@methiu/raigal 0.2.0 → 0.2.3

package/dist/mcp.js

@@ -12,7 +12,7 @@ import { createPublicKey, randomUUID, verify } from "node:crypto";
 import { spawn, spawnSync } from "node:child_process";
 import { z as z$1 } from "zod";
 import YAML, { parse } from "yaml";
-import micromatch from "micromatch";
+import picomatch from "picomatch";
 import ts from "typescript";
 import { parse as parse$1 } from "smol-toml";
 //#region src/cloud/paths.ts
@@ -84,7 +84,7 @@ const getActiveToken = () => {
 };
 //#endregion
 //#region src/version.ts
-const APP_VERSION = "0.2.0";
+const APP_VERSION = "0.2.3";
 //#endregion
 //#region src/cloud/contract.ts
 const Severity = z.enum(["error", "warning"]);
@@ -347,7 +347,9 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	if (!header.kid) throw new JwtVerificationError("JWT header missing 'kid'", "unknown_kid");
 	const publicKey = getPublicKey(header.kid);
 	if (!publicKey) throw new JwtVerificationError(`Unknown or untrusted signing key id (kid: ${header.kid})`, "unknown_kid");
-	if (!verify(null, Buffer.from(`${headerB64}.${payloadB64}`, "utf-8"), publicKey, Buffer.from(signatureB64, "base64url"))) throw new JwtVerificationError("Invalid JWT cryptographic signature", "invalid_signature");
+	const signedData = Buffer.from(`${headerB64}.${payloadB64}`, "utf-8");
+	const signature = Buffer.from(signatureB64, "base64url");
+	if (!verify(null, signedData, publicKey, signature)) throw new JwtVerificationError("Invalid JWT cryptographic signature", "invalid_signature");
 	let rawPayload;
 	try {
 		rawPayload = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf-8"));
@@ -359,7 +361,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const claims = parsed.data;
 	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
 	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.2.0", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (!isVersionAtLeast("0.2.3", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -393,7 +395,7 @@ const fetchGitHubOidcToken = async () => {
 };
 //#endregion
 //#region src/cloud/entitlement.ts
-const GRACE_PERIOD_SECONDS = 4320 * 60;
+const GRACE_PERIOD_SECONDS = 259200;
 var MissingCredentialError = class extends Error {
 	constructor(message = "No organization credential found") {
 		super(message);
@@ -473,6 +475,10 @@ const handleEntitlementFetchError = (err, cached, cachedClaims, now) => {
 			nowSeconds: now,
 			allowGraceSeconds: GRACE_PERIOD_SECONDS
 		});
+		if (graceClaims.plan === "trial" && graceClaims.trial_ends_at && now > Math.floor(new Date(graceClaims.trial_ends_at).getTime() / 1e3)) {
+			clearCachedEntitlement();
+			throw new LicenceDeniedError("Organization trial has expired", "trial_expired");
+		}
 		return {
 			jwt: cached.entitlement,
 			claims: graceClaims,
@@ -480,6 +486,7 @@ const handleEntitlementFetchError = (err, cached, cachedClaims, now) => {
 			grace: now > graceClaims.exp
 		};
 	} catch (jwtErr) {
+		if (jwtErr instanceof LicenceDeniedError) throw jwtErr;
 		if (jwtErr instanceof JwtVerificationError && jwtErr.code === "expired_beyond_grace") throw new LicenceUnverifiableError(`Raigal license could not be verified online and the offline grace period expired on ${(/* @__PURE__ */ new Date((cachedClaims?.exp ?? 0) * 1e3)).toISOString()}. Check network connectivity or Raigal Cloud status.`);
 	}
 	throw new LicenceUnverifiableError(`Raigal license could not be verified online (${err instanceof Error ? err.message : String(err)}). Check network connectivity or Raigal Cloud status.`);
@@ -494,7 +501,8 @@ const getEntitlement = async () => {
 	} catch {
 		cachedClaims = null;
 	}
-	if (cached && cachedClaims && now < cached.refresh_after) return {
+	const isTrialExpired = cachedClaims?.plan === "trial" && cachedClaims.trial_ends_at && now > Math.floor(new Date(cachedClaims.trial_ends_at).getTime() / 1e3);
+	if (cached && cachedClaims && !isTrialExpired && now < cached.refresh_after) return {
 		jwt: cached.entitlement,
 		claims: cachedClaims,
 		fromCache: true
@@ -503,7 +511,7 @@ const getEntitlement = async () => {
 	if (!activeToken) {
 		oidcToken = await fetchGitHubOidcToken();
 		if (!oidcToken) {
-			if (cached && cachedClaims) return {
+			if (cached && cachedClaims && !isTrialExpired) return {
 				jwt: cached.entitlement,
 				claims: cachedClaims,
 				fromCache: true
@@ -512,7 +520,8 @@ const getEntitlement = async () => {
 		}
 	} else oidcToken = await fetchGitHubOidcToken();
 	try {
-		const response = await fetchEntitlementFromApi(activeToken?.token ?? "", oidcToken);
+		const tokenToPass = activeToken?.token ?? "";
+		const response = await fetchEntitlementFromApi(tokenToPass, oidcToken);
 		const claims = verifyEntitlementJwt(response.entitlement, { nowSeconds: now });
 		saveCachedEntitlement(response.entitlement, response.refresh_after);
 		return {
@@ -526,7 +535,7 @@ const getEntitlement = async () => {
 };
 //#endregion
 //#region src/cloud/owner.ts
-const GITHUB_REMOTE_RE = /^(?:(?:git@|ssh:\/\/(?:git@)?)github\.com(?::(?:\d+\/)?|[:/])|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/.\s]+?)(?:\.git)?\s*$/;
+const GITHUB_REMOTE_RE = /^(?:(?:git@|ssh:\/\/(?:git@)?)github\.com(?::(?:\d+\/)?|[:/])|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/\s]+?)(?:\.git)?\s*$/;
 const parseGitRemote = (rawUrl) => {
 	if (!rawUrl) return {
 		owner: null,
@@ -664,6 +673,23 @@ const requireEntitlement = async (options = {}) => {
 	try {
 		const entitlement = await getEntitlement();
 		const tokenKind = getActiveToken()?.kind ?? "session";
+		if (entitlement.claims.plan === "trial" && entitlement.claims.trial_ends_at) {
+			const trialEnd = new Date(entitlement.claims.trial_ends_at).getTime();
+			if (Date.now() > trialEnd) {
+				const message = "Raigal license denied: Organization trial has expired";
+				if (mode === "throw") throw new LicenceDeniedError(message, "trial_expired");
+				if (mode === "fatal") {
+					process.stderr.write(`${message}\n`);
+					process.exit(30);
+				}
+				process.stderr.write(`[raigal] ${message}\n`);
+				return {
+					ok: false,
+					exitCode: 30,
+					message
+				};
+			}
+		}
 		const detectedOwner = detectLocalRepoOwner(directory);
 		if (options.repoOwner) detectedOwner.owner = options.repoOwner.toLowerCase();
 		const ownerCheck = checkOwnerAgainstAllowlist(detectedOwner, entitlement.claims.allowed_owners, tokenKind);
@@ -784,12 +810,13 @@ const DEFAULT_CONFIG = {
 		format: "json"
 	},
 	telemetry: { enabled: true },
-	rules: {}
+	rules: {},
+	overrides: []
 };
 //#endregion
 //#region src/config/extends.ts
 const MAX_DEPTH$1 = 5;
-const MAX_CONFIG_BYTES = 1024 * 1024;
+const MAX_CONFIG_BYTES = 1048576;
 const isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 const deepMerge = (...sources) => {
 	const result = {};
@@ -970,12 +997,25 @@ const CiSchema = z.object({
 	format: z.enum(["json"]).default("json")
 }).strict();
 const TelemetrySchema = z.object({ enabled: z.boolean().default(true) }).strict();
+const BaselineConfigSchema = z.object({ mode: z.enum(["strict", "relaxed"]).default("relaxed") }).strict();
+const LicensingConfigSchema = z.object({ onLapse: z.enum(["fail-open", "fail-closed"]).default("fail-open") }).strict();
+const WorkspaceConfigSchema = z.object({ minimumFloor: z.number().min(0).max(100).default(50) }).strict();
 const RuleSeverityOverride = z.enum([
 	"error",
 	"warning",
 	"off"
 ]);
 const RulesSchema = z.record(z.string(), RuleSeverityOverride).default(() => ({}));
+const FileOverrideSchema = z.object({
+	files: z.array(z.string().min(1)).min(1),
+	quality: z.object({
+		maxFunctionLoc: QualitySchema.shape.maxFunctionLoc.unwrap().optional(),
+		maxFileLoc: QualitySchema.shape.maxFileLoc.unwrap().optional(),
+		maxNesting: QualitySchema.shape.maxNesting.unwrap().optional(),
+		maxParams: QualitySchema.shape.maxParams.unwrap().optional()
+	}).optional(),
+	rules: z.record(z.string(), RuleSeverityOverride).optional()
+});
 const AislopConfigSchema = z.object({
 	version: z.number().default(1),
 	extends: z.union([z.string(), z.array(z.string())]).optional(),
@@ -1030,7 +1070,11 @@ const AislopConfigSchema = z.object({
 		format: "json"
 	})),
 	telemetry: TelemetrySchema.default(() => ({ enabled: true })),
+	baseline: BaselineConfigSchema.optional(),
+	licensing: LicensingConfigSchema.optional(),
+	workspace: WorkspaceConfigSchema.optional(),
 	rules: RulesSchema,
+	overrides: z.array(FileOverrideSchema).default(() => []),
 	exclude: z.array(z.string()).default(() => [
 		"node_modules",
 		".git",
@@ -1062,6 +1106,9 @@ const KNOWN_KEYS_BY_PATH = {
 		"scoring",
 		"ci",
 		"telemetry",
+		"baseline",
+		"licensing",
+		"workspace",
 		"rules",
 		"exclude",
 		"include"
@@ -1112,7 +1159,10 @@ const KNOWN_KEYS_BY_PATH = {
 	],
 	"scoring.thresholds": ["good", "ok"],
 	ci: ["failBelow", "format"],
-	telemetry: ["enabled"]
+	telemetry: ["enabled"],
+	baseline: ["mode"],
+	licensing: ["onLapse"],
+	workspace: ["minimumFloor"]
 };
 const levenshtein = (a, b) => {
 	const m = a.length;
@@ -1242,13 +1292,140 @@ const loadConfig = (directory) => {
 	const configPath = findConfigFile(directory);
 	if (!configPath) return DEFAULT_CONFIG;
 	try {
-		return validateConfig(loadConfigChain(configPath), configPath);
+		const merged = loadConfigChain(configPath);
+		return validateConfig(merged, configPath);
 	} catch (error) {
 		if (error instanceof ConfigError) throw error;
 		throw new ConfigError(configPath, `Failed to parse ${configPath}: ${error instanceof Error ? error.message : String(error)}`);
 	}
 };
 //#endregion
+//#region src/utils/globs.ts
+const MAX_BRACE_EXPANSIONS = 256;
+const braceListAt = (pattern, start) => {
+	let depth = 0;
+	const commas = [];
+	for (let i = start; i < pattern.length; i += 1) {
+		const char = pattern[i];
+		if (char === "\\") i += 1;
+		else if (char === "{") depth += 1;
+		else if (char === ",") {
+			if (depth === 1) commas.push(i);
+		} else if (char === "}") {
+			depth -= 1;
+			if (depth === 0) return commas.length > 0 ? {
+				start,
+				end: i,
+				commas
+			} : null;
+		}
+	}
+	return null;
+};
+const findBraceList = (pattern) => {
+	for (let start = pattern.indexOf("{"); start !== -1; start = pattern.indexOf("{", start + 1)) {
+		if (start > 0 && pattern[start - 1] === "\\") continue;
+		const list = braceListAt(pattern, start);
+		if (list) return list;
+	}
+	return null;
+};
+const expandInto = (pattern, results) => {
+	const list = findBraceList(pattern);
+	if (!list) {
+		results.push(pattern);
+		return results.length <= MAX_BRACE_EXPANSIONS;
+	}
+	const bounds = [
+		list.start,
+		...list.commas,
+		list.end
+	];
+	const prefix = pattern.slice(0, list.start);
+	const suffix = pattern.slice(list.end + 1);
+	for (let i = 0; i < bounds.length - 1; i += 1) {
+		const option = pattern.slice(bounds[i] + 1, bounds[i + 1]);
+		if (!expandInto(`${prefix}${option}${suffix}`, results)) return false;
+	}
+	return true;
+};
+const expandBraceLists = (pattern) => {
+	const results = [];
+	return expandInto(pattern, results) ? results : [pattern];
+};
+const isNegated = (pattern) => picomatch.scan(pattern).negated;
+const matchesGlobList = (value, patterns, options = {}) => {
+	const expanded = patterns.flatMap(expandBraceLists);
+	const positives = expanded.filter((pattern) => !isNegated(pattern));
+	const negatives = expanded.filter(isNegated).map((pattern) => pattern.slice(1));
+	const included = positives.length === 0 || picomatch.isMatch(value, positives, options);
+	const excluded = negatives.length > 0 && picomatch.isMatch(value, negatives, options);
+	return included && !excluded;
+};
+//#endregion
+//#region src/scoring/rule-severity.ts
+/**
+* Apply per-rule severity overrides from config: "off" drops the diagnostic,
+* "error"/"warning" rewrite its severity before scoring and rendering.
+*/
+const applyRuleSeverities = (diagnostics, overrides) => {
+	if (Object.keys(overrides).length === 0) return diagnostics;
+	const result = [];
+	for (const diagnostic of diagnostics) {
+		const override = overrides[diagnostic.rule];
+		if (!override) {
+			result.push(diagnostic);
+			continue;
+		}
+		if (override === "off") continue;
+		result.push(override === diagnostic.severity ? diagnostic : {
+			...diagnostic,
+			severity: override
+		});
+	}
+	return result;
+};
+//#endregion
+//#region src/config/overrides.ts
+const overrideRelativePath = (rootDirectory, filePath) => {
+	const paths = path.win32.isAbsolute(rootDirectory) && !path.posix.isAbsolute(rootDirectory) ? path.win32 : path.posix;
+	const root = rootDirectory.replaceAll("\\", "/");
+	const file = filePath.replaceAll("\\", "/");
+	return paths.normalize(paths.isAbsolute(file) ? paths.relative(root, file) : file).replaceAll("\\", "/");
+};
+const matchesEntry = (relativePath, patterns) => matchesGlobList(relativePath, patterns, { dot: true });
+const resolveFilePolicy = (config, relativePath) => {
+	let quality = config.quality;
+	let rules = config.rules ?? {};
+	if (relativePath === ".." || relativePath.startsWith("../") || path.win32.isAbsolute(relativePath)) return {
+		quality,
+		rules
+	};
+	for (const entry of config.overrides ?? []) {
+		if (!matchesEntry(relativePath, entry.files)) continue;
+		if (entry.quality) quality = {
+			...quality,
+			...entry.quality
+		};
+		if (entry.rules) rules = {
+			...rules,
+			...entry.rules
+		};
+	}
+	return {
+		quality,
+		rules
+	};
+};
+const applyFileOverrides = (diagnostics, context) => {
+	if (!context.config.overrides?.length) return diagnostics;
+	return diagnostics.flatMap((diagnostic) => {
+		const relativePath = overrideRelativePath(context.rootDirectory, diagnostic.filePath);
+		const { rules } = resolveFilePolicy(context.config, relativePath);
+		return applyRuleSeverities([diagnostic], rules);
+	});
+};
+//#endregion
 //#region src/utils/paths.ts
 /** Normalize an OS path to forward-slash (POSIX) separators. */
 const toPosix = (p) => p.split(path.sep).join("/");
@@ -1275,13 +1452,13 @@ const normalizeExcludePatterns = (patterns) => patterns.flatMap((pattern) => {
 	const normalized = withoutProjectPrefix.slice(0, end);
 	if (normalized.length === 0) return [];
 	if (normalized.length > 256) return [];
-	if (micromatch.scan(normalized).isGlob) return [normalized];
+	if (picomatch.scan(normalized).isGlob) return [normalized];
 	if (normalized.startsWith(".") && !normalized.includes("/")) return supportedGlobPatterns([`**/${normalized}`, `**/${normalized}/**`]);
 	return supportedGlobPatterns([normalized, `${normalized}/**`]);
 });
 const isPathExcluded = (relativePath, normalizedPatterns) => {
 	if (normalizedPatterns.length === 0) return false;
-	return micromatch.isMatch(relativePath, normalizedPatterns, { dot: true });
+	return picomatch.isMatch(relativePath, normalizedPatterns, { dot: true });
 };
 const filterExcludedDiagnostics = (diagnostics, rootDirectory, excludePatterns) => {
 	if (!excludePatterns || excludePatterns.length === 0) return diagnostics;
@@ -1294,7 +1471,7 @@ const filterExcludedDiagnostics = (diagnostics, rootDirectory, excludePatterns)
 };
 //#endregion
 //#region src/utils/project-path-safety.ts
-const MAX_PROJECT_CONFIG_BYTES = 1024 * 1024;
+const MAX_PROJECT_CONFIG_BYTES = 1048576;
 const isWithinDirectory$2 = (rootDirectory, candidate) => {
 	const relative = path.relative(rootDirectory, candidate);
 	return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
@@ -1381,7 +1558,7 @@ const isAutoGenerated = (filePath) => {
 };
 //#endregion
 //#region src/utils/git-ignore.ts
-const MAX_BUFFER$1 = 50 * 1024 * 1024;
+const MAX_BUFFER$1 = 52428800;
 const NOT_IGNORED_ARGUMENTS = [
 	"ls-files",
 	"--cached",
@@ -1492,7 +1669,7 @@ const dropGitIgnoredPaths = (rootDirectory, absolutePaths) => {
 };
 //#endregion
 //#region src/utils/project-file-list.ts
-const MAX_BUFFER = 50 * 1024 * 1024;
+const MAX_BUFFER = 52428800;
 const normalizePruneDirectories = (directories) => new Set([...directories].map((directory) => directory.toLowerCase()));
 const isInPrunedDirectory = (filePath, pruneDirectories) => {
 	const pathSegments = filePath.split("/");
@@ -1703,12 +1880,13 @@ const normalizeIncludePatterns = (patterns) => patterns.flatMap((pattern) => {
 	const normalized = pattern.trim().replace(/^\.\//, "").replace(/\/$/, "");
 	if (normalized === "" || normalized === ".") return ["**"];
 	if (normalized.length > 256) return [];
-	if (micromatch.scan(normalized).isGlob) return [normalized];
+	if (picomatch.scan(normalized).isGlob) return [normalized];
 	return supportedGlobPatterns([normalized, `${normalized}/**`]);
 });
 const createPathMatcher = (patterns) => {
-	const matchers = patterns.map((pattern) => micromatch.matcher(pattern, { dot: true }));
-	return (filePath) => matchers.some((matches) => matches(filePath));
+	if (patterns.length === 0) return () => false;
+	const isMatch = picomatch(patterns, { dot: true });
+	return (filePath) => isMatch(filePath);
 };
 const filterFiles = (rootDirectory, files, options) => {
 	const extraExtensions = new Set(options.extraExtensions);
@@ -2405,7 +2583,7 @@ const tokenizeJs = (content, ext = ".ts") => {
 };
 //#endregion
 //#region src/utils/source-masker.ts
-const JS_EXTS$2 = /* @__PURE__ */ new Set([
+const JS_EXTS$3 = /* @__PURE__ */ new Set([
 	".ts",
 	".tsx",
 	".js",
@@ -2413,7 +2591,7 @@ const JS_EXTS$2 = /* @__PURE__ */ new Set([
 	".mjs",
 	".cjs"
 ]);
-const PY_EXTS = /* @__PURE__ */ new Set([".py"]);
+const PY_EXTS$1 = /* @__PURE__ */ new Set([".py"]);
 const RB_EXTS = /* @__PURE__ */ new Set([".rb"]);
 const PHP_EXTS = /* @__PURE__ */ new Set([".php"]);
 const CSHARP_EXTS = /* @__PURE__ */ new Set([".cs"]);
@@ -2437,8 +2615,8 @@ const C_STYLE_COMMENT_EXTS = /* @__PURE__ */ new Set([
 	".zig"
 ]);
 const familyForExt = (ext) => {
-	if (JS_EXTS$2.has(ext)) return "js";
-	if (PY_EXTS.has(ext)) return "py";
+	if (JS_EXTS$3.has(ext)) return "js";
+	if (PY_EXTS$1.has(ext)) return "py";
 	if (RB_EXTS.has(ext)) return "rb";
 	if (PHP_EXTS.has(ext)) return "php";
 	if (CSHARP_EXTS.has(ext)) return "csharp";
@@ -2670,7 +2848,7 @@ const getCommentLines = (content, ext) => {
 };
 //#endregion
 //#region src/engines/ai-slop/abstractions.ts
-const JS_EXTS$1 = /* @__PURE__ */ new Set([
+const JS_EXTS$2 = /* @__PURE__ */ new Set([
 	".ts",
 	".tsx",
 	".js",
@@ -2681,11 +2859,11 @@ const JS_EXTS$1 = /* @__PURE__ */ new Set([
 const THIN_WRAPPER_PATTERNS = [
 	{
 		pattern: /(?:export\s+)?(?:async\s+)?function\s+(\w+)\s*\([^)]*\)\s*(?::\s*\w[^{]*)?\{\s*\n?\s*return\s+\w+\([^)]*\);\s*\n?\s*\}/g,
-		extensions: JS_EXTS$1
+		extensions: JS_EXTS$2
 	},
 	{
 		pattern: /(?:export\s+)?const\s+(\w+)\s*=\s*(?:async\s+)?\([^)]*\)\s*(?::\s*\w[^=]*)?\s*=>\s*\w+\([^)]*\);/g,
-		extensions: JS_EXTS$1
+		extensions: JS_EXTS$2
 	},
 	{
 		pattern: /def\s+(\w+)\s*\([^)]*\)(?:\s*->[^:]*)?:\s*\n\s+return\s+\w+\([^)]*\)\s*$/gm,
@@ -3933,7 +4111,7 @@ const scriptKindFor$1 = (ext) => {
 	}
 };
 const lineFor$1 = (sourceFile, node) => sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
-const makeDiagnostic = (filePath, line, rule, message, help) => ({
+const makeDiagnostic$1 = (filePath, line, rule, message, help) => ({
 	filePath,
 	engine: "ai-slop",
 	rule,
@@ -3983,7 +4161,7 @@ const detectRedundantTryCatch = (sourceFile, relativePath) => {
 		if (ts.isTryStatement(node) && node.catchClause && !node.finallyBlock) {
 			const catchNameNode = node.catchClause.variableDeclaration?.name;
 			const [onlyStatement] = node.catchClause.block.statements;
-			if (catchNameNode && ts.isIdentifier(catchNameNode) && node.catchClause.block.statements.length === 1 && onlyStatement && (isRethrowStatement(onlyStatement, catchNameNode.text) || isPromiseRejectRethrow(onlyStatement, catchNameNode.text))) diagnostics.push(makeDiagnostic(relativePath, lineFor$1(sourceFile, node.catchClause), "ai-slop/redundant-try-catch", "Catch block only rethrows the same error", "Remove the try/catch or add useful context, cleanup, or recovery. Rethrowing unchanged errors is usually defensive agent noise."));
+			if (catchNameNode && ts.isIdentifier(catchNameNode) && node.catchClause.block.statements.length === 1 && onlyStatement && (isRethrowStatement(onlyStatement, catchNameNode.text) || isPromiseRejectRethrow(onlyStatement, catchNameNode.text))) diagnostics.push(makeDiagnostic$1(relativePath, lineFor$1(sourceFile, node.catchClause), "ai-slop/redundant-try-catch", "Catch block only rethrows the same error", "Remove the try/catch or add useful context, cleanup, or recovery. Rethrowing unchanged errors is usually defensive agent noise."));
 		}
 		ts.forEachChild(node, visit);
 	};
@@ -4001,7 +4179,7 @@ const detectPrimitiveCoercions = (sourceFile, relativePath) => {
 				const [arg] = child.arguments;
 				if (arg && ts.isIdentifier(arg)) {
 					const primitive = params.get(arg.text);
-					if (primitive && child.expression.text === COERCION_CTORS[primitive]) diagnostics.push(makeDiagnostic(relativePath, lineFor$1(sourceFile, child), "ai-slop/redundant-type-coercion", `Parameter '${arg.text}' is already typed as ${primitive} but is coerced again`, "Trust the typed boundary or validate unknown input before this function. Re-coercing already typed parameters is usually defensive agent noise."));
+					if (primitive && child.expression.text === COERCION_CTORS[primitive]) diagnostics.push(makeDiagnostic$1(relativePath, lineFor$1(sourceFile, child), "ai-slop/redundant-type-coercion", `Parameter '${arg.text}' is already typed as ${primitive} but is coerced again`, "Trust the typed boundary or validate unknown input before this function. Re-coercing already typed parameters is usually defensive agent noise."));
 				}
 			}
 			ts.forEachChild(child, visitBody);
@@ -4044,7 +4222,7 @@ const detectDuplicateExportedTypes = (parsedSources) => {
 				continue;
 			}
 			if (previous.filePath === declaration.filePath) continue;
-			diagnostics.push(makeDiagnostic(declaration.filePath, declaration.line, "ai-slop/duplicate-type-declaration", `Exported type '${declaration.name}' duplicates an existing declaration`, `Reuse or import the existing type from ${previous.filePath} instead of re-declaring the same shape in another file.`));
+			diagnostics.push(makeDiagnostic$1(declaration.filePath, declaration.line, "ai-slop/duplicate-type-declaration", `Exported type '${declaration.name}' duplicates an existing declaration`, `Reuse or import the existing type from ${previous.filePath} instead of re-declaring the same shape in another file.`));
 		}
 	}
 	return diagnostics;
@@ -4146,7 +4324,7 @@ const detectDuplicateImports = async (context) => {
 					rule: "ai-slop/duplicate-import",
 					severity: "warning",
 					message: `"${spec}" is also imported on line ${firstLine}. Merge into a single import statement.`,
-					help: "Two imports from the same module split readers' attention and grow the import block. Run aislop fix to merge them automatically.",
+					help: "Two imports from the same module split readers' attention and grow the import block. Run raigal fix to merge them automatically.",
 					line: dup.line,
 					column: 1,
 					category: "AI Slop",
@@ -5854,7 +6032,8 @@ const isJsRelativeOrAbsolute = (spec) => spec.startsWith(".") || spec.startsWith
 const RUNTIME_BUILTINS = /* @__PURE__ */ new Set(["bun"]);
 const isJsBuiltin = (spec) => {
 	if (RUNTIME_BUILTINS.has(spec)) return true;
-	return isBuiltin(spec.startsWith("node:") ? spec.slice(5) : spec) || isBuiltin(spec);
+	const stripped = spec.startsWith("node:") ? spec.slice(5) : spec;
+	return isBuiltin(stripped) || isBuiltin(spec);
 };
 const VIRTUAL_MODULE_PREFIXES = [
 	"astro:",
@@ -6066,7 +6245,8 @@ const isLocalAliasReplacement = (rawValue, configDirectory, rootDirectory) => {
 	if (!target) return false;
 	if (!target.startsWith(".") && !target.startsWith("/") && !target.startsWith("~/") && !target.startsWith("@/")) return false;
 	const normalized = target.startsWith("~/") || target.startsWith("@/") ? target.slice(2) : target;
-	return isRootBoundedTarget(path.isAbsolute(normalized) ? normalized : path.resolve(configDirectory, normalized), rootDirectory);
+	const candidate = path.isAbsolute(normalized) ? normalized : path.resolve(configDirectory, normalized);
+	return isRootBoundedTarget(candidate, rootDirectory);
 };
 const hasValidPackageImportTarget = (value, packageDirectory, rootDirectory) => {
 	if (!isRootBoundedTarget(packageDirectory, rootDirectory)) return false;
@@ -7186,7 +7366,9 @@ const isRustDocCommentLine = (line) => {
 };
 const collectBlocks = (sourceLines, syntax, content, ext) => {
 	const blocks = [];
-	const commentLines = getCommentLines(content ?? sourceLines.join("\n"), ext ?? (syntax.linePrefixes.includes("//") ? ".ts" : ".py"));
+	const actualContent = content ?? sourceLines.join("\n");
+	const actualExt = ext ?? (syntax.linePrefixes.includes("//") ? ".ts" : ".py");
+	const commentLines = getCommentLines(actualContent, actualExt);
 	let i = 0;
 	while (i < sourceLines.length) {
 		const line = sourceLines[i];
@@ -7514,7 +7696,8 @@ const detectNarrativeComments = async (context) => {
 		} catch {
 			continue;
 		}
-		const blocks = collectBlocks(content.split("\n"), syntax, content, ext);
+		const lines = content.split("\n");
+		const blocks = collectBlocks(lines, syntax, content, ext);
 		for (const block of blocks) {
 			const { matched, reason } = detectNarrativeInBlock(block, ext);
 			if (!matched) continue;
@@ -7986,7 +8169,7 @@ const detectRustPatterns = async (context) => {
 };
 //#endregion
 //#region src/engines/ai-slop/silent-recovery.ts
-const JS_EXTS = /* @__PURE__ */ new Set([
+const JS_EXTS$1 = /* @__PURE__ */ new Set([
 	".ts",
 	".tsx",
 	".js",
@@ -8181,7 +8364,7 @@ const detectSilentRecovery = async (context) => {
 	for (const filePath of files) {
 		if (isAutoGenerated(filePath)) continue;
 		const ext = path.extname(filePath);
-		const isJs = JS_EXTS.has(ext);
+		const isJs = JS_EXTS$1.has(ext);
 		if (!isJs && !(ext === ".py")) continue;
 		const relPath = relativePosix(context.rootDirectory, filePath);
 		if (isNonProductionPath(relPath)) continue;
@@ -8466,7 +8649,7 @@ const detectUnusedCss = async (context) => {
 				rule: "ai-slop/unused-css",
 				severity: "warning",
 				message: `CSS class '.${def.name}' is defined but never referenced in the codebase`,
-				help: "Remove the dead CSS rule, or confirm the class is used dynamically (and add an aislop-ignore comment if so)",
+				help: "Remove the dead CSS rule, or confirm the class is used dynamically (and add a raigal-ignore comment if so)",
 				line: def.line,
 				column: 0,
 				category: "AI Slop",
@@ -9466,7 +9649,8 @@ const checkFunctionDiagnostics = (relativePath, fn, limits, ext) => {
 	const results = [];
 	const multiplier = functionLocMultiplier(fn, ext);
 	const fnMax = functionLocBudget(fn, ext, limits.maxFunctionLoc);
-	if (exceedsLimit(fn.lineCount - fn.templateLines, limits.maxFunctionLoc, multiplier)) results.push({
+	const effectiveLineCount = fn.lineCount - fn.templateLines;
+	if (exceedsLimit(effectiveLineCount, limits.maxFunctionLoc, multiplier)) results.push({
 		filePath: relativePath,
 		engine: "code-quality",
 		rule: "complexity/function-too-long",
@@ -9523,10 +9707,10 @@ const checkFileComplexity = (filePath, rootDirectory, limits) => {
 };
 const checkComplexity = async (context) => {
 	const files = getSourceFiles(context);
-	const limits = context.config.quality;
 	const diagnostics = [];
 	for (const filePath of files) {
 		if (isAutoGenerated(filePath)) continue;
+		const { quality: limits } = resolveFilePolicy(context.config, overrideRelativePath(context.rootDirectory, filePath));
 		diagnostics.push(...checkFileComplexity(filePath, context.rootDirectory, limits));
 	}
 	return diagnostics;
@@ -9556,14 +9740,14 @@ const isTrivialLine = (line) => {
 };
 const SVG_MARKUP_RE = /<\/?(?:svg|path|polyline|line|circle|rect|g)\b|(?:xmlns|viewBox|stroke(?:-width|-linecap|-linejoin)?|fill|fill-opacity|d|points|x1|x2|y1|y2)=/;
 const DATA_LITERAL_RE = /^\s*(?:[A-Za-z_$][\w$-]*:\s*(?:["'`[{]|\d|true\b|false\b|null\b)|["'`][^"'`]*["'`],?\s*$|[{}\]],?\s*$|\),?\s*$)/;
-const SUPPRESS_RE = /aislop[- ]ignore(?:-next-block|-file)?\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
-const FILE_SUPPRESS_RE = /aislop[- ]ignore-file\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
+const SUPPRESS_RE = /(?:raigal|aislop)[- ]ignore(?:-next-block|-file)?\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
+const FILE_SUPPRESS_RE = /(?:raigal|aislop)[- ]ignore-file\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
 const fileHasSuppression = (content) => FILE_SUPPRESS_RE.test(content);
 const isLowSignalMarkupWindow = (lines) => {
 	return lines.filter((line) => SVG_MARKUP_RE.test(line)).length >= Math.ceil(WINDOW_SIZE / 2);
 };
 const isLowSignalDataWindow = (lines) => {
-	return lines.filter((line) => DATA_LITERAL_RE.test(line)).length >= WINDOW_SIZE - 1;
+	return lines.filter((line) => DATA_LITERAL_RE.test(line)).length >= 9;
 };
 const findSuppressedLines = (lines) => {
 	const suppressed = /* @__PURE__ */ new Set();
@@ -9595,7 +9779,7 @@ const collectMeaningfulLines = (content) => {
 		if (isLowSignalDataWindow(window)) continue;
 		if (window.every(isTrivialLine)) continue;
 		const normalised = window.map(normaliseLine);
-		if (normalised.filter((n) => n.length > 0 && n !== "}" && n !== "{").length < WINDOW_SIZE - 1) continue;
+		if (normalised.filter((n) => n.length > 0 && n !== "}" && n !== "{").length < 9) continue;
 		if (new Set(normalised).size < MIN_DISTINCT_LINES) continue;
 		hits.push({
 			startLine: i + 1,
@@ -9883,8 +10067,8 @@ const shouldIncludeIssue = (issueType, filePath) => {
 	return !filePath.replace(/\\/g, "/").includes(".github/workflows/");
 };
 const DEPENDENCY_HELP = {
-	dependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `aislop fix`.",
-	devDependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `aislop fix`.",
+	dependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `raigal fix`.",
+	devDependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `raigal fix`.",
 	unlisted: "This package is imported in code but not declared in package.json. Run `npm install` to add it.",
 	unresolved: "This import cannot be resolved. Check for typos or missing packages.",
 	binaries: "This binary is used but its package is not in package.json."
@@ -10516,13 +10700,23 @@ const withReportPath = async (run) => {
 };
 const UNSUPPORTED_GLOB_SYNTAX = /[?[\]{}!|()\\]/;
 const isDotnetFormatPath = (pattern) => !pattern.startsWith("-") && !UNSUPPORTED_GLOB_SYNTAX.test(pattern);
+const expandBraces = (pattern, depth = 0) => {
+	if (depth > 10) return [pattern];
+	const match = /\{([^{}]+)\}/.exec(pattern);
+	if (!match) return [pattern];
+	const [fullMatch, options] = match;
+	const parts = options.split(",");
+	const prefix = pattern.slice(0, match.index);
+	const suffix = pattern.slice(match.index + fullMatch.length);
+	return parts.flatMap((part) => expandBraces(`${prefix}${part}${suffix}`, depth + 1));
+};
 const buildDotnetFormatExcludeScope = (excludePatterns) => {
 	const scope = {
 		excludeArguments: [],
 		unsupportedPatterns: []
 	};
 	for (const pattern of normalizeExcludePatterns(excludePatterns ?? [])) {
-		const expanded = micromatch.braces(pattern, { expand: true });
+		const expanded = expandBraces(pattern);
 		if (expanded.every(isDotnetFormatPath)) scope.excludeArguments.push(...expanded);
 		else scope.unsupportedPatterns.push(pattern);
 	}
@@ -10716,7 +10910,7 @@ const runGofmt = async (context) => {
 			rule: "go-formatting",
 			severity: "warning",
 			message: "Go file is not formatted correctly",
-			help: "Run `aislop fix` to auto-format with gofmt",
+			help: "Run `raigal fix` to auto-format with gofmt",
 			line: 0,
 			column: 0,
 			category: "Format",
@@ -10735,7 +10929,8 @@ const resolvePackageRoot = (startFile) => {
 	while (true) {
 		const packageJsonPath = path.join(current, "package.json");
 		if (fs.existsSync(packageJsonPath)) try {
-			if (JSON.parse(fs.readFileSync(packageJsonPath, "utf-8")).name === "aislop") return current;
+			const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+			if (packageJson.name === "aislop" || packageJson.name === "@methiu/raigal" || packageJson.name === "raigal") return current;
 		} catch {}
 		const parent = path.dirname(current);
 		if (parent === current) break;
@@ -10846,7 +11041,7 @@ const parseRuffFormatOutput = (output, rootDir) => {
 			rule: "python-formatting",
 			severity: "warning",
 			message: "Python file is not formatted correctly",
-			help: "Run `aislop fix` to auto-format with ruff",
+			help: "Run `raigal fix` to auto-format with ruff",
 			line: 0,
 			column: 0,
 			category: "Format",
@@ -10919,7 +11114,8 @@ const parseClangTidyOutput = (output, rootDirectory) => {
 const runClangTidy = async (context) => {
 	const compileCommandsDir = findCompileCommandsDir(context);
 	if (!compileCommandsDir) return [];
-	const sources = filterSourcesInDatabase(findCppSources(context).filter((f) => CPP_IMPL_EXTENSIONS.has(path.extname(f).toLowerCase())), readCompileCommandsFiles(compileCommandsDir));
+	const implSources = findCppSources(context).filter((f) => CPP_IMPL_EXTENSIONS.has(path.extname(f).toLowerCase()));
+	const sources = filterSourcesInDatabase(implSources, readCompileCommandsFiles(compileCommandsDir));
 	if (sources.length === 0) return [];
 	const diagnostics = [];
 	for (const chunk of chunkFilePaths(sources, CLANG_TIDY_CHUNK_MAX_FILES)) try {
@@ -11289,7 +11485,7 @@ const runExpoDoctor = async (context) => {
 		rule: "expo-doctor/config-error",
 		severity: "warning",
 		message: configError,
-		help: "Install project dependencies, then re-run `aislop scan`.",
+		help: "Install project dependencies, then re-run `raigal scan`.",
 		line: 0,
 		column: 0,
 		category: "Expo",
@@ -12107,7 +12303,7 @@ const normalizeEslintIgnorePatterns = (patterns) => patterns.map((pattern) => pa
 	if (!pattern.includes("*") && !path.extname(pattern)) return [`${pattern}/**`];
 	return [pattern];
 });
-const isEslintIgnored = (relativePath, patterns) => patterns.length > 0 && micromatch.isMatch(relativePath, patterns, { dot: true });
+const isEslintIgnored = (relativePath, patterns) => patterns.length > 0 && picomatch.isMatch(relativePath, patterns, { dot: true });
 const getOxlintTargets = (context) => {
 	const eslintIgnorePatterns = normalizeEslintIgnorePatterns(collectEslintIgnorePatterns(context.rootDirectory));
 	return getSourceFiles(context).filter((filePath) => OXLINT_EXTENSIONS.has(path.extname(filePath).toLowerCase())).filter((filePath) => !isAutoGenerated(filePath)).map((filePath) => path.relative(context.rootDirectory, filePath).split(path.sep).join("/")).filter((filePath) => !isEslintIgnored(filePath, eslintIgnorePatterns));
@@ -12253,7 +12449,8 @@ const resolveTrustedTscPath = () => {
 };
 const isReferenceOnlyConfig = (tsconfigPath) => {
 	try {
-		const parsed = parseJsonc(fs.readFileSync(tsconfigPath, "utf-8"));
+		const raw = fs.readFileSync(tsconfigPath, "utf-8");
+		const parsed = parseJsonc(raw);
 		if (!parsed) return false;
 		return Array.isArray(parsed.references) && !parsed.files && !parsed.include && !parsed.extends;
 	} catch {
@@ -12396,6 +12593,174 @@ const lintEngine = {
 	}
 };
 //#endregion
+//#region src/engines/security/ai-security.ts
+const JS_EXTS = /* @__PURE__ */ new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mjs",
+	".cjs"
+]);
+const PY_EXTS = /* @__PURE__ */ new Set([".py"]);
+const UNICODE_TAG_RE = /[\u{E0000}-\u{E007F}]/gu;
+const hasRuleIgnore = (lines, lineIndex, ruleSuffix) => {
+	const start = Math.max(0, lineIndex - 2);
+	const re = new RegExp(`(?:raigal|aislop)[- ]ignore(?:-file)?\\b.*(?:${ruleSuffix}|security\\/${ruleSuffix})`, "i");
+	return lines.slice(start, lineIndex + 1).some((line) => re.test(line));
+};
+const hasFileIgnore = (lines, ruleSuffix) => {
+	const re = new RegExp(`(?:raigal|aislop)[- ]ignore-file\\b.*(?:${ruleSuffix}|security\\/${ruleSuffix})`, "i");
+	return lines.slice(0, 10).some((line) => re.test(line));
+};
+const makeDiagnostic = (filePath, rule, message, help, line, column) => ({
+	filePath,
+	engine: "security",
+	rule,
+	severity: "error",
+	message,
+	help,
+	line,
+	column,
+	category: "Security",
+	fixable: false
+});
+const P_BYPASS = "bypassPermissions";
+const P_EXEC_TYPE = "executor_type";
+const P_LOCAL = "local";
+const P_USE_DOCKER = "use_docker";
+const P_AUTO_RUN = "auto_run";
+const P_UNSAFE_MODE = "unsafe_mode";
+const P_PYTHON_REPL = "PythonREPLTool";
+const UNSANDBOXED_TOOL_PATTERNS = [
+	{
+		pattern: new RegExp(`\\bpermission_?mode["']?\\s*[:=]\\s*["']${P_BYPASS}["']`, "i"),
+		message: `permission_mode '${P_BYPASS}' bypasses agent sandboxing and human confirmation`,
+		help: `Do not use ${P_BYPASS} mode in production; use standard interactive approval`
+	},
+	{
+		pattern: new RegExp(`\\b${P_EXEC_TYPE}["']?\\s*[:=]\\s*["']${P_LOCAL}["']`, "i"),
+		message: `${P_EXEC_TYPE}='${P_LOCAL}' executes LLM-generated code directly on host machine without container isolation`,
+		help: "Configure agent to use DockerCommandLineCodeExecutor or a containerized sandbox environment"
+	},
+	{
+		pattern: new RegExp(`\\b(?:LocalCommandLineCodeExecutor|LocalCodeExecutor)\\s*\\(`),
+		message: "Local code executor executes LLM-generated code on host machine without container isolation",
+		help: "Use DockerCommandLineCodeExecutor or an isolated execution sandbox"
+	},
+	{
+		pattern: new RegExp(`\\b${P_USE_DOCKER}\\s*[:=]\\s*(?:False|false)\\b|["']${P_USE_DOCKER}["']\\s*:\\s*(?:False|false)\\b`),
+		message: `${P_USE_DOCKER}=False disables container sandboxing for agent code execution`,
+		help: `Set ${P_USE_DOCKER}=True to isolate agent execution inside Docker containers`
+	},
+	{
+		pattern: new RegExp(`\\b(?:interpreter\\.)?${P_AUTO_RUN}\\s*[:=]\\s*(?:True|true)\\b`),
+		message: `${P_AUTO_RUN}=True allows autonomous shell execution without human confirmation`,
+		help: `Keep ${P_AUTO_RUN}=False so dangerous commands require explicit human review`
+	},
+	{
+		pattern: new RegExp(`\\bCodeInterpreterTool\\s*\\([^)]*${P_UNSAFE_MODE}\\s*=\\s*(?:True|true)\\b|\\b${P_UNSAFE_MODE}\\s*[:=]\\s*(?:True|true)\\b`),
+		message: `${P_UNSAFE_MODE}=True allows code interpreter tool to execute without Docker isolation`,
+		help: `Disable ${P_UNSAFE_MODE} and isolate code execution in containerized environments`
+	},
+	{
+		pattern: new RegExp(`\\b(?:${P_PYTHON_REPL}|PythonAstREPLTool)\\s*\\(`),
+		message: `${P_PYTHON_REPL} executes arbitrary Python code in host process without container isolation`,
+		help: `Use containerized sandbox execution rather than unconfined ${P_PYTHON_REPL} in production`
+	}
+];
+const P_SYS = "system";
+const P_DEV = "developer";
+const P_SM = "SystemMessage";
+const PROMPT_INJECTION_JS_PATTERNS = [
+	new RegExp(`(?:role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?content\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`)`, "g"),
+	new RegExp(`(?:content\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`[^}{;]{0,120}?role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`(?:role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?content\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["']))`, "g"),
+	new RegExp(`(?:content\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["'])[^}{;]{0,120}?role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`\\b(?:${P_SYS}|systemPrompt|system_prompt|system_instruction)\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\``, "g"),
+	new RegExp(`\\b(?:${P_SYS}|systemPrompt|system_prompt|system_instruction)\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["'])`, "g"),
+	new RegExp(`\\b(?:new\\s+)?${P_SM}\\s*\\(\\s*(?:\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`|["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["']|\\{\\s*content\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`)`, "g"),
+	new RegExp(`\\[\\s*["']${P_SYS}["']\\s*,\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`\\s*\\]`, "g")
+];
+const PROMPT_INJECTION_PY_PATTERNS = [
+	new RegExp(`(?:["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?["']content["']\\s*:\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["']))`, "g"),
+	new RegExp(`(?:["']content["']\\s*:\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])[^}{;]{0,120}?["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`(?:["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?["']content["']\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\())`, "g"),
+	new RegExp(`(?:["']content["']\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\()[^}{;]{0,120}?["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`\\b(?:${P_SYS}|system_prompt|system_message|system_instruction)\\s*=\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])`, "g"),
+	new RegExp(`\\b(?:${P_SYS}|system_prompt|system_message|system_instruction)\\s*=\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\()`, "g"),
+	new RegExp(`\\b${P_SM}\\s*\\(\\s*(?:content\\s*=\\s*)?f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])`, "g"),
+	new RegExp(`\\b${P_SM}\\s*\\(\\s*(?:content\\s*=\\s*)?(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\()`, "g"),
+	new RegExp(`\\(\\s*["']${P_SYS}["']\\s*,\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])\\s*\\)`, "g")
+];
+const checkInvisibleUnicode = (relPath, content, lines) => {
+	if (hasFileIgnore(lines, "invisible-unicode-tags")) return [];
+	const results = [];
+	const tagRegex = new RegExp(UNICODE_TAG_RE.source, UNICODE_TAG_RE.flags);
+	for (const match of content.matchAll(tagRegex)) {
+		const matchIndex = match.index ?? 0;
+		const line = content.slice(0, matchIndex).split("\n").length;
+		const col = matchIndex - content.lastIndexOf("\n", matchIndex - 1);
+		if (hasRuleIgnore(lines, line - 1, "invisible-unicode-tags")) continue;
+		results.push(makeDiagnostic(relPath, "security/invisible-unicode-tags", "Invisible Unicode Tag character (U+E0000-U+E007F) detected: potential stealth prompt injection or ASCII smuggling", "Remove invisible Unicode tag characters. Unicode Tag block (U+E0000-U+E007F) has no legitimate printable presentation in source code", line, col));
+	}
+	return results;
+};
+const checkUnsandboxedTools = (relPath, content, lines) => {
+	if (hasFileIgnore(lines, "unsandboxed-agent-tool")) return [];
+	const results = [];
+	for (const { pattern, message, help } of UNSANDBOXED_TOOL_PATTERNS) {
+		const regex = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`);
+		for (const match of content.matchAll(regex)) {
+			const matchIndex = match.index ?? 0;
+			const line = content.slice(0, matchIndex).split("\n").length;
+			const col = matchIndex - content.lastIndexOf("\n", matchIndex - 1);
+			if (hasRuleIgnore(lines, line - 1, "unsandboxed-agent-tool")) continue;
+			results.push(makeDiagnostic(relPath, "security/unsandboxed-agent-tool", message, help, line, col));
+		}
+	}
+	return results;
+};
+const checkPromptInjection = (relPath, content, lines, isJs) => {
+	if (hasFileIgnore(lines, "prompt-injection")) return [];
+	const results = [];
+	const patterns = isJs ? PROMPT_INJECTION_JS_PATTERNS : PROMPT_INJECTION_PY_PATTERNS;
+	for (const pattern of patterns) {
+		const regex = new RegExp(pattern.source, pattern.flags);
+		for (const match of content.matchAll(regex)) {
+			const matchIndex = match.index ?? 0;
+			const line = content.slice(0, matchIndex).split("\n").length;
+			const col = matchIndex - content.lastIndexOf("\n", matchIndex - 1);
+			if (hasRuleIgnore(lines, line - 1, "prompt-injection")) continue;
+			results.push(makeDiagnostic(relPath, "security/prompt-injection", "Untrusted variable interpolation into system prompt creates prompt injection vulnerability", "Keep system prompts static. Pass dynamic user inputs via user messages or input parameters with strict delimiters", line, col));
+		}
+	}
+	return results;
+};
+const scanAiSecurity = async (context) => {
+	const files = getSourceFiles(context);
+	const diagnostics = [];
+	for (const filePath of files) {
+		const ext = path.extname(filePath);
+		let content;
+		try {
+			content = fs.readFileSync(filePath, "utf-8");
+		} catch {
+			continue;
+		}
+		const relativePath = relativePosix(context.rootDirectory, filePath);
+		const lines = content.split("\n");
+		diagnostics.push(...checkInvisibleUnicode(relativePath, content, lines));
+		const isJs = JS_EXTS.has(ext);
+		const isPy = PY_EXTS.has(ext);
+		if (isJs || isPy) {
+			diagnostics.push(...checkUnsandboxedTools(relativePath, content, lines));
+			diagnostics.push(...checkPromptInjection(relativePath, content, lines, isJs));
+		}
+	}
+	return diagnostics;
+};
+//#endregion
 //#region src/ui/invocation.ts
 const detectInvocation = () => "raigal";
 //#endregion
@@ -12778,7 +13143,7 @@ const parseJsAudit = (output, source, manifest) => {
 			rule: "security/dependency-audit-skipped",
 			severity: "info",
 			message: `Dependency audit skipped (${source}): lockfile is missing`,
-			help: errorDetail ?? "Generate a lockfile, then re-run `aislop scan` for dependency vulnerability checks.",
+			help: errorDetail ?? "Generate a lockfile, then re-run `raigal scan` for dependency vulnerability checks.",
 			line: 0,
 			column: 0,
 			category: "Security",
@@ -12889,7 +13254,8 @@ const readRuntimeDependencies = (rootDir) => {
 	collectRuntimeNames(rootManifest, names);
 	const globs = [...npmWorkspaceGlobs(rootManifest), ...pnpmWorkspaceGlobs(rootDir)];
 	if (globs.length === 0) return { runtimeDependencies: names };
-	for (const relativeDir of micromatch(listPackageDirectories(rootDir), globs)) {
+	const isMatch = picomatch(globs, { dot: true });
+	for (const relativeDir of listPackageDirectories(rootDir).filter((dir) => isMatch(dir))) {
 		const memberManifest = readJsonFile(path.join(rootDir, relativeDir, "package.json"));
 		if (memberManifest) collectRuntimeNames(memberManifest, names);
 	}
@@ -12951,10 +13317,11 @@ const auditSkippedDiagnostic = (source, help) => ({
 });
 const runNpmAudit = async (rootDir, timeout) => {
 	try {
-		return parseJsAudit((await runSubprocess("npm", ["audit", "--json"], {
+		const result = await runSubprocess("npm", ["audit", "--json"], {
 			cwd: rootDir,
 			timeout
-		})).stdout, "npm audit", readRuntimeDependencies(rootDir));
+		});
+		return parseJsAudit(result.stdout, "npm audit", readRuntimeDependencies(rootDir));
 	} catch (error) {
 		return [auditSkippedDiagnostic("npm audit", `Failed to run npm audit: ${errorMessageOf(error)}`)];
 	}
@@ -12975,10 +13342,11 @@ const runBunAudit = async (rootDir, timeout) => {
 const runPnpmAuditWithFallback = async (rootDir, timeout) => {
 	const canFallbackToNpm = fs.existsSync(path.join(rootDir, "package-lock.json"));
 	try {
-		const diagnostics = parseJsAudit((await runSubprocess("pnpm", ["audit", "--json"], {
+		const result = await runSubprocess("pnpm", ["audit", "--json"], {
 			cwd: rootDir,
 			timeout
-		})).stdout, "pnpm audit", readRuntimeDependencies(rootDir));
+		});
+		const diagnostics = parseJsAudit(result.stdout, "pnpm audit", readRuntimeDependencies(rootDir));
 		if (diagnostics.some((d) => d.rule === "security/dependency-audit-skipped")) {
 			if (canFallbackToNpm) return runNpmAudit(rootDir, timeout);
 			return diagnostics;
@@ -13335,7 +13703,7 @@ const RISKY_PATTERNS = [
 //#region src/engines/security/risky.ts
 const hasDangerouslySetInnerHtmlIgnore = (lines, lineIndex) => {
 	const start = Math.max(0, lineIndex - 2);
-	return lines.slice(start, lineIndex + 1).some((line) => /(?:biome-ignore|eslint-disable|aislop-ignore).*(?:noDangerouslySetInnerHtml|dangerouslySetInnerHTML|dangerously-set-innerhtml)/i.test(line));
+	return lines.slice(start, lineIndex + 1).some((line) => /(?:biome-ignore|eslint-disable|raigal-ignore|aislop-ignore).*(?:noDangerouslySetInnerHtml|dangerouslySetInnerHTML|dangerously-set-innerhtml)/i.test(line));
 };
 const isStructuredDataScript = (content, matchIndex) => {
 	const before = content.slice(Math.max(0, matchIndex - 300), matchIndex);
@@ -13657,7 +14025,11 @@ const securityEngine = {
 	name: "security",
 	async run(context) {
 		const diagnostics = [];
-		const promises = [scanSecrets(context), detectRiskyConstructs(context)];
+		const promises = [
+			scanSecrets(context),
+			detectRiskyConstructs(context),
+			scanAiSecurity(context)
+		];
 		if (context.config.security.audit) promises.push(runDependencyAudit(context));
 		const results = await Promise.allSettled(promises);
 		for (const result of results) if (result.status === "fulfilled") diagnostics.push(...result.value);
@@ -13758,6 +14130,7 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 			const result = await engine.run(context);
 			result.diagnostics = filterExcludedDiagnostics(result.diagnostics, context.rootDirectory, context.excludePatterns);
 			result.elapsed = performance.now() - start;
+			result.diagnostics = applyFileOverrides(result.diagnostics, context);
 			onComplete?.(result);
 			return result;
 		} catch (error) {
@@ -13766,6 +14139,7 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 				diagnostics: [],
 				elapsed: performance.now() - start,
 				skipped: true,
+				failed: true,
 				skipReason: error instanceof Error ? error.message : String(error)
 			};
 			onComplete?.(result);
@@ -13776,9 +14150,13 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 		diagnostics: [],
 		elapsed: 0,
 		skipped: true,
+		failed: true,
 		skipReason: r.reason instanceof Error ? r.reason.message : String(r.reason)
 	});
-	return dedupeEquivalenceDiagnostics(dedupeOverlappingComments(dedupeCSharpAsync(stripSecretDiagnostics(finalResults))));
+	const stripped = stripSecretDiagnostics(finalResults);
+	const csharp = dedupeCSharpAsync(stripped);
+	const comments = dedupeOverlappingComments(csharp);
+	return dedupeEquivalenceDiagnostics(comments);
 };
 const stripSecretDiagnostics = (results) => {
 	for (const result of results) for (const d of result.diagnostics) if (d.redactSource || isSecretClassRule(d.rule)) {
@@ -13924,6 +14302,9 @@ const RULE_SCORE_IMPACTS = {
 	"security/shell-injection": strict("Interpolated shell commands can become command execution."),
 	"security/unsafe-deserialization": strict("Deserializing untrusted data with a legacy .NET formatter can become remote code execution."),
 	"security/unsafe-c-call": strict("Unbounded C string and process calls can become buffer overflows or command execution."),
+	"security/prompt-injection": strict("Dynamic user interpolation in system/developer prompts enables prompt injection attacks."),
+	"security/unsandboxed-agent-tool": strict("Unsandboxed agent code execution or tool permission bypass allows arbitrary host commands."),
+	"security/invisible-unicode-tags": strict("Invisible Unicode Tag characters (U+E0000-U+E007F) hide stealth prompt injection payloads."),
 	"security/dependency-audit-skipped": advisory("An unavailable audit is visibility loss, not evidence of a vulnerability."),
 	"dotnet/projects-skipped": advisory("Skipping unrestored C# projects is visibility loss, not evidence of a defect."),
 	"cppcheck/chunks-skipped": advisory("A skipped cppcheck chunk is visibility loss, not evidence that the skipped files have a defect."),
@@ -14000,7 +14381,8 @@ const calculateScore = (diagnostics, weights, thresholds, sourceFileCount, smoot
 	const capScale = Math.max(1, fileCount.effectiveSourceFileCount / CAP_REFERENCE_FILES);
 	const defaultRuleCap = typeof maxPerRule === "number" && maxPerRule > 0 ? maxPerRule : null;
 	const capForRule = (key) => {
-		const ruleCap = scoreImpactForRule(key.slice(key.indexOf(":") + 1)).cap;
+		const rule = key.slice(key.indexOf(":") + 1);
+		const ruleCap = scoreImpactForRule(rule).cap;
 		if (typeof ruleCap === "number") return defaultRuleCap ? Math.min(defaultRuleCap, ruleCap) : ruleCap;
 		return defaultRuleCap;
 	};
@@ -14113,8 +14495,10 @@ const detectSourceLanguages = (sourceFiles) => {
 const detectLanguages = (directory, sourceFiles) => {
 	const languages = new Set(detectSourceLanguages(sourceFiles));
 	for (const [file, lang] of Object.entries(LANGUAGE_SIGNALS)) if (fs.existsSync(path.join(directory, file))) languages.add(lang);
-	if (readPackageJson(path.join(directory, "package.json"))) if (fs.existsSync(path.join(directory, "tsconfig.json"))) languages.add("typescript");
-	else languages.add("javascript");
+	if (readPackageJson(path.join(directory, "package.json"))) {
+		if (fs.existsSync(path.join(directory, "tsconfig.json"))) languages.add("typescript");
+		else languages.add("javascript");
+	}
 	for (const signal of PYTHON_SIGNALS) if (fs.existsSync(path.join(directory, signal))) {
 		languages.add("python");
 		break;
@@ -14305,14 +14689,19 @@ const hasExistingLiteralBackslashPath = (cwd, fingerprint) => {
 	}
 };
 const migrateMarkerlessFingerprint = (cwd, fingerprint) => hasExistingLiteralBackslashPath(cwd, fingerprint) ? fingerprint : normalizeLegacyFingerprint(fingerprint);
-const BASELINE_REL = path.join(".aislop", "baseline.json");
-const baselinePath = (cwd) => path.join(cwd, BASELINE_REL);
+const baselinePath = (cwd) => {
+	const raigalCandidate = path.join(cwd, ".raigal", "baseline.json");
+	if (fs.existsSync(raigalCandidate)) return raigalCandidate;
+	const raigalDir = path.join(cwd, ".raigal");
+	if (fs.existsSync(raigalDir)) return raigalCandidate;
+	return path.join(cwd, ".aislop", "baseline.json");
+};
 const readBaseline = (cwd) => {
 	const raw = readIfExists(baselinePath(cwd));
 	if (!raw) return null;
 	try {
 		const parsed = JSON.parse(raw);
-		if (parsed.schema !== "aislop.baseline.v2" && parsed.schema !== "aislop.baseline.v1") return null;
+		if (parsed.schema !== "aislop.baseline.v2" && parsed.schema !== "aislop.baseline.v1" && parsed.schema !== "raigal.baseline.v2" && parsed.schema !== "raigal.baseline.v1") return null;
 		const findingFingerprints = parsed.findingFingerprints ?? [];
 		const needsWindowsMigration = parsed.pathFormat !== "posix";
 		return {
@@ -14449,6 +14838,8 @@ const buildEngineContext = (rootDirectory, project, config) => {
 		frameworks: project.frameworks,
 		installedTools: project.installedTools,
 		config: {
+			overrides: config.overrides,
+			rules: config.rules,
 			quality: config.quality,
 			security: config.security,
 			lint: config.lint,
@@ -14495,7 +14886,9 @@ const summariseDiagnostics = (diagnostics, rootDirectory) => {
 const runScan = async (cwd) => {
 	const project = await discoverProject(cwd);
 	const config = loadConfig(cwd);
-	const diagnostics = (await runEngines(buildEngineContext(project.rootDirectory, project, config), enabledEnginesFromConfig(config))).flatMap((r) => r.diagnostics);
+	const context = buildEngineContext(project.rootDirectory, project, config);
+	const enabled = enabledEnginesFromConfig(config);
+	const diagnostics = (await runEngines(context, enabled)).flatMap((r) => r.diagnostics);
 	const { score } = calculateScore(diagnostics, config.scoring.weights, config.scoring.thresholds, project.sourceFileCount, config.scoring.smoothing, config.scoring.maxPerRule);
 	const errorCount = diagnostics.filter((d) => d.severity === "error").length;
 	const failBelow = config.ci.failBelow;
@@ -14510,12 +14903,11 @@ const runScan = async (cwd) => {
 		}
 	};
 };
-const aislopScanInputSchema = z$1.object({ path: z$1.string().optional().describe("Project directory to scan, confined to the MCP server's cwd. Defaults to that cwd.") });
-const aislopScanTool = {
+const raigalScanInputSchema = z$1.object({ path: z$1.string().optional().describe("Project directory to scan, confined to the MCP server's cwd. Defaults to that cwd.") });
+const raigalScanTool = {
 	name: "raigal_scan",
 	description: "Scan a project with Raigal. Runs the deterministic engines (format, lint, code-quality, ai-slop, security, architecture), returns a 0–100 score and the top findings. Use this before deciding whether the agent's recent changes are ready to ship.",
-	inputSchema: aislopScanInputSchema,
-	name: "aislop_scan"
+	inputSchema: raigalScanInputSchema
 };
 const handleRaigalScan = async (input) => {
 	const cwd = resolveCwd(input.path);
@@ -14530,8 +14922,7 @@ const handleRaigalScan = async (input) => {
 		...summary
 	};
 };
-const handleAislopScan = handleRaigalScan;
-const aislopFixInputSchema = z$1.object({
+const raigalFixInputSchema = z$1.object({
 	path: z$1.string().optional().describe("Project directory to fix, confined to the MCP server's cwd. Defaults to that cwd."),
 	force: z$1.boolean().optional().describe("Run aggressive fixes (dependency audit overrides, unused-file removal, framework alignment). Off by default; on means writes to package.json and may delete files.")
 });
@@ -14561,11 +14952,10 @@ const runRaigalFix = (cwd, force) => {
 		}));
 	});
 };
-const aislopFixTool = {
+const raigalFixTool = {
 	name: "raigal_fix",
 	description: "Apply mechanical fixes (formatting, unused imports, narrative comments, duplicate imports, etc.). Returns counts before/after so the agent can see how many issues remain. Use BEFORE handing off to the agent — saves tokens by clearing what the CLI handles deterministically.",
-	inputSchema: aislopFixInputSchema,
-	name: "aislop_fix"
+	inputSchema: raigalFixInputSchema
 };
 const handleRaigalFix = async (input) => {
 	const cwd = resolveCwd(input.path);
@@ -14587,13 +14977,11 @@ const handleRaigalFix = async (input) => {
 		elided: summary.elided
 	};
 };
-const handleAislopFix = handleRaigalFix;
-const aislopWhyInputSchema = z$1.object({ rule_id: z$1.string().describe("Full rule id (e.g. `ai-slop/narrative-comment`, `complexity/function-too-long`, `security/sql-injection`).") });
-const aislopWhyTool = {
+const raigalWhyInputSchema = z$1.object({ rule_id: z$1.string().describe("Full rule id (e.g. `ai-slop/narrative-comment`, `complexity/function-too-long`, `security/sql-injection`).") });
+const raigalWhyTool = {
 	name: "raigal_why",
 	description: "Explain a Raigal rule: what it catches, why an AI agent typically produces it, severity, and whether it's auto-fixable. Use when a finding's message alone isn't enough to act on.",
-	inputSchema: aislopWhyInputSchema,
-	name: "aislop_why"
+	inputSchema: raigalWhyInputSchema
 };
 const handleRaigalWhy = (input) => {
 	const ruleId = input.rule_id.trim();
@@ -14606,13 +14994,11 @@ const handleRaigalWhy = (input) => {
 		hint: "Run `raigal rules` for the full list of rules and their auto-fix status. The /patterns page has bad/good code examples for every named ai-slop pattern."
 	};
 };
-const handleAislopWhy = handleRaigalWhy;
-const aislopBaselineInputSchema = z$1.object({ path: z$1.string().optional().describe("Project directory, confined to the MCP server's cwd. Defaults to that cwd.") });
-const aislopBaselineTool = {
+const raigalBaselineInputSchema = z$1.object({ path: z$1.string().optional().describe("Project directory, confined to the MCP server's cwd. Defaults to that cwd.") });
+const raigalBaselineTool = {
 	name: "raigal_baseline",
 	description: "Read the project's baseline (the last captured score the per-edit hook compares against). Returns score / lastScanAt / fileCount, or null if no baseline exists yet (run `raigal hook baseline` to capture).",
-	inputSchema: aislopBaselineInputSchema,
-	name: "aislop_baseline"
+	inputSchema: raigalBaselineInputSchema
 };
 const handleRaigalBaseline = (input) => {
 	const baseline = readBaseline(resolveCwd(input.path));
@@ -14627,7 +15013,6 @@ const handleRaigalBaseline = (input) => {
 		hint: "Run `raigal hook baseline` to capture a baseline."
 	};
 };
-const handleAislopBaseline = handleRaigalBaseline;
 //#endregion
 //#region src/telemetry/env.ts
 const ALLOWED_OVERRIDE = /* @__PURE__ */ new Set([
@@ -14766,6 +15151,10 @@ const SAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set([
 	"exit_code",
 	"duration_ms",
 	"error_kind",
+	"error_name",
+	"error_code",
+	"failed_stage",
+	"engines_failed",
 	"score",
 	"score_bucket",
 	"finding_count",
@@ -14879,10 +15268,11 @@ const track = (input) => {
 		cachedInstallId = ensured.installId;
 		installCreated = ensured.created;
 	}
-	const { clean, dropped } = redactProperties({
+	const merged = {
 		...baseProperties(cachedInstallId),
 		...input.properties
-	});
+	};
+	const { clean, dropped } = redactProperties(merged);
 	if (isDebug()) {
 		const compact = JSON.stringify({
 			event: input.event,
@@ -14986,38 +15376,22 @@ const buildServer = () => {
 		name: "raigal",
 		version: APP_VERSION
 	});
-	server.registerTool(aislopScanTool.name, {
-		description: aislopScanTool.description,
-		inputSchema: aislopScanInputSchema.shape
-	}, (input) => instrument("aislop_scan", () => handleAislopScan(input)));
-	server.registerTool(aislopFixTool.name, {
-		description: aislopFixTool.description,
-		inputSchema: aislopFixInputSchema.shape
-	}, (input) => instrument("aislop_fix", () => handleAislopFix(input)));
-	server.registerTool(aislopWhyTool.name, {
-		description: aislopWhyTool.description,
-		inputSchema: aislopWhyInputSchema.shape
-	}, (input) => instrument("aislop_why", () => handleAislopWhy(input)));
-	server.registerTool(aislopBaselineTool.name, {
-		description: aislopBaselineTool.description,
-		inputSchema: aislopBaselineInputSchema.shape
-	}, (input) => instrument("aislop_baseline", () => handleAislopBaseline(input)));
-	server.registerTool("raigal_scan", {
-		description: aislopScanTool.description,
-		inputSchema: aislopScanInputSchema.shape
-	}, (input) => instrument("raigal_scan", () => handleAislopScan(input)));
-	server.registerTool("raigal_fix", {
-		description: aislopFixTool.description,
-		inputSchema: aislopFixInputSchema.shape
-	}, (input) => instrument("raigal_fix", () => handleAislopFix(input)));
-	server.registerTool("raigal_why", {
-		description: aislopWhyTool.description,
-		inputSchema: aislopWhyInputSchema.shape
-	}, (input) => instrument("raigal_why", () => handleAislopWhy(input)));
-	server.registerTool("raigal_baseline", {
-		description: aislopBaselineTool.description,
-		inputSchema: aislopBaselineInputSchema.shape
-	}, (input) => instrument("raigal_baseline", () => handleAislopBaseline(input)));
+	server.registerTool(raigalScanTool.name, {
+		description: raigalScanTool.description,
+		inputSchema: raigalScanInputSchema.shape
+	}, (input) => instrument("raigal_scan", () => handleRaigalScan(input)));
+	server.registerTool(raigalFixTool.name, {
+		description: raigalFixTool.description,
+		inputSchema: raigalFixInputSchema.shape
+	}, (input) => instrument("raigal_fix", () => handleRaigalFix(input)));
+	server.registerTool(raigalWhyTool.name, {
+		description: raigalWhyTool.description,
+		inputSchema: raigalWhyInputSchema.shape
+	}, (input) => instrument("raigal_why", () => handleRaigalWhy(input)));
+	server.registerTool(raigalBaselineTool.name, {
+		description: raigalBaselineTool.description,
+		inputSchema: raigalBaselineInputSchema.shape
+	}, (input) => instrument("raigal_baseline", () => handleRaigalBaseline(input)));
 	return server;
 };
 const main = async () => {