@methiu/raigal 0.2.3 → 0.2.5

package/dist/{json-BflWt4dX.js → json-B8XGYwMv.js}

@@ -1,4 +1,4 @@
-import { t as APP_VERSION } from "./version-B4eYJn3o.js";
+import { t as APP_VERSION } from "./version-BlgPglaO.js";
 import { i as ENGINE_INFO, n as withFindingAssessments, t as summarizeFindingAssessments } from "./finding-assessment-CGpt5YUR.js";
 //#region src/output/json.ts
 const buildJsonOutput = (results, scoreResult, fileCount, elapsedMs, coverage) => {

package/dist/mcp.js

@@ -84,7 +84,7 @@ const getActiveToken = () => {
 };
 //#endregion
 //#region src/version.ts
-const APP_VERSION = "0.2.3";
+const APP_VERSION = "0.2.5";
 //#endregion
 //#region src/cloud/contract.ts
 const Severity = z.enum(["error", "warning"]);
@@ -347,9 +347,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	if (!header.kid) throw new JwtVerificationError("JWT header missing 'kid'", "unknown_kid");
 	const publicKey = getPublicKey(header.kid);
 	if (!publicKey) throw new JwtVerificationError(`Unknown or untrusted signing key id (kid: ${header.kid})`, "unknown_kid");
-	const signedData = Buffer.from(`${headerB64}.${payloadB64}`, "utf-8");
-	const signature = Buffer.from(signatureB64, "base64url");
-	if (!verify(null, signedData, publicKey, signature)) throw new JwtVerificationError("Invalid JWT cryptographic signature", "invalid_signature");
+	if (!verify(null, Buffer.from(`${headerB64}.${payloadB64}`, "utf-8"), publicKey, Buffer.from(signatureB64, "base64url"))) throw new JwtVerificationError("Invalid JWT cryptographic signature", "invalid_signature");
 	let rawPayload;
 	try {
 		rawPayload = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf-8"));
@@ -361,7 +359,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const claims = parsed.data;
 	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
 	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.2.3", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (!isVersionAtLeast("0.2.5", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -395,7 +393,7 @@ const fetchGitHubOidcToken = async () => {
 };
 //#endregion
 //#region src/cloud/entitlement.ts
-const GRACE_PERIOD_SECONDS = 259200;
+const GRACE_PERIOD_SECONDS = 4320 * 60;
 var MissingCredentialError = class extends Error {
 	constructor(message = "No organization credential found") {
 		super(message);
@@ -520,8 +518,7 @@ const getEntitlement = async () => {
 		}
 	} else oidcToken = await fetchGitHubOidcToken();
 	try {
-		const tokenToPass = activeToken?.token ?? "";
-		const response = await fetchEntitlementFromApi(tokenToPass, oidcToken);
+		const response = await fetchEntitlementFromApi(activeToken?.token ?? "", oidcToken);
 		const claims = verifyEntitlementJwt(response.entitlement, { nowSeconds: now });
 		saveCachedEntitlement(response.entitlement, response.refresh_after);
 		return {
@@ -816,7 +813,7 @@ const DEFAULT_CONFIG = {
 //#endregion
 //#region src/config/extends.ts
 const MAX_DEPTH$1 = 5;
-const MAX_CONFIG_BYTES = 1048576;
+const MAX_CONFIG_BYTES = 1024 * 1024;
 const isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 const deepMerge = (...sources) => {
 	const result = {};
@@ -1292,8 +1289,7 @@ const loadConfig = (directory) => {
 	const configPath = findConfigFile(directory);
 	if (!configPath) return DEFAULT_CONFIG;
 	try {
-		const merged = loadConfigChain(configPath);
-		return validateConfig(merged, configPath);
+		return validateConfig(loadConfigChain(configPath), configPath);
 	} catch (error) {
 		if (error instanceof ConfigError) throw error;
 		throw new ConfigError(configPath, `Failed to parse ${configPath}: ${error instanceof Error ? error.message : String(error)}`);
@@ -1471,7 +1467,7 @@ const filterExcludedDiagnostics = (diagnostics, rootDirectory, excludePatterns)
 };
 //#endregion
 //#region src/utils/project-path-safety.ts
-const MAX_PROJECT_CONFIG_BYTES = 1048576;
+const MAX_PROJECT_CONFIG_BYTES = 1024 * 1024;
 const isWithinDirectory$2 = (rootDirectory, candidate) => {
 	const relative = path.relative(rootDirectory, candidate);
 	return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
@@ -1558,7 +1554,7 @@ const isAutoGenerated = (filePath) => {
 };
 //#endregion
 //#region src/utils/git-ignore.ts
-const MAX_BUFFER$1 = 52428800;
+const MAX_BUFFER$1 = 50 * 1024 * 1024;
 const NOT_IGNORED_ARGUMENTS = [
 	"ls-files",
 	"--cached",
@@ -1669,7 +1665,7 @@ const dropGitIgnoredPaths = (rootDirectory, absolutePaths) => {
 };
 //#endregion
 //#region src/utils/project-file-list.ts
-const MAX_BUFFER = 52428800;
+const MAX_BUFFER = 50 * 1024 * 1024;
 const normalizePruneDirectories = (directories) => new Set([...directories].map((directory) => directory.toLowerCase()));
 const isInPrunedDirectory = (filePath, pruneDirectories) => {
 	const pathSegments = filePath.split("/");
@@ -6032,8 +6028,7 @@ const isJsRelativeOrAbsolute = (spec) => spec.startsWith(".") || spec.startsWith
 const RUNTIME_BUILTINS = /* @__PURE__ */ new Set(["bun"]);
 const isJsBuiltin = (spec) => {
 	if (RUNTIME_BUILTINS.has(spec)) return true;
-	const stripped = spec.startsWith("node:") ? spec.slice(5) : spec;
-	return isBuiltin(stripped) || isBuiltin(spec);
+	return isBuiltin(spec.startsWith("node:") ? spec.slice(5) : spec) || isBuiltin(spec);
 };
 const VIRTUAL_MODULE_PREFIXES = [
 	"astro:",
@@ -6245,8 +6240,7 @@ const isLocalAliasReplacement = (rawValue, configDirectory, rootDirectory) => {
 	if (!target) return false;
 	if (!target.startsWith(".") && !target.startsWith("/") && !target.startsWith("~/") && !target.startsWith("@/")) return false;
 	const normalized = target.startsWith("~/") || target.startsWith("@/") ? target.slice(2) : target;
-	const candidate = path.isAbsolute(normalized) ? normalized : path.resolve(configDirectory, normalized);
-	return isRootBoundedTarget(candidate, rootDirectory);
+	return isRootBoundedTarget(path.isAbsolute(normalized) ? normalized : path.resolve(configDirectory, normalized), rootDirectory);
 };
 const hasValidPackageImportTarget = (value, packageDirectory, rootDirectory) => {
 	if (!isRootBoundedTarget(packageDirectory, rootDirectory)) return false;
@@ -7366,9 +7360,7 @@ const isRustDocCommentLine = (line) => {
 };
 const collectBlocks = (sourceLines, syntax, content, ext) => {
 	const blocks = [];
-	const actualContent = content ?? sourceLines.join("\n");
-	const actualExt = ext ?? (syntax.linePrefixes.includes("//") ? ".ts" : ".py");
-	const commentLines = getCommentLines(actualContent, actualExt);
+	const commentLines = getCommentLines(content ?? sourceLines.join("\n"), ext ?? (syntax.linePrefixes.includes("//") ? ".ts" : ".py"));
 	let i = 0;
 	while (i < sourceLines.length) {
 		const line = sourceLines[i];
@@ -7696,8 +7688,7 @@ const detectNarrativeComments = async (context) => {
 		} catch {
 			continue;
 		}
-		const lines = content.split("\n");
-		const blocks = collectBlocks(lines, syntax, content, ext);
+		const blocks = collectBlocks(content.split("\n"), syntax, content, ext);
 		for (const block of blocks) {
 			const { matched, reason } = detectNarrativeInBlock(block, ext);
 			if (!matched) continue;
@@ -9649,8 +9640,7 @@ const checkFunctionDiagnostics = (relativePath, fn, limits, ext) => {
 	const results = [];
 	const multiplier = functionLocMultiplier(fn, ext);
 	const fnMax = functionLocBudget(fn, ext, limits.maxFunctionLoc);
-	const effectiveLineCount = fn.lineCount - fn.templateLines;
-	if (exceedsLimit(effectiveLineCount, limits.maxFunctionLoc, multiplier)) results.push({
+	if (exceedsLimit(fn.lineCount - fn.templateLines, limits.maxFunctionLoc, multiplier)) results.push({
 		filePath: relativePath,
 		engine: "code-quality",
 		rule: "complexity/function-too-long",
@@ -9747,7 +9737,7 @@ const isLowSignalMarkupWindow = (lines) => {
 	return lines.filter((line) => SVG_MARKUP_RE.test(line)).length >= Math.ceil(WINDOW_SIZE / 2);
 };
 const isLowSignalDataWindow = (lines) => {
-	return lines.filter((line) => DATA_LITERAL_RE.test(line)).length >= 9;
+	return lines.filter((line) => DATA_LITERAL_RE.test(line)).length >= WINDOW_SIZE - 1;
 };
 const findSuppressedLines = (lines) => {
 	const suppressed = /* @__PURE__ */ new Set();
@@ -9779,7 +9769,7 @@ const collectMeaningfulLines = (content) => {
 		if (isLowSignalDataWindow(window)) continue;
 		if (window.every(isTrivialLine)) continue;
 		const normalised = window.map(normaliseLine);
-		if (normalised.filter((n) => n.length > 0 && n !== "}" && n !== "{").length < 9) continue;
+		if (normalised.filter((n) => n.length > 0 && n !== "}" && n !== "{").length < WINDOW_SIZE - 1) continue;
 		if (new Set(normalised).size < MIN_DISTINCT_LINES) continue;
 		hits.push({
 			startLine: i + 1,
@@ -10652,7 +10642,7 @@ const runClangFormat = async (context) => {
 };
 //#endregion
 //#region src/engines/format/dotnet-format.ts
-const REPORT_FILENAME = ".aislop-dotnet-format.json";
+const REPORT_FILENAME = ".raigal-dotnet-format.json";
 const parseDotnetFormatReport = (json, rootDirectory) => {
 	if (!json) return [];
 	let report;
@@ -11114,8 +11104,7 @@ const parseClangTidyOutput = (output, rootDirectory) => {
 const runClangTidy = async (context) => {
 	const compileCommandsDir = findCompileCommandsDir(context);
 	if (!compileCommandsDir) return [];
-	const implSources = findCppSources(context).filter((f) => CPP_IMPL_EXTENSIONS.has(path.extname(f).toLowerCase()));
-	const sources = filterSourcesInDatabase(implSources, readCompileCommandsFiles(compileCommandsDir));
+	const sources = filterSourcesInDatabase(findCppSources(context).filter((f) => CPP_IMPL_EXTENSIONS.has(path.extname(f).toLowerCase())), readCompileCommandsFiles(compileCommandsDir));
 	if (sources.length === 0) return [];
 	const diagnostics = [];
 	for (const chunk of chunkFilePaths(sources, CLANG_TIDY_CHUNK_MAX_FILES)) try {
@@ -12449,8 +12438,7 @@ const resolveTrustedTscPath = () => {
 };
 const isReferenceOnlyConfig = (tsconfigPath) => {
 	try {
-		const raw = fs.readFileSync(tsconfigPath, "utf-8");
-		const parsed = parseJsonc(raw);
+		const parsed = parseJsonc(fs.readFileSync(tsconfigPath, "utf-8"));
 		if (!parsed) return false;
 		return Array.isArray(parsed.references) && !parsed.files && !parsed.include && !parsed.extends;
 	} catch {
@@ -13317,11 +13305,10 @@ const auditSkippedDiagnostic = (source, help) => ({
 });
 const runNpmAudit = async (rootDir, timeout) => {
 	try {
-		const result = await runSubprocess("npm", ["audit", "--json"], {
+		return parseJsAudit((await runSubprocess("npm", ["audit", "--json"], {
 			cwd: rootDir,
 			timeout
-		});
-		return parseJsAudit(result.stdout, "npm audit", readRuntimeDependencies(rootDir));
+		})).stdout, "npm audit", readRuntimeDependencies(rootDir));
 	} catch (error) {
 		return [auditSkippedDiagnostic("npm audit", `Failed to run npm audit: ${errorMessageOf(error)}`)];
 	}
@@ -13342,11 +13329,10 @@ const runBunAudit = async (rootDir, timeout) => {
 const runPnpmAuditWithFallback = async (rootDir, timeout) => {
 	const canFallbackToNpm = fs.existsSync(path.join(rootDir, "package-lock.json"));
 	try {
-		const result = await runSubprocess("pnpm", ["audit", "--json"], {
+		const diagnostics = parseJsAudit((await runSubprocess("pnpm", ["audit", "--json"], {
 			cwd: rootDir,
 			timeout
-		});
-		const diagnostics = parseJsAudit(result.stdout, "pnpm audit", readRuntimeDependencies(rootDir));
+		})).stdout, "pnpm audit", readRuntimeDependencies(rootDir));
 		if (diagnostics.some((d) => d.rule === "security/dependency-audit-skipped")) {
 			if (canFallbackToNpm) return runNpmAudit(rootDir, timeout);
 			return diagnostics;
@@ -14153,10 +14139,7 @@ const runEngines = async (context, enabledEngines, onStart, onComplete) => {
 		failed: true,
 		skipReason: r.reason instanceof Error ? r.reason.message : String(r.reason)
 	});
-	const stripped = stripSecretDiagnostics(finalResults);
-	const csharp = dedupeCSharpAsync(stripped);
-	const comments = dedupeOverlappingComments(csharp);
-	return dedupeEquivalenceDiagnostics(comments);
+	return dedupeEquivalenceDiagnostics(dedupeOverlappingComments(dedupeCSharpAsync(stripSecretDiagnostics(finalResults))));
 };
 const stripSecretDiagnostics = (results) => {
 	for (const result of results) for (const d of result.diagnostics) if (d.redactSource || isSecretClassRule(d.rule)) {
@@ -14381,8 +14364,7 @@ const calculateScore = (diagnostics, weights, thresholds, sourceFileCount, smoot
 	const capScale = Math.max(1, fileCount.effectiveSourceFileCount / CAP_REFERENCE_FILES);
 	const defaultRuleCap = typeof maxPerRule === "number" && maxPerRule > 0 ? maxPerRule : null;
 	const capForRule = (key) => {
-		const rule = key.slice(key.indexOf(":") + 1);
-		const ruleCap = scoreImpactForRule(rule).cap;
+		const ruleCap = scoreImpactForRule(key.slice(key.indexOf(":") + 1)).cap;
 		if (typeof ruleCap === "number") return defaultRuleCap ? Math.min(defaultRuleCap, ruleCap) : ruleCap;
 		return defaultRuleCap;
 	};
@@ -14495,10 +14477,8 @@ const detectSourceLanguages = (sourceFiles) => {
 const detectLanguages = (directory, sourceFiles) => {
 	const languages = new Set(detectSourceLanguages(sourceFiles));
 	for (const [file, lang] of Object.entries(LANGUAGE_SIGNALS)) if (fs.existsSync(path.join(directory, file))) languages.add(lang);
-	if (readPackageJson(path.join(directory, "package.json"))) {
-		if (fs.existsSync(path.join(directory, "tsconfig.json"))) languages.add("typescript");
-		else languages.add("javascript");
-	}
+	if (readPackageJson(path.join(directory, "package.json"))) if (fs.existsSync(path.join(directory, "tsconfig.json"))) languages.add("typescript");
+	else languages.add("javascript");
 	for (const signal of PYTHON_SIGNALS) if (fs.existsSync(path.join(directory, signal))) {
 		languages.add("python");
 		break;
@@ -14694,7 +14674,9 @@ const baselinePath = (cwd) => {
 	if (fs.existsSync(raigalCandidate)) return raigalCandidate;
 	const raigalDir = path.join(cwd, ".raigal");
 	if (fs.existsSync(raigalDir)) return raigalCandidate;
-	return path.join(cwd, ".aislop", "baseline.json");
+	const legacyCandidate = path.join(cwd, ".aislop", "baseline.json");
+	if (fs.existsSync(legacyCandidate)) return legacyCandidate;
+	return raigalCandidate;
 };
 const readBaseline = (cwd) => {
 	const raw = readIfExists(baselinePath(cwd));
@@ -14705,7 +14687,7 @@ const readBaseline = (cwd) => {
 		const findingFingerprints = parsed.findingFingerprints ?? [];
 		const needsWindowsMigration = parsed.pathFormat !== "posix";
 		return {
-			schema: "aislop.baseline.v2",
+			schema: "raigal.baseline.v2",
 			pathFormat: "posix",
 			updatedAt: parsed.updatedAt ?? "",
 			score: parsed.score ?? 0,
@@ -14886,9 +14868,7 @@ const summariseDiagnostics = (diagnostics, rootDirectory) => {
 const runScan = async (cwd) => {
 	const project = await discoverProject(cwd);
 	const config = loadConfig(cwd);
-	const context = buildEngineContext(project.rootDirectory, project, config);
-	const enabled = enabledEnginesFromConfig(config);
-	const diagnostics = (await runEngines(context, enabled)).flatMap((r) => r.diagnostics);
+	const diagnostics = (await runEngines(buildEngineContext(project.rootDirectory, project, config), enabledEnginesFromConfig(config))).flatMap((r) => r.diagnostics);
 	const { score } = calculateScore(diagnostics, config.scoring.weights, config.scoring.thresholds, project.sourceFileCount, config.scoring.smoothing, config.scoring.maxPerRule);
 	const errorCount = diagnostics.filter((d) => d.severity === "error").length;
 	const failBelow = config.ci.failBelow;
@@ -15268,11 +15248,10 @@ const track = (input) => {
 		cachedInstallId = ensured.installId;
 		installCreated = ensured.created;
 	}
-	const merged = {
+	const { clean, dropped } = redactProperties({
 		...baseProperties(cachedInstallId),
 		...input.properties
-	};
-	const { clean, dropped } = redactProperties(merged);
+	});
 	if (isDebug()) {
 		const compact = JSON.stringify({
 			event: input.event,

package/dist/{mount-CHGc3gB6.js → mount-DTc8WaIt.js}

@@ -4,7 +4,7 @@ const mountAgentTui = async (store) => {
 	const [{ render }, React, { AgentApp }] = await Promise.all([
 		import("ink"),
 		import("react"),
-		import("./AgentApp-DJYdD1VH.js")
+		import("./AgentApp-CIiRfOun.js")
 	]);
 	process.stdout.write("\x1B[?1049h\x1B[?25l");
 	const instance = render(React.createElement(AgentApp, { store }), { exitOnCtrlC: false });

package/dist/{sarif-CpuYM3aK.js → sarif-DqH4dGEo.js}

@@ -1,4 +1,4 @@
-import { t as APP_VERSION } from "./version-B4eYJn3o.js";
+import { t as APP_VERSION } from "./version-BlgPglaO.js";
 import { n as isSecretClassRule, t as FIXED_SECRET_DIAGNOSTIC_MESSAGE } from "./mask-secrets-BXn-ZSEh.js";
 import path from "node:path";
 //#region src/output/sarif.ts

package/dist/{version-B4eYJn3o.js → version-BlgPglaO.js}

@@ -1,6 +1,6 @@
 import "node:fs";
 import "node:url";
 //#region src/version.ts
-const APP_VERSION = "0.2.3";
+const APP_VERSION = "0.2.5";
 //#endregion
 export { APP_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@methiu/raigal",
-	"version": "0.2.3",
+	"version": "0.2.5",
 	"publishConfig": {
 		"access": "public"
 	},