@methiu/raigal 0.2.0 → 0.2.3

package/dist/cli.js

@@ -13,9 +13,8 @@ import { z } from "zod/v4";
 import crypto, { createHash, createPublicKey, randomUUID, verify } from "node:crypto";
 import YAML, { parse } from "yaml";
 import { confirm, isCancel, multiselect, select, text } from "@clack/prompts";
-import * as readline$1 from "node:readline";
-import readline from "node:readline";
-import micromatch from "micromatch";
+import readline, * as readline$1 from "node:readline";
+import picomatch from "picomatch";
 import ts from "typescript";
 import { parse as parse$1 } from "smol-toml";
 import { Writable } from "node:stream";
@@ -113,7 +112,8 @@ const commandExists = (bin) => {
 			}
 		}
 	}
-	const result = spawnSync(process.platform === "win32" ? "where.exe" : "which", [bin], {
+	const command = process.platform === "win32" ? "where.exe" : "which";
+	const result = spawnSync(command, [bin], {
 		encoding: "utf-8",
 		timeout: PROVIDER_PROBE_TIMEOUT_MS
 	});
@@ -702,7 +702,7 @@ const highlightRaigal = (text, theme, baseToken) => {
 	const tail = text.slice(lastIndex);
 	return out + (baseToken ? style$1(theme, baseToken, tail) : tail);
 };
-const highlightAislop = highlightRaigal;
+const highlightAislop = (...args) => highlightRaigal(...args);
 //#endregion
 //#region src/ui/width.ts
 const ANSI_RE$1 = new RegExp(`\\[[0-9;]*m`, "g");
@@ -711,7 +711,8 @@ const stringWidth = (s) => {
 	const bare = stripAnsi$1(s);
 	let total = 0;
 	for (const ch of bare) {
-		const w = wcwidth(ch.codePointAt(0) ?? 0);
+		const cp = ch.codePointAt(0) ?? 0;
+		const w = wcwidth(cp);
 		total += w > 0 ? w : 1;
 	}
 	return total;
@@ -727,7 +728,8 @@ const truncate = (s, max, ellipsis = "…") => {
 	let out = "";
 	let w = 0;
 	for (const ch of s) {
-		const cw = wcwidth(ch.codePointAt(0) ?? 0);
+		const cp = ch.codePointAt(0) ?? 0;
+		const cw = wcwidth(cp);
 		if (w + cw > limit) break;
 		out += ch;
 		w += cw;
@@ -737,7 +739,8 @@ const truncate = (s, max, ellipsis = "…") => {
 //#endregion
 //#region src/ui/display.ts
 const renderDisplaySection = (label, deps = {}) => {
-	return style$1(deps.theme ?? theme, "section", label);
+	const t = deps.theme ?? theme;
+	return style$1(t, "section", label);
 };
 const renderDisplayRows = (rows, options = {}) => {
 	if (rows.length === 0) return [];
@@ -898,7 +901,8 @@ const symbols = createSymbols({ plain: isPlain() });
 */
 const renderHintLine = (hint, deps = {}) => {
 	const t = deps.theme ?? theme;
-	return ` ${style$1(t, "accent", (deps.symbols ?? symbols).hint)} ${highlightAislop(maskSecrets(hint), t)}\n`;
+	const s = deps.symbols ?? symbols;
+	return ` ${style$1(t, "accent", s.hint)} ${highlightAislop(maskSecrets(hint), t)}\n`;
 };
 const createLogger = (deps = {}) => {
 	const t = deps.theme ?? theme;
@@ -923,7 +927,7 @@ const createLogger = (deps = {}) => {
 const log = createLogger();
 //#endregion
 //#region src/version.ts
-const APP_VERSION = "0.2.0";
+const APP_VERSION = "0.2.3";
 //#endregion
 //#region src/commands/agent-connect.ts
 const commandText = (status) => [status.provider.loginCommand.command, ...status.provider.loginCommand.args].join(" ");
@@ -1410,7 +1414,9 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	if (!header.kid) throw new JwtVerificationError("JWT header missing 'kid'", "unknown_kid");
 	const publicKey = getPublicKey(header.kid);
 	if (!publicKey) throw new JwtVerificationError(`Unknown or untrusted signing key id (kid: ${header.kid})`, "unknown_kid");
-	if (!verify(null, Buffer.from(`${headerB64}.${payloadB64}`, "utf-8"), publicKey, Buffer.from(signatureB64, "base64url"))) throw new JwtVerificationError("Invalid JWT cryptographic signature", "invalid_signature");
+	const signedData = Buffer.from(`${headerB64}.${payloadB64}`, "utf-8");
+	const signature = Buffer.from(signatureB64, "base64url");
+	if (!verify(null, signedData, publicKey, signature)) throw new JwtVerificationError("Invalid JWT cryptographic signature", "invalid_signature");
 	let rawPayload;
 	try {
 		rawPayload = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf-8"));
@@ -1422,7 +1428,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const claims = parsed.data;
 	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
 	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.2.0", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (!isVersionAtLeast("0.2.3", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -1456,7 +1462,7 @@ const fetchGitHubOidcToken = async () => {
 };
 //#endregion
 //#region src/cloud/entitlement.ts
-const GRACE_PERIOD_SECONDS = 4320 * 60;
+const GRACE_PERIOD_SECONDS = 259200;
 var MissingCredentialError = class extends Error {
 	constructor(message = "No organization credential found") {
 		super(message);
@@ -1536,6 +1542,10 @@ const handleEntitlementFetchError = (err, cached, cachedClaims, now) => {
 			nowSeconds: now,
 			allowGraceSeconds: GRACE_PERIOD_SECONDS
 		});
+		if (graceClaims.plan === "trial" && graceClaims.trial_ends_at && now > Math.floor(new Date(graceClaims.trial_ends_at).getTime() / 1e3)) {
+			clearCachedEntitlement();
+			throw new LicenceDeniedError("Organization trial has expired", "trial_expired");
+		}
 		return {
 			jwt: cached.entitlement,
 			claims: graceClaims,
@@ -1543,6 +1553,7 @@ const handleEntitlementFetchError = (err, cached, cachedClaims, now) => {
 			grace: now > graceClaims.exp
 		};
 	} catch (jwtErr) {
+		if (jwtErr instanceof LicenceDeniedError) throw jwtErr;
 		if (jwtErr instanceof JwtVerificationError && jwtErr.code === "expired_beyond_grace") throw new LicenceUnverifiableError(`Raigal license could not be verified online and the offline grace period expired on ${(/* @__PURE__ */ new Date((cachedClaims?.exp ?? 0) * 1e3)).toISOString()}. Check network connectivity or Raigal Cloud status.`);
 	}
 	throw new LicenceUnverifiableError(`Raigal license could not be verified online (${err instanceof Error ? err.message : String(err)}). Check network connectivity or Raigal Cloud status.`);
@@ -1557,7 +1568,8 @@ const getEntitlement = async () => {
 	} catch {
 		cachedClaims = null;
 	}
-	if (cached && cachedClaims && now < cached.refresh_after) return {
+	const isTrialExpired = cachedClaims?.plan === "trial" && cachedClaims.trial_ends_at && now > Math.floor(new Date(cachedClaims.trial_ends_at).getTime() / 1e3);
+	if (cached && cachedClaims && !isTrialExpired && now < cached.refresh_after) return {
 		jwt: cached.entitlement,
 		claims: cachedClaims,
 		fromCache: true
@@ -1566,7 +1578,7 @@ const getEntitlement = async () => {
 	if (!activeToken) {
 		oidcToken = await fetchGitHubOidcToken();
 		if (!oidcToken) {
-			if (cached && cachedClaims) return {
+			if (cached && cachedClaims && !isTrialExpired) return {
 				jwt: cached.entitlement,
 				claims: cachedClaims,
 				fromCache: true
@@ -1575,7 +1587,8 @@ const getEntitlement = async () => {
 		}
 	} else oidcToken = await fetchGitHubOidcToken();
 	try {
-		const response = await fetchEntitlementFromApi(activeToken?.token ?? "", oidcToken);
+		const tokenToPass = activeToken?.token ?? "";
+		const response = await fetchEntitlementFromApi(tokenToPass, oidcToken);
 		const claims = verifyEntitlementJwt(response.entitlement, { nowSeconds: now });
 		saveCachedEntitlement(response.entitlement, response.refresh_after);
 		return {
@@ -1589,7 +1602,7 @@ const getEntitlement = async () => {
 };
 //#endregion
 //#region src/cloud/owner.ts
-const GITHUB_REMOTE_RE$1 = /^(?:(?:git@|ssh:\/\/(?:git@)?)github\.com(?::(?:\d+\/)?|[:/])|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/.\s]+?)(?:\.git)?\s*$/;
+const GITHUB_REMOTE_RE$1 = /^(?:(?:git@|ssh:\/\/(?:git@)?)github\.com(?::(?:\d+\/)?|[:/])|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/\s]+?)(?:\.git)?\s*$/;
 const parseGitRemote = (rawUrl) => {
 	if (!rawUrl) return {
 		owner: null,
@@ -1727,6 +1740,23 @@ const requireEntitlement = async (options = {}) => {
 	try {
 		const entitlement = await getEntitlement();
 		const tokenKind = getActiveToken()?.kind ?? "session";
+		if (entitlement.claims.plan === "trial" && entitlement.claims.trial_ends_at) {
+			const trialEnd = new Date(entitlement.claims.trial_ends_at).getTime();
+			if (Date.now() > trialEnd) {
+				const message = "Raigal license denied: Organization trial has expired";
+				if (mode === "throw") throw new LicenceDeniedError(message, "trial_expired");
+				if (mode === "fatal") {
+					process.stderr.write(`${message}\n`);
+					process.exit(30);
+				}
+				process.stderr.write(`[raigal] ${message}\n`);
+				return {
+					ok: false,
+					exitCode: 30,
+					message
+				};
+			}
+		}
 		const detectedOwner = detectLocalRepoOwner(directory);
 		if (options.repoOwner) detectedOwner.owner = options.repoOwner.toLowerCase();
 		const ownerCheck = checkOwnerAgainstAllowlist(detectedOwner, entitlement.claims.allowed_owners, tokenKind);
@@ -2026,415 +2056,154 @@ const renderBackgroundLaunch = (launch) => {
 	].join("\n")}`);
 };
 //#endregion
-//#region src/agents/prompt.ts
-const CONTEXT_LINES$1 = 3;
-const MAX_DIAGNOSTICS_PER_FILE$1 = 6;
-const MAX_FILES$1 = 12;
-const priority = (diagnostic) => {
-	if (diagnostic.severity === "error") return 0;
-	if (diagnostic.severity === "warning") return 1;
-	return 2;
-};
-const selectAgentFindings = (diagnostics, limit) => diagnostics.filter((diagnostic) => diagnostic.severity !== "info").sort((a, b) => {
-	const severityDelta = priority(a) - priority(b);
-	if (severityDelta !== 0) return severityDelta;
-	if (a.fixable !== b.fixable) return a.fixable ? 1 : -1;
-	return a.filePath.localeCompare(b.filePath);
-}).slice(0, Math.max(1, limit));
-const groupByFile$1 = (diagnostics) => {
-	const groups = /* @__PURE__ */ new Map();
-	for (const diagnostic of diagnostics) {
-		const list = groups.get(diagnostic.filePath) ?? [];
-		list.push(diagnostic);
-		groups.set(diagnostic.filePath, list);
-	}
-	return [...groups.entries()].map(([filePath, items]) => ({
-		filePath,
-		diagnostics: items
-	})).slice(0, MAX_FILES$1);
+//#region src/agents/session-activity.ts
+const createUsageTotals = () => ({
+	inputTokens: 0,
+	cachedInputTokens: 0,
+	outputTokens: 0,
+	totalTokens: 0
+});
+const createSessionStats = () => ({
+	providerPasses: 0,
+	toolCalls: 0,
+	outputEvents: 0
+});
+const mergeProviderUsage = (totals, usage) => {
+	const inputTokens = Math.max(totals.inputTokens, usage.inputTokens ?? 0);
+	const cachedInputTokens = Math.max(totals.cachedInputTokens, usage.cachedInputTokens ?? 0);
+	const outputTokens = Math.max(totals.outputTokens, usage.outputTokens ?? 0);
+	const totalTokens = Math.max(totals.totalTokens, usage.totalTokens ?? inputTokens + cachedInputTokens + outputTokens);
+	const costUsd = usage.costUsd === void 0 ? totals.costUsd : Math.max(totals.costUsd ?? 0, usage.costUsd);
+	return {
+		inputTokens,
+		cachedInputTokens,
+		outputTokens,
+		totalTokens,
+		...costUsd !== void 0 ? { costUsd } : {}
+	};
 };
-const snippetFor = (rootDirectory, diagnostic) => {
-	if (diagnostic.line <= 0 || diagnostic.redactSource || isSecretClassRule(diagnostic.rule)) return null;
-	const absolutePath = path.resolve(rootDirectory, diagnostic.filePath);
-	let content;
-	try {
-		content = fs.readFileSync(absolutePath, "utf-8");
-	} catch {
-		return null;
-	}
-	const lines = content.split("\n");
-	const start = Math.max(0, diagnostic.line - 1 - CONTEXT_LINES$1);
-	const end = Math.min(lines.length, diagnostic.line + CONTEXT_LINES$1);
-	const out = [];
-	for (let index = start; index < end; index += 1) {
-		const lineNumber = index + 1;
-		const marker = lineNumber === diagnostic.line ? ">" : " ";
-		out.push(`${marker} ${String(lineNumber).padStart(4)} | ${lines[index]}`);
-	}
-	return out.join("\n");
+const abbreviateTokens = (n) => {
+	if (n >= 1e6) return `${(n / 1e6).toFixed(1)}M`;
+	if (n >= 1e3) return `${Math.round(n / 1e3)}k`;
+	return String(n);
 };
-const buildRepairPrompt = (input) => {
-	const groups = groupByFile$1(input.findings);
-	const lines = [
-		"You are repairing AI slop findings in a local git worktree.",
-		"",
-		`Current raigal score: ${input.score == null ? "not scored" : `${input.score}/100`}`,
-		`Target score: ${input.targetScore}/100`,
-		`Turn budget: ${input.maxTurns}`,
-		"",
-		"Hard constraints:",
-		"- Make the smallest code changes that improve the findings below.",
-		"- Do not change public APIs, exports, database schemas, or test expectations unless a finding directly requires it.",
-		"- Do not delete tests.",
-		"- Do not add dependencies unless the existing project already clearly expects them.",
-		"- Never print, copy, commit, or echo secret values or credentials. Replace all hardcoded credentials and secrets with environment-variable references (e.g. process.env.KEY).",
-		"- If a finding looks like a false positive, leave the code alone and mention it in your final summary.",
-		"- Run the relevant local verification command if it is obvious and cheap.",
-		"",
-		"raigal findings to repair:",
-		""
+const formatUsageTotals = (usage) => {
+	if (usage.totalTokens === 0 && usage.costUsd === void 0) return "unknown";
+	const tokens = [
+		`${abbreviateTokens(usage.totalTokens)} total`,
+		`${abbreviateTokens(usage.inputTokens)} in`,
+		`${abbreviateTokens(usage.outputTokens)} out`
 	];
-	for (const group of groups) {
-		lines.push(`## ${group.filePath}`);
-		for (const diagnostic of group.diagnostics.slice(0, MAX_DIAGNOSTICS_PER_FILE$1)) {
-			const location = diagnostic.line > 0 ? `:${diagnostic.line}` : "";
-			lines.push(`- ${diagnostic.severity.toUpperCase()} ${diagnostic.rule}${location}: ${diagnostic.message}`);
-			if (diagnostic.help) lines.push(`  Help: ${diagnostic.help}`);
-			const snippet = snippetFor(input.rootDirectory, diagnostic);
-			if (snippet) {
-				lines.push("```");
-				lines.push(snippet);
-				lines.push("```");
-			}
+	if (usage.cachedInputTokens > 0) tokens.push(`${abbreviateTokens(usage.cachedInputTokens)} cached`);
+	if (usage.costUsd !== void 0) tokens.push(`$${usage.costUsd.toFixed(2)}`);
+	return tokens.join(" / ");
+};
+const formatToolCalls = (count) => `${count.toLocaleString()} tool call${count === 1 ? "" : "s"}`;
+const isProviderToolLine = (line) => Boolean(line?.startsWith("exec: ") || line?.startsWith("tool: "));
+const formatDiffStat = (file) => {
+	if (file.binary) return "binary";
+	if (typeof file.additions === "number" || typeof file.deletions === "number") return `+${file.additions ?? 0} -${file.deletions ?? 0}`;
+	return "changed";
+};
+const createChangedFileTracker = (input) => {
+	const files = /* @__PURE__ */ new Map();
+	let timer;
+	let pending = false;
+	const noteFile = (filePath, source, stat) => {
+		const absolute = path.join(input.cwd, filePath);
+		const updatedAt = ((fs.existsSync(absolute) ? fs.statSync(absolute) : null)?.mtime ?? /* @__PURE__ */ new Date()).toISOString();
+		const prior = files.get(filePath);
+		const additions = stat?.additions ?? prior?.additions;
+		const deletions = stat?.deletions ?? prior?.deletions;
+		const binary = stat?.binary ?? prior?.binary;
+		if (prior?.updatedAt === updatedAt && prior.source === source && prior.additions === additions && prior.deletions === deletions && prior.binary === binary) return;
+		const next = {
+			filePath,
+			updatedAt,
+			source,
+			...additions !== void 0 ? { additions } : {},
+			...deletions !== void 0 ? { deletions } : {},
+			...binary !== void 0 ? { binary } : {}
+		};
+		files.set(filePath, next);
+		input.session?.append("file.changed", next);
+		input.onChange([...files.values()]);
+	};
+	const refresh = async (source = "git diff") => {
+		if (pending) return [...files.values()];
+		pending = true;
+		try {
+			const stats = await diffNumstat(input.cwd);
+			for (const filePath of await diffNameOnly(input.cwd)) noteFile(filePath, source, stats.get(filePath));
+			return [...files.values()];
+		} finally {
+			pending = false;
 		}
-		lines.push("");
-	}
-	if (input.findings.length === 0) lines.push("No findings were supplied. Inspect the codebase for obvious AI slop only if needed.");
-	lines.push("After editing, stop and summarize what changed and what you intentionally skipped.");
-	return maskSecrets(lines.join("\n"));
+	};
+	const start = () => {
+		if (timer) return;
+		timer = setInterval(() => {
+			refresh("git diff");
+		}, 1e3);
+		timer.unref();
+	};
+	const stop = async () => {
+		if (timer) {
+			clearInterval(timer);
+			timer = void 0;
+		}
+		return refresh("git diff");
+	};
+	return {
+		noteFile,
+		refresh,
+		start,
+		stop,
+		files: () => [...files.values()]
+	};
 };
 //#endregion
-//#region src/agents/publish.ts
-const defaultBranchSuffix = () => (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\..+$/, "").replace("T", "-");
-const normalizeBranchName = (raw) => {
-	const cleaned = raw.trim().replace(/[^A-Za-z0-9._/-]+/g, "-").replace(/\/+/g, "/").replace(/^-+|-+$/g, "").replace(/^\/+|\/+$/g, "");
-	return cleaned.length > 0 ? cleaned.slice(0, 120) : `raigal/agent-${defaultBranchSuffix()}`;
-};
-const defaultBranchName = () => `raigal/agent-${defaultBranchSuffix()}`;
-const runGit = async (cwd, args) => {
-	const result = await runSubprocess("git", args, {
-		cwd,
-		timeout: 9e4
-	});
-	if (result.exitCode !== 0) throw new Error(result.stderr || result.stdout || `git ${args.join(" ")} failed`);
-	return result.stdout;
+//#region src/agents/session-state.ts
+const ACTIVITY_CAP = 200;
+const EDITS_CAP = 8;
+const buildInitialState = (init) => ({
+	model: null,
+	scoreStart: null,
+	score: null,
+	findingsRemaining: null,
+	filesChanged: /* @__PURE__ */ new Set(),
+	filesEdited: /* @__PURE__ */ new Set(),
+	passes: 0,
+	toolCalls: 0,
+	tokens: {
+		in: 0,
+		out: 0,
+		cached: 0,
+		total: 0
+	},
+	startedAt: Date.now(),
+	worktree: null,
+	branch: null,
+	activity: [],
+	recentEdits: [],
+	steps: [],
+	files: [],
+	actions: [],
+	usage: null,
+	estimatedTokens: 0,
+	phase: "starting",
+	pendingDecision: null,
+	summary: null,
+	...init
+});
+const activeStepIndex = (steps) => {
+	for (let i = steps.length - 1; i >= 0; i -= 1) if (steps[i].status === "running") return i;
+	return -1;
 };
-const currentBranch = async (cwd) => {
-	const result = await runSubprocess("git", ["branch", "--show-current"], { cwd });
-	if (result.exitCode !== 0) return null;
-	return result.stdout.trim() || null;
-};
-const resolveBaseBranch = async (cwd, fallback) => {
-	if (fallback && fallback !== "HEAD") return fallback;
-	const cached = await runSubprocess("git", [
-		"symbolic-ref",
-		"refs/remotes/origin/HEAD",
-		"--short"
-	], { cwd });
-	if (cached.exitCode === 0 && cached.stdout.trim()) return cached.stdout.trim().replace(/^origin\//, "");
-	const remote = await runSubprocess("git", [
-		"remote",
-		"show",
-		"origin"
-	], {
-		cwd,
-		timeout: 3e4
-	});
-	if (remote.exitCode === 0) {
-		const branch = remote.stdout.split("\n").find((entry) => entry.trim().startsWith("HEAD branch:"))?.split(":").slice(1).join(":").trim();
-		if (branch) return branch;
-	}
-	return "main";
-};
-const ensureBranch = async (cwd, branch) => {
-	if (await currentBranch(cwd) === branch) return;
-	await runGit(cwd, [
-		"switch",
-		"-c",
-		branch
-	]);
-};
-const ensureGh = async () => {
-	if ((await runSubprocess("gh", ["--version"], { timeout: 1e4 })).exitCode !== 0) throw new Error("Creating a PR requires the GitHub CLI. Install and authenticate `gh`, then retry.");
-};
-const buildPrBody = (input) => {
-	const delta = input.beforeScore != null && input.afterScore != null ? input.afterScore - input.beforeScore : null;
-	const deltaStr = delta != null ? ` (${delta >= 0 ? `+${delta}` : delta})` : "";
-	const scoreStr = `${input.beforeScore ?? "not scored"} -> ${input.afterScore ?? "not scored"}${deltaStr}`;
-	let diffStatLine = `- Files changed: ${input.changedFiles.length}`;
-	if (typeof input.diffSummary === "string" && input.diffSummary.trim()) diffStatLine += ` (${input.diffSummary.trim()})`;
-	else if (input.diffSummary && typeof input.diffSummary === "object") {
-		const adds = input.diffSummary.additions ?? 0;
-		const dels = input.diffSummary.deletions ?? 0;
-		diffStatLine += ` (+${adds} -${dels})`;
-	}
-	const fixedFindingsSection = input.fixedFindings && input.fixedFindings.length > 0 ? [
-		"### Fixed findings",
-		"",
-		"| Rule | File | Message |",
-		"|---|---|---|",
-		...input.fixedFindings.slice(0, 10).map((f) => {
-			const loc = f.line ? `${f.path}:${f.line}` : f.path;
-			const msg = (f.message || "").replace(/\|/g, "\\|");
-			return `| \`${f.ruleId}\` | \`${loc}\` | ${msg} |`;
-		}),
-		input.fixedFindings.length > 10 ? `\n*...and ${input.fixedFindings.length - 10} more findings fixed.*` : "",
-		""
-	] : [];
-	return [
-		"This PR was generated locally by `raigal agent`.",
-		"",
-		"## Summary",
-		"",
-		`- Provider: ${input.providerId}`,
-		`- Score: ${scoreStr}`,
-		diffStatLine,
-		"",
-		...fixedFindingsSection,
-		"## Changed files",
-		"",
-		...input.changedFiles.map((file) => `- ${file}`),
-		"",
-		"## Verification",
-		"",
-		"- `raigal scan --json`",
-		"",
-		"Review before merging. The deterministic scan is the gate; the provider only proposed the patch."
-	].filter(Boolean).join("\n");
-};
-const publishAgentDiff = async (input) => {
-	if (!input.options.commit && !input.options.pr) return null;
-	if (input.changedFiles.length === 0) return null;
-	const branch = normalizeBranchName(input.options.branch ?? defaultBranchName());
-	await ensureBranch(input.cwd, branch);
-	await runGit(input.cwd, ["add", "-A"]);
-	if ((await runSubprocess("git", [
-		"diff",
-		"--cached",
-		"--quiet"
-	], { cwd: input.cwd })).exitCode === 0) return null;
-	await runGit(input.cwd, [
-		"commit",
-		"-m",
-		input.options.commitMessage,
-		"-m",
-		"Generated by raigal agent."
-	]);
-	const commitSha = (await runGit(input.cwd, [
-		"rev-parse",
-		"--short",
-		"HEAD"
-	])).trim();
-	if (!input.options.pr) return {
-		branch,
-		commitSha,
-		pushed: false,
-		prUrl: null
-	};
-	await ensureGh();
-	const base = input.options.base ?? await resolveBaseBranch(input.cwd, input.originalBranch);
-	await runGit(input.cwd, [
-		"push",
-		"-u",
-		"origin",
-		branch
-	]);
-	let diffSummary = input.diffSummary;
-	if (!diffSummary) {
-		const stat = await runSubprocess("git", [
-			"diff",
-			"--shortstat",
-			"HEAD~1"
-		], { cwd: input.cwd });
-		if (stat.exitCode === 0 && stat.stdout.trim()) diffSummary = stat.stdout.trim();
-	}
-	const args = [
-		"pr",
-		"create",
-		"--base",
-		base,
-		"--head",
-		branch,
-		"--title",
-		input.options.prTitle ?? input.options.commitMessage,
-		"--body",
-		buildPrBody({
-			...input,
-			diffSummary
-		})
-	];
-	if (!input.options.ready) args.push("--draft");
-	const pr = await runSubprocess("gh", args, {
-		cwd: input.cwd,
-		timeout: 9e4
-	});
-	if (pr.exitCode !== 0) throw new Error(pr.stderr || pr.stdout || "Failed to create pull request with gh.");
-	return {
-		branch,
-		commitSha,
-		pushed: true,
-		prUrl: pr.stdout.trim() || null
-	};
-};
-//#endregion
-//#region src/agents/session-activity.ts
-const createUsageTotals = () => ({
-	inputTokens: 0,
-	cachedInputTokens: 0,
-	outputTokens: 0,
-	totalTokens: 0
-});
-const createSessionStats = () => ({
-	providerPasses: 0,
-	toolCalls: 0,
-	outputEvents: 0
-});
-const mergeProviderUsage = (totals, usage) => {
-	const inputTokens = Math.max(totals.inputTokens, usage.inputTokens ?? 0);
-	const cachedInputTokens = Math.max(totals.cachedInputTokens, usage.cachedInputTokens ?? 0);
-	const outputTokens = Math.max(totals.outputTokens, usage.outputTokens ?? 0);
-	const totalTokens = Math.max(totals.totalTokens, usage.totalTokens ?? inputTokens + cachedInputTokens + outputTokens);
-	const costUsd = usage.costUsd === void 0 ? totals.costUsd : Math.max(totals.costUsd ?? 0, usage.costUsd);
-	return {
-		inputTokens,
-		cachedInputTokens,
-		outputTokens,
-		totalTokens,
-		...costUsd !== void 0 ? { costUsd } : {}
-	};
-};
-const abbreviateTokens = (n) => {
-	if (n >= 1e6) return `${(n / 1e6).toFixed(1)}M`;
-	if (n >= 1e3) return `${Math.round(n / 1e3)}k`;
-	return String(n);
-};
-const formatUsageTotals = (usage) => {
-	if (usage.totalTokens === 0 && usage.costUsd === void 0) return "unknown";
-	const tokens = [
-		`${abbreviateTokens(usage.totalTokens)} total`,
-		`${abbreviateTokens(usage.inputTokens)} in`,
-		`${abbreviateTokens(usage.outputTokens)} out`
-	];
-	if (usage.cachedInputTokens > 0) tokens.push(`${abbreviateTokens(usage.cachedInputTokens)} cached`);
-	if (usage.costUsd !== void 0) tokens.push(`$${usage.costUsd.toFixed(2)}`);
-	return tokens.join(" / ");
-};
-const formatToolCalls = (count) => `${count.toLocaleString()} tool call${count === 1 ? "" : "s"}`;
-const isProviderToolLine = (line) => Boolean(line?.startsWith("exec: ") || line?.startsWith("tool: "));
-const formatDiffStat = (file) => {
-	if (file.binary) return "binary";
-	if (typeof file.additions === "number" || typeof file.deletions === "number") return `+${file.additions ?? 0} -${file.deletions ?? 0}`;
-	return "changed";
-};
-const createChangedFileTracker = (input) => {
-	const files = /* @__PURE__ */ new Map();
-	let timer;
-	let pending = false;
-	const noteFile = (filePath, source, stat) => {
-		const absolute = path.join(input.cwd, filePath);
-		const updatedAt = ((fs.existsSync(absolute) ? fs.statSync(absolute) : null)?.mtime ?? /* @__PURE__ */ new Date()).toISOString();
-		const prior = files.get(filePath);
-		const additions = stat?.additions ?? prior?.additions;
-		const deletions = stat?.deletions ?? prior?.deletions;
-		const binary = stat?.binary ?? prior?.binary;
-		if (prior?.updatedAt === updatedAt && prior.source === source && prior.additions === additions && prior.deletions === deletions && prior.binary === binary) return;
-		const next = {
-			filePath,
-			updatedAt,
-			source,
-			...additions !== void 0 ? { additions } : {},
-			...deletions !== void 0 ? { deletions } : {},
-			...binary !== void 0 ? { binary } : {}
-		};
-		files.set(filePath, next);
-		input.session?.append("file.changed", next);
-		input.onChange([...files.values()]);
-	};
-	const refresh = async (source = "git diff") => {
-		if (pending) return [...files.values()];
-		pending = true;
-		try {
-			const stats = await diffNumstat(input.cwd);
-			for (const filePath of await diffNameOnly(input.cwd)) noteFile(filePath, source, stats.get(filePath));
-			return [...files.values()];
-		} finally {
-			pending = false;
-		}
-	};
-	const start = () => {
-		if (timer) return;
-		timer = setInterval(() => {
-			refresh("git diff");
-		}, 1e3);
-		timer.unref();
-	};
-	const stop = async () => {
-		if (timer) {
-			clearInterval(timer);
-			timer = void 0;
-		}
-		return refresh("git diff");
-	};
-	return {
-		noteFile,
-		refresh,
-		start,
-		stop,
-		files: () => [...files.values()]
-	};
-};
-//#endregion
-//#region src/agents/session-state.ts
-const ACTIVITY_CAP = 200;
-const EDITS_CAP = 8;
-const buildInitialState = (init) => ({
-	model: null,
-	scoreStart: null,
-	score: null,
-	findingsRemaining: null,
-	filesChanged: /* @__PURE__ */ new Set(),
-	filesEdited: /* @__PURE__ */ new Set(),
-	passes: 0,
-	toolCalls: 0,
-	tokens: {
-		in: 0,
-		out: 0,
-		cached: 0,
-		total: 0
-	},
-	startedAt: Date.now(),
-	worktree: null,
-	branch: null,
-	activity: [],
-	recentEdits: [],
-	steps: [],
-	files: [],
-	actions: [],
-	usage: null,
-	estimatedTokens: 0,
-	phase: "starting",
-	pendingDecision: null,
-	summary: null,
-	...init
-});
-const activeStepIndex = (steps) => {
-	for (let i = steps.length - 1; i >= 0; i -= 1) if (steps[i].status === "running") return i;
-	return -1;
-};
-const createEmitter = (subscribers) => {
-	return () => {
-		for (const fn of subscribers) fn();
-	};
+const createEmitter = (subscribers) => {
+	return () => {
+		for (const fn of subscribers) fn();
+	};
 };
 const createCoreMethods = ({ state, subscribers, emit }) => ({
 	getState: () => state,
@@ -2614,7 +2383,7 @@ var AgentTui = class {
 	}
 	ensureMounted() {
 		if (!this.tty || this.handle) return;
-		this.handle = import("./mount-DTc8WaIt.js").then((m) => m.mountAgentTui(this.store));
+		this.handle = import("./mount-CHGc3gB6.js").then((m) => m.mountAgentTui(this.store));
 	}
 	setActions(actions) {
 		this.store.update({ actions: actions.filter((action) => action.trim().length > 0) });
@@ -2681,16 +2450,249 @@ var AgentTui = class {
 		await this.close();
 		if (!this.tty) this.write(` ${opts.footer}\n`);
 	}
-	async abort() {
-		this.store.update({ phase: "error" });
-		await this.close();
+	async abort() {
+		this.store.update({ phase: "error" });
+		await this.close();
+	}
+	async close() {
+		const pending = this.handle;
+		this.handle = null;
+		if (!pending) return;
+		await (await pending).close();
+	}
+};
+//#endregion
+//#region src/commands/agent-local-cli.ts
+const cliPath$1 = () => {
+	const arg = process.argv[1];
+	if (arg && fs.existsSync(arg)) return arg;
+	return path.resolve("dist/cli.js");
+};
+const runSelf = (args, cwd) => {
+	const result = spawnSync(process.execPath, [cliPath$1(), ...args], {
+		cwd,
+		encoding: "utf-8",
+		env: {
+			...process.env,
+			AISLOP_NO_TELEMETRY: "1",
+			AISLOP_NO_UPDATE_NOTIFIER: "1",
+			NO_COLOR: "1"
+		},
+		maxBuffer: 52428800
+	});
+	return {
+		exitCode: result.status,
+		stdout: result.stdout,
+		stderr: result.stderr
+	};
+};
+const scanJson = (cwd) => {
+	const result = runSelf([
+		"scan",
+		".",
+		"--json"
+	], cwd);
+	if (!result.stdout.trim()) throw new Error(result.stderr || "raigal scan did not produce JSON output.");
+	try {
+		return JSON.parse(result.stdout);
+	} catch (error) {
+		throw new Error(`Failed to parse raigal scan output: ${error instanceof Error ? error.message : String(error)}`);
+	}
+};
+const runSafeFix = (cwd) => {
+	const result = runSelf([
+		"fix",
+		".",
+		"--safe"
+	], cwd);
+	if (result.exitCode !== 0 && result.stderr.trim()) log.warn(result.stderr.trim().split("\n")[0] ?? "Safe fix reported a non-zero exit.");
+};
+const applyDiff = async (root, patch) => {
+	const child = spawnSync("git", [
+		"apply",
+		"--index",
+		"--whitespace=nowarn",
+		"-"
+	], {
+		cwd: root,
+		input: patch,
+		encoding: "utf-8",
+		maxBuffer: 52428800
+	});
+	if (child.status !== 0) throw new Error(child.stderr || child.stdout || "Failed to apply agent diff.");
+};
+//#endregion
+//#region src/agents/publish.ts
+const defaultBranchSuffix = () => (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\..+$/, "").replace("T", "-");
+const normalizeBranchName = (raw) => {
+	const cleaned = raw.trim().replace(/[^A-Za-z0-9._/-]+/g, "-").replace(/\/+/g, "/").replace(/^-+|-+$/g, "").replace(/^\/+|\/+$/g, "");
+	return cleaned.length > 0 ? cleaned.slice(0, 120) : `raigal/agent-${defaultBranchSuffix()}`;
+};
+const defaultBranchName = () => `raigal/agent-${defaultBranchSuffix()}`;
+const runGit = async (cwd, args) => {
+	const result = await runSubprocess("git", args, {
+		cwd,
+		timeout: 9e4
+	});
+	if (result.exitCode !== 0) throw new Error(result.stderr || result.stdout || `git ${args.join(" ")} failed`);
+	return result.stdout;
+};
+const currentBranch = async (cwd) => {
+	const result = await runSubprocess("git", ["branch", "--show-current"], { cwd });
+	if (result.exitCode !== 0) return null;
+	return result.stdout.trim() || null;
+};
+const resolveBaseBranch = async (cwd, fallback) => {
+	if (fallback && fallback !== "HEAD") return fallback;
+	const cached = await runSubprocess("git", [
+		"symbolic-ref",
+		"refs/remotes/origin/HEAD",
+		"--short"
+	], { cwd });
+	if (cached.exitCode === 0 && cached.stdout.trim()) return cached.stdout.trim().replace(/^origin\//, "");
+	const remote = await runSubprocess("git", [
+		"remote",
+		"show",
+		"origin"
+	], {
+		cwd,
+		timeout: 3e4
+	});
+	if (remote.exitCode === 0) {
+		const branch = remote.stdout.split("\n").find((entry) => entry.trim().startsWith("HEAD branch:"))?.split(":").slice(1).join(":").trim();
+		if (branch) return branch;
+	}
+	return "main";
+};
+const ensureBranch = async (cwd, branch) => {
+	if (await currentBranch(cwd) === branch) return;
+	await runGit(cwd, [
+		"switch",
+		"-c",
+		branch
+	]);
+};
+const ensureGh = async () => {
+	if ((await runSubprocess("gh", ["--version"], { timeout: 1e4 })).exitCode !== 0) throw new Error("Creating a PR requires the GitHub CLI. Install and authenticate `gh`, then retry.");
+};
+const buildPrBody = (input) => {
+	const delta = input.beforeScore != null && input.afterScore != null ? input.afterScore - input.beforeScore : null;
+	const deltaStr = delta != null ? ` (${delta >= 0 ? `+${delta}` : delta})` : "";
+	const scoreStr = `${input.beforeScore ?? "not scored"} -> ${input.afterScore ?? "not scored"}${deltaStr}`;
+	let diffStatLine = `- Files changed: ${input.changedFiles.length}`;
+	if (typeof input.diffSummary === "string" && input.diffSummary.trim()) diffStatLine += ` (${input.diffSummary.trim()})`;
+	else if (input.diffSummary && typeof input.diffSummary === "object") {
+		const adds = input.diffSummary.additions ?? 0;
+		const dels = input.diffSummary.deletions ?? 0;
+		diffStatLine += ` (+${adds} -${dels})`;
 	}
-	async close() {
-		const pending = this.handle;
-		this.handle = null;
-		if (!pending) return;
-		await (await pending).close();
+	const fixedFindingsSection = input.fixedFindings && input.fixedFindings.length > 0 ? [
+		"### Fixed findings",
+		"",
+		"| Rule | File | Message |",
+		"|---|---|---|",
+		...input.fixedFindings.slice(0, 10).map((f) => {
+			const loc = f.line ? `${f.path}:${f.line}` : f.path;
+			const msg = (f.message || "").replace(/\|/g, "\\|");
+			return `| \`${f.ruleId}\` | \`${loc}\` | ${msg} |`;
+		}),
+		input.fixedFindings.length > 10 ? `\n*...and ${input.fixedFindings.length - 10} more findings fixed.*` : "",
+		""
+	] : [];
+	return [
+		"This PR was generated locally by `raigal agent`.",
+		"",
+		"## Summary",
+		"",
+		`- Provider: ${input.providerId}`,
+		`- Score: ${scoreStr}`,
+		diffStatLine,
+		"",
+		...fixedFindingsSection,
+		"## Changed files",
+		"",
+		...input.changedFiles.map((file) => `- ${file}`),
+		"",
+		"## Verification",
+		"",
+		"- `raigal scan --json`",
+		"",
+		"Review before merging. The deterministic scan is the gate; the provider only proposed the patch."
+	].filter(Boolean).join("\n");
+};
+const publishAgentDiff = async (input) => {
+	if (!input.options.commit && !input.options.pr) return null;
+	if (input.changedFiles.length === 0) return null;
+	const branch = normalizeBranchName(input.options.branch ?? defaultBranchName());
+	await ensureBranch(input.cwd, branch);
+	await runGit(input.cwd, ["add", "-A"]);
+	if ((await runSubprocess("git", [
+		"diff",
+		"--cached",
+		"--quiet"
+	], { cwd: input.cwd })).exitCode === 0) return null;
+	await runGit(input.cwd, [
+		"commit",
+		"-m",
+		input.options.commitMessage,
+		"-m",
+		"Generated by raigal agent."
+	]);
+	const commitSha = (await runGit(input.cwd, [
+		"rev-parse",
+		"--short",
+		"HEAD"
+	])).trim();
+	if (!input.options.pr) return {
+		branch,
+		commitSha,
+		pushed: false,
+		prUrl: null
+	};
+	await ensureGh();
+	const base = input.options.base ?? await resolveBaseBranch(input.cwd, input.originalBranch);
+	await runGit(input.cwd, [
+		"push",
+		"-u",
+		"origin",
+		branch
+	]);
+	let diffSummary = input.diffSummary;
+	if (!diffSummary) {
+		const stat = await runSubprocess("git", [
+			"diff",
+			"--shortstat",
+			"HEAD~1"
+		], { cwd: input.cwd });
+		if (stat.exitCode === 0 && stat.stdout.trim()) diffSummary = stat.stdout.trim();
 	}
+	const args = [
+		"pr",
+		"create",
+		"--base",
+		base,
+		"--head",
+		branch,
+		"--title",
+		input.options.prTitle ?? input.options.commitMessage,
+		"--body",
+		buildPrBody({
+			...input,
+			diffSummary
+		})
+	];
+	if (!input.options.ready) args.push("--draft");
+	const pr = await runSubprocess("gh", args, {
+		cwd: input.cwd,
+		timeout: 9e4
+	});
+	if (pr.exitCode !== 0) throw new Error(pr.stderr || pr.stdout || "Failed to create pull request with gh.");
+	return {
+		branch,
+		commitSha,
+		pushed: true,
+		prUrl: pr.stdout.trim() || null
+	};
 };
 //#endregion
 //#region src/cloud/context.ts
@@ -2766,7 +2768,8 @@ const detectGitDiff = (directory, baseRef) => {
 			"HEAD~1"
 		], directory);
 		let diffPreview;
-		if (preview) diffPreview = preview.split("\n").slice(0, 40).join("\n").slice(0, 1e4);
+		const allowSnippets = process.env.RAIGAL_NO_SNIPPETS !== "true" && process.env.RAIGAL_PRIVACY_MODE !== "true";
+		if (preview && allowSnippets) diffPreview = preview.split("\n").slice(0, 40).join("\n").slice(0, 1e4);
 		return {
 			diffSummary,
 			diffPreview
@@ -2887,7 +2890,7 @@ const detectCiContext = () => {
 };
 //#endregion
 //#region src/cloud/outbox.ts
-const MAX_OUTBOX_BYTES = 5 * 1024 * 1024;
+const MAX_OUTBOX_BYTES = 5242880;
 const getMaxOutboxBytes = () => {
 	const override = process.env.RAIGAL_MAX_OUTBOX_BYTES;
 	if (override) {
@@ -2919,7 +2922,7 @@ const writeRunsToOutbox = (runs) => {
 		recursive: true,
 		mode: 448
 	});
-	let lines = runs.map((r) => JSON.stringify(r));
+	const lines = runs.map((r) => JSON.stringify(r));
 	let text = lines.length > 0 ? `${lines.join("\n")}\n` : "";
 	const maxBytes = getMaxOutboxBytes();
 	while (Buffer.byteLength(text, "utf-8") > maxBytes && lines.length > 1) {
@@ -2944,7 +2947,9 @@ const getLastRecordedRun = () => {
 	const runs = loadOutboxRuns();
 	return runs.length > 0 ? runs[runs.length - 1] ?? null : null;
 };
-const flushOutbox = async (token) => {
+const flushOutbox = async (optionsOrToken) => {
+	const token = typeof optionsOrToken === "string" ? optionsOrToken : optionsOrToken?.token;
+	const oidcToken = typeof optionsOrToken === "object" ? optionsOrToken?.oidcToken : void 0;
 	const runs = loadOutboxRuns();
 	if (runs.length === 0) return {
 		sent: 0,
@@ -2960,6 +2965,7 @@ const flushOutbox = async (token) => {
 			await requestApi("/v1/runs", {
 				method: "POST",
 				token,
+				oidcToken,
 				body: run,
 				timeoutMs: 4e3
 			});
@@ -3079,9 +3085,15 @@ var CloudRunRecorder = class {
 		if (this.finished) return;
 		this.finished = true;
 		try {
-			enqueueRun(this.buildRunPayload(exitCode));
+			const run = this.buildRunPayload(exitCode);
+			enqueueRun(run);
 			const activeToken = getActiveToken();
-			if (activeToken) await flushOutbox(activeToken.token);
+			let oidcToken;
+			if (!activeToken) oidcToken = await fetchGitHubOidcToken();
+			if (activeToken || oidcToken) await flushOutbox({
+				token: activeToken?.token,
+				oidcToken
+			});
 		} catch {}
 	}
 };
@@ -3091,7 +3103,10 @@ const startRunRecorder = (command, directory, flags = []) => {
 	const recorder = new CloudRunRecorder(command, directory, flags);
 	activeRecorder = recorder;
 	const activeToken = getActiveToken();
-	if (activeToken) flushOutbox(activeToken.token).catch(() => {});
+	if (activeToken) flushOutbox({ token: activeToken.token }).catch(() => {});
+	else fetchGitHubOidcToken().then((oidcToken) => {
+		if (oidcToken) return flushOutbox({ oidcToken });
+	}).catch(() => {});
 	return recorder;
 };
 const finishActiveRecorder = async (exitCode = 0) => {
@@ -3102,64 +3117,186 @@ const finishActiveRecorder = async (exitCode = 0) => {
 	}
 };
 //#endregion
-//#region src/commands/agent-local-cli.ts
-const cliPath$1 = () => {
-	const arg = process.argv[1];
-	if (arg && fs.existsSync(arg)) return arg;
-	return path.resolve("dist/cli.js");
+//#region src/commands/agent-session-publish.ts
+const maybePublishAgentDiff = async ({ tui, session, options, changedFiles, worktreePath, originalBranch, providerId, before, after }) => {
+	if (changedFiles.length > 0 && (options.commit || options.pr)) {
+		tui.start(options.pr ? "Creating local branch and PR" : "Creating local commit");
+		session.append("publish.started", {
+			commit: options.commit,
+			pr: options.pr,
+			branch: options.branch,
+			base: options.base,
+			ready: options.ready
+		});
+		const afterKeys = new Set(after.diagnostics.map((d) => `${d.rule}:${d.filePath}:${d.line}`));
+		const fixedFindings = before.diagnostics.filter((d) => !afterKeys.has(`${d.rule}:${d.filePath}:${d.line}`)).map((d) => ({
+			ruleId: d.rule,
+			path: d.filePath,
+			line: d.line,
+			message: d.message
+		}));
+		const published = await publishAgentDiff({
+			cwd: worktreePath,
+			originalBranch,
+			providerId,
+			beforeScore: before.score,
+			afterScore: after.score,
+			changedFiles,
+			fixedFindings,
+			options: {
+				commit: options.commit,
+				pr: options.pr,
+				branch: options.branch,
+				base: options.base,
+				commitMessage: options.commitMessage,
+				prTitle: options.prTitle,
+				ready: options.ready
+			}
+		});
+		session.append(published ? "publish.finished" : "publish.skipped", { result: published });
+		tui.complete({
+			status: published ? "done" : "skipped",
+			label: published?.prUrl ? `Opened PR ${published.prUrl}` : published ? `Committed ${published.commitSha}` : "No commit created"
+		});
+		return published;
+	}
+	if (options.commit || options.pr) session.append("publish.skipped", {
+		reason: "no_changed_files",
+		commit: options.commit,
+		pr: options.pr
+	});
+	return null;
 };
-const runSelf = (args, cwd) => {
-	const result = spawnSync(process.execPath, [cliPath$1(), ...args], {
-		cwd,
-		encoding: "utf-8",
-		env: {
-			...process.env,
-			AISLOP_NO_TELEMETRY: "1",
-			AISLOP_NO_UPDATE_NOTIFIER: "1",
-			NO_COLOR: "1"
-		},
-		maxBuffer: 50 * 1024 * 1024
+const recordAgentSessionTelemetry = ({ worktreePath, published, branchOption, providerId, beforeScore, afterScore, targetScore, durationMs, changedFilesCount }) => {
+	const recorder = getActiveRecorder();
+	if (!recorder) return;
+	let patchDiff;
+	if (worktreePath) try {
+		const rawDiff = spawnSync("git", [
+			"diff",
+			"-U2",
+			"--no-color",
+			"HEAD"
+		], {
+			cwd: worktreePath,
+			encoding: "utf-8"
+		}).stdout || "";
+		patchDiff = rawDiff ? maskSecrets(rawDiff).slice(0, 2e4) : void 0;
+	} catch {}
+	if (published) {
+		const prMatch = published.prUrl?.match(/\/pull\/(\d+)/);
+		const prNumber = prMatch ? Number.parseInt(prMatch[1], 10) : void 0;
+		recorder.setGitContext({
+			branch: published.branch,
+			pr_number: prNumber
+		});
+	} else if (branchOption) recorder.setGitContext({ branch: branchOption });
+	const agentTelemetry = {
+		provider: providerId,
+		before_score: beforeScore,
+		after_score: afterScore,
+		pr_url: published?.prUrl || void 0,
+		patch_diff: patchDiff,
+		duration_ms: durationMs
+	};
+	recorder.setAgentTelemetry(agentTelemetry);
+	recorder.recordStep("agent:baseline", 50, true);
+	recorder.recordStep("agent:verify", durationMs, afterScore !== null && afterScore >= targetScore);
+	recorder.setReport({
+		score: afterScore,
+		scoreable: true,
+		files_scanned: changedFilesCount,
+		findings: [],
+		agent_telemetry: agentTelemetry
 	});
-	return {
-		exitCode: result.status,
-		stdout: result.stdout,
-		stderr: result.stderr
-	};
 };
-const scanJson = (cwd) => {
-	const result = runSelf([
-		"scan",
-		".",
-		"--json"
-	], cwd);
-	if (!result.stdout.trim()) throw new Error(result.stderr || "raigal scan did not produce JSON output.");
-	try {
-		return JSON.parse(result.stdout);
-	} catch (error) {
-		throw new Error(`Failed to parse raigal scan output: ${error instanceof Error ? error.message : String(error)}`);
+//#endregion
+//#region src/agents/prompt.ts
+const CONTEXT_LINES$1 = 3;
+const MAX_DIAGNOSTICS_PER_FILE$1 = 6;
+const MAX_FILES$1 = 12;
+const priority = (diagnostic) => {
+	if (diagnostic.severity === "error") return 0;
+	if (diagnostic.severity === "warning") return 1;
+	return 2;
+};
+const selectAgentFindings = (diagnostics, limit) => diagnostics.filter((diagnostic) => diagnostic.severity !== "info").sort((a, b) => {
+	const severityDelta = priority(a) - priority(b);
+	if (severityDelta !== 0) return severityDelta;
+	if (a.fixable !== b.fixable) return a.fixable ? 1 : -1;
+	return a.filePath.localeCompare(b.filePath);
+}).slice(0, Math.max(1, limit));
+const groupByFile$1 = (diagnostics) => {
+	const groups = /* @__PURE__ */ new Map();
+	for (const diagnostic of diagnostics) {
+		const list = groups.get(diagnostic.filePath) ?? [];
+		list.push(diagnostic);
+		groups.set(diagnostic.filePath, list);
 	}
+	return [...groups.entries()].map(([filePath, items]) => ({
+		filePath,
+		diagnostics: items
+	})).slice(0, MAX_FILES$1);
 };
-const runSafeFix = (cwd) => {
-	const result = runSelf([
-		"fix",
-		".",
-		"--safe"
-	], cwd);
-	if (result.exitCode !== 0 && result.stderr.trim()) log.warn(result.stderr.trim().split("\n")[0] ?? "Safe fix reported a non-zero exit.");
+const snippetFor = (rootDirectory, diagnostic) => {
+	if (diagnostic.line <= 0 || diagnostic.redactSource || isSecretClassRule(diagnostic.rule)) return null;
+	const absolutePath = path.resolve(rootDirectory, diagnostic.filePath);
+	let content;
+	try {
+		content = fs.readFileSync(absolutePath, "utf-8");
+	} catch {
+		return null;
+	}
+	const lines = content.split("\n");
+	const start = Math.max(0, diagnostic.line - 1 - CONTEXT_LINES$1);
+	const end = Math.min(lines.length, diagnostic.line + CONTEXT_LINES$1);
+	const out = [];
+	for (let index = start; index < end; index += 1) {
+		const lineNumber = index + 1;
+		const marker = lineNumber === diagnostic.line ? ">" : " ";
+		out.push(`${marker} ${String(lineNumber).padStart(4)} | ${lines[index]}`);
+	}
+	return out.join("\n");
 };
-const applyDiff = async (root, patch) => {
-	const child = spawnSync("git", [
-		"apply",
-		"--index",
-		"--whitespace=nowarn",
-		"-"
-	], {
-		cwd: root,
-		input: patch,
-		encoding: "utf-8",
-		maxBuffer: 50 * 1024 * 1024
-	});
-	if (child.status !== 0) throw new Error(child.stderr || child.stdout || "Failed to apply agent diff.");
+const buildRepairPrompt = (input) => {
+	const groups = groupByFile$1(input.findings);
+	const lines = [
+		"You are repairing AI slop findings in a local git worktree.",
+		"",
+		`Current raigal score: ${input.score == null ? "not scored" : `${input.score}/100`}`,
+		`Target score: ${input.targetScore}/100`,
+		`Turn budget: ${input.maxTurns}`,
+		"",
+		"Hard constraints:",
+		"- Make the smallest code changes that improve the findings below.",
+		"- Do not change public APIs, exports, database schemas, or test expectations unless a finding directly requires it.",
+		"- Do not delete tests.",
+		"- Do not add dependencies unless the existing project already clearly expects them.",
+		"- Never print, copy, commit, or echo secret values or credentials. Replace all hardcoded credentials and secrets with environment-variable references (e.g. process.env.KEY).",
+		"- If a finding looks like a false positive, leave the code alone and mention it in your final summary.",
+		"- Run the relevant local verification command if it is obvious and cheap.",
+		"",
+		"raigal findings to repair:",
+		""
+	];
+	for (const group of groups) {
+		lines.push(`## ${group.filePath}`);
+		for (const diagnostic of group.diagnostics.slice(0, MAX_DIAGNOSTICS_PER_FILE$1)) {
+			const location = diagnostic.line > 0 ? `:${diagnostic.line}` : "";
+			lines.push(`- ${diagnostic.severity.toUpperCase()} ${diagnostic.rule}${location}: ${diagnostic.message}`);
+			if (diagnostic.help) lines.push(`  Help: ${diagnostic.help}`);
+			const snippet = snippetFor(input.rootDirectory, diagnostic);
+			if (snippet) {
+				lines.push("```");
+				lines.push(snippet);
+				lines.push("```");
+			}
+		}
+		lines.push("");
+	}
+	if (input.findings.length === 0) lines.push("No findings were supplied. Inspect the codebase for obvious AI slop only if needed.");
+	lines.push("After editing, stop and summarize what changed and what you intentionally skipped.");
+	return maskSecrets(lines.join("\n"));
 };
 //#endregion
 //#region src/agents/provider-metadata.ts
@@ -3614,6 +3751,53 @@ const maybeApplyDiff = async (input) => {
 	await applyDiff(input.originalRoot, await readBinaryDiff(input.worktreePath));
 	return true;
 };
+const resolveAgentSessionCwd = (created, requestedDirectory) => {
+	const relative = path.relative(created.state.root, requestedDirectory);
+	const outsideRoot = relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative);
+	if (relative.length === 0 || outsideRoot) return created.worktree.path;
+	return path.resolve(created.worktree.path, relative);
+};
+const prepareWorktree = async (tui, resolvedDir, options) => {
+	tui.start("Preparing local session");
+	const created = await createAgentWorktree(resolvedDir, { inPlace: options.inPlace });
+	tui.setMetric("Worktree", created.worktree.created ? path.relative(created.state.root, created.worktree.path) : "current");
+	tui.complete({
+		status: "done",
+		label: created.worktree.created ? `Created worktree ${path.relative(created.state.root, created.worktree.path)}` : "Using current worktree"
+	});
+	return created;
+};
+const scanBaseline = (tui, cwd) => {
+	tui.start("Scanning baseline");
+	const scan = scanJson(cwd);
+	tui.setMetric("Score", `${scan.score ?? "not scored"} -> ...`);
+	tui.setMetric("Findings", scan.diagnostics.length);
+	tui.complete({
+		status: scan.summary.errors > 0 ? "warn" : "done",
+		label: `Baseline ${scan.score ?? "not scored"} / 100 · ${scan.diagnostics.length} findings`
+	});
+	return scan;
+};
+const runSafeFixStep = (tui, cwd, options) => {
+	if (options.noFix) return;
+	tui.start("Applying deterministic safe fixes");
+	runSafeFix(cwd);
+	tui.complete({
+		status: "done",
+		label: "Safe fixer finished"
+	});
+};
+const selectFindings = (tui, cwd, limit, pass) => {
+	tui.start(`Pass ${pass}: selecting findings`);
+	const scan = scanJson(cwd);
+	const findings = selectAgentFindings(scan.diagnostics, limit);
+	tui.setMetric("Selected", findings.length);
+	tui.complete({
+		status: findings.length > 0 ? "done" : "skipped",
+		label: findings.length > 0 ? `Pass ${pass}: selected ${findings.length} finding${findings.length === 1 ? "" : "s"}` : "No remaining agent findings"
+	});
+	return findings;
+};
 //#endregion
 //#region src/utils/paths.ts
 /** Normalize an OS path to forward-slash (POSIX) separators. */
@@ -3749,52 +3933,6 @@ const printAgentSessionSummary = (input) => {
 //#endregion
 //#region src/commands/agent-session.ts
 const scoreDelta = (before, after) => typeof before === "number" && typeof after === "number" ? after - before : void 0;
-const resolveAgentSessionCwd = (created, requestedDirectory) => {
-	const relative = path.relative(created.state.root, requestedDirectory);
-	const outsideRoot = relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative);
-	if (relative.length === 0 || outsideRoot) return created.worktree.path;
-	return path.resolve(created.worktree.path, relative);
-};
-const prepareWorktree = async (tui, resolvedDir, options) => {
-	tui.start("Preparing local session");
-	const created = await createAgentWorktree(resolvedDir, { inPlace: options.inPlace });
-	tui.setMetric("Worktree", created.worktree.created ? path.relative(created.state.root, created.worktree.path) : "current");
-	tui.complete({
-		status: "done",
-		label: created.worktree.created ? `Created worktree ${path.relative(created.state.root, created.worktree.path)}` : "Using current worktree"
-	});
-	return created;
-};
-const scanBaseline = (tui, cwd) => {
-	tui.start("Scanning baseline");
-	const scan = scanJson(cwd);
-	tui.setMetric("Score", `${scan.score ?? "not scored"} -> ...`);
-	tui.setMetric("Findings", scan.diagnostics.length);
-	tui.complete({
-		status: scan.summary.errors > 0 ? "warn" : "done",
-		label: `Baseline ${scan.score ?? "not scored"} / 100 · ${scan.diagnostics.length} findings`
-	});
-	return scan;
-};
-const runSafeFixStep = (tui, cwd, options) => {
-	if (options.noFix) return;
-	tui.start("Applying deterministic safe fixes");
-	runSafeFix(cwd);
-	tui.complete({
-		status: "done",
-		label: "Safe fixer finished"
-	});
-};
-const selectFindings = (tui, cwd, limit, pass) => {
-	tui.start(`Pass ${pass}: selecting findings`);
-	const findings = selectAgentFindings(scanJson(cwd).diagnostics, limit);
-	tui.setMetric("Selected", findings.length);
-	tui.complete({
-		status: findings.length > 0 ? "done" : "skipped",
-		label: findings.length > 0 ? `Pass ${pass}: selected ${findings.length} finding${findings.length === 1 ? "" : "s"}` : "No remaining agent findings"
-	});
-	return findings;
-};
 const runAgentSession = async (selected, resolvedDir, options, started) => {
 	const tui = new AgentTui({
 		provider: selected.provider.label,
@@ -3959,49 +4097,16 @@ const runAgentSession = async (selected, resolvedDir, options, started) => {
 			applyRequested: options.apply,
 			changedFiles: changedFiles.length
 		});
-		if (changedFiles.length > 0 && (options.commit || options.pr)) {
-			tui.start(options.pr ? "Creating local branch and PR" : "Creating local commit");
-			session.append("publish.started", {
-				commit: options.commit,
-				pr: options.pr,
-				branch: options.branch,
-				base: options.base,
-				ready: options.ready
-			});
-			const afterKeys = new Set(verified.after.diagnostics.map((d) => `${d.rule}:${d.filePath}:${d.line}`));
-			const fixedFindings = before.diagnostics.filter((d) => !afterKeys.has(`${d.rule}:${d.filePath}:${d.line}`)).map((d) => ({
-				ruleId: d.rule,
-				path: d.filePath,
-				line: d.line,
-				message: d.message
-			}));
-			published = await publishAgentDiff({
-				cwd: created.worktree.path,
-				originalBranch: created.state.branch,
-				providerId: selected.provider.id,
-				beforeScore: before.score,
-				afterScore: verified.after.score,
-				changedFiles,
-				fixedFindings,
-				options: {
-					commit: options.commit,
-					pr: options.pr,
-					branch: options.branch,
-					base: options.base,
-					commitMessage: options.commitMessage,
-					prTitle: options.prTitle,
-					ready: options.ready
-				}
-			});
-			session.append(published ? "publish.finished" : "publish.skipped", { result: published });
-			tui.complete({
-				status: published ? "done" : "skipped",
-				label: published?.prUrl ? `Opened PR ${published.prUrl}` : published ? `Committed ${published.commitSha}` : "No commit created"
-			});
-		} else if (options.commit || options.pr) session.append("publish.skipped", {
-			reason: "no_changed_files",
-			commit: options.commit,
-			pr: options.pr
+		published = await maybePublishAgentDiff({
+			tui,
+			session,
+			options,
+			changedFiles,
+			worktreePath: created.worktree.path,
+			originalBranch: created.state.branch,
+			providerId: selected.provider.id,
+			before,
+			after: verified.after
 		});
 		session.append("session.completed", {
 			durationMs: Math.round(performance.now() - started),
@@ -4017,47 +4122,17 @@ const runAgentSession = async (selected, resolvedDir, options, started) => {
 			published: Boolean(published)
 		});
 		await tui.finish({ footer: `Done · ${selected.provider.id} · ${Math.round(performance.now() - started)}ms` });
-		const recorder = getActiveRecorder();
-		if (recorder) {
-			let patchDiff;
-			if (created?.worktree?.path) try {
-				patchDiff = (spawnSync("git", [
-					"diff",
-					"-U2",
-					"--no-color",
-					"HEAD"
-				], {
-					cwd: created.worktree.path,
-					encoding: "utf-8"
-				}).stdout || "").slice(0, 2e4) || void 0;
-			} catch {}
-			if (published) {
-				const prMatch = published.prUrl?.match(/\/pull\/(\d+)/);
-				const prNumber = prMatch ? Number.parseInt(prMatch[1], 10) : void 0;
-				recorder.setGitContext({
-					branch: published.branch,
-					pr_number: prNumber
-				});
-			} else if (options.branch) recorder.setGitContext({ branch: options.branch });
-			const agentTelemetry = {
-				provider: selected.provider.id,
-				before_score: before.score,
-				after_score: verified.after.score,
-				pr_url: published?.prUrl || void 0,
-				patch_diff: patchDiff,
-				duration_ms: Math.round(performance.now() - started)
-			};
-			recorder.setAgentTelemetry(agentTelemetry);
-			recorder.recordStep("agent:baseline", 50, true);
-			recorder.recordStep("agent:verify", Math.round(performance.now() - started), verified.after.score !== null && verified.after.score >= options.targetScore);
-			recorder.setReport({
-				score: verified.after.score,
-				scoreable: true,
-				files_scanned: changedFiles.length,
-				findings: [],
-				agent_telemetry: agentTelemetry
-			});
-		}
+		recordAgentSessionTelemetry({
+			worktreePath: created?.worktree?.path,
+			published,
+			branchOption: options.branch,
+			providerId: selected.provider.id,
+			beforeScore: before.score,
+			afterScore: verified.after.score,
+			targetScore: options.targetScore,
+			durationMs: Math.round(performance.now() - started),
+			changedFilesCount: changedFiles.length
+		});
 		printAgentSessionSummary({
 			before,
 			after: verified.after,
@@ -4704,7 +4779,8 @@ const DEFAULT_CONFIG = {
 		format: "json"
 	},
 	telemetry: { enabled: true },
-	rules: {}
+	rules: {},
+	overrides: []
 };
 const GITHUB_WORKFLOW_DIR = ".github/workflows";
 const GITHUB_WORKFLOW_FILE = "raigal.yml";
@@ -4747,7 +4823,7 @@ const DEFAULT_RULES_YAML = `# Architecture rules (BYO)
 //#endregion
 //#region src/config/extends.ts
 const MAX_DEPTH$1 = 5;
-const MAX_CONFIG_BYTES = 1024 * 1024;
+const MAX_CONFIG_BYTES = 1048576;
 const isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 const deepMerge = (...sources) => {
 	const result = {};
@@ -4928,12 +5004,25 @@ const CiSchema = z.object({
 	format: z.enum(["json"]).default("json")
 }).strict();
 const TelemetrySchema = z.object({ enabled: z.boolean().default(true) }).strict();
+const BaselineConfigSchema = z.object({ mode: z.enum(["strict", "relaxed"]).default("relaxed") }).strict();
+const LicensingConfigSchema = z.object({ onLapse: z.enum(["fail-open", "fail-closed"]).default("fail-open") }).strict();
+const WorkspaceConfigSchema = z.object({ minimumFloor: z.number().min(0).max(100).default(50) }).strict();
 const RuleSeverityOverride = z.enum([
 	"error",
 	"warning",
 	"off"
 ]);
 const RulesSchema = z.record(z.string(), RuleSeverityOverride).default(() => ({}));
+const FileOverrideSchema = z.object({
+	files: z.array(z.string().min(1)).min(1),
+	quality: z.object({
+		maxFunctionLoc: QualitySchema.shape.maxFunctionLoc.unwrap().optional(),
+		maxFileLoc: QualitySchema.shape.maxFileLoc.unwrap().optional(),
+		maxNesting: QualitySchema.shape.maxNesting.unwrap().optional(),
+		maxParams: QualitySchema.shape.maxParams.unwrap().optional()
+	}).optional(),
+	rules: z.record(z.string(), RuleSeverityOverride).optional()
+});
 const AislopConfigSchema = z.object({
 	version: z.number().default(1),
 	extends: z.union([z.string(), z.array(z.string())]).optional(),
@@ -4988,7 +5077,11 @@ const AislopConfigSchema = z.object({
 		format: "json"
 	})),
 	telemetry: TelemetrySchema.default(() => ({ enabled: true })),
+	baseline: BaselineConfigSchema.optional(),
+	licensing: LicensingConfigSchema.optional(),
+	workspace: WorkspaceConfigSchema.optional(),
 	rules: RulesSchema,
+	overrides: z.array(FileOverrideSchema).default(() => []),
 	exclude: z.array(z.string()).default(() => [
 		"node_modules",
 		".git",
@@ -5020,6 +5113,9 @@ const KNOWN_KEYS_BY_PATH = {
 		"scoring",
 		"ci",
 		"telemetry",
+		"baseline",
+		"licensing",
+		"workspace",
 		"rules",
 		"exclude",
 		"include"
@@ -5070,7 +5166,10 @@ const KNOWN_KEYS_BY_PATH = {
 	],
 	"scoring.thresholds": ["good", "ok"],
 	ci: ["failBelow", "format"],
-	telemetry: ["enabled"]
+	telemetry: ["enabled"],
+	baseline: ["mode"],
+	licensing: ["onLapse"],
+	workspace: ["minimumFloor"]
 };
 const levenshtein = (a, b) => {
 	const m = a.length;
@@ -5202,7 +5301,8 @@ const loadConfig = (directory) => {
 	const configPath = findConfigFile(directory);
 	if (!configPath) return DEFAULT_CONFIG;
 	try {
-		return validateConfig(loadConfigChain(configPath), configPath);
+		const merged = loadConfigChain(configPath);
+		return validateConfig(merged, configPath);
 	} catch (error) {
 		if (error instanceof ConfigError) throw error;
 		throw new ConfigError(configPath, `Failed to parse ${configPath}: ${error instanceof Error ? error.message : String(error)}`);
@@ -5360,6 +5460,10 @@ const SAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set([
 	"exit_code",
 	"duration_ms",
 	"error_kind",
+	"error_name",
+	"error_code",
+	"failed_stage",
+	"engines_failed",
 	"score",
 	"score_bucket",
 	"finding_count",
@@ -5473,10 +5577,11 @@ const track = (input) => {
 		cachedInstallId = ensured.installId;
 		installCreated = ensured.created;
 	}
-	const { clean, dropped } = redactProperties({
+	const merged = {
 		...baseProperties(cachedInstallId),
 		...input.properties
-	});
+	};
+	const { clean, dropped } = redactProperties(merged);
 	if (isDebug()) {
 		const compact = JSON.stringify({
 			event: input.event,
@@ -5615,6 +5720,8 @@ const buildCommandCompletedProps = (input) => {
 	if (typeof input.fixSteps === "number") props.fix_steps = input.fixSteps;
 	if (typeof input.fixResolved === "number") props.fix_resolved = input.fixResolved;
 	if (typeof input.fixScoreDelta === "number") props.fix_score_delta = input.fixScoreDelta;
+	if (input.errorName) props.error_name = input.errorName;
+	if (input.errorCode) props.error_code = input.errorCode;
 	return props;
 };
 const buildHookScanCompletedProps = (input) => {
@@ -5635,6 +5742,50 @@ const errorKindFromException = (error) => {
 	if (message.includes("engine") && message.includes("crash")) return "engine_crash";
 	return "unknown";
 };
+const SAFE_ERROR_NAME = /^[A-Za-z_$][A-Za-z0-9_$]{0,39}$/;
+const SAFE_ERROR_CODE = /^[A-Za-z][A-Za-z0-9_]{0,39}$/;
+const errorIdentity = (error) => {
+	let name;
+	if (error instanceof Error && typeof error.name === "string" && error.name.length > 0) name = error.name;
+	else if (error === null) name = "null";
+	else if (typeof error === "object") name = "object";
+	else name = typeof error;
+	const identity = { error_name: SAFE_ERROR_NAME.test(name) ? name : "Error" };
+	const code = error?.code;
+	if (typeof code === "string" && SAFE_ERROR_CODE.test(code)) identity.error_code = code;
+	else if (typeof code === "number" && Number.isFinite(code)) identity.error_code = String(code);
+	return identity;
+};
+const buildCommandFailedProps = (input) => {
+	const props = {
+		failed_stage: input.stage,
+		...errorIdentity(input.error)
+	};
+	if (input.command) props.command = input.command;
+	return props;
+};
+//#endregion
+//#region src/telemetry/fatal.ts
+const reportedErrors = /* @__PURE__ */ new Set();
+let activeTelemetryConfig;
+const markErrorReported = (error) => {
+	reportedErrors.add(error);
+};
+const rememberTelemetryConfig = (config) => {
+	activeTelemetryConfig = config;
+};
+const reportFatalError = async (error, stage, config) => {
+	if (reportedErrors.has(error)) return;
+	track({
+		event: "cli_command_failed",
+		properties: buildCommandFailedProps({
+			error,
+			stage
+		}),
+		config: activeTelemetryConfig ?? config
+	});
+	await flushTelemetry(2e3);
+};
 //#endregion
 //#region src/telemetry/lifecycle.ts
 const STARTED_FLUSH_TIMEOUT_MS = 100;
@@ -5645,6 +5796,7 @@ const withCommandLifecycle = async (start, run) => {
 		fileCount: start.fileCount,
 		properties: start.properties
 	});
+	rememberTelemetryConfig(start.config);
 	track({
 		event: "cli_command_started",
 		properties: startProps,
@@ -5661,6 +5813,7 @@ const withCommandLifecycle = async (start, run) => {
 				startProps,
 				exitCode: result.exitCode,
 				durationMs,
+				errorKind: result.errorKind,
 				score: result.score ?? void 0,
 				findingCount: result.findingCount,
 				errorCount: result.errorCount,
@@ -5678,16 +5831,21 @@ const withCommandLifecycle = async (start, run) => {
 		await flushTelemetry();
 		return result;
 	} catch (error) {
+		const durationMs = performance.now() - startedAt;
+		const identity = errorIdentity(error);
 		track({
 			event: "cli_command_completed",
 			properties: buildCommandCompletedProps({
 				startProps,
 				exitCode: 1,
-				durationMs: performance.now() - startedAt,
-				errorKind: errorKindFromException(error)
+				durationMs,
+				errorKind: errorKindFromException(error),
+				errorName: identity.error_name,
+				errorCode: identity.error_code
 			}),
 			config: start.config
 		});
+		markErrorReported(error);
 		await flushTelemetry();
 		throw error;
 	}
@@ -6263,14 +6421,17 @@ const renderRailStep = (step, deps = {}) => {
 * between the last step and the footer.
 */
 const renderRailConnector = (deps = {}) => {
-	return ` ${style$1(deps.theme ?? theme, "accentDim", (deps.symbols ?? symbols).rail)}\n`;
+	const t = deps.theme ?? theme;
+	const s = deps.symbols ?? symbols;
+	return ` ${style$1(t, "accentDim", s.rail)}\n`;
 };
 /**
 * Render the rail-end footer line ("└  <footer text>").
 */
 const renderRailFooter = (footer, deps = {}) => {
 	const t = deps.theme ?? theme;
-	return ` ${style$1(t, "accentDim", (deps.symbols ?? symbols).railEnd)}  ${highlightAislop(footer, t)}\n`;
+	const s = deps.symbols ?? symbols;
+	return ` ${style$1(t, "accentDim", s.railEnd)}  ${highlightAislop(footer, t)}\n`;
 };
 const renderRail = (input, deps = {}) => {
 	const t = deps.theme ?? theme;
@@ -6427,7 +6588,7 @@ const launchMonitorInBackground = async (directory, options) => {
 	fs.mkdirSync(logDir, { recursive: true });
 	const logPath = path.join(logDir, `${monitorId}.log`);
 	const logFd = fs.openSync(logPath, "a");
-	writeAgentMonitorRecord(root, {
+	const record = {
 		id: monitorId,
 		root,
 		requestedDirectory: path.resolve(directory),
@@ -6445,7 +6606,8 @@ const launchMonitorInBackground = async (directory, options) => {
 		noFix: options.noFix,
 		logPath,
 		recentCycles: []
-	});
+	};
+	writeAgentMonitorRecord(root, record);
 	const child = spawn(process.execPath, [cliPath(), ...buildBackgroundMonitorArgs(directory, options)], {
 		cwd: root,
 		detached: true,
@@ -6849,6 +7011,13 @@ const registerAgentMonitorSubcommands = (agent) => {
 	registerMonitorStopCommand(monitor);
 };
 //#endregion
+//#region src/ui/prompts.ts
+const runCancellable = async (fn) => {
+	const value = await fn();
+	if (isCancel(value)) return void 0;
+	return value;
+};
+//#endregion
 //#region src/commands/agent-apply.ts
 const asString = (value) => typeof value === "string" && value.length > 0 ? value : null;
 const isInside = (base, target) => {
@@ -7687,7 +7856,8 @@ const registerPlanSubcommand = (agent) => {
 	const plan = agent.command("plan [directory]").description("Preview provider, worktree, findings, and publish actions without editing");
 	addAgentOptions(plan);
 	plan.action(async (directory = ".", _flags, command) => {
-		const options = agentOptionsFromFlags(command.optsWithGlobals(), command);
+		const flags = command.optsWithGlobals();
+		const options = agentOptionsFromFlags(flags, command);
 		await withAgentLifecycle("agent_plan", directory, agentTelemetryProperties(options), async () => {
 			await agentPlanCommand(directory, options);
 		});
@@ -7697,7 +7867,8 @@ const registerAgentCommand = (program) => {
 	const agent = program.command("agent [directory]").description("Run a local AI slop repair session with Codex, Claude Code, or OpenCode");
 	addAgentOptions(agent);
 	agent.action(async (directory = ".", _flags, command) => {
-		const options = agentOptionsFromFlags(command.optsWithGlobals(), command);
+		const flags = command.optsWithGlobals();
+		const options = agentOptionsFromFlags(flags, command);
 		await withAgentLifecycle("agent", directory, agentTelemetryProperties(options), async () => {
 			return await agentCommand(directory, options);
 		});
@@ -7909,7 +8080,11 @@ const whoamiCommand = async () => {
 	process.stdout.write(`  Organization:     ${orgName} (${orgId})\n`);
 	if (userEmail) process.stdout.write(`  User:             ${userEmail}\n`);
 	process.stdout.write(`  Credential:       ${active.kind === "api_key" ? "Org API Key" : "User Session"} (via ${active.source})\n`);
-	process.stdout.write(`  Plan:             ${plan}${trialEnd ? ` (trial ends ${trialEnd})` : ""}\n`);
+	let planDisplay = plan;
+	if (plan === "active") planDisplay = "active (enterprise license)";
+	else if (plan === "expired") planDisplay = `expired${trialEnd ? ` (trial ended ${trialEnd})` : ""}`;
+	else if (trialEnd) planDisplay = `trial (trial ends ${trialEnd})`;
+	process.stdout.write(`  Plan:             ${planDisplay}\n`);
 	process.stdout.write(`  Allowed Owners:   ${owners || "none"}\n`);
 	if (claims) {
 		const expDate = (/* @__PURE__ */ new Date(claims.exp * 1e3)).toISOString();
@@ -7985,9 +8160,9 @@ const buildSuggestedActions = (diagnostics, findings, regressed, delta) => {
 	if (fixableDiags.length > 0) {
 		const ruleIds = Array.from(new Set(fixableDiags.map((d) => d.rule)));
 		actions.push({
-			id: "run_aislop_fix",
-			label: `Run aislop fix to clear ${fixableDiags.length} mechanical finding${fixableDiags.length === 1 ? "" : "s"}.`,
-			command: "aislop fix",
+			id: "run_raigal_fix",
+			label: `Run raigal fix to clear ${fixableDiags.length} mechanical finding${fixableDiags.length === 1 ? "" : "s"}.`,
+			command: "raigal fix",
 			rationale: "These findings have deterministic fixes (formatting, unused imports, trivial comments). Running this before any manual work avoids burning agent tokens on what the CLI handles for free.",
 			ruleIds
 		});
@@ -8048,8 +8223,40 @@ const buildFeedback = (diagnostics, score, rootDirectory, baseline, meta) => {
 	const regressed = typeof delta === "number" ? delta < 0 : false;
 	let newSinceBaseline;
 	if (baselineSnapshot && baselineSnapshot.findingFingerprints.length > 0) {
-		const known = new Set(baselineSnapshot.findingFingerprints);
-		newSinceBaseline = all.filter((f) => !known.has(fingerprintFinding(f))).slice(0, MAX_NEW_SINCE_BASELINE);
+		const remainingExact = new Set(baselineSnapshot.findingFingerprints);
+		const unmatchedFindings = [];
+		for (const f of all) {
+			const exactFp = fingerprintFinding(f);
+			if (remainingExact.has(exactFp)) remainingExact.delete(exactFp);
+			else unmatchedFindings.push(f);
+		}
+		const remainingPool = [];
+		for (const fp of remainingExact) {
+			const parts = fp.split(":");
+			if (parts.length >= 3) {
+				const file = parts[0];
+				const line = Number.parseInt(parts[1], 10);
+				const rule = parts.slice(2).join(":");
+				remainingPool.push({
+					file,
+					line: Number.isNaN(line) ? 0 : line,
+					rule
+				});
+			}
+		}
+		const stillUnmatched = [];
+		for (const f of unmatchedFindings) {
+			const candidateIdx = remainingPool.findIndex((b) => b.file === f.file && b.rule === f.ruleId && Math.abs(b.line - f.line) <= 5);
+			if (candidateIdx >= 0) remainingPool.splice(candidateIdx, 1);
+			else stillUnmatched.push(f);
+		}
+		const fresh = [];
+		for (const f of stillUnmatched) {
+			const candidateIdx = remainingPool.findIndex((b) => b.file === f.file && b.rule === f.ruleId);
+			if (candidateIdx >= 0) remainingPool.splice(candidateIdx, 1);
+			else fresh.push(f);
+		}
+		newSinceBaseline = fresh.slice(0, MAX_NEW_SINCE_BASELINE);
 	}
 	return {
 		schema: "aislop.hook.v2",
@@ -8088,25 +8295,151 @@ const readLock = (target) => {
 		return null;
 	}
 };
-const acquireHookLock = (cwd) => {
-	const target = lockPath(cwd);
-	const existing = readLock(target);
-	if (existing && Date.now() - existing.ts < STALE_MS) return null;
-	try {
-		fs.mkdirSync(path.dirname(target), { recursive: true });
-		fs.writeFileSync(target, JSON.stringify({
-			pid: process.pid,
-			ts: Date.now()
-		}));
-	} catch {
-		return null;
+const acquireHookLock = (cwd) => {
+	const target = lockPath(cwd);
+	const existing = readLock(target);
+	if (existing && Date.now() - existing.ts < STALE_MS) return null;
+	try {
+		fs.mkdirSync(path.dirname(target), { recursive: true });
+		fs.writeFileSync(target, JSON.stringify({
+			pid: process.pid,
+			ts: Date.now()
+		}));
+	} catch {
+		return null;
+	}
+	return () => {
+		try {
+			if (readLock(target)?.pid === process.pid) fs.unlinkSync(target);
+		} catch {}
+	};
+};
+//#endregion
+//#region src/utils/globs.ts
+const MAX_BRACE_EXPANSIONS = 256;
+const braceListAt = (pattern, start) => {
+	let depth = 0;
+	const commas = [];
+	for (let i = start; i < pattern.length; i += 1) {
+		const char = pattern[i];
+		if (char === "\\") i += 1;
+		else if (char === "{") depth += 1;
+		else if (char === ",") {
+			if (depth === 1) commas.push(i);
+		} else if (char === "}") {
+			depth -= 1;
+			if (depth === 0) return commas.length > 0 ? {
+				start,
+				end: i,
+				commas
+			} : null;
+		}
+	}
+	return null;
+};
+const findBraceList = (pattern) => {
+	for (let start = pattern.indexOf("{"); start !== -1; start = pattern.indexOf("{", start + 1)) {
+		if (start > 0 && pattern[start - 1] === "\\") continue;
+		const list = braceListAt(pattern, start);
+		if (list) return list;
+	}
+	return null;
+};
+const expandInto = (pattern, results) => {
+	const list = findBraceList(pattern);
+	if (!list) {
+		results.push(pattern);
+		return results.length <= MAX_BRACE_EXPANSIONS;
+	}
+	const bounds = [
+		list.start,
+		...list.commas,
+		list.end
+	];
+	const prefix = pattern.slice(0, list.start);
+	const suffix = pattern.slice(list.end + 1);
+	for (let i = 0; i < bounds.length - 1; i += 1) {
+		const option = pattern.slice(bounds[i] + 1, bounds[i + 1]);
+		if (!expandInto(`${prefix}${option}${suffix}`, results)) return false;
+	}
+	return true;
+};
+const expandBraceLists = (pattern) => {
+	const results = [];
+	return expandInto(pattern, results) ? results : [pattern];
+};
+const isNegated = (pattern) => picomatch.scan(pattern).negated;
+const matchesGlobList = (value, patterns, options = {}) => {
+	const expanded = patterns.flatMap(expandBraceLists);
+	const positives = expanded.filter((pattern) => !isNegated(pattern));
+	const negatives = expanded.filter(isNegated).map((pattern) => pattern.slice(1));
+	const included = positives.length === 0 || picomatch.isMatch(value, positives, options);
+	const excluded = negatives.length > 0 && picomatch.isMatch(value, negatives, options);
+	return included && !excluded;
+};
+//#endregion
+//#region src/scoring/rule-severity.ts
+/**
+* Apply per-rule severity overrides from config: "off" drops the diagnostic,
+* "error"/"warning" rewrite its severity before scoring and rendering.
+*/
+const applyRuleSeverities = (diagnostics, overrides) => {
+	if (Object.keys(overrides).length === 0) return diagnostics;
+	const result = [];
+	for (const diagnostic of diagnostics) {
+		const override = overrides[diagnostic.rule];
+		if (!override) {
+			result.push(diagnostic);
+			continue;
+		}
+		if (override === "off") continue;
+		result.push(override === diagnostic.severity ? diagnostic : {
+			...diagnostic,
+			severity: override
+		});
+	}
+	return result;
+};
+//#endregion
+//#region src/config/overrides.ts
+const overrideRelativePath = (rootDirectory, filePath) => {
+	const paths = path.win32.isAbsolute(rootDirectory) && !path.posix.isAbsolute(rootDirectory) ? path.win32 : path.posix;
+	const root = rootDirectory.replaceAll("\\", "/");
+	const file = filePath.replaceAll("\\", "/");
+	return paths.normalize(paths.isAbsolute(file) ? paths.relative(root, file) : file).replaceAll("\\", "/");
+};
+const matchesEntry = (relativePath, patterns) => matchesGlobList(relativePath, patterns, { dot: true });
+const resolveFilePolicy = (config, relativePath) => {
+	let quality = config.quality;
+	let rules = config.rules ?? {};
+	if (relativePath === ".." || relativePath.startsWith("../") || path.win32.isAbsolute(relativePath)) return {
+		quality,
+		rules
+	};
+	for (const entry of config.overrides ?? []) {
+		if (!matchesEntry(relativePath, entry.files)) continue;
+		if (entry.quality) quality = {
+			...quality,
+			...entry.quality
+		};
+		if (entry.rules) rules = {
+			...rules,
+			...entry.rules
+		};
 	}
-	return () => {
-		try {
-			if (readLock(target)?.pid === process.pid) fs.unlinkSync(target);
-		} catch {}
+	return {
+		quality,
+		rules
 	};
 };
+const applyFileOverrides = (diagnostics, context) => {
+	if (!context.config.overrides?.length) return diagnostics;
+	return diagnostics.flatMap((diagnostic) => {
+		const relativePath = overrideRelativePath(context.rootDirectory, diagnostic.filePath);
+		const { rules } = resolveFilePolicy(context.config, relativePath);
+		return applyRuleSeverities([diagnostic], rules);
+	});
+};
 const supportedGlobPatterns = (patterns) => patterns.filter((pattern) => pattern.length <= 256);
 const normalizeExcludePatterns = (patterns) => patterns.flatMap((pattern) => {
 	const trimmed = pattern.trim();
@@ -8116,13 +8449,13 @@ const normalizeExcludePatterns = (patterns) => patterns.flatMap((pattern) => {
 	const normalized = withoutProjectPrefix.slice(0, end);
 	if (normalized.length === 0) return [];
 	if (normalized.length > 256) return [];
-	if (micromatch.scan(normalized).isGlob) return [normalized];
+	if (picomatch.scan(normalized).isGlob) return [normalized];
 	if (normalized.startsWith(".") && !normalized.includes("/")) return supportedGlobPatterns([`**/${normalized}`, `**/${normalized}/**`]);
 	return supportedGlobPatterns([normalized, `${normalized}/**`]);
 });
 const isPathExcluded = (relativePath, normalizedPatterns) => {
 	if (normalizedPatterns.length === 0) return false;
-	return micromatch.isMatch(relativePath, normalizedPatterns, { dot: true });
+	return picomatch.isMatch(relativePath, normalizedPatterns, { dot: true });
 };
 const filterExcludedDiagnostics = (diagnostics, rootDirectory, excludePatterns) => {
 	if (!excludePatterns || excludePatterns.length === 0) return diagnostics;
@@ -8135,7 +8468,7 @@ const filterExcludedDiagnostics = (diagnostics, rootDirectory, excludePatterns)
 };
 //#endregion
 //#region src/utils/project-path-safety.ts
-const MAX_PROJECT_CONFIG_BYTES = 1024 * 1024;
+const MAX_PROJECT_CONFIG_BYTES = 1048576;
 const isWithinDirectory$3 = (rootDirectory, candidate) => {
 	const relative = path.relative(rootDirectory, candidate);
 	return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
@@ -8189,7 +8522,7 @@ const isRootBoundedTarget = (candidate, rootDirectory) => {
 };
 //#endregion
 //#region src/utils/aislop-ignore.ts
-const readRaigalIgnorePatterns = (rootDirectory) => {
+const readAislopIgnorePatterns = (rootDirectory) => {
 	const patterns = [];
 	for (const fileName of [".raigalignore", ".aislopignore"]) {
 		const targetPath = safeProjectFilePath(path.join(rootDirectory, fileName), rootDirectory);
@@ -8200,7 +8533,6 @@ const readRaigalIgnorePatterns = (rootDirectory) => {
 	}
 	return patterns;
 };
-const readAislopIgnorePatterns = readRaigalIgnorePatterns;
 //#endregion
 //#region src/utils/generated-files.ts
 const AUTO_GENERATED_PATTERNS = [
@@ -8236,7 +8568,7 @@ const isAutoGenerated = (filePath) => {
 };
 //#endregion
 //#region src/utils/git-ignore.ts
-const MAX_BUFFER$2 = 50 * 1024 * 1024;
+const MAX_BUFFER$2 = 52428800;
 const NOT_IGNORED_ARGUMENTS = [
 	"ls-files",
 	"--cached",
@@ -8347,7 +8679,7 @@ const dropGitIgnoredPaths = (rootDirectory, absolutePaths) => {
 };
 //#endregion
 //#region src/utils/project-file-list.ts
-const MAX_BUFFER$1 = 50 * 1024 * 1024;
+const MAX_BUFFER$1 = 52428800;
 const normalizePruneDirectories = (directories) => new Set([...directories].map((directory) => directory.toLowerCase()));
 const isInPrunedDirectory = (filePath, pruneDirectories) => {
 	const pathSegments = filePath.split("/");
@@ -8559,12 +8891,13 @@ const normalizeIncludePatterns = (patterns) => patterns.flatMap((pattern) => {
 	const normalized = pattern.trim().replace(/^\.\//, "").replace(/\/$/, "");
 	if (normalized === "" || normalized === ".") return ["**"];
 	if (normalized.length > 256) return [];
-	if (micromatch.scan(normalized).isGlob) return [normalized];
+	if (picomatch.scan(normalized).isGlob) return [normalized];
 	return supportedGlobPatterns([normalized, `${normalized}/**`]);
 });
 const createPathMatcher = (patterns) => {
-	const matchers = patterns.map((pattern) => micromatch.matcher(pattern, { dot: true }));
-	return (filePath) => matchers.some((matches) => matches(filePath));
+	if (patterns.length === 0) return () => false;
+	const isMatch = picomatch(patterns, { dot: true });
+	return (filePath) => isMatch(filePath);
 };
 const filterFiles = (rootDirectory, files, options) => {
 	const extraExtensions = new Set(options.extraExtensions);
@@ -9278,7 +9611,7 @@ const tokenizeJs = (content, ext = ".ts") => {
 };
 //#endregion
 //#region src/utils/source-masker.ts
-const JS_EXTS$2 = /* @__PURE__ */ new Set([
+const JS_EXTS$3 = /* @__PURE__ */ new Set([
 	".ts",
 	".tsx",
 	".js",
@@ -9286,7 +9619,7 @@ const JS_EXTS$2 = /* @__PURE__ */ new Set([
 	".mjs",
 	".cjs"
 ]);
-const PY_EXTS = /* @__PURE__ */ new Set([".py"]);
+const PY_EXTS$1 = /* @__PURE__ */ new Set([".py"]);
 const RB_EXTS = /* @__PURE__ */ new Set([".rb"]);
 const PHP_EXTS = /* @__PURE__ */ new Set([".php"]);
 const CSHARP_EXTS = /* @__PURE__ */ new Set([".cs"]);
@@ -9310,8 +9643,8 @@ const C_STYLE_COMMENT_EXTS = /* @__PURE__ */ new Set([
 	".zig"
 ]);
 const familyForExt = (ext) => {
-	if (JS_EXTS$2.has(ext)) return "js";
-	if (PY_EXTS.has(ext)) return "py";
+	if (JS_EXTS$3.has(ext)) return "js";
+	if (PY_EXTS$1.has(ext)) return "py";
 	if (RB_EXTS.has(ext)) return "rb";
 	if (PHP_EXTS.has(ext)) return "php";
 	if (CSHARP_EXTS.has(ext)) return "csharp";
@@ -9581,7 +9914,7 @@ const areLiteralMultisetsEqual = (a, b) => {
 };
 //#endregion
 //#region src/engines/ai-slop/abstractions.ts
-const JS_EXTS$1 = /* @__PURE__ */ new Set([
+const JS_EXTS$2 = /* @__PURE__ */ new Set([
 	".ts",
 	".tsx",
 	".js",
@@ -9592,11 +9925,11 @@ const JS_EXTS$1 = /* @__PURE__ */ new Set([
 const THIN_WRAPPER_PATTERNS = [
 	{
 		pattern: /(?:export\s+)?(?:async\s+)?function\s+(\w+)\s*\([^)]*\)\s*(?::\s*\w[^{]*)?\{\s*\n?\s*return\s+\w+\([^)]*\);\s*\n?\s*\}/g,
-		extensions: JS_EXTS$1
+		extensions: JS_EXTS$2
 	},
 	{
 		pattern: /(?:export\s+)?const\s+(\w+)\s*=\s*(?:async\s+)?\([^)]*\)\s*(?::\s*\w[^=]*)?\s*=>\s*\w+\([^)]*\);/g,
-		extensions: JS_EXTS$1
+		extensions: JS_EXTS$2
 	},
 	{
 		pattern: /def\s+(\w+)\s*\([^)]*\)(?:\s*->[^:]*)?:\s*\n\s+return\s+\w+\([^)]*\)\s*$/gm,
@@ -10844,7 +11177,7 @@ const scriptKindFor$1 = (ext) => {
 	}
 };
 const lineFor$1 = (sourceFile, node) => sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
-const makeDiagnostic = (filePath, line, rule, message, help) => ({
+const makeDiagnostic$1 = (filePath, line, rule, message, help) => ({
 	filePath,
 	engine: "ai-slop",
 	rule,
@@ -10894,7 +11227,7 @@ const detectRedundantTryCatch = (sourceFile, relativePath) => {
 		if (ts.isTryStatement(node) && node.catchClause && !node.finallyBlock) {
 			const catchNameNode = node.catchClause.variableDeclaration?.name;
 			const [onlyStatement] = node.catchClause.block.statements;
-			if (catchNameNode && ts.isIdentifier(catchNameNode) && node.catchClause.block.statements.length === 1 && onlyStatement && (isRethrowStatement(onlyStatement, catchNameNode.text) || isPromiseRejectRethrow(onlyStatement, catchNameNode.text))) diagnostics.push(makeDiagnostic(relativePath, lineFor$1(sourceFile, node.catchClause), "ai-slop/redundant-try-catch", "Catch block only rethrows the same error", "Remove the try/catch or add useful context, cleanup, or recovery. Rethrowing unchanged errors is usually defensive agent noise."));
+			if (catchNameNode && ts.isIdentifier(catchNameNode) && node.catchClause.block.statements.length === 1 && onlyStatement && (isRethrowStatement(onlyStatement, catchNameNode.text) || isPromiseRejectRethrow(onlyStatement, catchNameNode.text))) diagnostics.push(makeDiagnostic$1(relativePath, lineFor$1(sourceFile, node.catchClause), "ai-slop/redundant-try-catch", "Catch block only rethrows the same error", "Remove the try/catch or add useful context, cleanup, or recovery. Rethrowing unchanged errors is usually defensive agent noise."));
 		}
 		ts.forEachChild(node, visit);
 	};
@@ -10912,7 +11245,7 @@ const detectPrimitiveCoercions = (sourceFile, relativePath) => {
 				const [arg] = child.arguments;
 				if (arg && ts.isIdentifier(arg)) {
 					const primitive = params.get(arg.text);
-					if (primitive && child.expression.text === COERCION_CTORS[primitive]) diagnostics.push(makeDiagnostic(relativePath, lineFor$1(sourceFile, child), "ai-slop/redundant-type-coercion", `Parameter '${arg.text}' is already typed as ${primitive} but is coerced again`, "Trust the typed boundary or validate unknown input before this function. Re-coercing already typed parameters is usually defensive agent noise."));
+					if (primitive && child.expression.text === COERCION_CTORS[primitive]) diagnostics.push(makeDiagnostic$1(relativePath, lineFor$1(sourceFile, child), "ai-slop/redundant-type-coercion", `Parameter '${arg.text}' is already typed as ${primitive} but is coerced again`, "Trust the typed boundary or validate unknown input before this function. Re-coercing already typed parameters is usually defensive agent noise."));
 				}
 			}
 			ts.forEachChild(child, visitBody);
@@ -10955,7 +11288,7 @@ const detectDuplicateExportedTypes = (parsedSources) => {
 				continue;
 			}
 			if (previous.filePath === declaration.filePath) continue;
-			diagnostics.push(makeDiagnostic(declaration.filePath, declaration.line, "ai-slop/duplicate-type-declaration", `Exported type '${declaration.name}' duplicates an existing declaration`, `Reuse or import the existing type from ${previous.filePath} instead of re-declaring the same shape in another file.`));
+			diagnostics.push(makeDiagnostic$1(declaration.filePath, declaration.line, "ai-slop/duplicate-type-declaration", `Exported type '${declaration.name}' duplicates an existing declaration`, `Reuse or import the existing type from ${previous.filePath} instead of re-declaring the same shape in another file.`));
 		}
 	}
 	return diagnostics;
@@ -11057,7 +11390,7 @@ const detectDuplicateImports = async (context) => {
 					rule: "ai-slop/duplicate-import",
 					severity: "warning",
 					message: `"${spec}" is also imported on line ${firstLine}. Merge into a single import statement.`,
-					help: "Two imports from the same module split readers' attention and grow the import block. Run aislop fix to merge them automatically.",
+					help: "Two imports from the same module split readers' attention and grow the import block. Run raigal fix to merge them automatically.",
 					line: dup.line,
 					column: 1,
 					category: "AI Slop",
@@ -12765,7 +13098,8 @@ const isJsRelativeOrAbsolute = (spec) => spec.startsWith(".") || spec.startsWith
 const RUNTIME_BUILTINS = /* @__PURE__ */ new Set(["bun"]);
 const isJsBuiltin = (spec) => {
 	if (RUNTIME_BUILTINS.has(spec)) return true;
-	return isBuiltin(spec.startsWith("node:") ? spec.slice(5) : spec) || isBuiltin(spec);
+	const stripped = spec.startsWith("node:") ? spec.slice(5) : spec;
+	return isBuiltin(stripped) || isBuiltin(spec);
 };
 const VIRTUAL_MODULE_PREFIXES = [
 	"astro:",
@@ -12977,7 +13311,8 @@ const isLocalAliasReplacement = (rawValue, configDirectory, rootDirectory) => {
 	if (!target) return false;
 	if (!target.startsWith(".") && !target.startsWith("/") && !target.startsWith("~/") && !target.startsWith("@/")) return false;
 	const normalized = target.startsWith("~/") || target.startsWith("@/") ? target.slice(2) : target;
-	return isRootBoundedTarget(path.isAbsolute(normalized) ? normalized : path.resolve(configDirectory, normalized), rootDirectory);
+	const candidate = path.isAbsolute(normalized) ? normalized : path.resolve(configDirectory, normalized);
+	return isRootBoundedTarget(candidate, rootDirectory);
 };
 const hasValidPackageImportTarget = (value, packageDirectory, rootDirectory) => {
 	if (!isRootBoundedTarget(packageDirectory, rootDirectory)) return false;
@@ -14171,7 +14506,9 @@ const isRustDocCommentLine = (line) => {
 };
 const collectBlocks = (sourceLines, syntax, content, ext) => {
 	const blocks = [];
-	const commentLines = getCommentLines(content ?? sourceLines.join("\n"), ext ?? (syntax.linePrefixes.includes("//") ? ".ts" : ".py"));
+	const actualContent = content ?? sourceLines.join("\n");
+	const actualExt = ext ?? (syntax.linePrefixes.includes("//") ? ".ts" : ".py");
+	const commentLines = getCommentLines(actualContent, actualExt);
 	let i = 0;
 	while (i < sourceLines.length) {
 		const line = sourceLines[i];
@@ -14499,7 +14836,8 @@ const detectNarrativeComments = async (context) => {
 		} catch {
 			continue;
 		}
-		const blocks = collectBlocks(content.split("\n"), syntax, content, ext);
+		const lines = content.split("\n");
+		const blocks = collectBlocks(lines, syntax, content, ext);
 		for (const block of blocks) {
 			const { matched, reason } = detectNarrativeInBlock(block, ext);
 			if (!matched) continue;
@@ -14971,7 +15309,7 @@ const detectRustPatterns = async (context) => {
 };
 //#endregion
 //#region src/engines/ai-slop/silent-recovery.ts
-const JS_EXTS = /* @__PURE__ */ new Set([
+const JS_EXTS$1 = /* @__PURE__ */ new Set([
 	".ts",
 	".tsx",
 	".js",
@@ -15166,7 +15504,7 @@ const detectSilentRecovery = async (context) => {
 	for (const filePath of files) {
 		if (isAutoGenerated(filePath)) continue;
 		const ext = path.extname(filePath);
-		const isJs = JS_EXTS.has(ext);
+		const isJs = JS_EXTS$1.has(ext);
 		if (!isJs && !(ext === ".py")) continue;
 		const relPath = relativePosix(context.rootDirectory, filePath);
 		if (isNonProductionPath(relPath)) continue;
@@ -15451,7 +15789,7 @@ const detectUnusedCss = async (context) => {
 				rule: "ai-slop/unused-css",
 				severity: "warning",
 				message: `CSS class '.${def.name}' is defined but never referenced in the codebase`,
-				help: "Remove the dead CSS rule, or confirm the class is used dynamically (and add an aislop-ignore comment if so)",
+				help: "Remove the dead CSS rule, or confirm the class is used dynamically (and add a raigal-ignore comment if so)",
 				line: def.line,
 				column: 0,
 				category: "AI Slop",
@@ -16452,7 +16790,8 @@ const checkFunctionDiagnostics = (relativePath, fn, limits, ext) => {
 	const results = [];
 	const multiplier = functionLocMultiplier(fn, ext);
 	const fnMax = functionLocBudget(fn, ext, limits.maxFunctionLoc);
-	if (exceedsLimit(fn.lineCount - fn.templateLines, limits.maxFunctionLoc, multiplier)) results.push({
+	const effectiveLineCount = fn.lineCount - fn.templateLines;
+	if (exceedsLimit(effectiveLineCount, limits.maxFunctionLoc, multiplier)) results.push({
 		filePath: relativePath,
 		engine: "code-quality",
 		rule: "complexity/function-too-long",
@@ -16509,10 +16848,10 @@ const checkFileComplexity = (filePath, rootDirectory, limits) => {
 };
 const checkComplexity = async (context) => {
 	const files = getSourceFiles(context);
-	const limits = context.config.quality;
 	const diagnostics = [];
 	for (const filePath of files) {
 		if (isAutoGenerated(filePath)) continue;
+		const { quality: limits } = resolveFilePolicy(context.config, overrideRelativePath(context.rootDirectory, filePath));
 		diagnostics.push(...checkFileComplexity(filePath, context.rootDirectory, limits));
 	}
 	return diagnostics;
@@ -16542,14 +16881,14 @@ const isTrivialLine = (line) => {
 };
 const SVG_MARKUP_RE = /<\/?(?:svg|path|polyline|line|circle|rect|g)\b|(?:xmlns|viewBox|stroke(?:-width|-linecap|-linejoin)?|fill|fill-opacity|d|points|x1|x2|y1|y2)=/;
 const DATA_LITERAL_RE = /^\s*(?:[A-Za-z_$][\w$-]*:\s*(?:["'`[{]|\d|true\b|false\b|null\b)|["'`][^"'`]*["'`],?\s*$|[{}\]],?\s*$|\),?\s*$)/;
-const SUPPRESS_RE = /aislop[- ]ignore(?:-next-block|-file)?\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
-const FILE_SUPPRESS_RE = /aislop[- ]ignore-file\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
+const SUPPRESS_RE = /(?:raigal|aislop)[- ]ignore(?:-next-block|-file)?\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
+const FILE_SUPPRESS_RE = /(?:raigal|aislop)[- ]ignore-file\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
 const fileHasSuppression = (content) => FILE_SUPPRESS_RE.test(content);
 const isLowSignalMarkupWindow = (lines) => {
 	return lines.filter((line) => SVG_MARKUP_RE.test(line)).length >= Math.ceil(WINDOW_SIZE / 2);
 };
 const isLowSignalDataWindow = (lines) => {
-	return lines.filter((line) => DATA_LITERAL_RE.test(line)).length >= WINDOW_SIZE - 1;
+	return lines.filter((line) => DATA_LITERAL_RE.test(line)).length >= 9;
 };
 const findSuppressedLines = (lines) => {
 	const suppressed = /* @__PURE__ */ new Set();
@@ -16581,7 +16920,7 @@ const collectMeaningfulLines = (content) => {
 		if (isLowSignalDataWindow(window)) continue;
 		if (window.every(isTrivialLine)) continue;
 		const normalised = window.map(normaliseLine);
-		if (normalised.filter((n) => n.length > 0 && n !== "}" && n !== "{").length < WINDOW_SIZE - 1) continue;
+		if (normalised.filter((n) => n.length > 0 && n !== "}" && n !== "{").length < 9) continue;
 		if (new Set(normalised).size < MIN_DISTINCT_LINES) continue;
 		hits.push({
 			startLine: i + 1,
@@ -16685,8 +17024,8 @@ const shouldIncludeIssue = (issueType, filePath) => {
 	return !filePath.replace(/\\/g, "/").includes(".github/workflows/");
 };
 const DEPENDENCY_HELP = {
-	dependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `aislop fix`.",
-	devDependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `aislop fix`.",
+	dependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `raigal fix`.",
+	devDependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `raigal fix`.",
 	unlisted: "This package is imported in code but not declared in package.json. Run `npm install` to add it.",
 	unresolved: "This import cannot be resolved. Check for typos or missing packages.",
 	binaries: "This binary is used but its package is not in package.json."
@@ -17404,13 +17743,23 @@ const withReportPath = async (run) => {
 };
 const UNSUPPORTED_GLOB_SYNTAX = /[?[\]{}!|()\\]/;
 const isDotnetFormatPath = (pattern) => !pattern.startsWith("-") && !UNSUPPORTED_GLOB_SYNTAX.test(pattern);
+const expandBraces = (pattern, depth = 0) => {
+	if (depth > 10) return [pattern];
+	const match = /\{([^{}]+)\}/.exec(pattern);
+	if (!match) return [pattern];
+	const [fullMatch, options] = match;
+	const parts = options.split(",");
+	const prefix = pattern.slice(0, match.index);
+	const suffix = pattern.slice(match.index + fullMatch.length);
+	return parts.flatMap((part) => expandBraces(`${prefix}${part}${suffix}`, depth + 1));
+};
 const buildDotnetFormatExcludeScope = (excludePatterns) => {
 	const scope = {
 		excludeArguments: [],
 		unsupportedPatterns: []
 	};
 	for (const pattern of normalizeExcludePatterns(excludePatterns ?? [])) {
-		const expanded = micromatch.braces(pattern, { expand: true });
+		const expanded = expandBraces(pattern);
 		if (expanded.every(isDotnetFormatPath)) scope.excludeArguments.push(...expanded);
 		else scope.unsupportedPatterns.push(pattern);
 	}
@@ -17635,7 +17984,7 @@ const runGofmt = async (context) => {
 			rule: "go-formatting",
 			severity: "warning",
 			message: "Go file is not formatted correctly",
-			help: "Run `aislop fix` to auto-format with gofmt",
+			help: "Run `raigal fix` to auto-format with gofmt",
 			line: 0,
 			column: 0,
 			category: "Format",
@@ -17663,7 +18012,8 @@ const resolvePackageRoot = (startFile) => {
 	while (true) {
 		const packageJsonPath = path.join(current, "package.json");
 		if (fs.existsSync(packageJsonPath)) try {
-			if (JSON.parse(fs.readFileSync(packageJsonPath, "utf-8")).name === "aislop") return current;
+			const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+			if (packageJson.name === "aislop" || packageJson.name === "@methiu/raigal" || packageJson.name === "raigal") return current;
 		} catch {}
 		const parent = path.dirname(current);
 		if (parent === current) break;
@@ -17774,7 +18124,7 @@ const parseRuffFormatOutput = (output, rootDir) => {
 			rule: "python-formatting",
 			severity: "warning",
 			message: "Python file is not formatted correctly",
-			help: "Run `aislop fix` to auto-format with ruff",
+			help: "Run `raigal fix` to auto-format with ruff",
 			line: 0,
 			column: 0,
 			category: "Format",
@@ -17786,7 +18136,8 @@ const parseRuffFormatOutput = (output, rootDir) => {
 const fixRuffFormat = async (context) => {
 	const targets = context.files ? getPythonTargets(context) : [context.rootDirectory];
 	if (context.files && targets.length === 0) return;
-	const result = await runSubprocess(resolveToolBinary("ruff"), ["format", ...targets], {
+	const ruffBinary = resolveToolBinary("ruff");
+	const result = await runSubprocess(ruffBinary, ["format", ...targets], {
 		cwd: context.rootDirectory,
 		timeout: 6e4
 	});
@@ -17856,7 +18207,8 @@ const parseClangTidyOutput = (output, rootDirectory) => {
 const runClangTidy = async (context) => {
 	const compileCommandsDir = findCompileCommandsDir(context);
 	if (!compileCommandsDir) return [];
-	const sources = filterSourcesInDatabase(findCppSources(context).filter((f) => CPP_IMPL_EXTENSIONS.has(path.extname(f).toLowerCase())), readCompileCommandsFiles(compileCommandsDir));
+	const implSources = findCppSources(context).filter((f) => CPP_IMPL_EXTENSIONS.has(path.extname(f).toLowerCase()));
+	const sources = filterSourcesInDatabase(implSources, readCompileCommandsFiles(compileCommandsDir));
 	if (sources.length === 0) return [];
 	const diagnostics = [];
 	for (const chunk of chunkFilePaths(sources, CLANG_TIDY_CHUNK_MAX_FILES)) try {
@@ -18226,7 +18578,7 @@ const runExpoDoctor = async (context) => {
 		rule: "expo-doctor/config-error",
 		severity: "warning",
 		message: configError,
-		help: "Install project dependencies, then re-run `aislop scan`.",
+		help: "Install project dependencies, then re-run `raigal scan`.",
 		line: 0,
 		column: 0,
 		category: "Expo",
@@ -18692,7 +19044,8 @@ const processFile = (filePath, fileTargets, result) => {
 			});
 			continue;
 		}
-		const { edit, skipReason } = computeEdit(sourceFile, classifyIdentifier(best));
+		const shape = classifyIdentifier(best);
+		const { edit, skipReason } = computeEdit(sourceFile, shape);
 		if (!edit) {
 			pendingSkips.push({
 				target,
@@ -19273,7 +19626,7 @@ const normalizeEslintIgnorePatterns = (patterns) => patterns.map((pattern) => pa
 	if (!pattern.includes("*") && !path.extname(pattern)) return [`${pattern}/**`];
 	return [pattern];
 });
-const isEslintIgnored = (relativePath, patterns) => patterns.length > 0 && micromatch.isMatch(relativePath, patterns, { dot: true });
+const isEslintIgnored = (relativePath, patterns) => patterns.length > 0 && picomatch.isMatch(relativePath, patterns, { dot: true });
 const getOxlintTargets = (context) => {
 	const eslintIgnorePatterns = normalizeEslintIgnorePatterns(collectEslintIgnorePatterns(context.rootDirectory));
 	return getSourceFiles(context).filter((filePath) => OXLINT_EXTENSIONS.has(path.extname(filePath).toLowerCase())).filter((filePath) => !isAutoGenerated(filePath)).map((filePath) => path.relative(context.rootDirectory, filePath).split(path.sep).join("/")).filter((filePath) => !isEslintIgnored(filePath, eslintIgnorePatterns));
@@ -19507,7 +19860,8 @@ const ruffLintFixArgs = (context, unsafe) => {
 };
 const fixRuffLint = async (context) => {
 	if (context.files && getPythonTargets(context).length === 0) return;
-	const result = await runSubprocess(resolveToolBinary("ruff"), ruffLintFixArgs(context, false), {
+	const ruffBinary = resolveToolBinary("ruff");
+	const result = await runSubprocess(ruffBinary, ruffLintFixArgs(context, false), {
 		cwd: context.rootDirectory,
 		timeout: 6e4
 	});
@@ -19515,7 +19869,8 @@ const fixRuffLint = async (context) => {
 };
 const fixRuffLintForce = async (context) => {
 	if (context.files && getPythonTargets(context).length === 0) return;
-	const result = await runSubprocess(resolveToolBinary("ruff"), ruffLintFixArgs(context, true), {
+	const ruffBinary = resolveToolBinary("ruff");
+	const result = await runSubprocess(ruffBinary, ruffLintFixArgs(context, true), {
 		cwd: context.rootDirectory,
 		timeout: 6e4
 	});
@@ -19556,7 +19911,8 @@ const resolveTrustedTscPath = () => {
 };
 const isReferenceOnlyConfig = (tsconfigPath) => {
 	try {
-		const parsed = parseJsonc(fs.readFileSync(tsconfigPath, "utf-8"));
+		const raw = fs.readFileSync(tsconfigPath, "utf-8");
+		const parsed = parseJsonc(raw);
 		if (!parsed) return false;
 		return Array.isArray(parsed.references) && !parsed.files && !parsed.include && !parsed.extends;
 	} catch {
@@ -19699,6 +20055,174 @@ const lintEngine = {
 	}
 };
 //#endregion
+//#region src/engines/security/ai-security.ts
+const JS_EXTS = /* @__PURE__ */ new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mjs",
+	".cjs"
+]);
+const PY_EXTS = /* @__PURE__ */ new Set([".py"]);
+const UNICODE_TAG_RE = /[\u{E0000}-\u{E007F}]/gu;
+const hasRuleIgnore = (lines, lineIndex, ruleSuffix) => {
+	const start = Math.max(0, lineIndex - 2);
+	const re = new RegExp(`(?:raigal|aislop)[- ]ignore(?:-file)?\\b.*(?:${ruleSuffix}|security\\/${ruleSuffix})`, "i");
+	return lines.slice(start, lineIndex + 1).some((line) => re.test(line));
+};
+const hasFileIgnore = (lines, ruleSuffix) => {
+	const re = new RegExp(`(?:raigal|aislop)[- ]ignore-file\\b.*(?:${ruleSuffix}|security\\/${ruleSuffix})`, "i");
+	return lines.slice(0, 10).some((line) => re.test(line));
+};
+const makeDiagnostic = (filePath, rule, message, help, line, column) => ({
+	filePath,
+	engine: "security",
+	rule,
+	severity: "error",
+	message,
+	help,
+	line,
+	column,
+	category: "Security",
+	fixable: false
+});
+const P_BYPASS = "bypassPermissions";
+const P_EXEC_TYPE = "executor_type";
+const P_LOCAL = "local";
+const P_USE_DOCKER = "use_docker";
+const P_AUTO_RUN = "auto_run";
+const P_UNSAFE_MODE = "unsafe_mode";
+const P_PYTHON_REPL = "PythonREPLTool";
+const UNSANDBOXED_TOOL_PATTERNS = [
+	{
+		pattern: new RegExp(`\\bpermission_?mode["']?\\s*[:=]\\s*["']${P_BYPASS}["']`, "i"),
+		message: `permission_mode '${P_BYPASS}' bypasses agent sandboxing and human confirmation`,
+		help: `Do not use ${P_BYPASS} mode in production; use standard interactive approval`
+	},
+	{
+		pattern: new RegExp(`\\b${P_EXEC_TYPE}["']?\\s*[:=]\\s*["']${P_LOCAL}["']`, "i"),
+		message: `${P_EXEC_TYPE}='${P_LOCAL}' executes LLM-generated code directly on host machine without container isolation`,
+		help: "Configure agent to use DockerCommandLineCodeExecutor or a containerized sandbox environment"
+	},
+	{
+		pattern: new RegExp(`\\b(?:LocalCommandLineCodeExecutor|LocalCodeExecutor)\\s*\\(`),
+		message: "Local code executor executes LLM-generated code on host machine without container isolation",
+		help: "Use DockerCommandLineCodeExecutor or an isolated execution sandbox"
+	},
+	{
+		pattern: new RegExp(`\\b${P_USE_DOCKER}\\s*[:=]\\s*(?:False|false)\\b|["']${P_USE_DOCKER}["']\\s*:\\s*(?:False|false)\\b`),
+		message: `${P_USE_DOCKER}=False disables container sandboxing for agent code execution`,
+		help: `Set ${P_USE_DOCKER}=True to isolate agent execution inside Docker containers`
+	},
+	{
+		pattern: new RegExp(`\\b(?:interpreter\\.)?${P_AUTO_RUN}\\s*[:=]\\s*(?:True|true)\\b`),
+		message: `${P_AUTO_RUN}=True allows autonomous shell execution without human confirmation`,
+		help: `Keep ${P_AUTO_RUN}=False so dangerous commands require explicit human review`
+	},
+	{
+		pattern: new RegExp(`\\bCodeInterpreterTool\\s*\\([^)]*${P_UNSAFE_MODE}\\s*=\\s*(?:True|true)\\b|\\b${P_UNSAFE_MODE}\\s*[:=]\\s*(?:True|true)\\b`),
+		message: `${P_UNSAFE_MODE}=True allows code interpreter tool to execute without Docker isolation`,
+		help: `Disable ${P_UNSAFE_MODE} and isolate code execution in containerized environments`
+	},
+	{
+		pattern: new RegExp(`\\b(?:${P_PYTHON_REPL}|PythonAstREPLTool)\\s*\\(`),
+		message: `${P_PYTHON_REPL} executes arbitrary Python code in host process without container isolation`,
+		help: `Use containerized sandbox execution rather than unconfined ${P_PYTHON_REPL} in production`
+	}
+];
+const P_SYS = "system";
+const P_DEV = "developer";
+const P_SM = "SystemMessage";
+const PROMPT_INJECTION_JS_PATTERNS = [
+	new RegExp(`(?:role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?content\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`)`, "g"),
+	new RegExp(`(?:content\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`[^}{;]{0,120}?role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`(?:role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?content\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["']))`, "g"),
+	new RegExp(`(?:content\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["'])[^}{;]{0,120}?role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`\\b(?:${P_SYS}|systemPrompt|system_prompt|system_instruction)\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\``, "g"),
+	new RegExp(`\\b(?:${P_SYS}|systemPrompt|system_prompt|system_instruction)\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["'])`, "g"),
+	new RegExp(`\\b(?:new\\s+)?${P_SM}\\s*\\(\\s*(?:\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`|["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["']|\\{\\s*content\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`)`, "g"),
+	new RegExp(`\\[\\s*["']${P_SYS}["']\\s*,\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`\\s*\\]`, "g")
+];
+const PROMPT_INJECTION_PY_PATTERNS = [
+	new RegExp(`(?:["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?["']content["']\\s*:\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["']))`, "g"),
+	new RegExp(`(?:["']content["']\\s*:\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])[^}{;]{0,120}?["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`(?:["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?["']content["']\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\())`, "g"),
+	new RegExp(`(?:["']content["']\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\()[^}{;]{0,120}?["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`\\b(?:${P_SYS}|system_prompt|system_message|system_instruction)\\s*=\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])`, "g"),
+	new RegExp(`\\b(?:${P_SYS}|system_prompt|system_message|system_instruction)\\s*=\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\()`, "g"),
+	new RegExp(`\\b${P_SM}\\s*\\(\\s*(?:content\\s*=\\s*)?f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])`, "g"),
+	new RegExp(`\\b${P_SM}\\s*\\(\\s*(?:content\\s*=\\s*)?(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\()`, "g"),
+	new RegExp(`\\(\\s*["']${P_SYS}["']\\s*,\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])\\s*\\)`, "g")
+];
+const checkInvisibleUnicode = (relPath, content, lines) => {
+	if (hasFileIgnore(lines, "invisible-unicode-tags")) return [];
+	const results = [];
+	const tagRegex = new RegExp(UNICODE_TAG_RE.source, UNICODE_TAG_RE.flags);
+	for (const match of content.matchAll(tagRegex)) {
+		const matchIndex = match.index ?? 0;
+		const line = content.slice(0, matchIndex).split("\n").length;
+		const col = matchIndex - content.lastIndexOf("\n", matchIndex - 1);
+		if (hasRuleIgnore(lines, line - 1, "invisible-unicode-tags")) continue;
+		results.push(makeDiagnostic(relPath, "security/invisible-unicode-tags", "Invisible Unicode Tag character (U+E0000-U+E007F) detected: potential stealth prompt injection or ASCII smuggling", "Remove invisible Unicode tag characters. Unicode Tag block (U+E0000-U+E007F) has no legitimate printable presentation in source code", line, col));
+	}
+	return results;
+};
+const checkUnsandboxedTools = (relPath, content, lines) => {
+	if (hasFileIgnore(lines, "unsandboxed-agent-tool")) return [];
+	const results = [];
+	for (const { pattern, message, help } of UNSANDBOXED_TOOL_PATTERNS) {
+		const regex = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`);
+		for (const match of content.matchAll(regex)) {
+			const matchIndex = match.index ?? 0;
+			const line = content.slice(0, matchIndex).split("\n").length;
+			const col = matchIndex - content.lastIndexOf("\n", matchIndex - 1);
+			if (hasRuleIgnore(lines, line - 1, "unsandboxed-agent-tool")) continue;
+			results.push(makeDiagnostic(relPath, "security/unsandboxed-agent-tool", message, help, line, col));
+		}
+	}
+	return results;
+};
+const checkPromptInjection = (relPath, content, lines, isJs) => {
+	if (hasFileIgnore(lines, "prompt-injection")) return [];
+	const results = [];
+	const patterns = isJs ? PROMPT_INJECTION_JS_PATTERNS : PROMPT_INJECTION_PY_PATTERNS;
+	for (const pattern of patterns) {
+		const regex = new RegExp(pattern.source, pattern.flags);
+		for (const match of content.matchAll(regex)) {
+			const matchIndex = match.index ?? 0;
+			const line = content.slice(0, matchIndex).split("\n").length;
+			const col = matchIndex - content.lastIndexOf("\n", matchIndex - 1);
+			if (hasRuleIgnore(lines, line - 1, "prompt-injection")) continue;
+			results.push(makeDiagnostic(relPath, "security/prompt-injection", "Untrusted variable interpolation into system prompt creates prompt injection vulnerability", "Keep system prompts static. Pass dynamic user inputs via user messages or input parameters with strict delimiters", line, col));
+		}
+	}
+	return results;
+};
+const scanAiSecurity = async (context) => {
+	const files = getSourceFiles(context);
+	const diagnostics = [];
+	for (const filePath of files) {
+		const ext = path.extname(filePath);
+		let content;
+		try {
+			content = fs.readFileSync(filePath, "utf-8");
+		} catch {
+			continue;
+		}
+		const relativePath = relativePosix(context.rootDirectory, filePath);
+		const lines = content.split("\n");
+		diagnostics.push(...checkInvisibleUnicode(relativePath, content, lines));
+		const isJs = JS_EXTS.has(ext);
+		const isPy = PY_EXTS.has(ext);
+		if (isJs || isPy) {
+			diagnostics.push(...checkUnsandboxedTools(relativePath, content, lines));
+			diagnostics.push(...checkPromptInjection(relativePath, content, lines, isJs));
+		}
+	}
+	return diagnostics;
+};
+//#endregion
 //#region src/ui/invocation.ts
 const detectInvocation = () => "raigal";
 //#endregion
@@ -20081,7 +20605,7 @@ const parseJsAudit = (output, source, manifest) => {
 			rule: "security/dependency-audit-skipped",
 			severity: "info",
 			message: `Dependency audit skipped (${source}): lockfile is missing`,
-			help: errorDetail ?? "Generate a lockfile, then re-run `aislop scan` for dependency vulnerability checks.",
+			help: errorDetail ?? "Generate a lockfile, then re-run `raigal scan` for dependency vulnerability checks.",
 			line: 0,
 			column: 0,
 			category: "Security",
@@ -20192,7 +20716,8 @@ const readRuntimeDependencies = (rootDir) => {
 	collectRuntimeNames(rootManifest, names);
 	const globs = [...npmWorkspaceGlobs(rootManifest), ...pnpmWorkspaceGlobs(rootDir)];
 	if (globs.length === 0) return { runtimeDependencies: names };
-	for (const relativeDir of micromatch(listPackageDirectories(rootDir), globs)) {
+	const isMatch = picomatch(globs, { dot: true });
+	for (const relativeDir of listPackageDirectories(rootDir).filter((dir) => isMatch(dir))) {
 		const memberManifest = readJsonFile(path.join(rootDir, relativeDir, "package.json"));
 		if (memberManifest) collectRuntimeNames(memberManifest, names);
 	}
@@ -20254,10 +20779,11 @@ const auditSkippedDiagnostic = (source, help) => ({
 });
 const runNpmAudit = async (rootDir, timeout) => {
 	try {
-		return parseJsAudit((await runSubprocess("npm", ["audit", "--json"], {
+		const result = await runSubprocess("npm", ["audit", "--json"], {
 			cwd: rootDir,
 			timeout
-		})).stdout, "npm audit", readRuntimeDependencies(rootDir));
+		});
+		return parseJsAudit(result.stdout, "npm audit", readRuntimeDependencies(rootDir));
 	} catch (error) {
 		return [auditSkippedDiagnostic("npm audit", `Failed to run npm audit: ${errorMessageOf(error)}`)];
 	}
@@ -20278,10 +20804,11 @@ const runBunAudit = async (rootDir, timeout) => {
 const runPnpmAuditWithFallback = async (rootDir, timeout) => {
 	const canFallbackToNpm = fs.existsSync(path.join(rootDir, "package-lock.json"));
 	try {
-		const diagnostics = parseJsAudit((await runSubprocess("pnpm", ["audit", "--json"], {
+		const result = await runSubprocess("pnpm", ["audit", "--json"], {
 			cwd: rootDir,
 			timeout
-		})).stdout, "pnpm audit", readRuntimeDependencies(rootDir));
+		});
+		const diagnostics = parseJsAudit(result.stdout, "pnpm audit", readRuntimeDependencies(rootDir));
 		if (diagnostics.some((d) => d.rule === "security/dependency-audit-skipped")) {
 			if (canFallbackToNpm) return runNpmAudit(rootDir, timeout);
 			return diagnostics;
@@ -20638,7 +21165,7 @@ const RISKY_PATTERNS = [
 //#region src/engines/security/risky.ts
 const hasDangerouslySetInnerHtmlIgnore = (lines, lineIndex) => {
 	const start = Math.max(0, lineIndex - 2);
-	return lines.slice(start, lineIndex + 1).some((line) => /(?:biome-ignore|eslint-disable|aislop-ignore).*(?:noDangerouslySetInnerHtml|dangerouslySetInnerHTML|dangerously-set-innerhtml)/i.test(line));
+	return lines.slice(start, lineIndex + 1).some((line) => /(?:biome-ignore|eslint-disable|raigal-ignore|aislop-ignore).*(?:noDangerouslySetInnerHtml|dangerouslySetInnerHTML|dangerously-set-innerhtml)/i.test(line));
 };
 const isStructuredDataScript = (content, matchIndex) => {
 	const before = content.slice(Math.max(0, matchIndex - 300), matchIndex);
@@ -20966,7 +21493,11 @@ const ALL_ENGINES = [
 		name: "security",
 		async run(context) {
 			const diagnostics = [];
-			const promises = [scanSecrets(context), detectRiskyConstructs(context)];
+			const promises = [
+				scanSecrets(context),
+				detectRiskyConstructs(context),
+				scanAiSecurity(context)
+			];
 			if (context.config.security.audit) promises.push(runDependencyAudit(context));
 			const results = await Promise.allSettled(promises);
 			for (const result of results) if (result.status === "fulfilled") diagnostics.push(...result.value);
@@ -20988,6 +21519,7 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 			const result = await engine.run(context);
 			result.diagnostics = filterExcludedDiagnostics(result.diagnostics, context.rootDirectory, context.excludePatterns);
 			result.elapsed = performance.now() - start;
+			result.diagnostics = applyFileOverrides(result.diagnostics, context);
 			onComplete?.(result);
 			return result;
 		} catch (error) {
@@ -20996,6 +21528,7 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 				diagnostics: [],
 				elapsed: performance.now() - start,
 				skipped: true,
+				failed: true,
 				skipReason: error instanceof Error ? error.message : String(error)
 			};
 			onComplete?.(result);
@@ -21006,9 +21539,13 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 		diagnostics: [],
 		elapsed: 0,
 		skipped: true,
+		failed: true,
 		skipReason: r.reason instanceof Error ? r.reason.message : String(r.reason)
 	});
-	return dedupeEquivalenceDiagnostics(dedupeOverlappingComments(dedupeCSharpAsync(stripSecretDiagnostics(finalResults))));
+	const stripped = stripSecretDiagnostics(finalResults);
+	const csharp = dedupeCSharpAsync(stripped);
+	const comments = dedupeOverlappingComments(csharp);
+	return dedupeEquivalenceDiagnostics(comments);
 };
 const stripSecretDiagnostics = (results) => {
 	for (const result of results) for (const d of result.diagnostics) if (d.redactSource || isSecretClassRule(d.rule)) {
@@ -21154,6 +21691,9 @@ const RULE_SCORE_IMPACTS = {
 	"security/shell-injection": strict("Interpolated shell commands can become command execution."),
 	"security/unsafe-deserialization": strict("Deserializing untrusted data with a legacy .NET formatter can become remote code execution."),
 	"security/unsafe-c-call": strict("Unbounded C string and process calls can become buffer overflows or command execution."),
+	"security/prompt-injection": strict("Dynamic user interpolation in system/developer prompts enables prompt injection attacks."),
+	"security/unsandboxed-agent-tool": strict("Unsandboxed agent code execution or tool permission bypass allows arbitrary host commands."),
+	"security/invisible-unicode-tags": strict("Invisible Unicode Tag characters (U+E0000-U+E007F) hide stealth prompt injection payloads."),
 	"security/dependency-audit-skipped": advisory("An unavailable audit is visibility loss, not evidence of a vulnerability."),
 	"dotnet/projects-skipped": advisory("Skipping unrestored C# projects is visibility loss, not evidence of a defect."),
 	"cppcheck/chunks-skipped": advisory("A skipped cppcheck chunk is visibility loss, not evidence that the skipped files have a defect."),
@@ -21230,7 +21770,8 @@ const calculateScore = (diagnostics, weights, thresholds, sourceFileCount, smoot
 	const capScale = Math.max(1, fileCount.effectiveSourceFileCount / CAP_REFERENCE_FILES);
 	const defaultRuleCap = typeof maxPerRule === "number" && maxPerRule > 0 ? maxPerRule : null;
 	const capForRule = (key) => {
-		const ruleCap = scoreImpactForRule(key.slice(key.indexOf(":") + 1)).cap;
+		const rule = key.slice(key.indexOf(":") + 1);
+		const ruleCap = scoreImpactForRule(rule).cap;
 		if (typeof ruleCap === "number") return defaultRuleCap ? Math.min(defaultRuleCap, ruleCap) : ruleCap;
 		return defaultRuleCap;
 	};
@@ -21246,29 +21787,6 @@ const calculateScore = (diagnostics, weights, thresholds, sourceFileCount, smoot
 	};
 };
 //#endregion
-//#region src/scoring/rule-severity.ts
-/**
-* Apply per-rule severity overrides from config: "off" drops the diagnostic,
-* "error"/"warning" rewrite its severity before scoring and rendering.
-*/
-const applyRuleSeverities = (diagnostics, overrides) => {
-	if (Object.keys(overrides).length === 0) return diagnostics;
-	const result = [];
-	for (const diagnostic of diagnostics) {
-		const override = overrides[diagnostic.rule];
-		if (!override) {
-			result.push(diagnostic);
-			continue;
-		}
-		if (override === "off") continue;
-		result.push(override === diagnostic.severity ? diagnostic : {
-			...diagnostic,
-			severity: override
-		});
-	}
-	return result;
-};
-//#endregion
 //#region src/utils/discovery-classifiers.ts
 const LANGUAGE_SIGNALS = {
 	"tsconfig.json": "typescript",
@@ -21366,8 +21884,10 @@ const detectSourceLanguages = (sourceFiles) => {
 const detectLanguages = (directory, sourceFiles) => {
 	const languages = new Set(detectSourceLanguages(sourceFiles));
 	for (const [file, lang] of Object.entries(LANGUAGE_SIGNALS)) if (fs.existsSync(path.join(directory, file))) languages.add(lang);
-	if (readPackageJson(path.join(directory, "package.json"))) if (fs.existsSync(path.join(directory, "tsconfig.json"))) languages.add("typescript");
-	else languages.add("javascript");
+	if (readPackageJson(path.join(directory, "package.json"))) {
+		if (fs.existsSync(path.join(directory, "tsconfig.json"))) languages.add("typescript");
+		else languages.add("javascript");
+	}
 	for (const signal of PYTHON_SIGNALS) if (fs.existsSync(path.join(directory, signal))) {
 		languages.add("python");
 		break;
@@ -21594,7 +22114,7 @@ const runScopedScan = async (cwd, filePaths) => {
 	const rulesPath = configDir ? path.join(configDir, RULES_FILE) : void 0;
 	const enumeratedPaths = new Set(projectCandidates.map((filePath) => path.resolve(rootDirectory, filePath)));
 	const scopedCandidates = filePaths.filter((filePath) => enumeratedPaths.has(path.resolve(rootDirectory, filePath)));
-	const diagnostics = applyRuleSeverities((await runEngines({
+	const context = {
 		rootDirectory: project.rootDirectory,
 		languages: project.languages,
 		frameworks: project.frameworks,
@@ -21603,6 +22123,8 @@ const runScopedScan = async (cwd, filePaths) => {
 		projectFiles: [.../* @__PURE__ */ new Set([...projectSourceFiles, ...filterProjectDeclarationFiles(project.rootDirectory, projectCandidates, excludePatterns, config.include)])],
 		installedTools: project.installedTools,
 		config: {
+			overrides: config.overrides,
+			rules: config.rules,
 			quality: config.quality,
 			security: {
 				audit: false,
@@ -21615,14 +22137,17 @@ const runScopedScan = async (cwd, filePaths) => {
 			allowProjectLocalTools: false,
 			architectureRulesPath: config.engines.architecture ? rulesPath : void 0
 		}
-	}, {
+	};
+	const enabled = {
 		format: false,
 		lint: false,
 		"code-quality": config.engines["code-quality"],
 		"ai-slop": config.engines["ai-slop"],
 		architecture: config.engines.architecture,
 		security: false
-	})).flatMap((result) => result.diagnostics), config.rules);
+	};
+	const results = await runEngines(context, enabled);
+	const diagnostics = applyRuleSeverities(results.flatMap((result) => result.diagnostics), config.overrides.length ? {} : config.rules);
 	const { score } = calculateScore(diagnostics, config.scoring.weights, config.scoring.thresholds, projectSourceFiles.length + projectTestFiles.length, config.scoring.smoothing, config.scoring.maxPerRule);
 	return {
 		diagnostics,
@@ -21680,14 +22205,26 @@ const hasExistingLiteralBackslashPath = (cwd, fingerprint) => {
 	}
 };
 const migrateMarkerlessFingerprint = (cwd, fingerprint) => hasExistingLiteralBackslashPath(cwd, fingerprint) ? fingerprint : normalizeLegacyFingerprint(fingerprint);
-const BASELINE_REL = path.join(".aislop", "baseline.json");
-const baselinePath = (cwd) => path.join(cwd, BASELINE_REL);
+const baselinePath = (cwd) => {
+	const raigalCandidate = path.join(cwd, ".raigal", "baseline.json");
+	if (fs.existsSync(raigalCandidate)) return raigalCandidate;
+	const raigalDir = path.join(cwd, ".raigal");
+	if (fs.existsSync(raigalDir)) return raigalCandidate;
+	return path.join(cwd, ".aislop", "baseline.json");
+};
+const sessionPath = (cwd) => {
+	const raigalCandidate = path.join(cwd, ".raigal", "session.jsonl");
+	if (fs.existsSync(raigalCandidate)) return raigalCandidate;
+	const raigalDir = path.join(cwd, ".raigal");
+	if (fs.existsSync(raigalDir)) return raigalCandidate;
+	return path.join(cwd, ".aislop", "session.jsonl");
+};
 const readBaseline = (cwd) => {
 	const raw = readIfExists(baselinePath(cwd));
 	if (!raw) return null;
 	try {
 		const parsed = JSON.parse(raw);
-		if (parsed.schema !== "aislop.baseline.v2" && parsed.schema !== "aislop.baseline.v1") return null;
+		if (parsed.schema !== "aislop.baseline.v2" && parsed.schema !== "aislop.baseline.v1" && parsed.schema !== "raigal.baseline.v2" && parsed.schema !== "raigal.baseline.v1") return null;
 		const findingFingerprints = parsed.findingFingerprints ?? [];
 		const needsWindowsMigration = parsed.pathFormat !== "posix";
 		return {
@@ -21719,13 +22256,14 @@ const captureBaseline = async (cwd) => {
 	});
 	const project = await discoverProject(cwd);
 	const config = loadConfig(cwd);
-	const results = await runEngines({
+	const context = {
 		rootDirectory: project.rootDirectory,
 		languages: project.languages,
 		frameworks: project.frameworks,
-		files: [],
 		installedTools: project.installedTools,
 		config: {
+			overrides: config.overrides,
+			rules: config.rules,
 			quality: config.quality,
 			security: {
 				audit: false,
@@ -21737,19 +22275,22 @@ const captureBaseline = async (cwd) => {
 			},
 			allowProjectLocalTools: false
 		}
-	}, {
+	};
+	const enabled = {
 		format: false,
 		lint: false,
 		"code-quality": config.engines["code-quality"],
 		"ai-slop": config.engines["ai-slop"],
 		architecture: config.engines.architecture,
 		security: false
-	});
-	const diagnostics = results.flatMap((r) => r.diagnostics);
+	};
+	const results = await runEngines(context, enabled);
+	const diagnostics = applyRuleSeverities(results.flatMap((r) => r.diagnostics), config.overrides.length ? {} : config.rules);
 	const { score } = calculateScore(diagnostics, config.scoring.weights, config.scoring.thresholds, project.sourceFileCount, config.scoring.smoothing, config.scoring.maxPerRule);
 	const byEngine = {};
 	for (const r of results) {
-		const { score: engineScore } = calculateScore(diagnostics.filter((d) => r.diagnostics.includes(d)), config.scoring.weights, config.scoring.thresholds, project.sourceFileCount, config.scoring.smoothing, config.scoring.maxPerRule);
+		const engineDiags = diagnostics.filter((d) => d.engine === r.engine);
+		const { score: engineScore } = calculateScore(engineDiags, config.scoring.weights, config.scoring.thresholds, project.sourceFileCount, config.scoring.smoothing, config.scoring.maxPerRule);
 		byEngine[r.engine] = engineScore;
 	}
 	const findingFingerprints = diagnostics.filter((d) => d.severity === "error" || d.severity === "warning").map((d) => fingerprintDiagnostic(d, project.rootDirectory));
@@ -21771,7 +22312,7 @@ const captureBaseline = async (cwd) => {
 };
 const appendSessionFiles = (cwd, files) => {
 	if (files.length === 0) return;
-	const target = path.join(cwd, ".aislop", "session.jsonl");
+	const target = sessionPath(cwd);
 	try {
 		fs.mkdirSync(path.dirname(target), { recursive: true });
 		const line = `${JSON.stringify({
@@ -21782,7 +22323,8 @@ const appendSessionFiles = (cwd, files) => {
 	} catch {}
 };
 const readSessionFiles = (cwd) => {
-	const raw = readIfExists(path.join(cwd, ".aislop", "session.jsonl"));
+	const target = sessionPath(cwd);
+	const raw = readIfExists(target);
 	if (!raw) return [];
 	const files = /* @__PURE__ */ new Set();
 	for (const line of raw.split("\n")) {
@@ -21795,7 +22337,7 @@ const readSessionFiles = (cwd) => {
 	return Array.from(files);
 };
 const clearSessionFiles = (cwd) => {
-	const target = path.join(cwd, ".aislop", "session.jsonl");
+	const target = sessionPath(cwd);
 	try {
 		fs.unlinkSync(target);
 	} catch {}
@@ -21899,7 +22441,7 @@ const runClaudeFileChangedHook = async (deps = {}) => {
 			schema: "aislop.hook.v2",
 			event: "file_changed",
 			file: changed,
-			message: `Watched file changed (${changed}). aislop refreshed the baseline — score: ${result.score}.`,
+			message: `Watched file changed (${changed}). raigal refreshed the baseline - score: ${result.score}.`,
 			baseline: {
 				score: result.score,
 				fileCount: result.fileCount
@@ -22255,7 +22797,9 @@ const applyRemoval = (result, opts, target, nextContent) => {
 //#region src/hooks/install/rules-only.ts
 const installRulesOnly = (opts, paths, summary) => {
 	const result = emptyResult();
-	const next = upsertMarkdownFence(readIfExists(paths.rules), AISLOP_MD_BODY, sentinelHash(AISLOP_MD_BODY)).nextContent;
+	const existing = readIfExists(paths.rules);
+	const hash = sentinelHash(AISLOP_MD_BODY);
+	const next = upsertMarkdownFence(existing, AISLOP_MD_BODY, hash).nextContent;
 	applyContent(result, opts, paths.rules, next, summary);
 	if (paths.host && paths.marker) {
 		const host = readIfExists(paths.host) ?? "";
@@ -22307,7 +22851,7 @@ const uninstallAntigravity = (opts) => {
 //#endregion
 //#region src/hooks/io/json-patch.ts
 const AISLOP_SENTINEL_KEY = "__aislop";
-const isAislopManaged = (x) => typeof x === "object" && x !== null && "__aislop" in x && x["__aislop"] != null;
+const isAislopManaged = (x) => typeof x === "object" && x !== null && ("__aislop" in x && x["__aislop"] != null || "__raigal" in x && x["__raigal"] != null);
 const groupIsAislop = (group) => {
 	if (typeof group !== "object" || group === null) return false;
 	const hooks = group.hooks;
@@ -22362,14 +22906,14 @@ const resolveClaudePaths = (opts) => {
 };
 const buildHookGroup$1 = () => {
 	const hashBody = JSON.stringify({
-		command: "aislop hook claude",
+		command: "raigal hook claude",
 		matcher: "Edit|Write|MultiEdit"
 	});
 	return {
 		matcher: "Edit|Write|MultiEdit",
 		hooks: [{
 			type: "command",
-			command: "aislop hook claude",
+			command: "raigal hook claude",
 			[AISLOP_SENTINEL_KEY]: {
 				v: 1,
 				managed: true,
@@ -22379,12 +22923,12 @@ const buildHookGroup$1 = () => {
 	};
 };
 const buildStopHookGroup = () => {
-	const hashBody = JSON.stringify({ command: "aislop hook claude --stop" });
+	const hashBody = JSON.stringify({ command: "raigal hook claude --stop" });
 	return {
 		matcher: "",
 		hooks: [{
 			type: "command",
-			command: "aislop hook claude --stop",
+			command: "raigal hook claude --stop",
 			[AISLOP_SENTINEL_KEY]: {
 				v: 1,
 				managed: true,
@@ -22396,14 +22940,14 @@ const buildStopHookGroup = () => {
 const FILE_CHANGED_MATCHER = ".raigal/config.yml|.raigal/rules.yml|.aislop/config.yml|.aislop/rules.yml|package.json";
 const buildFileChangedHookGroup = () => {
 	const hashBody = JSON.stringify({
-		command: "aislop hook claude --on-file-changed",
+		command: "raigal hook claude --on-file-changed",
 		matcher: FILE_CHANGED_MATCHER
 	});
 	return {
 		matcher: FILE_CHANGED_MATCHER,
 		hooks: [{
 			type: "command",
-			command: "aislop hook claude --on-file-changed",
+			command: "raigal hook claude --on-file-changed",
 			[AISLOP_SENTINEL_KEY]: {
 				v: 1,
 				managed: true,
@@ -22431,7 +22975,8 @@ const installClaude = (opts) => {
 	const nextSettings = renderSettings$1(readIfExists(paths.settings), Boolean(opts.qualityGate));
 	applyContent(result, opts, paths.settings, nextSettings, "register PostToolUse + FileChanged hooks");
 	const mdHash = sentinelHash(AISLOP_MD_BODY);
-	const fenced = upsertMarkdownFence(readIfExists(paths.aislopMd), AISLOP_MD_BODY, mdHash);
+	const existingMd = readIfExists(paths.aislopMd);
+	const fenced = upsertMarkdownFence(existingMd, AISLOP_MD_BODY, mdHash);
 	applyContent(result, opts, paths.aislopMd, fenced.nextContent, "write AISLOP.md rules");
 	const existingClaudeMd = readIfExists(paths.claudeMd) ?? "";
 	const marker = "@AISLOP.md";
@@ -22546,11 +23091,11 @@ const resolveCursorPaths = (opts) => {
 };
 const buildHookEntry = () => {
 	const hashBody = JSON.stringify({
-		command: "aislop hook cursor",
+		command: "raigal hook cursor",
 		timeout: 5e3
 	});
 	return {
-		command: "aislop hook cursor",
+		command: "raigal hook cursor",
 		type: "command",
 		timeout: 5e3,
 		[AISLOP_SENTINEL_KEY]: {
@@ -22577,7 +23122,9 @@ const installCursor = (opts) => {
 	const nextHooks = renderHooksJson(readIfExists(paths.hooks));
 	applyContent(result, opts, paths.hooks, nextHooks, "register afterFileEdit hook");
 	if (opts.scope === "project") {
-		const rules = upsertMarkdownFence(readIfExists(paths.rules), AISLOP_MD_BODY, sentinelHash(AISLOP_MD_BODY)).nextContent;
+		const existingRules = readIfExists(paths.rules);
+		const hash = sentinelHash(AISLOP_MD_BODY);
+		const rules = upsertMarkdownFence(existingRules, AISLOP_MD_BODY, hash).nextContent;
 		applyContent(result, opts, paths.rules, rules, "write .cursor/rules/aislop.mdc");
 	}
 	return result;
@@ -22617,15 +23164,15 @@ const resolveGeminiPaths = (opts) => {
 };
 const buildHookGroup = () => {
 	const hashBody = JSON.stringify({
-		command: "aislop hook gemini",
+		command: "raigal hook gemini",
 		matcher: "write_file|replace"
 	});
 	return {
 		matcher: "write_file|replace",
 		hooks: [{
-			name: "aislop",
+			name: "raigal",
 			type: "command",
-			command: "aislop hook gemini",
+			command: "raigal hook gemini",
 			timeout: 5e3,
 			[AISLOP_SENTINEL_KEY]: {
 				v: 1,
@@ -22650,7 +23197,9 @@ const installGemini = (opts) => {
 	const result = emptyResult();
 	const next = renderSettings(readIfExists(paths.settings));
 	applyContent(result, opts, paths.settings, next, "register AfterTool hook");
-	const fenced = upsertMarkdownFence(readIfExists(paths.aislopMd), AISLOP_MD_BODY, sentinelHash(AISLOP_MD_BODY)).nextContent;
+	const existingMd = readIfExists(paths.aislopMd);
+	const hash = sentinelHash(AISLOP_MD_BODY);
+	const fenced = upsertMarkdownFence(existingMd, AISLOP_MD_BODY, hash).nextContent;
 	applyContent(result, opts, paths.aislopMd, fenced, "write AISLOP.md rules");
 	const existingGeminiMd = readIfExists(paths.geminiMd) ?? "";
 	const marker = "@AISLOP.md";
@@ -22716,8 +23265,8 @@ const uninstallKilocode = (opts) => {
 const resolvePiPaths = (opts) => {
 	return { extension: opts.scope === "project" ? path.join(opts.cwd, ".pi", "extensions", "aislop.js") : path.join(opts.home, ".pi", "agent", "extensions", "aislop.js") };
 };
-const PI_EXTENSION_SOURCE = `// aislop — auto-generated pi extension. Do not edit by hand.
-// Reinstall with: aislop hook install --pi
+const PI_EXTENSION_SOURCE = `// raigal — auto-generated pi extension. Do not edit by hand.
+// Reinstall with: raigal hook install --pi
 import { spawn } from "node:child_process";
 
 // Runs the CLI async so a slow scan never blocks pi's event loop, and forwards
@@ -22762,7 +23311,7 @@ export default function (pi) {
 		const filePath = event.input && event.input.path;
 		if (typeof filePath !== "string" || filePath.length === 0) return;
 
-		const bin = process.env.AISLOP_BIN || "aislop";
+		const bin = process.env.RAIGAL_BIN || process.env.AISLOP_BIN || "raigal";
 		const payload = JSON.stringify({
 			cwd: ctx.cwd,
 			file_path: filePath,
@@ -22789,7 +23338,7 @@ export default function (pi) {
 const installPi = (opts) => {
 	const paths = resolvePiPaths(opts);
 	const result = emptyResult();
-	applyContent(result, opts, paths.extension, PI_EXTENSION_SOURCE, "write pi aislop extension");
+	applyContent(result, opts, paths.extension, PI_EXTENSION_SOURCE, "write pi raigal extension");
 	return result;
 };
 const uninstallPi = (opts) => {
@@ -22945,6 +23494,31 @@ const detectInstalledAgents = (opts) => {
 	}
 	return hits;
 };
+const HOOK_MARKERS = [
+	"__raigal",
+	"raigal:begin",
+	"@RAIGAL.md",
+	"__aislop",
+	"aislop:begin",
+	"@AISLOP.md"
+];
+const hasHook = (target) => {
+	try {
+		if (!fs.statSync(target).isFile()) return false;
+		const base = path.basename(target).toLowerCase();
+		if (base.startsWith("raigal") || base.startsWith("aislop")) return true;
+		const content = fs.readFileSync(target, "utf8");
+		return HOOK_MARKERS.some((marker) => content.includes(marker));
+	} catch {
+		return false;
+	}
+};
+const detectionScopes = (agent) => AGENTS_SUPPORTING_BOTH_SCOPES.includes(agent) ? ["global", "project"] : [defaultScopeFor(agent)];
+const detectRaigalHooks = (opts) => ALL_AGENTS.filter((agent) => detectionScopes(agent).some((scope) => REGISTRY[agent].paths({
+	home: opts.home,
+	cwd: opts.cwd,
+	scope
+}).some(hasHook)));
 //#endregion
 //#region src/ui/search-select.ts
 const silentOutput = new Writable({ write(_chunk, _encoding, callback) {
@@ -23123,8 +23697,10 @@ const runSearchPrompt = async (options) => {
 			}
 			if (key.name === "space" && options.mode === "multi") {
 				const item = filtered[cursor];
-				if (item) if (selected.has(item.value)) selected.delete(item.value);
-				else selected.add(item.value);
+				if (item) {
+					if (selected.has(item.value)) selected.delete(item.value);
+					else selected.add(item.value);
+				}
 				render();
 				return;
 			}
@@ -23388,10 +23964,11 @@ const hookRun = async (agent, flags) => {
 		process.exit(0);
 	}
 	let exitCode = 0;
-	if (agent === "claude") if (flags?.onFileChanged) exitCode = await runClaudeFileChangedHook();
-	else if (flags?.stop) exitCode = await runClaudeStopHook();
-	else exitCode = await runClaudeHook();
-	else if (agent === "cursor") exitCode = await runCursorHook();
+	if (agent === "claude") {
+		if (flags?.onFileChanged) exitCode = await runClaudeFileChangedHook();
+		else if (flags?.stop) exitCode = await runClaudeStopHook();
+		else exitCode = await runClaudeHook();
+	} else if (agent === "cursor") exitCode = await runCursorHook();
 	else if (agent === "gemini") exitCode = await runGeminiHook();
 	else if (agent === "pi") exitCode = await runPiHook();
 	else {
@@ -23402,7 +23979,8 @@ const hookRun = async (agent, flags) => {
 	process.exit(exitCode);
 };
 const hookBaseline = async () => {
-	const result = await captureBaseline(process.cwd());
+	const cwd = process.cwd();
+	const result = await captureBaseline(cwd);
 	process.stdout.write(renderHookBaseline({
 		score: result.score,
 		fileCount: result.fileCount,
@@ -23632,8 +24210,38 @@ const registerHookAliases = (program) => {
 	});
 };
 //#endregion
+//#region src/utils/github-slug.ts
+const GITHUB_REMOTE_RE = /^(?:(?:git@|ssh:\/\/(?:git@)?)github\.com(?::(?:\d+\/)?|[:/])|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/\s]+?)(?:\.git)?\s*$/;
+const parseGithubSlug = (remoteUrl) => {
+	const match = remoteUrl.trim().match(GITHUB_REMOTE_RE);
+	if (!match) return null;
+	const owner = match[1];
+	const repo = match[2];
+	if (!owner || !repo) return null;
+	return {
+		owner,
+		repo
+	};
+};
+const detectGithubSlug = (directory) => {
+	let raw;
+	try {
+		raw = execSync("git remote get-url origin", {
+			cwd: path.resolve(directory),
+			encoding: "utf-8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		});
+	} catch {
+		return null;
+	}
+	return parseGithubSlug(raw);
+};
+//#endregion
 //#region src/commands/badge.ts
-const GITHUB_REMOTE_RE = /^(?:git@github\.com:|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/.\s]+?)(?:\.git)?\s*$/;
 const renderBadgeOutput = ({ owner, repo, svgUrl, pageUrl }) => {
 	const slug = `${owner}/${repo}`;
 	const markdown = `[![raigal](${svgUrl})](${pageUrl})`;
@@ -23677,31 +24285,6 @@ const renderBadgeOutput = ({ owner, repo, svgUrl, pageUrl }) => {
 		""
 	].join("\n");
 };
-const detectGithubSlugFromGit = (directory) => {
-	let raw;
-	try {
-		raw = execSync("git remote get-url origin", {
-			cwd: path.resolve(directory),
-			encoding: "utf-8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		});
-	} catch {
-		return null;
-	}
-	const match = raw.trim().match(GITHUB_REMOTE_RE);
-	if (!match) return null;
-	const owner = match[1];
-	const repo = match[2];
-	if (!owner || !repo) return null;
-	return {
-		owner,
-		repo
-	};
-};
 const badgeCommand = async (options = {}) => {
 	await requireEntitlement({
 		directory: options.directory,
@@ -23710,7 +24293,7 @@ const badgeCommand = async (options = {}) => {
 	let owner = options.owner?.trim();
 	let repo = options.repo?.trim();
 	if (!owner || !repo) {
-		const detected = detectGithubSlugFromGit(options.directory ?? ".");
+		const detected = detectGithubSlug(options.directory ?? ".");
 		if (!detected) throw new Error("Could not detect a GitHub remote. Run from a repo with `git remote get-url origin` set, or pass --owner and --repo.");
 		owner ??= detected.owner;
 		repo ??= detected.repo;
@@ -23826,6 +24409,9 @@ const RULE_LABELS = {
 	"security/shell-injection": "Possible shell injection",
 	"security/unsafe-deserialization": "Unsafe deserialization",
 	"security/unsafe-c-call": "Memory-unsafe C call",
+	"security/prompt-injection": "Prompt injection (untrusted system prompt)",
+	"security/unsandboxed-agent-tool": "Unsandboxed agent code execution tool",
+	"security/invisible-unicode-tags": "Invisible Unicode tag character (stealth injection)",
 	"dotnet/projects-skipped": "C# projects skipped by build-backed lint",
 	"cppcheck/chunks-skipped": "C/C++ files skipped by cppcheck",
 	"eslint/no-undef": "Undefined identifier",
@@ -23914,6 +24500,9 @@ const RULE_DESCRIPTIONS = {
 	"security/shell-injection": "Shell command is built from unsanitized input.",
 	"security/unsafe-deserialization": "Legacy .NET formatter can deserialize arbitrary types (RCE).",
 	"security/unsafe-c-call": "Unbounded C string/exec function with buffer-overflow or shell risk.",
+	"security/prompt-injection": "Untrusted dynamic variable interpolation into system or developer prompt.",
+	"security/unsandboxed-agent-tool": "Agent executes code or commands on host without container or interactive gate.",
+	"security/invisible-unicode-tags": "Invisible Unicode Tag block (U+E0000-U+E007F) used for prompt injection or ASCII smuggling.",
 	"dotnet/projects-skipped": "Build-backed C# lint only ran on restored projects; the rest were skipped.",
 	"cppcheck/chunks-skipped": "A cppcheck invocation timed out or failed on one or more chunks; their files were not analyzed.",
 	"oxlint/*": "JavaScript/TypeScript lint finding from oxlint.",
@@ -24108,7 +24697,8 @@ const BUILTIN_RULES = [
 			"typescript/*",
 			"dotnet/*",
 			"cppcheck/*",
-			"clang-tidy/*"
+			"clang-tidy/*",
+			"expo-doctor/*"
 		]
 	},
 	{
@@ -24207,7 +24797,10 @@ const BUILTIN_RULES = [
 			"security/shell-injection",
 			"security/unsafe-deserialization",
 			"security/unsafe-c-call",
-			"security/dependency-audit-skipped"
+			"security/dependency-audit-skipped",
+			"security/prompt-injection",
+			"security/unsandboxed-agent-tool",
+			"security/invisible-unicode-tags"
 		]
 	}
 ];
@@ -24217,7 +24810,8 @@ const collectRuleEntries = (directory) => {
 	for (const { engine, rules } of BUILTIN_RULES) for (const rule of rules) entries.push(toRuleEntry(engine, rule));
 	const configDir = findConfigDir(resolvedDir);
 	if (configDir) {
-		const archRules = loadArchitectureRules(path.join(configDir, RULES_FILE));
+		const rulesPath = path.join(configDir, RULES_FILE);
+		const archRules = loadArchitectureRules(rulesPath);
 		for (const rule of archRules) entries.push({
 			id: `arch/${rule.name}`,
 			engine: "architecture",
@@ -24274,6 +24868,8 @@ const resolveHistoryDir = (directory) => {
 	const resolved = path.resolve(directory);
 	const primary = path.join(resolved, CONFIG_DIR);
 	if (fs.existsSync(primary)) return primary;
+	const legacy = path.join(resolved, ".aislop");
+	if (fs.existsSync(legacy)) return legacy;
 	return null;
 };
 const historyPath = (directory) => {
@@ -24413,7 +25009,7 @@ const trendCommand = async (directory, limit) => {
 //#endregion
 //#region src/update-notifier.ts
 const REGISTRY_URL = "https://registry.npmjs.org/@methiu/raigal/latest";
-const CHECK_INTERVAL_MS = 1440 * 60 * 1e3;
+const CHECK_INTERVAL_MS = 864e5;
 const REQUEST_TIMEOUT_MS = 2e3;
 const CACHE_BASENAME = "update_check.json";
 const isUpdateNotifierDisabled = (env = process.env) => {
@@ -24486,7 +25082,7 @@ const maybeNotifyUpdate = async (now = Date.now()) => {
 	if (!process.stderr.isTTY) return;
 	const cachePath = resolveUpdateCachePath();
 	const cache = readCache(cachePath);
-	if (cache && isOutdated("0.2.0", cache.latest)) process.stderr.write(formatUpdateNotice(APP_VERSION, cache.latest));
+	if (cache && isOutdated("0.2.3", cache.latest)) process.stderr.write(formatUpdateNotice(APP_VERSION, cache.latest));
 	if (!cache || now - cache.checkedAt > CHECK_INTERVAL_MS) {
 		const latest = await fetchLatestVersion$1();
 		if (latest) writeCache(cachePath, {
@@ -25006,7 +25602,7 @@ const renderCommandGroup = (group, commandWidth) => {
 	return lines;
 };
 const renderCommandReference = (input = {}) => {
-	const version = input.version ?? "0.2.0";
+	const version = input.version ?? "0.2.3";
 	const commandWidth = Math.max(...COMMAND_REFERENCE.map((item) => item.command.length));
 	const lines = [renderHeader({
 		version,
@@ -25228,8 +25824,9 @@ const renderHelpDetails = () => [
 	""
 ].map((line) => highlightRaigal(line, theme)).join("\n");
 const renderHome = (input = {}) => {
+	const version = input.version ?? "0.2.3";
 	let out = renderHeader({
-		version: input.version ?? "0.2.0",
+		version,
 		command: "--bare",
 		context: []
 	});
@@ -25289,10 +25886,10 @@ const registerExtraCommands = (program) => {
 			return { exitCode: 0 };
 		});
 	});
-	program.command("update").alias("upgrade").description("Check npm for the latest aislop version").action(async () => {
+	program.command("update").alias("upgrade").description("Check npm for the latest raigal version").action(async () => {
 		await updateCommand();
 	});
-	program.command("version").description("Print the installed aislop version").action(() => {
+	program.command("version").description("Print the installed raigal version").action(() => {
 		process.stdout.write(`${APP_VERSION}\n`);
 	});
 	program.command("commands").description("List all commands and major flags").action(() => {
@@ -25480,7 +26077,8 @@ const saveCachedPolicy = (repoSlug, policy) => {
 };
 const fetchRemotePolicy = async (repoSlug, token) => {
 	try {
-		const data = await requestApi(`/v1/policy?repo=${encodeURIComponent(repoSlug.toLowerCase())}`, {
+		const endpoint = `/v1/policy?repo=${encodeURIComponent(repoSlug.toLowerCase())}`;
+		const data = await requestApi(endpoint, {
 			method: "GET",
 			token,
 			timeoutMs: 4e3
@@ -25885,7 +26483,7 @@ const printEngineStatus = (result) => {
 };
 //#endregion
 //#region src/utils/git.ts
-const MAX_BUFFER = 50 * 1024 * 1024;
+const MAX_BUFFER = 52428800;
 const baseRefExists = (cwd, ref) => {
 	const result = spawnSync("git", [
 		"rev-parse",
@@ -25974,6 +26572,18 @@ const getChangedLineMap = (cwd, base) => {
 	return map;
 };
 //#endregion
+//#region src/commands/scan-hook-nudge.ts
+const shouldShowHookNudge = (ctx) => ctx.isTty && !ctx.isCi && ctx.installedAgentCount === 0;
+const buildHookNudge = (ctx) => {
+	if (!shouldShowHookNudge(ctx)) return null;
+	return [
+		"",
+		"Next: install the per-edit hook so your coding agent fixes slop before it lands.",
+		ctx.invocation === "raigal" ? "  raigal hook install" : "  npm install -g @methiu/raigal && raigal hook install",
+		""
+	].join("\n");
+};
+//#endregion
 //#region src/commands/scan-coverage.ts
 const coverageReason = (c) => {
 	if (c.supportedFiles === 0 && c.dominantUnsupported) return `This repository is ${c.dominantUnsupported} (${c.unsupportedFiles} files), which Raigal does not analyze. No score — it would not reflect this code.`;
@@ -26396,7 +27006,8 @@ const renderActionRows = (steps, t) => {
 const renderTextSteps = (steps, t, s) => {
 	return steps.filter((step) => step.text).map((step) => {
 		const glyph = step.emphasis === "primary" ? s.hint : s.bullet;
-		return ` ${style$1(t, step.emphasis === "primary" ? "accent" : "muted", glyph)} ${highlightAislop(step.text ?? "", t)}`;
+		const tokenFor = step.emphasis === "primary" ? "accent" : "muted";
+		return ` ${style$1(t, tokenFor, glyph)} ${highlightAislop(step.text ?? "", t)}`;
 	});
 };
 const renderSummary = (input, deps = {}) => {
@@ -26453,10 +27064,14 @@ const renderSummary = (input, deps = {}) => {
 	return lines.join("\n");
 };
 const renderStarCta = (deps = {}) => {
-	return `\n ${style$1(deps.theme ?? theme, "muted", `★ Found this useful? Consider purchasing this software at ${terminalLink("https://raigal.dev")}`)}\n`;
+	const t = deps.theme ?? theme;
+	const repository = terminalLink("https://raigal.dev");
+	return `\n ${style$1(t, "muted", `★ Found this useful? Consider purchasing this software at ${repository}`)}\n`;
 };
 const renderTeamCta = (deps = {}) => {
-	return `\n ${style$1(deps.theme ?? theme, "muted", `→ Using raigal with a team? Get a 14-day team baseline at ${terminalLink("https://raigal.dev/contact?intent=team-baseline")}`)}\n`;
+	const t = deps.theme ?? theme;
+	const href = terminalLink("https://raigal.dev/contact?intent=team-baseline");
+	return `\n ${style$1(t, "muted", `→ Using raigal with a team? Get a 14-day team baseline at ${href}`)}\n`;
 };
 const renderCleanRun = (input, deps = {}) => {
 	const t = deps.theme ?? theme;
@@ -26515,7 +27130,7 @@ const buildScanNextSteps = (input) => {
 		emphasis: "primary",
 		label: "Provider",
 		command: `${input.invocation} agent --provider codex`,
-		detail: "or use --provider claude/opencode"
+		detail: "or use --provider claude/opencode/pi"
 	}, {
 		emphasis: "muted",
 		label: "Preview",
@@ -26682,13 +27297,15 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 	const configDir = findConfigDir(resolvedDir);
 	const rulesPath = configDir ? path.join(configDir, RULES_FILE) : void 0;
 	const engineConfig = {
+		overrides: config.overrides,
+		rules: config.rules,
 		quality: config.quality,
 		security: config.security,
 		lint: config.lint,
 		architectureRulesPath: config.engines.architecture ? rulesPath : void 0,
 		engines: config.engines
 	};
-	const { results: unannotated, suppressedCount } = applySuppressions((await runEnginesWithProgress({
+	const severityAdjusted = (await runEnginesWithProgress({
 		rootDirectory: resolvedDir,
 		languages: projectInfo.languages,
 		frameworks: projectInfo.frameworks,
@@ -26703,8 +27320,9 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		config: engineConfig
 	}, config.engines, machineOutput)).map((result) => ({
 		...result,
-		diagnostics: applyRuleSeverities(result.diagnostics, config.rules)
-	})), resolvedDir);
+		diagnostics: config.overrides.length ? result.diagnostics : applyRuleSeverities(result.diagnostics, config.rules)
+	}));
+	const { results: unannotated, suppressedCount } = applySuppressions(severityAdjusted, resolvedDir);
 	if (suppressedCount > 0 && !machineOutput) log.muted(`Suppressed ${suppressedCount} finding(s) via raigal-ignore directives`);
 	const changeMap = options.changes && !options.staged ? getChangedLineMap(resolvedDir, options.base) : null;
 	const results = changeMap ? unannotated.map((result) => ({
@@ -26741,6 +27359,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		engineIssues[r.engine] = r.diagnostics.length;
 		engineTimings[r.engine] = Math.round(r.elapsed);
 	}
+	const enginesFailed = results.filter((r) => r.failed).map((r) => r.engine);
 	const completion = {
 		exitCode,
 		score: scoreable ? scoreResult.score : null,
@@ -26750,7 +27369,8 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		warningCount: allDiagnostics.filter((d) => d.severity === "warning").length,
 		fixableCount: allDiagnostics.filter((d) => d.fixable).length,
 		engineIssues,
-		engineTimings
+		engineTimings,
+		...enginesFailed.length > 0 ? { properties: { engines_failed: enginesFailed } } : {}
 	};
 	recordScanToCloud({
 		results,
@@ -26763,12 +27383,12 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		scoreFileCount
 	});
 	if (options.sarif) {
-		const { buildSarifLog } = await import("./sarif--DI_2p2r.js");
+		const { buildSarifLog } = await import("./sarif-CdtsAfJ1.js");
 		console.log(JSON.stringify(buildSarifLog(results), null, 2));
 		return completion;
 	}
 	if (options.json) {
-		const { buildJsonOutput } = await import("./json-C9fBWj3V.js");
+		const { buildJsonOutput } = await import("./json-BaycSoJP.js");
 		const jsonOut = buildJsonOutput(results, scoreResult, scoreFileCount, elapsedMs, scanCoverage);
 		console.log(JSON.stringify(jsonOut, null, 2));
 		return completion;
@@ -26801,6 +27421,18 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		printBrand: options.printBrand,
 		showPilotInvitation
 	}));
+	if (options.command !== "ci" && options.printBrand !== false) {
+		const nudge = buildHookNudge({
+			installedAgentCount: detectRaigalHooks({
+				home: os.homedir(),
+				cwd: resolvedDir
+			}).length,
+			isTty: Boolean(process.stdout.isTTY),
+			isCi: isCiEnv(),
+			invocation: detectInvocation()
+		});
+		if (nudge) process.stdout.write(nudge);
+	}
 	return completion;
 };
 //#endregion
@@ -27401,7 +28033,8 @@ const groupByFile = (diagnostics) => {
 	});
 };
 const isInstalled = (bin) => {
-	return spawnSync(process.platform === "win32" ? "where" : "which", [bin], { encoding: "utf-8" }).status === 0;
+	const cmd = process.platform === "win32" ? "where" : "which";
+	return spawnSync(cmd, [bin], { encoding: "utf-8" }).status === 0;
 };
 const copyToClipboard = (text) => {
 	const args = {
@@ -27540,7 +28173,9 @@ const createEngineContext = (rootDirectory, projectInfo, config, options = {}) =
 		quality: config.quality,
 		security: config.security,
 		lint: config.lint,
-		engines: config.engines
+		engines: config.engines,
+		overrides: config.overrides,
+		rules: config.rules
 	},
 	...options.scope ? {
 		files: options.scope.files,
@@ -27875,7 +28510,8 @@ const fixNarrativeComments = async (context) => {
 		for (let i = 0; i < lines.length; i += 1) if (!toRemove.has(i + 1)) kept.push(lines[i]);
 		const newContent = kept.join("\n");
 		if (newContent !== content) {
-			if (!areLiteralMultisetsEqual(beforeLiterals, extractStringAndTemplateLiterals(newContent, ext))) continue;
+			const afterLiterals = extractStringAndTemplateLiterals(newContent, ext);
+			if (!areLiteralMultisetsEqual(beforeLiterals, afterLiterals)) continue;
 			fs.writeFileSync(filePath, newContent);
 		}
 	}
@@ -28057,6 +28693,56 @@ const computeRemovalRange = (sourceFile, node, content) => {
 		end: finalEnd
 	};
 };
+const isReferencedOutside = (sourceFile, statement, name) => {
+	const start = statement.getStart(sourceFile);
+	const end = statement.getEnd();
+	let found = false;
+	const visit = (node) => {
+		if (found) return;
+		if (ts.isIdentifier(node) && node.text === name) {
+			const pos = node.getStart(sourceFile);
+			if (pos < start || pos >= end) found = true;
+			return;
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return found;
+};
+const exportKeywordRange = (sourceFile, statement, content) => {
+	const modifiers = ts.canHaveModifiers(statement) ? ts.getModifiers(statement) ?? [] : [];
+	if (modifiers.some((m) => m.kind === ts.SyntaxKind.DefaultKeyword)) return null;
+	const exportKeyword = modifiers.find((m) => m.kind === ts.SyntaxKind.ExportKeyword);
+	if (!exportKeyword) return null;
+	let end = exportKeyword.getEnd();
+	while (end < content.length && (content[end] === " " || content[end] === "	")) end++;
+	return {
+		start: exportKeyword.getStart(sourceFile),
+		end
+	};
+};
+const removalFor = (sourceFile, statement, content, decl) => {
+	if (!isReferencedOutside(sourceFile, statement, decl.name)) return null;
+	const range = exportKeywordRange(sourceFile, statement, content);
+	if (!range) return {
+		type: "skip",
+		reason: "still referenced in its own file",
+		declaration: decl
+	};
+	return {
+		type: "match",
+		removal: {
+			...range,
+			declaration: decl
+		}
+	};
+};
+const declaredNames = (statement) => {
+	if (ts.isVariableStatement(statement)) return statement.declarationList.declarations.map((d) => ts.isIdentifier(d.name) ? d.name.text : null).filter((name) => name !== null);
+	if (ts.isFunctionDeclaration(statement) || ts.isClassDeclaration(statement) || ts.isInterfaceDeclaration(statement) || ts.isTypeAliasDeclaration(statement) || ts.isEnumDeclaration(statement) || ts.isModuleDeclaration(statement)) return statement.name && ts.isIdentifier(statement.name) ? [statement.name.text] : [];
+	return [];
+};
+const isDeclaredMoreThanOnce = (sourceFile, name) => sourceFile.statements.filter((s) => declaredNames(s).includes(name)).length > 1;
 const kindOfStatement = (node) => {
 	if (ts.isVariableStatement(node)) return "variable";
 	if (ts.isFunctionDeclaration(node)) return "function";
@@ -28068,6 +28754,11 @@ const kindOfStatement = (node) => {
 };
 const matchStatement = (sourceFile, statement, content, decl) => {
 	if (!kindOfStatement(statement)) return { type: "none" };
+	if (declaredNames(statement).includes(decl.name) && isDeclaredMoreThanOnce(sourceFile, decl.name)) return {
+		type: "skip",
+		reason: "merged declaration",
+		declaration: decl
+	};
 	if (ts.isVariableStatement(statement)) {
 		const varDecls = statement.declarationList.declarations;
 		if (varDecls.length === 0) return { type: "none" };
@@ -28083,6 +28774,8 @@ const matchStatement = (sourceFile, statement, content, decl) => {
 			reason: "multi-declaration variable statement",
 			declaration: decl
 		};
+		const referenced = removalFor(sourceFile, statement, content, decl);
+		if (referenced) return referenced;
 		if (initializerHasSideEffects(match.initializer)) return {
 			type: "skip",
 			reason: "initializer may have side effects",
@@ -28100,6 +28793,8 @@ const matchStatement = (sourceFile, statement, content, decl) => {
 		if (!statement.name) return { type: "none" };
 		if (statement.name.text !== decl.name) return { type: "none" };
 		if (!nodeContainsLine(sourceFile, statement, decl.line)) return { type: "none" };
+		const referenced = removalFor(sourceFile, statement, content, decl);
+		if (referenced) return referenced;
 		return {
 			type: "match",
 			removal: {
@@ -28111,6 +28806,8 @@ const matchStatement = (sourceFile, statement, content, decl) => {
 	if (ts.isTypeAliasDeclaration(statement) || ts.isInterfaceDeclaration(statement) || ts.isEnumDeclaration(statement)) {
 		if (statement.name.text !== decl.name) return { type: "none" };
 		if (!nodeContainsLine(sourceFile, statement, decl.line)) return { type: "none" };
+		const referenced = removalFor(sourceFile, statement, content, decl);
+		if (referenced) return referenced;
 		return {
 			type: "match",
 			removal: {
@@ -28184,7 +28881,7 @@ const detectUnusedDeclarations = async (context) => {
 			rule: "code-quality/unused-declaration",
 			severity: "warning",
 			message: `Unused ${extracted.kind}: ${extracted.name}`,
-			help: "This top-level declaration is never used; aislop will remove it.",
+			help: "This top-level declaration is never used; raigal will remove it.",
 			line: d.line,
 			column: d.column,
 			category: "Dead Code",
@@ -28202,7 +28899,7 @@ const detectUnusedDeclarations = async (context) => {
 			rule: "code-quality/unused-declaration",
 			severity: "warning",
 			message: `Unused ${kind}: ${name}`,
-			help: "This top-level declaration is never imported; aislop will remove it.",
+			help: "This top-level declaration is never imported; raigal will remove it.",
 			line: d.line,
 			column: d.column,
 			category: "Dead Code",
@@ -28308,7 +29005,7 @@ const removeUnusedDeclarations = (rootDirectory, declarations) => {
 };
 //#endregion
 //#region src/commands/fix-expo.ts
-const INSTALL_TIMEOUT$1 = 1800 * 1e3;
+const INSTALL_TIMEOUT$1 = 18e5;
 const fixExpoDependencies = async (context, onProgress) => {
 	await removeDisallowedExpoPackages(context.rootDirectory, onProgress);
 	onProgress?.("Expo dependency alignment · running expo install --fix (can take a few minutes)");
@@ -28362,8 +29059,8 @@ const removeDisallowedExpoPackages = async (rootDir, onProgress) => {
 };
 //#endregion
 //#region src/commands/fix-force.ts
-const INSTALL_TIMEOUT = 1800 * 1e3;
-const AUDIT_TIMEOUT = 60 * 1e3;
+const INSTALL_TIMEOUT = 18e5;
+const AUDIT_TIMEOUT = 6e4;
 const detectPackageManager = (rootDirectory) => {
 	if (fs.existsSync(path.join(rootDirectory, "pnpm-lock.yaml"))) return "pnpm";
 	if (fs.existsSync(path.join(rootDirectory, "package-lock.json")) || fs.existsSync(path.join(rootDirectory, "package.json"))) return "npm";
@@ -28661,13 +29358,14 @@ const CANNOT_SCOPE_REASON = "cannot honour an explicit file list under --changes
 const MISSING_MANIFEST_REASON = "no manifest or lockfile in the selected scope";
 const fixScopeError = (resolvedDir, flags) => {
 	if (flags.changes && flags.staged) return "--changes and --staged cannot be used together.";
-	return scanTargetError(resolvedDir, {
+	const options = {
 		changes: Boolean(flags.changes),
 		staged: Boolean(flags.staged),
 		base: flags.base,
 		verbose: false,
 		json: false
-	});
+	};
+	return scanTargetError(resolvedDir, options);
 };
 const collectFixFileScope = (rootDirectory, excludePatterns, includePatterns, flags) => {
 	const mode = resolveScanScopeMode({
@@ -28726,9 +29424,10 @@ const runFormattingStep = async (deps) => {
 	else if (deps.projectInfo.languages.includes("python")) log.warn("Python detected but ruff is not installed; skipping Python formatting fixes.");
 	if (deps.projectInfo.languages.includes("go") && deps.projectInfo.installedTools.gofmt) await deps.runStep("Formatting (go)", () => runGofmt(deps.context), () => fixGofmt(deps.context));
 	else if (deps.projectInfo.languages.includes("go")) log.warn("Go detected but gofmt is not installed; skipping Go formatting fixes.");
-	if (deps.projectInfo.languages.includes("rust") && deps.projectInfo.installedTools.rustfmt) if (isScopedFix(deps.context)) deps.skipStep?.("Formatting (rust)", CANNOT_SCOPE_REASON);
-	else await deps.runStep("Formatting (rust)", () => runGenericFormatter(deps.context, "rust"), () => fixGenericFormatter(deps.context, "rust"));
-	else if (deps.projectInfo.languages.includes("rust")) log.warn("Rust detected but rustfmt is not installed; skipping Rust formatting fixes.");
+	if (deps.projectInfo.languages.includes("rust") && deps.projectInfo.installedTools.rustfmt) {
+		if (isScopedFix(deps.context)) deps.skipStep?.("Formatting (rust)", CANNOT_SCOPE_REASON);
+		else await deps.runStep("Formatting (rust)", () => runGenericFormatter(deps.context, "rust"), () => fixGenericFormatter(deps.context, "rust"));
+	} else if (deps.projectInfo.languages.includes("rust")) log.warn("Rust detected but rustfmt is not installed; skipping Rust formatting fixes.");
 	if (deps.projectInfo.languages.includes("ruby") && deps.projectInfo.installedTools.rubocop) {
 		if (!skipUnsafeSafeFormatter(deps, "ruby")) await deps.runStep("Formatting (ruby)", () => runGenericFormatter(deps.context, "ruby"), () => fixGenericFormatter(deps.context, "ruby"));
 	} else if (deps.projectInfo.languages.includes("ruby")) log.warn("Ruby detected but rubocop is not installed; skipping Ruby formatting fixes.");
@@ -28777,7 +29476,8 @@ const runDeclarationStep = async (deps) => {
 	if (!deps.config.engines["code-quality"]) return;
 	if (!hasJsOrTs(deps.projectInfo)) return;
 	await deps.runStep("Unused declarations", () => detectUnusedDeclarations(deps.context), async () => {
-		const declarations = diagnosticsToDeclarations(await detectUnusedDeclarations(deps.context));
+		const diagnostics = await detectUnusedDeclarations(deps.context);
+		const declarations = diagnosticsToDeclarations(diagnostics);
 		removeUnusedDeclarations(deps.resolvedDir, declarations);
 	});
 };
@@ -28808,10 +29508,14 @@ const runForceSteps = async (deps) => {
 		return (await runKnipUnusedFiles(deps.resolvedDir)).filter((diagnostic) => isPathInFixScope(deps.context, diagnostic.filePath));
 	}, () => fixUnusedFiles(deps.resolvedDir, (filePath) => isPathInFixScope(deps.context, filePath)));
 	const railUpdate = (label) => deps.rail.setActiveLabel(label);
-	if (deps.config.engines.security) if (!scopeIncludesManifestWrites(deps.context)) deps.skipStep?.("Dependency audit fixes", MISSING_MANIFEST_REASON);
-	else await deps.runStep("Dependency audit fixes", () => runDependencyAudit(deps.context), () => fixDependencyAudit(deps.context, railUpdate));
-	if (deps.projectInfo.frameworks.includes("expo") && deps.config.lint.expoDoctor) if (!scopeIncludesManifestWrites(deps.context)) deps.skipStep?.("Expo dependency alignment", MISSING_MANIFEST_REASON);
-	else await deps.runStep("Expo dependency alignment", () => runExpoDoctor(deps.context), () => fixExpoDependencies(deps.context, railUpdate));
+	if (deps.config.engines.security) {
+		if (!scopeIncludesManifestWrites(deps.context)) deps.skipStep?.("Dependency audit fixes", MISSING_MANIFEST_REASON);
+		else await deps.runStep("Dependency audit fixes", () => runDependencyAudit(deps.context), () => fixDependencyAudit(deps.context, railUpdate));
+	}
+	if (deps.projectInfo.frameworks.includes("expo") && deps.config.lint.expoDoctor) {
+		if (!scopeIncludesManifestWrites(deps.context)) deps.skipStep?.("Expo dependency alignment", MISSING_MANIFEST_REASON);
+		else await deps.runStep("Expo dependency alignment", () => runExpoDoctor(deps.context), () => fixExpoDependencies(deps.context, railUpdate));
+	}
 };
 //#endregion
 //#region src/commands/fix-plan.ts
@@ -29107,7 +29811,8 @@ const runFixBody = async (resolvedDir, config, options, projectInfo) => {
 		brand: options.printBrand !== false
 	}));
 	const safe = Boolean(options.safe);
-	const scope = collectFixFileScope(resolvedDir, [...config.exclude, ...readAislopIgnorePatterns(resolvedDir)], config.include, options);
+	const excludePatterns = [...config.exclude, ...readAislopIgnorePatterns(resolvedDir)];
+	const scope = collectFixFileScope(resolvedDir, excludePatterns, config.include, options);
 	const scopedProjectInfo = scope ? {
 		...projectInfo,
 		languages: detectSourceLanguages([...scope.files, ...scope.testFiles])
@@ -29162,6 +29867,8 @@ const runFixBody = async (resolvedDir, config, options, projectInfo) => {
 	const configDir = findConfigDir(resolvedDir);
 	const rulesPath = configDir ? path.join(configDir, RULES_FILE) : void 0;
 	const engineConfig = {
+		overrides: config.overrides,
+		rules: config.rules,
 		quality: config.quality,
 		security: config.security,
 		lint: config.lint,
@@ -29187,7 +29894,7 @@ const runFixBody = async (resolvedDir, config, options, projectInfo) => {
 		status: "done",
 		label: "Verification complete"
 	});
-	const scanResults = appendPostFixLintResult(verificationResults, collectPostFixLintDiagnostics(steps));
+	const scanResults = appendPostFixLintResult(verificationResults, applyFileOverrides(collectPostFixLintDiagnostics(steps), context));
 	const allDiagnostics = scanResults.flatMap((r) => r.diagnostics);
 	const scoreResult = calculateScore(allDiagnostics, config.scoring.weights, config.scoring.thresholds, scope ? scope.scoreFileCount : projectInfo.sourceFileCount, config.scoring.smoothing, config.scoring.maxPerRule);
 	const errors = allDiagnostics.filter((d) => d.severity === "error").length;
@@ -29318,13 +30025,13 @@ const writeGithubWorkflow = (rootDirectory, enabled) => {
 	};
 };
 const promptForConfigChoices = async () => {
-	const enginesSelection = await multiselect({
+	const enginesSelection = await runCancellable(() => multiselect({
 		message: "Which engines should run?",
 		options: ENGINE_CHOICES,
 		initialValues: DEFAULT_ENGINE_SELECTION,
 		required: false
-	});
-	if (isCancel(enginesSelection)) return null;
+	}));
+	if (enginesSelection === void 0 || isCancel(enginesSelection)) return null;
 	const failBelowRaw = await text({
 		message: "CI quality gate — fail the build when the score drops below (0-100)",
 		initialValue: "70",
@@ -29455,16 +30162,18 @@ const initCommand = async (directory, options = {}) => {
 		status: "done",
 		label: `Wrote ${CONFIG_DIR}/${CONFIG_FILE}`
 	}];
-	if (choices.engines.includes("architecture")) if (!fs.existsSync(rulesPath)) {
-		fs.writeFileSync(rulesPath, DEFAULT_RULES_YAML);
-		steps.push({
-			status: "done",
-			label: `Wrote ${CONFIG_DIR}/${RULES_FILE}`
+	if (choices.engines.includes("architecture")) {
+		if (!fs.existsSync(rulesPath)) {
+			fs.writeFileSync(rulesPath, DEFAULT_RULES_YAML);
+			steps.push({
+				status: "done",
+				label: `Wrote ${CONFIG_DIR}/${RULES_FILE}`
+			});
+		} else steps.push({
+			status: "skipped",
+			label: `${CONFIG_DIR}/${RULES_FILE} already exists`
 		});
-	} else steps.push({
-		status: "skipped",
-		label: `${CONFIG_DIR}/${RULES_FILE} already exists`
-	});
+	}
 	const workflowResult = writeGithubWorkflow(resolvedDir, choices.writeGithubWorkflow);
 	if (workflowResult.status === "written") steps.push({
 		status: "done",
@@ -29679,13 +30388,19 @@ const suggestClosest = (token, candidates) => {
 };
 //#endregion
 //#region src/cli.ts
-const safeTelemetryConfig = (dir) => {
+const safeTelemetryConfig = (dir = process.cwd()) => {
 	try {
 		return loadConfig(dir).telemetry;
 	} catch {
 		return;
 	}
 };
+const exitOnFatal = (error, stage) => {
+	console.error(error);
+	reportFatalError(error, stage, safeTelemetryConfig()).finally(() => process.exit(1));
+};
+process.on("uncaughtException", (error) => exitOnFatal(error, "uncaught_exception"));
+process.on("unhandledRejection", (reason) => exitOnFatal(reason, "unhandled_rejection"));
 const handleTerminationSignal = async (signal) => {
 	killActiveChildren();
 	const exitCode = signal === "SIGINT" ? 130 : 143;
@@ -29784,7 +30499,7 @@ fixProgram.action(async (directory = ".", _flags, command) => {
 	}
 });
 registerAgentCommand(program);
-program.command("init [directory]").description("Create aislop config and optional CI workflow").option("--strict", "write an enterprise-grade default config: all engines, typecheck on, CI failBelow 85, workflow included").action(async (directory = ".", _flags, command) => {
+program.command("init [directory]").description("Create raigal config and optional CI workflow").option("--strict", "write an enterprise-grade default config: all engines, typecheck on, CI failBelow 85, workflow included").action(async (directory = ".", _flags, command) => {
 	const flags = command.optsWithGlobals();
 	await withCommandLifecycle({
 		command: "init",
@@ -29850,11 +30565,13 @@ program.hook("preAction", (_thisCommand, actionCommand) => {
 		"hook"
 	].includes(cmdName)) {
 		const flagNames = process.argv.slice(2).filter((arg) => arg.startsWith("-")).map((arg) => arg.replace(/^--?/, "").split("=")[0] ?? "");
-		startRunRecorder(cmdName, actionCommand.args?.[0] || process.cwd(), flagNames);
+		const dir = actionCommand.args?.[0] || process.cwd();
+		startRunRecorder(cmdName, dir, flagNames);
 	}
 });
 program.hook("postAction", async () => {
-	await finishActiveRecorder(typeof process.exitCode === "number" ? process.exitCode : 0);
+	const code = typeof process.exitCode === "number" ? process.exitCode : 0;
+	await finishActiveRecorder(code);
 });
 const main = async () => {
 	fireInstalledOnce();
@@ -29882,6 +30599,6 @@ const main = async () => {
 	await flushTelemetry();
 	await maybeNotifyUpdate();
 };
-main();
+main().catch((error) => exitOnFatal(error, "main"));
 //#endregion
 export { requestApi as a, log as c, detectRepoRef as i, FIXED_SECRET_DIAGNOSTIC_MESSAGE as l, withFindingAssessments as n, getActiveToken as o, ENGINE_INFO as r, APP_VERSION as s, summarizeFindingAssessments as t, isSecretClassRule as u };