@methiu/raigal 0.2.2 → 0.2.3

package/dist/cli.js

@@ -13,8 +13,7 @@ import { z } from "zod/v4";
 import crypto, { createHash, createPublicKey, randomUUID, verify } from "node:crypto";
 import YAML, { parse } from "yaml";
 import { confirm, isCancel, multiselect, select, text } from "@clack/prompts";
-import * as readline$1 from "node:readline";
-import readline from "node:readline";
+import readline, * as readline$1 from "node:readline";
 import picomatch from "picomatch";
 import ts from "typescript";
 import { parse as parse$1 } from "smol-toml";
@@ -113,7 +112,8 @@ const commandExists = (bin) => {
 			}
 		}
 	}
-	const result = spawnSync(process.platform === "win32" ? "where.exe" : "which", [bin], {
+	const command = process.platform === "win32" ? "where.exe" : "which";
+	const result = spawnSync(command, [bin], {
 		encoding: "utf-8",
 		timeout: PROVIDER_PROBE_TIMEOUT_MS
 	});
@@ -711,7 +711,8 @@ const stringWidth = (s) => {
 	const bare = stripAnsi$1(s);
 	let total = 0;
 	for (const ch of bare) {
-		const w = wcwidth(ch.codePointAt(0) ?? 0);
+		const cp = ch.codePointAt(0) ?? 0;
+		const w = wcwidth(cp);
 		total += w > 0 ? w : 1;
 	}
 	return total;
@@ -727,7 +728,8 @@ const truncate = (s, max, ellipsis = "…") => {
 	let out = "";
 	let w = 0;
 	for (const ch of s) {
-		const cw = wcwidth(ch.codePointAt(0) ?? 0);
+		const cp = ch.codePointAt(0) ?? 0;
+		const cw = wcwidth(cp);
 		if (w + cw > limit) break;
 		out += ch;
 		w += cw;
@@ -737,7 +739,8 @@ const truncate = (s, max, ellipsis = "…") => {
 //#endregion
 //#region src/ui/display.ts
 const renderDisplaySection = (label, deps = {}) => {
-	return style$1(deps.theme ?? theme, "section", label);
+	const t = deps.theme ?? theme;
+	return style$1(t, "section", label);
 };
 const renderDisplayRows = (rows, options = {}) => {
 	if (rows.length === 0) return [];
@@ -898,7 +901,8 @@ const symbols = createSymbols({ plain: isPlain() });
 */
 const renderHintLine = (hint, deps = {}) => {
 	const t = deps.theme ?? theme;
-	return ` ${style$1(t, "accent", (deps.symbols ?? symbols).hint)} ${highlightAislop(maskSecrets(hint), t)}\n`;
+	const s = deps.symbols ?? symbols;
+	return ` ${style$1(t, "accent", s.hint)} ${highlightAislop(maskSecrets(hint), t)}\n`;
 };
 const createLogger = (deps = {}) => {
 	const t = deps.theme ?? theme;
@@ -923,7 +927,7 @@ const createLogger = (deps = {}) => {
 const log = createLogger();
 //#endregion
 //#region src/version.ts
-const APP_VERSION = "0.2.2";
+const APP_VERSION = "0.2.3";
 //#endregion
 //#region src/commands/agent-connect.ts
 const commandText = (status) => [status.provider.loginCommand.command, ...status.provider.loginCommand.args].join(" ");
@@ -1410,7 +1414,9 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	if (!header.kid) throw new JwtVerificationError("JWT header missing 'kid'", "unknown_kid");
 	const publicKey = getPublicKey(header.kid);
 	if (!publicKey) throw new JwtVerificationError(`Unknown or untrusted signing key id (kid: ${header.kid})`, "unknown_kid");
-	if (!verify(null, Buffer.from(`${headerB64}.${payloadB64}`, "utf-8"), publicKey, Buffer.from(signatureB64, "base64url"))) throw new JwtVerificationError("Invalid JWT cryptographic signature", "invalid_signature");
+	const signedData = Buffer.from(`${headerB64}.${payloadB64}`, "utf-8");
+	const signature = Buffer.from(signatureB64, "base64url");
+	if (!verify(null, signedData, publicKey, signature)) throw new JwtVerificationError("Invalid JWT cryptographic signature", "invalid_signature");
 	let rawPayload;
 	try {
 		rawPayload = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf-8"));
@@ -1422,7 +1428,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const claims = parsed.data;
 	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
 	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.2.2", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (!isVersionAtLeast("0.2.3", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -1456,7 +1462,7 @@ const fetchGitHubOidcToken = async () => {
 };
 //#endregion
 //#region src/cloud/entitlement.ts
-const GRACE_PERIOD_SECONDS = 4320 * 60;
+const GRACE_PERIOD_SECONDS = 259200;
 var MissingCredentialError = class extends Error {
 	constructor(message = "No organization credential found") {
 		super(message);
@@ -1581,7 +1587,8 @@ const getEntitlement = async () => {
 		}
 	} else oidcToken = await fetchGitHubOidcToken();
 	try {
-		const response = await fetchEntitlementFromApi(activeToken?.token ?? "", oidcToken);
+		const tokenToPass = activeToken?.token ?? "";
+		const response = await fetchEntitlementFromApi(tokenToPass, oidcToken);
 		const claims = verifyEntitlementJwt(response.entitlement, { nowSeconds: now });
 		saveCachedEntitlement(response.entitlement, response.refresh_after);
 		return {
@@ -1595,7 +1602,7 @@ const getEntitlement = async () => {
 };
 //#endregion
 //#region src/cloud/owner.ts
-const GITHUB_REMOTE_RE$1 = /^(?:(?:git@|ssh:\/\/(?:git@)?)github\.com(?::(?:\d+\/)?|[:/])|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/.\s]+?)(?:\.git)?\s*$/;
+const GITHUB_REMOTE_RE$1 = /^(?:(?:git@|ssh:\/\/(?:git@)?)github\.com(?::(?:\d+\/)?|[:/])|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/\s]+?)(?:\.git)?\s*$/;
 const parseGitRemote = (rawUrl) => {
 	if (!rawUrl) return {
 		owner: null,
@@ -2376,7 +2383,7 @@ var AgentTui = class {
 	}
 	ensureMounted() {
 		if (!this.tty || this.handle) return;
-		this.handle = import("./mount-DTc8WaIt.js").then((m) => m.mountAgentTui(this.store));
+		this.handle = import("./mount-CHGc3gB6.js").then((m) => m.mountAgentTui(this.store));
 	}
 	setActions(actions) {
 		this.store.update({ actions: actions.filter((action) => action.trim().length > 0) });
@@ -2471,7 +2478,7 @@ const runSelf = (args, cwd) => {
 			AISLOP_NO_UPDATE_NOTIFIER: "1",
 			NO_COLOR: "1"
 		},
-		maxBuffer: 50 * 1024 * 1024
+		maxBuffer: 52428800
 	});
 	return {
 		exitCode: result.status,
@@ -2510,7 +2517,7 @@ const applyDiff = async (root, patch) => {
 		cwd: root,
 		input: patch,
 		encoding: "utf-8",
-		maxBuffer: 50 * 1024 * 1024
+		maxBuffer: 52428800
 	});
 	if (child.status !== 0) throw new Error(child.stderr || child.stdout || "Failed to apply agent diff.");
 };
@@ -2883,7 +2890,7 @@ const detectCiContext = () => {
 };
 //#endregion
 //#region src/cloud/outbox.ts
-const MAX_OUTBOX_BYTES = 5 * 1024 * 1024;
+const MAX_OUTBOX_BYTES = 5242880;
 const getMaxOutboxBytes = () => {
 	const override = process.env.RAIGAL_MAX_OUTBOX_BYTES;
 	if (override) {
@@ -3078,7 +3085,8 @@ var CloudRunRecorder = class {
 		if (this.finished) return;
 		this.finished = true;
 		try {
-			enqueueRun(this.buildRunPayload(exitCode));
+			const run = this.buildRunPayload(exitCode);
+			enqueueRun(run);
 			const activeToken = getActiveToken();
 			let oidcToken;
 			if (!activeToken) oidcToken = await fetchGitHubOidcToken();
@@ -3164,7 +3172,7 @@ const recordAgentSessionTelemetry = ({ worktreePath, published, branchOption, pr
 	if (!recorder) return;
 	let patchDiff;
 	if (worktreePath) try {
-		patchDiff = (spawnSync("git", [
+		const rawDiff = spawnSync("git", [
 			"diff",
 			"-U2",
 			"--no-color",
@@ -3172,7 +3180,8 @@ const recordAgentSessionTelemetry = ({ worktreePath, published, branchOption, pr
 		], {
 			cwd: worktreePath,
 			encoding: "utf-8"
-		}).stdout || "").slice(0, 2e4) || void 0;
+		}).stdout || "";
+		patchDiff = rawDiff ? maskSecrets(rawDiff).slice(0, 2e4) : void 0;
 	} catch {}
 	if (published) {
 		const prMatch = published.prUrl?.match(/\/pull\/(\d+)/);
@@ -3780,7 +3789,8 @@ const runSafeFixStep = (tui, cwd, options) => {
 };
 const selectFindings = (tui, cwd, limit, pass) => {
 	tui.start(`Pass ${pass}: selecting findings`);
-	const findings = selectAgentFindings(scanJson(cwd).diagnostics, limit);
+	const scan = scanJson(cwd);
+	const findings = selectAgentFindings(scan.diagnostics, limit);
 	tui.setMetric("Selected", findings.length);
 	tui.complete({
 		status: findings.length > 0 ? "done" : "skipped",
@@ -4813,7 +4823,7 @@ const DEFAULT_RULES_YAML = `# Architecture rules (BYO)
 //#endregion
 //#region src/config/extends.ts
 const MAX_DEPTH$1 = 5;
-const MAX_CONFIG_BYTES = 1024 * 1024;
+const MAX_CONFIG_BYTES = 1048576;
 const isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 const deepMerge = (...sources) => {
 	const result = {};
@@ -4994,6 +5004,9 @@ const CiSchema = z.object({
 	format: z.enum(["json"]).default("json")
 }).strict();
 const TelemetrySchema = z.object({ enabled: z.boolean().default(true) }).strict();
+const BaselineConfigSchema = z.object({ mode: z.enum(["strict", "relaxed"]).default("relaxed") }).strict();
+const LicensingConfigSchema = z.object({ onLapse: z.enum(["fail-open", "fail-closed"]).default("fail-open") }).strict();
+const WorkspaceConfigSchema = z.object({ minimumFloor: z.number().min(0).max(100).default(50) }).strict();
 const RuleSeverityOverride = z.enum([
 	"error",
 	"warning",
@@ -5064,6 +5077,9 @@ const AislopConfigSchema = z.object({
 		format: "json"
 	})),
 	telemetry: TelemetrySchema.default(() => ({ enabled: true })),
+	baseline: BaselineConfigSchema.optional(),
+	licensing: LicensingConfigSchema.optional(),
+	workspace: WorkspaceConfigSchema.optional(),
 	rules: RulesSchema,
 	overrides: z.array(FileOverrideSchema).default(() => []),
 	exclude: z.array(z.string()).default(() => [
@@ -5097,6 +5113,9 @@ const KNOWN_KEYS_BY_PATH = {
 		"scoring",
 		"ci",
 		"telemetry",
+		"baseline",
+		"licensing",
+		"workspace",
 		"rules",
 		"exclude",
 		"include"
@@ -5147,7 +5166,10 @@ const KNOWN_KEYS_BY_PATH = {
 	],
 	"scoring.thresholds": ["good", "ok"],
 	ci: ["failBelow", "format"],
-	telemetry: ["enabled"]
+	telemetry: ["enabled"],
+	baseline: ["mode"],
+	licensing: ["onLapse"],
+	workspace: ["minimumFloor"]
 };
 const levenshtein = (a, b) => {
 	const m = a.length;
@@ -5279,7 +5301,8 @@ const loadConfig = (directory) => {
 	const configPath = findConfigFile(directory);
 	if (!configPath) return DEFAULT_CONFIG;
 	try {
-		return validateConfig(loadConfigChain(configPath), configPath);
+		const merged = loadConfigChain(configPath);
+		return validateConfig(merged, configPath);
 	} catch (error) {
 		if (error instanceof ConfigError) throw error;
 		throw new ConfigError(configPath, `Failed to parse ${configPath}: ${error instanceof Error ? error.message : String(error)}`);
@@ -5554,10 +5577,11 @@ const track = (input) => {
 		cachedInstallId = ensured.installId;
 		installCreated = ensured.created;
 	}
-	const { clean, dropped } = redactProperties({
+	const merged = {
 		...baseProperties(cachedInstallId),
 		...input.properties
-	});
+	};
+	const { clean, dropped } = redactProperties(merged);
 	if (isDebug()) {
 		const compact = JSON.stringify({
 			event: input.event,
@@ -6397,14 +6421,17 @@ const renderRailStep = (step, deps = {}) => {
 * between the last step and the footer.
 */
 const renderRailConnector = (deps = {}) => {
-	return ` ${style$1(deps.theme ?? theme, "accentDim", (deps.symbols ?? symbols).rail)}\n`;
+	const t = deps.theme ?? theme;
+	const s = deps.symbols ?? symbols;
+	return ` ${style$1(t, "accentDim", s.rail)}\n`;
 };
 /**
 * Render the rail-end footer line ("└  <footer text>").
 */
 const renderRailFooter = (footer, deps = {}) => {
 	const t = deps.theme ?? theme;
-	return ` ${style$1(t, "accentDim", (deps.symbols ?? symbols).railEnd)}  ${highlightAislop(footer, t)}\n`;
+	const s = deps.symbols ?? symbols;
+	return ` ${style$1(t, "accentDim", s.railEnd)}  ${highlightAislop(footer, t)}\n`;
 };
 const renderRail = (input, deps = {}) => {
 	const t = deps.theme ?? theme;
@@ -6561,7 +6588,7 @@ const launchMonitorInBackground = async (directory, options) => {
 	fs.mkdirSync(logDir, { recursive: true });
 	const logPath = path.join(logDir, `${monitorId}.log`);
 	const logFd = fs.openSync(logPath, "a");
-	writeAgentMonitorRecord(root, {
+	const record = {
 		id: monitorId,
 		root,
 		requestedDirectory: path.resolve(directory),
@@ -6579,7 +6606,8 @@ const launchMonitorInBackground = async (directory, options) => {
 		noFix: options.noFix,
 		logPath,
 		recentCycles: []
-	});
+	};
+	writeAgentMonitorRecord(root, record);
 	const child = spawn(process.execPath, [cliPath(), ...buildBackgroundMonitorArgs(directory, options)], {
 		cwd: root,
 		detached: true,
@@ -7828,7 +7856,8 @@ const registerPlanSubcommand = (agent) => {
 	const plan = agent.command("plan [directory]").description("Preview provider, worktree, findings, and publish actions without editing");
 	addAgentOptions(plan);
 	plan.action(async (directory = ".", _flags, command) => {
-		const options = agentOptionsFromFlags(command.optsWithGlobals(), command);
+		const flags = command.optsWithGlobals();
+		const options = agentOptionsFromFlags(flags, command);
 		await withAgentLifecycle("agent_plan", directory, agentTelemetryProperties(options), async () => {
 			await agentPlanCommand(directory, options);
 		});
@@ -7838,7 +7867,8 @@ const registerAgentCommand = (program) => {
 	const agent = program.command("agent [directory]").description("Run a local AI slop repair session with Codex, Claude Code, or OpenCode");
 	addAgentOptions(agent);
 	agent.action(async (directory = ".", _flags, command) => {
-		const options = agentOptionsFromFlags(command.optsWithGlobals(), command);
+		const flags = command.optsWithGlobals();
+		const options = agentOptionsFromFlags(flags, command);
 		await withAgentLifecycle("agent", directory, agentTelemetryProperties(options), async () => {
 			return await agentCommand(directory, options);
 		});
@@ -8130,9 +8160,9 @@ const buildSuggestedActions = (diagnostics, findings, regressed, delta) => {
 	if (fixableDiags.length > 0) {
 		const ruleIds = Array.from(new Set(fixableDiags.map((d) => d.rule)));
 		actions.push({
-			id: "run_aislop_fix",
-			label: `Run aislop fix to clear ${fixableDiags.length} mechanical finding${fixableDiags.length === 1 ? "" : "s"}.`,
-			command: "aislop fix",
+			id: "run_raigal_fix",
+			label: `Run raigal fix to clear ${fixableDiags.length} mechanical finding${fixableDiags.length === 1 ? "" : "s"}.`,
+			command: "raigal fix",
 			rationale: "These findings have deterministic fixes (formatting, unused imports, trivial comments). Running this before any manual work avoids burning agent tokens on what the CLI handles for free.",
 			ruleIds
 		});
@@ -8193,8 +8223,40 @@ const buildFeedback = (diagnostics, score, rootDirectory, baseline, meta) => {
 	const regressed = typeof delta === "number" ? delta < 0 : false;
 	let newSinceBaseline;
 	if (baselineSnapshot && baselineSnapshot.findingFingerprints.length > 0) {
-		const known = new Set(baselineSnapshot.findingFingerprints);
-		newSinceBaseline = all.filter((f) => !known.has(fingerprintFinding(f))).slice(0, MAX_NEW_SINCE_BASELINE);
+		const remainingExact = new Set(baselineSnapshot.findingFingerprints);
+		const unmatchedFindings = [];
+		for (const f of all) {
+			const exactFp = fingerprintFinding(f);
+			if (remainingExact.has(exactFp)) remainingExact.delete(exactFp);
+			else unmatchedFindings.push(f);
+		}
+		const remainingPool = [];
+		for (const fp of remainingExact) {
+			const parts = fp.split(":");
+			if (parts.length >= 3) {
+				const file = parts[0];
+				const line = Number.parseInt(parts[1], 10);
+				const rule = parts.slice(2).join(":");
+				remainingPool.push({
+					file,
+					line: Number.isNaN(line) ? 0 : line,
+					rule
+				});
+			}
+		}
+		const stillUnmatched = [];
+		for (const f of unmatchedFindings) {
+			const candidateIdx = remainingPool.findIndex((b) => b.file === f.file && b.rule === f.ruleId && Math.abs(b.line - f.line) <= 5);
+			if (candidateIdx >= 0) remainingPool.splice(candidateIdx, 1);
+			else stillUnmatched.push(f);
+		}
+		const fresh = [];
+		for (const f of stillUnmatched) {
+			const candidateIdx = remainingPool.findIndex((b) => b.file === f.file && b.rule === f.ruleId);
+			if (candidateIdx >= 0) remainingPool.splice(candidateIdx, 1);
+			else fresh.push(f);
+		}
+		newSinceBaseline = fresh.slice(0, MAX_NEW_SINCE_BASELINE);
 	}
 	return {
 		schema: "aislop.hook.v2",
@@ -8406,7 +8468,7 @@ const filterExcludedDiagnostics = (diagnostics, rootDirectory, excludePatterns)
 };
 //#endregion
 //#region src/utils/project-path-safety.ts
-const MAX_PROJECT_CONFIG_BYTES = 1024 * 1024;
+const MAX_PROJECT_CONFIG_BYTES = 1048576;
 const isWithinDirectory$3 = (rootDirectory, candidate) => {
 	const relative = path.relative(rootDirectory, candidate);
 	return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
@@ -8506,7 +8568,7 @@ const isAutoGenerated = (filePath) => {
 };
 //#endregion
 //#region src/utils/git-ignore.ts
-const MAX_BUFFER$2 = 50 * 1024 * 1024;
+const MAX_BUFFER$2 = 52428800;
 const NOT_IGNORED_ARGUMENTS = [
 	"ls-files",
 	"--cached",
@@ -8617,7 +8679,7 @@ const dropGitIgnoredPaths = (rootDirectory, absolutePaths) => {
 };
 //#endregion
 //#region src/utils/project-file-list.ts
-const MAX_BUFFER$1 = 50 * 1024 * 1024;
+const MAX_BUFFER$1 = 52428800;
 const normalizePruneDirectories = (directories) => new Set([...directories].map((directory) => directory.toLowerCase()));
 const isInPrunedDirectory = (filePath, pruneDirectories) => {
 	const pathSegments = filePath.split("/");
@@ -9549,7 +9611,7 @@ const tokenizeJs = (content, ext = ".ts") => {
 };
 //#endregion
 //#region src/utils/source-masker.ts
-const JS_EXTS$2 = /* @__PURE__ */ new Set([
+const JS_EXTS$3 = /* @__PURE__ */ new Set([
 	".ts",
 	".tsx",
 	".js",
@@ -9557,7 +9619,7 @@ const JS_EXTS$2 = /* @__PURE__ */ new Set([
 	".mjs",
 	".cjs"
 ]);
-const PY_EXTS = /* @__PURE__ */ new Set([".py"]);
+const PY_EXTS$1 = /* @__PURE__ */ new Set([".py"]);
 const RB_EXTS = /* @__PURE__ */ new Set([".rb"]);
 const PHP_EXTS = /* @__PURE__ */ new Set([".php"]);
 const CSHARP_EXTS = /* @__PURE__ */ new Set([".cs"]);
@@ -9581,8 +9643,8 @@ const C_STYLE_COMMENT_EXTS = /* @__PURE__ */ new Set([
 	".zig"
 ]);
 const familyForExt = (ext) => {
-	if (JS_EXTS$2.has(ext)) return "js";
-	if (PY_EXTS.has(ext)) return "py";
+	if (JS_EXTS$3.has(ext)) return "js";
+	if (PY_EXTS$1.has(ext)) return "py";
 	if (RB_EXTS.has(ext)) return "rb";
 	if (PHP_EXTS.has(ext)) return "php";
 	if (CSHARP_EXTS.has(ext)) return "csharp";
@@ -9852,7 +9914,7 @@ const areLiteralMultisetsEqual = (a, b) => {
 };
 //#endregion
 //#region src/engines/ai-slop/abstractions.ts
-const JS_EXTS$1 = /* @__PURE__ */ new Set([
+const JS_EXTS$2 = /* @__PURE__ */ new Set([
 	".ts",
 	".tsx",
 	".js",
@@ -9863,11 +9925,11 @@ const JS_EXTS$1 = /* @__PURE__ */ new Set([
 const THIN_WRAPPER_PATTERNS = [
 	{
 		pattern: /(?:export\s+)?(?:async\s+)?function\s+(\w+)\s*\([^)]*\)\s*(?::\s*\w[^{]*)?\{\s*\n?\s*return\s+\w+\([^)]*\);\s*\n?\s*\}/g,
-		extensions: JS_EXTS$1
+		extensions: JS_EXTS$2
 	},
 	{
 		pattern: /(?:export\s+)?const\s+(\w+)\s*=\s*(?:async\s+)?\([^)]*\)\s*(?::\s*\w[^=]*)?\s*=>\s*\w+\([^)]*\);/g,
-		extensions: JS_EXTS$1
+		extensions: JS_EXTS$2
 	},
 	{
 		pattern: /def\s+(\w+)\s*\([^)]*\)(?:\s*->[^:]*)?:\s*\n\s+return\s+\w+\([^)]*\)\s*$/gm,
@@ -11115,7 +11177,7 @@ const scriptKindFor$1 = (ext) => {
 	}
 };
 const lineFor$1 = (sourceFile, node) => sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
-const makeDiagnostic = (filePath, line, rule, message, help) => ({
+const makeDiagnostic$1 = (filePath, line, rule, message, help) => ({
 	filePath,
 	engine: "ai-slop",
 	rule,
@@ -11165,7 +11227,7 @@ const detectRedundantTryCatch = (sourceFile, relativePath) => {
 		if (ts.isTryStatement(node) && node.catchClause && !node.finallyBlock) {
 			const catchNameNode = node.catchClause.variableDeclaration?.name;
 			const [onlyStatement] = node.catchClause.block.statements;
-			if (catchNameNode && ts.isIdentifier(catchNameNode) && node.catchClause.block.statements.length === 1 && onlyStatement && (isRethrowStatement(onlyStatement, catchNameNode.text) || isPromiseRejectRethrow(onlyStatement, catchNameNode.text))) diagnostics.push(makeDiagnostic(relativePath, lineFor$1(sourceFile, node.catchClause), "ai-slop/redundant-try-catch", "Catch block only rethrows the same error", "Remove the try/catch or add useful context, cleanup, or recovery. Rethrowing unchanged errors is usually defensive agent noise."));
+			if (catchNameNode && ts.isIdentifier(catchNameNode) && node.catchClause.block.statements.length === 1 && onlyStatement && (isRethrowStatement(onlyStatement, catchNameNode.text) || isPromiseRejectRethrow(onlyStatement, catchNameNode.text))) diagnostics.push(makeDiagnostic$1(relativePath, lineFor$1(sourceFile, node.catchClause), "ai-slop/redundant-try-catch", "Catch block only rethrows the same error", "Remove the try/catch or add useful context, cleanup, or recovery. Rethrowing unchanged errors is usually defensive agent noise."));
 		}
 		ts.forEachChild(node, visit);
 	};
@@ -11183,7 +11245,7 @@ const detectPrimitiveCoercions = (sourceFile, relativePath) => {
 				const [arg] = child.arguments;
 				if (arg && ts.isIdentifier(arg)) {
 					const primitive = params.get(arg.text);
-					if (primitive && child.expression.text === COERCION_CTORS[primitive]) diagnostics.push(makeDiagnostic(relativePath, lineFor$1(sourceFile, child), "ai-slop/redundant-type-coercion", `Parameter '${arg.text}' is already typed as ${primitive} but is coerced again`, "Trust the typed boundary or validate unknown input before this function. Re-coercing already typed parameters is usually defensive agent noise."));
+					if (primitive && child.expression.text === COERCION_CTORS[primitive]) diagnostics.push(makeDiagnostic$1(relativePath, lineFor$1(sourceFile, child), "ai-slop/redundant-type-coercion", `Parameter '${arg.text}' is already typed as ${primitive} but is coerced again`, "Trust the typed boundary or validate unknown input before this function. Re-coercing already typed parameters is usually defensive agent noise."));
 				}
 			}
 			ts.forEachChild(child, visitBody);
@@ -11226,7 +11288,7 @@ const detectDuplicateExportedTypes = (parsedSources) => {
 				continue;
 			}
 			if (previous.filePath === declaration.filePath) continue;
-			diagnostics.push(makeDiagnostic(declaration.filePath, declaration.line, "ai-slop/duplicate-type-declaration", `Exported type '${declaration.name}' duplicates an existing declaration`, `Reuse or import the existing type from ${previous.filePath} instead of re-declaring the same shape in another file.`));
+			diagnostics.push(makeDiagnostic$1(declaration.filePath, declaration.line, "ai-slop/duplicate-type-declaration", `Exported type '${declaration.name}' duplicates an existing declaration`, `Reuse or import the existing type from ${previous.filePath} instead of re-declaring the same shape in another file.`));
 		}
 	}
 	return diagnostics;
@@ -11328,7 +11390,7 @@ const detectDuplicateImports = async (context) => {
 					rule: "ai-slop/duplicate-import",
 					severity: "warning",
 					message: `"${spec}" is also imported on line ${firstLine}. Merge into a single import statement.`,
-					help: "Two imports from the same module split readers' attention and grow the import block. Run aislop fix to merge them automatically.",
+					help: "Two imports from the same module split readers' attention and grow the import block. Run raigal fix to merge them automatically.",
 					line: dup.line,
 					column: 1,
 					category: "AI Slop",
@@ -13036,7 +13098,8 @@ const isJsRelativeOrAbsolute = (spec) => spec.startsWith(".") || spec.startsWith
 const RUNTIME_BUILTINS = /* @__PURE__ */ new Set(["bun"]);
 const isJsBuiltin = (spec) => {
 	if (RUNTIME_BUILTINS.has(spec)) return true;
-	return isBuiltin(spec.startsWith("node:") ? spec.slice(5) : spec) || isBuiltin(spec);
+	const stripped = spec.startsWith("node:") ? spec.slice(5) : spec;
+	return isBuiltin(stripped) || isBuiltin(spec);
 };
 const VIRTUAL_MODULE_PREFIXES = [
 	"astro:",
@@ -13248,7 +13311,8 @@ const isLocalAliasReplacement = (rawValue, configDirectory, rootDirectory) => {
 	if (!target) return false;
 	if (!target.startsWith(".") && !target.startsWith("/") && !target.startsWith("~/") && !target.startsWith("@/")) return false;
 	const normalized = target.startsWith("~/") || target.startsWith("@/") ? target.slice(2) : target;
-	return isRootBoundedTarget(path.isAbsolute(normalized) ? normalized : path.resolve(configDirectory, normalized), rootDirectory);
+	const candidate = path.isAbsolute(normalized) ? normalized : path.resolve(configDirectory, normalized);
+	return isRootBoundedTarget(candidate, rootDirectory);
 };
 const hasValidPackageImportTarget = (value, packageDirectory, rootDirectory) => {
 	if (!isRootBoundedTarget(packageDirectory, rootDirectory)) return false;
@@ -14442,7 +14506,9 @@ const isRustDocCommentLine = (line) => {
 };
 const collectBlocks = (sourceLines, syntax, content, ext) => {
 	const blocks = [];
-	const commentLines = getCommentLines(content ?? sourceLines.join("\n"), ext ?? (syntax.linePrefixes.includes("//") ? ".ts" : ".py"));
+	const actualContent = content ?? sourceLines.join("\n");
+	const actualExt = ext ?? (syntax.linePrefixes.includes("//") ? ".ts" : ".py");
+	const commentLines = getCommentLines(actualContent, actualExt);
 	let i = 0;
 	while (i < sourceLines.length) {
 		const line = sourceLines[i];
@@ -14770,7 +14836,8 @@ const detectNarrativeComments = async (context) => {
 		} catch {
 			continue;
 		}
-		const blocks = collectBlocks(content.split("\n"), syntax, content, ext);
+		const lines = content.split("\n");
+		const blocks = collectBlocks(lines, syntax, content, ext);
 		for (const block of blocks) {
 			const { matched, reason } = detectNarrativeInBlock(block, ext);
 			if (!matched) continue;
@@ -15242,7 +15309,7 @@ const detectRustPatterns = async (context) => {
 };
 //#endregion
 //#region src/engines/ai-slop/silent-recovery.ts
-const JS_EXTS = /* @__PURE__ */ new Set([
+const JS_EXTS$1 = /* @__PURE__ */ new Set([
 	".ts",
 	".tsx",
 	".js",
@@ -15437,7 +15504,7 @@ const detectSilentRecovery = async (context) => {
 	for (const filePath of files) {
 		if (isAutoGenerated(filePath)) continue;
 		const ext = path.extname(filePath);
-		const isJs = JS_EXTS.has(ext);
+		const isJs = JS_EXTS$1.has(ext);
 		if (!isJs && !(ext === ".py")) continue;
 		const relPath = relativePosix(context.rootDirectory, filePath);
 		if (isNonProductionPath(relPath)) continue;
@@ -15722,7 +15789,7 @@ const detectUnusedCss = async (context) => {
 				rule: "ai-slop/unused-css",
 				severity: "warning",
 				message: `CSS class '.${def.name}' is defined but never referenced in the codebase`,
-				help: "Remove the dead CSS rule, or confirm the class is used dynamically (and add an aislop-ignore comment if so)",
+				help: "Remove the dead CSS rule, or confirm the class is used dynamically (and add a raigal-ignore comment if so)",
 				line: def.line,
 				column: 0,
 				category: "AI Slop",
@@ -16723,7 +16790,8 @@ const checkFunctionDiagnostics = (relativePath, fn, limits, ext) => {
 	const results = [];
 	const multiplier = functionLocMultiplier(fn, ext);
 	const fnMax = functionLocBudget(fn, ext, limits.maxFunctionLoc);
-	if (exceedsLimit(fn.lineCount - fn.templateLines, limits.maxFunctionLoc, multiplier)) results.push({
+	const effectiveLineCount = fn.lineCount - fn.templateLines;
+	if (exceedsLimit(effectiveLineCount, limits.maxFunctionLoc, multiplier)) results.push({
 		filePath: relativePath,
 		engine: "code-quality",
 		rule: "complexity/function-too-long",
@@ -16813,14 +16881,14 @@ const isTrivialLine = (line) => {
 };
 const SVG_MARKUP_RE = /<\/?(?:svg|path|polyline|line|circle|rect|g)\b|(?:xmlns|viewBox|stroke(?:-width|-linecap|-linejoin)?|fill|fill-opacity|d|points|x1|x2|y1|y2)=/;
 const DATA_LITERAL_RE = /^\s*(?:[A-Za-z_$][\w$-]*:\s*(?:["'`[{]|\d|true\b|false\b|null\b)|["'`][^"'`]*["'`],?\s*$|[{}\]],?\s*$|\),?\s*$)/;
-const SUPPRESS_RE = /aislop[- ]ignore(?:-next-block|-file)?\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
-const FILE_SUPPRESS_RE = /aislop[- ]ignore-file\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
+const SUPPRESS_RE = /(?:raigal|aislop)[- ]ignore(?:-next-block|-file)?\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
+const FILE_SUPPRESS_RE = /(?:raigal|aislop)[- ]ignore-file\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
 const fileHasSuppression = (content) => FILE_SUPPRESS_RE.test(content);
 const isLowSignalMarkupWindow = (lines) => {
 	return lines.filter((line) => SVG_MARKUP_RE.test(line)).length >= Math.ceil(WINDOW_SIZE / 2);
 };
 const isLowSignalDataWindow = (lines) => {
-	return lines.filter((line) => DATA_LITERAL_RE.test(line)).length >= WINDOW_SIZE - 1;
+	return lines.filter((line) => DATA_LITERAL_RE.test(line)).length >= 9;
 };
 const findSuppressedLines = (lines) => {
 	const suppressed = /* @__PURE__ */ new Set();
@@ -16852,7 +16920,7 @@ const collectMeaningfulLines = (content) => {
 		if (isLowSignalDataWindow(window)) continue;
 		if (window.every(isTrivialLine)) continue;
 		const normalised = window.map(normaliseLine);
-		if (normalised.filter((n) => n.length > 0 && n !== "}" && n !== "{").length < WINDOW_SIZE - 1) continue;
+		if (normalised.filter((n) => n.length > 0 && n !== "}" && n !== "{").length < 9) continue;
 		if (new Set(normalised).size < MIN_DISTINCT_LINES) continue;
 		hits.push({
 			startLine: i + 1,
@@ -16956,8 +17024,8 @@ const shouldIncludeIssue = (issueType, filePath) => {
 	return !filePath.replace(/\\/g, "/").includes(".github/workflows/");
 };
 const DEPENDENCY_HELP = {
-	dependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `aislop fix`.",
-	devDependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `aislop fix`.",
+	dependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `raigal fix`.",
+	devDependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `raigal fix`.",
 	unlisted: "This package is imported in code but not declared in package.json. Run `npm install` to add it.",
 	unresolved: "This import cannot be resolved. Check for typos or missing packages.",
 	binaries: "This binary is used but its package is not in package.json."
@@ -17916,7 +17984,7 @@ const runGofmt = async (context) => {
 			rule: "go-formatting",
 			severity: "warning",
 			message: "Go file is not formatted correctly",
-			help: "Run `aislop fix` to auto-format with gofmt",
+			help: "Run `raigal fix` to auto-format with gofmt",
 			line: 0,
 			column: 0,
 			category: "Format",
@@ -17944,7 +18012,8 @@ const resolvePackageRoot = (startFile) => {
 	while (true) {
 		const packageJsonPath = path.join(current, "package.json");
 		if (fs.existsSync(packageJsonPath)) try {
-			if (JSON.parse(fs.readFileSync(packageJsonPath, "utf-8")).name === "aislop") return current;
+			const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+			if (packageJson.name === "aislop" || packageJson.name === "@methiu/raigal" || packageJson.name === "raigal") return current;
 		} catch {}
 		const parent = path.dirname(current);
 		if (parent === current) break;
@@ -18055,7 +18124,7 @@ const parseRuffFormatOutput = (output, rootDir) => {
 			rule: "python-formatting",
 			severity: "warning",
 			message: "Python file is not formatted correctly",
-			help: "Run `aislop fix` to auto-format with ruff",
+			help: "Run `raigal fix` to auto-format with ruff",
 			line: 0,
 			column: 0,
 			category: "Format",
@@ -18067,7 +18136,8 @@ const parseRuffFormatOutput = (output, rootDir) => {
 const fixRuffFormat = async (context) => {
 	const targets = context.files ? getPythonTargets(context) : [context.rootDirectory];
 	if (context.files && targets.length === 0) return;
-	const result = await runSubprocess(resolveToolBinary("ruff"), ["format", ...targets], {
+	const ruffBinary = resolveToolBinary("ruff");
+	const result = await runSubprocess(ruffBinary, ["format", ...targets], {
 		cwd: context.rootDirectory,
 		timeout: 6e4
 	});
@@ -18137,7 +18207,8 @@ const parseClangTidyOutput = (output, rootDirectory) => {
 const runClangTidy = async (context) => {
 	const compileCommandsDir = findCompileCommandsDir(context);
 	if (!compileCommandsDir) return [];
-	const sources = filterSourcesInDatabase(findCppSources(context).filter((f) => CPP_IMPL_EXTENSIONS.has(path.extname(f).toLowerCase())), readCompileCommandsFiles(compileCommandsDir));
+	const implSources = findCppSources(context).filter((f) => CPP_IMPL_EXTENSIONS.has(path.extname(f).toLowerCase()));
+	const sources = filterSourcesInDatabase(implSources, readCompileCommandsFiles(compileCommandsDir));
 	if (sources.length === 0) return [];
 	const diagnostics = [];
 	for (const chunk of chunkFilePaths(sources, CLANG_TIDY_CHUNK_MAX_FILES)) try {
@@ -18507,7 +18578,7 @@ const runExpoDoctor = async (context) => {
 		rule: "expo-doctor/config-error",
 		severity: "warning",
 		message: configError,
-		help: "Install project dependencies, then re-run `aislop scan`.",
+		help: "Install project dependencies, then re-run `raigal scan`.",
 		line: 0,
 		column: 0,
 		category: "Expo",
@@ -18973,7 +19044,8 @@ const processFile = (filePath, fileTargets, result) => {
 			});
 			continue;
 		}
-		const { edit, skipReason } = computeEdit(sourceFile, classifyIdentifier(best));
+		const shape = classifyIdentifier(best);
+		const { edit, skipReason } = computeEdit(sourceFile, shape);
 		if (!edit) {
 			pendingSkips.push({
 				target,
@@ -19788,7 +19860,8 @@ const ruffLintFixArgs = (context, unsafe) => {
 };
 const fixRuffLint = async (context) => {
 	if (context.files && getPythonTargets(context).length === 0) return;
-	const result = await runSubprocess(resolveToolBinary("ruff"), ruffLintFixArgs(context, false), {
+	const ruffBinary = resolveToolBinary("ruff");
+	const result = await runSubprocess(ruffBinary, ruffLintFixArgs(context, false), {
 		cwd: context.rootDirectory,
 		timeout: 6e4
 	});
@@ -19796,7 +19869,8 @@ const fixRuffLint = async (context) => {
 };
 const fixRuffLintForce = async (context) => {
 	if (context.files && getPythonTargets(context).length === 0) return;
-	const result = await runSubprocess(resolveToolBinary("ruff"), ruffLintFixArgs(context, true), {
+	const ruffBinary = resolveToolBinary("ruff");
+	const result = await runSubprocess(ruffBinary, ruffLintFixArgs(context, true), {
 		cwd: context.rootDirectory,
 		timeout: 6e4
 	});
@@ -19837,7 +19911,8 @@ const resolveTrustedTscPath = () => {
 };
 const isReferenceOnlyConfig = (tsconfigPath) => {
 	try {
-		const parsed = parseJsonc(fs.readFileSync(tsconfigPath, "utf-8"));
+		const raw = fs.readFileSync(tsconfigPath, "utf-8");
+		const parsed = parseJsonc(raw);
 		if (!parsed) return false;
 		return Array.isArray(parsed.references) && !parsed.files && !parsed.include && !parsed.extends;
 	} catch {
@@ -19980,6 +20055,174 @@ const lintEngine = {
 	}
 };
 //#endregion
+//#region src/engines/security/ai-security.ts
+const JS_EXTS = /* @__PURE__ */ new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mjs",
+	".cjs"
+]);
+const PY_EXTS = /* @__PURE__ */ new Set([".py"]);
+const UNICODE_TAG_RE = /[\u{E0000}-\u{E007F}]/gu;
+const hasRuleIgnore = (lines, lineIndex, ruleSuffix) => {
+	const start = Math.max(0, lineIndex - 2);
+	const re = new RegExp(`(?:raigal|aislop)[- ]ignore(?:-file)?\\b.*(?:${ruleSuffix}|security\\/${ruleSuffix})`, "i");
+	return lines.slice(start, lineIndex + 1).some((line) => re.test(line));
+};
+const hasFileIgnore = (lines, ruleSuffix) => {
+	const re = new RegExp(`(?:raigal|aislop)[- ]ignore-file\\b.*(?:${ruleSuffix}|security\\/${ruleSuffix})`, "i");
+	return lines.slice(0, 10).some((line) => re.test(line));
+};
+const makeDiagnostic = (filePath, rule, message, help, line, column) => ({
+	filePath,
+	engine: "security",
+	rule,
+	severity: "error",
+	message,
+	help,
+	line,
+	column,
+	category: "Security",
+	fixable: false
+});
+const P_BYPASS = "bypassPermissions";
+const P_EXEC_TYPE = "executor_type";
+const P_LOCAL = "local";
+const P_USE_DOCKER = "use_docker";
+const P_AUTO_RUN = "auto_run";
+const P_UNSAFE_MODE = "unsafe_mode";
+const P_PYTHON_REPL = "PythonREPLTool";
+const UNSANDBOXED_TOOL_PATTERNS = [
+	{
+		pattern: new RegExp(`\\bpermission_?mode["']?\\s*[:=]\\s*["']${P_BYPASS}["']`, "i"),
+		message: `permission_mode '${P_BYPASS}' bypasses agent sandboxing and human confirmation`,
+		help: `Do not use ${P_BYPASS} mode in production; use standard interactive approval`
+	},
+	{
+		pattern: new RegExp(`\\b${P_EXEC_TYPE}["']?\\s*[:=]\\s*["']${P_LOCAL}["']`, "i"),
+		message: `${P_EXEC_TYPE}='${P_LOCAL}' executes LLM-generated code directly on host machine without container isolation`,
+		help: "Configure agent to use DockerCommandLineCodeExecutor or a containerized sandbox environment"
+	},
+	{
+		pattern: new RegExp(`\\b(?:LocalCommandLineCodeExecutor|LocalCodeExecutor)\\s*\\(`),
+		message: "Local code executor executes LLM-generated code on host machine without container isolation",
+		help: "Use DockerCommandLineCodeExecutor or an isolated execution sandbox"
+	},
+	{
+		pattern: new RegExp(`\\b${P_USE_DOCKER}\\s*[:=]\\s*(?:False|false)\\b|["']${P_USE_DOCKER}["']\\s*:\\s*(?:False|false)\\b`),
+		message: `${P_USE_DOCKER}=False disables container sandboxing for agent code execution`,
+		help: `Set ${P_USE_DOCKER}=True to isolate agent execution inside Docker containers`
+	},
+	{
+		pattern: new RegExp(`\\b(?:interpreter\\.)?${P_AUTO_RUN}\\s*[:=]\\s*(?:True|true)\\b`),
+		message: `${P_AUTO_RUN}=True allows autonomous shell execution without human confirmation`,
+		help: `Keep ${P_AUTO_RUN}=False so dangerous commands require explicit human review`
+	},
+	{
+		pattern: new RegExp(`\\bCodeInterpreterTool\\s*\\([^)]*${P_UNSAFE_MODE}\\s*=\\s*(?:True|true)\\b|\\b${P_UNSAFE_MODE}\\s*[:=]\\s*(?:True|true)\\b`),
+		message: `${P_UNSAFE_MODE}=True allows code interpreter tool to execute without Docker isolation`,
+		help: `Disable ${P_UNSAFE_MODE} and isolate code execution in containerized environments`
+	},
+	{
+		pattern: new RegExp(`\\b(?:${P_PYTHON_REPL}|PythonAstREPLTool)\\s*\\(`),
+		message: `${P_PYTHON_REPL} executes arbitrary Python code in host process without container isolation`,
+		help: `Use containerized sandbox execution rather than unconfined ${P_PYTHON_REPL} in production`
+	}
+];
+const P_SYS = "system";
+const P_DEV = "developer";
+const P_SM = "SystemMessage";
+const PROMPT_INJECTION_JS_PATTERNS = [
+	new RegExp(`(?:role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?content\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`)`, "g"),
+	new RegExp(`(?:content\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`[^}{;]{0,120}?role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`(?:role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?content\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["']))`, "g"),
+	new RegExp(`(?:content\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["'])[^}{;]{0,120}?role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`\\b(?:${P_SYS}|systemPrompt|system_prompt|system_instruction)\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\``, "g"),
+	new RegExp(`\\b(?:${P_SYS}|systemPrompt|system_prompt|system_instruction)\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["'])`, "g"),
+	new RegExp(`\\b(?:new\\s+)?${P_SM}\\s*\\(\\s*(?:\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`|["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["']|\\{\\s*content\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`)`, "g"),
+	new RegExp(`\\[\\s*["']${P_SYS}["']\\s*,\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`\\s*\\]`, "g")
+];
+const PROMPT_INJECTION_PY_PATTERNS = [
+	new RegExp(`(?:["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?["']content["']\\s*:\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["']))`, "g"),
+	new RegExp(`(?:["']content["']\\s*:\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])[^}{;]{0,120}?["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`(?:["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?["']content["']\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\())`, "g"),
+	new RegExp(`(?:["']content["']\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\()[^}{;]{0,120}?["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`\\b(?:${P_SYS}|system_prompt|system_message|system_instruction)\\s*=\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])`, "g"),
+	new RegExp(`\\b(?:${P_SYS}|system_prompt|system_message|system_instruction)\\s*=\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\()`, "g"),
+	new RegExp(`\\b${P_SM}\\s*\\(\\s*(?:content\\s*=\\s*)?f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])`, "g"),
+	new RegExp(`\\b${P_SM}\\s*\\(\\s*(?:content\\s*=\\s*)?(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\()`, "g"),
+	new RegExp(`\\(\\s*["']${P_SYS}["']\\s*,\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])\\s*\\)`, "g")
+];
+const checkInvisibleUnicode = (relPath, content, lines) => {
+	if (hasFileIgnore(lines, "invisible-unicode-tags")) return [];
+	const results = [];
+	const tagRegex = new RegExp(UNICODE_TAG_RE.source, UNICODE_TAG_RE.flags);
+	for (const match of content.matchAll(tagRegex)) {
+		const matchIndex = match.index ?? 0;
+		const line = content.slice(0, matchIndex).split("\n").length;
+		const col = matchIndex - content.lastIndexOf("\n", matchIndex - 1);
+		if (hasRuleIgnore(lines, line - 1, "invisible-unicode-tags")) continue;
+		results.push(makeDiagnostic(relPath, "security/invisible-unicode-tags", "Invisible Unicode Tag character (U+E0000-U+E007F) detected: potential stealth prompt injection or ASCII smuggling", "Remove invisible Unicode tag characters. Unicode Tag block (U+E0000-U+E007F) has no legitimate printable presentation in source code", line, col));
+	}
+	return results;
+};
+const checkUnsandboxedTools = (relPath, content, lines) => {
+	if (hasFileIgnore(lines, "unsandboxed-agent-tool")) return [];
+	const results = [];
+	for (const { pattern, message, help } of UNSANDBOXED_TOOL_PATTERNS) {
+		const regex = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`);
+		for (const match of content.matchAll(regex)) {
+			const matchIndex = match.index ?? 0;
+			const line = content.slice(0, matchIndex).split("\n").length;
+			const col = matchIndex - content.lastIndexOf("\n", matchIndex - 1);
+			if (hasRuleIgnore(lines, line - 1, "unsandboxed-agent-tool")) continue;
+			results.push(makeDiagnostic(relPath, "security/unsandboxed-agent-tool", message, help, line, col));
+		}
+	}
+	return results;
+};
+const checkPromptInjection = (relPath, content, lines, isJs) => {
+	if (hasFileIgnore(lines, "prompt-injection")) return [];
+	const results = [];
+	const patterns = isJs ? PROMPT_INJECTION_JS_PATTERNS : PROMPT_INJECTION_PY_PATTERNS;
+	for (const pattern of patterns) {
+		const regex = new RegExp(pattern.source, pattern.flags);
+		for (const match of content.matchAll(regex)) {
+			const matchIndex = match.index ?? 0;
+			const line = content.slice(0, matchIndex).split("\n").length;
+			const col = matchIndex - content.lastIndexOf("\n", matchIndex - 1);
+			if (hasRuleIgnore(lines, line - 1, "prompt-injection")) continue;
+			results.push(makeDiagnostic(relPath, "security/prompt-injection", "Untrusted variable interpolation into system prompt creates prompt injection vulnerability", "Keep system prompts static. Pass dynamic user inputs via user messages or input parameters with strict delimiters", line, col));
+		}
+	}
+	return results;
+};
+const scanAiSecurity = async (context) => {
+	const files = getSourceFiles(context);
+	const diagnostics = [];
+	for (const filePath of files) {
+		const ext = path.extname(filePath);
+		let content;
+		try {
+			content = fs.readFileSync(filePath, "utf-8");
+		} catch {
+			continue;
+		}
+		const relativePath = relativePosix(context.rootDirectory, filePath);
+		const lines = content.split("\n");
+		diagnostics.push(...checkInvisibleUnicode(relativePath, content, lines));
+		const isJs = JS_EXTS.has(ext);
+		const isPy = PY_EXTS.has(ext);
+		if (isJs || isPy) {
+			diagnostics.push(...checkUnsandboxedTools(relativePath, content, lines));
+			diagnostics.push(...checkPromptInjection(relativePath, content, lines, isJs));
+		}
+	}
+	return diagnostics;
+};
+//#endregion
 //#region src/ui/invocation.ts
 const detectInvocation = () => "raigal";
 //#endregion
@@ -20362,7 +20605,7 @@ const parseJsAudit = (output, source, manifest) => {
 			rule: "security/dependency-audit-skipped",
 			severity: "info",
 			message: `Dependency audit skipped (${source}): lockfile is missing`,
-			help: errorDetail ?? "Generate a lockfile, then re-run `aislop scan` for dependency vulnerability checks.",
+			help: errorDetail ?? "Generate a lockfile, then re-run `raigal scan` for dependency vulnerability checks.",
 			line: 0,
 			column: 0,
 			category: "Security",
@@ -20536,10 +20779,11 @@ const auditSkippedDiagnostic = (source, help) => ({
 });
 const runNpmAudit = async (rootDir, timeout) => {
 	try {
-		return parseJsAudit((await runSubprocess("npm", ["audit", "--json"], {
+		const result = await runSubprocess("npm", ["audit", "--json"], {
 			cwd: rootDir,
 			timeout
-		})).stdout, "npm audit", readRuntimeDependencies(rootDir));
+		});
+		return parseJsAudit(result.stdout, "npm audit", readRuntimeDependencies(rootDir));
 	} catch (error) {
 		return [auditSkippedDiagnostic("npm audit", `Failed to run npm audit: ${errorMessageOf(error)}`)];
 	}
@@ -20560,10 +20804,11 @@ const runBunAudit = async (rootDir, timeout) => {
 const runPnpmAuditWithFallback = async (rootDir, timeout) => {
 	const canFallbackToNpm = fs.existsSync(path.join(rootDir, "package-lock.json"));
 	try {
-		const diagnostics = parseJsAudit((await runSubprocess("pnpm", ["audit", "--json"], {
+		const result = await runSubprocess("pnpm", ["audit", "--json"], {
 			cwd: rootDir,
 			timeout
-		})).stdout, "pnpm audit", readRuntimeDependencies(rootDir));
+		});
+		const diagnostics = parseJsAudit(result.stdout, "pnpm audit", readRuntimeDependencies(rootDir));
 		if (diagnostics.some((d) => d.rule === "security/dependency-audit-skipped")) {
 			if (canFallbackToNpm) return runNpmAudit(rootDir, timeout);
 			return diagnostics;
@@ -20920,7 +21165,7 @@ const RISKY_PATTERNS = [
 //#region src/engines/security/risky.ts
 const hasDangerouslySetInnerHtmlIgnore = (lines, lineIndex) => {
 	const start = Math.max(0, lineIndex - 2);
-	return lines.slice(start, lineIndex + 1).some((line) => /(?:biome-ignore|eslint-disable|aislop-ignore).*(?:noDangerouslySetInnerHtml|dangerouslySetInnerHTML|dangerously-set-innerhtml)/i.test(line));
+	return lines.slice(start, lineIndex + 1).some((line) => /(?:biome-ignore|eslint-disable|raigal-ignore|aislop-ignore).*(?:noDangerouslySetInnerHtml|dangerouslySetInnerHTML|dangerously-set-innerhtml)/i.test(line));
 };
 const isStructuredDataScript = (content, matchIndex) => {
 	const before = content.slice(Math.max(0, matchIndex - 300), matchIndex);
@@ -21248,7 +21493,11 @@ const ALL_ENGINES = [
 		name: "security",
 		async run(context) {
 			const diagnostics = [];
-			const promises = [scanSecrets(context), detectRiskyConstructs(context)];
+			const promises = [
+				scanSecrets(context),
+				detectRiskyConstructs(context),
+				scanAiSecurity(context)
+			];
 			if (context.config.security.audit) promises.push(runDependencyAudit(context));
 			const results = await Promise.allSettled(promises);
 			for (const result of results) if (result.status === "fulfilled") diagnostics.push(...result.value);
@@ -21293,7 +21542,10 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 		failed: true,
 		skipReason: r.reason instanceof Error ? r.reason.message : String(r.reason)
 	});
-	return dedupeEquivalenceDiagnostics(dedupeOverlappingComments(dedupeCSharpAsync(stripSecretDiagnostics(finalResults))));
+	const stripped = stripSecretDiagnostics(finalResults);
+	const csharp = dedupeCSharpAsync(stripped);
+	const comments = dedupeOverlappingComments(csharp);
+	return dedupeEquivalenceDiagnostics(comments);
 };
 const stripSecretDiagnostics = (results) => {
 	for (const result of results) for (const d of result.diagnostics) if (d.redactSource || isSecretClassRule(d.rule)) {
@@ -21439,6 +21691,9 @@ const RULE_SCORE_IMPACTS = {
 	"security/shell-injection": strict("Interpolated shell commands can become command execution."),
 	"security/unsafe-deserialization": strict("Deserializing untrusted data with a legacy .NET formatter can become remote code execution."),
 	"security/unsafe-c-call": strict("Unbounded C string and process calls can become buffer overflows or command execution."),
+	"security/prompt-injection": strict("Dynamic user interpolation in system/developer prompts enables prompt injection attacks."),
+	"security/unsandboxed-agent-tool": strict("Unsandboxed agent code execution or tool permission bypass allows arbitrary host commands."),
+	"security/invisible-unicode-tags": strict("Invisible Unicode Tag characters (U+E0000-U+E007F) hide stealth prompt injection payloads."),
 	"security/dependency-audit-skipped": advisory("An unavailable audit is visibility loss, not evidence of a vulnerability."),
 	"dotnet/projects-skipped": advisory("Skipping unrestored C# projects is visibility loss, not evidence of a defect."),
 	"cppcheck/chunks-skipped": advisory("A skipped cppcheck chunk is visibility loss, not evidence that the skipped files have a defect."),
@@ -21515,7 +21770,8 @@ const calculateScore = (diagnostics, weights, thresholds, sourceFileCount, smoot
 	const capScale = Math.max(1, fileCount.effectiveSourceFileCount / CAP_REFERENCE_FILES);
 	const defaultRuleCap = typeof maxPerRule === "number" && maxPerRule > 0 ? maxPerRule : null;
 	const capForRule = (key) => {
-		const ruleCap = scoreImpactForRule(key.slice(key.indexOf(":") + 1)).cap;
+		const rule = key.slice(key.indexOf(":") + 1);
+		const ruleCap = scoreImpactForRule(rule).cap;
 		if (typeof ruleCap === "number") return defaultRuleCap ? Math.min(defaultRuleCap, ruleCap) : ruleCap;
 		return defaultRuleCap;
 	};
@@ -21628,8 +21884,10 @@ const detectSourceLanguages = (sourceFiles) => {
 const detectLanguages = (directory, sourceFiles) => {
 	const languages = new Set(detectSourceLanguages(sourceFiles));
 	for (const [file, lang] of Object.entries(LANGUAGE_SIGNALS)) if (fs.existsSync(path.join(directory, file))) languages.add(lang);
-	if (readPackageJson(path.join(directory, "package.json"))) if (fs.existsSync(path.join(directory, "tsconfig.json"))) languages.add("typescript");
-	else languages.add("javascript");
+	if (readPackageJson(path.join(directory, "package.json"))) {
+		if (fs.existsSync(path.join(directory, "tsconfig.json"))) languages.add("typescript");
+		else languages.add("javascript");
+	}
 	for (const signal of PYTHON_SIGNALS) if (fs.existsSync(path.join(directory, signal))) {
 		languages.add("python");
 		break;
@@ -21856,7 +22114,7 @@ const runScopedScan = async (cwd, filePaths) => {
 	const rulesPath = configDir ? path.join(configDir, RULES_FILE) : void 0;
 	const enumeratedPaths = new Set(projectCandidates.map((filePath) => path.resolve(rootDirectory, filePath)));
 	const scopedCandidates = filePaths.filter((filePath) => enumeratedPaths.has(path.resolve(rootDirectory, filePath)));
-	const diagnostics = applyRuleSeverities((await runEngines({
+	const context = {
 		rootDirectory: project.rootDirectory,
 		languages: project.languages,
 		frameworks: project.frameworks,
@@ -21879,14 +22137,17 @@ const runScopedScan = async (cwd, filePaths) => {
 			allowProjectLocalTools: false,
 			architectureRulesPath: config.engines.architecture ? rulesPath : void 0
 		}
-	}, {
+	};
+	const enabled = {
 		format: false,
 		lint: false,
 		"code-quality": config.engines["code-quality"],
 		"ai-slop": config.engines["ai-slop"],
 		architecture: config.engines.architecture,
 		security: false
-	})).flatMap((result) => result.diagnostics), config.overrides.length ? {} : config.rules);
+	};
+	const results = await runEngines(context, enabled);
+	const diagnostics = applyRuleSeverities(results.flatMap((result) => result.diagnostics), config.overrides.length ? {} : config.rules);
 	const { score } = calculateScore(diagnostics, config.scoring.weights, config.scoring.thresholds, projectSourceFiles.length + projectTestFiles.length, config.scoring.smoothing, config.scoring.maxPerRule);
 	return {
 		diagnostics,
@@ -21944,14 +22205,26 @@ const hasExistingLiteralBackslashPath = (cwd, fingerprint) => {
 	}
 };
 const migrateMarkerlessFingerprint = (cwd, fingerprint) => hasExistingLiteralBackslashPath(cwd, fingerprint) ? fingerprint : normalizeLegacyFingerprint(fingerprint);
-const BASELINE_REL = path.join(".aislop", "baseline.json");
-const baselinePath = (cwd) => path.join(cwd, BASELINE_REL);
+const baselinePath = (cwd) => {
+	const raigalCandidate = path.join(cwd, ".raigal", "baseline.json");
+	if (fs.existsSync(raigalCandidate)) return raigalCandidate;
+	const raigalDir = path.join(cwd, ".raigal");
+	if (fs.existsSync(raigalDir)) return raigalCandidate;
+	return path.join(cwd, ".aislop", "baseline.json");
+};
+const sessionPath = (cwd) => {
+	const raigalCandidate = path.join(cwd, ".raigal", "session.jsonl");
+	if (fs.existsSync(raigalCandidate)) return raigalCandidate;
+	const raigalDir = path.join(cwd, ".raigal");
+	if (fs.existsSync(raigalDir)) return raigalCandidate;
+	return path.join(cwd, ".aislop", "session.jsonl");
+};
 const readBaseline = (cwd) => {
 	const raw = readIfExists(baselinePath(cwd));
 	if (!raw) return null;
 	try {
 		const parsed = JSON.parse(raw);
-		if (parsed.schema !== "aislop.baseline.v2" && parsed.schema !== "aislop.baseline.v1") return null;
+		if (parsed.schema !== "aislop.baseline.v2" && parsed.schema !== "aislop.baseline.v1" && parsed.schema !== "raigal.baseline.v2" && parsed.schema !== "raigal.baseline.v1") return null;
 		const findingFingerprints = parsed.findingFingerprints ?? [];
 		const needsWindowsMigration = parsed.pathFormat !== "posix";
 		return {
@@ -21983,11 +22256,10 @@ const captureBaseline = async (cwd) => {
 	});
 	const project = await discoverProject(cwd);
 	const config = loadConfig(cwd);
-	const results = await runEngines({
+	const context = {
 		rootDirectory: project.rootDirectory,
 		languages: project.languages,
 		frameworks: project.frameworks,
-		files: [],
 		installedTools: project.installedTools,
 		config: {
 			overrides: config.overrides,
@@ -22003,19 +22275,22 @@ const captureBaseline = async (cwd) => {
 			},
 			allowProjectLocalTools: false
 		}
-	}, {
+	};
+	const enabled = {
 		format: false,
 		lint: false,
 		"code-quality": config.engines["code-quality"],
 		"ai-slop": config.engines["ai-slop"],
 		architecture: config.engines.architecture,
 		security: false
-	});
-	const diagnostics = results.flatMap((r) => r.diagnostics);
+	};
+	const results = await runEngines(context, enabled);
+	const diagnostics = applyRuleSeverities(results.flatMap((r) => r.diagnostics), config.overrides.length ? {} : config.rules);
 	const { score } = calculateScore(diagnostics, config.scoring.weights, config.scoring.thresholds, project.sourceFileCount, config.scoring.smoothing, config.scoring.maxPerRule);
 	const byEngine = {};
 	for (const r of results) {
-		const { score: engineScore } = calculateScore(diagnostics.filter((d) => r.diagnostics.includes(d)), config.scoring.weights, config.scoring.thresholds, project.sourceFileCount, config.scoring.smoothing, config.scoring.maxPerRule);
+		const engineDiags = diagnostics.filter((d) => d.engine === r.engine);
+		const { score: engineScore } = calculateScore(engineDiags, config.scoring.weights, config.scoring.thresholds, project.sourceFileCount, config.scoring.smoothing, config.scoring.maxPerRule);
 		byEngine[r.engine] = engineScore;
 	}
 	const findingFingerprints = diagnostics.filter((d) => d.severity === "error" || d.severity === "warning").map((d) => fingerprintDiagnostic(d, project.rootDirectory));
@@ -22037,7 +22312,7 @@ const captureBaseline = async (cwd) => {
 };
 const appendSessionFiles = (cwd, files) => {
 	if (files.length === 0) return;
-	const target = path.join(cwd, ".aislop", "session.jsonl");
+	const target = sessionPath(cwd);
 	try {
 		fs.mkdirSync(path.dirname(target), { recursive: true });
 		const line = `${JSON.stringify({
@@ -22048,7 +22323,8 @@ const appendSessionFiles = (cwd, files) => {
 	} catch {}
 };
 const readSessionFiles = (cwd) => {
-	const raw = readIfExists(path.join(cwd, ".aislop", "session.jsonl"));
+	const target = sessionPath(cwd);
+	const raw = readIfExists(target);
 	if (!raw) return [];
 	const files = /* @__PURE__ */ new Set();
 	for (const line of raw.split("\n")) {
@@ -22061,7 +22337,7 @@ const readSessionFiles = (cwd) => {
 	return Array.from(files);
 };
 const clearSessionFiles = (cwd) => {
-	const target = path.join(cwd, ".aislop", "session.jsonl");
+	const target = sessionPath(cwd);
 	try {
 		fs.unlinkSync(target);
 	} catch {}
@@ -22165,7 +22441,7 @@ const runClaudeFileChangedHook = async (deps = {}) => {
 			schema: "aislop.hook.v2",
 			event: "file_changed",
 			file: changed,
-			message: `Watched file changed (${changed}). aislop refreshed the baseline — score: ${result.score}.`,
+			message: `Watched file changed (${changed}). raigal refreshed the baseline - score: ${result.score}.`,
 			baseline: {
 				score: result.score,
 				fileCount: result.fileCount
@@ -22521,7 +22797,9 @@ const applyRemoval = (result, opts, target, nextContent) => {
 //#region src/hooks/install/rules-only.ts
 const installRulesOnly = (opts, paths, summary) => {
 	const result = emptyResult();
-	const next = upsertMarkdownFence(readIfExists(paths.rules), AISLOP_MD_BODY, sentinelHash(AISLOP_MD_BODY)).nextContent;
+	const existing = readIfExists(paths.rules);
+	const hash = sentinelHash(AISLOP_MD_BODY);
+	const next = upsertMarkdownFence(existing, AISLOP_MD_BODY, hash).nextContent;
 	applyContent(result, opts, paths.rules, next, summary);
 	if (paths.host && paths.marker) {
 		const host = readIfExists(paths.host) ?? "";
@@ -22573,7 +22851,7 @@ const uninstallAntigravity = (opts) => {
 //#endregion
 //#region src/hooks/io/json-patch.ts
 const AISLOP_SENTINEL_KEY = "__aislop";
-const isAislopManaged = (x) => typeof x === "object" && x !== null && "__aislop" in x && x["__aislop"] != null;
+const isAislopManaged = (x) => typeof x === "object" && x !== null && ("__aislop" in x && x["__aislop"] != null || "__raigal" in x && x["__raigal"] != null);
 const groupIsAislop = (group) => {
 	if (typeof group !== "object" || group === null) return false;
 	const hooks = group.hooks;
@@ -22628,14 +22906,14 @@ const resolveClaudePaths = (opts) => {
 };
 const buildHookGroup$1 = () => {
 	const hashBody = JSON.stringify({
-		command: "aislop hook claude",
+		command: "raigal hook claude",
 		matcher: "Edit|Write|MultiEdit"
 	});
 	return {
 		matcher: "Edit|Write|MultiEdit",
 		hooks: [{
 			type: "command",
-			command: "aislop hook claude",
+			command: "raigal hook claude",
 			[AISLOP_SENTINEL_KEY]: {
 				v: 1,
 				managed: true,
@@ -22645,12 +22923,12 @@ const buildHookGroup$1 = () => {
 	};
 };
 const buildStopHookGroup = () => {
-	const hashBody = JSON.stringify({ command: "aislop hook claude --stop" });
+	const hashBody = JSON.stringify({ command: "raigal hook claude --stop" });
 	return {
 		matcher: "",
 		hooks: [{
 			type: "command",
-			command: "aislop hook claude --stop",
+			command: "raigal hook claude --stop",
 			[AISLOP_SENTINEL_KEY]: {
 				v: 1,
 				managed: true,
@@ -22662,14 +22940,14 @@ const buildStopHookGroup = () => {
 const FILE_CHANGED_MATCHER = ".raigal/config.yml|.raigal/rules.yml|.aislop/config.yml|.aislop/rules.yml|package.json";
 const buildFileChangedHookGroup = () => {
 	const hashBody = JSON.stringify({
-		command: "aislop hook claude --on-file-changed",
+		command: "raigal hook claude --on-file-changed",
 		matcher: FILE_CHANGED_MATCHER
 	});
 	return {
 		matcher: FILE_CHANGED_MATCHER,
 		hooks: [{
 			type: "command",
-			command: "aislop hook claude --on-file-changed",
+			command: "raigal hook claude --on-file-changed",
 			[AISLOP_SENTINEL_KEY]: {
 				v: 1,
 				managed: true,
@@ -22697,7 +22975,8 @@ const installClaude = (opts) => {
 	const nextSettings = renderSettings$1(readIfExists(paths.settings), Boolean(opts.qualityGate));
 	applyContent(result, opts, paths.settings, nextSettings, "register PostToolUse + FileChanged hooks");
 	const mdHash = sentinelHash(AISLOP_MD_BODY);
-	const fenced = upsertMarkdownFence(readIfExists(paths.aislopMd), AISLOP_MD_BODY, mdHash);
+	const existingMd = readIfExists(paths.aislopMd);
+	const fenced = upsertMarkdownFence(existingMd, AISLOP_MD_BODY, mdHash);
 	applyContent(result, opts, paths.aislopMd, fenced.nextContent, "write AISLOP.md rules");
 	const existingClaudeMd = readIfExists(paths.claudeMd) ?? "";
 	const marker = "@AISLOP.md";
@@ -22812,11 +23091,11 @@ const resolveCursorPaths = (opts) => {
 };
 const buildHookEntry = () => {
 	const hashBody = JSON.stringify({
-		command: "aislop hook cursor",
+		command: "raigal hook cursor",
 		timeout: 5e3
 	});
 	return {
-		command: "aislop hook cursor",
+		command: "raigal hook cursor",
 		type: "command",
 		timeout: 5e3,
 		[AISLOP_SENTINEL_KEY]: {
@@ -22843,7 +23122,9 @@ const installCursor = (opts) => {
 	const nextHooks = renderHooksJson(readIfExists(paths.hooks));
 	applyContent(result, opts, paths.hooks, nextHooks, "register afterFileEdit hook");
 	if (opts.scope === "project") {
-		const rules = upsertMarkdownFence(readIfExists(paths.rules), AISLOP_MD_BODY, sentinelHash(AISLOP_MD_BODY)).nextContent;
+		const existingRules = readIfExists(paths.rules);
+		const hash = sentinelHash(AISLOP_MD_BODY);
+		const rules = upsertMarkdownFence(existingRules, AISLOP_MD_BODY, hash).nextContent;
 		applyContent(result, opts, paths.rules, rules, "write .cursor/rules/aislop.mdc");
 	}
 	return result;
@@ -22883,15 +23164,15 @@ const resolveGeminiPaths = (opts) => {
 };
 const buildHookGroup = () => {
 	const hashBody = JSON.stringify({
-		command: "aislop hook gemini",
+		command: "raigal hook gemini",
 		matcher: "write_file|replace"
 	});
 	return {
 		matcher: "write_file|replace",
 		hooks: [{
-			name: "aislop",
+			name: "raigal",
 			type: "command",
-			command: "aislop hook gemini",
+			command: "raigal hook gemini",
 			timeout: 5e3,
 			[AISLOP_SENTINEL_KEY]: {
 				v: 1,
@@ -22916,7 +23197,9 @@ const installGemini = (opts) => {
 	const result = emptyResult();
 	const next = renderSettings(readIfExists(paths.settings));
 	applyContent(result, opts, paths.settings, next, "register AfterTool hook");
-	const fenced = upsertMarkdownFence(readIfExists(paths.aislopMd), AISLOP_MD_BODY, sentinelHash(AISLOP_MD_BODY)).nextContent;
+	const existingMd = readIfExists(paths.aislopMd);
+	const hash = sentinelHash(AISLOP_MD_BODY);
+	const fenced = upsertMarkdownFence(existingMd, AISLOP_MD_BODY, hash).nextContent;
 	applyContent(result, opts, paths.aislopMd, fenced, "write AISLOP.md rules");
 	const existingGeminiMd = readIfExists(paths.geminiMd) ?? "";
 	const marker = "@AISLOP.md";
@@ -22982,8 +23265,8 @@ const uninstallKilocode = (opts) => {
 const resolvePiPaths = (opts) => {
 	return { extension: opts.scope === "project" ? path.join(opts.cwd, ".pi", "extensions", "aislop.js") : path.join(opts.home, ".pi", "agent", "extensions", "aislop.js") };
 };
-const PI_EXTENSION_SOURCE = `// aislop — auto-generated pi extension. Do not edit by hand.
-// Reinstall with: aislop hook install --pi
+const PI_EXTENSION_SOURCE = `// raigal — auto-generated pi extension. Do not edit by hand.
+// Reinstall with: raigal hook install --pi
 import { spawn } from "node:child_process";
 
 // Runs the CLI async so a slow scan never blocks pi's event loop, and forwards
@@ -23028,7 +23311,7 @@ export default function (pi) {
 		const filePath = event.input && event.input.path;
 		if (typeof filePath !== "string" || filePath.length === 0) return;
 
-		const bin = process.env.AISLOP_BIN || "aislop";
+		const bin = process.env.RAIGAL_BIN || process.env.AISLOP_BIN || "raigal";
 		const payload = JSON.stringify({
 			cwd: ctx.cwd,
 			file_path: filePath,
@@ -23055,7 +23338,7 @@ export default function (pi) {
 const installPi = (opts) => {
 	const paths = resolvePiPaths(opts);
 	const result = emptyResult();
-	applyContent(result, opts, paths.extension, PI_EXTENSION_SOURCE, "write pi aislop extension");
+	applyContent(result, opts, paths.extension, PI_EXTENSION_SOURCE, "write pi raigal extension");
 	return result;
 };
 const uninstallPi = (opts) => {
@@ -23414,8 +23697,10 @@ const runSearchPrompt = async (options) => {
 			}
 			if (key.name === "space" && options.mode === "multi") {
 				const item = filtered[cursor];
-				if (item) if (selected.has(item.value)) selected.delete(item.value);
-				else selected.add(item.value);
+				if (item) {
+					if (selected.has(item.value)) selected.delete(item.value);
+					else selected.add(item.value);
+				}
 				render();
 				return;
 			}
@@ -23679,10 +23964,11 @@ const hookRun = async (agent, flags) => {
 		process.exit(0);
 	}
 	let exitCode = 0;
-	if (agent === "claude") if (flags?.onFileChanged) exitCode = await runClaudeFileChangedHook();
-	else if (flags?.stop) exitCode = await runClaudeStopHook();
-	else exitCode = await runClaudeHook();
-	else if (agent === "cursor") exitCode = await runCursorHook();
+	if (agent === "claude") {
+		if (flags?.onFileChanged) exitCode = await runClaudeFileChangedHook();
+		else if (flags?.stop) exitCode = await runClaudeStopHook();
+		else exitCode = await runClaudeHook();
+	} else if (agent === "cursor") exitCode = await runCursorHook();
 	else if (agent === "gemini") exitCode = await runGeminiHook();
 	else if (agent === "pi") exitCode = await runPiHook();
 	else {
@@ -23693,7 +23979,8 @@ const hookRun = async (agent, flags) => {
 	process.exit(exitCode);
 };
 const hookBaseline = async () => {
-	const result = await captureBaseline(process.cwd());
+	const cwd = process.cwd();
+	const result = await captureBaseline(cwd);
 	process.stdout.write(renderHookBaseline({
 		score: result.score,
 		fileCount: result.fileCount,
@@ -23924,7 +24211,7 @@ const registerHookAliases = (program) => {
 };
 //#endregion
 //#region src/utils/github-slug.ts
-const GITHUB_REMOTE_RE = /^(?:git@github\.com:|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/\s]+?)(?:\.git)?\s*$/;
+const GITHUB_REMOTE_RE = /^(?:(?:git@|ssh:\/\/(?:git@)?)github\.com(?::(?:\d+\/)?|[:/])|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/\s]+?)(?:\.git)?\s*$/;
 const parseGithubSlug = (remoteUrl) => {
 	const match = remoteUrl.trim().match(GITHUB_REMOTE_RE);
 	if (!match) return null;
@@ -24122,6 +24409,9 @@ const RULE_LABELS = {
 	"security/shell-injection": "Possible shell injection",
 	"security/unsafe-deserialization": "Unsafe deserialization",
 	"security/unsafe-c-call": "Memory-unsafe C call",
+	"security/prompt-injection": "Prompt injection (untrusted system prompt)",
+	"security/unsandboxed-agent-tool": "Unsandboxed agent code execution tool",
+	"security/invisible-unicode-tags": "Invisible Unicode tag character (stealth injection)",
 	"dotnet/projects-skipped": "C# projects skipped by build-backed lint",
 	"cppcheck/chunks-skipped": "C/C++ files skipped by cppcheck",
 	"eslint/no-undef": "Undefined identifier",
@@ -24210,6 +24500,9 @@ const RULE_DESCRIPTIONS = {
 	"security/shell-injection": "Shell command is built from unsanitized input.",
 	"security/unsafe-deserialization": "Legacy .NET formatter can deserialize arbitrary types (RCE).",
 	"security/unsafe-c-call": "Unbounded C string/exec function with buffer-overflow or shell risk.",
+	"security/prompt-injection": "Untrusted dynamic variable interpolation into system or developer prompt.",
+	"security/unsandboxed-agent-tool": "Agent executes code or commands on host without container or interactive gate.",
+	"security/invisible-unicode-tags": "Invisible Unicode Tag block (U+E0000-U+E007F) used for prompt injection or ASCII smuggling.",
 	"dotnet/projects-skipped": "Build-backed C# lint only ran on restored projects; the rest were skipped.",
 	"cppcheck/chunks-skipped": "A cppcheck invocation timed out or failed on one or more chunks; their files were not analyzed.",
 	"oxlint/*": "JavaScript/TypeScript lint finding from oxlint.",
@@ -24404,7 +24697,8 @@ const BUILTIN_RULES = [
 			"typescript/*",
 			"dotnet/*",
 			"cppcheck/*",
-			"clang-tidy/*"
+			"clang-tidy/*",
+			"expo-doctor/*"
 		]
 	},
 	{
@@ -24503,7 +24797,10 @@ const BUILTIN_RULES = [
 			"security/shell-injection",
 			"security/unsafe-deserialization",
 			"security/unsafe-c-call",
-			"security/dependency-audit-skipped"
+			"security/dependency-audit-skipped",
+			"security/prompt-injection",
+			"security/unsandboxed-agent-tool",
+			"security/invisible-unicode-tags"
 		]
 	}
 ];
@@ -24513,7 +24810,8 @@ const collectRuleEntries = (directory) => {
 	for (const { engine, rules } of BUILTIN_RULES) for (const rule of rules) entries.push(toRuleEntry(engine, rule));
 	const configDir = findConfigDir(resolvedDir);
 	if (configDir) {
-		const archRules = loadArchitectureRules(path.join(configDir, RULES_FILE));
+		const rulesPath = path.join(configDir, RULES_FILE);
+		const archRules = loadArchitectureRules(rulesPath);
 		for (const rule of archRules) entries.push({
 			id: `arch/${rule.name}`,
 			engine: "architecture",
@@ -24570,6 +24868,8 @@ const resolveHistoryDir = (directory) => {
 	const resolved = path.resolve(directory);
 	const primary = path.join(resolved, CONFIG_DIR);
 	if (fs.existsSync(primary)) return primary;
+	const legacy = path.join(resolved, ".aislop");
+	if (fs.existsSync(legacy)) return legacy;
 	return null;
 };
 const historyPath = (directory) => {
@@ -24709,7 +25009,7 @@ const trendCommand = async (directory, limit) => {
 //#endregion
 //#region src/update-notifier.ts
 const REGISTRY_URL = "https://registry.npmjs.org/@methiu/raigal/latest";
-const CHECK_INTERVAL_MS = 1440 * 60 * 1e3;
+const CHECK_INTERVAL_MS = 864e5;
 const REQUEST_TIMEOUT_MS = 2e3;
 const CACHE_BASENAME = "update_check.json";
 const isUpdateNotifierDisabled = (env = process.env) => {
@@ -24782,7 +25082,7 @@ const maybeNotifyUpdate = async (now = Date.now()) => {
 	if (!process.stderr.isTTY) return;
 	const cachePath = resolveUpdateCachePath();
 	const cache = readCache(cachePath);
-	if (cache && isOutdated("0.2.2", cache.latest)) process.stderr.write(formatUpdateNotice(APP_VERSION, cache.latest));
+	if (cache && isOutdated("0.2.3", cache.latest)) process.stderr.write(formatUpdateNotice(APP_VERSION, cache.latest));
 	if (!cache || now - cache.checkedAt > CHECK_INTERVAL_MS) {
 		const latest = await fetchLatestVersion$1();
 		if (latest) writeCache(cachePath, {
@@ -25302,7 +25602,7 @@ const renderCommandGroup = (group, commandWidth) => {
 	return lines;
 };
 const renderCommandReference = (input = {}) => {
-	const version = input.version ?? "0.2.2";
+	const version = input.version ?? "0.2.3";
 	const commandWidth = Math.max(...COMMAND_REFERENCE.map((item) => item.command.length));
 	const lines = [renderHeader({
 		version,
@@ -25524,8 +25824,9 @@ const renderHelpDetails = () => [
 	""
 ].map((line) => highlightRaigal(line, theme)).join("\n");
 const renderHome = (input = {}) => {
+	const version = input.version ?? "0.2.3";
 	let out = renderHeader({
-		version: input.version ?? "0.2.2",
+		version,
 		command: "--bare",
 		context: []
 	});
@@ -25585,10 +25886,10 @@ const registerExtraCommands = (program) => {
 			return { exitCode: 0 };
 		});
 	});
-	program.command("update").alias("upgrade").description("Check npm for the latest aislop version").action(async () => {
+	program.command("update").alias("upgrade").description("Check npm for the latest raigal version").action(async () => {
 		await updateCommand();
 	});
-	program.command("version").description("Print the installed aislop version").action(() => {
+	program.command("version").description("Print the installed raigal version").action(() => {
 		process.stdout.write(`${APP_VERSION}\n`);
 	});
 	program.command("commands").description("List all commands and major flags").action(() => {
@@ -25776,7 +26077,8 @@ const saveCachedPolicy = (repoSlug, policy) => {
 };
 const fetchRemotePolicy = async (repoSlug, token) => {
 	try {
-		const data = await requestApi(`/v1/policy?repo=${encodeURIComponent(repoSlug.toLowerCase())}`, {
+		const endpoint = `/v1/policy?repo=${encodeURIComponent(repoSlug.toLowerCase())}`;
+		const data = await requestApi(endpoint, {
 			method: "GET",
 			token,
 			timeoutMs: 4e3
@@ -26181,7 +26483,7 @@ const printEngineStatus = (result) => {
 };
 //#endregion
 //#region src/utils/git.ts
-const MAX_BUFFER = 50 * 1024 * 1024;
+const MAX_BUFFER = 52428800;
 const baseRefExists = (cwd, ref) => {
 	const result = spawnSync("git", [
 		"rev-parse",
@@ -26704,7 +27006,8 @@ const renderActionRows = (steps, t) => {
 const renderTextSteps = (steps, t, s) => {
 	return steps.filter((step) => step.text).map((step) => {
 		const glyph = step.emphasis === "primary" ? s.hint : s.bullet;
-		return ` ${style$1(t, step.emphasis === "primary" ? "accent" : "muted", glyph)} ${highlightAislop(step.text ?? "", t)}`;
+		const tokenFor = step.emphasis === "primary" ? "accent" : "muted";
+		return ` ${style$1(t, tokenFor, glyph)} ${highlightAislop(step.text ?? "", t)}`;
 	});
 };
 const renderSummary = (input, deps = {}) => {
@@ -26761,10 +27064,14 @@ const renderSummary = (input, deps = {}) => {
 	return lines.join("\n");
 };
 const renderStarCta = (deps = {}) => {
-	return `\n ${style$1(deps.theme ?? theme, "muted", `★ Found this useful? Consider purchasing this software at ${terminalLink("https://raigal.dev")}`)}\n`;
+	const t = deps.theme ?? theme;
+	const repository = terminalLink("https://raigal.dev");
+	return `\n ${style$1(t, "muted", `★ Found this useful? Consider purchasing this software at ${repository}`)}\n`;
 };
 const renderTeamCta = (deps = {}) => {
-	return `\n ${style$1(deps.theme ?? theme, "muted", `→ Using raigal with a team? Get a 14-day team baseline at ${terminalLink("https://raigal.dev/contact?intent=team-baseline")}`)}\n`;
+	const t = deps.theme ?? theme;
+	const href = terminalLink("https://raigal.dev/contact?intent=team-baseline");
+	return `\n ${style$1(t, "muted", `→ Using raigal with a team? Get a 14-day team baseline at ${href}`)}\n`;
 };
 const renderCleanRun = (input, deps = {}) => {
 	const t = deps.theme ?? theme;
@@ -26998,7 +27305,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		architectureRulesPath: config.engines.architecture ? rulesPath : void 0,
 		engines: config.engines
 	};
-	const { results: unannotated, suppressedCount } = applySuppressions((await runEnginesWithProgress({
+	const severityAdjusted = (await runEnginesWithProgress({
 		rootDirectory: resolvedDir,
 		languages: projectInfo.languages,
 		frameworks: projectInfo.frameworks,
@@ -27014,7 +27321,8 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 	}, config.engines, machineOutput)).map((result) => ({
 		...result,
 		diagnostics: config.overrides.length ? result.diagnostics : applyRuleSeverities(result.diagnostics, config.rules)
-	})), resolvedDir);
+	}));
+	const { results: unannotated, suppressedCount } = applySuppressions(severityAdjusted, resolvedDir);
 	if (suppressedCount > 0 && !machineOutput) log.muted(`Suppressed ${suppressedCount} finding(s) via raigal-ignore directives`);
 	const changeMap = options.changes && !options.staged ? getChangedLineMap(resolvedDir, options.base) : null;
 	const results = changeMap ? unannotated.map((result) => ({
@@ -27075,7 +27383,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		scoreFileCount
 	});
 	if (options.sarif) {
-		const { buildSarifLog } = await import("./sarif--DI_2p2r.js");
+		const { buildSarifLog } = await import("./sarif-CdtsAfJ1.js");
 		console.log(JSON.stringify(buildSarifLog(results), null, 2));
 		return completion;
 	}
@@ -27725,7 +28033,8 @@ const groupByFile = (diagnostics) => {
 	});
 };
 const isInstalled = (bin) => {
-	return spawnSync(process.platform === "win32" ? "where" : "which", [bin], { encoding: "utf-8" }).status === 0;
+	const cmd = process.platform === "win32" ? "where" : "which";
+	return spawnSync(cmd, [bin], { encoding: "utf-8" }).status === 0;
 };
 const copyToClipboard = (text) => {
 	const args = {
@@ -28201,7 +28510,8 @@ const fixNarrativeComments = async (context) => {
 		for (let i = 0; i < lines.length; i += 1) if (!toRemove.has(i + 1)) kept.push(lines[i]);
 		const newContent = kept.join("\n");
 		if (newContent !== content) {
-			if (!areLiteralMultisetsEqual(beforeLiterals, extractStringAndTemplateLiterals(newContent, ext))) continue;
+			const afterLiterals = extractStringAndTemplateLiterals(newContent, ext);
+			if (!areLiteralMultisetsEqual(beforeLiterals, afterLiterals)) continue;
 			fs.writeFileSync(filePath, newContent);
 		}
 	}
@@ -28571,7 +28881,7 @@ const detectUnusedDeclarations = async (context) => {
 			rule: "code-quality/unused-declaration",
 			severity: "warning",
 			message: `Unused ${extracted.kind}: ${extracted.name}`,
-			help: "This top-level declaration is never used; aislop will remove it.",
+			help: "This top-level declaration is never used; raigal will remove it.",
 			line: d.line,
 			column: d.column,
 			category: "Dead Code",
@@ -28589,7 +28899,7 @@ const detectUnusedDeclarations = async (context) => {
 			rule: "code-quality/unused-declaration",
 			severity: "warning",
 			message: `Unused ${kind}: ${name}`,
-			help: "This top-level declaration is never imported; aislop will remove it.",
+			help: "This top-level declaration is never imported; raigal will remove it.",
 			line: d.line,
 			column: d.column,
 			category: "Dead Code",
@@ -28695,7 +29005,7 @@ const removeUnusedDeclarations = (rootDirectory, declarations) => {
 };
 //#endregion
 //#region src/commands/fix-expo.ts
-const INSTALL_TIMEOUT$1 = 1800 * 1e3;
+const INSTALL_TIMEOUT$1 = 18e5;
 const fixExpoDependencies = async (context, onProgress) => {
 	await removeDisallowedExpoPackages(context.rootDirectory, onProgress);
 	onProgress?.("Expo dependency alignment · running expo install --fix (can take a few minutes)");
@@ -28749,8 +29059,8 @@ const removeDisallowedExpoPackages = async (rootDir, onProgress) => {
 };
 //#endregion
 //#region src/commands/fix-force.ts
-const INSTALL_TIMEOUT = 1800 * 1e3;
-const AUDIT_TIMEOUT = 60 * 1e3;
+const INSTALL_TIMEOUT = 18e5;
+const AUDIT_TIMEOUT = 6e4;
 const detectPackageManager = (rootDirectory) => {
 	if (fs.existsSync(path.join(rootDirectory, "pnpm-lock.yaml"))) return "pnpm";
 	if (fs.existsSync(path.join(rootDirectory, "package-lock.json")) || fs.existsSync(path.join(rootDirectory, "package.json"))) return "npm";
@@ -29048,13 +29358,14 @@ const CANNOT_SCOPE_REASON = "cannot honour an explicit file list under --changes
 const MISSING_MANIFEST_REASON = "no manifest or lockfile in the selected scope";
 const fixScopeError = (resolvedDir, flags) => {
 	if (flags.changes && flags.staged) return "--changes and --staged cannot be used together.";
-	return scanTargetError(resolvedDir, {
+	const options = {
 		changes: Boolean(flags.changes),
 		staged: Boolean(flags.staged),
 		base: flags.base,
 		verbose: false,
 		json: false
-	});
+	};
+	return scanTargetError(resolvedDir, options);
 };
 const collectFixFileScope = (rootDirectory, excludePatterns, includePatterns, flags) => {
 	const mode = resolveScanScopeMode({
@@ -29113,9 +29424,10 @@ const runFormattingStep = async (deps) => {
 	else if (deps.projectInfo.languages.includes("python")) log.warn("Python detected but ruff is not installed; skipping Python formatting fixes.");
 	if (deps.projectInfo.languages.includes("go") && deps.projectInfo.installedTools.gofmt) await deps.runStep("Formatting (go)", () => runGofmt(deps.context), () => fixGofmt(deps.context));
 	else if (deps.projectInfo.languages.includes("go")) log.warn("Go detected but gofmt is not installed; skipping Go formatting fixes.");
-	if (deps.projectInfo.languages.includes("rust") && deps.projectInfo.installedTools.rustfmt) if (isScopedFix(deps.context)) deps.skipStep?.("Formatting (rust)", CANNOT_SCOPE_REASON);
-	else await deps.runStep("Formatting (rust)", () => runGenericFormatter(deps.context, "rust"), () => fixGenericFormatter(deps.context, "rust"));
-	else if (deps.projectInfo.languages.includes("rust")) log.warn("Rust detected but rustfmt is not installed; skipping Rust formatting fixes.");
+	if (deps.projectInfo.languages.includes("rust") && deps.projectInfo.installedTools.rustfmt) {
+		if (isScopedFix(deps.context)) deps.skipStep?.("Formatting (rust)", CANNOT_SCOPE_REASON);
+		else await deps.runStep("Formatting (rust)", () => runGenericFormatter(deps.context, "rust"), () => fixGenericFormatter(deps.context, "rust"));
+	} else if (deps.projectInfo.languages.includes("rust")) log.warn("Rust detected but rustfmt is not installed; skipping Rust formatting fixes.");
 	if (deps.projectInfo.languages.includes("ruby") && deps.projectInfo.installedTools.rubocop) {
 		if (!skipUnsafeSafeFormatter(deps, "ruby")) await deps.runStep("Formatting (ruby)", () => runGenericFormatter(deps.context, "ruby"), () => fixGenericFormatter(deps.context, "ruby"));
 	} else if (deps.projectInfo.languages.includes("ruby")) log.warn("Ruby detected but rubocop is not installed; skipping Ruby formatting fixes.");
@@ -29164,7 +29476,8 @@ const runDeclarationStep = async (deps) => {
 	if (!deps.config.engines["code-quality"]) return;
 	if (!hasJsOrTs(deps.projectInfo)) return;
 	await deps.runStep("Unused declarations", () => detectUnusedDeclarations(deps.context), async () => {
-		const declarations = diagnosticsToDeclarations(await detectUnusedDeclarations(deps.context));
+		const diagnostics = await detectUnusedDeclarations(deps.context);
+		const declarations = diagnosticsToDeclarations(diagnostics);
 		removeUnusedDeclarations(deps.resolvedDir, declarations);
 	});
 };
@@ -29195,10 +29508,14 @@ const runForceSteps = async (deps) => {
 		return (await runKnipUnusedFiles(deps.resolvedDir)).filter((diagnostic) => isPathInFixScope(deps.context, diagnostic.filePath));
 	}, () => fixUnusedFiles(deps.resolvedDir, (filePath) => isPathInFixScope(deps.context, filePath)));
 	const railUpdate = (label) => deps.rail.setActiveLabel(label);
-	if (deps.config.engines.security) if (!scopeIncludesManifestWrites(deps.context)) deps.skipStep?.("Dependency audit fixes", MISSING_MANIFEST_REASON);
-	else await deps.runStep("Dependency audit fixes", () => runDependencyAudit(deps.context), () => fixDependencyAudit(deps.context, railUpdate));
-	if (deps.projectInfo.frameworks.includes("expo") && deps.config.lint.expoDoctor) if (!scopeIncludesManifestWrites(deps.context)) deps.skipStep?.("Expo dependency alignment", MISSING_MANIFEST_REASON);
-	else await deps.runStep("Expo dependency alignment", () => runExpoDoctor(deps.context), () => fixExpoDependencies(deps.context, railUpdate));
+	if (deps.config.engines.security) {
+		if (!scopeIncludesManifestWrites(deps.context)) deps.skipStep?.("Dependency audit fixes", MISSING_MANIFEST_REASON);
+		else await deps.runStep("Dependency audit fixes", () => runDependencyAudit(deps.context), () => fixDependencyAudit(deps.context, railUpdate));
+	}
+	if (deps.projectInfo.frameworks.includes("expo") && deps.config.lint.expoDoctor) {
+		if (!scopeIncludesManifestWrites(deps.context)) deps.skipStep?.("Expo dependency alignment", MISSING_MANIFEST_REASON);
+		else await deps.runStep("Expo dependency alignment", () => runExpoDoctor(deps.context), () => fixExpoDependencies(deps.context, railUpdate));
+	}
 };
 //#endregion
 //#region src/commands/fix-plan.ts
@@ -29494,7 +29811,8 @@ const runFixBody = async (resolvedDir, config, options, projectInfo) => {
 		brand: options.printBrand !== false
 	}));
 	const safe = Boolean(options.safe);
-	const scope = collectFixFileScope(resolvedDir, [...config.exclude, ...readAislopIgnorePatterns(resolvedDir)], config.include, options);
+	const excludePatterns = [...config.exclude, ...readAislopIgnorePatterns(resolvedDir)];
+	const scope = collectFixFileScope(resolvedDir, excludePatterns, config.include, options);
 	const scopedProjectInfo = scope ? {
 		...projectInfo,
 		languages: detectSourceLanguages([...scope.files, ...scope.testFiles])
@@ -29713,7 +30031,7 @@ const promptForConfigChoices = async () => {
 		initialValues: DEFAULT_ENGINE_SELECTION,
 		required: false
 	}));
-	if (enginesSelection === void 0) return null;
+	if (enginesSelection === void 0 || isCancel(enginesSelection)) return null;
 	const failBelowRaw = await text({
 		message: "CI quality gate — fail the build when the score drops below (0-100)",
 		initialValue: "70",
@@ -29844,16 +30162,18 @@ const initCommand = async (directory, options = {}) => {
 		status: "done",
 		label: `Wrote ${CONFIG_DIR}/${CONFIG_FILE}`
 	}];
-	if (choices.engines.includes("architecture")) if (!fs.existsSync(rulesPath)) {
-		fs.writeFileSync(rulesPath, DEFAULT_RULES_YAML);
-		steps.push({
-			status: "done",
-			label: `Wrote ${CONFIG_DIR}/${RULES_FILE}`
+	if (choices.engines.includes("architecture")) {
+		if (!fs.existsSync(rulesPath)) {
+			fs.writeFileSync(rulesPath, DEFAULT_RULES_YAML);
+			steps.push({
+				status: "done",
+				label: `Wrote ${CONFIG_DIR}/${RULES_FILE}`
+			});
+		} else steps.push({
+			status: "skipped",
+			label: `${CONFIG_DIR}/${RULES_FILE} already exists`
 		});
-	} else steps.push({
-		status: "skipped",
-		label: `${CONFIG_DIR}/${RULES_FILE} already exists`
-	});
+	}
 	const workflowResult = writeGithubWorkflow(resolvedDir, choices.writeGithubWorkflow);
 	if (workflowResult.status === "written") steps.push({
 		status: "done",
@@ -30245,11 +30565,13 @@ program.hook("preAction", (_thisCommand, actionCommand) => {
 		"hook"
 	].includes(cmdName)) {
 		const flagNames = process.argv.slice(2).filter((arg) => arg.startsWith("-")).map((arg) => arg.replace(/^--?/, "").split("=")[0] ?? "");
-		startRunRecorder(cmdName, actionCommand.args?.[0] || process.cwd(), flagNames);
+		const dir = actionCommand.args?.[0] || process.cwd();
+		startRunRecorder(cmdName, dir, flagNames);
 	}
 });
 program.hook("postAction", async () => {
-	await finishActiveRecorder(typeof process.exitCode === "number" ? process.exitCode : 0);
+	const code = typeof process.exitCode === "number" ? process.exitCode : 0;
+	await finishActiveRecorder(code);
 });
 const main = async () => {
 	fireInstalledOnce();