@methiu/raigal 0.2.0 → 0.2.3

package/dist/index.js

@@ -1,5 +1,5 @@
-import { t as APP_VERSION } from "./version-v4OAaBLZ.js";
-import { a as getEngineLabel, i as ENGINE_INFO, r as scoreImpactForRule, t as summarizeFindingAssessments } from "./finding-assessment-M5fUTE-C.js";
+import { t as APP_VERSION } from "./version-B4eYJn3o.js";
+import { a as getEngineLabel, i as ENGINE_INFO, r as scoreImpactForRule, t as summarizeFindingAssessments } from "./finding-assessment-CGpt5YUR.js";
 import { n as isSecretClassRule, r as maskSecrets, t as FIXED_SECRET_DIAGNOSTIC_MESSAGE } from "./mask-secrets-BXn-ZSEh.js";
 import { createRequire, isBuiltin } from "node:module";
 import path from "node:path";
@@ -8,14 +8,14 @@ import YAML, { parse } from "yaml";
 import { z } from "zod/v4";
 import pc from "picocolors";
 import wcwidth from "wcwidth";
-import micromatch from "micromatch";
+import picomatch from "picomatch";
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import os, { tmpdir } from "node:os";
 import { performance } from "node:perf_hooks";
 import ts from "typescript";
 import { parse as parse$1 } from "smol-toml";
-import { createHash, createPublicKey, randomUUID, verify } from "node:crypto";
+import crypto, { createHash, createPublicKey, randomUUID, verify } from "node:crypto";
 import { isCancel, multiselect, select, text } from "@clack/prompts";
 import * as readline from "node:readline";
 import { Writable } from "node:stream";
@@ -88,7 +88,8 @@ const DEFAULT_CONFIG = {
 		format: "json"
 	},
 	telemetry: { enabled: true },
-	rules: {}
+	rules: {},
+	overrides: []
 };
 const GITHUB_WORKFLOW_DIR = ".github/workflows";
 const GITHUB_WORKFLOW_FILE = "raigal.yml";
@@ -131,7 +132,7 @@ const DEFAULT_RULES_YAML = `# Architecture rules (BYO)
 //#endregion
 //#region src/config/extends.ts
 const MAX_DEPTH$1 = 5;
-const MAX_CONFIG_BYTES = 1024 * 1024;
+const MAX_CONFIG_BYTES = 1048576;
 const isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 const deepMerge = (...sources) => {
 	const result = {};
@@ -312,12 +313,25 @@ const CiSchema = z.object({
 	format: z.enum(["json"]).default("json")
 }).strict();
 const TelemetrySchema = z.object({ enabled: z.boolean().default(true) }).strict();
+const BaselineConfigSchema = z.object({ mode: z.enum(["strict", "relaxed"]).default("relaxed") }).strict();
+const LicensingConfigSchema = z.object({ onLapse: z.enum(["fail-open", "fail-closed"]).default("fail-open") }).strict();
+const WorkspaceConfigSchema = z.object({ minimumFloor: z.number().min(0).max(100).default(50) }).strict();
 const RuleSeverityOverride = z.enum([
 	"error",
 	"warning",
 	"off"
 ]);
 const RulesSchema = z.record(z.string(), RuleSeverityOverride).default(() => ({}));
+const FileOverrideSchema = z.object({
+	files: z.array(z.string().min(1)).min(1),
+	quality: z.object({
+		maxFunctionLoc: QualitySchema.shape.maxFunctionLoc.unwrap().optional(),
+		maxFileLoc: QualitySchema.shape.maxFileLoc.unwrap().optional(),
+		maxNesting: QualitySchema.shape.maxNesting.unwrap().optional(),
+		maxParams: QualitySchema.shape.maxParams.unwrap().optional()
+	}).optional(),
+	rules: z.record(z.string(), RuleSeverityOverride).optional()
+});
 const AislopConfigSchema = z.object({
 	version: z.number().default(1),
 	extends: z.union([z.string(), z.array(z.string())]).optional(),
@@ -372,7 +386,11 @@ const AislopConfigSchema = z.object({
 		format: "json"
 	})),
 	telemetry: TelemetrySchema.default(() => ({ enabled: true })),
+	baseline: BaselineConfigSchema.optional(),
+	licensing: LicensingConfigSchema.optional(),
+	workspace: WorkspaceConfigSchema.optional(),
 	rules: RulesSchema,
+	overrides: z.array(FileOverrideSchema).default(() => []),
 	exclude: z.array(z.string()).default(() => [
 		"node_modules",
 		".git",
@@ -405,6 +423,9 @@ const KNOWN_KEYS_BY_PATH = {
 		"scoring",
 		"ci",
 		"telemetry",
+		"baseline",
+		"licensing",
+		"workspace",
 		"rules",
 		"exclude",
 		"include"
@@ -455,7 +476,10 @@ const KNOWN_KEYS_BY_PATH = {
 	],
 	"scoring.thresholds": ["good", "ok"],
 	ci: ["failBelow", "format"],
-	telemetry: ["enabled"]
+	telemetry: ["enabled"],
+	baseline: ["mode"],
+	licensing: ["onLapse"],
+	workspace: ["minimumFloor"]
 };
 const levenshtein = (a, b) => {
 	const m = a.length;
@@ -587,7 +611,8 @@ const loadConfig = (directory) => {
 	const configPath = findConfigFile(directory);
 	if (!configPath) return DEFAULT_CONFIG;
 	try {
-		return validateConfig(loadConfigChain(configPath), configPath);
+		const merged = loadConfigChain(configPath);
+		return validateConfig(merged, configPath);
 	} catch (error) {
 		if (error instanceof ConfigError) throw error;
 		throw new ConfigError(configPath, `Failed to parse ${configPath}: ${error instanceof Error ? error.message : String(error)}`);
@@ -674,7 +699,7 @@ const highlightRaigal = (text, theme, baseToken) => {
 	const tail = text.slice(lastIndex);
 	return out + (baseToken ? style(theme, baseToken, tail) : tail);
 };
-const highlightAislop = highlightRaigal;
+const highlightAislop = (...args) => highlightRaigal(...args);
 //#endregion
 //#region src/ui/width.ts
 const ANSI_RE$1 = new RegExp(`\\[[0-9;]*m`, "g");
@@ -683,7 +708,8 @@ const stringWidth = (s) => {
 	const bare = stripAnsi$1(s);
 	let total = 0;
 	for (const ch of bare) {
-		const w = wcwidth(ch.codePointAt(0) ?? 0);
+		const cp = ch.codePointAt(0) ?? 0;
+		const w = wcwidth(cp);
 		total += w > 0 ? w : 1;
 	}
 	return total;
@@ -699,7 +725,8 @@ const truncate = (s, max, ellipsis = "…") => {
 	let out = "";
 	let w = 0;
 	for (const ch of s) {
-		const cw = wcwidth(ch.codePointAt(0) ?? 0);
+		const cp = ch.codePointAt(0) ?? 0;
+		const cw = wcwidth(cp);
 		if (w + cw > limit) break;
 		out += ch;
 		w += cw;
@@ -709,7 +736,8 @@ const truncate = (s, max, ellipsis = "…") => {
 //#endregion
 //#region src/ui/display.ts
 const renderDisplaySection = (label, deps = {}) => {
-	return style(deps.theme ?? theme, "section", label);
+	const t = deps.theme ?? theme;
+	return style(t, "section", label);
 };
 const renderDisplayRows = (rows, options = {}) => {
 	if (rows.length === 0) return [];
@@ -856,8 +884,10 @@ const detectSourceLanguages = (sourceFiles) => {
 const detectLanguages = (directory, sourceFiles) => {
 	const languages = new Set(detectSourceLanguages(sourceFiles));
 	for (const [file, lang] of Object.entries(LANGUAGE_SIGNALS)) if (fs.existsSync(path.join(directory, file))) languages.add(lang);
-	if (readPackageJson(path.join(directory, "package.json"))) if (fs.existsSync(path.join(directory, "tsconfig.json"))) languages.add("typescript");
-	else languages.add("javascript");
+	if (readPackageJson(path.join(directory, "package.json"))) {
+		if (fs.existsSync(path.join(directory, "tsconfig.json"))) languages.add("typescript");
+		else languages.add("javascript");
+	}
 	for (const signal of PYTHON_SIGNALS) if (fs.existsSync(path.join(directory, signal))) {
 		languages.add("python");
 		break;
@@ -938,13 +968,13 @@ const normalizeExcludePatterns = (patterns) => patterns.flatMap((pattern) => {
 	const normalized = withoutProjectPrefix.slice(0, end);
 	if (normalized.length === 0) return [];
 	if (normalized.length > 256) return [];
-	if (micromatch.scan(normalized).isGlob) return [normalized];
+	if (picomatch.scan(normalized).isGlob) return [normalized];
 	if (normalized.startsWith(".") && !normalized.includes("/")) return supportedGlobPatterns([`**/${normalized}`, `**/${normalized}/**`]);
 	return supportedGlobPatterns([normalized, `${normalized}/**`]);
 });
 const isPathExcluded = (relativePath, normalizedPatterns) => {
 	if (normalizedPatterns.length === 0) return false;
-	return micromatch.isMatch(relativePath, normalizedPatterns, { dot: true });
+	return picomatch.isMatch(relativePath, normalizedPatterns, { dot: true });
 };
 const filterExcludedDiagnostics = (diagnostics, rootDirectory, excludePatterns) => {
 	if (!excludePatterns || excludePatterns.length === 0) return diagnostics;
@@ -990,7 +1020,7 @@ const isAutoGenerated = (filePath) => {
 };
 //#endregion
 //#region src/utils/git-ignore.ts
-const MAX_BUFFER$2 = 50 * 1024 * 1024;
+const MAX_BUFFER$2 = 52428800;
 const NOT_IGNORED_ARGUMENTS = [
 	"ls-files",
 	"--cached",
@@ -1101,7 +1131,7 @@ const dropGitIgnoredPaths = (rootDirectory, absolutePaths) => {
 };
 //#endregion
 //#region src/utils/project-file-list.ts
-const MAX_BUFFER$1 = 50 * 1024 * 1024;
+const MAX_BUFFER$1 = 52428800;
 const normalizePruneDirectories = (directories) => new Set([...directories].map((directory) => directory.toLowerCase()));
 const isInPrunedDirectory = (filePath, pruneDirectories) => {
 	const pathSegments = filePath.split("/");
@@ -1312,12 +1342,13 @@ const normalizeIncludePatterns = (patterns) => patterns.flatMap((pattern) => {
 	const normalized = pattern.trim().replace(/^\.\//, "").replace(/\/$/, "");
 	if (normalized === "" || normalized === ".") return ["**"];
 	if (normalized.length > 256) return [];
-	if (micromatch.scan(normalized).isGlob) return [normalized];
+	if (picomatch.scan(normalized).isGlob) return [normalized];
 	return supportedGlobPatterns([normalized, `${normalized}/**`]);
 });
 const createPathMatcher = (patterns) => {
-	const matchers = patterns.map((pattern) => micromatch.matcher(pattern, { dot: true }));
-	return (filePath) => matchers.some((matches) => matches(filePath));
+	if (patterns.length === 0) return () => false;
+	const isMatch = picomatch(patterns, { dot: true });
+	return (filePath) => isMatch(filePath);
 };
 const filterFiles = (rootDirectory, files, options) => {
 	const extraExtensions = new Set(options.extraExtensions);
@@ -1651,7 +1682,8 @@ const resolvePackageRoot = (startFile) => {
 	while (true) {
 		const packageJsonPath = path.join(current, "package.json");
 		if (fs.existsSync(packageJsonPath)) try {
-			if (JSON.parse(fs.readFileSync(packageJsonPath, "utf-8")).name === "aislop") return current;
+			const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+			if (packageJson.name === "aislop" || packageJson.name === "@methiu/raigal" || packageJson.name === "raigal") return current;
 		} catch {}
 		const parent = path.dirname(current);
 		if (parent === current) break;
@@ -1746,7 +1778,7 @@ const checkInstalledTools = async () => {
 };
 //#endregion
 //#region src/utils/project-path-safety.ts
-const MAX_PROJECT_CONFIG_BYTES = 1024 * 1024;
+const MAX_PROJECT_CONFIG_BYTES = 1048576;
 const isWithinDirectory$2 = (rootDirectory, candidate) => {
 	const relative = path.relative(rootDirectory, candidate);
 	return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
@@ -1800,7 +1832,7 @@ const isRootBoundedTarget = (candidate, rootDirectory) => {
 };
 //#endregion
 //#region src/utils/aislop-ignore.ts
-const readRaigalIgnorePatterns = (rootDirectory) => {
+const readAislopIgnorePatterns = (rootDirectory) => {
 	const patterns = [];
 	for (const fileName of [".raigalignore", ".aislopignore"]) {
 		const targetPath = safeProjectFilePath(path.join(rootDirectory, fileName), rootDirectory);
@@ -1811,7 +1843,6 @@ const readRaigalIgnorePatterns = (rootDirectory) => {
 	}
 	return patterns;
 };
-const readAislopIgnorePatterns = readRaigalIgnorePatterns;
 //#endregion
 //#region src/utils/source-file-context.ts
 const getSourceFilesForRoot = (rootDirectory) => filterProjectFiles(rootDirectory, listProjectFiles(rootDirectory));
@@ -2072,7 +2103,8 @@ const resolveTrustedTscPath = () => {
 };
 const isReferenceOnlyConfig = (tsconfigPath) => {
 	try {
-		const parsed = parseJsonc(fs.readFileSync(tsconfigPath, "utf-8"));
+		const raw = fs.readFileSync(tsconfigPath, "utf-8");
+		const parsed = parseJsonc(raw);
 		if (!parsed) return false;
 		return Array.isArray(parsed.references) && !parsed.files && !parsed.include && !parsed.extends;
 	} catch {
@@ -2391,7 +2423,7 @@ const changeContextOrder = (context) => {
 };
 //#endregion
 //#region src/utils/git.ts
-const MAX_BUFFER = 50 * 1024 * 1024;
+const MAX_BUFFER = 52428800;
 const baseRefExists = (cwd, ref) => {
 	const result = spawnSync("git", [
 		"rev-parse",
@@ -2639,6 +2671,132 @@ const doctorCommand = async (directory, options = {}) => {
 	}));
 };
 //#endregion
+//#region src/utils/globs.ts
+const MAX_BRACE_EXPANSIONS = 256;
+const braceListAt = (pattern, start) => {
+	let depth = 0;
+	const commas = [];
+	for (let i = start; i < pattern.length; i += 1) {
+		const char = pattern[i];
+		if (char === "\\") i += 1;
+		else if (char === "{") depth += 1;
+		else if (char === ",") {
+			if (depth === 1) commas.push(i);
+		} else if (char === "}") {
+			depth -= 1;
+			if (depth === 0) return commas.length > 0 ? {
+				start,
+				end: i,
+				commas
+			} : null;
+		}
+	}
+	return null;
+};
+const findBraceList = (pattern) => {
+	for (let start = pattern.indexOf("{"); start !== -1; start = pattern.indexOf("{", start + 1)) {
+		if (start > 0 && pattern[start - 1] === "\\") continue;
+		const list = braceListAt(pattern, start);
+		if (list) return list;
+	}
+	return null;
+};
+const expandInto = (pattern, results) => {
+	const list = findBraceList(pattern);
+	if (!list) {
+		results.push(pattern);
+		return results.length <= MAX_BRACE_EXPANSIONS;
+	}
+	const bounds = [
+		list.start,
+		...list.commas,
+		list.end
+	];
+	const prefix = pattern.slice(0, list.start);
+	const suffix = pattern.slice(list.end + 1);
+	for (let i = 0; i < bounds.length - 1; i += 1) {
+		const option = pattern.slice(bounds[i] + 1, bounds[i + 1]);
+		if (!expandInto(`${prefix}${option}${suffix}`, results)) return false;
+	}
+	return true;
+};
+const expandBraceLists = (pattern) => {
+	const results = [];
+	return expandInto(pattern, results) ? results : [pattern];
+};
+const isNegated = (pattern) => picomatch.scan(pattern).negated;
+const matchesGlobList = (value, patterns, options = {}) => {
+	const expanded = patterns.flatMap(expandBraceLists);
+	const positives = expanded.filter((pattern) => !isNegated(pattern));
+	const negatives = expanded.filter(isNegated).map((pattern) => pattern.slice(1));
+	const included = positives.length === 0 || picomatch.isMatch(value, positives, options);
+	const excluded = negatives.length > 0 && picomatch.isMatch(value, negatives, options);
+	return included && !excluded;
+};
+//#endregion
+//#region src/scoring/rule-severity.ts
+/**
+* Apply per-rule severity overrides from config: "off" drops the diagnostic,
+* "error"/"warning" rewrite its severity before scoring and rendering.
+*/
+const applyRuleSeverities = (diagnostics, overrides) => {
+	if (Object.keys(overrides).length === 0) return diagnostics;
+	const result = [];
+	for (const diagnostic of diagnostics) {
+		const override = overrides[diagnostic.rule];
+		if (!override) {
+			result.push(diagnostic);
+			continue;
+		}
+		if (override === "off") continue;
+		result.push(override === diagnostic.severity ? diagnostic : {
+			...diagnostic,
+			severity: override
+		});
+	}
+	return result;
+};
+//#endregion
+//#region src/config/overrides.ts
+const overrideRelativePath = (rootDirectory, filePath) => {
+	const paths = path.win32.isAbsolute(rootDirectory) && !path.posix.isAbsolute(rootDirectory) ? path.win32 : path.posix;
+	const root = rootDirectory.replaceAll("\\", "/");
+	const file = filePath.replaceAll("\\", "/");
+	return paths.normalize(paths.isAbsolute(file) ? paths.relative(root, file) : file).replaceAll("\\", "/");
+};
+const matchesEntry = (relativePath, patterns) => matchesGlobList(relativePath, patterns, { dot: true });
+const resolveFilePolicy = (config, relativePath) => {
+	let quality = config.quality;
+	let rules = config.rules ?? {};
+	if (relativePath === ".." || relativePath.startsWith("../") || path.win32.isAbsolute(relativePath)) return {
+		quality,
+		rules
+	};
+	for (const entry of config.overrides ?? []) {
+		if (!matchesEntry(relativePath, entry.files)) continue;
+		if (entry.quality) quality = {
+			...quality,
+			...entry.quality
+		};
+		if (entry.rules) rules = {
+			...rules,
+			...entry.rules
+		};
+	}
+	return {
+		quality,
+		rules
+	};
+};
+const applyFileOverrides = (diagnostics, context) => {
+	if (!context.config.overrides?.length) return diagnostics;
+	return diagnostics.flatMap((diagnostic) => {
+		const relativePath = overrideRelativePath(context.rootDirectory, diagnostic.filePath);
+		const { rules } = resolveFilePolicy(context.config, relativePath);
+		return applyRuleSeverities([diagnostic], rules);
+	});
+};
+//#endregion
 //#region src/utils/string-literals.ts
 const consumeQuotedString = (content, start, quote) => {
 	const len = content.length;
@@ -3247,7 +3405,7 @@ const tokenizeJs = (content, ext = ".ts") => {
 };
 //#endregion
 //#region src/utils/source-masker.ts
-const JS_EXTS$2 = /* @__PURE__ */ new Set([
+const JS_EXTS$3 = /* @__PURE__ */ new Set([
 	".ts",
 	".tsx",
 	".js",
@@ -3255,7 +3413,7 @@ const JS_EXTS$2 = /* @__PURE__ */ new Set([
 	".mjs",
 	".cjs"
 ]);
-const PY_EXTS = /* @__PURE__ */ new Set([".py"]);
+const PY_EXTS$1 = /* @__PURE__ */ new Set([".py"]);
 const RB_EXTS = /* @__PURE__ */ new Set([".rb"]);
 const PHP_EXTS = /* @__PURE__ */ new Set([".php"]);
 const CSHARP_EXTS = /* @__PURE__ */ new Set([".cs"]);
@@ -3279,8 +3437,8 @@ const C_STYLE_COMMENT_EXTS = /* @__PURE__ */ new Set([
 	".zig"
 ]);
 const familyForExt = (ext) => {
-	if (JS_EXTS$2.has(ext)) return "js";
-	if (PY_EXTS.has(ext)) return "py";
+	if (JS_EXTS$3.has(ext)) return "js";
+	if (PY_EXTS$1.has(ext)) return "py";
 	if (RB_EXTS.has(ext)) return "rb";
 	if (PHP_EXTS.has(ext)) return "php";
 	if (CSHARP_EXTS.has(ext)) return "csharp";
@@ -3550,7 +3708,7 @@ const areLiteralMultisetsEqual = (a, b) => {
 };
 //#endregion
 //#region src/engines/ai-slop/abstractions.ts
-const JS_EXTS$1 = /* @__PURE__ */ new Set([
+const JS_EXTS$2 = /* @__PURE__ */ new Set([
 	".ts",
 	".tsx",
 	".js",
@@ -3561,11 +3719,11 @@ const JS_EXTS$1 = /* @__PURE__ */ new Set([
 const THIN_WRAPPER_PATTERNS = [
 	{
 		pattern: /(?:export\s+)?(?:async\s+)?function\s+(\w+)\s*\([^)]*\)\s*(?::\s*\w[^{]*)?\{\s*\n?\s*return\s+\w+\([^)]*\);\s*\n?\s*\}/g,
-		extensions: JS_EXTS$1
+		extensions: JS_EXTS$2
 	},
 	{
 		pattern: /(?:export\s+)?const\s+(\w+)\s*=\s*(?:async\s+)?\([^)]*\)\s*(?::\s*\w[^=]*)?\s*=>\s*\w+\([^)]*\);/g,
-		extensions: JS_EXTS$1
+		extensions: JS_EXTS$2
 	},
 	{
 		pattern: /def\s+(\w+)\s*\([^)]*\)(?:\s*->[^:]*)?:\s*\n\s+return\s+\w+\([^)]*\)\s*$/gm,
@@ -4813,7 +4971,7 @@ const scriptKindFor$1 = (ext) => {
 	}
 };
 const lineFor$1 = (sourceFile, node) => sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
-const makeDiagnostic = (filePath, line, rule, message, help) => ({
+const makeDiagnostic$1 = (filePath, line, rule, message, help) => ({
 	filePath,
 	engine: "ai-slop",
 	rule,
@@ -4863,7 +5021,7 @@ const detectRedundantTryCatch = (sourceFile, relativePath) => {
 		if (ts.isTryStatement(node) && node.catchClause && !node.finallyBlock) {
 			const catchNameNode = node.catchClause.variableDeclaration?.name;
 			const [onlyStatement] = node.catchClause.block.statements;
-			if (catchNameNode && ts.isIdentifier(catchNameNode) && node.catchClause.block.statements.length === 1 && onlyStatement && (isRethrowStatement(onlyStatement, catchNameNode.text) || isPromiseRejectRethrow(onlyStatement, catchNameNode.text))) diagnostics.push(makeDiagnostic(relativePath, lineFor$1(sourceFile, node.catchClause), "ai-slop/redundant-try-catch", "Catch block only rethrows the same error", "Remove the try/catch or add useful context, cleanup, or recovery. Rethrowing unchanged errors is usually defensive agent noise."));
+			if (catchNameNode && ts.isIdentifier(catchNameNode) && node.catchClause.block.statements.length === 1 && onlyStatement && (isRethrowStatement(onlyStatement, catchNameNode.text) || isPromiseRejectRethrow(onlyStatement, catchNameNode.text))) diagnostics.push(makeDiagnostic$1(relativePath, lineFor$1(sourceFile, node.catchClause), "ai-slop/redundant-try-catch", "Catch block only rethrows the same error", "Remove the try/catch or add useful context, cleanup, or recovery. Rethrowing unchanged errors is usually defensive agent noise."));
 		}
 		ts.forEachChild(node, visit);
 	};
@@ -4881,7 +5039,7 @@ const detectPrimitiveCoercions = (sourceFile, relativePath) => {
 				const [arg] = child.arguments;
 				if (arg && ts.isIdentifier(arg)) {
 					const primitive = params.get(arg.text);
-					if (primitive && child.expression.text === COERCION_CTORS[primitive]) diagnostics.push(makeDiagnostic(relativePath, lineFor$1(sourceFile, child), "ai-slop/redundant-type-coercion", `Parameter '${arg.text}' is already typed as ${primitive} but is coerced again`, "Trust the typed boundary or validate unknown input before this function. Re-coercing already typed parameters is usually defensive agent noise."));
+					if (primitive && child.expression.text === COERCION_CTORS[primitive]) diagnostics.push(makeDiagnostic$1(relativePath, lineFor$1(sourceFile, child), "ai-slop/redundant-type-coercion", `Parameter '${arg.text}' is already typed as ${primitive} but is coerced again`, "Trust the typed boundary or validate unknown input before this function. Re-coercing already typed parameters is usually defensive agent noise."));
 				}
 			}
 			ts.forEachChild(child, visitBody);
@@ -4924,7 +5082,7 @@ const detectDuplicateExportedTypes = (parsedSources) => {
 				continue;
 			}
 			if (previous.filePath === declaration.filePath) continue;
-			diagnostics.push(makeDiagnostic(declaration.filePath, declaration.line, "ai-slop/duplicate-type-declaration", `Exported type '${declaration.name}' duplicates an existing declaration`, `Reuse or import the existing type from ${previous.filePath} instead of re-declaring the same shape in another file.`));
+			diagnostics.push(makeDiagnostic$1(declaration.filePath, declaration.line, "ai-slop/duplicate-type-declaration", `Exported type '${declaration.name}' duplicates an existing declaration`, `Reuse or import the existing type from ${previous.filePath} instead of re-declaring the same shape in another file.`));
 		}
 	}
 	return diagnostics;
@@ -5026,7 +5184,7 @@ const detectDuplicateImports = async (context) => {
 					rule: "ai-slop/duplicate-import",
 					severity: "warning",
 					message: `"${spec}" is also imported on line ${firstLine}. Merge into a single import statement.`,
-					help: "Two imports from the same module split readers' attention and grow the import block. Run aislop fix to merge them automatically.",
+					help: "Two imports from the same module split readers' attention and grow the import block. Run raigal fix to merge them automatically.",
 					line: dup.line,
 					column: 1,
 					category: "AI Slop",
@@ -6648,7 +6806,8 @@ const isJsRelativeOrAbsolute = (spec) => spec.startsWith(".") || spec.startsWith
 const RUNTIME_BUILTINS = /* @__PURE__ */ new Set(["bun"]);
 const isJsBuiltin = (spec) => {
 	if (RUNTIME_BUILTINS.has(spec)) return true;
-	return isBuiltin(spec.startsWith("node:") ? spec.slice(5) : spec) || isBuiltin(spec);
+	const stripped = spec.startsWith("node:") ? spec.slice(5) : spec;
+	return isBuiltin(stripped) || isBuiltin(spec);
 };
 const VIRTUAL_MODULE_PREFIXES = [
 	"astro:",
@@ -6860,7 +7019,8 @@ const isLocalAliasReplacement = (rawValue, configDirectory, rootDirectory) => {
 	if (!target) return false;
 	if (!target.startsWith(".") && !target.startsWith("/") && !target.startsWith("~/") && !target.startsWith("@/")) return false;
 	const normalized = target.startsWith("~/") || target.startsWith("@/") ? target.slice(2) : target;
-	return isRootBoundedTarget(path.isAbsolute(normalized) ? normalized : path.resolve(configDirectory, normalized), rootDirectory);
+	const candidate = path.isAbsolute(normalized) ? normalized : path.resolve(configDirectory, normalized);
+	return isRootBoundedTarget(candidate, rootDirectory);
 };
 const hasValidPackageImportTarget = (value, packageDirectory, rootDirectory) => {
 	if (!isRootBoundedTarget(packageDirectory, rootDirectory)) return false;
@@ -8054,7 +8214,9 @@ const isRustDocCommentLine = (line) => {
 };
 const collectBlocks = (sourceLines, syntax, content, ext) => {
 	const blocks = [];
-	const commentLines = getCommentLines(content ?? sourceLines.join("\n"), ext ?? (syntax.linePrefixes.includes("//") ? ".ts" : ".py"));
+	const actualContent = content ?? sourceLines.join("\n");
+	const actualExt = ext ?? (syntax.linePrefixes.includes("//") ? ".ts" : ".py");
+	const commentLines = getCommentLines(actualContent, actualExt);
 	let i = 0;
 	while (i < sourceLines.length) {
 		const line = sourceLines[i];
@@ -8382,7 +8544,8 @@ const detectNarrativeComments = async (context) => {
 		} catch {
 			continue;
 		}
-		const blocks = collectBlocks(content.split("\n"), syntax, content, ext);
+		const lines = content.split("\n");
+		const blocks = collectBlocks(lines, syntax, content, ext);
 		for (const block of blocks) {
 			const { matched, reason } = detectNarrativeInBlock(block, ext);
 			if (!matched) continue;
@@ -8854,7 +9017,7 @@ const detectRustPatterns = async (context) => {
 };
 //#endregion
 //#region src/engines/ai-slop/silent-recovery.ts
-const JS_EXTS = /* @__PURE__ */ new Set([
+const JS_EXTS$1 = /* @__PURE__ */ new Set([
 	".ts",
 	".tsx",
 	".js",
@@ -9049,7 +9212,7 @@ const detectSilentRecovery = async (context) => {
 	for (const filePath of files) {
 		if (isAutoGenerated(filePath)) continue;
 		const ext = path.extname(filePath);
-		const isJs = JS_EXTS.has(ext);
+		const isJs = JS_EXTS$1.has(ext);
 		if (!isJs && !(ext === ".py")) continue;
 		const relPath = relativePosix(context.rootDirectory, filePath);
 		if (isNonProductionPath(relPath)) continue;
@@ -9334,7 +9497,7 @@ const detectUnusedCss = async (context) => {
 				rule: "ai-slop/unused-css",
 				severity: "warning",
 				message: `CSS class '.${def.name}' is defined but never referenced in the codebase`,
-				help: "Remove the dead CSS rule, or confirm the class is used dynamically (and add an aislop-ignore comment if so)",
+				help: "Remove the dead CSS rule, or confirm the class is used dynamically (and add a raigal-ignore comment if so)",
 				line: def.line,
 				column: 0,
 				category: "AI Slop",
@@ -10324,7 +10487,8 @@ const checkFunctionDiagnostics = (relativePath, fn, limits, ext) => {
 	const results = [];
 	const multiplier = functionLocMultiplier(fn, ext);
 	const fnMax = functionLocBudget(fn, ext, limits.maxFunctionLoc);
-	if (exceedsLimit(fn.lineCount - fn.templateLines, limits.maxFunctionLoc, multiplier)) results.push({
+	const effectiveLineCount = fn.lineCount - fn.templateLines;
+	if (exceedsLimit(effectiveLineCount, limits.maxFunctionLoc, multiplier)) results.push({
 		filePath: relativePath,
 		engine: "code-quality",
 		rule: "complexity/function-too-long",
@@ -10381,10 +10545,10 @@ const checkFileComplexity = (filePath, rootDirectory, limits) => {
 };
 const checkComplexity = async (context) => {
 	const files = getSourceFiles(context);
-	const limits = context.config.quality;
 	const diagnostics = [];
 	for (const filePath of files) {
 		if (isAutoGenerated(filePath)) continue;
+		const { quality: limits } = resolveFilePolicy(context.config, overrideRelativePath(context.rootDirectory, filePath));
 		diagnostics.push(...checkFileComplexity(filePath, context.rootDirectory, limits));
 	}
 	return diagnostics;
@@ -10414,14 +10578,14 @@ const isTrivialLine = (line) => {
 };
 const SVG_MARKUP_RE = /<\/?(?:svg|path|polyline|line|circle|rect|g)\b|(?:xmlns|viewBox|stroke(?:-width|-linecap|-linejoin)?|fill|fill-opacity|d|points|x1|x2|y1|y2)=/;
 const DATA_LITERAL_RE = /^\s*(?:[A-Za-z_$][\w$-]*:\s*(?:["'`[{]|\d|true\b|false\b|null\b)|["'`][^"'`]*["'`],?\s*$|[{}\]],?\s*$|\),?\s*$)/;
-const SUPPRESS_RE = /aislop[- ]ignore(?:-next-block|-file)?\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
-const FILE_SUPPRESS_RE = /aislop[- ]ignore-file\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
+const SUPPRESS_RE = /(?:raigal|aislop)[- ]ignore(?:-next-block|-file)?\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
+const FILE_SUPPRESS_RE = /(?:raigal|aislop)[- ]ignore-file\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
 const fileHasSuppression = (content) => FILE_SUPPRESS_RE.test(content);
 const isLowSignalMarkupWindow = (lines) => {
 	return lines.filter((line) => SVG_MARKUP_RE.test(line)).length >= Math.ceil(WINDOW_SIZE / 2);
 };
 const isLowSignalDataWindow = (lines) => {
-	return lines.filter((line) => DATA_LITERAL_RE.test(line)).length >= WINDOW_SIZE - 1;
+	return lines.filter((line) => DATA_LITERAL_RE.test(line)).length >= 9;
 };
 const findSuppressedLines = (lines) => {
 	const suppressed = /* @__PURE__ */ new Set();
@@ -10453,7 +10617,7 @@ const collectMeaningfulLines = (content) => {
 		if (isLowSignalDataWindow(window)) continue;
 		if (window.every(isTrivialLine)) continue;
 		const normalised = window.map(normaliseLine);
-		if (normalised.filter((n) => n.length > 0 && n !== "}" && n !== "{").length < WINDOW_SIZE - 1) continue;
+		if (normalised.filter((n) => n.length > 0 && n !== "}" && n !== "{").length < 9) continue;
 		if (new Set(normalised).size < MIN_DISTINCT_LINES) continue;
 		hits.push({
 			startLine: i + 1,
@@ -10557,8 +10721,8 @@ const shouldIncludeIssue = (issueType, filePath) => {
 	return !filePath.replace(/\\/g, "/").includes(".github/workflows/");
 };
 const DEPENDENCY_HELP = {
-	dependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `aislop fix`.",
-	devDependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `aislop fix`.",
+	dependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `raigal fix`.",
+	devDependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `raigal fix`.",
 	unlisted: "This package is imported in code but not declared in package.json. Run `npm install` to add it.",
 	unresolved: "This import cannot be resolved. Check for typos or missing packages.",
 	binaries: "This binary is used but its package is not in package.json."
@@ -11276,13 +11440,23 @@ const withReportPath = async (run) => {
 };
 const UNSUPPORTED_GLOB_SYNTAX = /[?[\]{}!|()\\]/;
 const isDotnetFormatPath = (pattern) => !pattern.startsWith("-") && !UNSUPPORTED_GLOB_SYNTAX.test(pattern);
+const expandBraces = (pattern, depth = 0) => {
+	if (depth > 10) return [pattern];
+	const match = /\{([^{}]+)\}/.exec(pattern);
+	if (!match) return [pattern];
+	const [fullMatch, options] = match;
+	const parts = options.split(",");
+	const prefix = pattern.slice(0, match.index);
+	const suffix = pattern.slice(match.index + fullMatch.length);
+	return parts.flatMap((part) => expandBraces(`${prefix}${part}${suffix}`, depth + 1));
+};
 const buildDotnetFormatExcludeScope = (excludePatterns) => {
 	const scope = {
 		excludeArguments: [],
 		unsupportedPatterns: []
 	};
 	for (const pattern of normalizeExcludePatterns(excludePatterns ?? [])) {
-		const expanded = micromatch.braces(pattern, { expand: true });
+		const expanded = expandBraces(pattern);
 		if (expanded.every(isDotnetFormatPath)) scope.excludeArguments.push(...expanded);
 		else scope.unsupportedPatterns.push(pattern);
 	}
@@ -11507,7 +11681,7 @@ const runGofmt = async (context) => {
 			rule: "go-formatting",
 			severity: "warning",
 			message: "Go file is not formatted correctly",
-			help: "Run `aislop fix` to auto-format with gofmt",
+			help: "Run `raigal fix` to auto-format with gofmt",
 			line: 0,
 			column: 0,
 			category: "Format",
@@ -11577,7 +11751,7 @@ const parseRuffFormatOutput = (output, rootDir) => {
 			rule: "python-formatting",
 			severity: "warning",
 			message: "Python file is not formatted correctly",
-			help: "Run `aislop fix` to auto-format with ruff",
+			help: "Run `raigal fix` to auto-format with ruff",
 			line: 0,
 			column: 0,
 			category: "Format",
@@ -11589,7 +11763,8 @@ const parseRuffFormatOutput = (output, rootDir) => {
 const fixRuffFormat = async (context) => {
 	const targets = context.files ? getPythonTargets(context) : [context.rootDirectory];
 	if (context.files && targets.length === 0) return;
-	const result = await runSubprocess(resolveToolBinary("ruff"), ["format", ...targets], {
+	const ruffBinary = resolveToolBinary("ruff");
+	const result = await runSubprocess(ruffBinary, ["format", ...targets], {
 		cwd: context.rootDirectory,
 		timeout: 6e4
 	});
@@ -11659,7 +11834,8 @@ const parseClangTidyOutput = (output, rootDirectory) => {
 const runClangTidy = async (context) => {
 	const compileCommandsDir = findCompileCommandsDir(context);
 	if (!compileCommandsDir) return [];
-	const sources = filterSourcesInDatabase(findCppSources(context).filter((f) => CPP_IMPL_EXTENSIONS.has(path.extname(f).toLowerCase())), readCompileCommandsFiles(compileCommandsDir));
+	const implSources = findCppSources(context).filter((f) => CPP_IMPL_EXTENSIONS.has(path.extname(f).toLowerCase()));
+	const sources = filterSourcesInDatabase(implSources, readCompileCommandsFiles(compileCommandsDir));
 	if (sources.length === 0) return [];
 	const diagnostics = [];
 	for (const chunk of chunkFilePaths(sources, CLANG_TIDY_CHUNK_MAX_FILES)) try {
@@ -12029,7 +12205,7 @@ const runExpoDoctor = async (context) => {
 		rule: "expo-doctor/config-error",
 		severity: "warning",
 		message: configError,
-		help: "Install project dependencies, then re-run `aislop scan`.",
+		help: "Install project dependencies, then re-run `raigal scan`.",
 		line: 0,
 		column: 0,
 		category: "Expo",
@@ -12495,7 +12671,8 @@ const processFile = (filePath, fileTargets, result) => {
 			});
 			continue;
 		}
-		const { edit, skipReason } = computeEdit(sourceFile, classifyIdentifier(best));
+		const shape = classifyIdentifier(best);
+		const { edit, skipReason } = computeEdit(sourceFile, shape);
 		if (!edit) {
 			pendingSkips.push({
 				target,
@@ -13076,7 +13253,7 @@ const normalizeEslintIgnorePatterns = (patterns) => patterns.map((pattern) => pa
 	if (!pattern.includes("*") && !path.extname(pattern)) return [`${pattern}/**`];
 	return [pattern];
 });
-const isEslintIgnored = (relativePath, patterns) => patterns.length > 0 && micromatch.isMatch(relativePath, patterns, { dot: true });
+const isEslintIgnored = (relativePath, patterns) => patterns.length > 0 && picomatch.isMatch(relativePath, patterns, { dot: true });
 const getOxlintTargets = (context) => {
 	const eslintIgnorePatterns = normalizeEslintIgnorePatterns(collectEslintIgnorePatterns(context.rootDirectory));
 	return getSourceFiles(context).filter((filePath) => OXLINT_EXTENSIONS.has(path.extname(filePath).toLowerCase())).filter((filePath) => !isAutoGenerated(filePath)).map((filePath) => path.relative(context.rootDirectory, filePath).split(path.sep).join("/")).filter((filePath) => !isEslintIgnored(filePath, eslintIgnorePatterns));
@@ -13310,7 +13487,8 @@ const ruffLintFixArgs = (context, unsafe) => {
 };
 const fixRuffLint = async (context) => {
 	if (context.files && getPythonTargets(context).length === 0) return;
-	const result = await runSubprocess(resolveToolBinary("ruff"), ruffLintFixArgs(context, false), {
+	const ruffBinary = resolveToolBinary("ruff");
+	const result = await runSubprocess(ruffBinary, ruffLintFixArgs(context, false), {
 		cwd: context.rootDirectory,
 		timeout: 6e4
 	});
@@ -13318,7 +13496,8 @@ const fixRuffLint = async (context) => {
 };
 const fixRuffLintForce = async (context) => {
 	if (context.files && getPythonTargets(context).length === 0) return;
-	const result = await runSubprocess(resolveToolBinary("ruff"), ruffLintFixArgs(context, true), {
+	const ruffBinary = resolveToolBinary("ruff");
+	const result = await runSubprocess(ruffBinary, ruffLintFixArgs(context, true), {
 		cwd: context.rootDirectory,
 		timeout: 6e4
 	});
@@ -13407,6 +13586,174 @@ const lintEngine = {
 	}
 };
 //#endregion
+//#region src/engines/security/ai-security.ts
+const JS_EXTS = /* @__PURE__ */ new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mjs",
+	".cjs"
+]);
+const PY_EXTS = /* @__PURE__ */ new Set([".py"]);
+const UNICODE_TAG_RE = /[\u{E0000}-\u{E007F}]/gu;
+const hasRuleIgnore = (lines, lineIndex, ruleSuffix) => {
+	const start = Math.max(0, lineIndex - 2);
+	const re = new RegExp(`(?:raigal|aislop)[- ]ignore(?:-file)?\\b.*(?:${ruleSuffix}|security\\/${ruleSuffix})`, "i");
+	return lines.slice(start, lineIndex + 1).some((line) => re.test(line));
+};
+const hasFileIgnore = (lines, ruleSuffix) => {
+	const re = new RegExp(`(?:raigal|aislop)[- ]ignore-file\\b.*(?:${ruleSuffix}|security\\/${ruleSuffix})`, "i");
+	return lines.slice(0, 10).some((line) => re.test(line));
+};
+const makeDiagnostic = (filePath, rule, message, help, line, column) => ({
+	filePath,
+	engine: "security",
+	rule,
+	severity: "error",
+	message,
+	help,
+	line,
+	column,
+	category: "Security",
+	fixable: false
+});
+const P_BYPASS = "bypassPermissions";
+const P_EXEC_TYPE = "executor_type";
+const P_LOCAL = "local";
+const P_USE_DOCKER = "use_docker";
+const P_AUTO_RUN = "auto_run";
+const P_UNSAFE_MODE = "unsafe_mode";
+const P_PYTHON_REPL = "PythonREPLTool";
+const UNSANDBOXED_TOOL_PATTERNS = [
+	{
+		pattern: new RegExp(`\\bpermission_?mode["']?\\s*[:=]\\s*["']${P_BYPASS}["']`, "i"),
+		message: `permission_mode '${P_BYPASS}' bypasses agent sandboxing and human confirmation`,
+		help: `Do not use ${P_BYPASS} mode in production; use standard interactive approval`
+	},
+	{
+		pattern: new RegExp(`\\b${P_EXEC_TYPE}["']?\\s*[:=]\\s*["']${P_LOCAL}["']`, "i"),
+		message: `${P_EXEC_TYPE}='${P_LOCAL}' executes LLM-generated code directly on host machine without container isolation`,
+		help: "Configure agent to use DockerCommandLineCodeExecutor or a containerized sandbox environment"
+	},
+	{
+		pattern: new RegExp(`\\b(?:LocalCommandLineCodeExecutor|LocalCodeExecutor)\\s*\\(`),
+		message: "Local code executor executes LLM-generated code on host machine without container isolation",
+		help: "Use DockerCommandLineCodeExecutor or an isolated execution sandbox"
+	},
+	{
+		pattern: new RegExp(`\\b${P_USE_DOCKER}\\s*[:=]\\s*(?:False|false)\\b|["']${P_USE_DOCKER}["']\\s*:\\s*(?:False|false)\\b`),
+		message: `${P_USE_DOCKER}=False disables container sandboxing for agent code execution`,
+		help: `Set ${P_USE_DOCKER}=True to isolate agent execution inside Docker containers`
+	},
+	{
+		pattern: new RegExp(`\\b(?:interpreter\\.)?${P_AUTO_RUN}\\s*[:=]\\s*(?:True|true)\\b`),
+		message: `${P_AUTO_RUN}=True allows autonomous shell execution without human confirmation`,
+		help: `Keep ${P_AUTO_RUN}=False so dangerous commands require explicit human review`
+	},
+	{
+		pattern: new RegExp(`\\bCodeInterpreterTool\\s*\\([^)]*${P_UNSAFE_MODE}\\s*=\\s*(?:True|true)\\b|\\b${P_UNSAFE_MODE}\\s*[:=]\\s*(?:True|true)\\b`),
+		message: `${P_UNSAFE_MODE}=True allows code interpreter tool to execute without Docker isolation`,
+		help: `Disable ${P_UNSAFE_MODE} and isolate code execution in containerized environments`
+	},
+	{
+		pattern: new RegExp(`\\b(?:${P_PYTHON_REPL}|PythonAstREPLTool)\\s*\\(`),
+		message: `${P_PYTHON_REPL} executes arbitrary Python code in host process without container isolation`,
+		help: `Use containerized sandbox execution rather than unconfined ${P_PYTHON_REPL} in production`
+	}
+];
+const P_SYS = "system";
+const P_DEV = "developer";
+const P_SM = "SystemMessage";
+const PROMPT_INJECTION_JS_PATTERNS = [
+	new RegExp(`(?:role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?content\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`)`, "g"),
+	new RegExp(`(?:content\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`[^}{;]{0,120}?role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`(?:role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?content\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["']))`, "g"),
+	new RegExp(`(?:content\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["'])[^}{;]{0,120}?role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`\\b(?:${P_SYS}|systemPrompt|system_prompt|system_instruction)\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\``, "g"),
+	new RegExp(`\\b(?:${P_SYS}|systemPrompt|system_prompt|system_instruction)\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["'])`, "g"),
+	new RegExp(`\\b(?:new\\s+)?${P_SM}\\s*\\(\\s*(?:\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`|["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["']|\\{\\s*content\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`)`, "g"),
+	new RegExp(`\\[\\s*["']${P_SYS}["']\\s*,\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`\\s*\\]`, "g")
+];
+const PROMPT_INJECTION_PY_PATTERNS = [
+	new RegExp(`(?:["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?["']content["']\\s*:\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["']))`, "g"),
+	new RegExp(`(?:["']content["']\\s*:\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])[^}{;]{0,120}?["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`(?:["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?["']content["']\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\())`, "g"),
+	new RegExp(`(?:["']content["']\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\()[^}{;]{0,120}?["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`\\b(?:${P_SYS}|system_prompt|system_message|system_instruction)\\s*=\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])`, "g"),
+	new RegExp(`\\b(?:${P_SYS}|system_prompt|system_message|system_instruction)\\s*=\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\()`, "g"),
+	new RegExp(`\\b${P_SM}\\s*\\(\\s*(?:content\\s*=\\s*)?f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])`, "g"),
+	new RegExp(`\\b${P_SM}\\s*\\(\\s*(?:content\\s*=\\s*)?(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\()`, "g"),
+	new RegExp(`\\(\\s*["']${P_SYS}["']\\s*,\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])\\s*\\)`, "g")
+];
+const checkInvisibleUnicode = (relPath, content, lines) => {
+	if (hasFileIgnore(lines, "invisible-unicode-tags")) return [];
+	const results = [];
+	const tagRegex = new RegExp(UNICODE_TAG_RE.source, UNICODE_TAG_RE.flags);
+	for (const match of content.matchAll(tagRegex)) {
+		const matchIndex = match.index ?? 0;
+		const line = content.slice(0, matchIndex).split("\n").length;
+		const col = matchIndex - content.lastIndexOf("\n", matchIndex - 1);
+		if (hasRuleIgnore(lines, line - 1, "invisible-unicode-tags")) continue;
+		results.push(makeDiagnostic(relPath, "security/invisible-unicode-tags", "Invisible Unicode Tag character (U+E0000-U+E007F) detected: potential stealth prompt injection or ASCII smuggling", "Remove invisible Unicode tag characters. Unicode Tag block (U+E0000-U+E007F) has no legitimate printable presentation in source code", line, col));
+	}
+	return results;
+};
+const checkUnsandboxedTools = (relPath, content, lines) => {
+	if (hasFileIgnore(lines, "unsandboxed-agent-tool")) return [];
+	const results = [];
+	for (const { pattern, message, help } of UNSANDBOXED_TOOL_PATTERNS) {
+		const regex = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`);
+		for (const match of content.matchAll(regex)) {
+			const matchIndex = match.index ?? 0;
+			const line = content.slice(0, matchIndex).split("\n").length;
+			const col = matchIndex - content.lastIndexOf("\n", matchIndex - 1);
+			if (hasRuleIgnore(lines, line - 1, "unsandboxed-agent-tool")) continue;
+			results.push(makeDiagnostic(relPath, "security/unsandboxed-agent-tool", message, help, line, col));
+		}
+	}
+	return results;
+};
+const checkPromptInjection = (relPath, content, lines, isJs) => {
+	if (hasFileIgnore(lines, "prompt-injection")) return [];
+	const results = [];
+	const patterns = isJs ? PROMPT_INJECTION_JS_PATTERNS : PROMPT_INJECTION_PY_PATTERNS;
+	for (const pattern of patterns) {
+		const regex = new RegExp(pattern.source, pattern.flags);
+		for (const match of content.matchAll(regex)) {
+			const matchIndex = match.index ?? 0;
+			const line = content.slice(0, matchIndex).split("\n").length;
+			const col = matchIndex - content.lastIndexOf("\n", matchIndex - 1);
+			if (hasRuleIgnore(lines, line - 1, "prompt-injection")) continue;
+			results.push(makeDiagnostic(relPath, "security/prompt-injection", "Untrusted variable interpolation into system prompt creates prompt injection vulnerability", "Keep system prompts static. Pass dynamic user inputs via user messages or input parameters with strict delimiters", line, col));
+		}
+	}
+	return results;
+};
+const scanAiSecurity = async (context) => {
+	const files = getSourceFiles(context);
+	const diagnostics = [];
+	for (const filePath of files) {
+		const ext = path.extname(filePath);
+		let content;
+		try {
+			content = fs.readFileSync(filePath, "utf-8");
+		} catch {
+			continue;
+		}
+		const relativePath = relativePosix(context.rootDirectory, filePath);
+		const lines = content.split("\n");
+		diagnostics.push(...checkInvisibleUnicode(relativePath, content, lines));
+		const isJs = JS_EXTS.has(ext);
+		const isPy = PY_EXTS.has(ext);
+		if (isJs || isPy) {
+			diagnostics.push(...checkUnsandboxedTools(relativePath, content, lines));
+			diagnostics.push(...checkPromptInjection(relativePath, content, lines, isJs));
+		}
+	}
+	return diagnostics;
+};
+//#endregion
 //#region src/engines/security/audit-value.ts
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const readString = (record, key) => {
@@ -13786,7 +14133,7 @@ const parseJsAudit = (output, source, manifest) => {
 			rule: "security/dependency-audit-skipped",
 			severity: "info",
 			message: `Dependency audit skipped (${source}): lockfile is missing`,
-			help: errorDetail ?? "Generate a lockfile, then re-run `aislop scan` for dependency vulnerability checks.",
+			help: errorDetail ?? "Generate a lockfile, then re-run `raigal scan` for dependency vulnerability checks.",
 			line: 0,
 			column: 0,
 			category: "Security",
@@ -13897,7 +14244,8 @@ const readRuntimeDependencies = (rootDir) => {
 	collectRuntimeNames(rootManifest, names);
 	const globs = [...npmWorkspaceGlobs(rootManifest), ...pnpmWorkspaceGlobs(rootDir)];
 	if (globs.length === 0) return { runtimeDependencies: names };
-	for (const relativeDir of micromatch(listPackageDirectories(rootDir), globs)) {
+	const isMatch = picomatch(globs, { dot: true });
+	for (const relativeDir of listPackageDirectories(rootDir).filter((dir) => isMatch(dir))) {
 		const memberManifest = readJsonFile(path.join(rootDir, relativeDir, "package.json"));
 		if (memberManifest) collectRuntimeNames(memberManifest, names);
 	}
@@ -13959,10 +14307,11 @@ const auditSkippedDiagnostic = (source, help) => ({
 });
 const runNpmAudit = async (rootDir, timeout) => {
 	try {
-		return parseJsAudit((await runSubprocess("npm", ["audit", "--json"], {
+		const result = await runSubprocess("npm", ["audit", "--json"], {
 			cwd: rootDir,
 			timeout
-		})).stdout, "npm audit", readRuntimeDependencies(rootDir));
+		});
+		return parseJsAudit(result.stdout, "npm audit", readRuntimeDependencies(rootDir));
 	} catch (error) {
 		return [auditSkippedDiagnostic("npm audit", `Failed to run npm audit: ${errorMessageOf(error)}`)];
 	}
@@ -13983,10 +14332,11 @@ const runBunAudit = async (rootDir, timeout) => {
 const runPnpmAuditWithFallback = async (rootDir, timeout) => {
 	const canFallbackToNpm = fs.existsSync(path.join(rootDir, "package-lock.json"));
 	try {
-		const diagnostics = parseJsAudit((await runSubprocess("pnpm", ["audit", "--json"], {
+		const result = await runSubprocess("pnpm", ["audit", "--json"], {
 			cwd: rootDir,
 			timeout
-		})).stdout, "pnpm audit", readRuntimeDependencies(rootDir));
+		});
+		const diagnostics = parseJsAudit(result.stdout, "pnpm audit", readRuntimeDependencies(rootDir));
 		if (diagnostics.some((d) => d.rule === "security/dependency-audit-skipped")) {
 			if (canFallbackToNpm) return runNpmAudit(rootDir, timeout);
 			return diagnostics;
@@ -14343,7 +14693,7 @@ const RISKY_PATTERNS = [
 //#region src/engines/security/risky.ts
 const hasDangerouslySetInnerHtmlIgnore = (lines, lineIndex) => {
 	const start = Math.max(0, lineIndex - 2);
-	return lines.slice(start, lineIndex + 1).some((line) => /(?:biome-ignore|eslint-disable|aislop-ignore).*(?:noDangerouslySetInnerHtml|dangerouslySetInnerHTML|dangerously-set-innerhtml)/i.test(line));
+	return lines.slice(start, lineIndex + 1).some((line) => /(?:biome-ignore|eslint-disable|raigal-ignore|aislop-ignore).*(?:noDangerouslySetInnerHtml|dangerouslySetInnerHTML|dangerously-set-innerhtml)/i.test(line));
 };
 const isStructuredDataScript = (content, matchIndex) => {
 	const before = content.slice(Math.max(0, matchIndex - 300), matchIndex);
@@ -14671,7 +15021,11 @@ const ALL_ENGINES = [
 		name: "security",
 		async run(context) {
 			const diagnostics = [];
-			const promises = [scanSecrets(context), detectRiskyConstructs(context)];
+			const promises = [
+				scanSecrets(context),
+				detectRiskyConstructs(context),
+				scanAiSecurity(context)
+			];
 			if (context.config.security.audit) promises.push(runDependencyAudit(context));
 			const results = await Promise.allSettled(promises);
 			for (const result of results) if (result.status === "fulfilled") diagnostics.push(...result.value);
@@ -14693,6 +15047,7 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 			const result = await engine.run(context);
 			result.diagnostics = filterExcludedDiagnostics(result.diagnostics, context.rootDirectory, context.excludePatterns);
 			result.elapsed = performance.now() - start;
+			result.diagnostics = applyFileOverrides(result.diagnostics, context);
 			onComplete?.(result);
 			return result;
 		} catch (error) {
@@ -14701,6 +15056,7 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 				diagnostics: [],
 				elapsed: performance.now() - start,
 				skipped: true,
+				failed: true,
 				skipReason: error instanceof Error ? error.message : String(error)
 			};
 			onComplete?.(result);
@@ -14711,9 +15067,13 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 		diagnostics: [],
 		elapsed: 0,
 		skipped: true,
+		failed: true,
 		skipReason: r.reason instanceof Error ? r.reason.message : String(r.reason)
 	});
-	return dedupeEquivalenceDiagnostics(dedupeOverlappingComments(dedupeCSharpAsync(stripSecretDiagnostics(finalResults))));
+	const stripped = stripSecretDiagnostics(finalResults);
+	const csharp = dedupeCSharpAsync(stripped);
+	const comments = dedupeOverlappingComments(csharp);
+	return dedupeEquivalenceDiagnostics(comments);
 };
 const stripSecretDiagnostics = (results) => {
 	for (const result of results) for (const d of result.diagnostics) if (d.redactSource || isSecretClassRule(d.rule)) {
@@ -14762,7 +15122,8 @@ const calculateScore = (diagnostics, weights, thresholds, sourceFileCount, smoot
 	const capScale = Math.max(1, fileCount.effectiveSourceFileCount / CAP_REFERENCE_FILES);
 	const defaultRuleCap = typeof maxPerRule === "number" && maxPerRule > 0 ? maxPerRule : null;
 	const capForRule = (key) => {
-		const ruleCap = scoreImpactForRule(key.slice(key.indexOf(":") + 1)).cap;
+		const rule = key.slice(key.indexOf(":") + 1);
+		const ruleCap = scoreImpactForRule(rule).cap;
 		if (typeof ruleCap === "number") return defaultRuleCap ? Math.min(defaultRuleCap, ruleCap) : ruleCap;
 		return defaultRuleCap;
 	};
@@ -14929,6 +15290,10 @@ const SAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set([
 	"exit_code",
 	"duration_ms",
 	"error_kind",
+	"error_name",
+	"error_code",
+	"failed_stage",
+	"engines_failed",
 	"score",
 	"score_bucket",
 	"finding_count",
@@ -15042,10 +15407,11 @@ const track = (input) => {
 		cachedInstallId = ensured.installId;
 		installCreated = ensured.created;
 	}
-	const { clean, dropped } = redactProperties({
+	const merged = {
 		...baseProperties(cachedInstallId),
 		...input.properties
-	});
+	};
+	const { clean, dropped } = redactProperties(merged);
 	if (isDebug()) {
 		const compact = JSON.stringify({
 			event: input.event,
@@ -15157,6 +15523,8 @@ const buildCommandCompletedProps = (input) => {
 	if (typeof input.fixSteps === "number") props.fix_steps = input.fixSteps;
 	if (typeof input.fixResolved === "number") props.fix_resolved = input.fixResolved;
 	if (typeof input.fixScoreDelta === "number") props.fix_score_delta = input.fixScoreDelta;
+	if (input.errorName) props.error_name = input.errorName;
+	if (input.errorCode) props.error_code = input.errorCode;
 	return props;
 };
 const errorKindFromException = (error) => {
@@ -15166,6 +15534,26 @@ const errorKindFromException = (error) => {
 	if (message.includes("engine") && message.includes("crash")) return "engine_crash";
 	return "unknown";
 };
+const SAFE_ERROR_NAME = /^[A-Za-z_$][A-Za-z0-9_$]{0,39}$/;
+const SAFE_ERROR_CODE = /^[A-Za-z][A-Za-z0-9_]{0,39}$/;
+const errorIdentity = (error) => {
+	let name;
+	if (error instanceof Error && typeof error.name === "string" && error.name.length > 0) name = error.name;
+	else if (error === null) name = "null";
+	else if (typeof error === "object") name = "object";
+	else name = typeof error;
+	const identity = { error_name: SAFE_ERROR_NAME.test(name) ? name : "Error" };
+	const code = error?.code;
+	if (typeof code === "string" && SAFE_ERROR_CODE.test(code)) identity.error_code = code;
+	else if (typeof code === "number" && Number.isFinite(code)) identity.error_code = String(code);
+	return identity;
+};
+//#endregion
+//#region src/telemetry/fatal.ts
+const reportedErrors = /* @__PURE__ */ new Set();
+const markErrorReported = (error) => {
+	reportedErrors.add(error);
+};
 //#endregion
 //#region src/telemetry/lifecycle.ts
 const STARTED_FLUSH_TIMEOUT_MS = 100;
@@ -15176,6 +15564,7 @@ const withCommandLifecycle = async (start, run) => {
 		fileCount: start.fileCount,
 		properties: start.properties
 	});
+	start.config;
 	track({
 		event: "cli_command_started",
 		properties: startProps,
@@ -15192,6 +15581,7 @@ const withCommandLifecycle = async (start, run) => {
 				startProps,
 				exitCode: result.exitCode,
 				durationMs,
+				errorKind: result.errorKind,
 				score: result.score ?? void 0,
 				findingCount: result.findingCount,
 				errorCount: result.errorCount,
@@ -15209,16 +15599,21 @@ const withCommandLifecycle = async (start, run) => {
 		await flushTelemetry();
 		return result;
 	} catch (error) {
+		const durationMs = performance.now() - startedAt;
+		const identity = errorIdentity(error);
 		track({
 			event: "cli_command_completed",
 			properties: buildCommandCompletedProps({
 				startProps,
 				exitCode: 1,
-				durationMs: performance.now() - startedAt,
-				errorKind: errorKindFromException(error)
+				durationMs,
+				errorKind: errorKindFromException(error),
+				errorName: identity.error_name,
+				errorCode: identity.error_code
 			}),
 			config: start.config
 		});
+		markErrorReported(error);
 		await flushTelemetry();
 		throw error;
 	}
@@ -15296,14 +15691,17 @@ const renderRailStep = (step, deps = {}) => {
 * between the last step and the footer.
 */
 const renderRailConnector = (deps = {}) => {
-	return ` ${style(deps.theme ?? theme, "accentDim", (deps.symbols ?? symbols).rail)}\n`;
+	const t = deps.theme ?? theme;
+	const s = deps.symbols ?? symbols;
+	return ` ${style(t, "accentDim", s.rail)}\n`;
 };
 /**
 * Render the rail-end footer line ("└  <footer text>").
 */
 const renderRailFooter = (footer, deps = {}) => {
 	const t = deps.theme ?? theme;
-	return ` ${style(t, "accentDim", (deps.symbols ?? symbols).railEnd)}  ${highlightAislop(footer, t)}\n`;
+	const s = deps.symbols ?? symbols;
+	return ` ${style(t, "accentDim", s.railEnd)}  ${highlightAislop(footer, t)}\n`;
 };
 const renderRail = (input, deps = {}) => {
 	const t = deps.theme ?? theme;
@@ -15430,7 +15828,8 @@ var LiveRail = class {
 */
 const renderHintLine = (hint, deps = {}) => {
 	const t = deps.theme ?? theme;
-	return ` ${style(t, "accent", (deps.symbols ?? symbols).hint)} ${highlightAislop(maskSecrets(hint), t)}\n`;
+	const s = deps.symbols ?? symbols;
+	return ` ${style(t, "accent", s.hint)} ${highlightAislop(maskSecrets(hint), t)}\n`;
 };
 const createLogger = (deps = {}) => {
 	const t = deps.theme ?? theme;
@@ -15575,7 +15974,8 @@ const groupByFile = (diagnostics) => {
 	});
 };
 const isInstalled = (bin) => {
-	return spawnSync(process.platform === "win32" ? "where" : "which", [bin], { encoding: "utf-8" }).status === 0;
+	const cmd = process.platform === "win32" ? "where" : "which";
+	return spawnSync(cmd, [bin], { encoding: "utf-8" }).status === 0;
 };
 const copyToClipboard = (text) => {
 	const args = {
@@ -15714,7 +16114,9 @@ const createEngineContext = (rootDirectory, projectInfo, config, options = {}) =
 		quality: config.quality,
 		security: config.security,
 		lint: config.lint,
-		engines: config.engines
+		engines: config.engines,
+		overrides: config.overrides,
+		rules: config.rules
 	},
 	...options.scope ? {
 		files: options.scope.files,
@@ -16056,7 +16458,9 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	if (!header.kid) throw new JwtVerificationError("JWT header missing 'kid'", "unknown_kid");
 	const publicKey = getPublicKey(header.kid);
 	if (!publicKey) throw new JwtVerificationError(`Unknown or untrusted signing key id (kid: ${header.kid})`, "unknown_kid");
-	if (!verify(null, Buffer.from(`${headerB64}.${payloadB64}`, "utf-8"), publicKey, Buffer.from(signatureB64, "base64url"))) throw new JwtVerificationError("Invalid JWT cryptographic signature", "invalid_signature");
+	const signedData = Buffer.from(`${headerB64}.${payloadB64}`, "utf-8");
+	const signature = Buffer.from(signatureB64, "base64url");
+	if (!verify(null, signedData, publicKey, signature)) throw new JwtVerificationError("Invalid JWT cryptographic signature", "invalid_signature");
 	let rawPayload;
 	try {
 		rawPayload = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf-8"));
@@ -16068,7 +16472,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const claims = parsed.data;
 	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
 	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.2.0", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (!isVersionAtLeast("0.2.3", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -16102,7 +16506,7 @@ const fetchGitHubOidcToken = async () => {
 };
 //#endregion
 //#region src/cloud/entitlement.ts
-const GRACE_PERIOD_SECONDS = 4320 * 60;
+const GRACE_PERIOD_SECONDS = 259200;
 var MissingCredentialError = class extends Error {
 	constructor(message = "No organization credential found") {
 		super(message);
@@ -16182,6 +16586,10 @@ const handleEntitlementFetchError = (err, cached, cachedClaims, now) => {
 			nowSeconds: now,
 			allowGraceSeconds: GRACE_PERIOD_SECONDS
 		});
+		if (graceClaims.plan === "trial" && graceClaims.trial_ends_at && now > Math.floor(new Date(graceClaims.trial_ends_at).getTime() / 1e3)) {
+			clearCachedEntitlement();
+			throw new LicenceDeniedError("Organization trial has expired", "trial_expired");
+		}
 		return {
 			jwt: cached.entitlement,
 			claims: graceClaims,
@@ -16189,6 +16597,7 @@ const handleEntitlementFetchError = (err, cached, cachedClaims, now) => {
 			grace: now > graceClaims.exp
 		};
 	} catch (jwtErr) {
+		if (jwtErr instanceof LicenceDeniedError) throw jwtErr;
 		if (jwtErr instanceof JwtVerificationError && jwtErr.code === "expired_beyond_grace") throw new LicenceUnverifiableError(`Raigal license could not be verified online and the offline grace period expired on ${(/* @__PURE__ */ new Date((cachedClaims?.exp ?? 0) * 1e3)).toISOString()}. Check network connectivity or Raigal Cloud status.`);
 	}
 	throw new LicenceUnverifiableError(`Raigal license could not be verified online (${err instanceof Error ? err.message : String(err)}). Check network connectivity or Raigal Cloud status.`);
@@ -16203,7 +16612,8 @@ const getEntitlement = async () => {
 	} catch {
 		cachedClaims = null;
 	}
-	if (cached && cachedClaims && now < cached.refresh_after) return {
+	const isTrialExpired = cachedClaims?.plan === "trial" && cachedClaims.trial_ends_at && now > Math.floor(new Date(cachedClaims.trial_ends_at).getTime() / 1e3);
+	if (cached && cachedClaims && !isTrialExpired && now < cached.refresh_after) return {
 		jwt: cached.entitlement,
 		claims: cachedClaims,
 		fromCache: true
@@ -16212,7 +16622,7 @@ const getEntitlement = async () => {
 	if (!activeToken) {
 		oidcToken = await fetchGitHubOidcToken();
 		if (!oidcToken) {
-			if (cached && cachedClaims) return {
+			if (cached && cachedClaims && !isTrialExpired) return {
 				jwt: cached.entitlement,
 				claims: cachedClaims,
 				fromCache: true
@@ -16221,7 +16631,8 @@ const getEntitlement = async () => {
 		}
 	} else oidcToken = await fetchGitHubOidcToken();
 	try {
-		const response = await fetchEntitlementFromApi(activeToken?.token ?? "", oidcToken);
+		const tokenToPass = activeToken?.token ?? "";
+		const response = await fetchEntitlementFromApi(tokenToPass, oidcToken);
 		const claims = verifyEntitlementJwt(response.entitlement, { nowSeconds: now });
 		saveCachedEntitlement(response.entitlement, response.refresh_after);
 		return {
@@ -16235,7 +16646,7 @@ const getEntitlement = async () => {
 };
 //#endregion
 //#region src/cloud/owner.ts
-const GITHUB_REMOTE_RE = /^(?:(?:git@|ssh:\/\/(?:git@)?)github\.com(?::(?:\d+\/)?|[:/])|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/.\s]+?)(?:\.git)?\s*$/;
+const GITHUB_REMOTE_RE = /^(?:(?:git@|ssh:\/\/(?:git@)?)github\.com(?::(?:\d+\/)?|[:/])|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/\s]+?)(?:\.git)?\s*$/;
 const parseGitRemote = (rawUrl) => {
 	if (!rawUrl) return {
 		owner: null,
@@ -16373,6 +16784,23 @@ const requireEntitlement = async (options = {}) => {
 	try {
 		const entitlement = await getEntitlement();
 		const tokenKind = getActiveToken()?.kind ?? "session";
+		if (entitlement.claims.plan === "trial" && entitlement.claims.trial_ends_at) {
+			const trialEnd = new Date(entitlement.claims.trial_ends_at).getTime();
+			if (Date.now() > trialEnd) {
+				const message = "Raigal license denied: Organization trial has expired";
+				if (mode === "throw") throw new LicenceDeniedError(message, "trial_expired");
+				if (mode === "fatal") {
+					process.stderr.write(`${message}\n`);
+					process.exit(30);
+				}
+				process.stderr.write(`[raigal] ${message}\n`);
+				return {
+					ok: false,
+					exitCode: 30,
+					message
+				};
+			}
+		}
 		const detectedOwner = detectLocalRepoOwner(directory);
 		if (options.repoOwner) detectedOwner.owner = options.repoOwner.toLowerCase();
 		const ownerCheck = checkOwnerAgainstAllowlist(detectedOwner, entitlement.claims.allowed_owners, tokenKind);
@@ -16747,7 +17175,8 @@ const fixNarrativeComments = async (context) => {
 		for (let i = 0; i < lines.length; i += 1) if (!toRemove.has(i + 1)) kept.push(lines[i]);
 		const newContent = kept.join("\n");
 		if (newContent !== content) {
-			if (!areLiteralMultisetsEqual(beforeLiterals, extractStringAndTemplateLiterals(newContent, ext))) continue;
+			const afterLiterals = extractStringAndTemplateLiterals(newContent, ext);
+			if (!areLiteralMultisetsEqual(beforeLiterals, afterLiterals)) continue;
 			fs.writeFileSync(filePath, newContent);
 		}
 	}
@@ -16929,6 +17358,56 @@ const computeRemovalRange = (sourceFile, node, content) => {
 		end: finalEnd
 	};
 };
+const isReferencedOutside = (sourceFile, statement, name) => {
+	const start = statement.getStart(sourceFile);
+	const end = statement.getEnd();
+	let found = false;
+	const visit = (node) => {
+		if (found) return;
+		if (ts.isIdentifier(node) && node.text === name) {
+			const pos = node.getStart(sourceFile);
+			if (pos < start || pos >= end) found = true;
+			return;
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return found;
+};
+const exportKeywordRange = (sourceFile, statement, content) => {
+	const modifiers = ts.canHaveModifiers(statement) ? ts.getModifiers(statement) ?? [] : [];
+	if (modifiers.some((m) => m.kind === ts.SyntaxKind.DefaultKeyword)) return null;
+	const exportKeyword = modifiers.find((m) => m.kind === ts.SyntaxKind.ExportKeyword);
+	if (!exportKeyword) return null;
+	let end = exportKeyword.getEnd();
+	while (end < content.length && (content[end] === " " || content[end] === "	")) end++;
+	return {
+		start: exportKeyword.getStart(sourceFile),
+		end
+	};
+};
+const removalFor = (sourceFile, statement, content, decl) => {
+	if (!isReferencedOutside(sourceFile, statement, decl.name)) return null;
+	const range = exportKeywordRange(sourceFile, statement, content);
+	if (!range) return {
+		type: "skip",
+		reason: "still referenced in its own file",
+		declaration: decl
+	};
+	return {
+		type: "match",
+		removal: {
+			...range,
+			declaration: decl
+		}
+	};
+};
+const declaredNames = (statement) => {
+	if (ts.isVariableStatement(statement)) return statement.declarationList.declarations.map((d) => ts.isIdentifier(d.name) ? d.name.text : null).filter((name) => name !== null);
+	if (ts.isFunctionDeclaration(statement) || ts.isClassDeclaration(statement) || ts.isInterfaceDeclaration(statement) || ts.isTypeAliasDeclaration(statement) || ts.isEnumDeclaration(statement) || ts.isModuleDeclaration(statement)) return statement.name && ts.isIdentifier(statement.name) ? [statement.name.text] : [];
+	return [];
+};
+const isDeclaredMoreThanOnce = (sourceFile, name) => sourceFile.statements.filter((s) => declaredNames(s).includes(name)).length > 1;
 const kindOfStatement = (node) => {
 	if (ts.isVariableStatement(node)) return "variable";
 	if (ts.isFunctionDeclaration(node)) return "function";
@@ -16940,6 +17419,11 @@ const kindOfStatement = (node) => {
 };
 const matchStatement = (sourceFile, statement, content, decl) => {
 	if (!kindOfStatement(statement)) return { type: "none" };
+	if (declaredNames(statement).includes(decl.name) && isDeclaredMoreThanOnce(sourceFile, decl.name)) return {
+		type: "skip",
+		reason: "merged declaration",
+		declaration: decl
+	};
 	if (ts.isVariableStatement(statement)) {
 		const varDecls = statement.declarationList.declarations;
 		if (varDecls.length === 0) return { type: "none" };
@@ -16955,6 +17439,8 @@ const matchStatement = (sourceFile, statement, content, decl) => {
 			reason: "multi-declaration variable statement",
 			declaration: decl
 		};
+		const referenced = removalFor(sourceFile, statement, content, decl);
+		if (referenced) return referenced;
 		if (initializerHasSideEffects(match.initializer)) return {
 			type: "skip",
 			reason: "initializer may have side effects",
@@ -16972,6 +17458,8 @@ const matchStatement = (sourceFile, statement, content, decl) => {
 		if (!statement.name) return { type: "none" };
 		if (statement.name.text !== decl.name) return { type: "none" };
 		if (!nodeContainsLine(sourceFile, statement, decl.line)) return { type: "none" };
+		const referenced = removalFor(sourceFile, statement, content, decl);
+		if (referenced) return referenced;
 		return {
 			type: "match",
 			removal: {
@@ -16983,6 +17471,8 @@ const matchStatement = (sourceFile, statement, content, decl) => {
 	if (ts.isTypeAliasDeclaration(statement) || ts.isInterfaceDeclaration(statement) || ts.isEnumDeclaration(statement)) {
 		if (statement.name.text !== decl.name) return { type: "none" };
 		if (!nodeContainsLine(sourceFile, statement, decl.line)) return { type: "none" };
+		const referenced = removalFor(sourceFile, statement, content, decl);
+		if (referenced) return referenced;
 		return {
 			type: "match",
 			removal: {
@@ -17056,7 +17546,7 @@ const detectUnusedDeclarations = async (context) => {
 			rule: "code-quality/unused-declaration",
 			severity: "warning",
 			message: `Unused ${extracted.kind}: ${extracted.name}`,
-			help: "This top-level declaration is never used; aislop will remove it.",
+			help: "This top-level declaration is never used; raigal will remove it.",
 			line: d.line,
 			column: d.column,
 			category: "Dead Code",
@@ -17074,7 +17564,7 @@ const detectUnusedDeclarations = async (context) => {
 			rule: "code-quality/unused-declaration",
 			severity: "warning",
 			message: `Unused ${kind}: ${name}`,
-			help: "This top-level declaration is never imported; aislop will remove it.",
+			help: "This top-level declaration is never imported; raigal will remove it.",
 			line: d.line,
 			column: d.column,
 			category: "Dead Code",
@@ -17180,7 +17670,7 @@ const removeUnusedDeclarations = (rootDirectory, declarations) => {
 };
 //#endregion
 //#region src/commands/fix-expo.ts
-const INSTALL_TIMEOUT$1 = 1800 * 1e3;
+const INSTALL_TIMEOUT$1 = 18e5;
 const fixExpoDependencies = async (context, onProgress) => {
 	await removeDisallowedExpoPackages(context.rootDirectory, onProgress);
 	onProgress?.("Expo dependency alignment · running expo install --fix (can take a few minutes)");
@@ -17234,8 +17724,8 @@ const removeDisallowedExpoPackages = async (rootDir, onProgress) => {
 };
 //#endregion
 //#region src/commands/fix-force.ts
-const INSTALL_TIMEOUT = 1800 * 1e3;
-const AUDIT_TIMEOUT = 60 * 1e3;
+const INSTALL_TIMEOUT = 18e5;
+const AUDIT_TIMEOUT = 6e4;
 const detectPackageManager = (rootDirectory) => {
 	if (fs.existsSync(path.join(rootDirectory, "pnpm-lock.yaml"))) return "pnpm";
 	if (fs.existsSync(path.join(rootDirectory, "package-lock.json")) || fs.existsSync(path.join(rootDirectory, "package.json"))) return "npm";
@@ -17554,13 +18044,14 @@ const CANNOT_SCOPE_REASON = "cannot honour an explicit file list under --changes
 const MISSING_MANIFEST_REASON = "no manifest or lockfile in the selected scope";
 const fixScopeError = (resolvedDir, flags) => {
 	if (flags.changes && flags.staged) return "--changes and --staged cannot be used together.";
-	return scanTargetError(resolvedDir, {
+	const options = {
 		changes: Boolean(flags.changes),
 		staged: Boolean(flags.staged),
 		base: flags.base,
 		verbose: false,
 		json: false
-	});
+	};
+	return scanTargetError(resolvedDir, options);
 };
 const collectFixFileScope = (rootDirectory, excludePatterns, includePatterns, flags) => {
 	const mode = resolveScanScopeMode({
@@ -17619,9 +18110,10 @@ const runFormattingStep = async (deps) => {
 	else if (deps.projectInfo.languages.includes("python")) log.warn("Python detected but ruff is not installed; skipping Python formatting fixes.");
 	if (deps.projectInfo.languages.includes("go") && deps.projectInfo.installedTools.gofmt) await deps.runStep("Formatting (go)", () => runGofmt(deps.context), () => fixGofmt(deps.context));
 	else if (deps.projectInfo.languages.includes("go")) log.warn("Go detected but gofmt is not installed; skipping Go formatting fixes.");
-	if (deps.projectInfo.languages.includes("rust") && deps.projectInfo.installedTools.rustfmt) if (isScopedFix(deps.context)) deps.skipStep?.("Formatting (rust)", CANNOT_SCOPE_REASON);
-	else await deps.runStep("Formatting (rust)", () => runGenericFormatter(deps.context, "rust"), () => fixGenericFormatter(deps.context, "rust"));
-	else if (deps.projectInfo.languages.includes("rust")) log.warn("Rust detected but rustfmt is not installed; skipping Rust formatting fixes.");
+	if (deps.projectInfo.languages.includes("rust") && deps.projectInfo.installedTools.rustfmt) {
+		if (isScopedFix(deps.context)) deps.skipStep?.("Formatting (rust)", CANNOT_SCOPE_REASON);
+		else await deps.runStep("Formatting (rust)", () => runGenericFormatter(deps.context, "rust"), () => fixGenericFormatter(deps.context, "rust"));
+	} else if (deps.projectInfo.languages.includes("rust")) log.warn("Rust detected but rustfmt is not installed; skipping Rust formatting fixes.");
 	if (deps.projectInfo.languages.includes("ruby") && deps.projectInfo.installedTools.rubocop) {
 		if (!skipUnsafeSafeFormatter(deps, "ruby")) await deps.runStep("Formatting (ruby)", () => runGenericFormatter(deps.context, "ruby"), () => fixGenericFormatter(deps.context, "ruby"));
 	} else if (deps.projectInfo.languages.includes("ruby")) log.warn("Ruby detected but rubocop is not installed; skipping Ruby formatting fixes.");
@@ -17670,7 +18162,8 @@ const runDeclarationStep = async (deps) => {
 	if (!deps.config.engines["code-quality"]) return;
 	if (!hasJsOrTs(deps.projectInfo)) return;
 	await deps.runStep("Unused declarations", () => detectUnusedDeclarations(deps.context), async () => {
-		const declarations = diagnosticsToDeclarations(await detectUnusedDeclarations(deps.context));
+		const diagnostics = await detectUnusedDeclarations(deps.context);
+		const declarations = diagnosticsToDeclarations(diagnostics);
 		removeUnusedDeclarations(deps.resolvedDir, declarations);
 	});
 };
@@ -17701,10 +18194,14 @@ const runForceSteps = async (deps) => {
 		return (await runKnipUnusedFiles(deps.resolvedDir)).filter((diagnostic) => isPathInFixScope(deps.context, diagnostic.filePath));
 	}, () => fixUnusedFiles(deps.resolvedDir, (filePath) => isPathInFixScope(deps.context, filePath)));
 	const railUpdate = (label) => deps.rail.setActiveLabel(label);
-	if (deps.config.engines.security) if (!scopeIncludesManifestWrites(deps.context)) deps.skipStep?.("Dependency audit fixes", MISSING_MANIFEST_REASON);
-	else await deps.runStep("Dependency audit fixes", () => runDependencyAudit(deps.context), () => fixDependencyAudit(deps.context, railUpdate));
-	if (deps.projectInfo.frameworks.includes("expo") && deps.config.lint.expoDoctor) if (!scopeIncludesManifestWrites(deps.context)) deps.skipStep?.("Expo dependency alignment", MISSING_MANIFEST_REASON);
-	else await deps.runStep("Expo dependency alignment", () => runExpoDoctor(deps.context), () => fixExpoDependencies(deps.context, railUpdate));
+	if (deps.config.engines.security) {
+		if (!scopeIncludesManifestWrites(deps.context)) deps.skipStep?.("Dependency audit fixes", MISSING_MANIFEST_REASON);
+		else await deps.runStep("Dependency audit fixes", () => runDependencyAudit(deps.context), () => fixDependencyAudit(deps.context, railUpdate));
+	}
+	if (deps.projectInfo.frameworks.includes("expo") && deps.config.lint.expoDoctor) {
+		if (!scopeIncludesManifestWrites(deps.context)) deps.skipStep?.("Expo dependency alignment", MISSING_MANIFEST_REASON);
+		else await deps.runStep("Expo dependency alignment", () => runExpoDoctor(deps.context), () => fixExpoDependencies(deps.context, railUpdate));
+	}
 };
 //#endregion
 //#region src/commands/fix-plan.ts
@@ -18026,7 +18523,8 @@ const saveCachedPolicy = (repoSlug, policy) => {
 };
 const fetchRemotePolicy = async (repoSlug, token) => {
 	try {
-		const data = await requestApi(`/v1/policy?repo=${encodeURIComponent(repoSlug.toLowerCase())}`, {
+		const endpoint = `/v1/policy?repo=${encodeURIComponent(repoSlug.toLowerCase())}`;
+		const data = await requestApi(endpoint, {
 			method: "GET",
 			token,
 			timeoutMs: 4e3
@@ -18086,6 +18584,8 @@ const resolveHistoryDir = (directory) => {
 	const resolved = path.resolve(directory);
 	const primary = path.join(resolved, CONFIG_DIR);
 	if (fs.existsSync(primary)) return primary;
+	const legacy = path.join(resolved, ".aislop");
+	if (fs.existsSync(legacy)) return legacy;
 	return null;
 };
 const historyPath = (directory) => {
@@ -18198,6 +18698,842 @@ const recordFullScanActivity = (history, allowPilotInvitation, telemetryConfig)
 	appendHistory(history);
 	return allowPilotInvitation && !isHistoryDisabled() && !isTelemetryDisabled(telemetryConfig) && recordCompletedFullScan();
 };
+const AISLOP_MD_BODY = `# Raigal - agent instructions
+
+[Raigal](https://github.com/meethiu/raigal) is your guardrail for shipping clean, maintainable, production-grade code. It catches the patterns AI coding tools leave behind: dead imports, redundant code, duplicate logic, unsafe any-typed casts, narrative comments, swallowed errors, hidden fallbacks, oversized functions, risky security constructs - and grades the project out of 100 so regressions are visible. Treat its findings as blocking, not advisory: the goal is code a human maintainer would happily inherit.
+
+## On every edit
+
+A PostToolUse hook runs \`raigal hook claude\` after every Edit, Write, or MultiEdit. It scans the touched files and returns findings as JSON \`additionalContext\` shaped like \`RaigalFeedback\` (score, baseline, delta, regressed, counts, findings, newSinceBaseline, suggestedActions). Act on them the same turn; the \`suggestedActions\` field tells you exactly what to run next.
+
+## Severity ladder
+
+- \`error\` - MUST fix this turn.
+- \`warning\` + \`fixable: true\` - MUST fix this turn.
+- \`warning\` + \`fixable: false\` - fix if trivially mechanical, otherwise surface in your reply.
+
+## Rules
+
+- \`.raigal/config.yaml\` (or \`.aislop/config.yaml\`) - thresholds and engine toggles. Treat as authoritative; don't edit without user consent.
+- \`.raigal/rules.yaml\` (or \`.aislop/rules.yaml\`) - project-specific architecture rules (may be absent). When a finding cites \`architecture/*\`, open this file and follow it.
+- Custom rules can change between sessions. Trust what the scan returns, not a cached understanding of what the rules are.
+
+## Principles
+
+- Do not disable rules to pass the scan. Fix the underlying issue.
+- If a finding is a false positive, leave it and explain in your reply - do not delete the rule config.
+- The findings payload includes \`nextSteps[]\` - treat those as your plan for the turn.
+`;
+//#endregion
+//#region src/hooks/io/atomic-write.ts
+const atomicWrite = (targetPath, content) => {
+	const dir = path.dirname(targetPath);
+	fs.mkdirSync(dir, { recursive: true });
+	const rand = Math.random().toString(36).slice(2, 10);
+	const tmp = path.join(dir, `.aislop-tmp-${process.pid}-${rand}`);
+	fs.writeFileSync(tmp, content, "utf-8");
+	try {
+		fs.renameSync(tmp, targetPath);
+	} catch (err) {
+		const code = err?.code;
+		if (code === "EPERM" || code === "EBUSY") {
+			fs.copyFileSync(tmp, targetPath);
+			try {
+				fs.unlinkSync(tmp);
+			} catch {}
+		} else throw err;
+	}
+};
+const readIfExists = (targetPath) => {
+	try {
+		return fs.readFileSync(targetPath, "utf-8");
+	} catch {
+		return null;
+	}
+};
+//#endregion
+//#region src/hooks/io/sentinel.ts
+const sentinelHash = (content) => `sha256:${crypto.createHash("sha256").update(content).digest("hex").slice(0, 32)}`;
+const BEGIN_RE = /<!--\s*aislop:begin\s+v(\d+)(?:\s+hash=([^\s>]+))?\s*-->/;
+const END_RE = /<!--\s*aislop:end\s+v\d+\s*-->/;
+const renderFence = (body, hash) => [
+	`<!-- aislop:begin v1 hash=${hash} -->`,
+	body.trimEnd(),
+	"<!-- aislop:end v1 -->"
+].join("\n");
+const upsertMarkdownFence = (existing, body, hash) => {
+	const fenced = renderFence(body, hash);
+	if (existing == null || existing.length === 0) return {
+		nextContent: `${fenced}\n`,
+		replaced: false
+	};
+	const begin = existing.match(BEGIN_RE);
+	const end = existing.match(END_RE);
+	if (begin && end && (end.index ?? 0) > (begin.index ?? 0)) return {
+		nextContent: `${existing.slice(0, begin.index)}${fenced}${existing.slice((end.index ?? 0) + end[0].length)}`,
+		replaced: true
+	};
+	return {
+		nextContent: `${existing}${existing.endsWith("\n") ? "" : "\n"}\n${fenced}\n`,
+		replaced: false
+	};
+};
+//#endregion
+//#region src/hooks/install/types.ts
+const emptyResult = () => ({
+	wrote: [],
+	skipped: [],
+	planned: []
+});
+const applyContent = (result, opts, target, nextContent, summary) => {
+	if (readIfExists(target) === nextContent) {
+		result.skipped.push(target);
+		return;
+	}
+	if (opts.dryRun) {
+		result.planned.push({
+			path: target,
+			summary
+		});
+		return;
+	}
+	atomicWrite(target, nextContent);
+	result.wrote.push(target);
+};
+const applyRemoval = (result, opts, target, nextContent) => {
+	const existing = readIfExists(target);
+	if (existing == null) {
+		result.skipped.push(target);
+		return;
+	}
+	if (existing === (nextContent ?? "")) {
+		result.skipped.push(target);
+		return;
+	}
+	if (opts.dryRun) {
+		result.removed.push(target);
+		return;
+	}
+	if (nextContent == null) try {
+		fs.unlinkSync(target);
+	} catch {}
+	else atomicWrite(target, nextContent);
+	result.removed.push(target);
+};
+//#endregion
+//#region src/hooks/install/rules-only.ts
+const installRulesOnly = (opts, paths, summary) => {
+	const result = emptyResult();
+	const existing = readIfExists(paths.rules);
+	const hash = sentinelHash(AISLOP_MD_BODY);
+	const next = upsertMarkdownFence(existing, AISLOP_MD_BODY, hash).nextContent;
+	applyContent(result, opts, paths.rules, next, summary);
+	if (paths.host && paths.marker) {
+		const host = readIfExists(paths.host) ?? "";
+		if (!host.includes(paths.marker)) {
+			const joiner = host.endsWith("\n") || host.length === 0 ? "" : "\n";
+			const prefix = host.length === 0 ? "" : `${host}${joiner}\n`;
+			applyContent(result, opts, paths.host, `${prefix}${paths.marker}\n`, `append ${paths.marker} reference`);
+		} else result.skipped.push(paths.host);
+	}
+	return result;
+};
+const uninstallRulesOnly = (opts, paths) => {
+	const result = {
+		removed: [],
+		skipped: []
+	};
+	if (readIfExists(paths.rules) != null) applyRemoval(result, opts, paths.rules, null);
+	else result.skipped.push(paths.rules);
+	if (paths.host && paths.marker) {
+		const host = readIfExists(paths.host);
+		if (host?.includes(paths.marker)) {
+			const stripped = host.split("\n").filter((l) => l.trim() !== paths.marker).join("\n").replace(/\n{3,}/g, "\n\n").trim();
+			applyRemoval(result, opts, paths.host, stripped.length === 0 ? null : `${stripped}\n`);
+		} else result.skipped.push(paths.host);
+	}
+	return result;
+};
+//#endregion
+//#region src/hooks/install/antigravity.ts
+const resolveAntigravityPaths = (opts) => ({ rules: path.join(opts.cwd, ".agents", "rules", "antigravity-aislop-rules.md") });
+const installAntigravity = (opts) => {
+	if (opts.scope !== "project") return {
+		wrote: [],
+		skipped: [],
+		planned: [{
+			path: ".agents/rules/antigravity-aislop-rules.md",
+			summary: "Antigravity is project-scope only; pass --project"
+		}]
+	};
+	return installRulesOnly(opts, resolveAntigravityPaths(opts), "write .agents/rules/antigravity-aislop-rules.md");
+};
+const uninstallAntigravity = (opts) => {
+	if (opts.scope !== "project") return {
+		removed: [],
+		skipped: []
+	};
+	return uninstallRulesOnly(opts, resolveAntigravityPaths(opts));
+};
+//#endregion
+//#region src/hooks/io/json-patch.ts
+const AISLOP_SENTINEL_KEY = "__aislop";
+const isAislopManaged = (x) => typeof x === "object" && x !== null && ("__aislop" in x && x["__aislop"] != null || "__raigal" in x && x["__raigal"] != null);
+const groupIsAislop = (group) => {
+	if (typeof group !== "object" || group === null) return false;
+	const hooks = group.hooks;
+	if (!Array.isArray(hooks)) return false;
+	return hooks.some((h) => isAislopManaged(h));
+};
+const upsertHookGroup = (config, event, group) => {
+	const next = { ...config };
+	const hooks = next.hooks && typeof next.hooks === "object" ? next.hooks : {};
+	const cleaned = (Array.isArray(hooks[event]) ? hooks[event] : []).filter((g) => !groupIsAislop(g));
+	next.hooks = {
+		...hooks,
+		[event]: [...cleaned, group]
+	};
+	return next;
+};
+const upsertFlatHook = (config, event, entry) => {
+	const next = { ...config };
+	const hooks = next.hooks && typeof next.hooks === "object" ? next.hooks : {};
+	const cleaned = (Array.isArray(hooks[event]) ? hooks[event] : []).filter((e) => !isAislopManaged(e));
+	next.hooks = {
+		...hooks,
+		[event]: [...cleaned, entry]
+	};
+	return next;
+};
+const removeAislopEntries = (config, event) => {
+	const next = { ...config };
+	const hooks = next.hooks && typeof next.hooks === "object" ? next.hooks : {};
+	const existing = Array.isArray(hooks[event]) ? hooks[event] : [];
+	const cleaned = existing.filter((e) => !isAislopManaged(e) && !groupIsAislop(e));
+	const removed = existing.length - cleaned.length;
+	const nextHooks = { ...hooks };
+	if (cleaned.length === 0) delete nextHooks[event];
+	else nextHooks[event] = cleaned;
+	if (Object.keys(nextHooks).length === 0) delete next.hooks;
+	else next.hooks = nextHooks;
+	return {
+		next,
+		removed
+	};
+};
+//#endregion
+//#region src/hooks/install/claude.ts
+const resolveClaudePaths = (opts) => {
+	const root = opts.scope === "project" ? path.join(opts.cwd, ".claude") : path.join(opts.home, ".claude");
+	return {
+		settings: path.join(root, "settings.json"),
+		aislopMd: path.join(root, "AISLOP.md"),
+		claudeMd: path.join(root, "CLAUDE.md")
+	};
+};
+const buildHookGroup$1 = () => {
+	const hashBody = JSON.stringify({
+		command: "raigal hook claude",
+		matcher: "Edit|Write|MultiEdit"
+	});
+	return {
+		matcher: "Edit|Write|MultiEdit",
+		hooks: [{
+			type: "command",
+			command: "raigal hook claude",
+			[AISLOP_SENTINEL_KEY]: {
+				v: 1,
+				managed: true,
+				hash: sentinelHash(hashBody)
+			}
+		}]
+	};
+};
+const buildStopHookGroup = () => {
+	const hashBody = JSON.stringify({ command: "raigal hook claude --stop" });
+	return {
+		matcher: "",
+		hooks: [{
+			type: "command",
+			command: "raigal hook claude --stop",
+			[AISLOP_SENTINEL_KEY]: {
+				v: 1,
+				managed: true,
+				hash: sentinelHash(hashBody)
+			}
+		}]
+	};
+};
+const FILE_CHANGED_MATCHER = ".raigal/config.yml|.raigal/rules.yml|.aislop/config.yml|.aislop/rules.yml|package.json";
+const buildFileChangedHookGroup = () => {
+	const hashBody = JSON.stringify({
+		command: "raigal hook claude --on-file-changed",
+		matcher: FILE_CHANGED_MATCHER
+	});
+	return {
+		matcher: FILE_CHANGED_MATCHER,
+		hooks: [{
+			type: "command",
+			command: "raigal hook claude --on-file-changed",
+			[AISLOP_SENTINEL_KEY]: {
+				v: 1,
+				managed: true,
+				hash: sentinelHash(hashBody)
+			}
+		}]
+	};
+};
+const renderSettings$1 = (existingRaw, qualityGate) => {
+	let obj = {};
+	if (existingRaw) try {
+		obj = JSON.parse(existingRaw);
+	} catch {
+		obj = {};
+	}
+	let next = upsertHookGroup(obj, "PostToolUse", buildHookGroup$1());
+	next = upsertHookGroup(next, "FileChanged", buildFileChangedHookGroup());
+	if (qualityGate) next = upsertHookGroup(next, "Stop", buildStopHookGroup());
+	else next = removeAislopEntries(next, "Stop").next;
+	return `${JSON.stringify(next, null, 2)}\n`;
+};
+const installClaude = (opts) => {
+	const paths = resolveClaudePaths(opts);
+	const result = emptyResult();
+	const nextSettings = renderSettings$1(readIfExists(paths.settings), Boolean(opts.qualityGate));
+	applyContent(result, opts, paths.settings, nextSettings, "register PostToolUse + FileChanged hooks");
+	const mdHash = sentinelHash(AISLOP_MD_BODY);
+	const existingMd = readIfExists(paths.aislopMd);
+	const fenced = upsertMarkdownFence(existingMd, AISLOP_MD_BODY, mdHash);
+	applyContent(result, opts, paths.aislopMd, fenced.nextContent, "write AISLOP.md rules");
+	const existingClaudeMd = readIfExists(paths.claudeMd) ?? "";
+	const marker = "@AISLOP.md";
+	if (!existingClaudeMd.includes(marker)) {
+		const joiner = existingClaudeMd.endsWith("\n") || existingClaudeMd.length === 0 ? "" : "\n";
+		const prefix = existingClaudeMd.length === 0 ? "" : `${existingClaudeMd}${joiner}\n`;
+		applyContent(result, opts, paths.claudeMd, `${prefix}${marker}\n`, "append @AISLOP.md reference");
+	} else result.skipped.push(paths.claudeMd);
+	return result;
+};
+const uninstallClaude = (opts) => {
+	const paths = resolveClaudePaths({
+		...opts,
+		qualityGate: false
+	});
+	const result = {
+		removed: [],
+		skipped: []
+	};
+	const settingsRaw = readIfExists(paths.settings);
+	if (settingsRaw) {
+		let obj = {};
+		try {
+			obj = JSON.parse(settingsRaw);
+		} catch {
+			obj = {};
+		}
+		const afterPostToolUse = removeAislopEntries(obj, "PostToolUse").next;
+		const afterFileChanged = removeAislopEntries(afterPostToolUse, "FileChanged").next;
+		const stripped = removeAislopEntries(afterFileChanged, "Stop").next;
+		const stillHasHooks = stripped.hooks && typeof stripped.hooks === "object" && Object.keys(stripped.hooks).length > 0;
+		const otherKeys = Object.keys(stripped).filter((k) => k !== "hooks");
+		if (!stillHasHooks && otherKeys.length === 0) applyRemoval(result, opts, paths.settings, null);
+		else applyRemoval(result, opts, paths.settings, `${JSON.stringify(stripped, null, 2)}\n`);
+	} else result.skipped.push(paths.settings);
+	if (readIfExists(paths.aislopMd) != null) applyRemoval(result, opts, paths.aislopMd, null);
+	else result.skipped.push(paths.aislopMd);
+	const claudeMd = readIfExists(paths.claudeMd);
+	if (claudeMd?.includes("@AISLOP.md")) {
+		const stripped = claudeMd.split("\n").filter((line) => line.trim() !== "@AISLOP.md").join("\n").replace(/\n{3,}/g, "\n\n").trim();
+		applyRemoval(result, opts, paths.claudeMd, stripped.length === 0 ? null : `${stripped}\n`);
+	} else result.skipped.push(paths.claudeMd);
+	return result;
+};
+//#endregion
+//#region src/hooks/install/cline.ts
+const resolveClinePaths = (opts) => ({ rules: path.join(opts.cwd, ".clinerules") });
+const resolveRooPaths = (opts) => ({ rules: path.join(opts.cwd, ".roo", "rules", "aislop.md") });
+const installCline = (opts) => {
+	if (opts.scope !== "project") return {
+		wrote: [],
+		skipped: [],
+		planned: [{
+			path: ".clinerules",
+			summary: "Cline is project-scope only; pass --project"
+		}]
+	};
+	const cline = installRulesOnly(opts, resolveClinePaths(opts), "write .clinerules");
+	const roo = installRulesOnly(opts, resolveRooPaths(opts), "write .roo/rules/aislop.md");
+	return {
+		wrote: [...cline.wrote, ...roo.wrote],
+		skipped: [...cline.skipped, ...roo.skipped],
+		planned: [...cline.planned, ...roo.planned]
+	};
+};
+const uninstallCline = (opts) => {
+	if (opts.scope !== "project") return {
+		removed: [],
+		skipped: []
+	};
+	const a = uninstallRulesOnly(opts, resolveClinePaths(opts));
+	const b = uninstallRulesOnly(opts, resolveRooPaths(opts));
+	return {
+		removed: [...a.removed, ...b.removed],
+		skipped: [...a.skipped, ...b.skipped]
+	};
+};
+//#endregion
+//#region src/hooks/install/codex.ts
+const resolveCodexPaths = (opts) => ({ rules: opts.scope === "project" ? path.join(opts.cwd, "AGENTS.md") : path.join(opts.home, ".codex", "AGENTS.md") });
+const installCodex = (opts) => installRulesOnly(opts, resolveCodexPaths(opts), "write AGENTS.md rules for Codex");
+const uninstallCodex = (opts) => uninstallRulesOnly(opts, resolveCodexPaths(opts));
+//#endregion
+//#region src/hooks/install/copilot.ts
+const resolveCopilotPaths = (opts) => ({ rules: path.join(opts.cwd, ".github", "copilot-instructions.md") });
+const installCopilot = (opts) => {
+	if (opts.scope !== "project") return {
+		wrote: [],
+		skipped: [],
+		planned: [{
+			path: ".github/copilot-instructions.md",
+			summary: "Copilot is project-scope only; pass --project"
+		}]
+	};
+	return installRulesOnly(opts, resolveCopilotPaths(opts), "write .github/copilot-instructions.md");
+};
+const uninstallCopilot = (opts) => {
+	if (opts.scope !== "project") return {
+		removed: [],
+		skipped: []
+	};
+	return uninstallRulesOnly(opts, resolveCopilotPaths(opts));
+};
+//#endregion
+//#region src/hooks/install/cursor.ts
+const resolveCursorPaths = (opts) => {
+	const root = opts.scope === "project" ? path.join(opts.cwd, ".cursor") : path.join(opts.home, ".cursor");
+	return {
+		hooks: path.join(root, "hooks.json"),
+		rules: path.join(opts.cwd, ".cursor", "rules", "aislop.mdc")
+	};
+};
+const buildHookEntry = () => {
+	const hashBody = JSON.stringify({
+		command: "raigal hook cursor",
+		timeout: 5e3
+	});
+	return {
+		command: "raigal hook cursor",
+		type: "command",
+		timeout: 5e3,
+		[AISLOP_SENTINEL_KEY]: {
+			v: 1,
+			managed: true,
+			hash: sentinelHash(hashBody)
+		}
+	};
+};
+const renderHooksJson = (existingRaw) => {
+	let obj = { version: 1 };
+	if (existingRaw) try {
+		obj = JSON.parse(existingRaw);
+	} catch {
+		obj = { version: 1 };
+	}
+	if (typeof obj.version !== "number") obj.version = 1;
+	const next = upsertFlatHook(obj, "afterFileEdit", buildHookEntry());
+	return `${JSON.stringify(next, null, 2)}\n`;
+};
+const installCursor = (opts) => {
+	const paths = resolveCursorPaths(opts);
+	const result = emptyResult();
+	const nextHooks = renderHooksJson(readIfExists(paths.hooks));
+	applyContent(result, opts, paths.hooks, nextHooks, "register afterFileEdit hook");
+	if (opts.scope === "project") {
+		const existingRules = readIfExists(paths.rules);
+		const hash = sentinelHash(AISLOP_MD_BODY);
+		const rules = upsertMarkdownFence(existingRules, AISLOP_MD_BODY, hash).nextContent;
+		applyContent(result, opts, paths.rules, rules, "write .cursor/rules/aislop.mdc");
+	}
+	return result;
+};
+const uninstallCursor = (opts) => {
+	const paths = resolveCursorPaths(opts);
+	const result = {
+		removed: [],
+		skipped: []
+	};
+	const raw = readIfExists(paths.hooks);
+	if (raw) {
+		let obj = {};
+		try {
+			obj = JSON.parse(raw);
+		} catch {
+			obj = {};
+		}
+		const stripped = removeAislopEntries(obj, "afterFileEdit").next;
+		const stillHasHooks = stripped.hooks && typeof stripped.hooks === "object" && Object.keys(stripped.hooks).length > 0;
+		const otherKeys = Object.keys(stripped).filter((k) => k !== "hooks" && k !== "version");
+		if (!stillHasHooks && otherKeys.length === 0) applyRemoval(result, opts, paths.hooks, null);
+		else applyRemoval(result, opts, paths.hooks, `${JSON.stringify(stripped, null, 2)}\n`);
+	} else result.skipped.push(paths.hooks);
+	if (opts.scope === "project") applyRemoval(result, opts, paths.rules, null);
+	return result;
+};
+//#endregion
+//#region src/hooks/install/gemini.ts
+const resolveGeminiPaths = (opts) => {
+	const root = opts.scope === "project" ? path.join(opts.cwd, ".gemini") : path.join(opts.home, ".gemini");
+	return {
+		settings: path.join(root, "settings.json"),
+		aislopMd: path.join(root, "AISLOP.md"),
+		geminiMd: path.join(root, "GEMINI.md")
+	};
+};
+const buildHookGroup = () => {
+	const hashBody = JSON.stringify({
+		command: "raigal hook gemini",
+		matcher: "write_file|replace"
+	});
+	return {
+		matcher: "write_file|replace",
+		hooks: [{
+			name: "raigal",
+			type: "command",
+			command: "raigal hook gemini",
+			timeout: 5e3,
+			[AISLOP_SENTINEL_KEY]: {
+				v: 1,
+				managed: true,
+				hash: sentinelHash(hashBody)
+			}
+		}]
+	};
+};
+const renderSettings = (existingRaw) => {
+	let obj = {};
+	if (existingRaw) try {
+		obj = JSON.parse(existingRaw);
+	} catch {
+		obj = {};
+	}
+	const next = upsertHookGroup(obj, "AfterTool", buildHookGroup());
+	return `${JSON.stringify(next, null, 2)}\n`;
+};
+const installGemini = (opts) => {
+	const paths = resolveGeminiPaths(opts);
+	const result = emptyResult();
+	const next = renderSettings(readIfExists(paths.settings));
+	applyContent(result, opts, paths.settings, next, "register AfterTool hook");
+	const existingMd = readIfExists(paths.aislopMd);
+	const hash = sentinelHash(AISLOP_MD_BODY);
+	const fenced = upsertMarkdownFence(existingMd, AISLOP_MD_BODY, hash).nextContent;
+	applyContent(result, opts, paths.aislopMd, fenced, "write AISLOP.md rules");
+	const existingGeminiMd = readIfExists(paths.geminiMd) ?? "";
+	const marker = "@AISLOP.md";
+	if (!existingGeminiMd.includes(marker)) {
+		const joiner = existingGeminiMd.endsWith("\n") || existingGeminiMd.length === 0 ? "" : "\n";
+		const prefix = existingGeminiMd.length === 0 ? "" : `${existingGeminiMd}${joiner}\n`;
+		applyContent(result, opts, paths.geminiMd, `${prefix}${marker}\n`, "append @AISLOP.md reference");
+	} else result.skipped.push(paths.geminiMd);
+	return result;
+};
+const uninstallGemini = (opts) => {
+	const paths = resolveGeminiPaths(opts);
+	const result = {
+		removed: [],
+		skipped: []
+	};
+	const raw = readIfExists(paths.settings);
+	if (raw) {
+		let obj = {};
+		try {
+			obj = JSON.parse(raw);
+		} catch {
+			obj = {};
+		}
+		const stripped = removeAislopEntries(obj, "AfterTool").next;
+		const stillHasHooks = stripped.hooks && typeof stripped.hooks === "object" && Object.keys(stripped.hooks).length > 0;
+		const otherKeys = Object.keys(stripped).filter((k) => k !== "hooks");
+		if (!stillHasHooks && otherKeys.length === 0) applyRemoval(result, opts, paths.settings, null);
+		else applyRemoval(result, opts, paths.settings, `${JSON.stringify(stripped, null, 2)}\n`);
+	} else result.skipped.push(paths.settings);
+	if (readIfExists(paths.aislopMd) != null) applyRemoval(result, opts, paths.aislopMd, null);
+	else result.skipped.push(paths.aislopMd);
+	const geminiMd = readIfExists(paths.geminiMd);
+	if (geminiMd?.includes("@AISLOP.md")) {
+		const stripped = geminiMd.split("\n").filter((l) => l.trim() !== "@AISLOP.md").join("\n").replace(/\n{3,}/g, "\n\n").trim();
+		applyRemoval(result, opts, paths.geminiMd, stripped.length === 0 ? null : `${stripped}\n`);
+	} else result.skipped.push(paths.geminiMd);
+	return result;
+};
+//#endregion
+//#region src/hooks/install/kilocode.ts
+const resolveKilocodePaths = (opts) => ({ rules: path.join(opts.cwd, ".kilocode", "rules", "aislop-rules.md") });
+const installKilocode = (opts) => {
+	if (opts.scope !== "project") return {
+		wrote: [],
+		skipped: [],
+		planned: [{
+			path: ".kilocode/rules/aislop-rules.md",
+			summary: "Kilo Code is project-scope only; pass --project"
+		}]
+	};
+	return installRulesOnly(opts, resolveKilocodePaths(opts), "write .kilocode/rules/aislop-rules.md");
+};
+const uninstallKilocode = (opts) => {
+	if (opts.scope !== "project") return {
+		removed: [],
+		skipped: []
+	};
+	return uninstallRulesOnly(opts, resolveKilocodePaths(opts));
+};
+//#endregion
+//#region src/hooks/install/pi.ts
+const resolvePiPaths = (opts) => {
+	return { extension: opts.scope === "project" ? path.join(opts.cwd, ".pi", "extensions", "aislop.js") : path.join(opts.home, ".pi", "agent", "extensions", "aislop.js") };
+};
+const PI_EXTENSION_SOURCE = `// raigal — auto-generated pi extension. Do not edit by hand.
+// Reinstall with: raigal hook install --pi
+import { spawn } from "node:child_process";
+
+// Runs the CLI async so a slow scan never blocks pi's event loop, and forwards
+// ctx.signal so Esc actually kills the child instead of it running to completion.
+const runHook = (bin, args, input, signal) =>
+	new Promise((resolve) => {
+		const child = spawn(bin, args, { stdio: ["pipe", "pipe", "ignore"] });
+		const chunks = [];
+		let settled = false;
+		let timer;
+		const onAbort = () => {
+			child.kill();
+			finish(null);
+		};
+		const cleanup = () => {
+			if (timer !== undefined) clearTimeout(timer);
+			signal?.removeEventListener("abort", onAbort);
+		};
+		const finish = (value) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			resolve(value);
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+		timer = setTimeout(() => {
+			child.kill();
+			finish(null);
+		}, 15000);
+		child.stdout.on("data", (c) => chunks.push(c));
+		child.on("error", () => finish(null));
+		child.on("close", (code) => {
+			finish(code === 0 && chunks.length > 0 ? Buffer.concat(chunks).toString("utf-8") : null);
+		});
+		child.stdin.end(input);
+	});
+
+export default function (pi) {
+	pi.on("tool_result", async (event, ctx) => {
+		if (event.toolName !== "edit" && event.toolName !== "write") return;
+		if (event.isError) return;
+		const filePath = event.input && event.input.path;
+		if (typeof filePath !== "string" || filePath.length === 0) return;
+
+		const bin = process.env.RAIGAL_BIN || process.env.AISLOP_BIN || "raigal";
+		const payload = JSON.stringify({
+			cwd: ctx.cwd,
+			file_path: filePath,
+			tool_name: event.toolName,
+		});
+
+		let out;
+		try {
+			const stdout = await runHook(bin, ["hook", "pi"], payload, ctx.signal);
+			if (!stdout) return;
+			out = JSON.parse(stdout);
+		} catch {
+			return;
+		}
+		if (!out || !out.message) return;
+
+		return {
+			content: [...event.content, { type: "text", text: out.message }],
+			isError: event.isError,
+		};
+	});
+}
+`;
+const installPi = (opts) => {
+	const paths = resolvePiPaths(opts);
+	const result = emptyResult();
+	applyContent(result, opts, paths.extension, PI_EXTENSION_SOURCE, "write pi raigal extension");
+	return result;
+};
+const uninstallPi = (opts) => {
+	const paths = resolvePiPaths(opts);
+	const result = {
+		removed: [],
+		skipped: []
+	};
+	if (readIfExists(paths.extension) != null) applyRemoval(result, opts, paths.extension, null);
+	else result.skipped.push(paths.extension);
+	return result;
+};
+//#endregion
+//#region src/hooks/install/windsurf.ts
+const resolveWindsurfPaths = (opts) => ({ rules: path.join(opts.cwd, ".windsurfrules") });
+const installWindsurf = (opts) => {
+	if (opts.scope !== "project") return {
+		wrote: [],
+		skipped: [],
+		planned: [{
+			path: ".windsurfrules",
+			summary: "Windsurf is project-scope only; pass --project"
+		}]
+	};
+	return installRulesOnly(opts, resolveWindsurfPaths(opts), "write .windsurfrules");
+};
+const uninstallWindsurf = (opts) => {
+	if (opts.scope !== "project") return {
+		removed: [],
+		skipped: []
+	};
+	return uninstallRulesOnly(opts, resolveWindsurfPaths(opts));
+};
+//#endregion
+//#region src/hooks/install/registry.ts
+const ALL_AGENTS = [
+	"claude",
+	"cursor",
+	"gemini",
+	"pi",
+	"codex",
+	"windsurf",
+	"cline",
+	"kilocode",
+	"antigravity",
+	"copilot"
+];
+const AGENTS_PROJECT_ONLY = [
+	"windsurf",
+	"cline",
+	"kilocode",
+	"antigravity",
+	"copilot"
+];
+const AGENTS_SUPPORTING_BOTH_SCOPES = [
+	"claude",
+	"cursor",
+	"gemini",
+	"pi",
+	"codex"
+];
+const paths = {
+	claude: (opts) => {
+		const p = resolveClaudePaths(opts);
+		return [
+			p.settings,
+			p.aislopMd,
+			p.claudeMd
+		];
+	},
+	cursor: (opts) => {
+		const p = resolveCursorPaths(opts);
+		return opts.scope === "project" ? [p.hooks, p.rules] : [p.hooks];
+	},
+	gemini: (opts) => {
+		const p = resolveGeminiPaths(opts);
+		return [
+			p.settings,
+			p.aislopMd,
+			p.geminiMd
+		];
+	},
+	pi: (opts) => [resolvePiPaths(opts).extension],
+	codex: (opts) => [resolveCodexPaths(opts).rules],
+	windsurf: (opts) => [resolveWindsurfPaths(opts).rules],
+	cline: (opts) => [resolveClinePaths(opts).rules, resolveRooPaths(opts).rules],
+	kilocode: (opts) => [resolveKilocodePaths(opts).rules],
+	antigravity: (opts) => [resolveAntigravityPaths(opts).rules],
+	copilot: (opts) => [resolveCopilotPaths(opts).rules]
+};
+const REGISTRY = {
+	claude: {
+		install: installClaude,
+		uninstall: uninstallClaude,
+		paths: paths.claude
+	},
+	cursor: {
+		install: installCursor,
+		uninstall: uninstallCursor,
+		paths: paths.cursor
+	},
+	gemini: {
+		install: installGemini,
+		uninstall: uninstallGemini,
+		paths: paths.gemini
+	},
+	pi: {
+		install: installPi,
+		uninstall: uninstallPi,
+		paths: paths.pi
+	},
+	codex: {
+		install: installCodex,
+		uninstall: uninstallCodex,
+		paths: paths.codex
+	},
+	windsurf: {
+		install: installWindsurf,
+		uninstall: uninstallWindsurf,
+		paths: paths.windsurf
+	},
+	cline: {
+		install: installCline,
+		uninstall: uninstallCline,
+		paths: paths.cline
+	},
+	kilocode: {
+		install: installKilocode,
+		uninstall: uninstallKilocode,
+		paths: paths.kilocode
+	},
+	antigravity: {
+		install: installAntigravity,
+		uninstall: uninstallAntigravity,
+		paths: paths.antigravity
+	},
+	copilot: {
+		install: installCopilot,
+		uninstall: uninstallCopilot,
+		paths: paths.copilot
+	}
+};
+const defaultScopeFor = (agent) => AGENTS_PROJECT_ONLY.includes(agent) ? "project" : "global";
+const HOOK_MARKERS = [
+	"__raigal",
+	"raigal:begin",
+	"@RAIGAL.md",
+	"__aislop",
+	"aislop:begin",
+	"@AISLOP.md"
+];
+const hasHook = (target) => {
+	try {
+		if (!fs.statSync(target).isFile()) return false;
+		const base = path.basename(target).toLowerCase();
+		if (base.startsWith("raigal") || base.startsWith("aislop")) return true;
+		const content = fs.readFileSync(target, "utf8");
+		return HOOK_MARKERS.some((marker) => content.includes(marker));
+	} catch {
+		return false;
+	}
+};
+const detectionScopes = (agent) => AGENTS_SUPPORTING_BOTH_SCOPES.includes(agent) ? ["global", "project"] : [defaultScopeFor(agent)];
+const detectRaigalHooks = (opts) => ALL_AGENTS.filter((agent) => detectionScopes(agent).some((scope) => REGISTRY[agent].paths({
+	home: opts.home,
+	cwd: opts.cwd,
+	scope
+}).some(hasHook)));
 //#endregion
 //#region src/output/terminal.ts
 const groupBy = (items, key) => {
@@ -18365,27 +19701,16 @@ const printEngineStatus = (result) => {
 	}
 };
 //#endregion
-//#region src/scoring/rule-severity.ts
-/**
-* Apply per-rule severity overrides from config: "off" drops the diagnostic,
-* "error"/"warning" rewrite its severity before scoring and rendering.
-*/
-const applyRuleSeverities = (diagnostics, overrides) => {
-	if (Object.keys(overrides).length === 0) return diagnostics;
-	const result = [];
-	for (const diagnostic of diagnostics) {
-		const override = overrides[diagnostic.rule];
-		if (!override) {
-			result.push(diagnostic);
-			continue;
-		}
-		if (override === "off") continue;
-		result.push(override === diagnostic.severity ? diagnostic : {
-			...diagnostic,
-			severity: override
-		});
-	}
-	return result;
+//#region src/commands/scan-hook-nudge.ts
+const shouldShowHookNudge = (ctx) => ctx.isTty && !ctx.isCi && ctx.installedAgentCount === 0;
+const buildHookNudge = (ctx) => {
+	if (!shouldShowHookNudge(ctx)) return null;
+	return [
+		"",
+		"Next: install the per-edit hook so your coding agent fixes slop before it lands.",
+		ctx.invocation === "raigal" ? "  raigal hook install" : "  npm install -g @methiu/raigal && raigal hook install",
+		""
+	].join("\n");
 };
 //#endregion
 //#region src/commands/scan-coverage.ts
@@ -18679,6 +20004,9 @@ const RULE_LABELS = {
 	"security/shell-injection": "Possible shell injection",
 	"security/unsafe-deserialization": "Unsafe deserialization",
 	"security/unsafe-c-call": "Memory-unsafe C call",
+	"security/prompt-injection": "Prompt injection (untrusted system prompt)",
+	"security/unsandboxed-agent-tool": "Unsandboxed agent code execution tool",
+	"security/invisible-unicode-tags": "Invisible Unicode tag character (stealth injection)",
 	"dotnet/projects-skipped": "C# projects skipped by build-backed lint",
 	"cppcheck/chunks-skipped": "C/C++ files skipped by cppcheck",
 	"eslint/no-undef": "Undefined identifier",
@@ -18767,6 +20095,9 @@ const RULE_DESCRIPTIONS = {
 	"security/shell-injection": "Shell command is built from unsanitized input.",
 	"security/unsafe-deserialization": "Legacy .NET formatter can deserialize arbitrary types (RCE).",
 	"security/unsafe-c-call": "Unbounded C string/exec function with buffer-overflow or shell risk.",
+	"security/prompt-injection": "Untrusted dynamic variable interpolation into system or developer prompt.",
+	"security/unsandboxed-agent-tool": "Agent executes code or commands on host without container or interactive gate.",
+	"security/invisible-unicode-tags": "Invisible Unicode Tag block (U+E0000-U+E007F) used for prompt injection or ASCII smuggling.",
 	"dotnet/projects-skipped": "Build-backed C# lint only ran on restored projects; the rest were skipped.",
 	"cppcheck/chunks-skipped": "A cppcheck invocation timed out or failed on one or more chunks; their files were not analyzed.",
 	"oxlint/*": "JavaScript/TypeScript lint finding from oxlint.",
@@ -18841,7 +20172,8 @@ const renderActionRows = (steps, t) => {
 const renderTextSteps = (steps, t, s) => {
 	return steps.filter((step) => step.text).map((step) => {
 		const glyph = step.emphasis === "primary" ? s.hint : s.bullet;
-		return ` ${style(t, step.emphasis === "primary" ? "accent" : "muted", glyph)} ${highlightAislop(step.text ?? "", t)}`;
+		const tokenFor = step.emphasis === "primary" ? "accent" : "muted";
+		return ` ${style(t, tokenFor, glyph)} ${highlightAislop(step.text ?? "", t)}`;
 	});
 };
 const renderSummary = (input, deps = {}) => {
@@ -18898,10 +20230,14 @@ const renderSummary = (input, deps = {}) => {
 	return lines.join("\n");
 };
 const renderStarCta = (deps = {}) => {
-	return `\n ${style(deps.theme ?? theme, "muted", `★ Found this useful? Consider purchasing this software at ${terminalLink("https://raigal.dev")}`)}\n`;
+	const t = deps.theme ?? theme;
+	const repository = terminalLink("https://raigal.dev");
+	return `\n ${style(t, "muted", `★ Found this useful? Consider purchasing this software at ${repository}`)}\n`;
 };
 const renderTeamCta = (deps = {}) => {
-	return `\n ${style(deps.theme ?? theme, "muted", `→ Using raigal with a team? Get a 14-day team baseline at ${terminalLink("https://raigal.dev/contact?intent=team-baseline")}`)}\n`;
+	const t = deps.theme ?? theme;
+	const href = terminalLink("https://raigal.dev/contact?intent=team-baseline");
+	return `\n ${style(t, "muted", `→ Using raigal with a team? Get a 14-day team baseline at ${href}`)}\n`;
 };
 const renderCleanRun = (input, deps = {}) => {
 	const t = deps.theme ?? theme;
@@ -18960,7 +20296,7 @@ const buildScanNextSteps = (input) => {
 		emphasis: "primary",
 		label: "Provider",
 		command: `${input.invocation} agent --provider codex`,
-		detail: "or use --provider claude/opencode"
+		detail: "or use --provider claude/opencode/pi"
 	}, {
 		emphasis: "muted",
 		label: "Preview",
@@ -19119,13 +20455,15 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 	const configDir = findConfigDir(resolvedDir);
 	const rulesPath = configDir ? path.join(configDir, RULES_FILE) : void 0;
 	const engineConfig = {
+		overrides: config.overrides,
+		rules: config.rules,
 		quality: config.quality,
 		security: config.security,
 		lint: config.lint,
 		architectureRulesPath: config.engines.architecture ? rulesPath : void 0,
 		engines: config.engines
 	};
-	const { results: unannotated, suppressedCount } = applySuppressions((await runEnginesWithProgress({
+	const severityAdjusted = (await runEnginesWithProgress({
 		rootDirectory: resolvedDir,
 		languages: projectInfo.languages,
 		frameworks: projectInfo.frameworks,
@@ -19140,8 +20478,9 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		config: engineConfig
 	}, config.engines, machineOutput)).map((result) => ({
 		...result,
-		diagnostics: applyRuleSeverities(result.diagnostics, config.rules)
-	})), resolvedDir);
+		diagnostics: config.overrides.length ? result.diagnostics : applyRuleSeverities(result.diagnostics, config.rules)
+	}));
+	const { results: unannotated, suppressedCount } = applySuppressions(severityAdjusted, resolvedDir);
 	if (suppressedCount > 0 && !machineOutput) log.muted(`Suppressed ${suppressedCount} finding(s) via raigal-ignore directives`);
 	const changeMap = options.changes && !options.staged ? getChangedLineMap(resolvedDir, options.base) : null;
 	const results = changeMap ? unannotated.map((result) => ({
@@ -19178,6 +20517,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		engineIssues[r.engine] = r.diagnostics.length;
 		engineTimings[r.engine] = Math.round(r.elapsed);
 	}
+	const enginesFailed = results.filter((r) => r.failed).map((r) => r.engine);
 	const completion = {
 		exitCode,
 		score: scoreable ? scoreResult.score : null,
@@ -19187,7 +20527,8 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		warningCount: allDiagnostics.filter((d) => d.severity === "warning").length,
 		fixableCount: allDiagnostics.filter((d) => d.fixable).length,
 		engineIssues,
-		engineTimings
+		engineTimings,
+		...enginesFailed.length > 0 ? { properties: { engines_failed: enginesFailed } } : {}
 	};
 	recordScanToCloud({
 		results,
@@ -19200,12 +20541,12 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		scoreFileCount
 	});
 	if (options.sarif) {
-		const { buildSarifLog } = await import("./sarif-Do8E1xhZ.js");
+		const { buildSarifLog } = await import("./sarif-CpuYM3aK.js");
 		console.log(JSON.stringify(buildSarifLog(results), null, 2));
 		return completion;
 	}
 	if (options.json) {
-		const { buildJsonOutput } = await import("./json-C2IwKr9o.js");
+		const { buildJsonOutput } = await import("./json-BflWt4dX.js");
 		const jsonOut = buildJsonOutput(results, scoreResult, scoreFileCount, elapsedMs, scanCoverage);
 		console.log(JSON.stringify(jsonOut, null, 2));
 		return completion;
@@ -19238,6 +20579,18 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		printBrand: options.printBrand,
 		showPilotInvitation
 	}));
+	if (options.command !== "ci" && options.printBrand !== false) {
+		const nudge = buildHookNudge({
+			installedAgentCount: detectRaigalHooks({
+				home: os.homedir(),
+				cwd: resolvedDir
+			}).length,
+			isTty: Boolean(process.stdout.isTTY),
+			isCi: isCiEnv(),
+			invocation: detectInvocation()
+		});
+		if (nudge) process.stdout.write(nudge);
+	}
 	return completion;
 };
 //#endregion
@@ -19347,7 +20700,8 @@ const runFixBody = async (resolvedDir, config, options, projectInfo) => {
 		brand: options.printBrand !== false
 	}));
 	const safe = Boolean(options.safe);
-	const scope = collectFixFileScope(resolvedDir, [...config.exclude, ...readAislopIgnorePatterns(resolvedDir)], config.include, options);
+	const excludePatterns = [...config.exclude, ...readAislopIgnorePatterns(resolvedDir)];
+	const scope = collectFixFileScope(resolvedDir, excludePatterns, config.include, options);
 	const scopedProjectInfo = scope ? {
 		...projectInfo,
 		languages: detectSourceLanguages([...scope.files, ...scope.testFiles])
@@ -19402,6 +20756,8 @@ const runFixBody = async (resolvedDir, config, options, projectInfo) => {
 	const configDir = findConfigDir(resolvedDir);
 	const rulesPath = configDir ? path.join(configDir, RULES_FILE) : void 0;
 	const engineConfig = {
+		overrides: config.overrides,
+		rules: config.rules,
 		quality: config.quality,
 		security: config.security,
 		lint: config.lint,
@@ -19427,7 +20783,7 @@ const runFixBody = async (resolvedDir, config, options, projectInfo) => {
 		status: "done",
 		label: "Verification complete"
 	});
-	const scanResults = appendPostFixLintResult(verificationResults, collectPostFixLintDiagnostics(steps));
+	const scanResults = appendPostFixLintResult(verificationResults, applyFileOverrides(collectPostFixLintDiagnostics(steps), context));
 	const allDiagnostics = scanResults.flatMap((r) => r.diagnostics);
 	const scoreResult = calculateScore(allDiagnostics, config.scoring.weights, config.scoring.thresholds, scope ? scope.scoreFileCount : projectInfo.sourceFileCount, config.scoring.smoothing, config.scoring.maxPerRule);
 	const errors = allDiagnostics.filter((d) => d.severity === "error").length;
@@ -19489,6 +20845,13 @@ const runFixBody = async (resolvedDir, config, options, projectInfo) => {
 	};
 };
 //#endregion
+//#region src/ui/prompts.ts
+const runCancellable = async (fn) => {
+	const value = await fn();
+	if (isCancel(value)) return void 0;
+	return value;
+};
+//#endregion
 //#region src/commands/init.ts
 const buildInitSuccessRender = (input) => {
 	const deps = {
@@ -19558,13 +20921,13 @@ const writeGithubWorkflow = (rootDirectory, enabled) => {
 	};
 };
 const promptForConfigChoices = async () => {
-	const enginesSelection = await multiselect({
+	const enginesSelection = await runCancellable(() => multiselect({
 		message: "Which engines should run?",
 		options: ENGINE_CHOICES,
 		initialValues: DEFAULT_ENGINE_SELECTION,
 		required: false
-	});
-	if (isCancel(enginesSelection)) return null;
+	}));
+	if (enginesSelection === void 0 || isCancel(enginesSelection)) return null;
 	const failBelowRaw = await text({
 		message: "CI quality gate — fail the build when the score drops below (0-100)",
 		initialValue: "70",
@@ -19695,16 +21058,18 @@ const initCommand = async (directory, options = {}) => {
 		status: "done",
 		label: `Wrote ${CONFIG_DIR}/${CONFIG_FILE}`
 	}];
-	if (choices.engines.includes("architecture")) if (!fs.existsSync(rulesPath)) {
-		fs.writeFileSync(rulesPath, DEFAULT_RULES_YAML);
-		steps.push({
-			status: "done",
-			label: `Wrote ${CONFIG_DIR}/${RULES_FILE}`
+	if (choices.engines.includes("architecture")) {
+		if (!fs.existsSync(rulesPath)) {
+			fs.writeFileSync(rulesPath, DEFAULT_RULES_YAML);
+			steps.push({
+				status: "done",
+				label: `Wrote ${CONFIG_DIR}/${RULES_FILE}`
+			});
+		} else steps.push({
+			status: "skipped",
+			label: `${CONFIG_DIR}/${RULES_FILE} already exists`
 		});
-	} else steps.push({
-		status: "skipped",
-		label: `${CONFIG_DIR}/${RULES_FILE} already exists`
-	});
+	}
 	const workflowResult = writeGithubWorkflow(resolvedDir, choices.writeGithubWorkflow);
 	if (workflowResult.status === "written") steps.push({
 		status: "done",
@@ -19898,8 +21263,10 @@ const runSearchPrompt = async (options) => {
 			}
 			if (key.name === "space" && options.mode === "multi") {
 				const item = filtered[cursor];
-				if (item) if (selected.has(item.value)) selected.delete(item.value);
-				else selected.add(item.value);
+				if (item) {
+					if (selected.has(item.value)) selected.delete(item.value);
+					else selected.add(item.value);
+				}
 				render();
 				return;
 			}
@@ -20095,7 +21462,8 @@ const BUILTIN_RULES = [
 			"typescript/*",
 			"dotnet/*",
 			"cppcheck/*",
-			"clang-tidy/*"
+			"clang-tidy/*",
+			"expo-doctor/*"
 		]
 	},
 	{
@@ -20194,7 +21562,10 @@ const BUILTIN_RULES = [
 			"security/shell-injection",
 			"security/unsafe-deserialization",
 			"security/unsafe-c-call",
-			"security/dependency-audit-skipped"
+			"security/dependency-audit-skipped",
+			"security/prompt-injection",
+			"security/unsandboxed-agent-tool",
+			"security/invisible-unicode-tags"
 		]
 	}
 ];
@@ -20204,7 +21575,8 @@ const collectRuleEntries = (directory) => {
 	for (const { engine, rules } of BUILTIN_RULES) for (const rule of rules) entries.push(toRuleEntry(engine, rule));
 	const configDir = findConfigDir(resolvedDir);
 	if (configDir) {
-		const archRules = loadArchitectureRules(path.join(configDir, RULES_FILE));
+		const rulesPath = path.join(configDir, RULES_FILE);
+		const archRules = loadArchitectureRules(rulesPath);
 		for (const rule of archRules) entries.push({
 			id: `arch/${rule.name}`,
 			engine: "architecture",