@methiu/raigal 0.2.5 → 0.2.7

package/dist/cli.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire, isBuiltin } from "node:module";
+import { execSync, spawn, spawnSync } from "node:child_process";
 import fs, { closeSync, existsSync, mkdtempSync, openSync, readFileSync, rmSync } from "node:fs";
-import { Command, Option } from "commander";
 import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { Command, Option } from "commander";
 import { performance } from "node:perf_hooks";
-import { execSync, spawn, spawnSync } from "node:child_process";
 import os, { tmpdir } from "node:os";
 import pc from "picocolors";
 import wcwidth from "wcwidth";
-import { fileURLToPath, pathToFileURL } from "node:url";
 import { z } from "zod/v4";
 import crypto, { createHash, createPublicKey, randomUUID, verify } from "node:crypto";
 import YAML, { parse } from "yaml";
@@ -923,7 +923,7 @@ const createLogger = (deps = {}) => {
 const log = createLogger();
 //#endregion
 //#region src/version.ts
-const APP_VERSION = "0.2.5";
+const APP_VERSION = "0.2.7";
 //#endregion
 //#region src/commands/agent-connect.ts
 const commandText = (status) => [status.provider.loginCommand.command, ...status.provider.loginCommand.args].join(" ");
@@ -1209,7 +1209,7 @@ const AllowedOwner = z.object({
 	login: z.string().max(100)
 });
 const EntitlementClaims = z.object({
-	iss: z.literal(process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev"),
+	iss: z.literal("https://app.raigal.dev"),
 	sub: z.string(),
 	org_name: z.string(),
 	plan: z.enum(["trial", "active"]),
@@ -1266,6 +1266,8 @@ const requestApi = async (endpoint, options = {}) => {
 	};
 	if (options.token) headers.Authorization = `Bearer ${options.token}`;
 	if (options.oidcToken) headers["X-GitHub-OIDC"] = options.oidcToken;
+	const orgId = options.orgId || process.env.RAIGAL_ORG_ID;
+	if (orgId) headers["X-Raigal-Org-Id"] = orgId;
 	let body;
 	if (options.body !== void 0) {
 		headers["Content-Type"] = "application/json";
@@ -1327,11 +1329,12 @@ const pollDeviceToken = async (deviceCode) => {
 		throw err;
 	}
 };
-const fetchEntitlementFromApi = async (token, oidcToken) => {
+const fetchEntitlementFromApi = async (token, oidcToken, orgId) => {
 	const data = await requestApi("/v1/entitlement", {
 		method: "POST",
 		token: token || void 0,
-		oidcToken
+		oidcToken,
+		orgId
 	});
 	return EntitlementResponse.parse(data);
 };
@@ -1353,14 +1356,6 @@ const revokeSessionApi = async (token) => {
 const EMBEDDED_PUBLIC_KEYS = { rgl_key_2026_1: "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA69B+1w8c4yJpEURW4Ps2b4BZcoIzeBg3jkCfIo2n2eM=\n-----END PUBLIC KEY-----" };
 const keyObjectCache = /* @__PURE__ */ new Map();
 const getPublicKey = (kid) => {
-	if (process.env.RAIGAL_KEY_ID === kid && process.env.RAIGAL_PUBLIC_KEY) {
-		const customKey = process.env.RAIGAL_PUBLIC_KEY.replace(/\\n/g, "\n");
-		try {
-			return createPublicKey(customKey);
-		} catch {
-			return null;
-		}
-	}
 	const cached = keyObjectCache.get(kid);
 	if (cached) return cached;
 	const pem = EMBEDDED_PUBLIC_KEYS[kid];
@@ -1420,9 +1415,8 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const parsed = EntitlementClaims.safeParse(rawPayload);
 	if (!parsed.success) throw new JwtVerificationError(`Invalid entitlement claims: ${parsed.error.message}`, "invalid_claims");
 	const claims = parsed.data;
-	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
-	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.2.5", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (claims.iss !== "https://app.raigal.dev") throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
+	if (!isVersionAtLeast("0.2.7", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -1581,7 +1575,9 @@ const getEntitlement = async () => {
 		}
 	} else oidcToken = await fetchGitHubOidcToken();
 	try {
-		const response = await fetchEntitlementFromApi(activeToken?.token ?? "", oidcToken);
+		const tokenToPass = activeToken?.token ?? "";
+		const orgId = process.env.RAIGAL_ORG_ID;
+		const response = await fetchEntitlementFromApi(tokenToPass, oidcToken, orgId);
 		const claims = verifyEntitlementJwt(response.entitlement, { nowSeconds: now });
 		saveCachedEntitlement(response.entitlement, response.refresh_after);
 		return {
@@ -1595,7 +1591,7 @@ const getEntitlement = async () => {
 };
 //#endregion
 //#region src/cloud/owner.ts
-const GITHUB_REMOTE_RE$1 = /^(?:(?:git@|ssh:\/\/(?:git@)?)github\.com(?::(?:\d+\/)?|[:/])|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/\s]+?)(?:\.git)?\s*$/;
+const GENERIC_GIT_REMOTE_RE = /^(?:(?:git@|ssh:\/\/(?:git@)?)[^:/]+(?::(?:\d+\/)?|[:/])|https?:\/\/(?:[^@]+@)?[^/]+\/)([^/]+)\/([^/\s]+?)(?:\.git)?\s*$/;
 const parseGitRemote = (rawUrl) => {
 	if (!rawUrl) return {
 		owner: null,
@@ -1603,18 +1599,19 @@ const parseGitRemote = (rawUrl) => {
 		hasRemote: false,
 		isGitHubRemote: false
 	};
-	const match = rawUrl.match(GITHUB_REMOTE_RE$1);
+	const match = rawUrl.match(GENERIC_GIT_REMOTE_RE);
 	if (!match || !match[1] || !match[2]) return {
 		owner: null,
 		repo: null,
 		hasRemote: true,
 		isGitHubRemote: false
 	};
+	const isGitHub = rawUrl.includes("github.com");
 	return {
 		owner: match[1].toLowerCase(),
 		repo: match[2].toLowerCase(),
 		hasRemote: true,
-		isGitHubRemote: true
+		isGitHubRemote: isGitHub
 	};
 };
 const readGitConfigRemote = (dir) => {
@@ -1679,6 +1676,27 @@ const detectLocalRepoOwner = (directory) => {
 			isGitHubRemote: true
 		};
 	}
+	const gitlabRepo = process.env.CI_PROJECT_PATH?.trim();
+	if (gitlabRepo && gitlabRepo.includes("/")) {
+		const parts = gitlabRepo.split("/");
+		const repo = parts.pop() ?? "";
+		return {
+			owner: (parts[0] ?? "").toLowerCase(),
+			repo: repo.toLowerCase(),
+			hasRemote: true,
+			isGitHubRemote: false
+		};
+	}
+	const bitbucketRepo = (process.env.BITBUCKET_REPO_FULL_NAME || process.env.BITBUCKET_REPO_SLUG)?.trim();
+	if (bitbucketRepo) {
+		const [owner = process.env.BITBUCKET_WORKSPACE || "", repo = ""] = bitbucketRepo.includes("/") ? bitbucketRepo.split("/") : [process.env.BITBUCKET_WORKSPACE || "", bitbucketRepo];
+		return {
+			owner: owner.toLowerCase(),
+			repo: repo.toLowerCase(),
+			hasRemote: true,
+			isGitHubRemote: false
+		};
+	}
 	const gitRoot = findGitRoot$1(directory);
 	if (!gitRoot) return {
 		owner: null,
@@ -1690,26 +1708,17 @@ const detectLocalRepoOwner = (directory) => {
 	if (rawUrl !== null) return parseGitRemote(rawUrl);
 	return parseGitRemote(spawnGitRemote(gitRoot));
 };
-const isNonGitHubCi = () => {
-	const env = process.env;
-	if (!(env.CI === "true" || env.CI === "1")) return false;
-	return Boolean(env.GITLAB_CI || env.BITBUCKET_BUILD_NUMBER || env.CIRCLECI && !env.CIRCLE_PROJECT_REPONAME?.includes("/") || env.BUILDKITE || env.TRAVIS || env.JENKINS_URL);
-};
 const checkOwnerAgainstAllowlist = (detected, allowedOwners, tokenKind) => {
-	if (isNonGitHubCi()) return {
-		allowed: false,
-		reason: "Non-GitHub CI environments are unsupported under organization allowlists."
-	};
 	if (!detected.hasRemote) {
 		if (tokenKind === "session") return { allowed: true };
 		return {
 			allowed: false,
-			reason: "Repository has no GitHub remote. CI and API key runs require an origin remote matching an allowed organization."
+			reason: "Repository has no origin remote. CI and API key runs require an origin remote matching an allowed organization."
 		};
 	}
-	if (!detected.isGitHubRemote || !detected.owner) return {
+	if (!detected.owner) return {
 		allowed: false,
-		reason: "Repository remote is not hosted on GitHub or could not be determined."
+		reason: "Repository remote owner could not be determined."
 	};
 	const lowerOwner = detected.owner.toLowerCase();
 	if (!allowedOwners.some((allowed) => allowed.login.toLowerCase() === lowerOwner)) {
@@ -1717,7 +1726,7 @@ const checkOwnerAgainstAllowlist = (detected, allowedOwners, tokenKind) => {
 		return {
 			allowed: false,
 			owner: lowerOwner,
-			reason: `GitHub owner '${detected.owner}' is not on the organization allowlist (${allowedLogins || "none"}).`
+			reason: `Repository owner '${detected.owner}' is not on the organization allowlist (${allowedLogins || "none"}).`
 		};
 	}
 	return {
@@ -2805,8 +2814,8 @@ const detectGitContext = (directory) => {
 	const eventPayload = readGitHubEventPayload();
 	const pr = eventPayload?.pull_request;
 	let headSha = pr?.head?.sha;
-	if (!headSha) headSha = process.env.GITHUB_SHA || execGit(["rev-parse", "HEAD"], directory);
-	let branch = process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME;
+	if (!headSha) headSha = process.env.GITHUB_SHA || process.env.CI_COMMIT_SHA || process.env.BITBUCKET_COMMIT || execGit(["rev-parse", "HEAD"], directory);
+	let branch = process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME || process.env.CI_MERGE_REQUEST_SOURCE_BRANCH_NAME || process.env.CI_COMMIT_REF_NAME || process.env.BITBUCKET_BRANCH;
 	if (!branch) {
 		branch = execGit([
 			"rev-parse",
@@ -2815,7 +2824,7 @@ const detectGitContext = (directory) => {
 		], directory);
 		if (branch === "HEAD") branch = void 0;
 	}
-	let baseRef = pr?.base?.ref || process.env.GITHUB_BASE_REF;
+	let baseRef = pr?.base?.ref || process.env.GITHUB_BASE_REF || process.env.CI_MERGE_REQUEST_TARGET_BRANCH_NAME || process.env.BITBUCKET_PR_DESTINATION_BRANCH;
 	if (!baseRef) baseRef = void 0;
 	let prNumber;
 	if (typeof pr?.number === "number") prNumber = pr.number;
@@ -2823,6 +2832,12 @@ const detectGitContext = (directory) => {
 	else if (process.env.RAIGAL_PR_NUMBER || process.env.PR_NUMBER) {
 		const parsed = Number.parseInt(process.env.RAIGAL_PR_NUMBER || process.env.PR_NUMBER || "", 10);
 		if (!Number.isNaN(parsed) && parsed > 0) prNumber = parsed;
+	} else if (process.env.CI_MERGE_REQUEST_IID) {
+		const parsed = Number.parseInt(process.env.CI_MERGE_REQUEST_IID, 10);
+		if (!Number.isNaN(parsed) && parsed > 0) prNumber = parsed;
+	} else if (process.env.BITBUCKET_PR_ID) {
+		const parsed = Number.parseInt(process.env.BITBUCKET_PR_ID, 10);
+		if (!Number.isNaN(parsed) && parsed > 0) prNumber = parsed;
 	} else if (process.env.GITHUB_REF) {
 		const match = process.env.GITHUB_REF.match(/refs\/pull\/(\d+)(?:\/|$)/);
 		if (match && match[1]) prNumber = Number.parseInt(match[1], 10);
@@ -2879,7 +2894,31 @@ const detectCiContext = () => {
 			...runUrl ? { run_url: runUrl } : {}
 		};
 	}
-	if (process.env.CI === "true" || process.env.CI === "1") return { provider: process.env.GITLAB_CI && "gitlab-ci" || process.env.BITBUCKET_BUILD_NUMBER && "bitbucket-pipelines" || process.env.CIRCLECI && "circleci" || process.env.BUILDKITE && "buildkite" || process.env.TRAVIS && "travis-ci" || "generic-ci" };
+	if (process.env.GITLAB_CI) {
+		const runUrl = process.env.CI_JOB_URL || process.env.CI_PIPELINE_URL;
+		return {
+			provider: "gitlab-ci",
+			...runUrl ? { run_url: runUrl } : {}
+		};
+	}
+	if (process.env.BITBUCKET_BUILD_NUMBER) {
+		const workspace = process.env.BITBUCKET_WORKSPACE;
+		const repoSlug = process.env.BITBUCKET_REPO_SLUG;
+		const buildNumber = process.env.BITBUCKET_BUILD_NUMBER;
+		const runUrl = workspace && repoSlug && buildNumber ? `https://bitbucket.org/${workspace}/${repoSlug}/pipelines/results/${buildNumber}` : void 0;
+		return {
+			provider: "bitbucket-pipelines",
+			...runUrl ? { run_url: runUrl } : {}
+		};
+	}
+	if (process.env.CI === "true" || process.env.CI === "1") {
+		const provider = process.env.CIRCLECI && "circleci" || process.env.BUILDKITE && "buildkite" || process.env.TRAVIS && "travis-ci" || "generic-ci";
+		const runUrl = process.env.CIRCLE_BUILD_URL || process.env.BUILDKITE_BUILD_URL || process.env.TRAVIS_BUILD_WEB_URL;
+		return {
+			provider,
+			...runUrl ? { run_url: runUrl } : {}
+		};
+	}
 };
 //#endregion
 //#region src/cloud/outbox.ts
@@ -4791,10 +4830,53 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - uses: actions/setup-node@v4
         with:
           node-version: 22
       - run: npx --yes @methiu/raigal@latest ci .
+        env:
+          RAIGAL_TOKEN: \${{ secrets.RAIGAL_TOKEN }}
+          # RAIGAL_ORG_ID: \${{ vars.RAIGAL_ORG_ID }} # Optional: required if repository owner belongs to multiple Raigal organizations
+`;
+const DEFAULT_GITLAB_CI_FILE = ".gitlab-ci.yml";
+const DEFAULT_GITLAB_CI_YAML = `raigal_quality_gate:
+  image: node:24
+  stage: test
+  script:
+    - if [ -n "$CI_MERGE_REQUEST_IID" ]; then npx --yes @methiu/raigal@latest ci --changes --base "$CI_MERGE_REQUEST_DIFF_BASE_SHA"; else npx --yes @methiu/raigal@latest ci .; fi
+  variables:
+    RAIGAL_TOKEN: $RAIGAL_TOKEN
+    # RAIGAL_ORG_ID: $RAIGAL_ORG_ID # Optional: required if repository owner belongs to multiple Raigal organizations
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+`;
+const DEFAULT_BITBUCKET_FILE = "bitbucket-pipelines.yml";
+const DEFAULT_BITBUCKET_PIPELINES_YAML = `pipelines:
+  default:
+    - step:
+        name: raigal quality gate
+        image: node:24
+        script:
+          - npx --yes @methiu/raigal@latest ci .
+        secrets:
+          - RAIGAL_TOKEN
+          # - RAIGAL_ORG_ID
+  pull-requests:
+    "**":
+      - step:
+          name: raigal quality gate
+          image: node:24
+          clone:
+            depth: full
+          script:
+            - git fetch origin "$BITBUCKET_PR_DESTINATION_BRANCH"
+            - npx --yes @methiu/raigal@latest ci --changes --base FETCH_HEAD
+          secrets:
+            - RAIGAL_TOKEN
+            # - RAIGAL_ORG_ID
 `;
 const DEFAULT_RULES_YAML = `# Architecture rules (BYO)
 # Uncomment and customize to enforce your project's conventions.
@@ -8851,7 +8933,28 @@ const isSafeRegularProjectFile = (rootDirectory, absolutePath) => {
 		return false;
 	}
 };
-const hasAllowedSourceExtension = (filePath, extraExtensions) => SOURCE_EXTENSIONS$1.has(path.extname(filePath)) || extraExtensions.has(path.extname(filePath));
+const SECRET_CONFIG_EXTENSIONS = [
+	".env",
+	".yaml",
+	".yml",
+	".json",
+	".toml",
+	".ini",
+	".properties",
+	".tfvars"
+];
+const LOCKFILE_RE = /(?:^|\/)(?:package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|packages\.lock\.json|composer\.lock|bun\.lock)$/i;
+const isDotenvFile = (filePath) => {
+	const base = path.basename(filePath).toLowerCase();
+	return base === ".env" || base.startsWith(".env.");
+};
+const hasAllowedSourceExtension = (filePath, extraExtensions) => {
+	const extension = path.extname(filePath);
+	if (SOURCE_EXTENSIONS$1.has(extension)) return true;
+	if (LOCKFILE_RE.test(filePath)) return false;
+	if (extraExtensions.has(".env") && isDotenvFile(filePath)) return true;
+	return extraExtensions.has(extension);
+};
 const isInExcludedDirectory = (filePath, excludedDirectories) => {
 	const normalized = filePath.toLowerCase();
 	return excludedDirectories.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`) || normalized.includes(`/${directory}/`));
@@ -21223,13 +21326,19 @@ const SECRET_PATTERNS = [
 	},
 	{
 		pattern: /AKIA[0-9A-Z]{16}/g,
-		name: "AWS Access Key"
+		name: "AWS Access Key",
+		specific: true
 	},
 	{
-		pattern: /(?:aws[_-]?secret|secret[_-]?key)\s*[:=]\s*["']([A-Za-z0-9/+=]{40})["']/gi,
+		pattern: /(?:aws[_-]?secret(?:[_-]?access)?[_-]?key|secret[_-]?key)\s*[:=]\s*["']([A-Za-z0-9/+=]{40})["']/gi,
 		name: "AWS Secret Key",
 		keywordPrefixed: true
 	},
+	{
+		pattern: /\b(?:sk|rk)_live_[A-Za-z0-9]{20,}/g,
+		name: "Stripe secret key",
+		specific: true
+	},
 	{
 		pattern: /(?:password|passwd|pwd|secret)\s*[:=]\s*["']([^"']{8,})["']/gi,
 		name: "Hardcoded password/secret",
@@ -21237,11 +21346,13 @@ const SECRET_PATTERNS = [
 	},
 	{
 		pattern: /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/g,
-		name: "Private key"
+		name: "Private key",
+		specific: true
 	},
 	{
 		pattern: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
-		name: "JWT token"
+		name: "JWT token",
+		specific: true
 	},
 	{
 		pattern: /(?:token|bearer)\s*[:=]\s*["']([A-Za-z0-9_-]{20,})["']/gi,
@@ -21250,17 +21361,51 @@ const SECRET_PATTERNS = [
 	},
 	{
 		pattern: /gh[pousr]_[A-Za-z0-9_]{36,}/g,
-		name: "GitHub token"
+		name: "GitHub token",
+		specific: true
 	},
 	{
 		pattern: /xox[baprs]-[A-Za-z0-9-]+/g,
-		name: "Slack token"
+		name: "Slack token",
+		specific: true
 	},
 	{
 		pattern: /(?:mongodb(?:\+srv)?|postgres|mysql|redis):\/\/[^:@/"'`\s]+:[^@"'`\s]+@[^"'`\s]+/gi,
-		name: "Database connection string with credentials"
+		name: "Database connection string with credentials",
+		specific: true
 	}
 ];
+const FORMAT_PATTERNS = SECRET_PATTERNS.filter((p) => p.specific);
+const CONFIG_ASSIGNMENT_RE = /([A-Za-z0-9_.-]*(?:password|passwd|pwd|secret|token|api[_-]?key|apikey)[A-Za-z0-9_.-]*)["']?[ \t]*[:=][ \t]*["']?([^\s"'#,]+)/gi;
+const CONFIG_REFERENCE_KEY_RE = /(?:name|ref|path|file|arn|id|type|version|url|uri|length|count|env|header|field|prefix|policy|manager|store|provider)$/i;
+const CONFIG_REFERENCE_VALUE_RE = /^[<{$%]/;
+const CONFIG_PLACEHOLDER_VALUE_RE = /^(?:your|example|placeholder|redacted|dummy|xxx)/i;
+const VERSION_VALUE_RE = /^[~^<>=v]*\d+(?:\.\d+)+/;
+const CONFIG_LITERAL_VALUES = /* @__PURE__ */ new Set([
+	"true",
+	"false",
+	"null",
+	"none",
+	"nil"
+]);
+const isConfigFile = (filePath) => isDotenvFile(filePath) || SECRET_CONFIG_EXTENSIONS.includes(path.extname(filePath).toLowerCase());
+const DOTENV_TEMPLATE_RE = /^\.env\.(?:example|sample|template|dist|defaults)$/i;
+const isLocalDatabaseUrl = (value) => {
+	try {
+		return LOCAL_DB_HOSTS.has(new URL(value).hostname.toLowerCase());
+	} catch {
+		return false;
+	}
+};
+const configAssignmentName = (key) => {
+	const lower = key.toLowerCase();
+	if (/aws[_-]?secret/.test(lower)) return "AWS Secret Key";
+	if (/api[_-]?key|apikey/.test(lower)) return "API key";
+	if (/token/.test(lower) && !/password|passwd|pwd|secret/.test(lower)) return "Authentication token";
+	return "Hardcoded password/secret";
+};
+const URL_VALUE_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
+const isConfigValueIgnorable = (key, value) => value.length < 8 || URL_VALUE_RE.test(value) || CONFIG_REFERENCE_KEY_RE.test(key) || CONFIG_REFERENCE_VALUE_RE.test(value) || CONFIG_PLACEHOLDER_VALUE_RE.test(value) || VERSION_VALUE_RE.test(value) || CONFIG_LITERAL_VALUES.has(value.toLowerCase()) || isNonProductionCredentialValue(value);
 const isInsideStringLiteral = (content, matchIndex) => {
 	const lineStart = content.lastIndexOf("\n", matchIndex - 1) + 1;
 	const prefix = content.slice(lineStart, matchIndex);
@@ -21405,16 +21550,69 @@ const shouldSkipSecretFinding = (relativePath, name, lineText, matchedText) => {
 	if ((name === "Hardcoded password/secret" || name === "Authentication token") && isSymbolicConstantValue(matchedText)) return true;
 	return false;
 };
+const collectSourceCandidates = (content, relativePath) => {
+	const candidates = [];
+	for (const { pattern, name, keywordPrefixed, specific } of SECRET_PATTERNS) for (const match of content.matchAll(new RegExp(pattern.source, pattern.flags))) {
+		const matchedText = match[1] ?? match[0];
+		const lineText = lineForMatch(content, match.index);
+		if (isPlaceholderValue(matchedText)) continue;
+		if (shouldSkipSecretFinding(relativePath, name, lineText, matchedText)) continue;
+		if (keywordPrefixed && isInsideStringLiteral(content, match.index)) continue;
+		candidates.push({
+			name,
+			start: match.index,
+			end: match.index + match[0].length,
+			specific: Boolean(specific)
+		});
+	}
+	return candidates;
+};
+const collectConfigCandidates = (content, relativePath) => {
+	const candidates = [];
+	const template = DOTENV_TEMPLATE_RE.test(path.posix.basename(relativePath));
+	for (const { pattern, name } of FORMAT_PATTERNS) for (const match of content.matchAll(new RegExp(pattern.source, pattern.flags))) {
+		const lineText = lineForMatch(content, match.index);
+		if (isPlaceholderValue(match[0])) continue;
+		if (template && isLocalDatabaseUrl(match[0])) continue;
+		if (shouldSkipSecretFinding(relativePath, name, lineText, match[0])) continue;
+		candidates.push({
+			name,
+			start: match.index,
+			end: match.index + match[0].length,
+			specific: true
+		});
+	}
+	for (const match of content.matchAll(new RegExp(CONFIG_ASSIGNMENT_RE.source, CONFIG_ASSIGNMENT_RE.flags))) {
+		const [, key, value] = match;
+		const name = configAssignmentName(key);
+		const lineText = lineForMatch(content, match.index);
+		if (isConfigValueIgnorable(key, value) || isPlaceholderValue(value)) continue;
+		if (shouldSkipSecretFinding(relativePath, name, lineText, value)) continue;
+		candidates.push({
+			name,
+			start: match.index,
+			end: match.index + match[0].length,
+			specific: false
+		});
+	}
+	return candidates;
+};
+const dedupeCandidates = (candidates) => {
+	const ordered = [...candidates].sort((a, b) => Number(b.specific) - Number(a.specific) || a.start - b.start);
+	const kept = [];
+	for (const candidate of ordered) {
+		if (kept.some((k) => candidate.start < k.end && k.start < candidate.end)) continue;
+		kept.push(candidate);
+	}
+	return kept.sort((a, b) => a.start - b.start);
+};
+const resolveSecretFiles = (context) => {
+	const extras = [...SECRET_CONFIG_EXTENSIONS];
+	return context.secretFiles ? filterExplicitFiles(context.rootDirectory, context.secretFiles, extras) : getSourceFilesWithExtras(context, extras);
+};
 const scanSecrets = async (context) => {
-	const files = getSourceFilesWithExtras(context, [
-		".env",
-		".yaml",
-		".yml",
-		".json",
-		".toml"
-	]);
 	const diagnostics = [];
-	for (const filePath of files) {
+	for (const filePath of resolveSecretFiles(context)) {
 		let content;
 		try {
 			content = fs.readFileSync(filePath, "utf-8");
@@ -21423,30 +21621,20 @@ const scanSecrets = async (context) => {
 		}
 		content = maskComments(content, path.extname(filePath));
 		const relativePath = relativePosix(context.rootDirectory, filePath);
-		for (const { pattern, name, keywordPrefixed } of SECRET_PATTERNS) {
-			const regex = new RegExp(pattern.source, pattern.flags);
-			for (const match of content.matchAll(regex)) {
-				const matchedText = match[1] ?? match[0];
-				const lineText = lineForMatch(content, match.index);
-				if (isPlaceholderValue(matchedText)) continue;
-				if (shouldSkipSecretFinding(relativePath, name, lineText, matchedText)) continue;
-				if (keywordPrefixed && isInsideStringLiteral(content, match.index)) continue;
-				const line = content.slice(0, match.index).split("\n").length;
-				diagnostics.push({
-					filePath: relativePath,
-					engine: "security",
-					rule: "security/hardcoded-secret",
-					severity: "error",
-					message: `Possible ${name} detected in source code`,
-					help: "Move secrets to environment variables or a secrets manager",
-					line,
-					column: 0,
-					category: "Security",
-					fixable: false,
-					redactSource: true
-				});
-			}
-		}
+		const candidates = isConfigFile(filePath) ? collectConfigCandidates(content, relativePath) : collectSourceCandidates(content, relativePath);
+		for (const { name, start } of dedupeCandidates(candidates)) diagnostics.push({
+			filePath: relativePath,
+			engine: "security",
+			rule: "security/hardcoded-secret",
+			severity: "error",
+			message: `Possible ${name} detected in source code`,
+			help: "Move secrets to environment variables or a secrets manager",
+			line: content.slice(0, start).split("\n").length,
+			column: 0,
+			category: "Security",
+			fixable: false,
+			redactSource: true
+		});
 	}
 	return diagnostics;
 };
@@ -22658,13 +22846,21 @@ const runPiHook = async (deps = {}) => {
 		release();
 	}
 };
-const AISLOP_MD_BODY = `# Raigal - agent instructions
+//#endregion
+//#region src/hooks/assets.ts
+const buildRaigalMdBody = (agent) => {
+	let onEditSection;
+	if (agent === "claude") onEditSection = `A PostToolUse hook runs \`raigal hook claude\` after every Edit, Write, or MultiEdit. It scans the touched files and returns findings as JSON \`additionalContext\` shaped like \`RaigalFeedback\` (score, baseline, delta, regressed, counts, findings, newSinceBaseline, suggestedActions). Act on them the same turn; the \`suggestedActions\` field tells you exactly what to run next.`;
+	else if (agent === "gemini") onEditSection = `An AfterTool hook runs \`raigal hook gemini\` after file modifications. It scans the touched files and returns findings. Act on them the same turn; fix reported issues before completing.`;
+	else if (agent === "cursor") onEditSection = `An afterFileEdit hook runs \`raigal hook cursor\` after file modifications. It scans the touched files and reports quality findings. Fix reported errors and fixable warnings before completing your turn.`;
+	else onEditSection = `Raigal scans changed files and reports code quality, security, and AI pattern findings. Act on reported findings during your turn; fix errors and fixable warnings before completing your response.`;
+	return `# Raigal - agent instructions
 
 [Raigal](https://github.com/meethiu/raigal) is your guardrail for shipping clean, maintainable, production-grade code. It catches the patterns AI coding tools leave behind: dead imports, redundant code, duplicate logic, unsafe any-typed casts, narrative comments, swallowed errors, hidden fallbacks, oversized functions, risky security constructs - and grades the project out of 100 so regressions are visible. Treat its findings as blocking, not advisory: the goal is code a human maintainer would happily inherit.
 
 ## On every edit
 
-A PostToolUse hook runs \`raigal hook claude\` after every Edit, Write, or MultiEdit. It scans the touched files and returns findings as JSON \`additionalContext\` shaped like \`RaigalFeedback\` (score, baseline, delta, regressed, counts, findings, newSinceBaseline, suggestedActions). Act on them the same turn; the \`suggestedActions\` field tells you exactly what to run next.
+${onEditSection}
 
 ## Severity ladder
 
@@ -22684,15 +22880,17 @@ A PostToolUse hook runs \`raigal hook claude\` after every Edit, Write, or Multi
 - If a finding is a false positive, leave it and explain in your reply - do not delete the rule config.
 - The findings payload includes \`nextSteps[]\` - treat those as your plan for the turn.
 `;
+};
+buildRaigalMdBody("claude");
 //#endregion
 //#region src/hooks/io/sentinel.ts
 const sentinelHash = (content) => `sha256:${crypto.createHash("sha256").update(content).digest("hex").slice(0, 32)}`;
-const BEGIN_RE = /<!--\s*aislop:begin\s+v(\d+)(?:\s+hash=([^\s>]+))?\s*-->/;
-const END_RE = /<!--\s*aislop:end\s+v\d+\s*-->/;
+const BEGIN_RE = /<!--\s*(?:raigal|aislop):begin\s+v(\d+)(?:\s+hash=([^\s>]+))?\s*-->/;
+const END_RE = /<!--\s*(?:raigal|aislop):end\s+v\d+\s*-->/;
 const renderFence = (body, hash) => [
-	`<!-- aislop:begin v1 hash=${hash} -->`,
+	`<!-- raigal:begin v1 hash=${hash} -->`,
 	body.trimEnd(),
-	"<!-- aislop:end v1 -->"
+	"<!-- raigal:end v1 -->"
 ].join("\n");
 const upsertMarkdownFence = (existing, body, hash) => {
 	const fenced = renderFence(body, hash);
@@ -22757,11 +22955,20 @@ const applyRemoval = (result, opts, target, nextContent) => {
 //#region src/hooks/install/rules-only.ts
 const installRulesOnly = (opts, paths, summary) => {
 	const result = emptyResult();
-	const next = upsertMarkdownFence(readIfExists(paths.rules), AISLOP_MD_BODY, sentinelHash(AISLOP_MD_BODY)).nextContent;
+	const body = paths.body ?? buildRaigalMdBody();
+	const next = upsertMarkdownFence(readIfExists(paths.rules) ?? (paths.legacyRules ? readIfExists(paths.legacyRules) : null), body, sentinelHash(body)).nextContent;
 	applyContent(result, opts, paths.rules, next, summary);
+	if (paths.legacyRules && readIfExists(paths.legacyRules) != null) {
+		if (!opts.dryRun) try {
+			fs.rmSync(paths.legacyRules, { force: true });
+		} catch {}
+	}
 	if (paths.host && paths.marker) {
 		const host = readIfExists(paths.host) ?? "";
-		if (!host.includes(paths.marker)) {
+		if (paths.legacyMarker && host.includes(paths.legacyMarker)) {
+			const migrated = host.split("\n").map((l) => l.trim() === paths.legacyMarker ? paths.marker : l).join("\n");
+			applyContent(result, opts, paths.host, migrated, `update ${paths.marker} reference`);
+		} else if (!host.includes(paths.marker)) {
 			const joiner = host.endsWith("\n") || host.length === 0 ? "" : "\n";
 			const prefix = host.length === 0 ? "" : `${host}${joiner}\n`;
 			applyContent(result, opts, paths.host, `${prefix}${paths.marker}\n`, `append ${paths.marker} reference`);
@@ -22774,30 +22981,41 @@ const uninstallRulesOnly = (opts, paths) => {
 		removed: [],
 		skipped: []
 	};
-	if (readIfExists(paths.rules) != null) applyRemoval(result, opts, paths.rules, null);
-	else result.skipped.push(paths.rules);
-	if (paths.host && paths.marker) {
+	let removedRule = false;
+	if (readIfExists(paths.rules) != null) {
+		applyRemoval(result, opts, paths.rules, null);
+		removedRule = true;
+	}
+	if (paths.legacyRules && readIfExists(paths.legacyRules) != null) {
+		applyRemoval(result, opts, paths.legacyRules, null);
+		removedRule = true;
+	}
+	if (!removedRule) result.skipped.push(paths.rules);
+	if (paths.host && (paths.marker || paths.legacyMarker)) {
 		const host = readIfExists(paths.host);
-		if (host?.includes(paths.marker)) {
-			const stripped = host.split("\n").filter((l) => l.trim() !== paths.marker).join("\n").replace(/\n{3,}/g, "\n\n").trim();
+		if (host && (paths.marker && host.includes(paths.marker) || paths.legacyMarker && host.includes(paths.legacyMarker))) {
+			const stripped = host.split("\n").filter((l) => l.trim() !== paths.marker && l.trim() !== paths.legacyMarker).join("\n").replace(/\n{3,}/g, "\n\n").trim();
 			applyRemoval(result, opts, paths.host, stripped.length === 0 ? null : `${stripped}\n`);
-		} else result.skipped.push(paths.host);
+		} else if (paths.host) result.skipped.push(paths.host);
 	}
 	return result;
 };
 //#endregion
 //#region src/hooks/install/antigravity.ts
-const resolveAntigravityPaths = (opts) => ({ rules: path.join(opts.cwd, ".agents", "rules", "antigravity-aislop-rules.md") });
+const resolveAntigravityPaths = (opts) => ({
+	rules: path.join(opts.cwd, ".agents", "rules", "antigravity-raigal-rules.md"),
+	legacyRules: path.join(opts.cwd, ".agents", "rules", "antigravity-aislop-rules.md")
+});
 const installAntigravity = (opts) => {
 	if (opts.scope !== "project") return {
 		wrote: [],
 		skipped: [],
 		planned: [{
-			path: ".agents/rules/antigravity-aislop-rules.md",
+			path: ".agents/rules/antigravity-raigal-rules.md",
 			summary: "Antigravity is project-scope only; pass --project"
 		}]
 	};
-	return installRulesOnly(opts, resolveAntigravityPaths(opts), "write .agents/rules/antigravity-aislop-rules.md");
+	return installRulesOnly(opts, resolveAntigravityPaths(opts), "write .agents/rules/antigravity-raigal-rules.md");
 };
 const uninstallAntigravity = (opts) => {
 	if (opts.scope !== "project") return {
@@ -22806,9 +23024,7 @@ const uninstallAntigravity = (opts) => {
 	};
 	return uninstallRulesOnly(opts, resolveAntigravityPaths(opts));
 };
-//#endregion
-//#region src/hooks/io/json-patch.ts
-const AISLOP_SENTINEL_KEY = "__aislop";
+const RAIGAL_SENTINEL_KEY = "__raigal";
 const isAislopManaged = (x) => typeof x === "object" && x !== null && ("__aislop" in x && x["__aislop"] != null || "__raigal" in x && x["__raigal"] != null);
 const groupIsAislop = (group) => {
 	if (typeof group !== "object" || group === null) return false;
@@ -22858,6 +23074,7 @@ const resolveClaudePaths = (opts) => {
 	const root = opts.scope === "project" ? path.join(opts.cwd, ".claude") : path.join(opts.home, ".claude");
 	return {
 		settings: path.join(root, "settings.json"),
+		raigalMd: path.join(root, "RAIGAL.md"),
 		aislopMd: path.join(root, "AISLOP.md"),
 		claudeMd: path.join(root, "CLAUDE.md")
 	};
@@ -22872,7 +23089,7 @@ const buildHookGroup$1 = () => {
 		hooks: [{
 			type: "command",
 			command: "raigal hook claude",
-			[AISLOP_SENTINEL_KEY]: {
+			[RAIGAL_SENTINEL_KEY]: {
 				v: 1,
 				managed: true,
 				hash: sentinelHash(hashBody)
@@ -22887,7 +23104,7 @@ const buildStopHookGroup = () => {
 		hooks: [{
 			type: "command",
 			command: "raigal hook claude --stop",
-			[AISLOP_SENTINEL_KEY]: {
+			[RAIGAL_SENTINEL_KEY]: {
 				v: 1,
 				managed: true,
 				hash: sentinelHash(hashBody)
@@ -22906,7 +23123,7 @@ const buildFileChangedHookGroup = () => {
 		hooks: [{
 			type: "command",
 			command: "raigal hook claude --on-file-changed",
-			[AISLOP_SENTINEL_KEY]: {
+			[RAIGAL_SENTINEL_KEY]: {
 				v: 1,
 				managed: true,
 				hash: sentinelHash(hashBody)
@@ -22932,15 +23149,25 @@ const installClaude = (opts) => {
 	const result = emptyResult();
 	const nextSettings = renderSettings$1(readIfExists(paths.settings), Boolean(opts.qualityGate));
 	applyContent(result, opts, paths.settings, nextSettings, "register PostToolUse + FileChanged hooks");
-	const mdHash = sentinelHash(AISLOP_MD_BODY);
-	const fenced = upsertMarkdownFence(readIfExists(paths.aislopMd), AISLOP_MD_BODY, mdHash);
-	applyContent(result, opts, paths.aislopMd, fenced.nextContent, "write AISLOP.md rules");
+	const body = buildRaigalMdBody("claude");
+	const mdHash = sentinelHash(body);
+	const fenced = upsertMarkdownFence(readIfExists(paths.raigalMd) ?? readIfExists(paths.aislopMd), body, mdHash);
+	applyContent(result, opts, paths.raigalMd, fenced.nextContent, "write RAIGAL.md rules");
+	if (paths.raigalMd !== paths.aislopMd && readIfExists(paths.aislopMd) != null) {
+		if (!opts.dryRun) try {
+			fs.rmSync(paths.aislopMd, { force: true });
+		} catch {}
+	}
 	const existingClaudeMd = readIfExists(paths.claudeMd) ?? "";
-	const marker = "@AISLOP.md";
-	if (!existingClaudeMd.includes(marker)) {
+	const marker = "@RAIGAL.md";
+	const legacyMarker = "@AISLOP.md";
+	if (existingClaudeMd.includes(legacyMarker)) {
+		const migrated = existingClaudeMd.split("\n").map((line) => line.trim() === legacyMarker ? marker : line).join("\n");
+		applyContent(result, opts, paths.claudeMd, migrated, "update @RAIGAL.md reference");
+	} else if (!existingClaudeMd.includes(marker)) {
 		const joiner = existingClaudeMd.endsWith("\n") || existingClaudeMd.length === 0 ? "" : "\n";
 		const prefix = existingClaudeMd.length === 0 ? "" : `${existingClaudeMd}${joiner}\n`;
-		applyContent(result, opts, paths.claudeMd, `${prefix}${marker}\n`, "append @AISLOP.md reference");
+		applyContent(result, opts, paths.claudeMd, `${prefix}${marker}\n`, "append @RAIGAL.md reference");
 	} else result.skipped.push(paths.claudeMd);
 	return result;
 };
@@ -22969,11 +23196,19 @@ const uninstallClaude = (opts) => {
 		if (!stillHasHooks && otherKeys.length === 0) applyRemoval(result, opts, paths.settings, null);
 		else applyRemoval(result, opts, paths.settings, `${JSON.stringify(stripped, null, 2)}\n`);
 	} else result.skipped.push(paths.settings);
-	if (readIfExists(paths.aislopMd) != null) applyRemoval(result, opts, paths.aislopMd, null);
-	else result.skipped.push(paths.aislopMd);
+	let removedMd = false;
+	if (readIfExists(paths.raigalMd) != null) {
+		applyRemoval(result, opts, paths.raigalMd, null);
+		removedMd = true;
+	}
+	if (readIfExists(paths.aislopMd) != null) {
+		applyRemoval(result, opts, paths.aislopMd, null);
+		removedMd = true;
+	}
+	if (!removedMd) result.skipped.push(paths.raigalMd);
 	const claudeMd = readIfExists(paths.claudeMd);
-	if (claudeMd?.includes("@AISLOP.md")) {
-		const stripped = claudeMd.split("\n").filter((line) => line.trim() !== "@AISLOP.md").join("\n").replace(/\n{3,}/g, "\n\n").trim();
+	if (claudeMd?.includes("@RAIGAL.md") || claudeMd?.includes("@AISLOP.md")) {
+		const stripped = claudeMd.split("\n").filter((line) => line.trim() !== "@RAIGAL.md" && line.trim() !== "@AISLOP.md").join("\n").replace(/\n{3,}/g, "\n\n").trim();
 		applyRemoval(result, opts, paths.claudeMd, stripped.length === 0 ? null : `${stripped}\n`);
 	} else result.skipped.push(paths.claudeMd);
 	return result;
@@ -22981,7 +23216,10 @@ const uninstallClaude = (opts) => {
 //#endregion
 //#region src/hooks/install/cline.ts
 const resolveClinePaths = (opts) => ({ rules: path.join(opts.cwd, ".clinerules") });
-const resolveRooPaths = (opts) => ({ rules: path.join(opts.cwd, ".roo", "rules", "aislop.md") });
+const resolveRooPaths = (opts) => ({
+	rules: path.join(opts.cwd, ".roo", "rules", "raigal.md"),
+	legacyRules: path.join(opts.cwd, ".roo", "rules", "aislop.md")
+});
 const installCline = (opts) => {
 	if (opts.scope !== "project") return {
 		wrote: [],
@@ -22992,7 +23230,7 @@ const installCline = (opts) => {
 		}]
 	};
 	const cline = installRulesOnly(opts, resolveClinePaths(opts), "write .clinerules");
-	const roo = installRulesOnly(opts, resolveRooPaths(opts), "write .roo/rules/aislop.md");
+	const roo = installRulesOnly(opts, resolveRooPaths(opts), "write .roo/rules/raigal.md");
 	return {
 		wrote: [...cline.wrote, ...roo.wrote],
 		skipped: [...cline.skipped, ...roo.skipped],
@@ -23043,7 +23281,8 @@ const resolveCursorPaths = (opts) => {
 	const root = opts.scope === "project" ? path.join(opts.cwd, ".cursor") : path.join(opts.home, ".cursor");
 	return {
 		hooks: path.join(root, "hooks.json"),
-		rules: path.join(opts.cwd, ".cursor", "rules", "aislop.mdc")
+		rules: path.join(opts.cwd, ".cursor", "rules", "raigal.mdc"),
+		legacyRules: path.join(opts.cwd, ".cursor", "rules", "aislop.mdc")
 	};
 };
 const buildHookEntry = () => {
@@ -23055,7 +23294,7 @@ const buildHookEntry = () => {
 		command: "raigal hook cursor",
 		type: "command",
 		timeout: 5e3,
-		[AISLOP_SENTINEL_KEY]: {
+		[RAIGAL_SENTINEL_KEY]: {
 			v: 1,
 			managed: true,
 			hash: sentinelHash(hashBody)
@@ -23079,8 +23318,14 @@ const installCursor = (opts) => {
 	const nextHooks = renderHooksJson(readIfExists(paths.hooks));
 	applyContent(result, opts, paths.hooks, nextHooks, "register afterFileEdit hook");
 	if (opts.scope === "project") {
-		const rules = upsertMarkdownFence(readIfExists(paths.rules), AISLOP_MD_BODY, sentinelHash(AISLOP_MD_BODY)).nextContent;
-		applyContent(result, opts, paths.rules, rules, "write .cursor/rules/aislop.mdc");
+		const body = buildRaigalMdBody("cursor");
+		const rules = upsertMarkdownFence(readIfExists(paths.rules) ?? (paths.legacyRules ? readIfExists(paths.legacyRules) : null), body, sentinelHash(body)).nextContent;
+		applyContent(result, opts, paths.rules, rules, "write .cursor/rules/raigal.mdc");
+		if (paths.legacyRules && readIfExists(paths.legacyRules) != null) {
+			if (!opts.dryRun) try {
+				fs.rmSync(paths.legacyRules, { force: true });
+			} catch {}
+		}
 	}
 	return result;
 };
@@ -23104,7 +23349,18 @@ const uninstallCursor = (opts) => {
 		if (!stillHasHooks && otherKeys.length === 0) applyRemoval(result, opts, paths.hooks, null);
 		else applyRemoval(result, opts, paths.hooks, `${JSON.stringify(stripped, null, 2)}\n`);
 	} else result.skipped.push(paths.hooks);
-	if (opts.scope === "project") applyRemoval(result, opts, paths.rules, null);
+	if (opts.scope === "project") {
+		let removedRule = false;
+		if (readIfExists(paths.rules) != null) {
+			applyRemoval(result, opts, paths.rules, null);
+			removedRule = true;
+		}
+		if (paths.legacyRules && readIfExists(paths.legacyRules) != null) {
+			applyRemoval(result, opts, paths.legacyRules, null);
+			removedRule = true;
+		}
+		if (!removedRule) result.skipped.push(paths.rules);
+	}
 	return result;
 };
 //#endregion
@@ -23113,6 +23369,7 @@ const resolveGeminiPaths = (opts) => {
 	const root = opts.scope === "project" ? path.join(opts.cwd, ".gemini") : path.join(opts.home, ".gemini");
 	return {
 		settings: path.join(root, "settings.json"),
+		raigalMd: path.join(root, "RAIGAL.md"),
 		aislopMd: path.join(root, "AISLOP.md"),
 		geminiMd: path.join(root, "GEMINI.md")
 	};
@@ -23129,7 +23386,7 @@ const buildHookGroup = () => {
 			type: "command",
 			command: "raigal hook gemini",
 			timeout: 5e3,
-			[AISLOP_SENTINEL_KEY]: {
+			[RAIGAL_SENTINEL_KEY]: {
 				v: 1,
 				managed: true,
 				hash: sentinelHash(hashBody)
@@ -23152,14 +23409,25 @@ const installGemini = (opts) => {
 	const result = emptyResult();
 	const next = renderSettings(readIfExists(paths.settings));
 	applyContent(result, opts, paths.settings, next, "register AfterTool hook");
-	const fenced = upsertMarkdownFence(readIfExists(paths.aislopMd), AISLOP_MD_BODY, sentinelHash(AISLOP_MD_BODY)).nextContent;
-	applyContent(result, opts, paths.aislopMd, fenced, "write AISLOP.md rules");
+	const body = buildRaigalMdBody("gemini");
+	const hash = sentinelHash(body);
+	const fenced = upsertMarkdownFence(readIfExists(paths.raigalMd) ?? readIfExists(paths.aislopMd), body, hash).nextContent;
+	applyContent(result, opts, paths.raigalMd, fenced, "write RAIGAL.md rules");
+	if (paths.raigalMd !== paths.aislopMd && readIfExists(paths.aislopMd) != null) {
+		if (!opts.dryRun) try {
+			fs.rmSync(paths.aislopMd, { force: true });
+		} catch {}
+	}
 	const existingGeminiMd = readIfExists(paths.geminiMd) ?? "";
-	const marker = "@AISLOP.md";
-	if (!existingGeminiMd.includes(marker)) {
+	const marker = "@RAIGAL.md";
+	const legacyMarker = "@AISLOP.md";
+	if (existingGeminiMd.includes(legacyMarker)) {
+		const migrated = existingGeminiMd.split("\n").map((l) => l.trim() === legacyMarker ? marker : l).join("\n");
+		applyContent(result, opts, paths.geminiMd, migrated, "update @RAIGAL.md reference");
+	} else if (!existingGeminiMd.includes(marker)) {
 		const joiner = existingGeminiMd.endsWith("\n") || existingGeminiMd.length === 0 ? "" : "\n";
 		const prefix = existingGeminiMd.length === 0 ? "" : `${existingGeminiMd}${joiner}\n`;
-		applyContent(result, opts, paths.geminiMd, `${prefix}${marker}\n`, "append @AISLOP.md reference");
+		applyContent(result, opts, paths.geminiMd, `${prefix}${marker}\n`, "append @RAIGAL.md reference");
 	} else result.skipped.push(paths.geminiMd);
 	return result;
 };
@@ -23183,28 +23451,39 @@ const uninstallGemini = (opts) => {
 		if (!stillHasHooks && otherKeys.length === 0) applyRemoval(result, opts, paths.settings, null);
 		else applyRemoval(result, opts, paths.settings, `${JSON.stringify(stripped, null, 2)}\n`);
 	} else result.skipped.push(paths.settings);
-	if (readIfExists(paths.aislopMd) != null) applyRemoval(result, opts, paths.aislopMd, null);
-	else result.skipped.push(paths.aislopMd);
+	let removedMd = false;
+	if (readIfExists(paths.raigalMd) != null) {
+		applyRemoval(result, opts, paths.raigalMd, null);
+		removedMd = true;
+	}
+	if (readIfExists(paths.aislopMd) != null) {
+		applyRemoval(result, opts, paths.aislopMd, null);
+		removedMd = true;
+	}
+	if (!removedMd) result.skipped.push(paths.raigalMd);
 	const geminiMd = readIfExists(paths.geminiMd);
-	if (geminiMd?.includes("@AISLOP.md")) {
-		const stripped = geminiMd.split("\n").filter((l) => l.trim() !== "@AISLOP.md").join("\n").replace(/\n{3,}/g, "\n\n").trim();
+	if (geminiMd?.includes("@RAIGAL.md") || geminiMd?.includes("@AISLOP.md")) {
+		const stripped = geminiMd.split("\n").filter((l) => l.trim() !== "@RAIGAL.md" && l.trim() !== "@AISLOP.md").join("\n").replace(/\n{3,}/g, "\n\n").trim();
 		applyRemoval(result, opts, paths.geminiMd, stripped.length === 0 ? null : `${stripped}\n`);
 	} else result.skipped.push(paths.geminiMd);
 	return result;
 };
 //#endregion
 //#region src/hooks/install/kilocode.ts
-const resolveKilocodePaths = (opts) => ({ rules: path.join(opts.cwd, ".kilocode", "rules", "aislop-rules.md") });
+const resolveKilocodePaths = (opts) => ({
+	rules: path.join(opts.cwd, ".kilocode", "rules", "raigal-rules.md"),
+	legacyRules: path.join(opts.cwd, ".kilocode", "rules", "aislop-rules.md")
+});
 const installKilocode = (opts) => {
 	if (opts.scope !== "project") return {
 		wrote: [],
 		skipped: [],
 		planned: [{
-			path: ".kilocode/rules/aislop-rules.md",
+			path: ".kilocode/rules/raigal-rules.md",
 			summary: "Kilo Code is project-scope only; pass --project"
 		}]
 	};
-	return installRulesOnly(opts, resolveKilocodePaths(opts), "write .kilocode/rules/aislop-rules.md");
+	return installRulesOnly(opts, resolveKilocodePaths(opts), "write .kilocode/rules/raigal-rules.md");
 };
 const uninstallKilocode = (opts) => {
 	if (opts.scope !== "project") return {
@@ -23358,18 +23637,24 @@ const paths = {
 		const p = resolveClaudePaths(opts);
 		return [
 			p.settings,
+			p.raigalMd,
 			p.aislopMd,
 			p.claudeMd
 		];
 	},
 	cursor: (opts) => {
 		const p = resolveCursorPaths(opts);
-		return opts.scope === "project" ? [p.hooks, p.rules] : [p.hooks];
+		return opts.scope === "project" ? [
+			p.hooks,
+			p.rules,
+			...p.legacyRules ? [p.legacyRules] : []
+		] : [p.hooks];
 	},
 	gemini: (opts) => {
 		const p = resolveGeminiPaths(opts);
 		return [
 			p.settings,
+			p.raigalMd,
 			p.aislopMd,
 			p.geminiMd
 		];
@@ -23377,9 +23662,22 @@ const paths = {
 	pi: (opts) => [resolvePiPaths(opts).extension],
 	codex: (opts) => [resolveCodexPaths(opts).rules],
 	windsurf: (opts) => [resolveWindsurfPaths(opts).rules],
-	cline: (opts) => [resolveClinePaths(opts).rules, resolveRooPaths(opts).rules],
-	kilocode: (opts) => [resolveKilocodePaths(opts).rules],
-	antigravity: (opts) => [resolveAntigravityPaths(opts).rules],
+	cline: (opts) => {
+		const roo = resolveRooPaths(opts);
+		return [
+			resolveClinePaths(opts).rules,
+			roo.rules,
+			...roo.legacyRules ? [roo.legacyRules] : []
+		];
+	},
+	kilocode: (opts) => {
+		const k = resolveKilocodePaths(opts);
+		return [k.rules, ...k.legacyRules ? [k.legacyRules] : []];
+	},
+	antigravity: (opts) => {
+		const a = resolveAntigravityPaths(opts);
+		return [a.rules, ...a.legacyRules ? [a.legacyRules] : []];
+	},
 	copilot: (opts) => [resolveCopilotPaths(opts).rules]
 };
 const REGISTRY = {
@@ -25030,7 +25328,7 @@ const maybeNotifyUpdate = async (now = Date.now()) => {
 	if (!process.stderr.isTTY) return;
 	const cachePath = resolveUpdateCachePath();
 	const cache = readCache(cachePath);
-	if (cache && isOutdated("0.2.5", cache.latest)) process.stderr.write(formatUpdateNotice(APP_VERSION, cache.latest));
+	if (cache && isOutdated("0.2.7", cache.latest)) process.stderr.write(formatUpdateNotice(APP_VERSION, cache.latest));
 	if (!cache || now - cache.checkedAt > CHECK_INTERVAL_MS) {
 		const latest = await fetchLatestVersion$1();
 		if (latest) writeCache(cachePath, {
@@ -25304,6 +25602,10 @@ const COMMAND_REFERENCE = [
 		summary: "Stop a running background agent session",
 		flags: ["--root <directory>", "--force"]
 	},
+	{
+		command: "raigal mcp",
+		summary: "Run the Model Context Protocol (MCP) server over stdio"
+	},
 	{
 		command: "raigal ci [directory]",
 		summary: "Run the CI quality gate with thresholded exit codes",
@@ -25483,6 +25785,7 @@ const commandGroupLabel = (command) => {
 	if (command.startsWith("raigal scan")) return "Core Workflow";
 	if (command.startsWith("raigal fix")) return "Core Workflow";
 	if (command.startsWith("raigal ci")) return "Core Workflow";
+	if (command.startsWith("raigal mcp")) return "Local Agent";
 	if (command.startsWith("raigal hook")) return "Hooks";
 	if (command === "raigal hooks") return "Hooks";
 	if (command.startsWith("raigal install")) return "Hooks";
@@ -25550,7 +25853,7 @@ const renderCommandGroup = (group, commandWidth) => {
 	return lines;
 };
 const renderCommandReference = (input = {}) => {
-	const version = input.version ?? "0.2.5";
+	const version = input.version ?? "0.2.7";
 	const commandWidth = Math.max(...COMMAND_REFERENCE.map((item) => item.command.length));
 	const lines = [renderHeader({
 		version,
@@ -25773,7 +26076,7 @@ const renderHelpDetails = () => [
 ].map((line) => highlightRaigal(line, theme)).join("\n");
 const renderHome = (input = {}) => {
 	let out = renderHeader({
-		version: input.version ?? "0.2.5",
+		version: input.version ?? "0.2.7",
 		command: "--bare",
 		context: []
 	});
@@ -26444,12 +26747,13 @@ const baseRefExists = (cwd, ref) => {
 	return !result.error && result.status === 0;
 };
 const getChangedFiles = (cwd, base) => {
+	const trimmedBase = base?.trim();
 	const diff = spawnSync("git", [
 		"diff",
 		"--no-color",
 		"--name-only",
 		"--diff-filter=ACMR",
-		base ?? "HEAD"
+		trimmedBase && trimmedBase.length > 0 ? trimmedBase : "HEAD"
 	], {
 		cwd,
 		encoding: "utf-8",
@@ -26501,13 +26805,14 @@ const listUntrackedFiles = (cwd) => {
 	return untracked.stdout.split("\n").filter((line) => line.length > 0);
 };
 const getChangedLineMap = (cwd, base) => {
+	const trimmedBase = base?.trim();
 	const diff = spawnSync("git", [
 		"diff",
 		"--no-color",
 		"--no-ext-diff",
 		"-U0",
 		"--diff-filter=ACMR",
-		base ?? "HEAD"
+		trimmedBase && trimmedBase.length > 0 ? trimmedBase : "HEAD"
 	], {
 		cwd,
 		encoding: "utf-8",
@@ -26518,22 +26823,10 @@ const getChangedLineMap = (cwd, base) => {
 	return map;
 };
 //#endregion
-//#region src/commands/scan-hook-nudge.ts
-const shouldShowHookNudge = (ctx) => ctx.isTty && !ctx.isCi && ctx.installedAgentCount === 0;
-const buildHookNudge = (ctx) => {
-	if (!shouldShowHookNudge(ctx)) return null;
-	return [
-		"",
-		"Next: install the per-edit hook so your coding agent fixes slop before it lands.",
-		ctx.invocation === "raigal" ? "  raigal hook install" : "  npm install -g @methiu/raigal && raigal hook install",
-		""
-	].join("\n");
-};
-//#endregion
 //#region src/commands/scan-coverage.ts
 const coverageReason = (c) => {
 	if (c.supportedFiles === 0 && c.dominantUnsupported) return `This repository is ${c.dominantUnsupported} (${c.unsupportedFiles} files), which Raigal does not analyze. No score — it would not reflect this code.`;
-	if (c.supportedFiles === 0) return "No files in a language Raigal analyzes (TypeScript, JavaScript, Python, Go, Rust, Ruby, PHP, Java). Nothing to score.";
+	if (c.supportedFiles === 0) return "No files in a language Raigal analyzes (TypeScript, JavaScript, Python, Go, Rust, Ruby, PHP, C#, C/C++). Nothing to score.";
 	const lang = c.dominantUnsupported ?? "an unsupported language";
 	const files = `${c.supportedFiles} supported file${c.supportedFiles === 1 ? "" : "s"}`;
 	return `This repository is mostly ${lang} (${c.unsupportedFiles} files); Raigal analyzed only ${files}. Score withheld — it would represent a sliver of the codebase.`;
@@ -26772,20 +27065,36 @@ const collectScanFileScope = (request) => {
 		projectFiles: [.../* @__PURE__ */ new Set([...projectSourceFiles, ...declarations])],
 		scoreFileCount: projectSourceFiles.length + projectTestFiles.length,
 		scopeLabel: candidates.label,
+		secretFiles: filterEnumeratedProjectFiles(request.rootDirectory, candidates.files, [...SECRET_CONFIG_EXTENSIONS], request.excludePatterns, request.includePatterns),
 		testFiles
 	};
 };
 //#endregion
+//#region src/commands/scan-hook-nudge.ts
+const shouldShowHookNudge = (ctx) => ctx.isTty && !ctx.isCi && ctx.installedAgentCount === 0;
+const buildHookNudge = (ctx) => {
+	if (!shouldShowHookNudge(ctx)) return null;
+	return [
+		"",
+		"Next: install the per-edit hook so your coding agent fixes slop before it lands.",
+		ctx.invocation === "raigal" ? "  raigal hook install" : "  npm install -g @methiu/raigal && raigal hook install",
+		""
+	].join("\n");
+};
+//#endregion
 //#region src/commands/scan-options.ts
 const isMachineOutput = (options) => Boolean(options.json) || Boolean(options.sarif);
 const isHistoryComparableScan = (options) => !options.staged && !options.changes && options.command !== "ci";
 const isFullProjectScan = (options) => isHistoryComparableScan(options) && !options.include?.length && !options.exclude?.length;
 const resolveScanScopeMode = (options) => {
 	if (options.staged) return { kind: "staged" };
-	if (options.changes) return options.base ? {
-		kind: "changes",
-		base: options.base
-	} : { kind: "changes" };
+	if (options.changes) {
+		const base = options.base?.trim();
+		return base ? {
+			kind: "changes",
+			base
+		} : { kind: "changes" };
+	}
 	return { kind: "full" };
 };
 //#endregion
@@ -27144,7 +27453,8 @@ const buildScanRender = (input) => {
 const scanTargetError = (resolvedDir, options) => {
 	if (!fs.existsSync(resolvedDir)) return `Path does not exist: ${resolvedDir}`;
 	if (!fs.statSync(resolvedDir).isDirectory()) return `Not a directory: ${resolvedDir}`;
-	if (options.changes && options.base && !baseRefExists(resolvedDir, options.base)) return `Could not resolve base ref "${options.base}". Make sure it exists and was fetched (e.g. \`git fetch origin ${options.base}\`).`;
+	const base = options.base?.trim();
+	if (options.changes && base && !baseRefExists(resolvedDir, base)) return `Could not resolve base ref "${base}". Make sure it exists and was fetched (e.g. \`git fetch origin ${base}\`).`;
 	return null;
 };
 //#endregion
@@ -27216,7 +27526,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 	const projectName = projectInfo.projectName ?? "project";
 	const language = projectInfo.languages[0] ?? "unknown";
 	const printedHumanHeader = !machineOutput && showHeader;
-	const { dependencyAuditFiles, dependencyAuditScope, files, projectFiles, scoreFileCount, scopeLabel, testFiles } = scanScope;
+	const { dependencyAuditFiles, dependencyAuditScope, files, projectFiles, scoreFileCount, scopeLabel, secretFiles, testFiles } = scanScope;
 	const excludePatterns = [...config.exclude, ...readAislopIgnorePatterns(resolvedDir)];
 	const scanCoverage = deriveScanCoverage(projectInfo.coverage, scoreFileCount);
 	const reportProjectInfo = {
@@ -27257,6 +27567,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		excludePatterns,
 		testFiles,
 		projectFiles,
+		secretFiles,
 		installedTools: projectInfo.installedTools,
 		config: engineConfig
 	}, config.engines, machineOutput)).map((result) => ({
@@ -29900,10 +30211,12 @@ const buildInitSuccessRender = (input) => {
 	}, deps);
 	const writtenCount = input.steps.filter((s) => s.status === "done").length;
 	const footer = writtenCount === 0 ? "Nothing to write" : `Done · wrote ${writtenCount} file${writtenCount === 1 ? "" : "s"}`;
-	return `${header}${renderRail({
+	const rail = renderRail({
 		steps: input.steps,
 		footer
-	}, deps)}\n${renderHintLine(`Try ${input.nextCommand}`, deps)}`;
+	}, deps);
+	const extraHint = input.hint ? `\n${renderHintLine(input.hint, deps)}` : "";
+	return `${header}${rail}\n${renderHintLine(`Try ${input.nextCommand}`, deps)}${extraHint}`;
 };
 const ENGINE_CHOICES = [
 	{
@@ -29954,7 +30267,45 @@ const writeGithubWorkflow = (rootDirectory, enabled) => {
 		relativePath
 	};
 };
-const promptForConfigChoices = async () => {
+const writeGitlabWorkflow = (rootDirectory, enabled) => {
+	const relativePath = DEFAULT_GITLAB_CI_FILE;
+	if (!enabled) return { status: "declined" };
+	const workflowPath = path.join(rootDirectory, DEFAULT_GITLAB_CI_FILE);
+	if (fs.existsSync(workflowPath)) return {
+		status: "skipped-exists",
+		relativePath
+	};
+	fs.writeFileSync(workflowPath, DEFAULT_GITLAB_CI_YAML);
+	return {
+		status: "written",
+		relativePath
+	};
+};
+const writeBitbucketWorkflow = (rootDirectory, enabled) => {
+	const relativePath = DEFAULT_BITBUCKET_FILE;
+	if (!enabled) return { status: "declined" };
+	const workflowPath = path.join(rootDirectory, DEFAULT_BITBUCKET_FILE);
+	if (fs.existsSync(workflowPath)) return {
+		status: "skipped-exists",
+		relativePath
+	};
+	fs.writeFileSync(workflowPath, DEFAULT_BITBUCKET_PIPELINES_YAML);
+	return {
+		status: "written",
+		relativePath
+	};
+};
+const detectDefaultCiProvider = (directory) => {
+	if (fs.existsSync(path.join(directory, ".gitlab-ci.yml"))) return "gitlab";
+	if (fs.existsSync(path.join(directory, "bitbucket-pipelines.yml"))) return "bitbucket";
+	if (fs.existsSync(path.join(directory, ".github/workflows"))) return "github";
+	const detectedOwner = detectLocalRepoOwner(directory);
+	if (detectedOwner.hasRemote) {
+		if (detectedOwner.isGitHubRemote) return "github";
+	}
+	return "github";
+};
+const promptForConfigChoices = async (directory) => {
 	const enginesSelection = await runCancellable(() => multiselect({
 		message: "Which engines should run?",
 		options: ENGINE_CHOICES,
@@ -29984,15 +30335,26 @@ const promptForConfigChoices = async () => {
 	});
 	if (isCancel(telemetryChoice)) return null;
 	const workflowChoice = await select({
-		message: "Add a GitHub Actions workflow to run Raigal on every push and PR?",
-		options: [{
-			value: "yes",
-			label: "Yes — writes .github/workflows/raigal.yml"
-		}, {
-			value: "no",
-			label: "No, I'll wire CI myself"
-		}],
-		initialValue: "yes"
+		message: "Add automated CI quality gate workflow?",
+		options: [
+			{
+				value: "github",
+				label: "GitHub Actions — writes .github/workflows/raigal.yml"
+			},
+			{
+				value: "gitlab",
+				label: "GitLab CI — writes .gitlab-ci.yml"
+			},
+			{
+				value: "bitbucket",
+				label: "Bitbucket Pipelines — writes bitbucket-pipelines.yml"
+			},
+			{
+				value: "none",
+				label: "No, I'll wire CI myself"
+			}
+		],
+		initialValue: detectDefaultCiProvider(directory)
 	});
 	if (isCancel(workflowChoice)) return null;
 	return {
@@ -30000,7 +30362,8 @@ const promptForConfigChoices = async () => {
 		failBelow: Number(failBelowRaw),
 		typecheck: DEFAULT_CONFIG.lint.typecheck,
 		telemetryEnabled: telemetryChoice === "enabled",
-		writeGithubWorkflow: workflowChoice === "yes"
+		writeGithubWorkflow: workflowChoice === "github",
+		ciProvider: workflowChoice
 	};
 };
 const strictChoices = () => ({
@@ -30008,7 +30371,8 @@ const strictChoices = () => ({
 	failBelow: 85,
 	typecheck: true,
 	telemetryEnabled: DEFAULT_CONFIG.telemetry.enabled,
-	writeGithubWorkflow: true
+	writeGithubWorkflow: true,
+	ciProvider: "github"
 });
 const writeAislopConfig = (configDir, configPath, choices) => {
 	const selected = new Set(choices.engines);
@@ -30085,7 +30449,7 @@ const initCommand = async (directory, options = {}) => {
 			return;
 		}
 	}
-	const choices = options.strict ? strictChoices() : await promptForConfigChoices();
+	const choices = options.strict ? strictChoices() : await promptForConfigChoices(resolvedDir);
 	if (!choices) return;
 	writeAislopConfig(configDir, configPath, choices);
 	const steps = [{
@@ -30102,19 +30466,49 @@ const initCommand = async (directory, options = {}) => {
 		status: "skipped",
 		label: `${CONFIG_DIR}/${RULES_FILE} already exists`
 	});
-	const workflowResult = writeGithubWorkflow(resolvedDir, choices.writeGithubWorkflow);
-	if (workflowResult.status === "written") steps.push({
-		status: "done",
-		label: `Wrote ${workflowResult.relativePath}`
-	});
-	else if (workflowResult.status === "skipped-exists") steps.push({
-		status: "skipped",
-		label: `${workflowResult.relativePath} already exists`
-	});
+	let ciHint;
+	if (choices.ciProvider === "gitlab") {
+		const gitlabResult = writeGitlabWorkflow(resolvedDir, true);
+		if (gitlabResult.status === "written") {
+			steps.push({
+				status: "done",
+				label: `Wrote ${gitlabResult.relativePath}`
+			});
+			ciHint = "Set RAIGAL_TOKEN in GitLab CI/CD Variables (Settings > CI/CD > Variables).";
+		} else if (gitlabResult.status === "skipped-exists") steps.push({
+			status: "skipped",
+			label: `${gitlabResult.relativePath} already exists`
+		});
+	} else if (choices.ciProvider === "bitbucket") {
+		const bbResult = writeBitbucketWorkflow(resolvedDir, true);
+		if (bbResult.status === "written") {
+			steps.push({
+				status: "done",
+				label: `Wrote ${bbResult.relativePath}`
+			});
+			ciHint = "Set RAIGAL_TOKEN in Bitbucket Repository Variables (Repository settings > Repository variables).";
+		} else if (bbResult.status === "skipped-exists") steps.push({
+			status: "skipped",
+			label: `${bbResult.relativePath} already exists`
+		});
+	} else if (choices.writeGithubWorkflow || choices.ciProvider === "github") {
+		const workflowResult = writeGithubWorkflow(resolvedDir, true);
+		if (workflowResult.status === "written") {
+			steps.push({
+				status: "done",
+				label: `Wrote ${workflowResult.relativePath}`
+			});
+			ciHint = "GitHub Actions zero-token OIDC enabled (permissions: id-token: write).";
+		} else if (workflowResult.status === "skipped-exists") steps.push({
+			status: "skipped",
+			label: `${workflowResult.relativePath} already exists`
+		});
+	}
 	process.stdout.write(buildInitSuccessRender({
 		steps,
 		nextCommand: `${invocation} scan`,
-		includeHeader: false
+		includeHeader: false,
+		hint: ciHint
 	}));
 };
 //#endregion
@@ -30446,6 +30840,15 @@ program.command("doctor [directory]").description("Check toolchain coverage for
 		return { exitCode: 0 };
 	});
 });
+program.command("mcp").description("Run the Model Context Protocol (MCP) server over stdio").action(async () => {
+	const mcpPath = path.join(path.dirname(fileURLToPath(import.meta.url)), "mcp.js");
+	spawn(process.execPath, [mcpPath], {
+		stdio: "inherit",
+		env: process.env
+	}).on("exit", (code) => {
+		process.exit(code ?? 0);
+	});
+});
 const ciProgram = program.command("ci [directory]").description("Run the quality gate for CI");
 for (const [flag, description] of [
 	["--changes", "only gate files changed vs --base (or HEAD)"],