@methiu/raigal 0.2.2 → 0.2.4

package/dist/{json-DBoMe4xB.js → json-BBZKvm0E.js}

@@ -1,5 +1,5 @@
-import { t as APP_VERSION } from "./version-9Cnt1TiK.js";
-import { i as ENGINE_INFO, n as withFindingAssessments, t as summarizeFindingAssessments } from "./finding-assessment-M5fUTE-C.js";
+import { t as APP_VERSION } from "./version-CukuIVX4.js";
+import { i as ENGINE_INFO, n as withFindingAssessments, t as summarizeFindingAssessments } from "./finding-assessment-CGpt5YUR.js";
 //#region src/output/json.ts
 const buildJsonOutput = (results, scoreResult, fileCount, elapsedMs, coverage) => {
 	const allDiagnostics = results.flatMap((r) => r.diagnostics);

package/dist/mcp.js

@@ -84,7 +84,7 @@ const getActiveToken = () => {
 };
 //#endregion
 //#region src/version.ts
-const APP_VERSION = "0.2.2";
+const APP_VERSION = "0.2.4";
 //#endregion
 //#region src/cloud/contract.ts
 const Severity = z.enum(["error", "warning"]);
@@ -359,7 +359,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const claims = parsed.data;
 	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
 	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.2.2", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (!isVersionAtLeast("0.2.4", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -532,7 +532,7 @@ const getEntitlement = async () => {
 };
 //#endregion
 //#region src/cloud/owner.ts
-const GITHUB_REMOTE_RE = /^(?:(?:git@|ssh:\/\/(?:git@)?)github\.com(?::(?:\d+\/)?|[:/])|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/.\s]+?)(?:\.git)?\s*$/;
+const GITHUB_REMOTE_RE = /^(?:(?:git@|ssh:\/\/(?:git@)?)github\.com(?::(?:\d+\/)?|[:/])|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/\s]+?)(?:\.git)?\s*$/;
 const parseGitRemote = (rawUrl) => {
 	if (!rawUrl) return {
 		owner: null,
@@ -994,6 +994,9 @@ const CiSchema = z.object({
 	format: z.enum(["json"]).default("json")
 }).strict();
 const TelemetrySchema = z.object({ enabled: z.boolean().default(true) }).strict();
+const BaselineConfigSchema = z.object({ mode: z.enum(["strict", "relaxed"]).default("relaxed") }).strict();
+const LicensingConfigSchema = z.object({ onLapse: z.enum(["fail-open", "fail-closed"]).default("fail-open") }).strict();
+const WorkspaceConfigSchema = z.object({ minimumFloor: z.number().min(0).max(100).default(50) }).strict();
 const RuleSeverityOverride = z.enum([
 	"error",
 	"warning",
@@ -1064,6 +1067,9 @@ const AislopConfigSchema = z.object({
 		format: "json"
 	})),
 	telemetry: TelemetrySchema.default(() => ({ enabled: true })),
+	baseline: BaselineConfigSchema.optional(),
+	licensing: LicensingConfigSchema.optional(),
+	workspace: WorkspaceConfigSchema.optional(),
 	rules: RulesSchema,
 	overrides: z.array(FileOverrideSchema).default(() => []),
 	exclude: z.array(z.string()).default(() => [
@@ -1097,6 +1103,9 @@ const KNOWN_KEYS_BY_PATH = {
 		"scoring",
 		"ci",
 		"telemetry",
+		"baseline",
+		"licensing",
+		"workspace",
 		"rules",
 		"exclude",
 		"include"
@@ -1147,7 +1156,10 @@ const KNOWN_KEYS_BY_PATH = {
 	],
 	"scoring.thresholds": ["good", "ok"],
 	ci: ["failBelow", "format"],
-	telemetry: ["enabled"]
+	telemetry: ["enabled"],
+	baseline: ["mode"],
+	licensing: ["onLapse"],
+	workspace: ["minimumFloor"]
 };
 const levenshtein = (a, b) => {
 	const m = a.length;
@@ -2567,7 +2579,7 @@ const tokenizeJs = (content, ext = ".ts") => {
 };
 //#endregion
 //#region src/utils/source-masker.ts
-const JS_EXTS$2 = /* @__PURE__ */ new Set([
+const JS_EXTS$3 = /* @__PURE__ */ new Set([
 	".ts",
 	".tsx",
 	".js",
@@ -2575,7 +2587,7 @@ const JS_EXTS$2 = /* @__PURE__ */ new Set([
 	".mjs",
 	".cjs"
 ]);
-const PY_EXTS = /* @__PURE__ */ new Set([".py"]);
+const PY_EXTS$1 = /* @__PURE__ */ new Set([".py"]);
 const RB_EXTS = /* @__PURE__ */ new Set([".rb"]);
 const PHP_EXTS = /* @__PURE__ */ new Set([".php"]);
 const CSHARP_EXTS = /* @__PURE__ */ new Set([".cs"]);
@@ -2599,8 +2611,8 @@ const C_STYLE_COMMENT_EXTS = /* @__PURE__ */ new Set([
 	".zig"
 ]);
 const familyForExt = (ext) => {
-	if (JS_EXTS$2.has(ext)) return "js";
-	if (PY_EXTS.has(ext)) return "py";
+	if (JS_EXTS$3.has(ext)) return "js";
+	if (PY_EXTS$1.has(ext)) return "py";
 	if (RB_EXTS.has(ext)) return "rb";
 	if (PHP_EXTS.has(ext)) return "php";
 	if (CSHARP_EXTS.has(ext)) return "csharp";
@@ -2832,7 +2844,7 @@ const getCommentLines = (content, ext) => {
 };
 //#endregion
 //#region src/engines/ai-slop/abstractions.ts
-const JS_EXTS$1 = /* @__PURE__ */ new Set([
+const JS_EXTS$2 = /* @__PURE__ */ new Set([
 	".ts",
 	".tsx",
 	".js",
@@ -2843,11 +2855,11 @@ const JS_EXTS$1 = /* @__PURE__ */ new Set([
 const THIN_WRAPPER_PATTERNS = [
 	{
 		pattern: /(?:export\s+)?(?:async\s+)?function\s+(\w+)\s*\([^)]*\)\s*(?::\s*\w[^{]*)?\{\s*\n?\s*return\s+\w+\([^)]*\);\s*\n?\s*\}/g,
-		extensions: JS_EXTS$1
+		extensions: JS_EXTS$2
 	},
 	{
 		pattern: /(?:export\s+)?const\s+(\w+)\s*=\s*(?:async\s+)?\([^)]*\)\s*(?::\s*\w[^=]*)?\s*=>\s*\w+\([^)]*\);/g,
-		extensions: JS_EXTS$1
+		extensions: JS_EXTS$2
 	},
 	{
 		pattern: /def\s+(\w+)\s*\([^)]*\)(?:\s*->[^:]*)?:\s*\n\s+return\s+\w+\([^)]*\)\s*$/gm,
@@ -4095,7 +4107,7 @@ const scriptKindFor$1 = (ext) => {
 	}
 };
 const lineFor$1 = (sourceFile, node) => sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
-const makeDiagnostic = (filePath, line, rule, message, help) => ({
+const makeDiagnostic$1 = (filePath, line, rule, message, help) => ({
 	filePath,
 	engine: "ai-slop",
 	rule,
@@ -4145,7 +4157,7 @@ const detectRedundantTryCatch = (sourceFile, relativePath) => {
 		if (ts.isTryStatement(node) && node.catchClause && !node.finallyBlock) {
 			const catchNameNode = node.catchClause.variableDeclaration?.name;
 			const [onlyStatement] = node.catchClause.block.statements;
-			if (catchNameNode && ts.isIdentifier(catchNameNode) && node.catchClause.block.statements.length === 1 && onlyStatement && (isRethrowStatement(onlyStatement, catchNameNode.text) || isPromiseRejectRethrow(onlyStatement, catchNameNode.text))) diagnostics.push(makeDiagnostic(relativePath, lineFor$1(sourceFile, node.catchClause), "ai-slop/redundant-try-catch", "Catch block only rethrows the same error", "Remove the try/catch or add useful context, cleanup, or recovery. Rethrowing unchanged errors is usually defensive agent noise."));
+			if (catchNameNode && ts.isIdentifier(catchNameNode) && node.catchClause.block.statements.length === 1 && onlyStatement && (isRethrowStatement(onlyStatement, catchNameNode.text) || isPromiseRejectRethrow(onlyStatement, catchNameNode.text))) diagnostics.push(makeDiagnostic$1(relativePath, lineFor$1(sourceFile, node.catchClause), "ai-slop/redundant-try-catch", "Catch block only rethrows the same error", "Remove the try/catch or add useful context, cleanup, or recovery. Rethrowing unchanged errors is usually defensive agent noise."));
 		}
 		ts.forEachChild(node, visit);
 	};
@@ -4163,7 +4175,7 @@ const detectPrimitiveCoercions = (sourceFile, relativePath) => {
 				const [arg] = child.arguments;
 				if (arg && ts.isIdentifier(arg)) {
 					const primitive = params.get(arg.text);
-					if (primitive && child.expression.text === COERCION_CTORS[primitive]) diagnostics.push(makeDiagnostic(relativePath, lineFor$1(sourceFile, child), "ai-slop/redundant-type-coercion", `Parameter '${arg.text}' is already typed as ${primitive} but is coerced again`, "Trust the typed boundary or validate unknown input before this function. Re-coercing already typed parameters is usually defensive agent noise."));
+					if (primitive && child.expression.text === COERCION_CTORS[primitive]) diagnostics.push(makeDiagnostic$1(relativePath, lineFor$1(sourceFile, child), "ai-slop/redundant-type-coercion", `Parameter '${arg.text}' is already typed as ${primitive} but is coerced again`, "Trust the typed boundary or validate unknown input before this function. Re-coercing already typed parameters is usually defensive agent noise."));
 				}
 			}
 			ts.forEachChild(child, visitBody);
@@ -4206,7 +4218,7 @@ const detectDuplicateExportedTypes = (parsedSources) => {
 				continue;
 			}
 			if (previous.filePath === declaration.filePath) continue;
-			diagnostics.push(makeDiagnostic(declaration.filePath, declaration.line, "ai-slop/duplicate-type-declaration", `Exported type '${declaration.name}' duplicates an existing declaration`, `Reuse or import the existing type from ${previous.filePath} instead of re-declaring the same shape in another file.`));
+			diagnostics.push(makeDiagnostic$1(declaration.filePath, declaration.line, "ai-slop/duplicate-type-declaration", `Exported type '${declaration.name}' duplicates an existing declaration`, `Reuse or import the existing type from ${previous.filePath} instead of re-declaring the same shape in another file.`));
 		}
 	}
 	return diagnostics;
@@ -4308,7 +4320,7 @@ const detectDuplicateImports = async (context) => {
 					rule: "ai-slop/duplicate-import",
 					severity: "warning",
 					message: `"${spec}" is also imported on line ${firstLine}. Merge into a single import statement.`,
-					help: "Two imports from the same module split readers' attention and grow the import block. Run aislop fix to merge them automatically.",
+					help: "Two imports from the same module split readers' attention and grow the import block. Run raigal fix to merge them automatically.",
 					line: dup.line,
 					column: 1,
 					category: "AI Slop",
@@ -8148,7 +8160,7 @@ const detectRustPatterns = async (context) => {
 };
 //#endregion
 //#region src/engines/ai-slop/silent-recovery.ts
-const JS_EXTS = /* @__PURE__ */ new Set([
+const JS_EXTS$1 = /* @__PURE__ */ new Set([
 	".ts",
 	".tsx",
 	".js",
@@ -8343,7 +8355,7 @@ const detectSilentRecovery = async (context) => {
 	for (const filePath of files) {
 		if (isAutoGenerated(filePath)) continue;
 		const ext = path.extname(filePath);
-		const isJs = JS_EXTS.has(ext);
+		const isJs = JS_EXTS$1.has(ext);
 		if (!isJs && !(ext === ".py")) continue;
 		const relPath = relativePosix(context.rootDirectory, filePath);
 		if (isNonProductionPath(relPath)) continue;
@@ -8628,7 +8640,7 @@ const detectUnusedCss = async (context) => {
 				rule: "ai-slop/unused-css",
 				severity: "warning",
 				message: `CSS class '.${def.name}' is defined but never referenced in the codebase`,
-				help: "Remove the dead CSS rule, or confirm the class is used dynamically (and add an aislop-ignore comment if so)",
+				help: "Remove the dead CSS rule, or confirm the class is used dynamically (and add a raigal-ignore comment if so)",
 				line: def.line,
 				column: 0,
 				category: "AI Slop",
@@ -9718,8 +9730,8 @@ const isTrivialLine = (line) => {
 };
 const SVG_MARKUP_RE = /<\/?(?:svg|path|polyline|line|circle|rect|g)\b|(?:xmlns|viewBox|stroke(?:-width|-linecap|-linejoin)?|fill|fill-opacity|d|points|x1|x2|y1|y2)=/;
 const DATA_LITERAL_RE = /^\s*(?:[A-Za-z_$][\w$-]*:\s*(?:["'`[{]|\d|true\b|false\b|null\b)|["'`][^"'`]*["'`],?\s*$|[{}\]],?\s*$|\),?\s*$)/;
-const SUPPRESS_RE = /aislop[- ]ignore(?:-next-block|-file)?\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
-const FILE_SUPPRESS_RE = /aislop[- ]ignore-file\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
+const SUPPRESS_RE = /(?:raigal|aislop)[- ]ignore(?:-next-block|-file)?\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
+const FILE_SUPPRESS_RE = /(?:raigal|aislop)[- ]ignore-file\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
 const fileHasSuppression = (content) => FILE_SUPPRESS_RE.test(content);
 const isLowSignalMarkupWindow = (lines) => {
 	return lines.filter((line) => SVG_MARKUP_RE.test(line)).length >= Math.ceil(WINDOW_SIZE / 2);
@@ -10045,8 +10057,8 @@ const shouldIncludeIssue = (issueType, filePath) => {
 	return !filePath.replace(/\\/g, "/").includes(".github/workflows/");
 };
 const DEPENDENCY_HELP = {
-	dependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `aislop fix`.",
-	devDependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `aislop fix`.",
+	dependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `raigal fix`.",
+	devDependencies: "This package is listed in package.json but not imported anywhere. Remove it with `npm uninstall` or `raigal fix`.",
 	unlisted: "This package is imported in code but not declared in package.json. Run `npm install` to add it.",
 	unresolved: "This import cannot be resolved. Check for typos or missing packages.",
 	binaries: "This binary is used but its package is not in package.json."
@@ -10630,7 +10642,7 @@ const runClangFormat = async (context) => {
 };
 //#endregion
 //#region src/engines/format/dotnet-format.ts
-const REPORT_FILENAME = ".aislop-dotnet-format.json";
+const REPORT_FILENAME = ".raigal-dotnet-format.json";
 const parseDotnetFormatReport = (json, rootDirectory) => {
 	if (!json) return [];
 	let report;
@@ -10888,7 +10900,7 @@ const runGofmt = async (context) => {
 			rule: "go-formatting",
 			severity: "warning",
 			message: "Go file is not formatted correctly",
-			help: "Run `aislop fix` to auto-format with gofmt",
+			help: "Run `raigal fix` to auto-format with gofmt",
 			line: 0,
 			column: 0,
 			category: "Format",
@@ -10907,7 +10919,8 @@ const resolvePackageRoot = (startFile) => {
 	while (true) {
 		const packageJsonPath = path.join(current, "package.json");
 		if (fs.existsSync(packageJsonPath)) try {
-			if (JSON.parse(fs.readFileSync(packageJsonPath, "utf-8")).name === "aislop") return current;
+			const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+			if (packageJson.name === "aislop" || packageJson.name === "@methiu/raigal" || packageJson.name === "raigal") return current;
 		} catch {}
 		const parent = path.dirname(current);
 		if (parent === current) break;
@@ -11018,7 +11031,7 @@ const parseRuffFormatOutput = (output, rootDir) => {
 			rule: "python-formatting",
 			severity: "warning",
 			message: "Python file is not formatted correctly",
-			help: "Run `aislop fix` to auto-format with ruff",
+			help: "Run `raigal fix` to auto-format with ruff",
 			line: 0,
 			column: 0,
 			category: "Format",
@@ -11461,7 +11474,7 @@ const runExpoDoctor = async (context) => {
 		rule: "expo-doctor/config-error",
 		severity: "warning",
 		message: configError,
-		help: "Install project dependencies, then re-run `aislop scan`.",
+		help: "Install project dependencies, then re-run `raigal scan`.",
 		line: 0,
 		column: 0,
 		category: "Expo",
@@ -12568,6 +12581,174 @@ const lintEngine = {
 	}
 };
 //#endregion
+//#region src/engines/security/ai-security.ts
+const JS_EXTS = /* @__PURE__ */ new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mjs",
+	".cjs"
+]);
+const PY_EXTS = /* @__PURE__ */ new Set([".py"]);
+const UNICODE_TAG_RE = /[\u{E0000}-\u{E007F}]/gu;
+const hasRuleIgnore = (lines, lineIndex, ruleSuffix) => {
+	const start = Math.max(0, lineIndex - 2);
+	const re = new RegExp(`(?:raigal|aislop)[- ]ignore(?:-file)?\\b.*(?:${ruleSuffix}|security\\/${ruleSuffix})`, "i");
+	return lines.slice(start, lineIndex + 1).some((line) => re.test(line));
+};
+const hasFileIgnore = (lines, ruleSuffix) => {
+	const re = new RegExp(`(?:raigal|aislop)[- ]ignore-file\\b.*(?:${ruleSuffix}|security\\/${ruleSuffix})`, "i");
+	return lines.slice(0, 10).some((line) => re.test(line));
+};
+const makeDiagnostic = (filePath, rule, message, help, line, column) => ({
+	filePath,
+	engine: "security",
+	rule,
+	severity: "error",
+	message,
+	help,
+	line,
+	column,
+	category: "Security",
+	fixable: false
+});
+const P_BYPASS = "bypassPermissions";
+const P_EXEC_TYPE = "executor_type";
+const P_LOCAL = "local";
+const P_USE_DOCKER = "use_docker";
+const P_AUTO_RUN = "auto_run";
+const P_UNSAFE_MODE = "unsafe_mode";
+const P_PYTHON_REPL = "PythonREPLTool";
+const UNSANDBOXED_TOOL_PATTERNS = [
+	{
+		pattern: new RegExp(`\\bpermission_?mode["']?\\s*[:=]\\s*["']${P_BYPASS}["']`, "i"),
+		message: `permission_mode '${P_BYPASS}' bypasses agent sandboxing and human confirmation`,
+		help: `Do not use ${P_BYPASS} mode in production; use standard interactive approval`
+	},
+	{
+		pattern: new RegExp(`\\b${P_EXEC_TYPE}["']?\\s*[:=]\\s*["']${P_LOCAL}["']`, "i"),
+		message: `${P_EXEC_TYPE}='${P_LOCAL}' executes LLM-generated code directly on host machine without container isolation`,
+		help: "Configure agent to use DockerCommandLineCodeExecutor or a containerized sandbox environment"
+	},
+	{
+		pattern: new RegExp(`\\b(?:LocalCommandLineCodeExecutor|LocalCodeExecutor)\\s*\\(`),
+		message: "Local code executor executes LLM-generated code on host machine without container isolation",
+		help: "Use DockerCommandLineCodeExecutor or an isolated execution sandbox"
+	},
+	{
+		pattern: new RegExp(`\\b${P_USE_DOCKER}\\s*[:=]\\s*(?:False|false)\\b|["']${P_USE_DOCKER}["']\\s*:\\s*(?:False|false)\\b`),
+		message: `${P_USE_DOCKER}=False disables container sandboxing for agent code execution`,
+		help: `Set ${P_USE_DOCKER}=True to isolate agent execution inside Docker containers`
+	},
+	{
+		pattern: new RegExp(`\\b(?:interpreter\\.)?${P_AUTO_RUN}\\s*[:=]\\s*(?:True|true)\\b`),
+		message: `${P_AUTO_RUN}=True allows autonomous shell execution without human confirmation`,
+		help: `Keep ${P_AUTO_RUN}=False so dangerous commands require explicit human review`
+	},
+	{
+		pattern: new RegExp(`\\bCodeInterpreterTool\\s*\\([^)]*${P_UNSAFE_MODE}\\s*=\\s*(?:True|true)\\b|\\b${P_UNSAFE_MODE}\\s*[:=]\\s*(?:True|true)\\b`),
+		message: `${P_UNSAFE_MODE}=True allows code interpreter tool to execute without Docker isolation`,
+		help: `Disable ${P_UNSAFE_MODE} and isolate code execution in containerized environments`
+	},
+	{
+		pattern: new RegExp(`\\b(?:${P_PYTHON_REPL}|PythonAstREPLTool)\\s*\\(`),
+		message: `${P_PYTHON_REPL} executes arbitrary Python code in host process without container isolation`,
+		help: `Use containerized sandbox execution rather than unconfined ${P_PYTHON_REPL} in production`
+	}
+];
+const P_SYS = "system";
+const P_DEV = "developer";
+const P_SM = "SystemMessage";
+const PROMPT_INJECTION_JS_PATTERNS = [
+	new RegExp(`(?:role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?content\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`)`, "g"),
+	new RegExp(`(?:content\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`[^}{;]{0,120}?role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`(?:role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?content\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["']))`, "g"),
+	new RegExp(`(?:content\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["'])[^}{;]{0,120}?role\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`\\b(?:${P_SYS}|systemPrompt|system_prompt|system_instruction)\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\``, "g"),
+	new RegExp(`\\b(?:${P_SYS}|systemPrompt|system_prompt|system_instruction)\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["'])`, "g"),
+	new RegExp(`\\b(?:new\\s+)?${P_SM}\\s*\\(\\s*(?:\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`|["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_$]|[a-zA-Z_$][\\w$]*\\s*\\+\\s*["']|\\{\\s*content\\s*:\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`)`, "g"),
+	new RegExp(`\\[\\s*["']${P_SYS}["']\\s*,\\s*\`[^\`]*\\$\\{[^}]+\\}[^\`]*\`\\s*\\]`, "g")
+];
+const PROMPT_INJECTION_PY_PATTERNS = [
+	new RegExp(`(?:["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?["']content["']\\s*:\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["']))`, "g"),
+	new RegExp(`(?:["']content["']\\s*:\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])[^}{;]{0,120}?["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`(?:["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'][^}{;]{0,120}?["']content["']\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\())`, "g"),
+	new RegExp(`(?:["']content["']\\s*:\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\()[^}{;]{0,120}?["']role["']\\s*:\\s*["'](?:${P_SYS}|${P_DEV})["'])`, "g"),
+	new RegExp(`\\b(?:${P_SYS}|system_prompt|system_message|system_instruction)\\s*=\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])`, "g"),
+	new RegExp(`\\b(?:${P_SYS}|system_prompt|system_message|system_instruction)\\s*=\\s*(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\()`, "g"),
+	new RegExp(`\\b${P_SM}\\s*\\(\\s*(?:content\\s*=\\s*)?f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])`, "g"),
+	new RegExp(`\\b${P_SM}\\s*\\(\\s*(?:content\\s*=\\s*)?(?:["'][^"'\\n]*["']\\s*\\+\\s*[a-zA-Z_]|[a-zA-Z_]\\w*\\s*\\+\\s*["']|["'][^"'\\n]*["']\\.format\\()`, "g"),
+	new RegExp(`\\(\\s*["']${P_SYS}["']\\s*,\\s*f(?:"""[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?"""|\'\'\'[\\s\\S]*?\\{[^}]+\\}[\\s\\S]*?\'\'\'|["'][^"'\\n]*?\\{[^}]+\\}[^"'\\n]*?["'])\\s*\\)`, "g")
+];
+const checkInvisibleUnicode = (relPath, content, lines) => {
+	if (hasFileIgnore(lines, "invisible-unicode-tags")) return [];
+	const results = [];
+	const tagRegex = new RegExp(UNICODE_TAG_RE.source, UNICODE_TAG_RE.flags);
+	for (const match of content.matchAll(tagRegex)) {
+		const matchIndex = match.index ?? 0;
+		const line = content.slice(0, matchIndex).split("\n").length;
+		const col = matchIndex - content.lastIndexOf("\n", matchIndex - 1);
+		if (hasRuleIgnore(lines, line - 1, "invisible-unicode-tags")) continue;
+		results.push(makeDiagnostic(relPath, "security/invisible-unicode-tags", "Invisible Unicode Tag character (U+E0000-U+E007F) detected: potential stealth prompt injection or ASCII smuggling", "Remove invisible Unicode tag characters. Unicode Tag block (U+E0000-U+E007F) has no legitimate printable presentation in source code", line, col));
+	}
+	return results;
+};
+const checkUnsandboxedTools = (relPath, content, lines) => {
+	if (hasFileIgnore(lines, "unsandboxed-agent-tool")) return [];
+	const results = [];
+	for (const { pattern, message, help } of UNSANDBOXED_TOOL_PATTERNS) {
+		const regex = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`);
+		for (const match of content.matchAll(regex)) {
+			const matchIndex = match.index ?? 0;
+			const line = content.slice(0, matchIndex).split("\n").length;
+			const col = matchIndex - content.lastIndexOf("\n", matchIndex - 1);
+			if (hasRuleIgnore(lines, line - 1, "unsandboxed-agent-tool")) continue;
+			results.push(makeDiagnostic(relPath, "security/unsandboxed-agent-tool", message, help, line, col));
+		}
+	}
+	return results;
+};
+const checkPromptInjection = (relPath, content, lines, isJs) => {
+	if (hasFileIgnore(lines, "prompt-injection")) return [];
+	const results = [];
+	const patterns = isJs ? PROMPT_INJECTION_JS_PATTERNS : PROMPT_INJECTION_PY_PATTERNS;
+	for (const pattern of patterns) {
+		const regex = new RegExp(pattern.source, pattern.flags);
+		for (const match of content.matchAll(regex)) {
+			const matchIndex = match.index ?? 0;
+			const line = content.slice(0, matchIndex).split("\n").length;
+			const col = matchIndex - content.lastIndexOf("\n", matchIndex - 1);
+			if (hasRuleIgnore(lines, line - 1, "prompt-injection")) continue;
+			results.push(makeDiagnostic(relPath, "security/prompt-injection", "Untrusted variable interpolation into system prompt creates prompt injection vulnerability", "Keep system prompts static. Pass dynamic user inputs via user messages or input parameters with strict delimiters", line, col));
+		}
+	}
+	return results;
+};
+const scanAiSecurity = async (context) => {
+	const files = getSourceFiles(context);
+	const diagnostics = [];
+	for (const filePath of files) {
+		const ext = path.extname(filePath);
+		let content;
+		try {
+			content = fs.readFileSync(filePath, "utf-8");
+		} catch {
+			continue;
+		}
+		const relativePath = relativePosix(context.rootDirectory, filePath);
+		const lines = content.split("\n");
+		diagnostics.push(...checkInvisibleUnicode(relativePath, content, lines));
+		const isJs = JS_EXTS.has(ext);
+		const isPy = PY_EXTS.has(ext);
+		if (isJs || isPy) {
+			diagnostics.push(...checkUnsandboxedTools(relativePath, content, lines));
+			diagnostics.push(...checkPromptInjection(relativePath, content, lines, isJs));
+		}
+	}
+	return diagnostics;
+};
+//#endregion
 //#region src/ui/invocation.ts
 const detectInvocation = () => "raigal";
 //#endregion
@@ -12950,7 +13131,7 @@ const parseJsAudit = (output, source, manifest) => {
 			rule: "security/dependency-audit-skipped",
 			severity: "info",
 			message: `Dependency audit skipped (${source}): lockfile is missing`,
-			help: errorDetail ?? "Generate a lockfile, then re-run `aislop scan` for dependency vulnerability checks.",
+			help: errorDetail ?? "Generate a lockfile, then re-run `raigal scan` for dependency vulnerability checks.",
 			line: 0,
 			column: 0,
 			category: "Security",
@@ -13508,7 +13689,7 @@ const RISKY_PATTERNS = [
 //#region src/engines/security/risky.ts
 const hasDangerouslySetInnerHtmlIgnore = (lines, lineIndex) => {
 	const start = Math.max(0, lineIndex - 2);
-	return lines.slice(start, lineIndex + 1).some((line) => /(?:biome-ignore|eslint-disable|aislop-ignore).*(?:noDangerouslySetInnerHtml|dangerouslySetInnerHTML|dangerously-set-innerhtml)/i.test(line));
+	return lines.slice(start, lineIndex + 1).some((line) => /(?:biome-ignore|eslint-disable|raigal-ignore|aislop-ignore).*(?:noDangerouslySetInnerHtml|dangerouslySetInnerHTML|dangerously-set-innerhtml)/i.test(line));
 };
 const isStructuredDataScript = (content, matchIndex) => {
 	const before = content.slice(Math.max(0, matchIndex - 300), matchIndex);
@@ -13830,7 +14011,11 @@ const securityEngine = {
 	name: "security",
 	async run(context) {
 		const diagnostics = [];
-		const promises = [scanSecrets(context), detectRiskyConstructs(context)];
+		const promises = [
+			scanSecrets(context),
+			detectRiskyConstructs(context),
+			scanAiSecurity(context)
+		];
 		if (context.config.security.audit) promises.push(runDependencyAudit(context));
 		const results = await Promise.allSettled(promises);
 		for (const result of results) if (result.status === "fulfilled") diagnostics.push(...result.value);
@@ -14100,6 +14285,9 @@ const RULE_SCORE_IMPACTS = {
 	"security/shell-injection": strict("Interpolated shell commands can become command execution."),
 	"security/unsafe-deserialization": strict("Deserializing untrusted data with a legacy .NET formatter can become remote code execution."),
 	"security/unsafe-c-call": strict("Unbounded C string and process calls can become buffer overflows or command execution."),
+	"security/prompt-injection": strict("Dynamic user interpolation in system/developer prompts enables prompt injection attacks."),
+	"security/unsandboxed-agent-tool": strict("Unsandboxed agent code execution or tool permission bypass allows arbitrary host commands."),
+	"security/invisible-unicode-tags": strict("Invisible Unicode Tag characters (U+E0000-U+E007F) hide stealth prompt injection payloads."),
 	"security/dependency-audit-skipped": advisory("An unavailable audit is visibility loss, not evidence of a vulnerability."),
 	"dotnet/projects-skipped": advisory("Skipping unrestored C# projects is visibility loss, not evidence of a defect."),
 	"cppcheck/chunks-skipped": advisory("A skipped cppcheck chunk is visibility loss, not evidence that the skipped files have a defect."),
@@ -14481,18 +14669,25 @@ const hasExistingLiteralBackslashPath = (cwd, fingerprint) => {
 	}
 };
 const migrateMarkerlessFingerprint = (cwd, fingerprint) => hasExistingLiteralBackslashPath(cwd, fingerprint) ? fingerprint : normalizeLegacyFingerprint(fingerprint);
-const BASELINE_REL = path.join(".aislop", "baseline.json");
-const baselinePath = (cwd) => path.join(cwd, BASELINE_REL);
+const baselinePath = (cwd) => {
+	const raigalCandidate = path.join(cwd, ".raigal", "baseline.json");
+	if (fs.existsSync(raigalCandidate)) return raigalCandidate;
+	const raigalDir = path.join(cwd, ".raigal");
+	if (fs.existsSync(raigalDir)) return raigalCandidate;
+	const legacyCandidate = path.join(cwd, ".aislop", "baseline.json");
+	if (fs.existsSync(legacyCandidate)) return legacyCandidate;
+	return raigalCandidate;
+};
 const readBaseline = (cwd) => {
 	const raw = readIfExists(baselinePath(cwd));
 	if (!raw) return null;
 	try {
 		const parsed = JSON.parse(raw);
-		if (parsed.schema !== "aislop.baseline.v2" && parsed.schema !== "aislop.baseline.v1") return null;
+		if (parsed.schema !== "aislop.baseline.v2" && parsed.schema !== "aislop.baseline.v1" && parsed.schema !== "raigal.baseline.v2" && parsed.schema !== "raigal.baseline.v1") return null;
 		const findingFingerprints = parsed.findingFingerprints ?? [];
 		const needsWindowsMigration = parsed.pathFormat !== "posix";
 		return {
-			schema: "aislop.baseline.v2",
+			schema: "raigal.baseline.v2",
 			pathFormat: "posix",
 			updatedAt: parsed.updatedAt ?? "",
 			score: parsed.score ?? 0,
@@ -14688,12 +14883,11 @@ const runScan = async (cwd) => {
 		}
 	};
 };
-const aislopScanInputSchema = z$1.object({ path: z$1.string().optional().describe("Project directory to scan, confined to the MCP server's cwd. Defaults to that cwd.") });
-const aislopScanTool = {
+const raigalScanInputSchema = z$1.object({ path: z$1.string().optional().describe("Project directory to scan, confined to the MCP server's cwd. Defaults to that cwd.") });
+const raigalScanTool = {
 	name: "raigal_scan",
 	description: "Scan a project with Raigal. Runs the deterministic engines (format, lint, code-quality, ai-slop, security, architecture), returns a 0–100 score and the top findings. Use this before deciding whether the agent's recent changes are ready to ship.",
-	inputSchema: aislopScanInputSchema,
-	name: "aislop_scan"
+	inputSchema: raigalScanInputSchema
 };
 const handleRaigalScan = async (input) => {
 	const cwd = resolveCwd(input.path);
@@ -14708,7 +14902,7 @@ const handleRaigalScan = async (input) => {
 		...summary
 	};
 };
-const aislopFixInputSchema = z$1.object({
+const raigalFixInputSchema = z$1.object({
 	path: z$1.string().optional().describe("Project directory to fix, confined to the MCP server's cwd. Defaults to that cwd."),
 	force: z$1.boolean().optional().describe("Run aggressive fixes (dependency audit overrides, unused-file removal, framework alignment). Off by default; on means writes to package.json and may delete files.")
 });
@@ -14738,11 +14932,10 @@ const runRaigalFix = (cwd, force) => {
 		}));
 	});
 };
-const aislopFixTool = {
+const raigalFixTool = {
 	name: "raigal_fix",
 	description: "Apply mechanical fixes (formatting, unused imports, narrative comments, duplicate imports, etc.). Returns counts before/after so the agent can see how many issues remain. Use BEFORE handing off to the agent — saves tokens by clearing what the CLI handles deterministically.",
-	inputSchema: aislopFixInputSchema,
-	name: "aislop_fix"
+	inputSchema: raigalFixInputSchema
 };
 const handleRaigalFix = async (input) => {
 	const cwd = resolveCwd(input.path);
@@ -14764,12 +14957,11 @@ const handleRaigalFix = async (input) => {
 		elided: summary.elided
 	};
 };
-const aislopWhyInputSchema = z$1.object({ rule_id: z$1.string().describe("Full rule id (e.g. `ai-slop/narrative-comment`, `complexity/function-too-long`, `security/sql-injection`).") });
-const aislopWhyTool = {
+const raigalWhyInputSchema = z$1.object({ rule_id: z$1.string().describe("Full rule id (e.g. `ai-slop/narrative-comment`, `complexity/function-too-long`, `security/sql-injection`).") });
+const raigalWhyTool = {
 	name: "raigal_why",
 	description: "Explain a Raigal rule: what it catches, why an AI agent typically produces it, severity, and whether it's auto-fixable. Use when a finding's message alone isn't enough to act on.",
-	inputSchema: aislopWhyInputSchema,
-	name: "aislop_why"
+	inputSchema: raigalWhyInputSchema
 };
 const handleRaigalWhy = (input) => {
 	const ruleId = input.rule_id.trim();
@@ -14782,12 +14974,11 @@ const handleRaigalWhy = (input) => {
 		hint: "Run `raigal rules` for the full list of rules and their auto-fix status. The /patterns page has bad/good code examples for every named ai-slop pattern."
 	};
 };
-const aislopBaselineInputSchema = z$1.object({ path: z$1.string().optional().describe("Project directory, confined to the MCP server's cwd. Defaults to that cwd.") });
-const aislopBaselineTool = {
+const raigalBaselineInputSchema = z$1.object({ path: z$1.string().optional().describe("Project directory, confined to the MCP server's cwd. Defaults to that cwd.") });
+const raigalBaselineTool = {
 	name: "raigal_baseline",
 	description: "Read the project's baseline (the last captured score the per-edit hook compares against). Returns score / lastScanAt / fileCount, or null if no baseline exists yet (run `raigal hook baseline` to capture).",
-	inputSchema: aislopBaselineInputSchema,
-	name: "aislop_baseline"
+	inputSchema: raigalBaselineInputSchema
 };
 const handleRaigalBaseline = (input) => {
 	const baseline = readBaseline(resolveCwd(input.path));
@@ -15164,37 +15355,21 @@ const buildServer = () => {
 		name: "raigal",
 		version: APP_VERSION
 	});
-	server.registerTool(aislopScanTool.name, {
-		description: aislopScanTool.description,
-		inputSchema: aislopScanInputSchema.shape
-	}, (input) => instrument("aislop_scan", () => handleRaigalScan(input)));
-	server.registerTool(aislopFixTool.name, {
-		description: aislopFixTool.description,
-		inputSchema: aislopFixInputSchema.shape
-	}, (input) => instrument("aislop_fix", () => handleRaigalFix(input)));
-	server.registerTool(aislopWhyTool.name, {
-		description: aislopWhyTool.description,
-		inputSchema: aislopWhyInputSchema.shape
-	}, (input) => instrument("aislop_why", () => handleRaigalWhy(input)));
-	server.registerTool(aislopBaselineTool.name, {
-		description: aislopBaselineTool.description,
-		inputSchema: aislopBaselineInputSchema.shape
-	}, (input) => instrument("aislop_baseline", () => handleRaigalBaseline(input)));
-	server.registerTool("raigal_scan", {
-		description: aislopScanTool.description,
-		inputSchema: aislopScanInputSchema.shape
+	server.registerTool(raigalScanTool.name, {
+		description: raigalScanTool.description,
+		inputSchema: raigalScanInputSchema.shape
 	}, (input) => instrument("raigal_scan", () => handleRaigalScan(input)));
-	server.registerTool("raigal_fix", {
-		description: aislopFixTool.description,
-		inputSchema: aislopFixInputSchema.shape
+	server.registerTool(raigalFixTool.name, {
+		description: raigalFixTool.description,
+		inputSchema: raigalFixInputSchema.shape
 	}, (input) => instrument("raigal_fix", () => handleRaigalFix(input)));
-	server.registerTool("raigal_why", {
-		description: aislopWhyTool.description,
-		inputSchema: aislopWhyInputSchema.shape
+	server.registerTool(raigalWhyTool.name, {
+		description: raigalWhyTool.description,
+		inputSchema: raigalWhyInputSchema.shape
 	}, (input) => instrument("raigal_why", () => handleRaigalWhy(input)));
-	server.registerTool("raigal_baseline", {
-		description: aislopBaselineTool.description,
-		inputSchema: aislopBaselineInputSchema.shape
+	server.registerTool(raigalBaselineTool.name, {
+		description: raigalBaselineTool.description,
+		inputSchema: raigalBaselineInputSchema.shape
 	}, (input) => instrument("raigal_baseline", () => handleRaigalBaseline(input)));
 	return server;
 };

package/dist/{sarif--DI_2p2r.js → sarif-CdtsAfJ1.js}

@@ -53,7 +53,7 @@ const buildSarifLog = (results) => {
 		version: SARIF_VERSION,
 		runs: [{
 			tool: { driver: {
-				name: "aislop",
+				name: "raigal",
 				version: APP_VERSION,
 				informationUri: "https://github.com/meethiu/raigal",
 				rules