@methiu/raigal 0.2.0 → 0.2.2

package/dist/cli.js

@@ -15,7 +15,7 @@ import YAML, { parse } from "yaml";
 import { confirm, isCancel, multiselect, select, text } from "@clack/prompts";
 import * as readline$1 from "node:readline";
 import readline from "node:readline";
-import micromatch from "micromatch";
+import picomatch from "picomatch";
 import ts from "typescript";
 import { parse as parse$1 } from "smol-toml";
 import { Writable } from "node:stream";
@@ -702,7 +702,7 @@ const highlightRaigal = (text, theme, baseToken) => {
 	const tail = text.slice(lastIndex);
 	return out + (baseToken ? style$1(theme, baseToken, tail) : tail);
 };
-const highlightAislop = highlightRaigal;
+const highlightAislop = (...args) => highlightRaigal(...args);
 //#endregion
 //#region src/ui/width.ts
 const ANSI_RE$1 = new RegExp(`\\[[0-9;]*m`, "g");
@@ -923,7 +923,7 @@ const createLogger = (deps = {}) => {
 const log = createLogger();
 //#endregion
 //#region src/version.ts
-const APP_VERSION = "0.2.0";
+const APP_VERSION = "0.2.2";
 //#endregion
 //#region src/commands/agent-connect.ts
 const commandText = (status) => [status.provider.loginCommand.command, ...status.provider.loginCommand.args].join(" ");
@@ -1422,7 +1422,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const claims = parsed.data;
 	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
 	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.2.0", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (!isVersionAtLeast("0.2.2", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -1536,6 +1536,10 @@ const handleEntitlementFetchError = (err, cached, cachedClaims, now) => {
 			nowSeconds: now,
 			allowGraceSeconds: GRACE_PERIOD_SECONDS
 		});
+		if (graceClaims.plan === "trial" && graceClaims.trial_ends_at && now > Math.floor(new Date(graceClaims.trial_ends_at).getTime() / 1e3)) {
+			clearCachedEntitlement();
+			throw new LicenceDeniedError("Organization trial has expired", "trial_expired");
+		}
 		return {
 			jwt: cached.entitlement,
 			claims: graceClaims,
@@ -1543,6 +1547,7 @@ const handleEntitlementFetchError = (err, cached, cachedClaims, now) => {
 			grace: now > graceClaims.exp
 		};
 	} catch (jwtErr) {
+		if (jwtErr instanceof LicenceDeniedError) throw jwtErr;
 		if (jwtErr instanceof JwtVerificationError && jwtErr.code === "expired_beyond_grace") throw new LicenceUnverifiableError(`Raigal license could not be verified online and the offline grace period expired on ${(/* @__PURE__ */ new Date((cachedClaims?.exp ?? 0) * 1e3)).toISOString()}. Check network connectivity or Raigal Cloud status.`);
 	}
 	throw new LicenceUnverifiableError(`Raigal license could not be verified online (${err instanceof Error ? err.message : String(err)}). Check network connectivity or Raigal Cloud status.`);
@@ -1557,7 +1562,8 @@ const getEntitlement = async () => {
 	} catch {
 		cachedClaims = null;
 	}
-	if (cached && cachedClaims && now < cached.refresh_after) return {
+	const isTrialExpired = cachedClaims?.plan === "trial" && cachedClaims.trial_ends_at && now > Math.floor(new Date(cachedClaims.trial_ends_at).getTime() / 1e3);
+	if (cached && cachedClaims && !isTrialExpired && now < cached.refresh_after) return {
 		jwt: cached.entitlement,
 		claims: cachedClaims,
 		fromCache: true
@@ -1566,7 +1572,7 @@ const getEntitlement = async () => {
 	if (!activeToken) {
 		oidcToken = await fetchGitHubOidcToken();
 		if (!oidcToken) {
-			if (cached && cachedClaims) return {
+			if (cached && cachedClaims && !isTrialExpired) return {
 				jwt: cached.entitlement,
 				claims: cachedClaims,
 				fromCache: true
@@ -1727,6 +1733,23 @@ const requireEntitlement = async (options = {}) => {
 	try {
 		const entitlement = await getEntitlement();
 		const tokenKind = getActiveToken()?.kind ?? "session";
+		if (entitlement.claims.plan === "trial" && entitlement.claims.trial_ends_at) {
+			const trialEnd = new Date(entitlement.claims.trial_ends_at).getTime();
+			if (Date.now() > trialEnd) {
+				const message = "Raigal license denied: Organization trial has expired";
+				if (mode === "throw") throw new LicenceDeniedError(message, "trial_expired");
+				if (mode === "fatal") {
+					process.stderr.write(`${message}\n`);
+					process.exit(30);
+				}
+				process.stderr.write(`[raigal] ${message}\n`);
+				return {
+					ok: false,
+					exitCode: 30,
+					message
+				};
+			}
+		}
 		const detectedOwner = detectLocalRepoOwner(directory);
 		if (options.repoOwner) detectedOwner.owner = options.repoOwner.toLowerCase();
 		const ownerCheck = checkOwnerAgainstAllowlist(detectedOwner, entitlement.claims.allowed_owners, tokenKind);
@@ -2026,267 +2049,6 @@ const renderBackgroundLaunch = (launch) => {
 	].join("\n")}`);
 };
 //#endregion
-//#region src/agents/prompt.ts
-const CONTEXT_LINES$1 = 3;
-const MAX_DIAGNOSTICS_PER_FILE$1 = 6;
-const MAX_FILES$1 = 12;
-const priority = (diagnostic) => {
-	if (diagnostic.severity === "error") return 0;
-	if (diagnostic.severity === "warning") return 1;
-	return 2;
-};
-const selectAgentFindings = (diagnostics, limit) => diagnostics.filter((diagnostic) => diagnostic.severity !== "info").sort((a, b) => {
-	const severityDelta = priority(a) - priority(b);
-	if (severityDelta !== 0) return severityDelta;
-	if (a.fixable !== b.fixable) return a.fixable ? 1 : -1;
-	return a.filePath.localeCompare(b.filePath);
-}).slice(0, Math.max(1, limit));
-const groupByFile$1 = (diagnostics) => {
-	const groups = /* @__PURE__ */ new Map();
-	for (const diagnostic of diagnostics) {
-		const list = groups.get(diagnostic.filePath) ?? [];
-		list.push(diagnostic);
-		groups.set(diagnostic.filePath, list);
-	}
-	return [...groups.entries()].map(([filePath, items]) => ({
-		filePath,
-		diagnostics: items
-	})).slice(0, MAX_FILES$1);
-};
-const snippetFor = (rootDirectory, diagnostic) => {
-	if (diagnostic.line <= 0 || diagnostic.redactSource || isSecretClassRule(diagnostic.rule)) return null;
-	const absolutePath = path.resolve(rootDirectory, diagnostic.filePath);
-	let content;
-	try {
-		content = fs.readFileSync(absolutePath, "utf-8");
-	} catch {
-		return null;
-	}
-	const lines = content.split("\n");
-	const start = Math.max(0, diagnostic.line - 1 - CONTEXT_LINES$1);
-	const end = Math.min(lines.length, diagnostic.line + CONTEXT_LINES$1);
-	const out = [];
-	for (let index = start; index < end; index += 1) {
-		const lineNumber = index + 1;
-		const marker = lineNumber === diagnostic.line ? ">" : " ";
-		out.push(`${marker} ${String(lineNumber).padStart(4)} | ${lines[index]}`);
-	}
-	return out.join("\n");
-};
-const buildRepairPrompt = (input) => {
-	const groups = groupByFile$1(input.findings);
-	const lines = [
-		"You are repairing AI slop findings in a local git worktree.",
-		"",
-		`Current raigal score: ${input.score == null ? "not scored" : `${input.score}/100`}`,
-		`Target score: ${input.targetScore}/100`,
-		`Turn budget: ${input.maxTurns}`,
-		"",
-		"Hard constraints:",
-		"- Make the smallest code changes that improve the findings below.",
-		"- Do not change public APIs, exports, database schemas, or test expectations unless a finding directly requires it.",
-		"- Do not delete tests.",
-		"- Do not add dependencies unless the existing project already clearly expects them.",
-		"- Never print, copy, commit, or echo secret values or credentials. Replace all hardcoded credentials and secrets with environment-variable references (e.g. process.env.KEY).",
-		"- If a finding looks like a false positive, leave the code alone and mention it in your final summary.",
-		"- Run the relevant local verification command if it is obvious and cheap.",
-		"",
-		"raigal findings to repair:",
-		""
-	];
-	for (const group of groups) {
-		lines.push(`## ${group.filePath}`);
-		for (const diagnostic of group.diagnostics.slice(0, MAX_DIAGNOSTICS_PER_FILE$1)) {
-			const location = diagnostic.line > 0 ? `:${diagnostic.line}` : "";
-			lines.push(`- ${diagnostic.severity.toUpperCase()} ${diagnostic.rule}${location}: ${diagnostic.message}`);
-			if (diagnostic.help) lines.push(`  Help: ${diagnostic.help}`);
-			const snippet = snippetFor(input.rootDirectory, diagnostic);
-			if (snippet) {
-				lines.push("```");
-				lines.push(snippet);
-				lines.push("```");
-			}
-		}
-		lines.push("");
-	}
-	if (input.findings.length === 0) lines.push("No findings were supplied. Inspect the codebase for obvious AI slop only if needed.");
-	lines.push("After editing, stop and summarize what changed and what you intentionally skipped.");
-	return maskSecrets(lines.join("\n"));
-};
-//#endregion
-//#region src/agents/publish.ts
-const defaultBranchSuffix = () => (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\..+$/, "").replace("T", "-");
-const normalizeBranchName = (raw) => {
-	const cleaned = raw.trim().replace(/[^A-Za-z0-9._/-]+/g, "-").replace(/\/+/g, "/").replace(/^-+|-+$/g, "").replace(/^\/+|\/+$/g, "");
-	return cleaned.length > 0 ? cleaned.slice(0, 120) : `raigal/agent-${defaultBranchSuffix()}`;
-};
-const defaultBranchName = () => `raigal/agent-${defaultBranchSuffix()}`;
-const runGit = async (cwd, args) => {
-	const result = await runSubprocess("git", args, {
-		cwd,
-		timeout: 9e4
-	});
-	if (result.exitCode !== 0) throw new Error(result.stderr || result.stdout || `git ${args.join(" ")} failed`);
-	return result.stdout;
-};
-const currentBranch = async (cwd) => {
-	const result = await runSubprocess("git", ["branch", "--show-current"], { cwd });
-	if (result.exitCode !== 0) return null;
-	return result.stdout.trim() || null;
-};
-const resolveBaseBranch = async (cwd, fallback) => {
-	if (fallback && fallback !== "HEAD") return fallback;
-	const cached = await runSubprocess("git", [
-		"symbolic-ref",
-		"refs/remotes/origin/HEAD",
-		"--short"
-	], { cwd });
-	if (cached.exitCode === 0 && cached.stdout.trim()) return cached.stdout.trim().replace(/^origin\//, "");
-	const remote = await runSubprocess("git", [
-		"remote",
-		"show",
-		"origin"
-	], {
-		cwd,
-		timeout: 3e4
-	});
-	if (remote.exitCode === 0) {
-		const branch = remote.stdout.split("\n").find((entry) => entry.trim().startsWith("HEAD branch:"))?.split(":").slice(1).join(":").trim();
-		if (branch) return branch;
-	}
-	return "main";
-};
-const ensureBranch = async (cwd, branch) => {
-	if (await currentBranch(cwd) === branch) return;
-	await runGit(cwd, [
-		"switch",
-		"-c",
-		branch
-	]);
-};
-const ensureGh = async () => {
-	if ((await runSubprocess("gh", ["--version"], { timeout: 1e4 })).exitCode !== 0) throw new Error("Creating a PR requires the GitHub CLI. Install and authenticate `gh`, then retry.");
-};
-const buildPrBody = (input) => {
-	const delta = input.beforeScore != null && input.afterScore != null ? input.afterScore - input.beforeScore : null;
-	const deltaStr = delta != null ? ` (${delta >= 0 ? `+${delta}` : delta})` : "";
-	const scoreStr = `${input.beforeScore ?? "not scored"} -> ${input.afterScore ?? "not scored"}${deltaStr}`;
-	let diffStatLine = `- Files changed: ${input.changedFiles.length}`;
-	if (typeof input.diffSummary === "string" && input.diffSummary.trim()) diffStatLine += ` (${input.diffSummary.trim()})`;
-	else if (input.diffSummary && typeof input.diffSummary === "object") {
-		const adds = input.diffSummary.additions ?? 0;
-		const dels = input.diffSummary.deletions ?? 0;
-		diffStatLine += ` (+${adds} -${dels})`;
-	}
-	const fixedFindingsSection = input.fixedFindings && input.fixedFindings.length > 0 ? [
-		"### Fixed findings",
-		"",
-		"| Rule | File | Message |",
-		"|---|---|---|",
-		...input.fixedFindings.slice(0, 10).map((f) => {
-			const loc = f.line ? `${f.path}:${f.line}` : f.path;
-			const msg = (f.message || "").replace(/\|/g, "\\|");
-			return `| \`${f.ruleId}\` | \`${loc}\` | ${msg} |`;
-		}),
-		input.fixedFindings.length > 10 ? `\n*...and ${input.fixedFindings.length - 10} more findings fixed.*` : "",
-		""
-	] : [];
-	return [
-		"This PR was generated locally by `raigal agent`.",
-		"",
-		"## Summary",
-		"",
-		`- Provider: ${input.providerId}`,
-		`- Score: ${scoreStr}`,
-		diffStatLine,
-		"",
-		...fixedFindingsSection,
-		"## Changed files",
-		"",
-		...input.changedFiles.map((file) => `- ${file}`),
-		"",
-		"## Verification",
-		"",
-		"- `raigal scan --json`",
-		"",
-		"Review before merging. The deterministic scan is the gate; the provider only proposed the patch."
-	].filter(Boolean).join("\n");
-};
-const publishAgentDiff = async (input) => {
-	if (!input.options.commit && !input.options.pr) return null;
-	if (input.changedFiles.length === 0) return null;
-	const branch = normalizeBranchName(input.options.branch ?? defaultBranchName());
-	await ensureBranch(input.cwd, branch);
-	await runGit(input.cwd, ["add", "-A"]);
-	if ((await runSubprocess("git", [
-		"diff",
-		"--cached",
-		"--quiet"
-	], { cwd: input.cwd })).exitCode === 0) return null;
-	await runGit(input.cwd, [
-		"commit",
-		"-m",
-		input.options.commitMessage,
-		"-m",
-		"Generated by raigal agent."
-	]);
-	const commitSha = (await runGit(input.cwd, [
-		"rev-parse",
-		"--short",
-		"HEAD"
-	])).trim();
-	if (!input.options.pr) return {
-		branch,
-		commitSha,
-		pushed: false,
-		prUrl: null
-	};
-	await ensureGh();
-	const base = input.options.base ?? await resolveBaseBranch(input.cwd, input.originalBranch);
-	await runGit(input.cwd, [
-		"push",
-		"-u",
-		"origin",
-		branch
-	]);
-	let diffSummary = input.diffSummary;
-	if (!diffSummary) {
-		const stat = await runSubprocess("git", [
-			"diff",
-			"--shortstat",
-			"HEAD~1"
-		], { cwd: input.cwd });
-		if (stat.exitCode === 0 && stat.stdout.trim()) diffSummary = stat.stdout.trim();
-	}
-	const args = [
-		"pr",
-		"create",
-		"--base",
-		base,
-		"--head",
-		branch,
-		"--title",
-		input.options.prTitle ?? input.options.commitMessage,
-		"--body",
-		buildPrBody({
-			...input,
-			diffSummary
-		})
-	];
-	if (!input.options.ready) args.push("--draft");
-	const pr = await runSubprocess("gh", args, {
-		cwd: input.cwd,
-		timeout: 9e4
-	});
-	if (pr.exitCode !== 0) throw new Error(pr.stderr || pr.stdout || "Failed to create pull request with gh.");
-	return {
-		branch,
-		commitSha,
-		pushed: true,
-		prUrl: pr.stdout.trim() || null
-	};
-};
-//#endregion
 //#region src/agents/session-activity.ts
 const createUsageTotals = () => ({
 	inputTokens: 0,
@@ -2693,6 +2455,239 @@ var AgentTui = class {
 	}
 };
 //#endregion
+//#region src/commands/agent-local-cli.ts
+const cliPath$1 = () => {
+	const arg = process.argv[1];
+	if (arg && fs.existsSync(arg)) return arg;
+	return path.resolve("dist/cli.js");
+};
+const runSelf = (args, cwd) => {
+	const result = spawnSync(process.execPath, [cliPath$1(), ...args], {
+		cwd,
+		encoding: "utf-8",
+		env: {
+			...process.env,
+			AISLOP_NO_TELEMETRY: "1",
+			AISLOP_NO_UPDATE_NOTIFIER: "1",
+			NO_COLOR: "1"
+		},
+		maxBuffer: 50 * 1024 * 1024
+	});
+	return {
+		exitCode: result.status,
+		stdout: result.stdout,
+		stderr: result.stderr
+	};
+};
+const scanJson = (cwd) => {
+	const result = runSelf([
+		"scan",
+		".",
+		"--json"
+	], cwd);
+	if (!result.stdout.trim()) throw new Error(result.stderr || "raigal scan did not produce JSON output.");
+	try {
+		return JSON.parse(result.stdout);
+	} catch (error) {
+		throw new Error(`Failed to parse raigal scan output: ${error instanceof Error ? error.message : String(error)}`);
+	}
+};
+const runSafeFix = (cwd) => {
+	const result = runSelf([
+		"fix",
+		".",
+		"--safe"
+	], cwd);
+	if (result.exitCode !== 0 && result.stderr.trim()) log.warn(result.stderr.trim().split("\n")[0] ?? "Safe fix reported a non-zero exit.");
+};
+const applyDiff = async (root, patch) => {
+	const child = spawnSync("git", [
+		"apply",
+		"--index",
+		"--whitespace=nowarn",
+		"-"
+	], {
+		cwd: root,
+		input: patch,
+		encoding: "utf-8",
+		maxBuffer: 50 * 1024 * 1024
+	});
+	if (child.status !== 0) throw new Error(child.stderr || child.stdout || "Failed to apply agent diff.");
+};
+//#endregion
+//#region src/agents/publish.ts
+const defaultBranchSuffix = () => (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\..+$/, "").replace("T", "-");
+const normalizeBranchName = (raw) => {
+	const cleaned = raw.trim().replace(/[^A-Za-z0-9._/-]+/g, "-").replace(/\/+/g, "/").replace(/^-+|-+$/g, "").replace(/^\/+|\/+$/g, "");
+	return cleaned.length > 0 ? cleaned.slice(0, 120) : `raigal/agent-${defaultBranchSuffix()}`;
+};
+const defaultBranchName = () => `raigal/agent-${defaultBranchSuffix()}`;
+const runGit = async (cwd, args) => {
+	const result = await runSubprocess("git", args, {
+		cwd,
+		timeout: 9e4
+	});
+	if (result.exitCode !== 0) throw new Error(result.stderr || result.stdout || `git ${args.join(" ")} failed`);
+	return result.stdout;
+};
+const currentBranch = async (cwd) => {
+	const result = await runSubprocess("git", ["branch", "--show-current"], { cwd });
+	if (result.exitCode !== 0) return null;
+	return result.stdout.trim() || null;
+};
+const resolveBaseBranch = async (cwd, fallback) => {
+	if (fallback && fallback !== "HEAD") return fallback;
+	const cached = await runSubprocess("git", [
+		"symbolic-ref",
+		"refs/remotes/origin/HEAD",
+		"--short"
+	], { cwd });
+	if (cached.exitCode === 0 && cached.stdout.trim()) return cached.stdout.trim().replace(/^origin\//, "");
+	const remote = await runSubprocess("git", [
+		"remote",
+		"show",
+		"origin"
+	], {
+		cwd,
+		timeout: 3e4
+	});
+	if (remote.exitCode === 0) {
+		const branch = remote.stdout.split("\n").find((entry) => entry.trim().startsWith("HEAD branch:"))?.split(":").slice(1).join(":").trim();
+		if (branch) return branch;
+	}
+	return "main";
+};
+const ensureBranch = async (cwd, branch) => {
+	if (await currentBranch(cwd) === branch) return;
+	await runGit(cwd, [
+		"switch",
+		"-c",
+		branch
+	]);
+};
+const ensureGh = async () => {
+	if ((await runSubprocess("gh", ["--version"], { timeout: 1e4 })).exitCode !== 0) throw new Error("Creating a PR requires the GitHub CLI. Install and authenticate `gh`, then retry.");
+};
+const buildPrBody = (input) => {
+	const delta = input.beforeScore != null && input.afterScore != null ? input.afterScore - input.beforeScore : null;
+	const deltaStr = delta != null ? ` (${delta >= 0 ? `+${delta}` : delta})` : "";
+	const scoreStr = `${input.beforeScore ?? "not scored"} -> ${input.afterScore ?? "not scored"}${deltaStr}`;
+	let diffStatLine = `- Files changed: ${input.changedFiles.length}`;
+	if (typeof input.diffSummary === "string" && input.diffSummary.trim()) diffStatLine += ` (${input.diffSummary.trim()})`;
+	else if (input.diffSummary && typeof input.diffSummary === "object") {
+		const adds = input.diffSummary.additions ?? 0;
+		const dels = input.diffSummary.deletions ?? 0;
+		diffStatLine += ` (+${adds} -${dels})`;
+	}
+	const fixedFindingsSection = input.fixedFindings && input.fixedFindings.length > 0 ? [
+		"### Fixed findings",
+		"",
+		"| Rule | File | Message |",
+		"|---|---|---|",
+		...input.fixedFindings.slice(0, 10).map((f) => {
+			const loc = f.line ? `${f.path}:${f.line}` : f.path;
+			const msg = (f.message || "").replace(/\|/g, "\\|");
+			return `| \`${f.ruleId}\` | \`${loc}\` | ${msg} |`;
+		}),
+		input.fixedFindings.length > 10 ? `\n*...and ${input.fixedFindings.length - 10} more findings fixed.*` : "",
+		""
+	] : [];
+	return [
+		"This PR was generated locally by `raigal agent`.",
+		"",
+		"## Summary",
+		"",
+		`- Provider: ${input.providerId}`,
+		`- Score: ${scoreStr}`,
+		diffStatLine,
+		"",
+		...fixedFindingsSection,
+		"## Changed files",
+		"",
+		...input.changedFiles.map((file) => `- ${file}`),
+		"",
+		"## Verification",
+		"",
+		"- `raigal scan --json`",
+		"",
+		"Review before merging. The deterministic scan is the gate; the provider only proposed the patch."
+	].filter(Boolean).join("\n");
+};
+const publishAgentDiff = async (input) => {
+	if (!input.options.commit && !input.options.pr) return null;
+	if (input.changedFiles.length === 0) return null;
+	const branch = normalizeBranchName(input.options.branch ?? defaultBranchName());
+	await ensureBranch(input.cwd, branch);
+	await runGit(input.cwd, ["add", "-A"]);
+	if ((await runSubprocess("git", [
+		"diff",
+		"--cached",
+		"--quiet"
+	], { cwd: input.cwd })).exitCode === 0) return null;
+	await runGit(input.cwd, [
+		"commit",
+		"-m",
+		input.options.commitMessage,
+		"-m",
+		"Generated by raigal agent."
+	]);
+	const commitSha = (await runGit(input.cwd, [
+		"rev-parse",
+		"--short",
+		"HEAD"
+	])).trim();
+	if (!input.options.pr) return {
+		branch,
+		commitSha,
+		pushed: false,
+		prUrl: null
+	};
+	await ensureGh();
+	const base = input.options.base ?? await resolveBaseBranch(input.cwd, input.originalBranch);
+	await runGit(input.cwd, [
+		"push",
+		"-u",
+		"origin",
+		branch
+	]);
+	let diffSummary = input.diffSummary;
+	if (!diffSummary) {
+		const stat = await runSubprocess("git", [
+			"diff",
+			"--shortstat",
+			"HEAD~1"
+		], { cwd: input.cwd });
+		if (stat.exitCode === 0 && stat.stdout.trim()) diffSummary = stat.stdout.trim();
+	}
+	const args = [
+		"pr",
+		"create",
+		"--base",
+		base,
+		"--head",
+		branch,
+		"--title",
+		input.options.prTitle ?? input.options.commitMessage,
+		"--body",
+		buildPrBody({
+			...input,
+			diffSummary
+		})
+	];
+	if (!input.options.ready) args.push("--draft");
+	const pr = await runSubprocess("gh", args, {
+		cwd: input.cwd,
+		timeout: 9e4
+	});
+	if (pr.exitCode !== 0) throw new Error(pr.stderr || pr.stdout || "Failed to create pull request with gh.");
+	return {
+		branch,
+		commitSha,
+		pushed: true,
+		prUrl: pr.stdout.trim() || null
+	};
+};
+//#endregion
 //#region src/cloud/context.ts
 const execGit = (args, cwd) => {
 	try {
@@ -2766,7 +2761,8 @@ const detectGitDiff = (directory, baseRef) => {
 			"HEAD~1"
 		], directory);
 		let diffPreview;
-		if (preview) diffPreview = preview.split("\n").slice(0, 40).join("\n").slice(0, 1e4);
+		const allowSnippets = process.env.RAIGAL_NO_SNIPPETS !== "true" && process.env.RAIGAL_PRIVACY_MODE !== "true";
+		if (preview && allowSnippets) diffPreview = preview.split("\n").slice(0, 40).join("\n").slice(0, 1e4);
 		return {
 			diffSummary,
 			diffPreview
@@ -2919,7 +2915,7 @@ const writeRunsToOutbox = (runs) => {
 		recursive: true,
 		mode: 448
 	});
-	let lines = runs.map((r) => JSON.stringify(r));
+	const lines = runs.map((r) => JSON.stringify(r));
 	let text = lines.length > 0 ? `${lines.join("\n")}\n` : "";
 	const maxBytes = getMaxOutboxBytes();
 	while (Buffer.byteLength(text, "utf-8") > maxBytes && lines.length > 1) {
@@ -2944,7 +2940,9 @@ const getLastRecordedRun = () => {
 	const runs = loadOutboxRuns();
 	return runs.length > 0 ? runs[runs.length - 1] ?? null : null;
 };
-const flushOutbox = async (token) => {
+const flushOutbox = async (optionsOrToken) => {
+	const token = typeof optionsOrToken === "string" ? optionsOrToken : optionsOrToken?.token;
+	const oidcToken = typeof optionsOrToken === "object" ? optionsOrToken?.oidcToken : void 0;
 	const runs = loadOutboxRuns();
 	if (runs.length === 0) return {
 		sent: 0,
@@ -2960,6 +2958,7 @@ const flushOutbox = async (token) => {
 			await requestApi("/v1/runs", {
 				method: "POST",
 				token,
+				oidcToken,
 				body: run,
 				timeoutMs: 4e3
 			});
@@ -3081,7 +3080,12 @@ var CloudRunRecorder = class {
 		try {
 			enqueueRun(this.buildRunPayload(exitCode));
 			const activeToken = getActiveToken();
-			if (activeToken) await flushOutbox(activeToken.token);
+			let oidcToken;
+			if (!activeToken) oidcToken = await fetchGitHubOidcToken();
+			if (activeToken || oidcToken) await flushOutbox({
+				token: activeToken?.token,
+				oidcToken
+			});
 		} catch {}
 	}
 };
@@ -3091,7 +3095,10 @@ const startRunRecorder = (command, directory, flags = []) => {
 	const recorder = new CloudRunRecorder(command, directory, flags);
 	activeRecorder = recorder;
 	const activeToken = getActiveToken();
-	if (activeToken) flushOutbox(activeToken.token).catch(() => {});
+	if (activeToken) flushOutbox({ token: activeToken.token }).catch(() => {});
+	else fetchGitHubOidcToken().then((oidcToken) => {
+		if (oidcToken) return flushOutbox({ oidcToken });
+	}).catch(() => {});
 	return recorder;
 };
 const finishActiveRecorder = async (exitCode = 0) => {
@@ -3102,64 +3109,185 @@ const finishActiveRecorder = async (exitCode = 0) => {
 	}
 };
 //#endregion
-//#region src/commands/agent-local-cli.ts
-const cliPath$1 = () => {
-	const arg = process.argv[1];
-	if (arg && fs.existsSync(arg)) return arg;
-	return path.resolve("dist/cli.js");
+//#region src/commands/agent-session-publish.ts
+const maybePublishAgentDiff = async ({ tui, session, options, changedFiles, worktreePath, originalBranch, providerId, before, after }) => {
+	if (changedFiles.length > 0 && (options.commit || options.pr)) {
+		tui.start(options.pr ? "Creating local branch and PR" : "Creating local commit");
+		session.append("publish.started", {
+			commit: options.commit,
+			pr: options.pr,
+			branch: options.branch,
+			base: options.base,
+			ready: options.ready
+		});
+		const afterKeys = new Set(after.diagnostics.map((d) => `${d.rule}:${d.filePath}:${d.line}`));
+		const fixedFindings = before.diagnostics.filter((d) => !afterKeys.has(`${d.rule}:${d.filePath}:${d.line}`)).map((d) => ({
+			ruleId: d.rule,
+			path: d.filePath,
+			line: d.line,
+			message: d.message
+		}));
+		const published = await publishAgentDiff({
+			cwd: worktreePath,
+			originalBranch,
+			providerId,
+			beforeScore: before.score,
+			afterScore: after.score,
+			changedFiles,
+			fixedFindings,
+			options: {
+				commit: options.commit,
+				pr: options.pr,
+				branch: options.branch,
+				base: options.base,
+				commitMessage: options.commitMessage,
+				prTitle: options.prTitle,
+				ready: options.ready
+			}
+		});
+		session.append(published ? "publish.finished" : "publish.skipped", { result: published });
+		tui.complete({
+			status: published ? "done" : "skipped",
+			label: published?.prUrl ? `Opened PR ${published.prUrl}` : published ? `Committed ${published.commitSha}` : "No commit created"
+		});
+		return published;
+	}
+	if (options.commit || options.pr) session.append("publish.skipped", {
+		reason: "no_changed_files",
+		commit: options.commit,
+		pr: options.pr
+	});
+	return null;
 };
-const runSelf = (args, cwd) => {
-	const result = spawnSync(process.execPath, [cliPath$1(), ...args], {
-		cwd,
-		encoding: "utf-8",
-		env: {
-			...process.env,
-			AISLOP_NO_TELEMETRY: "1",
-			AISLOP_NO_UPDATE_NOTIFIER: "1",
-			NO_COLOR: "1"
-		},
-		maxBuffer: 50 * 1024 * 1024
+const recordAgentSessionTelemetry = ({ worktreePath, published, branchOption, providerId, beforeScore, afterScore, targetScore, durationMs, changedFilesCount }) => {
+	const recorder = getActiveRecorder();
+	if (!recorder) return;
+	let patchDiff;
+	if (worktreePath) try {
+		patchDiff = (spawnSync("git", [
+			"diff",
+			"-U2",
+			"--no-color",
+			"HEAD"
+		], {
+			cwd: worktreePath,
+			encoding: "utf-8"
+		}).stdout || "").slice(0, 2e4) || void 0;
+	} catch {}
+	if (published) {
+		const prMatch = published.prUrl?.match(/\/pull\/(\d+)/);
+		const prNumber = prMatch ? Number.parseInt(prMatch[1], 10) : void 0;
+		recorder.setGitContext({
+			branch: published.branch,
+			pr_number: prNumber
+		});
+	} else if (branchOption) recorder.setGitContext({ branch: branchOption });
+	const agentTelemetry = {
+		provider: providerId,
+		before_score: beforeScore,
+		after_score: afterScore,
+		pr_url: published?.prUrl || void 0,
+		patch_diff: patchDiff,
+		duration_ms: durationMs
+	};
+	recorder.setAgentTelemetry(agentTelemetry);
+	recorder.recordStep("agent:baseline", 50, true);
+	recorder.recordStep("agent:verify", durationMs, afterScore !== null && afterScore >= targetScore);
+	recorder.setReport({
+		score: afterScore,
+		scoreable: true,
+		files_scanned: changedFilesCount,
+		findings: [],
+		agent_telemetry: agentTelemetry
 	});
-	return {
-		exitCode: result.status,
-		stdout: result.stdout,
-		stderr: result.stderr
-	};
 };
-const scanJson = (cwd) => {
-	const result = runSelf([
-		"scan",
-		".",
-		"--json"
-	], cwd);
-	if (!result.stdout.trim()) throw new Error(result.stderr || "raigal scan did not produce JSON output.");
-	try {
-		return JSON.parse(result.stdout);
-	} catch (error) {
-		throw new Error(`Failed to parse raigal scan output: ${error instanceof Error ? error.message : String(error)}`);
+//#endregion
+//#region src/agents/prompt.ts
+const CONTEXT_LINES$1 = 3;
+const MAX_DIAGNOSTICS_PER_FILE$1 = 6;
+const MAX_FILES$1 = 12;
+const priority = (diagnostic) => {
+	if (diagnostic.severity === "error") return 0;
+	if (diagnostic.severity === "warning") return 1;
+	return 2;
+};
+const selectAgentFindings = (diagnostics, limit) => diagnostics.filter((diagnostic) => diagnostic.severity !== "info").sort((a, b) => {
+	const severityDelta = priority(a) - priority(b);
+	if (severityDelta !== 0) return severityDelta;
+	if (a.fixable !== b.fixable) return a.fixable ? 1 : -1;
+	return a.filePath.localeCompare(b.filePath);
+}).slice(0, Math.max(1, limit));
+const groupByFile$1 = (diagnostics) => {
+	const groups = /* @__PURE__ */ new Map();
+	for (const diagnostic of diagnostics) {
+		const list = groups.get(diagnostic.filePath) ?? [];
+		list.push(diagnostic);
+		groups.set(diagnostic.filePath, list);
 	}
+	return [...groups.entries()].map(([filePath, items]) => ({
+		filePath,
+		diagnostics: items
+	})).slice(0, MAX_FILES$1);
 };
-const runSafeFix = (cwd) => {
-	const result = runSelf([
-		"fix",
-		".",
-		"--safe"
-	], cwd);
-	if (result.exitCode !== 0 && result.stderr.trim()) log.warn(result.stderr.trim().split("\n")[0] ?? "Safe fix reported a non-zero exit.");
+const snippetFor = (rootDirectory, diagnostic) => {
+	if (diagnostic.line <= 0 || diagnostic.redactSource || isSecretClassRule(diagnostic.rule)) return null;
+	const absolutePath = path.resolve(rootDirectory, diagnostic.filePath);
+	let content;
+	try {
+		content = fs.readFileSync(absolutePath, "utf-8");
+	} catch {
+		return null;
+	}
+	const lines = content.split("\n");
+	const start = Math.max(0, diagnostic.line - 1 - CONTEXT_LINES$1);
+	const end = Math.min(lines.length, diagnostic.line + CONTEXT_LINES$1);
+	const out = [];
+	for (let index = start; index < end; index += 1) {
+		const lineNumber = index + 1;
+		const marker = lineNumber === diagnostic.line ? ">" : " ";
+		out.push(`${marker} ${String(lineNumber).padStart(4)} | ${lines[index]}`);
+	}
+	return out.join("\n");
 };
-const applyDiff = async (root, patch) => {
-	const child = spawnSync("git", [
-		"apply",
-		"--index",
-		"--whitespace=nowarn",
-		"-"
-	], {
-		cwd: root,
-		input: patch,
-		encoding: "utf-8",
-		maxBuffer: 50 * 1024 * 1024
-	});
-	if (child.status !== 0) throw new Error(child.stderr || child.stdout || "Failed to apply agent diff.");
+const buildRepairPrompt = (input) => {
+	const groups = groupByFile$1(input.findings);
+	const lines = [
+		"You are repairing AI slop findings in a local git worktree.",
+		"",
+		`Current raigal score: ${input.score == null ? "not scored" : `${input.score}/100`}`,
+		`Target score: ${input.targetScore}/100`,
+		`Turn budget: ${input.maxTurns}`,
+		"",
+		"Hard constraints:",
+		"- Make the smallest code changes that improve the findings below.",
+		"- Do not change public APIs, exports, database schemas, or test expectations unless a finding directly requires it.",
+		"- Do not delete tests.",
+		"- Do not add dependencies unless the existing project already clearly expects them.",
+		"- Never print, copy, commit, or echo secret values or credentials. Replace all hardcoded credentials and secrets with environment-variable references (e.g. process.env.KEY).",
+		"- If a finding looks like a false positive, leave the code alone and mention it in your final summary.",
+		"- Run the relevant local verification command if it is obvious and cheap.",
+		"",
+		"raigal findings to repair:",
+		""
+	];
+	for (const group of groups) {
+		lines.push(`## ${group.filePath}`);
+		for (const diagnostic of group.diagnostics.slice(0, MAX_DIAGNOSTICS_PER_FILE$1)) {
+			const location = diagnostic.line > 0 ? `:${diagnostic.line}` : "";
+			lines.push(`- ${diagnostic.severity.toUpperCase()} ${diagnostic.rule}${location}: ${diagnostic.message}`);
+			if (diagnostic.help) lines.push(`  Help: ${diagnostic.help}`);
+			const snippet = snippetFor(input.rootDirectory, diagnostic);
+			if (snippet) {
+				lines.push("```");
+				lines.push(snippet);
+				lines.push("```");
+			}
+		}
+		lines.push("");
+	}
+	if (input.findings.length === 0) lines.push("No findings were supplied. Inspect the codebase for obvious AI slop only if needed.");
+	lines.push("After editing, stop and summarize what changed and what you intentionally skipped.");
+	return maskSecrets(lines.join("\n"));
 };
 //#endregion
 //#region src/agents/provider-metadata.ts
@@ -3614,6 +3742,52 @@ const maybeApplyDiff = async (input) => {
 	await applyDiff(input.originalRoot, await readBinaryDiff(input.worktreePath));
 	return true;
 };
+const resolveAgentSessionCwd = (created, requestedDirectory) => {
+	const relative = path.relative(created.state.root, requestedDirectory);
+	const outsideRoot = relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative);
+	if (relative.length === 0 || outsideRoot) return created.worktree.path;
+	return path.resolve(created.worktree.path, relative);
+};
+const prepareWorktree = async (tui, resolvedDir, options) => {
+	tui.start("Preparing local session");
+	const created = await createAgentWorktree(resolvedDir, { inPlace: options.inPlace });
+	tui.setMetric("Worktree", created.worktree.created ? path.relative(created.state.root, created.worktree.path) : "current");
+	tui.complete({
+		status: "done",
+		label: created.worktree.created ? `Created worktree ${path.relative(created.state.root, created.worktree.path)}` : "Using current worktree"
+	});
+	return created;
+};
+const scanBaseline = (tui, cwd) => {
+	tui.start("Scanning baseline");
+	const scan = scanJson(cwd);
+	tui.setMetric("Score", `${scan.score ?? "not scored"} -> ...`);
+	tui.setMetric("Findings", scan.diagnostics.length);
+	tui.complete({
+		status: scan.summary.errors > 0 ? "warn" : "done",
+		label: `Baseline ${scan.score ?? "not scored"} / 100 · ${scan.diagnostics.length} findings`
+	});
+	return scan;
+};
+const runSafeFixStep = (tui, cwd, options) => {
+	if (options.noFix) return;
+	tui.start("Applying deterministic safe fixes");
+	runSafeFix(cwd);
+	tui.complete({
+		status: "done",
+		label: "Safe fixer finished"
+	});
+};
+const selectFindings = (tui, cwd, limit, pass) => {
+	tui.start(`Pass ${pass}: selecting findings`);
+	const findings = selectAgentFindings(scanJson(cwd).diagnostics, limit);
+	tui.setMetric("Selected", findings.length);
+	tui.complete({
+		status: findings.length > 0 ? "done" : "skipped",
+		label: findings.length > 0 ? `Pass ${pass}: selected ${findings.length} finding${findings.length === 1 ? "" : "s"}` : "No remaining agent findings"
+	});
+	return findings;
+};
 //#endregion
 //#region src/utils/paths.ts
 /** Normalize an OS path to forward-slash (POSIX) separators. */
@@ -3749,52 +3923,6 @@ const printAgentSessionSummary = (input) => {
 //#endregion
 //#region src/commands/agent-session.ts
 const scoreDelta = (before, after) => typeof before === "number" && typeof after === "number" ? after - before : void 0;
-const resolveAgentSessionCwd = (created, requestedDirectory) => {
-	const relative = path.relative(created.state.root, requestedDirectory);
-	const outsideRoot = relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative);
-	if (relative.length === 0 || outsideRoot) return created.worktree.path;
-	return path.resolve(created.worktree.path, relative);
-};
-const prepareWorktree = async (tui, resolvedDir, options) => {
-	tui.start("Preparing local session");
-	const created = await createAgentWorktree(resolvedDir, { inPlace: options.inPlace });
-	tui.setMetric("Worktree", created.worktree.created ? path.relative(created.state.root, created.worktree.path) : "current");
-	tui.complete({
-		status: "done",
-		label: created.worktree.created ? `Created worktree ${path.relative(created.state.root, created.worktree.path)}` : "Using current worktree"
-	});
-	return created;
-};
-const scanBaseline = (tui, cwd) => {
-	tui.start("Scanning baseline");
-	const scan = scanJson(cwd);
-	tui.setMetric("Score", `${scan.score ?? "not scored"} -> ...`);
-	tui.setMetric("Findings", scan.diagnostics.length);
-	tui.complete({
-		status: scan.summary.errors > 0 ? "warn" : "done",
-		label: `Baseline ${scan.score ?? "not scored"} / 100 · ${scan.diagnostics.length} findings`
-	});
-	return scan;
-};
-const runSafeFixStep = (tui, cwd, options) => {
-	if (options.noFix) return;
-	tui.start("Applying deterministic safe fixes");
-	runSafeFix(cwd);
-	tui.complete({
-		status: "done",
-		label: "Safe fixer finished"
-	});
-};
-const selectFindings = (tui, cwd, limit, pass) => {
-	tui.start(`Pass ${pass}: selecting findings`);
-	const findings = selectAgentFindings(scanJson(cwd).diagnostics, limit);
-	tui.setMetric("Selected", findings.length);
-	tui.complete({
-		status: findings.length > 0 ? "done" : "skipped",
-		label: findings.length > 0 ? `Pass ${pass}: selected ${findings.length} finding${findings.length === 1 ? "" : "s"}` : "No remaining agent findings"
-	});
-	return findings;
-};
 const runAgentSession = async (selected, resolvedDir, options, started) => {
 	const tui = new AgentTui({
 		provider: selected.provider.label,
@@ -3959,49 +4087,16 @@ const runAgentSession = async (selected, resolvedDir, options, started) => {
 			applyRequested: options.apply,
 			changedFiles: changedFiles.length
 		});
-		if (changedFiles.length > 0 && (options.commit || options.pr)) {
-			tui.start(options.pr ? "Creating local branch and PR" : "Creating local commit");
-			session.append("publish.started", {
-				commit: options.commit,
-				pr: options.pr,
-				branch: options.branch,
-				base: options.base,
-				ready: options.ready
-			});
-			const afterKeys = new Set(verified.after.diagnostics.map((d) => `${d.rule}:${d.filePath}:${d.line}`));
-			const fixedFindings = before.diagnostics.filter((d) => !afterKeys.has(`${d.rule}:${d.filePath}:${d.line}`)).map((d) => ({
-				ruleId: d.rule,
-				path: d.filePath,
-				line: d.line,
-				message: d.message
-			}));
-			published = await publishAgentDiff({
-				cwd: created.worktree.path,
-				originalBranch: created.state.branch,
-				providerId: selected.provider.id,
-				beforeScore: before.score,
-				afterScore: verified.after.score,
-				changedFiles,
-				fixedFindings,
-				options: {
-					commit: options.commit,
-					pr: options.pr,
-					branch: options.branch,
-					base: options.base,
-					commitMessage: options.commitMessage,
-					prTitle: options.prTitle,
-					ready: options.ready
-				}
-			});
-			session.append(published ? "publish.finished" : "publish.skipped", { result: published });
-			tui.complete({
-				status: published ? "done" : "skipped",
-				label: published?.prUrl ? `Opened PR ${published.prUrl}` : published ? `Committed ${published.commitSha}` : "No commit created"
-			});
-		} else if (options.commit || options.pr) session.append("publish.skipped", {
-			reason: "no_changed_files",
-			commit: options.commit,
-			pr: options.pr
+		published = await maybePublishAgentDiff({
+			tui,
+			session,
+			options,
+			changedFiles,
+			worktreePath: created.worktree.path,
+			originalBranch: created.state.branch,
+			providerId: selected.provider.id,
+			before,
+			after: verified.after
 		});
 		session.append("session.completed", {
 			durationMs: Math.round(performance.now() - started),
@@ -4017,47 +4112,17 @@ const runAgentSession = async (selected, resolvedDir, options, started) => {
 			published: Boolean(published)
 		});
 		await tui.finish({ footer: `Done · ${selected.provider.id} · ${Math.round(performance.now() - started)}ms` });
-		const recorder = getActiveRecorder();
-		if (recorder) {
-			let patchDiff;
-			if (created?.worktree?.path) try {
-				patchDiff = (spawnSync("git", [
-					"diff",
-					"-U2",
-					"--no-color",
-					"HEAD"
-				], {
-					cwd: created.worktree.path,
-					encoding: "utf-8"
-				}).stdout || "").slice(0, 2e4) || void 0;
-			} catch {}
-			if (published) {
-				const prMatch = published.prUrl?.match(/\/pull\/(\d+)/);
-				const prNumber = prMatch ? Number.parseInt(prMatch[1], 10) : void 0;
-				recorder.setGitContext({
-					branch: published.branch,
-					pr_number: prNumber
-				});
-			} else if (options.branch) recorder.setGitContext({ branch: options.branch });
-			const agentTelemetry = {
-				provider: selected.provider.id,
-				before_score: before.score,
-				after_score: verified.after.score,
-				pr_url: published?.prUrl || void 0,
-				patch_diff: patchDiff,
-				duration_ms: Math.round(performance.now() - started)
-			};
-			recorder.setAgentTelemetry(agentTelemetry);
-			recorder.recordStep("agent:baseline", 50, true);
-			recorder.recordStep("agent:verify", Math.round(performance.now() - started), verified.after.score !== null && verified.after.score >= options.targetScore);
-			recorder.setReport({
-				score: verified.after.score,
-				scoreable: true,
-				files_scanned: changedFiles.length,
-				findings: [],
-				agent_telemetry: agentTelemetry
-			});
-		}
+		recordAgentSessionTelemetry({
+			worktreePath: created?.worktree?.path,
+			published,
+			branchOption: options.branch,
+			providerId: selected.provider.id,
+			beforeScore: before.score,
+			afterScore: verified.after.score,
+			targetScore: options.targetScore,
+			durationMs: Math.round(performance.now() - started),
+			changedFilesCount: changedFiles.length
+		});
 		printAgentSessionSummary({
 			before,
 			after: verified.after,
@@ -4704,7 +4769,8 @@ const DEFAULT_CONFIG = {
 		format: "json"
 	},
 	telemetry: { enabled: true },
-	rules: {}
+	rules: {},
+	overrides: []
 };
 const GITHUB_WORKFLOW_DIR = ".github/workflows";
 const GITHUB_WORKFLOW_FILE = "raigal.yml";
@@ -4934,6 +5000,16 @@ const RuleSeverityOverride = z.enum([
 	"off"
 ]);
 const RulesSchema = z.record(z.string(), RuleSeverityOverride).default(() => ({}));
+const FileOverrideSchema = z.object({
+	files: z.array(z.string().min(1)).min(1),
+	quality: z.object({
+		maxFunctionLoc: QualitySchema.shape.maxFunctionLoc.unwrap().optional(),
+		maxFileLoc: QualitySchema.shape.maxFileLoc.unwrap().optional(),
+		maxNesting: QualitySchema.shape.maxNesting.unwrap().optional(),
+		maxParams: QualitySchema.shape.maxParams.unwrap().optional()
+	}).optional(),
+	rules: z.record(z.string(), RuleSeverityOverride).optional()
+});
 const AislopConfigSchema = z.object({
 	version: z.number().default(1),
 	extends: z.union([z.string(), z.array(z.string())]).optional(),
@@ -4989,6 +5065,7 @@ const AislopConfigSchema = z.object({
 	})),
 	telemetry: TelemetrySchema.default(() => ({ enabled: true })),
 	rules: RulesSchema,
+	overrides: z.array(FileOverrideSchema).default(() => []),
 	exclude: z.array(z.string()).default(() => [
 		"node_modules",
 		".git",
@@ -5360,6 +5437,10 @@ const SAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set([
 	"exit_code",
 	"duration_ms",
 	"error_kind",
+	"error_name",
+	"error_code",
+	"failed_stage",
+	"engines_failed",
 	"score",
 	"score_bucket",
 	"finding_count",
@@ -5615,6 +5696,8 @@ const buildCommandCompletedProps = (input) => {
 	if (typeof input.fixSteps === "number") props.fix_steps = input.fixSteps;
 	if (typeof input.fixResolved === "number") props.fix_resolved = input.fixResolved;
 	if (typeof input.fixScoreDelta === "number") props.fix_score_delta = input.fixScoreDelta;
+	if (input.errorName) props.error_name = input.errorName;
+	if (input.errorCode) props.error_code = input.errorCode;
 	return props;
 };
 const buildHookScanCompletedProps = (input) => {
@@ -5635,6 +5718,50 @@ const errorKindFromException = (error) => {
 	if (message.includes("engine") && message.includes("crash")) return "engine_crash";
 	return "unknown";
 };
+const SAFE_ERROR_NAME = /^[A-Za-z_$][A-Za-z0-9_$]{0,39}$/;
+const SAFE_ERROR_CODE = /^[A-Za-z][A-Za-z0-9_]{0,39}$/;
+const errorIdentity = (error) => {
+	let name;
+	if (error instanceof Error && typeof error.name === "string" && error.name.length > 0) name = error.name;
+	else if (error === null) name = "null";
+	else if (typeof error === "object") name = "object";
+	else name = typeof error;
+	const identity = { error_name: SAFE_ERROR_NAME.test(name) ? name : "Error" };
+	const code = error?.code;
+	if (typeof code === "string" && SAFE_ERROR_CODE.test(code)) identity.error_code = code;
+	else if (typeof code === "number" && Number.isFinite(code)) identity.error_code = String(code);
+	return identity;
+};
+const buildCommandFailedProps = (input) => {
+	const props = {
+		failed_stage: input.stage,
+		...errorIdentity(input.error)
+	};
+	if (input.command) props.command = input.command;
+	return props;
+};
+//#endregion
+//#region src/telemetry/fatal.ts
+const reportedErrors = /* @__PURE__ */ new Set();
+let activeTelemetryConfig;
+const markErrorReported = (error) => {
+	reportedErrors.add(error);
+};
+const rememberTelemetryConfig = (config) => {
+	activeTelemetryConfig = config;
+};
+const reportFatalError = async (error, stage, config) => {
+	if (reportedErrors.has(error)) return;
+	track({
+		event: "cli_command_failed",
+		properties: buildCommandFailedProps({
+			error,
+			stage
+		}),
+		config: activeTelemetryConfig ?? config
+	});
+	await flushTelemetry(2e3);
+};
 //#endregion
 //#region src/telemetry/lifecycle.ts
 const STARTED_FLUSH_TIMEOUT_MS = 100;
@@ -5645,6 +5772,7 @@ const withCommandLifecycle = async (start, run) => {
 		fileCount: start.fileCount,
 		properties: start.properties
 	});
+	rememberTelemetryConfig(start.config);
 	track({
 		event: "cli_command_started",
 		properties: startProps,
@@ -5661,6 +5789,7 @@ const withCommandLifecycle = async (start, run) => {
 				startProps,
 				exitCode: result.exitCode,
 				durationMs,
+				errorKind: result.errorKind,
 				score: result.score ?? void 0,
 				findingCount: result.findingCount,
 				errorCount: result.errorCount,
@@ -5678,16 +5807,21 @@ const withCommandLifecycle = async (start, run) => {
 		await flushTelemetry();
 		return result;
 	} catch (error) {
+		const durationMs = performance.now() - startedAt;
+		const identity = errorIdentity(error);
 		track({
 			event: "cli_command_completed",
 			properties: buildCommandCompletedProps({
 				startProps,
 				exitCode: 1,
-				durationMs: performance.now() - startedAt,
-				errorKind: errorKindFromException(error)
+				durationMs,
+				errorKind: errorKindFromException(error),
+				errorName: identity.error_name,
+				errorCode: identity.error_code
 			}),
 			config: start.config
 		});
+		markErrorReported(error);
 		await flushTelemetry();
 		throw error;
 	}
@@ -6849,6 +6983,13 @@ const registerAgentMonitorSubcommands = (agent) => {
 	registerMonitorStopCommand(monitor);
 };
 //#endregion
+//#region src/ui/prompts.ts
+const runCancellable = async (fn) => {
+	const value = await fn();
+	if (isCancel(value)) return void 0;
+	return value;
+};
+//#endregion
 //#region src/commands/agent-apply.ts
 const asString = (value) => typeof value === "string" && value.length > 0 ? value : null;
 const isInside = (base, target) => {
@@ -7909,7 +8050,11 @@ const whoamiCommand = async () => {
 	process.stdout.write(`  Organization:     ${orgName} (${orgId})\n`);
 	if (userEmail) process.stdout.write(`  User:             ${userEmail}\n`);
 	process.stdout.write(`  Credential:       ${active.kind === "api_key" ? "Org API Key" : "User Session"} (via ${active.source})\n`);
-	process.stdout.write(`  Plan:             ${plan}${trialEnd ? ` (trial ends ${trialEnd})` : ""}\n`);
+	let planDisplay = plan;
+	if (plan === "active") planDisplay = "active (enterprise license)";
+	else if (plan === "expired") planDisplay = `expired${trialEnd ? ` (trial ended ${trialEnd})` : ""}`;
+	else if (trialEnd) planDisplay = `trial (trial ends ${trialEnd})`;
+	process.stdout.write(`  Plan:             ${planDisplay}\n`);
 	process.stdout.write(`  Allowed Owners:   ${owners || "none"}\n`);
 	if (claims) {
 		const expDate = (/* @__PURE__ */ new Date(claims.exp * 1e3)).toISOString();
@@ -8107,6 +8252,132 @@ const acquireHookLock = (cwd) => {
 		} catch {}
 	};
 };
+//#endregion
+//#region src/utils/globs.ts
+const MAX_BRACE_EXPANSIONS = 256;
+const braceListAt = (pattern, start) => {
+	let depth = 0;
+	const commas = [];
+	for (let i = start; i < pattern.length; i += 1) {
+		const char = pattern[i];
+		if (char === "\\") i += 1;
+		else if (char === "{") depth += 1;
+		else if (char === ",") {
+			if (depth === 1) commas.push(i);
+		} else if (char === "}") {
+			depth -= 1;
+			if (depth === 0) return commas.length > 0 ? {
+				start,
+				end: i,
+				commas
+			} : null;
+		}
+	}
+	return null;
+};
+const findBraceList = (pattern) => {
+	for (let start = pattern.indexOf("{"); start !== -1; start = pattern.indexOf("{", start + 1)) {
+		if (start > 0 && pattern[start - 1] === "\\") continue;
+		const list = braceListAt(pattern, start);
+		if (list) return list;
+	}
+	return null;
+};
+const expandInto = (pattern, results) => {
+	const list = findBraceList(pattern);
+	if (!list) {
+		results.push(pattern);
+		return results.length <= MAX_BRACE_EXPANSIONS;
+	}
+	const bounds = [
+		list.start,
+		...list.commas,
+		list.end
+	];
+	const prefix = pattern.slice(0, list.start);
+	const suffix = pattern.slice(list.end + 1);
+	for (let i = 0; i < bounds.length - 1; i += 1) {
+		const option = pattern.slice(bounds[i] + 1, bounds[i + 1]);
+		if (!expandInto(`${prefix}${option}${suffix}`, results)) return false;
+	}
+	return true;
+};
+const expandBraceLists = (pattern) => {
+	const results = [];
+	return expandInto(pattern, results) ? results : [pattern];
+};
+const isNegated = (pattern) => picomatch.scan(pattern).negated;
+const matchesGlobList = (value, patterns, options = {}) => {
+	const expanded = patterns.flatMap(expandBraceLists);
+	const positives = expanded.filter((pattern) => !isNegated(pattern));
+	const negatives = expanded.filter(isNegated).map((pattern) => pattern.slice(1));
+	const included = positives.length === 0 || picomatch.isMatch(value, positives, options);
+	const excluded = negatives.length > 0 && picomatch.isMatch(value, negatives, options);
+	return included && !excluded;
+};
+//#endregion
+//#region src/scoring/rule-severity.ts
+/**
+* Apply per-rule severity overrides from config: "off" drops the diagnostic,
+* "error"/"warning" rewrite its severity before scoring and rendering.
+*/
+const applyRuleSeverities = (diagnostics, overrides) => {
+	if (Object.keys(overrides).length === 0) return diagnostics;
+	const result = [];
+	for (const diagnostic of diagnostics) {
+		const override = overrides[diagnostic.rule];
+		if (!override) {
+			result.push(diagnostic);
+			continue;
+		}
+		if (override === "off") continue;
+		result.push(override === diagnostic.severity ? diagnostic : {
+			...diagnostic,
+			severity: override
+		});
+	}
+	return result;
+};
+//#endregion
+//#region src/config/overrides.ts
+const overrideRelativePath = (rootDirectory, filePath) => {
+	const paths = path.win32.isAbsolute(rootDirectory) && !path.posix.isAbsolute(rootDirectory) ? path.win32 : path.posix;
+	const root = rootDirectory.replaceAll("\\", "/");
+	const file = filePath.replaceAll("\\", "/");
+	return paths.normalize(paths.isAbsolute(file) ? paths.relative(root, file) : file).replaceAll("\\", "/");
+};
+const matchesEntry = (relativePath, patterns) => matchesGlobList(relativePath, patterns, { dot: true });
+const resolveFilePolicy = (config, relativePath) => {
+	let quality = config.quality;
+	let rules = config.rules ?? {};
+	if (relativePath === ".." || relativePath.startsWith("../") || path.win32.isAbsolute(relativePath)) return {
+		quality,
+		rules
+	};
+	for (const entry of config.overrides ?? []) {
+		if (!matchesEntry(relativePath, entry.files)) continue;
+		if (entry.quality) quality = {
+			...quality,
+			...entry.quality
+		};
+		if (entry.rules) rules = {
+			...rules,
+			...entry.rules
+		};
+	}
+	return {
+		quality,
+		rules
+	};
+};
+const applyFileOverrides = (diagnostics, context) => {
+	if (!context.config.overrides?.length) return diagnostics;
+	return diagnostics.flatMap((diagnostic) => {
+		const relativePath = overrideRelativePath(context.rootDirectory, diagnostic.filePath);
+		const { rules } = resolveFilePolicy(context.config, relativePath);
+		return applyRuleSeverities([diagnostic], rules);
+	});
+};
 const supportedGlobPatterns = (patterns) => patterns.filter((pattern) => pattern.length <= 256);
 const normalizeExcludePatterns = (patterns) => patterns.flatMap((pattern) => {
 	const trimmed = pattern.trim();
@@ -8116,13 +8387,13 @@ const normalizeExcludePatterns = (patterns) => patterns.flatMap((pattern) => {
 	const normalized = withoutProjectPrefix.slice(0, end);
 	if (normalized.length === 0) return [];
 	if (normalized.length > 256) return [];
-	if (micromatch.scan(normalized).isGlob) return [normalized];
+	if (picomatch.scan(normalized).isGlob) return [normalized];
 	if (normalized.startsWith(".") && !normalized.includes("/")) return supportedGlobPatterns([`**/${normalized}`, `**/${normalized}/**`]);
 	return supportedGlobPatterns([normalized, `${normalized}/**`]);
 });
 const isPathExcluded = (relativePath, normalizedPatterns) => {
 	if (normalizedPatterns.length === 0) return false;
-	return micromatch.isMatch(relativePath, normalizedPatterns, { dot: true });
+	return picomatch.isMatch(relativePath, normalizedPatterns, { dot: true });
 };
 const filterExcludedDiagnostics = (diagnostics, rootDirectory, excludePatterns) => {
 	if (!excludePatterns || excludePatterns.length === 0) return diagnostics;
@@ -8189,7 +8460,7 @@ const isRootBoundedTarget = (candidate, rootDirectory) => {
 };
 //#endregion
 //#region src/utils/aislop-ignore.ts
-const readRaigalIgnorePatterns = (rootDirectory) => {
+const readAislopIgnorePatterns = (rootDirectory) => {
 	const patterns = [];
 	for (const fileName of [".raigalignore", ".aislopignore"]) {
 		const targetPath = safeProjectFilePath(path.join(rootDirectory, fileName), rootDirectory);
@@ -8200,7 +8471,6 @@ const readRaigalIgnorePatterns = (rootDirectory) => {
 	}
 	return patterns;
 };
-const readAislopIgnorePatterns = readRaigalIgnorePatterns;
 //#endregion
 //#region src/utils/generated-files.ts
 const AUTO_GENERATED_PATTERNS = [
@@ -8559,12 +8829,13 @@ const normalizeIncludePatterns = (patterns) => patterns.flatMap((pattern) => {
 	const normalized = pattern.trim().replace(/^\.\//, "").replace(/\/$/, "");
 	if (normalized === "" || normalized === ".") return ["**"];
 	if (normalized.length > 256) return [];
-	if (micromatch.scan(normalized).isGlob) return [normalized];
+	if (picomatch.scan(normalized).isGlob) return [normalized];
 	return supportedGlobPatterns([normalized, `${normalized}/**`]);
 });
 const createPathMatcher = (patterns) => {
-	const matchers = patterns.map((pattern) => micromatch.matcher(pattern, { dot: true }));
-	return (filePath) => matchers.some((matches) => matches(filePath));
+	if (patterns.length === 0) return () => false;
+	const isMatch = picomatch(patterns, { dot: true });
+	return (filePath) => isMatch(filePath);
 };
 const filterFiles = (rootDirectory, files, options) => {
 	const extraExtensions = new Set(options.extraExtensions);
@@ -16509,10 +16780,10 @@ const checkFileComplexity = (filePath, rootDirectory, limits) => {
 };
 const checkComplexity = async (context) => {
 	const files = getSourceFiles(context);
-	const limits = context.config.quality;
 	const diagnostics = [];
 	for (const filePath of files) {
 		if (isAutoGenerated(filePath)) continue;
+		const { quality: limits } = resolveFilePolicy(context.config, overrideRelativePath(context.rootDirectory, filePath));
 		diagnostics.push(...checkFileComplexity(filePath, context.rootDirectory, limits));
 	}
 	return diagnostics;
@@ -17404,13 +17675,23 @@ const withReportPath = async (run) => {
 };
 const UNSUPPORTED_GLOB_SYNTAX = /[?[\]{}!|()\\]/;
 const isDotnetFormatPath = (pattern) => !pattern.startsWith("-") && !UNSUPPORTED_GLOB_SYNTAX.test(pattern);
+const expandBraces = (pattern, depth = 0) => {
+	if (depth > 10) return [pattern];
+	const match = /\{([^{}]+)\}/.exec(pattern);
+	if (!match) return [pattern];
+	const [fullMatch, options] = match;
+	const parts = options.split(",");
+	const prefix = pattern.slice(0, match.index);
+	const suffix = pattern.slice(match.index + fullMatch.length);
+	return parts.flatMap((part) => expandBraces(`${prefix}${part}${suffix}`, depth + 1));
+};
 const buildDotnetFormatExcludeScope = (excludePatterns) => {
 	const scope = {
 		excludeArguments: [],
 		unsupportedPatterns: []
 	};
 	for (const pattern of normalizeExcludePatterns(excludePatterns ?? [])) {
-		const expanded = micromatch.braces(pattern, { expand: true });
+		const expanded = expandBraces(pattern);
 		if (expanded.every(isDotnetFormatPath)) scope.excludeArguments.push(...expanded);
 		else scope.unsupportedPatterns.push(pattern);
 	}
@@ -19273,7 +19554,7 @@ const normalizeEslintIgnorePatterns = (patterns) => patterns.map((pattern) => pa
 	if (!pattern.includes("*") && !path.extname(pattern)) return [`${pattern}/**`];
 	return [pattern];
 });
-const isEslintIgnored = (relativePath, patterns) => patterns.length > 0 && micromatch.isMatch(relativePath, patterns, { dot: true });
+const isEslintIgnored = (relativePath, patterns) => patterns.length > 0 && picomatch.isMatch(relativePath, patterns, { dot: true });
 const getOxlintTargets = (context) => {
 	const eslintIgnorePatterns = normalizeEslintIgnorePatterns(collectEslintIgnorePatterns(context.rootDirectory));
 	return getSourceFiles(context).filter((filePath) => OXLINT_EXTENSIONS.has(path.extname(filePath).toLowerCase())).filter((filePath) => !isAutoGenerated(filePath)).map((filePath) => path.relative(context.rootDirectory, filePath).split(path.sep).join("/")).filter((filePath) => !isEslintIgnored(filePath, eslintIgnorePatterns));
@@ -20192,7 +20473,8 @@ const readRuntimeDependencies = (rootDir) => {
 	collectRuntimeNames(rootManifest, names);
 	const globs = [...npmWorkspaceGlobs(rootManifest), ...pnpmWorkspaceGlobs(rootDir)];
 	if (globs.length === 0) return { runtimeDependencies: names };
-	for (const relativeDir of micromatch(listPackageDirectories(rootDir), globs)) {
+	const isMatch = picomatch(globs, { dot: true });
+	for (const relativeDir of listPackageDirectories(rootDir).filter((dir) => isMatch(dir))) {
 		const memberManifest = readJsonFile(path.join(rootDir, relativeDir, "package.json"));
 		if (memberManifest) collectRuntimeNames(memberManifest, names);
 	}
@@ -20988,6 +21270,7 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 			const result = await engine.run(context);
 			result.diagnostics = filterExcludedDiagnostics(result.diagnostics, context.rootDirectory, context.excludePatterns);
 			result.elapsed = performance.now() - start;
+			result.diagnostics = applyFileOverrides(result.diagnostics, context);
 			onComplete?.(result);
 			return result;
 		} catch (error) {
@@ -20996,6 +21279,7 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 				diagnostics: [],
 				elapsed: performance.now() - start,
 				skipped: true,
+				failed: true,
 				skipReason: error instanceof Error ? error.message : String(error)
 			};
 			onComplete?.(result);
@@ -21006,6 +21290,7 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 		diagnostics: [],
 		elapsed: 0,
 		skipped: true,
+		failed: true,
 		skipReason: r.reason instanceof Error ? r.reason.message : String(r.reason)
 	});
 	return dedupeEquivalenceDiagnostics(dedupeOverlappingComments(dedupeCSharpAsync(stripSecretDiagnostics(finalResults))));
@@ -21246,29 +21531,6 @@ const calculateScore = (diagnostics, weights, thresholds, sourceFileCount, smoot
 	};
 };
 //#endregion
-//#region src/scoring/rule-severity.ts
-/**
-* Apply per-rule severity overrides from config: "off" drops the diagnostic,
-* "error"/"warning" rewrite its severity before scoring and rendering.
-*/
-const applyRuleSeverities = (diagnostics, overrides) => {
-	if (Object.keys(overrides).length === 0) return diagnostics;
-	const result = [];
-	for (const diagnostic of diagnostics) {
-		const override = overrides[diagnostic.rule];
-		if (!override) {
-			result.push(diagnostic);
-			continue;
-		}
-		if (override === "off") continue;
-		result.push(override === diagnostic.severity ? diagnostic : {
-			...diagnostic,
-			severity: override
-		});
-	}
-	return result;
-};
-//#endregion
 //#region src/utils/discovery-classifiers.ts
 const LANGUAGE_SIGNALS = {
 	"tsconfig.json": "typescript",
@@ -21603,6 +21865,8 @@ const runScopedScan = async (cwd, filePaths) => {
 		projectFiles: [.../* @__PURE__ */ new Set([...projectSourceFiles, ...filterProjectDeclarationFiles(project.rootDirectory, projectCandidates, excludePatterns, config.include)])],
 		installedTools: project.installedTools,
 		config: {
+			overrides: config.overrides,
+			rules: config.rules,
 			quality: config.quality,
 			security: {
 				audit: false,
@@ -21622,7 +21886,7 @@ const runScopedScan = async (cwd, filePaths) => {
 		"ai-slop": config.engines["ai-slop"],
 		architecture: config.engines.architecture,
 		security: false
-	})).flatMap((result) => result.diagnostics), config.rules);
+	})).flatMap((result) => result.diagnostics), config.overrides.length ? {} : config.rules);
 	const { score } = calculateScore(diagnostics, config.scoring.weights, config.scoring.thresholds, projectSourceFiles.length + projectTestFiles.length, config.scoring.smoothing, config.scoring.maxPerRule);
 	return {
 		diagnostics,
@@ -21726,6 +21990,8 @@ const captureBaseline = async (cwd) => {
 		files: [],
 		installedTools: project.installedTools,
 		config: {
+			overrides: config.overrides,
+			rules: config.rules,
 			quality: config.quality,
 			security: {
 				audit: false,
@@ -22945,6 +23211,31 @@ const detectInstalledAgents = (opts) => {
 	}
 	return hits;
 };
+const HOOK_MARKERS = [
+	"__raigal",
+	"raigal:begin",
+	"@RAIGAL.md",
+	"__aislop",
+	"aislop:begin",
+	"@AISLOP.md"
+];
+const hasHook = (target) => {
+	try {
+		if (!fs.statSync(target).isFile()) return false;
+		const base = path.basename(target).toLowerCase();
+		if (base.startsWith("raigal") || base.startsWith("aislop")) return true;
+		const content = fs.readFileSync(target, "utf8");
+		return HOOK_MARKERS.some((marker) => content.includes(marker));
+	} catch {
+		return false;
+	}
+};
+const detectionScopes = (agent) => AGENTS_SUPPORTING_BOTH_SCOPES.includes(agent) ? ["global", "project"] : [defaultScopeFor(agent)];
+const detectRaigalHooks = (opts) => ALL_AGENTS.filter((agent) => detectionScopes(agent).some((scope) => REGISTRY[agent].paths({
+	home: opts.home,
+	cwd: opts.cwd,
+	scope
+}).some(hasHook)));
 //#endregion
 //#region src/ui/search-select.ts
 const silentOutput = new Writable({ write(_chunk, _encoding, callback) {
@@ -23632,8 +23923,38 @@ const registerHookAliases = (program) => {
 	});
 };
 //#endregion
+//#region src/utils/github-slug.ts
+const GITHUB_REMOTE_RE = /^(?:git@github\.com:|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/\s]+?)(?:\.git)?\s*$/;
+const parseGithubSlug = (remoteUrl) => {
+	const match = remoteUrl.trim().match(GITHUB_REMOTE_RE);
+	if (!match) return null;
+	const owner = match[1];
+	const repo = match[2];
+	if (!owner || !repo) return null;
+	return {
+		owner,
+		repo
+	};
+};
+const detectGithubSlug = (directory) => {
+	let raw;
+	try {
+		raw = execSync("git remote get-url origin", {
+			cwd: path.resolve(directory),
+			encoding: "utf-8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		});
+	} catch {
+		return null;
+	}
+	return parseGithubSlug(raw);
+};
+//#endregion
 //#region src/commands/badge.ts
-const GITHUB_REMOTE_RE = /^(?:git@github\.com:|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/.\s]+?)(?:\.git)?\s*$/;
 const renderBadgeOutput = ({ owner, repo, svgUrl, pageUrl }) => {
 	const slug = `${owner}/${repo}`;
 	const markdown = `[![raigal](${svgUrl})](${pageUrl})`;
@@ -23677,31 +23998,6 @@ const renderBadgeOutput = ({ owner, repo, svgUrl, pageUrl }) => {
 		""
 	].join("\n");
 };
-const detectGithubSlugFromGit = (directory) => {
-	let raw;
-	try {
-		raw = execSync("git remote get-url origin", {
-			cwd: path.resolve(directory),
-			encoding: "utf-8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		});
-	} catch {
-		return null;
-	}
-	const match = raw.trim().match(GITHUB_REMOTE_RE);
-	if (!match) return null;
-	const owner = match[1];
-	const repo = match[2];
-	if (!owner || !repo) return null;
-	return {
-		owner,
-		repo
-	};
-};
 const badgeCommand = async (options = {}) => {
 	await requireEntitlement({
 		directory: options.directory,
@@ -23710,7 +24006,7 @@ const badgeCommand = async (options = {}) => {
 	let owner = options.owner?.trim();
 	let repo = options.repo?.trim();
 	if (!owner || !repo) {
-		const detected = detectGithubSlugFromGit(options.directory ?? ".");
+		const detected = detectGithubSlug(options.directory ?? ".");
 		if (!detected) throw new Error("Could not detect a GitHub remote. Run from a repo with `git remote get-url origin` set, or pass --owner and --repo.");
 		owner ??= detected.owner;
 		repo ??= detected.repo;
@@ -24486,7 +24782,7 @@ const maybeNotifyUpdate = async (now = Date.now()) => {
 	if (!process.stderr.isTTY) return;
 	const cachePath = resolveUpdateCachePath();
 	const cache = readCache(cachePath);
-	if (cache && isOutdated("0.2.0", cache.latest)) process.stderr.write(formatUpdateNotice(APP_VERSION, cache.latest));
+	if (cache && isOutdated("0.2.2", cache.latest)) process.stderr.write(formatUpdateNotice(APP_VERSION, cache.latest));
 	if (!cache || now - cache.checkedAt > CHECK_INTERVAL_MS) {
 		const latest = await fetchLatestVersion$1();
 		if (latest) writeCache(cachePath, {
@@ -25006,7 +25302,7 @@ const renderCommandGroup = (group, commandWidth) => {
 	return lines;
 };
 const renderCommandReference = (input = {}) => {
-	const version = input.version ?? "0.2.0";
+	const version = input.version ?? "0.2.2";
 	const commandWidth = Math.max(...COMMAND_REFERENCE.map((item) => item.command.length));
 	const lines = [renderHeader({
 		version,
@@ -25229,7 +25525,7 @@ const renderHelpDetails = () => [
 ].map((line) => highlightRaigal(line, theme)).join("\n");
 const renderHome = (input = {}) => {
 	let out = renderHeader({
-		version: input.version ?? "0.2.0",
+		version: input.version ?? "0.2.2",
 		command: "--bare",
 		context: []
 	});
@@ -25974,6 +26270,18 @@ const getChangedLineMap = (cwd, base) => {
 	return map;
 };
 //#endregion
+//#region src/commands/scan-hook-nudge.ts
+const shouldShowHookNudge = (ctx) => ctx.isTty && !ctx.isCi && ctx.installedAgentCount === 0;
+const buildHookNudge = (ctx) => {
+	if (!shouldShowHookNudge(ctx)) return null;
+	return [
+		"",
+		"Next: install the per-edit hook so your coding agent fixes slop before it lands.",
+		ctx.invocation === "raigal" ? "  raigal hook install" : "  npm install -g @methiu/raigal && raigal hook install",
+		""
+	].join("\n");
+};
+//#endregion
 //#region src/commands/scan-coverage.ts
 const coverageReason = (c) => {
 	if (c.supportedFiles === 0 && c.dominantUnsupported) return `This repository is ${c.dominantUnsupported} (${c.unsupportedFiles} files), which Raigal does not analyze. No score — it would not reflect this code.`;
@@ -26515,7 +26823,7 @@ const buildScanNextSteps = (input) => {
 		emphasis: "primary",
 		label: "Provider",
 		command: `${input.invocation} agent --provider codex`,
-		detail: "or use --provider claude/opencode"
+		detail: "or use --provider claude/opencode/pi"
 	}, {
 		emphasis: "muted",
 		label: "Preview",
@@ -26682,6 +26990,8 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 	const configDir = findConfigDir(resolvedDir);
 	const rulesPath = configDir ? path.join(configDir, RULES_FILE) : void 0;
 	const engineConfig = {
+		overrides: config.overrides,
+		rules: config.rules,
 		quality: config.quality,
 		security: config.security,
 		lint: config.lint,
@@ -26703,7 +27013,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		config: engineConfig
 	}, config.engines, machineOutput)).map((result) => ({
 		...result,
-		diagnostics: applyRuleSeverities(result.diagnostics, config.rules)
+		diagnostics: config.overrides.length ? result.diagnostics : applyRuleSeverities(result.diagnostics, config.rules)
 	})), resolvedDir);
 	if (suppressedCount > 0 && !machineOutput) log.muted(`Suppressed ${suppressedCount} finding(s) via raigal-ignore directives`);
 	const changeMap = options.changes && !options.staged ? getChangedLineMap(resolvedDir, options.base) : null;
@@ -26741,6 +27051,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		engineIssues[r.engine] = r.diagnostics.length;
 		engineTimings[r.engine] = Math.round(r.elapsed);
 	}
+	const enginesFailed = results.filter((r) => r.failed).map((r) => r.engine);
 	const completion = {
 		exitCode,
 		score: scoreable ? scoreResult.score : null,
@@ -26750,7 +27061,8 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		warningCount: allDiagnostics.filter((d) => d.severity === "warning").length,
 		fixableCount: allDiagnostics.filter((d) => d.fixable).length,
 		engineIssues,
-		engineTimings
+		engineTimings,
+		...enginesFailed.length > 0 ? { properties: { engines_failed: enginesFailed } } : {}
 	};
 	recordScanToCloud({
 		results,
@@ -26768,7 +27080,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		return completion;
 	}
 	if (options.json) {
-		const { buildJsonOutput } = await import("./json-C9fBWj3V.js");
+		const { buildJsonOutput } = await import("./json-BaycSoJP.js");
 		const jsonOut = buildJsonOutput(results, scoreResult, scoreFileCount, elapsedMs, scanCoverage);
 		console.log(JSON.stringify(jsonOut, null, 2));
 		return completion;
@@ -26801,6 +27113,18 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		printBrand: options.printBrand,
 		showPilotInvitation
 	}));
+	if (options.command !== "ci" && options.printBrand !== false) {
+		const nudge = buildHookNudge({
+			installedAgentCount: detectRaigalHooks({
+				home: os.homedir(),
+				cwd: resolvedDir
+			}).length,
+			isTty: Boolean(process.stdout.isTTY),
+			isCi: isCiEnv(),
+			invocation: detectInvocation()
+		});
+		if (nudge) process.stdout.write(nudge);
+	}
 	return completion;
 };
 //#endregion
@@ -27540,7 +27864,9 @@ const createEngineContext = (rootDirectory, projectInfo, config, options = {}) =
 		quality: config.quality,
 		security: config.security,
 		lint: config.lint,
-		engines: config.engines
+		engines: config.engines,
+		overrides: config.overrides,
+		rules: config.rules
 	},
 	...options.scope ? {
 		files: options.scope.files,
@@ -28057,6 +28383,56 @@ const computeRemovalRange = (sourceFile, node, content) => {
 		end: finalEnd
 	};
 };
+const isReferencedOutside = (sourceFile, statement, name) => {
+	const start = statement.getStart(sourceFile);
+	const end = statement.getEnd();
+	let found = false;
+	const visit = (node) => {
+		if (found) return;
+		if (ts.isIdentifier(node) && node.text === name) {
+			const pos = node.getStart(sourceFile);
+			if (pos < start || pos >= end) found = true;
+			return;
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return found;
+};
+const exportKeywordRange = (sourceFile, statement, content) => {
+	const modifiers = ts.canHaveModifiers(statement) ? ts.getModifiers(statement) ?? [] : [];
+	if (modifiers.some((m) => m.kind === ts.SyntaxKind.DefaultKeyword)) return null;
+	const exportKeyword = modifiers.find((m) => m.kind === ts.SyntaxKind.ExportKeyword);
+	if (!exportKeyword) return null;
+	let end = exportKeyword.getEnd();
+	while (end < content.length && (content[end] === " " || content[end] === "	")) end++;
+	return {
+		start: exportKeyword.getStart(sourceFile),
+		end
+	};
+};
+const removalFor = (sourceFile, statement, content, decl) => {
+	if (!isReferencedOutside(sourceFile, statement, decl.name)) return null;
+	const range = exportKeywordRange(sourceFile, statement, content);
+	if (!range) return {
+		type: "skip",
+		reason: "still referenced in its own file",
+		declaration: decl
+	};
+	return {
+		type: "match",
+		removal: {
+			...range,
+			declaration: decl
+		}
+	};
+};
+const declaredNames = (statement) => {
+	if (ts.isVariableStatement(statement)) return statement.declarationList.declarations.map((d) => ts.isIdentifier(d.name) ? d.name.text : null).filter((name) => name !== null);
+	if (ts.isFunctionDeclaration(statement) || ts.isClassDeclaration(statement) || ts.isInterfaceDeclaration(statement) || ts.isTypeAliasDeclaration(statement) || ts.isEnumDeclaration(statement) || ts.isModuleDeclaration(statement)) return statement.name && ts.isIdentifier(statement.name) ? [statement.name.text] : [];
+	return [];
+};
+const isDeclaredMoreThanOnce = (sourceFile, name) => sourceFile.statements.filter((s) => declaredNames(s).includes(name)).length > 1;
 const kindOfStatement = (node) => {
 	if (ts.isVariableStatement(node)) return "variable";
 	if (ts.isFunctionDeclaration(node)) return "function";
@@ -28068,6 +28444,11 @@ const kindOfStatement = (node) => {
 };
 const matchStatement = (sourceFile, statement, content, decl) => {
 	if (!kindOfStatement(statement)) return { type: "none" };
+	if (declaredNames(statement).includes(decl.name) && isDeclaredMoreThanOnce(sourceFile, decl.name)) return {
+		type: "skip",
+		reason: "merged declaration",
+		declaration: decl
+	};
 	if (ts.isVariableStatement(statement)) {
 		const varDecls = statement.declarationList.declarations;
 		if (varDecls.length === 0) return { type: "none" };
@@ -28083,6 +28464,8 @@ const matchStatement = (sourceFile, statement, content, decl) => {
 			reason: "multi-declaration variable statement",
 			declaration: decl
 		};
+		const referenced = removalFor(sourceFile, statement, content, decl);
+		if (referenced) return referenced;
 		if (initializerHasSideEffects(match.initializer)) return {
 			type: "skip",
 			reason: "initializer may have side effects",
@@ -28100,6 +28483,8 @@ const matchStatement = (sourceFile, statement, content, decl) => {
 		if (!statement.name) return { type: "none" };
 		if (statement.name.text !== decl.name) return { type: "none" };
 		if (!nodeContainsLine(sourceFile, statement, decl.line)) return { type: "none" };
+		const referenced = removalFor(sourceFile, statement, content, decl);
+		if (referenced) return referenced;
 		return {
 			type: "match",
 			removal: {
@@ -28111,6 +28496,8 @@ const matchStatement = (sourceFile, statement, content, decl) => {
 	if (ts.isTypeAliasDeclaration(statement) || ts.isInterfaceDeclaration(statement) || ts.isEnumDeclaration(statement)) {
 		if (statement.name.text !== decl.name) return { type: "none" };
 		if (!nodeContainsLine(sourceFile, statement, decl.line)) return { type: "none" };
+		const referenced = removalFor(sourceFile, statement, content, decl);
+		if (referenced) return referenced;
 		return {
 			type: "match",
 			removal: {
@@ -29162,6 +29549,8 @@ const runFixBody = async (resolvedDir, config, options, projectInfo) => {
 	const configDir = findConfigDir(resolvedDir);
 	const rulesPath = configDir ? path.join(configDir, RULES_FILE) : void 0;
 	const engineConfig = {
+		overrides: config.overrides,
+		rules: config.rules,
 		quality: config.quality,
 		security: config.security,
 		lint: config.lint,
@@ -29187,7 +29576,7 @@ const runFixBody = async (resolvedDir, config, options, projectInfo) => {
 		status: "done",
 		label: "Verification complete"
 	});
-	const scanResults = appendPostFixLintResult(verificationResults, collectPostFixLintDiagnostics(steps));
+	const scanResults = appendPostFixLintResult(verificationResults, applyFileOverrides(collectPostFixLintDiagnostics(steps), context));
 	const allDiagnostics = scanResults.flatMap((r) => r.diagnostics);
 	const scoreResult = calculateScore(allDiagnostics, config.scoring.weights, config.scoring.thresholds, scope ? scope.scoreFileCount : projectInfo.sourceFileCount, config.scoring.smoothing, config.scoring.maxPerRule);
 	const errors = allDiagnostics.filter((d) => d.severity === "error").length;
@@ -29318,13 +29707,13 @@ const writeGithubWorkflow = (rootDirectory, enabled) => {
 	};
 };
 const promptForConfigChoices = async () => {
-	const enginesSelection = await multiselect({
+	const enginesSelection = await runCancellable(() => multiselect({
 		message: "Which engines should run?",
 		options: ENGINE_CHOICES,
 		initialValues: DEFAULT_ENGINE_SELECTION,
 		required: false
-	});
-	if (isCancel(enginesSelection)) return null;
+	}));
+	if (enginesSelection === void 0) return null;
 	const failBelowRaw = await text({
 		message: "CI quality gate — fail the build when the score drops below (0-100)",
 		initialValue: "70",
@@ -29679,13 +30068,19 @@ const suggestClosest = (token, candidates) => {
 };
 //#endregion
 //#region src/cli.ts
-const safeTelemetryConfig = (dir) => {
+const safeTelemetryConfig = (dir = process.cwd()) => {
 	try {
 		return loadConfig(dir).telemetry;
 	} catch {
 		return;
 	}
 };
+const exitOnFatal = (error, stage) => {
+	console.error(error);
+	reportFatalError(error, stage, safeTelemetryConfig()).finally(() => process.exit(1));
+};
+process.on("uncaughtException", (error) => exitOnFatal(error, "uncaught_exception"));
+process.on("unhandledRejection", (reason) => exitOnFatal(reason, "unhandled_rejection"));
 const handleTerminationSignal = async (signal) => {
 	killActiveChildren();
 	const exitCode = signal === "SIGINT" ? 130 : 143;
@@ -29784,7 +30179,7 @@ fixProgram.action(async (directory = ".", _flags, command) => {
 	}
 });
 registerAgentCommand(program);
-program.command("init [directory]").description("Create aislop config and optional CI workflow").option("--strict", "write an enterprise-grade default config: all engines, typecheck on, CI failBelow 85, workflow included").action(async (directory = ".", _flags, command) => {
+program.command("init [directory]").description("Create raigal config and optional CI workflow").option("--strict", "write an enterprise-grade default config: all engines, typecheck on, CI failBelow 85, workflow included").action(async (directory = ".", _flags, command) => {
 	const flags = command.optsWithGlobals();
 	await withCommandLifecycle({
 		command: "init",
@@ -29882,6 +30277,6 @@ const main = async () => {
 	await flushTelemetry();
 	await maybeNotifyUpdate();
 };
-main();
+main().catch((error) => exitOnFatal(error, "main"));
 //#endregion
 export { requestApi as a, log as c, detectRepoRef as i, FIXED_SECRET_DIAGNOSTIC_MESSAGE as l, withFindingAssessments as n, getActiveToken as o, ENGINE_INFO as r, APP_VERSION as s, summarizeFindingAssessments as t, isSecretClassRule as u };