@methiu/raigal 0.2.3 → 0.2.5

package/dist/index.js

@@ -1,4 +1,4 @@
-import { t as APP_VERSION } from "./version-B4eYJn3o.js";
+import { t as APP_VERSION } from "./version-BlgPglaO.js";
 import { a as getEngineLabel, i as ENGINE_INFO, r as scoreImpactForRule, t as summarizeFindingAssessments } from "./finding-assessment-CGpt5YUR.js";
 import { n as isSecretClassRule, r as maskSecrets, t as FIXED_SECRET_DIAGNOSTIC_MESSAGE } from "./mask-secrets-BXn-ZSEh.js";
 import { createRequire, isBuiltin } from "node:module";
@@ -132,7 +132,7 @@ const DEFAULT_RULES_YAML = `# Architecture rules (BYO)
 //#endregion
 //#region src/config/extends.ts
 const MAX_DEPTH$1 = 5;
-const MAX_CONFIG_BYTES = 1048576;
+const MAX_CONFIG_BYTES = 1024 * 1024;
 const isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 const deepMerge = (...sources) => {
 	const result = {};
@@ -611,8 +611,7 @@ const loadConfig = (directory) => {
 	const configPath = findConfigFile(directory);
 	if (!configPath) return DEFAULT_CONFIG;
 	try {
-		const merged = loadConfigChain(configPath);
-		return validateConfig(merged, configPath);
+		return validateConfig(loadConfigChain(configPath), configPath);
 	} catch (error) {
 		if (error instanceof ConfigError) throw error;
 		throw new ConfigError(configPath, `Failed to parse ${configPath}: ${error instanceof Error ? error.message : String(error)}`);
@@ -708,8 +707,7 @@ const stringWidth = (s) => {
 	const bare = stripAnsi$1(s);
 	let total = 0;
 	for (const ch of bare) {
-		const cp = ch.codePointAt(0) ?? 0;
-		const w = wcwidth(cp);
+		const w = wcwidth(ch.codePointAt(0) ?? 0);
 		total += w > 0 ? w : 1;
 	}
 	return total;
@@ -725,8 +723,7 @@ const truncate = (s, max, ellipsis = "…") => {
 	let out = "";
 	let w = 0;
 	for (const ch of s) {
-		const cp = ch.codePointAt(0) ?? 0;
-		const cw = wcwidth(cp);
+		const cw = wcwidth(ch.codePointAt(0) ?? 0);
 		if (w + cw > limit) break;
 		out += ch;
 		w += cw;
@@ -736,8 +733,7 @@ const truncate = (s, max, ellipsis = "…") => {
 //#endregion
 //#region src/ui/display.ts
 const renderDisplaySection = (label, deps = {}) => {
-	const t = deps.theme ?? theme;
-	return style(t, "section", label);
+	return style(deps.theme ?? theme, "section", label);
 };
 const renderDisplayRows = (rows, options = {}) => {
 	if (rows.length === 0) return [];
@@ -884,10 +880,8 @@ const detectSourceLanguages = (sourceFiles) => {
 const detectLanguages = (directory, sourceFiles) => {
 	const languages = new Set(detectSourceLanguages(sourceFiles));
 	for (const [file, lang] of Object.entries(LANGUAGE_SIGNALS)) if (fs.existsSync(path.join(directory, file))) languages.add(lang);
-	if (readPackageJson(path.join(directory, "package.json"))) {
-		if (fs.existsSync(path.join(directory, "tsconfig.json"))) languages.add("typescript");
-		else languages.add("javascript");
-	}
+	if (readPackageJson(path.join(directory, "package.json"))) if (fs.existsSync(path.join(directory, "tsconfig.json"))) languages.add("typescript");
+	else languages.add("javascript");
 	for (const signal of PYTHON_SIGNALS) if (fs.existsSync(path.join(directory, signal))) {
 		languages.add("python");
 		break;
@@ -1020,7 +1014,7 @@ const isAutoGenerated = (filePath) => {
 };
 //#endregion
 //#region src/utils/git-ignore.ts
-const MAX_BUFFER$2 = 52428800;
+const MAX_BUFFER$2 = 50 * 1024 * 1024;
 const NOT_IGNORED_ARGUMENTS = [
 	"ls-files",
 	"--cached",
@@ -1131,7 +1125,7 @@ const dropGitIgnoredPaths = (rootDirectory, absolutePaths) => {
 };
 //#endregion
 //#region src/utils/project-file-list.ts
-const MAX_BUFFER$1 = 52428800;
+const MAX_BUFFER$1 = 50 * 1024 * 1024;
 const normalizePruneDirectories = (directories) => new Set([...directories].map((directory) => directory.toLowerCase()));
 const isInPrunedDirectory = (filePath, pruneDirectories) => {
 	const pathSegments = filePath.split("/");
@@ -1778,7 +1772,7 @@ const checkInstalledTools = async () => {
 };
 //#endregion
 //#region src/utils/project-path-safety.ts
-const MAX_PROJECT_CONFIG_BYTES = 1048576;
+const MAX_PROJECT_CONFIG_BYTES = 1024 * 1024;
 const isWithinDirectory$2 = (rootDirectory, candidate) => {
 	const relative = path.relative(rootDirectory, candidate);
 	return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
@@ -2103,8 +2097,7 @@ const resolveTrustedTscPath = () => {
 };
 const isReferenceOnlyConfig = (tsconfigPath) => {
 	try {
-		const raw = fs.readFileSync(tsconfigPath, "utf-8");
-		const parsed = parseJsonc(raw);
+		const parsed = parseJsonc(fs.readFileSync(tsconfigPath, "utf-8"));
 		if (!parsed) return false;
 		return Array.isArray(parsed.references) && !parsed.files && !parsed.include && !parsed.extends;
 	} catch {
@@ -2423,7 +2416,7 @@ const changeContextOrder = (context) => {
 };
 //#endregion
 //#region src/utils/git.ts
-const MAX_BUFFER = 52428800;
+const MAX_BUFFER = 50 * 1024 * 1024;
 const baseRefExists = (cwd, ref) => {
 	const result = spawnSync("git", [
 		"rev-parse",
@@ -6806,8 +6799,7 @@ const isJsRelativeOrAbsolute = (spec) => spec.startsWith(".") || spec.startsWith
 const RUNTIME_BUILTINS = /* @__PURE__ */ new Set(["bun"]);
 const isJsBuiltin = (spec) => {
 	if (RUNTIME_BUILTINS.has(spec)) return true;
-	const stripped = spec.startsWith("node:") ? spec.slice(5) : spec;
-	return isBuiltin(stripped) || isBuiltin(spec);
+	return isBuiltin(spec.startsWith("node:") ? spec.slice(5) : spec) || isBuiltin(spec);
 };
 const VIRTUAL_MODULE_PREFIXES = [
 	"astro:",
@@ -7019,8 +7011,7 @@ const isLocalAliasReplacement = (rawValue, configDirectory, rootDirectory) => {
 	if (!target) return false;
 	if (!target.startsWith(".") && !target.startsWith("/") && !target.startsWith("~/") && !target.startsWith("@/")) return false;
 	const normalized = target.startsWith("~/") || target.startsWith("@/") ? target.slice(2) : target;
-	const candidate = path.isAbsolute(normalized) ? normalized : path.resolve(configDirectory, normalized);
-	return isRootBoundedTarget(candidate, rootDirectory);
+	return isRootBoundedTarget(path.isAbsolute(normalized) ? normalized : path.resolve(configDirectory, normalized), rootDirectory);
 };
 const hasValidPackageImportTarget = (value, packageDirectory, rootDirectory) => {
 	if (!isRootBoundedTarget(packageDirectory, rootDirectory)) return false;
@@ -8214,9 +8205,7 @@ const isRustDocCommentLine = (line) => {
 };
 const collectBlocks = (sourceLines, syntax, content, ext) => {
 	const blocks = [];
-	const actualContent = content ?? sourceLines.join("\n");
-	const actualExt = ext ?? (syntax.linePrefixes.includes("//") ? ".ts" : ".py");
-	const commentLines = getCommentLines(actualContent, actualExt);
+	const commentLines = getCommentLines(content ?? sourceLines.join("\n"), ext ?? (syntax.linePrefixes.includes("//") ? ".ts" : ".py"));
 	let i = 0;
 	while (i < sourceLines.length) {
 		const line = sourceLines[i];
@@ -8544,8 +8533,7 @@ const detectNarrativeComments = async (context) => {
 		} catch {
 			continue;
 		}
-		const lines = content.split("\n");
-		const blocks = collectBlocks(lines, syntax, content, ext);
+		const blocks = collectBlocks(content.split("\n"), syntax, content, ext);
 		for (const block of blocks) {
 			const { matched, reason } = detectNarrativeInBlock(block, ext);
 			if (!matched) continue;
@@ -10487,8 +10475,7 @@ const checkFunctionDiagnostics = (relativePath, fn, limits, ext) => {
 	const results = [];
 	const multiplier = functionLocMultiplier(fn, ext);
 	const fnMax = functionLocBudget(fn, ext, limits.maxFunctionLoc);
-	const effectiveLineCount = fn.lineCount - fn.templateLines;
-	if (exceedsLimit(effectiveLineCount, limits.maxFunctionLoc, multiplier)) results.push({
+	if (exceedsLimit(fn.lineCount - fn.templateLines, limits.maxFunctionLoc, multiplier)) results.push({
 		filePath: relativePath,
 		engine: "code-quality",
 		rule: "complexity/function-too-long",
@@ -10585,7 +10572,7 @@ const isLowSignalMarkupWindow = (lines) => {
 	return lines.filter((line) => SVG_MARKUP_RE.test(line)).length >= Math.ceil(WINDOW_SIZE / 2);
 };
 const isLowSignalDataWindow = (lines) => {
-	return lines.filter((line) => DATA_LITERAL_RE.test(line)).length >= 9;
+	return lines.filter((line) => DATA_LITERAL_RE.test(line)).length >= WINDOW_SIZE - 1;
 };
 const findSuppressedLines = (lines) => {
 	const suppressed = /* @__PURE__ */ new Set();
@@ -10617,7 +10604,7 @@ const collectMeaningfulLines = (content) => {
 		if (isLowSignalDataWindow(window)) continue;
 		if (window.every(isTrivialLine)) continue;
 		const normalised = window.map(normaliseLine);
-		if (normalised.filter((n) => n.length > 0 && n !== "}" && n !== "{").length < 9) continue;
+		if (normalised.filter((n) => n.length > 0 && n !== "}" && n !== "{").length < WINDOW_SIZE - 1) continue;
 		if (new Set(normalised).size < MIN_DISTINCT_LINES) continue;
 		hits.push({
 			startLine: i + 1,
@@ -11392,7 +11379,7 @@ const fixClangFormat = async (context) => {
 };
 //#endregion
 //#region src/engines/format/dotnet-format.ts
-const REPORT_FILENAME = ".aislop-dotnet-format.json";
+const REPORT_FILENAME = ".raigal-dotnet-format.json";
 const parseDotnetFormatReport = (json, rootDirectory) => {
 	if (!json) return [];
 	let report;
@@ -11763,8 +11750,7 @@ const parseRuffFormatOutput = (output, rootDir) => {
 const fixRuffFormat = async (context) => {
 	const targets = context.files ? getPythonTargets(context) : [context.rootDirectory];
 	if (context.files && targets.length === 0) return;
-	const ruffBinary = resolveToolBinary("ruff");
-	const result = await runSubprocess(ruffBinary, ["format", ...targets], {
+	const result = await runSubprocess(resolveToolBinary("ruff"), ["format", ...targets], {
 		cwd: context.rootDirectory,
 		timeout: 6e4
 	});
@@ -11834,8 +11820,7 @@ const parseClangTidyOutput = (output, rootDirectory) => {
 const runClangTidy = async (context) => {
 	const compileCommandsDir = findCompileCommandsDir(context);
 	if (!compileCommandsDir) return [];
-	const implSources = findCppSources(context).filter((f) => CPP_IMPL_EXTENSIONS.has(path.extname(f).toLowerCase()));
-	const sources = filterSourcesInDatabase(implSources, readCompileCommandsFiles(compileCommandsDir));
+	const sources = filterSourcesInDatabase(findCppSources(context).filter((f) => CPP_IMPL_EXTENSIONS.has(path.extname(f).toLowerCase())), readCompileCommandsFiles(compileCommandsDir));
 	if (sources.length === 0) return [];
 	const diagnostics = [];
 	for (const chunk of chunkFilePaths(sources, CLANG_TIDY_CHUNK_MAX_FILES)) try {
@@ -12671,8 +12656,7 @@ const processFile = (filePath, fileTargets, result) => {
 			});
 			continue;
 		}
-		const shape = classifyIdentifier(best);
-		const { edit, skipReason } = computeEdit(sourceFile, shape);
+		const { edit, skipReason } = computeEdit(sourceFile, classifyIdentifier(best));
 		if (!edit) {
 			pendingSkips.push({
 				target,
@@ -13487,8 +13471,7 @@ const ruffLintFixArgs = (context, unsafe) => {
 };
 const fixRuffLint = async (context) => {
 	if (context.files && getPythonTargets(context).length === 0) return;
-	const ruffBinary = resolveToolBinary("ruff");
-	const result = await runSubprocess(ruffBinary, ruffLintFixArgs(context, false), {
+	const result = await runSubprocess(resolveToolBinary("ruff"), ruffLintFixArgs(context, false), {
 		cwd: context.rootDirectory,
 		timeout: 6e4
 	});
@@ -13496,8 +13479,7 @@ const fixRuffLint = async (context) => {
 };
 const fixRuffLintForce = async (context) => {
 	if (context.files && getPythonTargets(context).length === 0) return;
-	const ruffBinary = resolveToolBinary("ruff");
-	const result = await runSubprocess(ruffBinary, ruffLintFixArgs(context, true), {
+	const result = await runSubprocess(resolveToolBinary("ruff"), ruffLintFixArgs(context, true), {
 		cwd: context.rootDirectory,
 		timeout: 6e4
 	});
@@ -14307,11 +14289,10 @@ const auditSkippedDiagnostic = (source, help) => ({
 });
 const runNpmAudit = async (rootDir, timeout) => {
 	try {
-		const result = await runSubprocess("npm", ["audit", "--json"], {
+		return parseJsAudit((await runSubprocess("npm", ["audit", "--json"], {
 			cwd: rootDir,
 			timeout
-		});
-		return parseJsAudit(result.stdout, "npm audit", readRuntimeDependencies(rootDir));
+		})).stdout, "npm audit", readRuntimeDependencies(rootDir));
 	} catch (error) {
 		return [auditSkippedDiagnostic("npm audit", `Failed to run npm audit: ${errorMessageOf(error)}`)];
 	}
@@ -14332,11 +14313,10 @@ const runBunAudit = async (rootDir, timeout) => {
 const runPnpmAuditWithFallback = async (rootDir, timeout) => {
 	const canFallbackToNpm = fs.existsSync(path.join(rootDir, "package-lock.json"));
 	try {
-		const result = await runSubprocess("pnpm", ["audit", "--json"], {
+		const diagnostics = parseJsAudit((await runSubprocess("pnpm", ["audit", "--json"], {
 			cwd: rootDir,
 			timeout
-		});
-		const diagnostics = parseJsAudit(result.stdout, "pnpm audit", readRuntimeDependencies(rootDir));
+		})).stdout, "pnpm audit", readRuntimeDependencies(rootDir));
 		if (diagnostics.some((d) => d.rule === "security/dependency-audit-skipped")) {
 			if (canFallbackToNpm) return runNpmAudit(rootDir, timeout);
 			return diagnostics;
@@ -15070,10 +15050,7 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 		failed: true,
 		skipReason: r.reason instanceof Error ? r.reason.message : String(r.reason)
 	});
-	const stripped = stripSecretDiagnostics(finalResults);
-	const csharp = dedupeCSharpAsync(stripped);
-	const comments = dedupeOverlappingComments(csharp);
-	return dedupeEquivalenceDiagnostics(comments);
+	return dedupeEquivalenceDiagnostics(dedupeOverlappingComments(dedupeCSharpAsync(stripSecretDiagnostics(finalResults))));
 };
 const stripSecretDiagnostics = (results) => {
 	for (const result of results) for (const d of result.diagnostics) if (d.redactSource || isSecretClassRule(d.rule)) {
@@ -15122,8 +15099,7 @@ const calculateScore = (diagnostics, weights, thresholds, sourceFileCount, smoot
 	const capScale = Math.max(1, fileCount.effectiveSourceFileCount / CAP_REFERENCE_FILES);
 	const defaultRuleCap = typeof maxPerRule === "number" && maxPerRule > 0 ? maxPerRule : null;
 	const capForRule = (key) => {
-		const rule = key.slice(key.indexOf(":") + 1);
-		const ruleCap = scoreImpactForRule(rule).cap;
+		const ruleCap = scoreImpactForRule(key.slice(key.indexOf(":") + 1)).cap;
 		if (typeof ruleCap === "number") return defaultRuleCap ? Math.min(defaultRuleCap, ruleCap) : ruleCap;
 		return defaultRuleCap;
 	};
@@ -15407,11 +15383,10 @@ const track = (input) => {
 		cachedInstallId = ensured.installId;
 		installCreated = ensured.created;
 	}
-	const merged = {
+	const { clean, dropped } = redactProperties({
 		...baseProperties(cachedInstallId),
 		...input.properties
-	};
-	const { clean, dropped } = redactProperties(merged);
+	});
 	if (isDebug()) {
 		const compact = JSON.stringify({
 			event: input.event,
@@ -15691,17 +15666,14 @@ const renderRailStep = (step, deps = {}) => {
 * between the last step and the footer.
 */
 const renderRailConnector = (deps = {}) => {
-	const t = deps.theme ?? theme;
-	const s = deps.symbols ?? symbols;
-	return ` ${style(t, "accentDim", s.rail)}\n`;
+	return ` ${style(deps.theme ?? theme, "accentDim", (deps.symbols ?? symbols).rail)}\n`;
 };
 /**
 * Render the rail-end footer line ("└  <footer text>").
 */
 const renderRailFooter = (footer, deps = {}) => {
 	const t = deps.theme ?? theme;
-	const s = deps.symbols ?? symbols;
-	return ` ${style(t, "accentDim", s.railEnd)}  ${highlightAislop(footer, t)}\n`;
+	return ` ${style(t, "accentDim", (deps.symbols ?? symbols).railEnd)}  ${highlightAislop(footer, t)}\n`;
 };
 const renderRail = (input, deps = {}) => {
 	const t = deps.theme ?? theme;
@@ -15828,8 +15800,7 @@ var LiveRail = class {
 */
 const renderHintLine = (hint, deps = {}) => {
 	const t = deps.theme ?? theme;
-	const s = deps.symbols ?? symbols;
-	return ` ${style(t, "accent", s.hint)} ${highlightAislop(maskSecrets(hint), t)}\n`;
+	return ` ${style(t, "accent", (deps.symbols ?? symbols).hint)} ${highlightAislop(maskSecrets(hint), t)}\n`;
 };
 const createLogger = (deps = {}) => {
 	const t = deps.theme ?? theme;
@@ -15974,8 +15945,7 @@ const groupByFile = (diagnostics) => {
 	});
 };
 const isInstalled = (bin) => {
-	const cmd = process.platform === "win32" ? "where" : "which";
-	return spawnSync(cmd, [bin], { encoding: "utf-8" }).status === 0;
+	return spawnSync(process.platform === "win32" ? "where" : "which", [bin], { encoding: "utf-8" }).status === 0;
 };
 const copyToClipboard = (text) => {
 	const args = {
@@ -16458,9 +16428,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	if (!header.kid) throw new JwtVerificationError("JWT header missing 'kid'", "unknown_kid");
 	const publicKey = getPublicKey(header.kid);
 	if (!publicKey) throw new JwtVerificationError(`Unknown or untrusted signing key id (kid: ${header.kid})`, "unknown_kid");
-	const signedData = Buffer.from(`${headerB64}.${payloadB64}`, "utf-8");
-	const signature = Buffer.from(signatureB64, "base64url");
-	if (!verify(null, signedData, publicKey, signature)) throw new JwtVerificationError("Invalid JWT cryptographic signature", "invalid_signature");
+	if (!verify(null, Buffer.from(`${headerB64}.${payloadB64}`, "utf-8"), publicKey, Buffer.from(signatureB64, "base64url"))) throw new JwtVerificationError("Invalid JWT cryptographic signature", "invalid_signature");
 	let rawPayload;
 	try {
 		rawPayload = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf-8"));
@@ -16472,7 +16440,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const claims = parsed.data;
 	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
 	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.2.3", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (!isVersionAtLeast("0.2.5", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -16506,7 +16474,7 @@ const fetchGitHubOidcToken = async () => {
 };
 //#endregion
 //#region src/cloud/entitlement.ts
-const GRACE_PERIOD_SECONDS = 259200;
+const GRACE_PERIOD_SECONDS = 4320 * 60;
 var MissingCredentialError = class extends Error {
 	constructor(message = "No organization credential found") {
 		super(message);
@@ -16631,8 +16599,7 @@ const getEntitlement = async () => {
 		}
 	} else oidcToken = await fetchGitHubOidcToken();
 	try {
-		const tokenToPass = activeToken?.token ?? "";
-		const response = await fetchEntitlementFromApi(tokenToPass, oidcToken);
+		const response = await fetchEntitlementFromApi(activeToken?.token ?? "", oidcToken);
 		const claims = verifyEntitlementJwt(response.entitlement, { nowSeconds: now });
 		saveCachedEntitlement(response.entitlement, response.refresh_after);
 		return {
@@ -17175,8 +17142,7 @@ const fixNarrativeComments = async (context) => {
 		for (let i = 0; i < lines.length; i += 1) if (!toRemove.has(i + 1)) kept.push(lines[i]);
 		const newContent = kept.join("\n");
 		if (newContent !== content) {
-			const afterLiterals = extractStringAndTemplateLiterals(newContent, ext);
-			if (!areLiteralMultisetsEqual(beforeLiterals, afterLiterals)) continue;
+			if (!areLiteralMultisetsEqual(beforeLiterals, extractStringAndTemplateLiterals(newContent, ext))) continue;
 			fs.writeFileSync(filePath, newContent);
 		}
 	}
@@ -17670,7 +17636,7 @@ const removeUnusedDeclarations = (rootDirectory, declarations) => {
 };
 //#endregion
 //#region src/commands/fix-expo.ts
-const INSTALL_TIMEOUT$1 = 18e5;
+const INSTALL_TIMEOUT$1 = 1800 * 1e3;
 const fixExpoDependencies = async (context, onProgress) => {
 	await removeDisallowedExpoPackages(context.rootDirectory, onProgress);
 	onProgress?.("Expo dependency alignment · running expo install --fix (can take a few minutes)");
@@ -17724,8 +17690,8 @@ const removeDisallowedExpoPackages = async (rootDir, onProgress) => {
 };
 //#endregion
 //#region src/commands/fix-force.ts
-const INSTALL_TIMEOUT = 18e5;
-const AUDIT_TIMEOUT = 6e4;
+const INSTALL_TIMEOUT = 1800 * 1e3;
+const AUDIT_TIMEOUT = 60 * 1e3;
 const detectPackageManager = (rootDirectory) => {
 	if (fs.existsSync(path.join(rootDirectory, "pnpm-lock.yaml"))) return "pnpm";
 	if (fs.existsSync(path.join(rootDirectory, "package-lock.json")) || fs.existsSync(path.join(rootDirectory, "package.json"))) return "npm";
@@ -18044,14 +18010,13 @@ const CANNOT_SCOPE_REASON = "cannot honour an explicit file list under --changes
 const MISSING_MANIFEST_REASON = "no manifest or lockfile in the selected scope";
 const fixScopeError = (resolvedDir, flags) => {
 	if (flags.changes && flags.staged) return "--changes and --staged cannot be used together.";
-	const options = {
+	return scanTargetError(resolvedDir, {
 		changes: Boolean(flags.changes),
 		staged: Boolean(flags.staged),
 		base: flags.base,
 		verbose: false,
 		json: false
-	};
-	return scanTargetError(resolvedDir, options);
+	});
 };
 const collectFixFileScope = (rootDirectory, excludePatterns, includePatterns, flags) => {
 	const mode = resolveScanScopeMode({
@@ -18110,10 +18075,9 @@ const runFormattingStep = async (deps) => {
 	else if (deps.projectInfo.languages.includes("python")) log.warn("Python detected but ruff is not installed; skipping Python formatting fixes.");
 	if (deps.projectInfo.languages.includes("go") && deps.projectInfo.installedTools.gofmt) await deps.runStep("Formatting (go)", () => runGofmt(deps.context), () => fixGofmt(deps.context));
 	else if (deps.projectInfo.languages.includes("go")) log.warn("Go detected but gofmt is not installed; skipping Go formatting fixes.");
-	if (deps.projectInfo.languages.includes("rust") && deps.projectInfo.installedTools.rustfmt) {
-		if (isScopedFix(deps.context)) deps.skipStep?.("Formatting (rust)", CANNOT_SCOPE_REASON);
-		else await deps.runStep("Formatting (rust)", () => runGenericFormatter(deps.context, "rust"), () => fixGenericFormatter(deps.context, "rust"));
-	} else if (deps.projectInfo.languages.includes("rust")) log.warn("Rust detected but rustfmt is not installed; skipping Rust formatting fixes.");
+	if (deps.projectInfo.languages.includes("rust") && deps.projectInfo.installedTools.rustfmt) if (isScopedFix(deps.context)) deps.skipStep?.("Formatting (rust)", CANNOT_SCOPE_REASON);
+	else await deps.runStep("Formatting (rust)", () => runGenericFormatter(deps.context, "rust"), () => fixGenericFormatter(deps.context, "rust"));
+	else if (deps.projectInfo.languages.includes("rust")) log.warn("Rust detected but rustfmt is not installed; skipping Rust formatting fixes.");
 	if (deps.projectInfo.languages.includes("ruby") && deps.projectInfo.installedTools.rubocop) {
 		if (!skipUnsafeSafeFormatter(deps, "ruby")) await deps.runStep("Formatting (ruby)", () => runGenericFormatter(deps.context, "ruby"), () => fixGenericFormatter(deps.context, "ruby"));
 	} else if (deps.projectInfo.languages.includes("ruby")) log.warn("Ruby detected but rubocop is not installed; skipping Ruby formatting fixes.");
@@ -18162,8 +18126,7 @@ const runDeclarationStep = async (deps) => {
 	if (!deps.config.engines["code-quality"]) return;
 	if (!hasJsOrTs(deps.projectInfo)) return;
 	await deps.runStep("Unused declarations", () => detectUnusedDeclarations(deps.context), async () => {
-		const diagnostics = await detectUnusedDeclarations(deps.context);
-		const declarations = diagnosticsToDeclarations(diagnostics);
+		const declarations = diagnosticsToDeclarations(await detectUnusedDeclarations(deps.context));
 		removeUnusedDeclarations(deps.resolvedDir, declarations);
 	});
 };
@@ -18194,14 +18157,10 @@ const runForceSteps = async (deps) => {
 		return (await runKnipUnusedFiles(deps.resolvedDir)).filter((diagnostic) => isPathInFixScope(deps.context, diagnostic.filePath));
 	}, () => fixUnusedFiles(deps.resolvedDir, (filePath) => isPathInFixScope(deps.context, filePath)));
 	const railUpdate = (label) => deps.rail.setActiveLabel(label);
-	if (deps.config.engines.security) {
-		if (!scopeIncludesManifestWrites(deps.context)) deps.skipStep?.("Dependency audit fixes", MISSING_MANIFEST_REASON);
-		else await deps.runStep("Dependency audit fixes", () => runDependencyAudit(deps.context), () => fixDependencyAudit(deps.context, railUpdate));
-	}
-	if (deps.projectInfo.frameworks.includes("expo") && deps.config.lint.expoDoctor) {
-		if (!scopeIncludesManifestWrites(deps.context)) deps.skipStep?.("Expo dependency alignment", MISSING_MANIFEST_REASON);
-		else await deps.runStep("Expo dependency alignment", () => runExpoDoctor(deps.context), () => fixExpoDependencies(deps.context, railUpdate));
-	}
+	if (deps.config.engines.security) if (!scopeIncludesManifestWrites(deps.context)) deps.skipStep?.("Dependency audit fixes", MISSING_MANIFEST_REASON);
+	else await deps.runStep("Dependency audit fixes", () => runDependencyAudit(deps.context), () => fixDependencyAudit(deps.context, railUpdate));
+	if (deps.projectInfo.frameworks.includes("expo") && deps.config.lint.expoDoctor) if (!scopeIncludesManifestWrites(deps.context)) deps.skipStep?.("Expo dependency alignment", MISSING_MANIFEST_REASON);
+	else await deps.runStep("Expo dependency alignment", () => runExpoDoctor(deps.context), () => fixExpoDependencies(deps.context, railUpdate));
 };
 //#endregion
 //#region src/commands/fix-plan.ts
@@ -18523,8 +18482,7 @@ const saveCachedPolicy = (repoSlug, policy) => {
 };
 const fetchRemotePolicy = async (repoSlug, token) => {
 	try {
-		const endpoint = `/v1/policy?repo=${encodeURIComponent(repoSlug.toLowerCase())}`;
-		const data = await requestApi(endpoint, {
+		const data = await requestApi(`/v1/policy?repo=${encodeURIComponent(repoSlug.toLowerCase())}`, {
 			method: "GET",
 			token,
 			timeoutMs: 4e3
@@ -18714,8 +18672,8 @@ A PostToolUse hook runs \`raigal hook claude\` after every Edit, Write, or Multi
 
 ## Rules
 
-- \`.raigal/config.yaml\` (or \`.aislop/config.yaml\`) - thresholds and engine toggles. Treat as authoritative; don't edit without user consent.
-- \`.raigal/rules.yaml\` (or \`.aislop/rules.yaml\`) - project-specific architecture rules (may be absent). When a finding cites \`architecture/*\`, open this file and follow it.
+- \`.raigal/config.yaml\` - thresholds and engine toggles. Treat as authoritative; don't edit without user consent.
+- \`.raigal/rules.yaml\` - project-specific architecture rules (may be absent). When a finding cites \`architecture/*\`, open this file and follow it.
 - Custom rules can change between sessions. Trust what the scan returns, not a cached understanding of what the rules are.
 
 ## Principles
@@ -18730,7 +18688,7 @@ const atomicWrite = (targetPath, content) => {
 	const dir = path.dirname(targetPath);
 	fs.mkdirSync(dir, { recursive: true });
 	const rand = Math.random().toString(36).slice(2, 10);
-	const tmp = path.join(dir, `.aislop-tmp-${process.pid}-${rand}`);
+	const tmp = path.join(dir, `.raigal-tmp-${process.pid}-${rand}`);
 	fs.writeFileSync(tmp, content, "utf-8");
 	try {
 		fs.renameSync(tmp, targetPath);
@@ -18824,9 +18782,7 @@ const applyRemoval = (result, opts, target, nextContent) => {
 //#region src/hooks/install/rules-only.ts
 const installRulesOnly = (opts, paths, summary) => {
 	const result = emptyResult();
-	const existing = readIfExists(paths.rules);
-	const hash = sentinelHash(AISLOP_MD_BODY);
-	const next = upsertMarkdownFence(existing, AISLOP_MD_BODY, hash).nextContent;
+	const next = upsertMarkdownFence(readIfExists(paths.rules), AISLOP_MD_BODY, sentinelHash(AISLOP_MD_BODY)).nextContent;
 	applyContent(result, opts, paths.rules, next, summary);
 	if (paths.host && paths.marker) {
 		const host = readIfExists(paths.host) ?? "";
@@ -19002,8 +18958,7 @@ const installClaude = (opts) => {
 	const nextSettings = renderSettings$1(readIfExists(paths.settings), Boolean(opts.qualityGate));
 	applyContent(result, opts, paths.settings, nextSettings, "register PostToolUse + FileChanged hooks");
 	const mdHash = sentinelHash(AISLOP_MD_BODY);
-	const existingMd = readIfExists(paths.aislopMd);
-	const fenced = upsertMarkdownFence(existingMd, AISLOP_MD_BODY, mdHash);
+	const fenced = upsertMarkdownFence(readIfExists(paths.aislopMd), AISLOP_MD_BODY, mdHash);
 	applyContent(result, opts, paths.aislopMd, fenced.nextContent, "write AISLOP.md rules");
 	const existingClaudeMd = readIfExists(paths.claudeMd) ?? "";
 	const marker = "@AISLOP.md";
@@ -19149,9 +19104,7 @@ const installCursor = (opts) => {
 	const nextHooks = renderHooksJson(readIfExists(paths.hooks));
 	applyContent(result, opts, paths.hooks, nextHooks, "register afterFileEdit hook");
 	if (opts.scope === "project") {
-		const existingRules = readIfExists(paths.rules);
-		const hash = sentinelHash(AISLOP_MD_BODY);
-		const rules = upsertMarkdownFence(existingRules, AISLOP_MD_BODY, hash).nextContent;
+		const rules = upsertMarkdownFence(readIfExists(paths.rules), AISLOP_MD_BODY, sentinelHash(AISLOP_MD_BODY)).nextContent;
 		applyContent(result, opts, paths.rules, rules, "write .cursor/rules/aislop.mdc");
 	}
 	return result;
@@ -19224,9 +19177,7 @@ const installGemini = (opts) => {
 	const result = emptyResult();
 	const next = renderSettings(readIfExists(paths.settings));
 	applyContent(result, opts, paths.settings, next, "register AfterTool hook");
-	const existingMd = readIfExists(paths.aislopMd);
-	const hash = sentinelHash(AISLOP_MD_BODY);
-	const fenced = upsertMarkdownFence(existingMd, AISLOP_MD_BODY, hash).nextContent;
+	const fenced = upsertMarkdownFence(readIfExists(paths.aislopMd), AISLOP_MD_BODY, sentinelHash(AISLOP_MD_BODY)).nextContent;
 	applyContent(result, opts, paths.aislopMd, fenced, "write AISLOP.md rules");
 	const existingGeminiMd = readIfExists(paths.geminiMd) ?? "";
 	const marker = "@AISLOP.md";
@@ -20172,8 +20123,7 @@ const renderActionRows = (steps, t) => {
 const renderTextSteps = (steps, t, s) => {
 	return steps.filter((step) => step.text).map((step) => {
 		const glyph = step.emphasis === "primary" ? s.hint : s.bullet;
-		const tokenFor = step.emphasis === "primary" ? "accent" : "muted";
-		return ` ${style(t, tokenFor, glyph)} ${highlightAislop(step.text ?? "", t)}`;
+		return ` ${style(t, step.emphasis === "primary" ? "accent" : "muted", glyph)} ${highlightAislop(step.text ?? "", t)}`;
 	});
 };
 const renderSummary = (input, deps = {}) => {
@@ -20230,14 +20180,10 @@ const renderSummary = (input, deps = {}) => {
 	return lines.join("\n");
 };
 const renderStarCta = (deps = {}) => {
-	const t = deps.theme ?? theme;
-	const repository = terminalLink("https://raigal.dev");
-	return `\n ${style(t, "muted", `★ Found this useful? Consider purchasing this software at ${repository}`)}\n`;
+	return `\n ${style(deps.theme ?? theme, "muted", `★ Found this useful? Consider purchasing this software at ${terminalLink("https://raigal.dev")}`)}\n`;
 };
 const renderTeamCta = (deps = {}) => {
-	const t = deps.theme ?? theme;
-	const href = terminalLink("https://raigal.dev/contact?intent=team-baseline");
-	return `\n ${style(t, "muted", `→ Using raigal with a team? Get a 14-day team baseline at ${href}`)}\n`;
+	return `\n ${style(deps.theme ?? theme, "muted", `→ Using raigal with a team? Get a 14-day team baseline at ${terminalLink("https://raigal.dev/contact?intent=team-baseline")}`)}\n`;
 };
 const renderCleanRun = (input, deps = {}) => {
 	const t = deps.theme ?? theme;
@@ -20463,7 +20409,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		architectureRulesPath: config.engines.architecture ? rulesPath : void 0,
 		engines: config.engines
 	};
-	const severityAdjusted = (await runEnginesWithProgress({
+	const { results: unannotated, suppressedCount } = applySuppressions((await runEnginesWithProgress({
 		rootDirectory: resolvedDir,
 		languages: projectInfo.languages,
 		frameworks: projectInfo.frameworks,
@@ -20479,8 +20425,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 	}, config.engines, machineOutput)).map((result) => ({
 		...result,
 		diagnostics: config.overrides.length ? result.diagnostics : applyRuleSeverities(result.diagnostics, config.rules)
-	}));
-	const { results: unannotated, suppressedCount } = applySuppressions(severityAdjusted, resolvedDir);
+	})), resolvedDir);
 	if (suppressedCount > 0 && !machineOutput) log.muted(`Suppressed ${suppressedCount} finding(s) via raigal-ignore directives`);
 	const changeMap = options.changes && !options.staged ? getChangedLineMap(resolvedDir, options.base) : null;
 	const results = changeMap ? unannotated.map((result) => ({
@@ -20541,12 +20486,12 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		scoreFileCount
 	});
 	if (options.sarif) {
-		const { buildSarifLog } = await import("./sarif-CpuYM3aK.js");
+		const { buildSarifLog } = await import("./sarif-DqH4dGEo.js");
 		console.log(JSON.stringify(buildSarifLog(results), null, 2));
 		return completion;
 	}
 	if (options.json) {
-		const { buildJsonOutput } = await import("./json-BflWt4dX.js");
+		const { buildJsonOutput } = await import("./json-B8XGYwMv.js");
 		const jsonOut = buildJsonOutput(results, scoreResult, scoreFileCount, elapsedMs, scanCoverage);
 		console.log(JSON.stringify(jsonOut, null, 2));
 		return completion;
@@ -20700,8 +20645,7 @@ const runFixBody = async (resolvedDir, config, options, projectInfo) => {
 		brand: options.printBrand !== false
 	}));
 	const safe = Boolean(options.safe);
-	const excludePatterns = [...config.exclude, ...readAislopIgnorePatterns(resolvedDir)];
-	const scope = collectFixFileScope(resolvedDir, excludePatterns, config.include, options);
+	const scope = collectFixFileScope(resolvedDir, [...config.exclude, ...readAislopIgnorePatterns(resolvedDir)], config.include, options);
 	const scopedProjectInfo = scope ? {
 		...projectInfo,
 		languages: detectSourceLanguages([...scope.files, ...scope.testFiles])
@@ -21058,18 +21002,16 @@ const initCommand = async (directory, options = {}) => {
 		status: "done",
 		label: `Wrote ${CONFIG_DIR}/${CONFIG_FILE}`
 	}];
-	if (choices.engines.includes("architecture")) {
-		if (!fs.existsSync(rulesPath)) {
-			fs.writeFileSync(rulesPath, DEFAULT_RULES_YAML);
-			steps.push({
-				status: "done",
-				label: `Wrote ${CONFIG_DIR}/${RULES_FILE}`
-			});
-		} else steps.push({
-			status: "skipped",
-			label: `${CONFIG_DIR}/${RULES_FILE} already exists`
+	if (choices.engines.includes("architecture")) if (!fs.existsSync(rulesPath)) {
+		fs.writeFileSync(rulesPath, DEFAULT_RULES_YAML);
+		steps.push({
+			status: "done",
+			label: `Wrote ${CONFIG_DIR}/${RULES_FILE}`
 		});
-	}
+	} else steps.push({
+		status: "skipped",
+		label: `${CONFIG_DIR}/${RULES_FILE} already exists`
+	});
 	const workflowResult = writeGithubWorkflow(resolvedDir, choices.writeGithubWorkflow);
 	if (workflowResult.status === "written") steps.push({
 		status: "done",
@@ -21263,10 +21205,8 @@ const runSearchPrompt = async (options) => {
 			}
 			if (key.name === "space" && options.mode === "multi") {
 				const item = filtered[cursor];
-				if (item) {
-					if (selected.has(item.value)) selected.delete(item.value);
-					else selected.add(item.value);
-				}
+				if (item) if (selected.has(item.value)) selected.delete(item.value);
+				else selected.add(item.value);
 				render();
 				return;
 			}
@@ -21575,8 +21515,7 @@ const collectRuleEntries = (directory) => {
 	for (const { engine, rules } of BUILTIN_RULES) for (const rule of rules) entries.push(toRuleEntry(engine, rule));
 	const configDir = findConfigDir(resolvedDir);
 	if (configDir) {
-		const rulesPath = path.join(configDir, RULES_FILE);
-		const archRules = loadArchitectureRules(rulesPath);
+		const archRules = loadArchitectureRules(path.join(configDir, RULES_FILE));
 		for (const rule of archRules) entries.push({
 			id: `arch/${rule.name}`,
 			engine: "architecture",