@methiu/raigal 0.2.0 → 0.2.2

package/dist/index.js

@@ -1,4 +1,4 @@
-import { t as APP_VERSION } from "./version-v4OAaBLZ.js";
+import { t as APP_VERSION } from "./version-9Cnt1TiK.js";
 import { a as getEngineLabel, i as ENGINE_INFO, r as scoreImpactForRule, t as summarizeFindingAssessments } from "./finding-assessment-M5fUTE-C.js";
 import { n as isSecretClassRule, r as maskSecrets, t as FIXED_SECRET_DIAGNOSTIC_MESSAGE } from "./mask-secrets-BXn-ZSEh.js";
 import { createRequire, isBuiltin } from "node:module";
@@ -8,14 +8,14 @@ import YAML, { parse } from "yaml";
 import { z } from "zod/v4";
 import pc from "picocolors";
 import wcwidth from "wcwidth";
-import micromatch from "micromatch";
+import picomatch from "picomatch";
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import os, { tmpdir } from "node:os";
 import { performance } from "node:perf_hooks";
 import ts from "typescript";
 import { parse as parse$1 } from "smol-toml";
-import { createHash, createPublicKey, randomUUID, verify } from "node:crypto";
+import crypto, { createHash, createPublicKey, randomUUID, verify } from "node:crypto";
 import { isCancel, multiselect, select, text } from "@clack/prompts";
 import * as readline from "node:readline";
 import { Writable } from "node:stream";
@@ -88,7 +88,8 @@ const DEFAULT_CONFIG = {
 		format: "json"
 	},
 	telemetry: { enabled: true },
-	rules: {}
+	rules: {},
+	overrides: []
 };
 const GITHUB_WORKFLOW_DIR = ".github/workflows";
 const GITHUB_WORKFLOW_FILE = "raigal.yml";
@@ -318,6 +319,16 @@ const RuleSeverityOverride = z.enum([
 	"off"
 ]);
 const RulesSchema = z.record(z.string(), RuleSeverityOverride).default(() => ({}));
+const FileOverrideSchema = z.object({
+	files: z.array(z.string().min(1)).min(1),
+	quality: z.object({
+		maxFunctionLoc: QualitySchema.shape.maxFunctionLoc.unwrap().optional(),
+		maxFileLoc: QualitySchema.shape.maxFileLoc.unwrap().optional(),
+		maxNesting: QualitySchema.shape.maxNesting.unwrap().optional(),
+		maxParams: QualitySchema.shape.maxParams.unwrap().optional()
+	}).optional(),
+	rules: z.record(z.string(), RuleSeverityOverride).optional()
+});
 const AislopConfigSchema = z.object({
 	version: z.number().default(1),
 	extends: z.union([z.string(), z.array(z.string())]).optional(),
@@ -373,6 +384,7 @@ const AislopConfigSchema = z.object({
 	})),
 	telemetry: TelemetrySchema.default(() => ({ enabled: true })),
 	rules: RulesSchema,
+	overrides: z.array(FileOverrideSchema).default(() => []),
 	exclude: z.array(z.string()).default(() => [
 		"node_modules",
 		".git",
@@ -674,7 +686,7 @@ const highlightRaigal = (text, theme, baseToken) => {
 	const tail = text.slice(lastIndex);
 	return out + (baseToken ? style(theme, baseToken, tail) : tail);
 };
-const highlightAislop = highlightRaigal;
+const highlightAislop = (...args) => highlightRaigal(...args);
 //#endregion
 //#region src/ui/width.ts
 const ANSI_RE$1 = new RegExp(`\\[[0-9;]*m`, "g");
@@ -938,13 +950,13 @@ const normalizeExcludePatterns = (patterns) => patterns.flatMap((pattern) => {
 	const normalized = withoutProjectPrefix.slice(0, end);
 	if (normalized.length === 0) return [];
 	if (normalized.length > 256) return [];
-	if (micromatch.scan(normalized).isGlob) return [normalized];
+	if (picomatch.scan(normalized).isGlob) return [normalized];
 	if (normalized.startsWith(".") && !normalized.includes("/")) return supportedGlobPatterns([`**/${normalized}`, `**/${normalized}/**`]);
 	return supportedGlobPatterns([normalized, `${normalized}/**`]);
 });
 const isPathExcluded = (relativePath, normalizedPatterns) => {
 	if (normalizedPatterns.length === 0) return false;
-	return micromatch.isMatch(relativePath, normalizedPatterns, { dot: true });
+	return picomatch.isMatch(relativePath, normalizedPatterns, { dot: true });
 };
 const filterExcludedDiagnostics = (diagnostics, rootDirectory, excludePatterns) => {
 	if (!excludePatterns || excludePatterns.length === 0) return diagnostics;
@@ -1312,12 +1324,13 @@ const normalizeIncludePatterns = (patterns) => patterns.flatMap((pattern) => {
 	const normalized = pattern.trim().replace(/^\.\//, "").replace(/\/$/, "");
 	if (normalized === "" || normalized === ".") return ["**"];
 	if (normalized.length > 256) return [];
-	if (micromatch.scan(normalized).isGlob) return [normalized];
+	if (picomatch.scan(normalized).isGlob) return [normalized];
 	return supportedGlobPatterns([normalized, `${normalized}/**`]);
 });
 const createPathMatcher = (patterns) => {
-	const matchers = patterns.map((pattern) => micromatch.matcher(pattern, { dot: true }));
-	return (filePath) => matchers.some((matches) => matches(filePath));
+	if (patterns.length === 0) return () => false;
+	const isMatch = picomatch(patterns, { dot: true });
+	return (filePath) => isMatch(filePath);
 };
 const filterFiles = (rootDirectory, files, options) => {
 	const extraExtensions = new Set(options.extraExtensions);
@@ -1800,7 +1813,7 @@ const isRootBoundedTarget = (candidate, rootDirectory) => {
 };
 //#endregion
 //#region src/utils/aislop-ignore.ts
-const readRaigalIgnorePatterns = (rootDirectory) => {
+const readAislopIgnorePatterns = (rootDirectory) => {
 	const patterns = [];
 	for (const fileName of [".raigalignore", ".aislopignore"]) {
 		const targetPath = safeProjectFilePath(path.join(rootDirectory, fileName), rootDirectory);
@@ -1811,7 +1824,6 @@ const readRaigalIgnorePatterns = (rootDirectory) => {
 	}
 	return patterns;
 };
-const readAislopIgnorePatterns = readRaigalIgnorePatterns;
 //#endregion
 //#region src/utils/source-file-context.ts
 const getSourceFilesForRoot = (rootDirectory) => filterProjectFiles(rootDirectory, listProjectFiles(rootDirectory));
@@ -2639,6 +2651,132 @@ const doctorCommand = async (directory, options = {}) => {
 	}));
 };
 //#endregion
+//#region src/utils/globs.ts
+const MAX_BRACE_EXPANSIONS = 256;
+const braceListAt = (pattern, start) => {
+	let depth = 0;
+	const commas = [];
+	for (let i = start; i < pattern.length; i += 1) {
+		const char = pattern[i];
+		if (char === "\\") i += 1;
+		else if (char === "{") depth += 1;
+		else if (char === ",") {
+			if (depth === 1) commas.push(i);
+		} else if (char === "}") {
+			depth -= 1;
+			if (depth === 0) return commas.length > 0 ? {
+				start,
+				end: i,
+				commas
+			} : null;
+		}
+	}
+	return null;
+};
+const findBraceList = (pattern) => {
+	for (let start = pattern.indexOf("{"); start !== -1; start = pattern.indexOf("{", start + 1)) {
+		if (start > 0 && pattern[start - 1] === "\\") continue;
+		const list = braceListAt(pattern, start);
+		if (list) return list;
+	}
+	return null;
+};
+const expandInto = (pattern, results) => {
+	const list = findBraceList(pattern);
+	if (!list) {
+		results.push(pattern);
+		return results.length <= MAX_BRACE_EXPANSIONS;
+	}
+	const bounds = [
+		list.start,
+		...list.commas,
+		list.end
+	];
+	const prefix = pattern.slice(0, list.start);
+	const suffix = pattern.slice(list.end + 1);
+	for (let i = 0; i < bounds.length - 1; i += 1) {
+		const option = pattern.slice(bounds[i] + 1, bounds[i + 1]);
+		if (!expandInto(`${prefix}${option}${suffix}`, results)) return false;
+	}
+	return true;
+};
+const expandBraceLists = (pattern) => {
+	const results = [];
+	return expandInto(pattern, results) ? results : [pattern];
+};
+const isNegated = (pattern) => picomatch.scan(pattern).negated;
+const matchesGlobList = (value, patterns, options = {}) => {
+	const expanded = patterns.flatMap(expandBraceLists);
+	const positives = expanded.filter((pattern) => !isNegated(pattern));
+	const negatives = expanded.filter(isNegated).map((pattern) => pattern.slice(1));
+	const included = positives.length === 0 || picomatch.isMatch(value, positives, options);
+	const excluded = negatives.length > 0 && picomatch.isMatch(value, negatives, options);
+	return included && !excluded;
+};
+//#endregion
+//#region src/scoring/rule-severity.ts
+/**
+* Apply per-rule severity overrides from config: "off" drops the diagnostic,
+* "error"/"warning" rewrite its severity before scoring and rendering.
+*/
+const applyRuleSeverities = (diagnostics, overrides) => {
+	if (Object.keys(overrides).length === 0) return diagnostics;
+	const result = [];
+	for (const diagnostic of diagnostics) {
+		const override = overrides[diagnostic.rule];
+		if (!override) {
+			result.push(diagnostic);
+			continue;
+		}
+		if (override === "off") continue;
+		result.push(override === diagnostic.severity ? diagnostic : {
+			...diagnostic,
+			severity: override
+		});
+	}
+	return result;
+};
+//#endregion
+//#region src/config/overrides.ts
+const overrideRelativePath = (rootDirectory, filePath) => {
+	const paths = path.win32.isAbsolute(rootDirectory) && !path.posix.isAbsolute(rootDirectory) ? path.win32 : path.posix;
+	const root = rootDirectory.replaceAll("\\", "/");
+	const file = filePath.replaceAll("\\", "/");
+	return paths.normalize(paths.isAbsolute(file) ? paths.relative(root, file) : file).replaceAll("\\", "/");
+};
+const matchesEntry = (relativePath, patterns) => matchesGlobList(relativePath, patterns, { dot: true });
+const resolveFilePolicy = (config, relativePath) => {
+	let quality = config.quality;
+	let rules = config.rules ?? {};
+	if (relativePath === ".." || relativePath.startsWith("../") || path.win32.isAbsolute(relativePath)) return {
+		quality,
+		rules
+	};
+	for (const entry of config.overrides ?? []) {
+		if (!matchesEntry(relativePath, entry.files)) continue;
+		if (entry.quality) quality = {
+			...quality,
+			...entry.quality
+		};
+		if (entry.rules) rules = {
+			...rules,
+			...entry.rules
+		};
+	}
+	return {
+		quality,
+		rules
+	};
+};
+const applyFileOverrides = (diagnostics, context) => {
+	if (!context.config.overrides?.length) return diagnostics;
+	return diagnostics.flatMap((diagnostic) => {
+		const relativePath = overrideRelativePath(context.rootDirectory, diagnostic.filePath);
+		const { rules } = resolveFilePolicy(context.config, relativePath);
+		return applyRuleSeverities([diagnostic], rules);
+	});
+};
+//#endregion
 //#region src/utils/string-literals.ts
 const consumeQuotedString = (content, start, quote) => {
 	const len = content.length;
@@ -10381,10 +10519,10 @@ const checkFileComplexity = (filePath, rootDirectory, limits) => {
 };
 const checkComplexity = async (context) => {
 	const files = getSourceFiles(context);
-	const limits = context.config.quality;
 	const diagnostics = [];
 	for (const filePath of files) {
 		if (isAutoGenerated(filePath)) continue;
+		const { quality: limits } = resolveFilePolicy(context.config, overrideRelativePath(context.rootDirectory, filePath));
 		diagnostics.push(...checkFileComplexity(filePath, context.rootDirectory, limits));
 	}
 	return diagnostics;
@@ -11276,13 +11414,23 @@ const withReportPath = async (run) => {
 };
 const UNSUPPORTED_GLOB_SYNTAX = /[?[\]{}!|()\\]/;
 const isDotnetFormatPath = (pattern) => !pattern.startsWith("-") && !UNSUPPORTED_GLOB_SYNTAX.test(pattern);
+const expandBraces = (pattern, depth = 0) => {
+	if (depth > 10) return [pattern];
+	const match = /\{([^{}]+)\}/.exec(pattern);
+	if (!match) return [pattern];
+	const [fullMatch, options] = match;
+	const parts = options.split(",");
+	const prefix = pattern.slice(0, match.index);
+	const suffix = pattern.slice(match.index + fullMatch.length);
+	return parts.flatMap((part) => expandBraces(`${prefix}${part}${suffix}`, depth + 1));
+};
 const buildDotnetFormatExcludeScope = (excludePatterns) => {
 	const scope = {
 		excludeArguments: [],
 		unsupportedPatterns: []
 	};
 	for (const pattern of normalizeExcludePatterns(excludePatterns ?? [])) {
-		const expanded = micromatch.braces(pattern, { expand: true });
+		const expanded = expandBraces(pattern);
 		if (expanded.every(isDotnetFormatPath)) scope.excludeArguments.push(...expanded);
 		else scope.unsupportedPatterns.push(pattern);
 	}
@@ -13076,7 +13224,7 @@ const normalizeEslintIgnorePatterns = (patterns) => patterns.map((pattern) => pa
 	if (!pattern.includes("*") && !path.extname(pattern)) return [`${pattern}/**`];
 	return [pattern];
 });
-const isEslintIgnored = (relativePath, patterns) => patterns.length > 0 && micromatch.isMatch(relativePath, patterns, { dot: true });
+const isEslintIgnored = (relativePath, patterns) => patterns.length > 0 && picomatch.isMatch(relativePath, patterns, { dot: true });
 const getOxlintTargets = (context) => {
 	const eslintIgnorePatterns = normalizeEslintIgnorePatterns(collectEslintIgnorePatterns(context.rootDirectory));
 	return getSourceFiles(context).filter((filePath) => OXLINT_EXTENSIONS.has(path.extname(filePath).toLowerCase())).filter((filePath) => !isAutoGenerated(filePath)).map((filePath) => path.relative(context.rootDirectory, filePath).split(path.sep).join("/")).filter((filePath) => !isEslintIgnored(filePath, eslintIgnorePatterns));
@@ -13897,7 +14045,8 @@ const readRuntimeDependencies = (rootDir) => {
 	collectRuntimeNames(rootManifest, names);
 	const globs = [...npmWorkspaceGlobs(rootManifest), ...pnpmWorkspaceGlobs(rootDir)];
 	if (globs.length === 0) return { runtimeDependencies: names };
-	for (const relativeDir of micromatch(listPackageDirectories(rootDir), globs)) {
+	const isMatch = picomatch(globs, { dot: true });
+	for (const relativeDir of listPackageDirectories(rootDir).filter((dir) => isMatch(dir))) {
 		const memberManifest = readJsonFile(path.join(rootDir, relativeDir, "package.json"));
 		if (memberManifest) collectRuntimeNames(memberManifest, names);
 	}
@@ -14693,6 +14842,7 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 			const result = await engine.run(context);
 			result.diagnostics = filterExcludedDiagnostics(result.diagnostics, context.rootDirectory, context.excludePatterns);
 			result.elapsed = performance.now() - start;
+			result.diagnostics = applyFileOverrides(result.diagnostics, context);
 			onComplete?.(result);
 			return result;
 		} catch (error) {
@@ -14701,6 +14851,7 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 				diagnostics: [],
 				elapsed: performance.now() - start,
 				skipped: true,
+				failed: true,
 				skipReason: error instanceof Error ? error.message : String(error)
 			};
 			onComplete?.(result);
@@ -14711,6 +14862,7 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 		diagnostics: [],
 		elapsed: 0,
 		skipped: true,
+		failed: true,
 		skipReason: r.reason instanceof Error ? r.reason.message : String(r.reason)
 	});
 	return dedupeEquivalenceDiagnostics(dedupeOverlappingComments(dedupeCSharpAsync(stripSecretDiagnostics(finalResults))));
@@ -14929,6 +15081,10 @@ const SAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set([
 	"exit_code",
 	"duration_ms",
 	"error_kind",
+	"error_name",
+	"error_code",
+	"failed_stage",
+	"engines_failed",
 	"score",
 	"score_bucket",
 	"finding_count",
@@ -15157,6 +15313,8 @@ const buildCommandCompletedProps = (input) => {
 	if (typeof input.fixSteps === "number") props.fix_steps = input.fixSteps;
 	if (typeof input.fixResolved === "number") props.fix_resolved = input.fixResolved;
 	if (typeof input.fixScoreDelta === "number") props.fix_score_delta = input.fixScoreDelta;
+	if (input.errorName) props.error_name = input.errorName;
+	if (input.errorCode) props.error_code = input.errorCode;
 	return props;
 };
 const errorKindFromException = (error) => {
@@ -15166,6 +15324,26 @@ const errorKindFromException = (error) => {
 	if (message.includes("engine") && message.includes("crash")) return "engine_crash";
 	return "unknown";
 };
+const SAFE_ERROR_NAME = /^[A-Za-z_$][A-Za-z0-9_$]{0,39}$/;
+const SAFE_ERROR_CODE = /^[A-Za-z][A-Za-z0-9_]{0,39}$/;
+const errorIdentity = (error) => {
+	let name;
+	if (error instanceof Error && typeof error.name === "string" && error.name.length > 0) name = error.name;
+	else if (error === null) name = "null";
+	else if (typeof error === "object") name = "object";
+	else name = typeof error;
+	const identity = { error_name: SAFE_ERROR_NAME.test(name) ? name : "Error" };
+	const code = error?.code;
+	if (typeof code === "string" && SAFE_ERROR_CODE.test(code)) identity.error_code = code;
+	else if (typeof code === "number" && Number.isFinite(code)) identity.error_code = String(code);
+	return identity;
+};
+//#endregion
+//#region src/telemetry/fatal.ts
+const reportedErrors = /* @__PURE__ */ new Set();
+const markErrorReported = (error) => {
+	reportedErrors.add(error);
+};
 //#endregion
 //#region src/telemetry/lifecycle.ts
 const STARTED_FLUSH_TIMEOUT_MS = 100;
@@ -15176,6 +15354,7 @@ const withCommandLifecycle = async (start, run) => {
 		fileCount: start.fileCount,
 		properties: start.properties
 	});
+	start.config;
 	track({
 		event: "cli_command_started",
 		properties: startProps,
@@ -15192,6 +15371,7 @@ const withCommandLifecycle = async (start, run) => {
 				startProps,
 				exitCode: result.exitCode,
 				durationMs,
+				errorKind: result.errorKind,
 				score: result.score ?? void 0,
 				findingCount: result.findingCount,
 				errorCount: result.errorCount,
@@ -15209,16 +15389,21 @@ const withCommandLifecycle = async (start, run) => {
 		await flushTelemetry();
 		return result;
 	} catch (error) {
+		const durationMs = performance.now() - startedAt;
+		const identity = errorIdentity(error);
 		track({
 			event: "cli_command_completed",
 			properties: buildCommandCompletedProps({
 				startProps,
 				exitCode: 1,
-				durationMs: performance.now() - startedAt,
-				errorKind: errorKindFromException(error)
+				durationMs,
+				errorKind: errorKindFromException(error),
+				errorName: identity.error_name,
+				errorCode: identity.error_code
 			}),
 			config: start.config
 		});
+		markErrorReported(error);
 		await flushTelemetry();
 		throw error;
 	}
@@ -15714,7 +15899,9 @@ const createEngineContext = (rootDirectory, projectInfo, config, options = {}) =
 		quality: config.quality,
 		security: config.security,
 		lint: config.lint,
-		engines: config.engines
+		engines: config.engines,
+		overrides: config.overrides,
+		rules: config.rules
 	},
 	...options.scope ? {
 		files: options.scope.files,
@@ -16068,7 +16255,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const claims = parsed.data;
 	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
 	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.2.0", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (!isVersionAtLeast("0.2.2", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -16182,6 +16369,10 @@ const handleEntitlementFetchError = (err, cached, cachedClaims, now) => {
 			nowSeconds: now,
 			allowGraceSeconds: GRACE_PERIOD_SECONDS
 		});
+		if (graceClaims.plan === "trial" && graceClaims.trial_ends_at && now > Math.floor(new Date(graceClaims.trial_ends_at).getTime() / 1e3)) {
+			clearCachedEntitlement();
+			throw new LicenceDeniedError("Organization trial has expired", "trial_expired");
+		}
 		return {
 			jwt: cached.entitlement,
 			claims: graceClaims,
@@ -16189,6 +16380,7 @@ const handleEntitlementFetchError = (err, cached, cachedClaims, now) => {
 			grace: now > graceClaims.exp
 		};
 	} catch (jwtErr) {
+		if (jwtErr instanceof LicenceDeniedError) throw jwtErr;
 		if (jwtErr instanceof JwtVerificationError && jwtErr.code === "expired_beyond_grace") throw new LicenceUnverifiableError(`Raigal license could not be verified online and the offline grace period expired on ${(/* @__PURE__ */ new Date((cachedClaims?.exp ?? 0) * 1e3)).toISOString()}. Check network connectivity or Raigal Cloud status.`);
 	}
 	throw new LicenceUnverifiableError(`Raigal license could not be verified online (${err instanceof Error ? err.message : String(err)}). Check network connectivity or Raigal Cloud status.`);
@@ -16203,7 +16395,8 @@ const getEntitlement = async () => {
 	} catch {
 		cachedClaims = null;
 	}
-	if (cached && cachedClaims && now < cached.refresh_after) return {
+	const isTrialExpired = cachedClaims?.plan === "trial" && cachedClaims.trial_ends_at && now > Math.floor(new Date(cachedClaims.trial_ends_at).getTime() / 1e3);
+	if (cached && cachedClaims && !isTrialExpired && now < cached.refresh_after) return {
 		jwt: cached.entitlement,
 		claims: cachedClaims,
 		fromCache: true
@@ -16212,7 +16405,7 @@ const getEntitlement = async () => {
 	if (!activeToken) {
 		oidcToken = await fetchGitHubOidcToken();
 		if (!oidcToken) {
-			if (cached && cachedClaims) return {
+			if (cached && cachedClaims && !isTrialExpired) return {
 				jwt: cached.entitlement,
 				claims: cachedClaims,
 				fromCache: true
@@ -16373,6 +16566,23 @@ const requireEntitlement = async (options = {}) => {
 	try {
 		const entitlement = await getEntitlement();
 		const tokenKind = getActiveToken()?.kind ?? "session";
+		if (entitlement.claims.plan === "trial" && entitlement.claims.trial_ends_at) {
+			const trialEnd = new Date(entitlement.claims.trial_ends_at).getTime();
+			if (Date.now() > trialEnd) {
+				const message = "Raigal license denied: Organization trial has expired";
+				if (mode === "throw") throw new LicenceDeniedError(message, "trial_expired");
+				if (mode === "fatal") {
+					process.stderr.write(`${message}\n`);
+					process.exit(30);
+				}
+				process.stderr.write(`[raigal] ${message}\n`);
+				return {
+					ok: false,
+					exitCode: 30,
+					message
+				};
+			}
+		}
 		const detectedOwner = detectLocalRepoOwner(directory);
 		if (options.repoOwner) detectedOwner.owner = options.repoOwner.toLowerCase();
 		const ownerCheck = checkOwnerAgainstAllowlist(detectedOwner, entitlement.claims.allowed_owners, tokenKind);
@@ -16929,6 +17139,56 @@ const computeRemovalRange = (sourceFile, node, content) => {
 		end: finalEnd
 	};
 };
+const isReferencedOutside = (sourceFile, statement, name) => {
+	const start = statement.getStart(sourceFile);
+	const end = statement.getEnd();
+	let found = false;
+	const visit = (node) => {
+		if (found) return;
+		if (ts.isIdentifier(node) && node.text === name) {
+			const pos = node.getStart(sourceFile);
+			if (pos < start || pos >= end) found = true;
+			return;
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return found;
+};
+const exportKeywordRange = (sourceFile, statement, content) => {
+	const modifiers = ts.canHaveModifiers(statement) ? ts.getModifiers(statement) ?? [] : [];
+	if (modifiers.some((m) => m.kind === ts.SyntaxKind.DefaultKeyword)) return null;
+	const exportKeyword = modifiers.find((m) => m.kind === ts.SyntaxKind.ExportKeyword);
+	if (!exportKeyword) return null;
+	let end = exportKeyword.getEnd();
+	while (end < content.length && (content[end] === " " || content[end] === "	")) end++;
+	return {
+		start: exportKeyword.getStart(sourceFile),
+		end
+	};
+};
+const removalFor = (sourceFile, statement, content, decl) => {
+	if (!isReferencedOutside(sourceFile, statement, decl.name)) return null;
+	const range = exportKeywordRange(sourceFile, statement, content);
+	if (!range) return {
+		type: "skip",
+		reason: "still referenced in its own file",
+		declaration: decl
+	};
+	return {
+		type: "match",
+		removal: {
+			...range,
+			declaration: decl
+		}
+	};
+};
+const declaredNames = (statement) => {
+	if (ts.isVariableStatement(statement)) return statement.declarationList.declarations.map((d) => ts.isIdentifier(d.name) ? d.name.text : null).filter((name) => name !== null);
+	if (ts.isFunctionDeclaration(statement) || ts.isClassDeclaration(statement) || ts.isInterfaceDeclaration(statement) || ts.isTypeAliasDeclaration(statement) || ts.isEnumDeclaration(statement) || ts.isModuleDeclaration(statement)) return statement.name && ts.isIdentifier(statement.name) ? [statement.name.text] : [];
+	return [];
+};
+const isDeclaredMoreThanOnce = (sourceFile, name) => sourceFile.statements.filter((s) => declaredNames(s).includes(name)).length > 1;
 const kindOfStatement = (node) => {
 	if (ts.isVariableStatement(node)) return "variable";
 	if (ts.isFunctionDeclaration(node)) return "function";
@@ -16940,6 +17200,11 @@ const kindOfStatement = (node) => {
 };
 const matchStatement = (sourceFile, statement, content, decl) => {
 	if (!kindOfStatement(statement)) return { type: "none" };
+	if (declaredNames(statement).includes(decl.name) && isDeclaredMoreThanOnce(sourceFile, decl.name)) return {
+		type: "skip",
+		reason: "merged declaration",
+		declaration: decl
+	};
 	if (ts.isVariableStatement(statement)) {
 		const varDecls = statement.declarationList.declarations;
 		if (varDecls.length === 0) return { type: "none" };
@@ -16955,6 +17220,8 @@ const matchStatement = (sourceFile, statement, content, decl) => {
 			reason: "multi-declaration variable statement",
 			declaration: decl
 		};
+		const referenced = removalFor(sourceFile, statement, content, decl);
+		if (referenced) return referenced;
 		if (initializerHasSideEffects(match.initializer)) return {
 			type: "skip",
 			reason: "initializer may have side effects",
@@ -16972,6 +17239,8 @@ const matchStatement = (sourceFile, statement, content, decl) => {
 		if (!statement.name) return { type: "none" };
 		if (statement.name.text !== decl.name) return { type: "none" };
 		if (!nodeContainsLine(sourceFile, statement, decl.line)) return { type: "none" };
+		const referenced = removalFor(sourceFile, statement, content, decl);
+		if (referenced) return referenced;
 		return {
 			type: "match",
 			removal: {
@@ -16983,6 +17252,8 @@ const matchStatement = (sourceFile, statement, content, decl) => {
 	if (ts.isTypeAliasDeclaration(statement) || ts.isInterfaceDeclaration(statement) || ts.isEnumDeclaration(statement)) {
 		if (statement.name.text !== decl.name) return { type: "none" };
 		if (!nodeContainsLine(sourceFile, statement, decl.line)) return { type: "none" };
+		const referenced = removalFor(sourceFile, statement, content, decl);
+		if (referenced) return referenced;
 		return {
 			type: "match",
 			removal: {
@@ -18198,6 +18469,835 @@ const recordFullScanActivity = (history, allowPilotInvitation, telemetryConfig)
 	appendHistory(history);
 	return allowPilotInvitation && !isHistoryDisabled() && !isTelemetryDisabled(telemetryConfig) && recordCompletedFullScan();
 };
+const AISLOP_MD_BODY = `# Raigal - agent instructions
+
+[Raigal](https://github.com/meethiu/raigal) is your guardrail for shipping clean, maintainable, production-grade code. It catches the patterns AI coding tools leave behind: dead imports, redundant code, duplicate logic, unsafe any-typed casts, narrative comments, swallowed errors, hidden fallbacks, oversized functions, risky security constructs - and grades the project out of 100 so regressions are visible. Treat its findings as blocking, not advisory: the goal is code a human maintainer would happily inherit.
+
+## On every edit
+
+A PostToolUse hook runs \`raigal hook claude\` after every Edit, Write, or MultiEdit. It scans the touched files and returns findings as JSON \`additionalContext\` shaped like \`RaigalFeedback\` (score, baseline, delta, regressed, counts, findings, newSinceBaseline, suggestedActions). Act on them the same turn; the \`suggestedActions\` field tells you exactly what to run next.
+
+## Severity ladder
+
+- \`error\` - MUST fix this turn.
+- \`warning\` + \`fixable: true\` - MUST fix this turn.
+- \`warning\` + \`fixable: false\` - fix if trivially mechanical, otherwise surface in your reply.
+
+## Rules
+
+- \`.raigal/config.yaml\` (or \`.aislop/config.yaml\`) - thresholds and engine toggles. Treat as authoritative; don't edit without user consent.
+- \`.raigal/rules.yaml\` (or \`.aislop/rules.yaml\`) - project-specific architecture rules (may be absent). When a finding cites \`architecture/*\`, open this file and follow it.
+- Custom rules can change between sessions. Trust what the scan returns, not a cached understanding of what the rules are.
+
+## Principles
+
+- Do not disable rules to pass the scan. Fix the underlying issue.
+- If a finding is a false positive, leave it and explain in your reply - do not delete the rule config.
+- The findings payload includes \`nextSteps[]\` - treat those as your plan for the turn.
+`;
+//#endregion
+//#region src/hooks/io/atomic-write.ts
+const atomicWrite = (targetPath, content) => {
+	const dir = path.dirname(targetPath);
+	fs.mkdirSync(dir, { recursive: true });
+	const rand = Math.random().toString(36).slice(2, 10);
+	const tmp = path.join(dir, `.aislop-tmp-${process.pid}-${rand}`);
+	fs.writeFileSync(tmp, content, "utf-8");
+	try {
+		fs.renameSync(tmp, targetPath);
+	} catch (err) {
+		const code = err?.code;
+		if (code === "EPERM" || code === "EBUSY") {
+			fs.copyFileSync(tmp, targetPath);
+			try {
+				fs.unlinkSync(tmp);
+			} catch {}
+		} else throw err;
+	}
+};
+const readIfExists = (targetPath) => {
+	try {
+		return fs.readFileSync(targetPath, "utf-8");
+	} catch {
+		return null;
+	}
+};
+//#endregion
+//#region src/hooks/io/sentinel.ts
+const sentinelHash = (content) => `sha256:${crypto.createHash("sha256").update(content).digest("hex").slice(0, 32)}`;
+const BEGIN_RE = /<!--\s*aislop:begin\s+v(\d+)(?:\s+hash=([^\s>]+))?\s*-->/;
+const END_RE = /<!--\s*aislop:end\s+v\d+\s*-->/;
+const renderFence = (body, hash) => [
+	`<!-- aislop:begin v1 hash=${hash} -->`,
+	body.trimEnd(),
+	"<!-- aislop:end v1 -->"
+].join("\n");
+const upsertMarkdownFence = (existing, body, hash) => {
+	const fenced = renderFence(body, hash);
+	if (existing == null || existing.length === 0) return {
+		nextContent: `${fenced}\n`,
+		replaced: false
+	};
+	const begin = existing.match(BEGIN_RE);
+	const end = existing.match(END_RE);
+	if (begin && end && (end.index ?? 0) > (begin.index ?? 0)) return {
+		nextContent: `${existing.slice(0, begin.index)}${fenced}${existing.slice((end.index ?? 0) + end[0].length)}`,
+		replaced: true
+	};
+	return {
+		nextContent: `${existing}${existing.endsWith("\n") ? "" : "\n"}\n${fenced}\n`,
+		replaced: false
+	};
+};
+//#endregion
+//#region src/hooks/install/types.ts
+const emptyResult = () => ({
+	wrote: [],
+	skipped: [],
+	planned: []
+});
+const applyContent = (result, opts, target, nextContent, summary) => {
+	if (readIfExists(target) === nextContent) {
+		result.skipped.push(target);
+		return;
+	}
+	if (opts.dryRun) {
+		result.planned.push({
+			path: target,
+			summary
+		});
+		return;
+	}
+	atomicWrite(target, nextContent);
+	result.wrote.push(target);
+};
+const applyRemoval = (result, opts, target, nextContent) => {
+	const existing = readIfExists(target);
+	if (existing == null) {
+		result.skipped.push(target);
+		return;
+	}
+	if (existing === (nextContent ?? "")) {
+		result.skipped.push(target);
+		return;
+	}
+	if (opts.dryRun) {
+		result.removed.push(target);
+		return;
+	}
+	if (nextContent == null) try {
+		fs.unlinkSync(target);
+	} catch {}
+	else atomicWrite(target, nextContent);
+	result.removed.push(target);
+};
+//#endregion
+//#region src/hooks/install/rules-only.ts
+const installRulesOnly = (opts, paths, summary) => {
+	const result = emptyResult();
+	const next = upsertMarkdownFence(readIfExists(paths.rules), AISLOP_MD_BODY, sentinelHash(AISLOP_MD_BODY)).nextContent;
+	applyContent(result, opts, paths.rules, next, summary);
+	if (paths.host && paths.marker) {
+		const host = readIfExists(paths.host) ?? "";
+		if (!host.includes(paths.marker)) {
+			const joiner = host.endsWith("\n") || host.length === 0 ? "" : "\n";
+			const prefix = host.length === 0 ? "" : `${host}${joiner}\n`;
+			applyContent(result, opts, paths.host, `${prefix}${paths.marker}\n`, `append ${paths.marker} reference`);
+		} else result.skipped.push(paths.host);
+	}
+	return result;
+};
+const uninstallRulesOnly = (opts, paths) => {
+	const result = {
+		removed: [],
+		skipped: []
+	};
+	if (readIfExists(paths.rules) != null) applyRemoval(result, opts, paths.rules, null);
+	else result.skipped.push(paths.rules);
+	if (paths.host && paths.marker) {
+		const host = readIfExists(paths.host);
+		if (host?.includes(paths.marker)) {
+			const stripped = host.split("\n").filter((l) => l.trim() !== paths.marker).join("\n").replace(/\n{3,}/g, "\n\n").trim();
+			applyRemoval(result, opts, paths.host, stripped.length === 0 ? null : `${stripped}\n`);
+		} else result.skipped.push(paths.host);
+	}
+	return result;
+};
+//#endregion
+//#region src/hooks/install/antigravity.ts
+const resolveAntigravityPaths = (opts) => ({ rules: path.join(opts.cwd, ".agents", "rules", "antigravity-aislop-rules.md") });
+const installAntigravity = (opts) => {
+	if (opts.scope !== "project") return {
+		wrote: [],
+		skipped: [],
+		planned: [{
+			path: ".agents/rules/antigravity-aislop-rules.md",
+			summary: "Antigravity is project-scope only; pass --project"
+		}]
+	};
+	return installRulesOnly(opts, resolveAntigravityPaths(opts), "write .agents/rules/antigravity-aislop-rules.md");
+};
+const uninstallAntigravity = (opts) => {
+	if (opts.scope !== "project") return {
+		removed: [],
+		skipped: []
+	};
+	return uninstallRulesOnly(opts, resolveAntigravityPaths(opts));
+};
+//#endregion
+//#region src/hooks/io/json-patch.ts
+const AISLOP_SENTINEL_KEY = "__aislop";
+const isAislopManaged = (x) => typeof x === "object" && x !== null && "__aislop" in x && x["__aislop"] != null;
+const groupIsAislop = (group) => {
+	if (typeof group !== "object" || group === null) return false;
+	const hooks = group.hooks;
+	if (!Array.isArray(hooks)) return false;
+	return hooks.some((h) => isAislopManaged(h));
+};
+const upsertHookGroup = (config, event, group) => {
+	const next = { ...config };
+	const hooks = next.hooks && typeof next.hooks === "object" ? next.hooks : {};
+	const cleaned = (Array.isArray(hooks[event]) ? hooks[event] : []).filter((g) => !groupIsAislop(g));
+	next.hooks = {
+		...hooks,
+		[event]: [...cleaned, group]
+	};
+	return next;
+};
+const upsertFlatHook = (config, event, entry) => {
+	const next = { ...config };
+	const hooks = next.hooks && typeof next.hooks === "object" ? next.hooks : {};
+	const cleaned = (Array.isArray(hooks[event]) ? hooks[event] : []).filter((e) => !isAislopManaged(e));
+	next.hooks = {
+		...hooks,
+		[event]: [...cleaned, entry]
+	};
+	return next;
+};
+const removeAislopEntries = (config, event) => {
+	const next = { ...config };
+	const hooks = next.hooks && typeof next.hooks === "object" ? next.hooks : {};
+	const existing = Array.isArray(hooks[event]) ? hooks[event] : [];
+	const cleaned = existing.filter((e) => !isAislopManaged(e) && !groupIsAislop(e));
+	const removed = existing.length - cleaned.length;
+	const nextHooks = { ...hooks };
+	if (cleaned.length === 0) delete nextHooks[event];
+	else nextHooks[event] = cleaned;
+	if (Object.keys(nextHooks).length === 0) delete next.hooks;
+	else next.hooks = nextHooks;
+	return {
+		next,
+		removed
+	};
+};
+//#endregion
+//#region src/hooks/install/claude.ts
+const resolveClaudePaths = (opts) => {
+	const root = opts.scope === "project" ? path.join(opts.cwd, ".claude") : path.join(opts.home, ".claude");
+	return {
+		settings: path.join(root, "settings.json"),
+		aislopMd: path.join(root, "AISLOP.md"),
+		claudeMd: path.join(root, "CLAUDE.md")
+	};
+};
+const buildHookGroup$1 = () => {
+	const hashBody = JSON.stringify({
+		command: "aislop hook claude",
+		matcher: "Edit|Write|MultiEdit"
+	});
+	return {
+		matcher: "Edit|Write|MultiEdit",
+		hooks: [{
+			type: "command",
+			command: "aislop hook claude",
+			[AISLOP_SENTINEL_KEY]: {
+				v: 1,
+				managed: true,
+				hash: sentinelHash(hashBody)
+			}
+		}]
+	};
+};
+const buildStopHookGroup = () => {
+	const hashBody = JSON.stringify({ command: "aislop hook claude --stop" });
+	return {
+		matcher: "",
+		hooks: [{
+			type: "command",
+			command: "aislop hook claude --stop",
+			[AISLOP_SENTINEL_KEY]: {
+				v: 1,
+				managed: true,
+				hash: sentinelHash(hashBody)
+			}
+		}]
+	};
+};
+const FILE_CHANGED_MATCHER = ".raigal/config.yml|.raigal/rules.yml|.aislop/config.yml|.aislop/rules.yml|package.json";
+const buildFileChangedHookGroup = () => {
+	const hashBody = JSON.stringify({
+		command: "aislop hook claude --on-file-changed",
+		matcher: FILE_CHANGED_MATCHER
+	});
+	return {
+		matcher: FILE_CHANGED_MATCHER,
+		hooks: [{
+			type: "command",
+			command: "aislop hook claude --on-file-changed",
+			[AISLOP_SENTINEL_KEY]: {
+				v: 1,
+				managed: true,
+				hash: sentinelHash(hashBody)
+			}
+		}]
+	};
+};
+const renderSettings$1 = (existingRaw, qualityGate) => {
+	let obj = {};
+	if (existingRaw) try {
+		obj = JSON.parse(existingRaw);
+	} catch {
+		obj = {};
+	}
+	let next = upsertHookGroup(obj, "PostToolUse", buildHookGroup$1());
+	next = upsertHookGroup(next, "FileChanged", buildFileChangedHookGroup());
+	if (qualityGate) next = upsertHookGroup(next, "Stop", buildStopHookGroup());
+	else next = removeAislopEntries(next, "Stop").next;
+	return `${JSON.stringify(next, null, 2)}\n`;
+};
+const installClaude = (opts) => {
+	const paths = resolveClaudePaths(opts);
+	const result = emptyResult();
+	const nextSettings = renderSettings$1(readIfExists(paths.settings), Boolean(opts.qualityGate));
+	applyContent(result, opts, paths.settings, nextSettings, "register PostToolUse + FileChanged hooks");
+	const mdHash = sentinelHash(AISLOP_MD_BODY);
+	const fenced = upsertMarkdownFence(readIfExists(paths.aislopMd), AISLOP_MD_BODY, mdHash);
+	applyContent(result, opts, paths.aislopMd, fenced.nextContent, "write AISLOP.md rules");
+	const existingClaudeMd = readIfExists(paths.claudeMd) ?? "";
+	const marker = "@AISLOP.md";
+	if (!existingClaudeMd.includes(marker)) {
+		const joiner = existingClaudeMd.endsWith("\n") || existingClaudeMd.length === 0 ? "" : "\n";
+		const prefix = existingClaudeMd.length === 0 ? "" : `${existingClaudeMd}${joiner}\n`;
+		applyContent(result, opts, paths.claudeMd, `${prefix}${marker}\n`, "append @AISLOP.md reference");
+	} else result.skipped.push(paths.claudeMd);
+	return result;
+};
+const uninstallClaude = (opts) => {
+	const paths = resolveClaudePaths({
+		...opts,
+		qualityGate: false
+	});
+	const result = {
+		removed: [],
+		skipped: []
+	};
+	const settingsRaw = readIfExists(paths.settings);
+	if (settingsRaw) {
+		let obj = {};
+		try {
+			obj = JSON.parse(settingsRaw);
+		} catch {
+			obj = {};
+		}
+		const afterPostToolUse = removeAislopEntries(obj, "PostToolUse").next;
+		const afterFileChanged = removeAislopEntries(afterPostToolUse, "FileChanged").next;
+		const stripped = removeAislopEntries(afterFileChanged, "Stop").next;
+		const stillHasHooks = stripped.hooks && typeof stripped.hooks === "object" && Object.keys(stripped.hooks).length > 0;
+		const otherKeys = Object.keys(stripped).filter((k) => k !== "hooks");
+		if (!stillHasHooks && otherKeys.length === 0) applyRemoval(result, opts, paths.settings, null);
+		else applyRemoval(result, opts, paths.settings, `${JSON.stringify(stripped, null, 2)}\n`);
+	} else result.skipped.push(paths.settings);
+	if (readIfExists(paths.aislopMd) != null) applyRemoval(result, opts, paths.aislopMd, null);
+	else result.skipped.push(paths.aislopMd);
+	const claudeMd = readIfExists(paths.claudeMd);
+	if (claudeMd?.includes("@AISLOP.md")) {
+		const stripped = claudeMd.split("\n").filter((line) => line.trim() !== "@AISLOP.md").join("\n").replace(/\n{3,}/g, "\n\n").trim();
+		applyRemoval(result, opts, paths.claudeMd, stripped.length === 0 ? null : `${stripped}\n`);
+	} else result.skipped.push(paths.claudeMd);
+	return result;
+};
+//#endregion
+//#region src/hooks/install/cline.ts
+const resolveClinePaths = (opts) => ({ rules: path.join(opts.cwd, ".clinerules") });
+const resolveRooPaths = (opts) => ({ rules: path.join(opts.cwd, ".roo", "rules", "aislop.md") });
+const installCline = (opts) => {
+	if (opts.scope !== "project") return {
+		wrote: [],
+		skipped: [],
+		planned: [{
+			path: ".clinerules",
+			summary: "Cline is project-scope only; pass --project"
+		}]
+	};
+	const cline = installRulesOnly(opts, resolveClinePaths(opts), "write .clinerules");
+	const roo = installRulesOnly(opts, resolveRooPaths(opts), "write .roo/rules/aislop.md");
+	return {
+		wrote: [...cline.wrote, ...roo.wrote],
+		skipped: [...cline.skipped, ...roo.skipped],
+		planned: [...cline.planned, ...roo.planned]
+	};
+};
+const uninstallCline = (opts) => {
+	if (opts.scope !== "project") return {
+		removed: [],
+		skipped: []
+	};
+	const a = uninstallRulesOnly(opts, resolveClinePaths(opts));
+	const b = uninstallRulesOnly(opts, resolveRooPaths(opts));
+	return {
+		removed: [...a.removed, ...b.removed],
+		skipped: [...a.skipped, ...b.skipped]
+	};
+};
+//#endregion
+//#region src/hooks/install/codex.ts
+const resolveCodexPaths = (opts) => ({ rules: opts.scope === "project" ? path.join(opts.cwd, "AGENTS.md") : path.join(opts.home, ".codex", "AGENTS.md") });
+const installCodex = (opts) => installRulesOnly(opts, resolveCodexPaths(opts), "write AGENTS.md rules for Codex");
+const uninstallCodex = (opts) => uninstallRulesOnly(opts, resolveCodexPaths(opts));
+//#endregion
+//#region src/hooks/install/copilot.ts
+const resolveCopilotPaths = (opts) => ({ rules: path.join(opts.cwd, ".github", "copilot-instructions.md") });
+const installCopilot = (opts) => {
+	if (opts.scope !== "project") return {
+		wrote: [],
+		skipped: [],
+		planned: [{
+			path: ".github/copilot-instructions.md",
+			summary: "Copilot is project-scope only; pass --project"
+		}]
+	};
+	return installRulesOnly(opts, resolveCopilotPaths(opts), "write .github/copilot-instructions.md");
+};
+const uninstallCopilot = (opts) => {
+	if (opts.scope !== "project") return {
+		removed: [],
+		skipped: []
+	};
+	return uninstallRulesOnly(opts, resolveCopilotPaths(opts));
+};
+//#endregion
+//#region src/hooks/install/cursor.ts
+const resolveCursorPaths = (opts) => {
+	const root = opts.scope === "project" ? path.join(opts.cwd, ".cursor") : path.join(opts.home, ".cursor");
+	return {
+		hooks: path.join(root, "hooks.json"),
+		rules: path.join(opts.cwd, ".cursor", "rules", "aislop.mdc")
+	};
+};
+const buildHookEntry = () => {
+	const hashBody = JSON.stringify({
+		command: "aislop hook cursor",
+		timeout: 5e3
+	});
+	return {
+		command: "aislop hook cursor",
+		type: "command",
+		timeout: 5e3,
+		[AISLOP_SENTINEL_KEY]: {
+			v: 1,
+			managed: true,
+			hash: sentinelHash(hashBody)
+		}
+	};
+};
+const renderHooksJson = (existingRaw) => {
+	let obj = { version: 1 };
+	if (existingRaw) try {
+		obj = JSON.parse(existingRaw);
+	} catch {
+		obj = { version: 1 };
+	}
+	if (typeof obj.version !== "number") obj.version = 1;
+	const next = upsertFlatHook(obj, "afterFileEdit", buildHookEntry());
+	return `${JSON.stringify(next, null, 2)}\n`;
+};
+const installCursor = (opts) => {
+	const paths = resolveCursorPaths(opts);
+	const result = emptyResult();
+	const nextHooks = renderHooksJson(readIfExists(paths.hooks));
+	applyContent(result, opts, paths.hooks, nextHooks, "register afterFileEdit hook");
+	if (opts.scope === "project") {
+		const rules = upsertMarkdownFence(readIfExists(paths.rules), AISLOP_MD_BODY, sentinelHash(AISLOP_MD_BODY)).nextContent;
+		applyContent(result, opts, paths.rules, rules, "write .cursor/rules/aislop.mdc");
+	}
+	return result;
+};
+const uninstallCursor = (opts) => {
+	const paths = resolveCursorPaths(opts);
+	const result = {
+		removed: [],
+		skipped: []
+	};
+	const raw = readIfExists(paths.hooks);
+	if (raw) {
+		let obj = {};
+		try {
+			obj = JSON.parse(raw);
+		} catch {
+			obj = {};
+		}
+		const stripped = removeAislopEntries(obj, "afterFileEdit").next;
+		const stillHasHooks = stripped.hooks && typeof stripped.hooks === "object" && Object.keys(stripped.hooks).length > 0;
+		const otherKeys = Object.keys(stripped).filter((k) => k !== "hooks" && k !== "version");
+		if (!stillHasHooks && otherKeys.length === 0) applyRemoval(result, opts, paths.hooks, null);
+		else applyRemoval(result, opts, paths.hooks, `${JSON.stringify(stripped, null, 2)}\n`);
+	} else result.skipped.push(paths.hooks);
+	if (opts.scope === "project") applyRemoval(result, opts, paths.rules, null);
+	return result;
+};
+//#endregion
+//#region src/hooks/install/gemini.ts
+const resolveGeminiPaths = (opts) => {
+	const root = opts.scope === "project" ? path.join(opts.cwd, ".gemini") : path.join(opts.home, ".gemini");
+	return {
+		settings: path.join(root, "settings.json"),
+		aislopMd: path.join(root, "AISLOP.md"),
+		geminiMd: path.join(root, "GEMINI.md")
+	};
+};
+const buildHookGroup = () => {
+	const hashBody = JSON.stringify({
+		command: "aislop hook gemini",
+		matcher: "write_file|replace"
+	});
+	return {
+		matcher: "write_file|replace",
+		hooks: [{
+			name: "aislop",
+			type: "command",
+			command: "aislop hook gemini",
+			timeout: 5e3,
+			[AISLOP_SENTINEL_KEY]: {
+				v: 1,
+				managed: true,
+				hash: sentinelHash(hashBody)
+			}
+		}]
+	};
+};
+const renderSettings = (existingRaw) => {
+	let obj = {};
+	if (existingRaw) try {
+		obj = JSON.parse(existingRaw);
+	} catch {
+		obj = {};
+	}
+	const next = upsertHookGroup(obj, "AfterTool", buildHookGroup());
+	return `${JSON.stringify(next, null, 2)}\n`;
+};
+const installGemini = (opts) => {
+	const paths = resolveGeminiPaths(opts);
+	const result = emptyResult();
+	const next = renderSettings(readIfExists(paths.settings));
+	applyContent(result, opts, paths.settings, next, "register AfterTool hook");
+	const fenced = upsertMarkdownFence(readIfExists(paths.aislopMd), AISLOP_MD_BODY, sentinelHash(AISLOP_MD_BODY)).nextContent;
+	applyContent(result, opts, paths.aislopMd, fenced, "write AISLOP.md rules");
+	const existingGeminiMd = readIfExists(paths.geminiMd) ?? "";
+	const marker = "@AISLOP.md";
+	if (!existingGeminiMd.includes(marker)) {
+		const joiner = existingGeminiMd.endsWith("\n") || existingGeminiMd.length === 0 ? "" : "\n";
+		const prefix = existingGeminiMd.length === 0 ? "" : `${existingGeminiMd}${joiner}\n`;
+		applyContent(result, opts, paths.geminiMd, `${prefix}${marker}\n`, "append @AISLOP.md reference");
+	} else result.skipped.push(paths.geminiMd);
+	return result;
+};
+const uninstallGemini = (opts) => {
+	const paths = resolveGeminiPaths(opts);
+	const result = {
+		removed: [],
+		skipped: []
+	};
+	const raw = readIfExists(paths.settings);
+	if (raw) {
+		let obj = {};
+		try {
+			obj = JSON.parse(raw);
+		} catch {
+			obj = {};
+		}
+		const stripped = removeAislopEntries(obj, "AfterTool").next;
+		const stillHasHooks = stripped.hooks && typeof stripped.hooks === "object" && Object.keys(stripped.hooks).length > 0;
+		const otherKeys = Object.keys(stripped).filter((k) => k !== "hooks");
+		if (!stillHasHooks && otherKeys.length === 0) applyRemoval(result, opts, paths.settings, null);
+		else applyRemoval(result, opts, paths.settings, `${JSON.stringify(stripped, null, 2)}\n`);
+	} else result.skipped.push(paths.settings);
+	if (readIfExists(paths.aislopMd) != null) applyRemoval(result, opts, paths.aislopMd, null);
+	else result.skipped.push(paths.aislopMd);
+	const geminiMd = readIfExists(paths.geminiMd);
+	if (geminiMd?.includes("@AISLOP.md")) {
+		const stripped = geminiMd.split("\n").filter((l) => l.trim() !== "@AISLOP.md").join("\n").replace(/\n{3,}/g, "\n\n").trim();
+		applyRemoval(result, opts, paths.geminiMd, stripped.length === 0 ? null : `${stripped}\n`);
+	} else result.skipped.push(paths.geminiMd);
+	return result;
+};
+//#endregion
+//#region src/hooks/install/kilocode.ts
+const resolveKilocodePaths = (opts) => ({ rules: path.join(opts.cwd, ".kilocode", "rules", "aislop-rules.md") });
+const installKilocode = (opts) => {
+	if (opts.scope !== "project") return {
+		wrote: [],
+		skipped: [],
+		planned: [{
+			path: ".kilocode/rules/aislop-rules.md",
+			summary: "Kilo Code is project-scope only; pass --project"
+		}]
+	};
+	return installRulesOnly(opts, resolveKilocodePaths(opts), "write .kilocode/rules/aislop-rules.md");
+};
+const uninstallKilocode = (opts) => {
+	if (opts.scope !== "project") return {
+		removed: [],
+		skipped: []
+	};
+	return uninstallRulesOnly(opts, resolveKilocodePaths(opts));
+};
+//#endregion
+//#region src/hooks/install/pi.ts
+const resolvePiPaths = (opts) => {
+	return { extension: opts.scope === "project" ? path.join(opts.cwd, ".pi", "extensions", "aislop.js") : path.join(opts.home, ".pi", "agent", "extensions", "aislop.js") };
+};
+const PI_EXTENSION_SOURCE = `// aislop — auto-generated pi extension. Do not edit by hand.
+// Reinstall with: aislop hook install --pi
+import { spawn } from "node:child_process";
+
+// Runs the CLI async so a slow scan never blocks pi's event loop, and forwards
+// ctx.signal so Esc actually kills the child instead of it running to completion.
+const runHook = (bin, args, input, signal) =>
+	new Promise((resolve) => {
+		const child = spawn(bin, args, { stdio: ["pipe", "pipe", "ignore"] });
+		const chunks = [];
+		let settled = false;
+		let timer;
+		const onAbort = () => {
+			child.kill();
+			finish(null);
+		};
+		const cleanup = () => {
+			if (timer !== undefined) clearTimeout(timer);
+			signal?.removeEventListener("abort", onAbort);
+		};
+		const finish = (value) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			resolve(value);
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+		timer = setTimeout(() => {
+			child.kill();
+			finish(null);
+		}, 15000);
+		child.stdout.on("data", (c) => chunks.push(c));
+		child.on("error", () => finish(null));
+		child.on("close", (code) => {
+			finish(code === 0 && chunks.length > 0 ? Buffer.concat(chunks).toString("utf-8") : null);
+		});
+		child.stdin.end(input);
+	});
+
+export default function (pi) {
+	pi.on("tool_result", async (event, ctx) => {
+		if (event.toolName !== "edit" && event.toolName !== "write") return;
+		if (event.isError) return;
+		const filePath = event.input && event.input.path;
+		if (typeof filePath !== "string" || filePath.length === 0) return;
+
+		const bin = process.env.AISLOP_BIN || "aislop";
+		const payload = JSON.stringify({
+			cwd: ctx.cwd,
+			file_path: filePath,
+			tool_name: event.toolName,
+		});
+
+		let out;
+		try {
+			const stdout = await runHook(bin, ["hook", "pi"], payload, ctx.signal);
+			if (!stdout) return;
+			out = JSON.parse(stdout);
+		} catch {
+			return;
+		}
+		if (!out || !out.message) return;
+
+		return {
+			content: [...event.content, { type: "text", text: out.message }],
+			isError: event.isError,
+		};
+	});
+}
+`;
+const installPi = (opts) => {
+	const paths = resolvePiPaths(opts);
+	const result = emptyResult();
+	applyContent(result, opts, paths.extension, PI_EXTENSION_SOURCE, "write pi aislop extension");
+	return result;
+};
+const uninstallPi = (opts) => {
+	const paths = resolvePiPaths(opts);
+	const result = {
+		removed: [],
+		skipped: []
+	};
+	if (readIfExists(paths.extension) != null) applyRemoval(result, opts, paths.extension, null);
+	else result.skipped.push(paths.extension);
+	return result;
+};
+//#endregion
+//#region src/hooks/install/windsurf.ts
+const resolveWindsurfPaths = (opts) => ({ rules: path.join(opts.cwd, ".windsurfrules") });
+const installWindsurf = (opts) => {
+	if (opts.scope !== "project") return {
+		wrote: [],
+		skipped: [],
+		planned: [{
+			path: ".windsurfrules",
+			summary: "Windsurf is project-scope only; pass --project"
+		}]
+	};
+	return installRulesOnly(opts, resolveWindsurfPaths(opts), "write .windsurfrules");
+};
+const uninstallWindsurf = (opts) => {
+	if (opts.scope !== "project") return {
+		removed: [],
+		skipped: []
+	};
+	return uninstallRulesOnly(opts, resolveWindsurfPaths(opts));
+};
+//#endregion
+//#region src/hooks/install/registry.ts
+const ALL_AGENTS = [
+	"claude",
+	"cursor",
+	"gemini",
+	"pi",
+	"codex",
+	"windsurf",
+	"cline",
+	"kilocode",
+	"antigravity",
+	"copilot"
+];
+const AGENTS_PROJECT_ONLY = [
+	"windsurf",
+	"cline",
+	"kilocode",
+	"antigravity",
+	"copilot"
+];
+const AGENTS_SUPPORTING_BOTH_SCOPES = [
+	"claude",
+	"cursor",
+	"gemini",
+	"pi",
+	"codex"
+];
+const paths = {
+	claude: (opts) => {
+		const p = resolveClaudePaths(opts);
+		return [
+			p.settings,
+			p.aislopMd,
+			p.claudeMd
+		];
+	},
+	cursor: (opts) => {
+		const p = resolveCursorPaths(opts);
+		return opts.scope === "project" ? [p.hooks, p.rules] : [p.hooks];
+	},
+	gemini: (opts) => {
+		const p = resolveGeminiPaths(opts);
+		return [
+			p.settings,
+			p.aislopMd,
+			p.geminiMd
+		];
+	},
+	pi: (opts) => [resolvePiPaths(opts).extension],
+	codex: (opts) => [resolveCodexPaths(opts).rules],
+	windsurf: (opts) => [resolveWindsurfPaths(opts).rules],
+	cline: (opts) => [resolveClinePaths(opts).rules, resolveRooPaths(opts).rules],
+	kilocode: (opts) => [resolveKilocodePaths(opts).rules],
+	antigravity: (opts) => [resolveAntigravityPaths(opts).rules],
+	copilot: (opts) => [resolveCopilotPaths(opts).rules]
+};
+const REGISTRY = {
+	claude: {
+		install: installClaude,
+		uninstall: uninstallClaude,
+		paths: paths.claude
+	},
+	cursor: {
+		install: installCursor,
+		uninstall: uninstallCursor,
+		paths: paths.cursor
+	},
+	gemini: {
+		install: installGemini,
+		uninstall: uninstallGemini,
+		paths: paths.gemini
+	},
+	pi: {
+		install: installPi,
+		uninstall: uninstallPi,
+		paths: paths.pi
+	},
+	codex: {
+		install: installCodex,
+		uninstall: uninstallCodex,
+		paths: paths.codex
+	},
+	windsurf: {
+		install: installWindsurf,
+		uninstall: uninstallWindsurf,
+		paths: paths.windsurf
+	},
+	cline: {
+		install: installCline,
+		uninstall: uninstallCline,
+		paths: paths.cline
+	},
+	kilocode: {
+		install: installKilocode,
+		uninstall: uninstallKilocode,
+		paths: paths.kilocode
+	},
+	antigravity: {
+		install: installAntigravity,
+		uninstall: uninstallAntigravity,
+		paths: paths.antigravity
+	},
+	copilot: {
+		install: installCopilot,
+		uninstall: uninstallCopilot,
+		paths: paths.copilot
+	}
+};
+const defaultScopeFor = (agent) => AGENTS_PROJECT_ONLY.includes(agent) ? "project" : "global";
+const HOOK_MARKERS = [
+	"__raigal",
+	"raigal:begin",
+	"@RAIGAL.md",
+	"__aislop",
+	"aislop:begin",
+	"@AISLOP.md"
+];
+const hasHook = (target) => {
+	try {
+		if (!fs.statSync(target).isFile()) return false;
+		const base = path.basename(target).toLowerCase();
+		if (base.startsWith("raigal") || base.startsWith("aislop")) return true;
+		const content = fs.readFileSync(target, "utf8");
+		return HOOK_MARKERS.some((marker) => content.includes(marker));
+	} catch {
+		return false;
+	}
+};
+const detectionScopes = (agent) => AGENTS_SUPPORTING_BOTH_SCOPES.includes(agent) ? ["global", "project"] : [defaultScopeFor(agent)];
+const detectRaigalHooks = (opts) => ALL_AGENTS.filter((agent) => detectionScopes(agent).some((scope) => REGISTRY[agent].paths({
+	home: opts.home,
+	cwd: opts.cwd,
+	scope
+}).some(hasHook)));
 //#endregion
 //#region src/output/terminal.ts
 const groupBy = (items, key) => {
@@ -18365,27 +19465,16 @@ const printEngineStatus = (result) => {
 	}
 };
 //#endregion
-//#region src/scoring/rule-severity.ts
-/**
-* Apply per-rule severity overrides from config: "off" drops the diagnostic,
-* "error"/"warning" rewrite its severity before scoring and rendering.
-*/
-const applyRuleSeverities = (diagnostics, overrides) => {
-	if (Object.keys(overrides).length === 0) return diagnostics;
-	const result = [];
-	for (const diagnostic of diagnostics) {
-		const override = overrides[diagnostic.rule];
-		if (!override) {
-			result.push(diagnostic);
-			continue;
-		}
-		if (override === "off") continue;
-		result.push(override === diagnostic.severity ? diagnostic : {
-			...diagnostic,
-			severity: override
-		});
-	}
-	return result;
+//#region src/commands/scan-hook-nudge.ts
+const shouldShowHookNudge = (ctx) => ctx.isTty && !ctx.isCi && ctx.installedAgentCount === 0;
+const buildHookNudge = (ctx) => {
+	if (!shouldShowHookNudge(ctx)) return null;
+	return [
+		"",
+		"Next: install the per-edit hook so your coding agent fixes slop before it lands.",
+		ctx.invocation === "raigal" ? "  raigal hook install" : "  npm install -g @methiu/raigal && raigal hook install",
+		""
+	].join("\n");
 };
 //#endregion
 //#region src/commands/scan-coverage.ts
@@ -18960,7 +20049,7 @@ const buildScanNextSteps = (input) => {
 		emphasis: "primary",
 		label: "Provider",
 		command: `${input.invocation} agent --provider codex`,
-		detail: "or use --provider claude/opencode"
+		detail: "or use --provider claude/opencode/pi"
 	}, {
 		emphasis: "muted",
 		label: "Preview",
@@ -19119,6 +20208,8 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 	const configDir = findConfigDir(resolvedDir);
 	const rulesPath = configDir ? path.join(configDir, RULES_FILE) : void 0;
 	const engineConfig = {
+		overrides: config.overrides,
+		rules: config.rules,
 		quality: config.quality,
 		security: config.security,
 		lint: config.lint,
@@ -19140,7 +20231,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		config: engineConfig
 	}, config.engines, machineOutput)).map((result) => ({
 		...result,
-		diagnostics: applyRuleSeverities(result.diagnostics, config.rules)
+		diagnostics: config.overrides.length ? result.diagnostics : applyRuleSeverities(result.diagnostics, config.rules)
 	})), resolvedDir);
 	if (suppressedCount > 0 && !machineOutput) log.muted(`Suppressed ${suppressedCount} finding(s) via raigal-ignore directives`);
 	const changeMap = options.changes && !options.staged ? getChangedLineMap(resolvedDir, options.base) : null;
@@ -19178,6 +20269,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		engineIssues[r.engine] = r.diagnostics.length;
 		engineTimings[r.engine] = Math.round(r.elapsed);
 	}
+	const enginesFailed = results.filter((r) => r.failed).map((r) => r.engine);
 	const completion = {
 		exitCode,
 		score: scoreable ? scoreResult.score : null,
@@ -19187,7 +20279,8 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		warningCount: allDiagnostics.filter((d) => d.severity === "warning").length,
 		fixableCount: allDiagnostics.filter((d) => d.fixable).length,
 		engineIssues,
-		engineTimings
+		engineTimings,
+		...enginesFailed.length > 0 ? { properties: { engines_failed: enginesFailed } } : {}
 	};
 	recordScanToCloud({
 		results,
@@ -19200,12 +20293,12 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		scoreFileCount
 	});
 	if (options.sarif) {
-		const { buildSarifLog } = await import("./sarif-Do8E1xhZ.js");
+		const { buildSarifLog } = await import("./sarif-Ba5D8TPH.js");
 		console.log(JSON.stringify(buildSarifLog(results), null, 2));
 		return completion;
 	}
 	if (options.json) {
-		const { buildJsonOutput } = await import("./json-C2IwKr9o.js");
+		const { buildJsonOutput } = await import("./json-DBoMe4xB.js");
 		const jsonOut = buildJsonOutput(results, scoreResult, scoreFileCount, elapsedMs, scanCoverage);
 		console.log(JSON.stringify(jsonOut, null, 2));
 		return completion;
@@ -19238,6 +20331,18 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		printBrand: options.printBrand,
 		showPilotInvitation
 	}));
+	if (options.command !== "ci" && options.printBrand !== false) {
+		const nudge = buildHookNudge({
+			installedAgentCount: detectRaigalHooks({
+				home: os.homedir(),
+				cwd: resolvedDir
+			}).length,
+			isTty: Boolean(process.stdout.isTTY),
+			isCi: isCiEnv(),
+			invocation: detectInvocation()
+		});
+		if (nudge) process.stdout.write(nudge);
+	}
 	return completion;
 };
 //#endregion
@@ -19402,6 +20507,8 @@ const runFixBody = async (resolvedDir, config, options, projectInfo) => {
 	const configDir = findConfigDir(resolvedDir);
 	const rulesPath = configDir ? path.join(configDir, RULES_FILE) : void 0;
 	const engineConfig = {
+		overrides: config.overrides,
+		rules: config.rules,
 		quality: config.quality,
 		security: config.security,
 		lint: config.lint,
@@ -19427,7 +20534,7 @@ const runFixBody = async (resolvedDir, config, options, projectInfo) => {
 		status: "done",
 		label: "Verification complete"
 	});
-	const scanResults = appendPostFixLintResult(verificationResults, collectPostFixLintDiagnostics(steps));
+	const scanResults = appendPostFixLintResult(verificationResults, applyFileOverrides(collectPostFixLintDiagnostics(steps), context));
 	const allDiagnostics = scanResults.flatMap((r) => r.diagnostics);
 	const scoreResult = calculateScore(allDiagnostics, config.scoring.weights, config.scoring.thresholds, scope ? scope.scoreFileCount : projectInfo.sourceFileCount, config.scoring.smoothing, config.scoring.maxPerRule);
 	const errors = allDiagnostics.filter((d) => d.severity === "error").length;
@@ -19489,6 +20596,13 @@ const runFixBody = async (resolvedDir, config, options, projectInfo) => {
 	};
 };
 //#endregion
+//#region src/ui/prompts.ts
+const runCancellable = async (fn) => {
+	const value = await fn();
+	if (isCancel(value)) return void 0;
+	return value;
+};
+//#endregion
 //#region src/commands/init.ts
 const buildInitSuccessRender = (input) => {
 	const deps = {
@@ -19558,13 +20672,13 @@ const writeGithubWorkflow = (rootDirectory, enabled) => {
 	};
 };
 const promptForConfigChoices = async () => {
-	const enginesSelection = await multiselect({
+	const enginesSelection = await runCancellable(() => multiselect({
 		message: "Which engines should run?",
 		options: ENGINE_CHOICES,
 		initialValues: DEFAULT_ENGINE_SELECTION,
 		required: false
-	});
-	if (isCancel(enginesSelection)) return null;
+	}));
+	if (enginesSelection === void 0) return null;
 	const failBelowRaw = await text({
 		message: "CI quality gate — fail the build when the score drops below (0-100)",
 		initialValue: "70",