@methiu/raigal 0.2.6 → 0.2.7

package/LICENSE

@@ -1 +1,6 @@
-PROPRIETARY. All rights reserved. Use is permitted only under a written agreement with Raigal.
+Copyright (c) 2026 Raigal. All rights reserved.
+
+PROPRIETARY. Use is permitted only under a written agreement with Raigal.
+
+This software includes third-party components licensed under their own terms.
+See THIRD_PARTY_NOTICES.md for those components and their licences.

package/README.md

@@ -5,11 +5,11 @@
 [![npm version](https://img.shields.io/npm/v/@methiu/raigal.svg)](https://www.npmjs.com/package/@methiu/raigal) [![npm downloads](https://img.shields.io/npm/dm/@methiu/raigal.svg)](https://www.npmjs.com/package/@methiu/raigal) [![CI](https://github.com/meethiu/raigal/actions/workflows/ci.yml/badge.svg)](https://github.com/meethiu/raigal/actions/workflows/ci.yml) [![Node >= 20](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org)
 The patterns Claude Code, Cursor, Codex, and OpenCode leave behind: narrative comments above self-explanatory code, swallowed exceptions, hidden fallbacks, `as any` casts, hallucinated imports, duplicated helpers, dead code, todo stubs, oversized functions. Tests pass. Lint passes. The code rots anyway.
 
-Raigal catches them. 50+ rules across 10 language targets (TypeScript, JavaScript, Expo / React Native, Python, Go, Rust, Ruby, PHP, C#, C/C++). Scores every change 0-100. Sub-second. Deterministic: no LLM in the runtime path, same code in, same score out.
+Raigal catches them. 50+ rules across 10 language targets (TypeScript, JavaScript, Expo / React Native, Python, Go, Rust, Ruby, PHP, C#, C/C++). Scores every change 0-100. No LLM in the scoring path: the same code and tool versions give the same score.
 
 ## Quick start
 
-Raigal is demo software licensed to organizations on an admin-managed allowlist. Runs require authentication via organization credentials (`raigal login` or `RAIGAL_TOKEN`).
+Raigal is licensed to organizations on an admin-managed allowlist. Runs require authentication via organization credentials (`raigal login` or `RAIGAL_TOKEN`).
 
 ```bash
 # 1. Sign in with your organization account
@@ -21,7 +21,7 @@ raigal scan
 
 In CI and automated workflows, provide your organization API key via the `RAIGAL_TOKEN` environment variable.
 
-Also available on npm, Yarn, Bun, and Homebrew:
+Install it with npm, pnpm, Yarn, or Bun:
 
 ```bash
 npm install -g @methiu/raigal
@@ -53,7 +53,7 @@ raigal hook install --claude # per-edit hook
 
 ## Installation
 
-The same CLI is published to npm and Homebrew. Pick whichever fits your stack.
+The CLI is published to npm as `@methiu/raigal`. The unscoped `raigal` package is an official alias that installs the same CLI.
 
 **Node / npm**
 
@@ -79,22 +79,6 @@ npm install -g @methiu/raigal
 
 Package installation does not run dependency lifecycle scripts. After installing, run `raigal-tools` once if you want bundled Ruff and golangci-lint coverage; the core scanner works without it.
 
-**Homebrew** (macOS / Linux)
-
-```bash
-brew install meethiu/tap/raigal
-```
-
-Homebrew installs Node.js as a dependency if it isn't already present. Details: [homebrew-tap](https://github.com/meethiu/homebrew-tap).
-
-**Python / pipx**
-
-```bash
-pipx install raigal
-```
-
-`pipx` keeps `raigal` in its own isolated environment. Needs Node.js on `PATH`.
-
 Full reference for every channel, optional bundled tooling, and external tools: [Installation Docs](https://docs.raigal.dev/getting-started/installation).
 
 ---
@@ -286,7 +270,7 @@ Expose Raigal as MCP tools for Claude Desktop, Cursor, Codex:
   "mcpServers": {
     "raigal": {
       "command": "npx",
-      "args": ["-y", "@methiu/raigal-mcp"]
+      "args": ["-y", "@methiu/raigal@latest", "mcp"]
     }
   }
 }
@@ -310,7 +294,7 @@ raigal ci --sarif          # SARIF output for code scanning
 ```bash
 raigal                         # interactive menu
 raigal init                    # interactive setup: engines, threshold, and CI pipeline (GitHub, GitLab, Bitbucket)
-raigal init --strict           # enterprise-grade gate: all engines, typecheck, failBelow 85
+raigal init --strict           # strict gate: all engines, typecheck, failBelow 85
 raigal doctor                  # check which engines can run here
 raigal rules                   # list rules with severity, fixability, and score impact
 raigal rules --search          # searchable rule explorer
@@ -485,9 +469,20 @@ AI coding tools generate code that compiles and passes tests but ships with patt
 
 - **One score**: 0-100, enforced in CI. Weighted so sloppy patterns hit harder than style noise.
 - **Auto-fix first**: Clears formatters, unused imports, dead code mechanically. Hands off the rest to your agent with full context.
-- **Deterministic**: Regex + AST + standard tooling. No LLMs, no API calls. Same code in, same score out.
+- **No LLM in scoring**: Regex + AST + standard tooling. The same code and tool versions give the same score. See [Network access](#network-access) for the calls a run does make.
 - **Fast onboarding**: Runs with your organization session (`raigal login`) or CI token (`RAIGAL_TOKEN`). Add `.raigal/config.yml` to tune.
 
+## Network access
+
+Raigal scores code on your machine, but a run is not offline. It contacts:
+
+- **Raigal Cloud** (`app.raigal.dev`): sign-in, the organization licence check, and the upload of run results while you are signed in. In GitHub Actions it also requests an OIDC token from GitHub.
+- **Package registries**, through dependency audits (`npm audit`, `pnpm audit`, `bun audit`, `pip-audit` when installed). On by default; set `security.audit: false` to turn them off.
+- **npm registry**, to check for a newer CLI version. Turn off with `RAIGAL_NO_UPDATE_NOTIFIER=1`.
+- **Usage telemetry** (PostHog, EU host). Off in CI; turn off with `RAIGAL_NO_TELEMETRY=1` or `DO_NOT_TRACK=1`.
+
+`raigal-tools` downloads Ruff and golangci-lint only when you run it.
+
 ## What it catches
 
 Six deterministic engines run in parallel:

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,70 @@
+# Third-Party Software Notices and Information
+
+This product contains components subject to open source licenses.
+
+---
+
+## aislop
+
+Portions of this software are derived from aislop (https://github.com/scanaislop/aislop),
+used under the MIT License. Raigal's own code is not covered by this notice; see `LICENSE`.
+
+MIT License
+
+Copyright (c) 2025 heavykenny
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+## Third-Party Package Dependencies
+
+The following third-party packages may be bundled into or used by distributions of this software:
+
+- `@biomejs/biome` (MIT OR Apache-2.0) - https://github.com/biomejs/biome
+- `@clack/prompts` (MIT) - https://github.com/natemoo-re/clack
+- `@modelcontextprotocol/sdk` (MIT) - https://github.com/modelcontextprotocol/typescript-sdk
+- `adm-zip` (MIT) - https://github.com/cthackers/adm-zip
+- `commander` (MIT) - https://github.com/tj/commander.js
+- `expo-doctor` (MIT) - https://github.com/expo/expo
+- `ink` (MIT) - https://github.com/vadimdemedes/ink
+- `ink-select-input` (MIT) - https://github.com/vadimdemedes/ink-select-input
+- `knip` (ISC) - https://github.com/webpro-nl/knip
+- `micromatch` (MIT) - https://github.com/micromatch/micromatch
+- `oxlint` (MIT) - https://github.com/oxc-project/oxc
+- `picocolors` (ISC) - https://github.com/alexeyraspopov/picocolors
+- `react` (MIT) - https://github.com/facebook/react
+- `smol-toml` (BSD-3-Clause) - https://github.com/cyyynthia/smol-toml
+- `tar` (BlueOak-1.0.0 / ISC) - https://github.com/isaacs/node-tar
+- `typescript` (Apache-2.0) - https://github.com/microsoft/TypeScript
+- `wcwidth` (MIT) - https://github.com/timoxley/wcwidth
+- `yaml` (ISC) - https://github.com/eemeli/yaml
+- `zod` (MIT) - https://github.com/colinhacks/zod
+
+---
+
+## External Tools (Downloaded Standalone Binaries)
+
+The following external tools are downloaded separately as standalone binaries by `raigal-tools` and executed as separate child processes. They are NOT bundled or redistributed inside the Raigal JavaScript library:
+
+- `ruff` (MIT / Apache-2.0) - https://github.com/astral-sh/ruff
+- `golangci-lint` (GPL-3.0) - https://github.com/golangci/golangci-lint
+- `AsyncFixer` (Apache-2.0) - https://github.com/semihokur/AsyncFixer
+- `Meziantou.Analyzer` (MIT) - https://github.com/meziantou/Meziantou.Analyzer
+- `IDisposableAnalyzers` (MIT) - https://github.com/DotNetAnalyzers/IDisposableAnalyzers

package/dist/cli.js

@@ -923,7 +923,7 @@ const createLogger = (deps = {}) => {
 const log = createLogger();
 //#endregion
 //#region src/version.ts
-const APP_VERSION = "0.2.6";
+const APP_VERSION = "0.2.7";
 //#endregion
 //#region src/commands/agent-connect.ts
 const commandText = (status) => [status.provider.loginCommand.command, ...status.provider.loginCommand.args].join(" ");
@@ -1209,7 +1209,7 @@ const AllowedOwner = z.object({
 	login: z.string().max(100)
 });
 const EntitlementClaims = z.object({
-	iss: z.literal(process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev"),
+	iss: z.literal("https://app.raigal.dev"),
 	sub: z.string(),
 	org_name: z.string(),
 	plan: z.enum(["trial", "active"]),
@@ -1356,14 +1356,6 @@ const revokeSessionApi = async (token) => {
 const EMBEDDED_PUBLIC_KEYS = { rgl_key_2026_1: "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA69B+1w8c4yJpEURW4Ps2b4BZcoIzeBg3jkCfIo2n2eM=\n-----END PUBLIC KEY-----" };
 const keyObjectCache = /* @__PURE__ */ new Map();
 const getPublicKey = (kid) => {
-	if (process.env.RAIGAL_KEY_ID === kid && process.env.RAIGAL_PUBLIC_KEY) {
-		const customKey = process.env.RAIGAL_PUBLIC_KEY.replace(/\\n/g, "\n");
-		try {
-			return createPublicKey(customKey);
-		} catch {
-			return null;
-		}
-	}
 	const cached = keyObjectCache.get(kid);
 	if (cached) return cached;
 	const pem = EMBEDDED_PUBLIC_KEYS[kid];
@@ -1423,9 +1415,8 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const parsed = EntitlementClaims.safeParse(rawPayload);
 	if (!parsed.success) throw new JwtVerificationError(`Invalid entitlement claims: ${parsed.error.message}`, "invalid_claims");
 	const claims = parsed.data;
-	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
-	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.2.6", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (claims.iss !== "https://app.raigal.dev") throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
+	if (!isVersionAtLeast("0.2.7", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -8942,7 +8933,28 @@ const isSafeRegularProjectFile = (rootDirectory, absolutePath) => {
 		return false;
 	}
 };
-const hasAllowedSourceExtension = (filePath, extraExtensions) => SOURCE_EXTENSIONS$1.has(path.extname(filePath)) || extraExtensions.has(path.extname(filePath));
+const SECRET_CONFIG_EXTENSIONS = [
+	".env",
+	".yaml",
+	".yml",
+	".json",
+	".toml",
+	".ini",
+	".properties",
+	".tfvars"
+];
+const LOCKFILE_RE = /(?:^|\/)(?:package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|packages\.lock\.json|composer\.lock|bun\.lock)$/i;
+const isDotenvFile = (filePath) => {
+	const base = path.basename(filePath).toLowerCase();
+	return base === ".env" || base.startsWith(".env.");
+};
+const hasAllowedSourceExtension = (filePath, extraExtensions) => {
+	const extension = path.extname(filePath);
+	if (SOURCE_EXTENSIONS$1.has(extension)) return true;
+	if (LOCKFILE_RE.test(filePath)) return false;
+	if (extraExtensions.has(".env") && isDotenvFile(filePath)) return true;
+	return extraExtensions.has(extension);
+};
 const isInExcludedDirectory = (filePath, excludedDirectories) => {
 	const normalized = filePath.toLowerCase();
 	return excludedDirectories.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`) || normalized.includes(`/${directory}/`));
@@ -21314,13 +21326,19 @@ const SECRET_PATTERNS = [
 	},
 	{
 		pattern: /AKIA[0-9A-Z]{16}/g,
-		name: "AWS Access Key"
+		name: "AWS Access Key",
+		specific: true
 	},
 	{
-		pattern: /(?:aws[_-]?secret|secret[_-]?key)\s*[:=]\s*["']([A-Za-z0-9/+=]{40})["']/gi,
+		pattern: /(?:aws[_-]?secret(?:[_-]?access)?[_-]?key|secret[_-]?key)\s*[:=]\s*["']([A-Za-z0-9/+=]{40})["']/gi,
 		name: "AWS Secret Key",
 		keywordPrefixed: true
 	},
+	{
+		pattern: /\b(?:sk|rk)_live_[A-Za-z0-9]{20,}/g,
+		name: "Stripe secret key",
+		specific: true
+	},
 	{
 		pattern: /(?:password|passwd|pwd|secret)\s*[:=]\s*["']([^"']{8,})["']/gi,
 		name: "Hardcoded password/secret",
@@ -21328,11 +21346,13 @@ const SECRET_PATTERNS = [
 	},
 	{
 		pattern: /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/g,
-		name: "Private key"
+		name: "Private key",
+		specific: true
 	},
 	{
 		pattern: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
-		name: "JWT token"
+		name: "JWT token",
+		specific: true
 	},
 	{
 		pattern: /(?:token|bearer)\s*[:=]\s*["']([A-Za-z0-9_-]{20,})["']/gi,
@@ -21341,17 +21361,51 @@ const SECRET_PATTERNS = [
 	},
 	{
 		pattern: /gh[pousr]_[A-Za-z0-9_]{36,}/g,
-		name: "GitHub token"
+		name: "GitHub token",
+		specific: true
 	},
 	{
 		pattern: /xox[baprs]-[A-Za-z0-9-]+/g,
-		name: "Slack token"
+		name: "Slack token",
+		specific: true
 	},
 	{
 		pattern: /(?:mongodb(?:\+srv)?|postgres|mysql|redis):\/\/[^:@/"'`\s]+:[^@"'`\s]+@[^"'`\s]+/gi,
-		name: "Database connection string with credentials"
+		name: "Database connection string with credentials",
+		specific: true
 	}
 ];
+const FORMAT_PATTERNS = SECRET_PATTERNS.filter((p) => p.specific);
+const CONFIG_ASSIGNMENT_RE = /([A-Za-z0-9_.-]*(?:password|passwd|pwd|secret|token|api[_-]?key|apikey)[A-Za-z0-9_.-]*)["']?[ \t]*[:=][ \t]*["']?([^\s"'#,]+)/gi;
+const CONFIG_REFERENCE_KEY_RE = /(?:name|ref|path|file|arn|id|type|version|url|uri|length|count|env|header|field|prefix|policy|manager|store|provider)$/i;
+const CONFIG_REFERENCE_VALUE_RE = /^[<{$%]/;
+const CONFIG_PLACEHOLDER_VALUE_RE = /^(?:your|example|placeholder|redacted|dummy|xxx)/i;
+const VERSION_VALUE_RE = /^[~^<>=v]*\d+(?:\.\d+)+/;
+const CONFIG_LITERAL_VALUES = /* @__PURE__ */ new Set([
+	"true",
+	"false",
+	"null",
+	"none",
+	"nil"
+]);
+const isConfigFile = (filePath) => isDotenvFile(filePath) || SECRET_CONFIG_EXTENSIONS.includes(path.extname(filePath).toLowerCase());
+const DOTENV_TEMPLATE_RE = /^\.env\.(?:example|sample|template|dist|defaults)$/i;
+const isLocalDatabaseUrl = (value) => {
+	try {
+		return LOCAL_DB_HOSTS.has(new URL(value).hostname.toLowerCase());
+	} catch {
+		return false;
+	}
+};
+const configAssignmentName = (key) => {
+	const lower = key.toLowerCase();
+	if (/aws[_-]?secret/.test(lower)) return "AWS Secret Key";
+	if (/api[_-]?key|apikey/.test(lower)) return "API key";
+	if (/token/.test(lower) && !/password|passwd|pwd|secret/.test(lower)) return "Authentication token";
+	return "Hardcoded password/secret";
+};
+const URL_VALUE_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
+const isConfigValueIgnorable = (key, value) => value.length < 8 || URL_VALUE_RE.test(value) || CONFIG_REFERENCE_KEY_RE.test(key) || CONFIG_REFERENCE_VALUE_RE.test(value) || CONFIG_PLACEHOLDER_VALUE_RE.test(value) || VERSION_VALUE_RE.test(value) || CONFIG_LITERAL_VALUES.has(value.toLowerCase()) || isNonProductionCredentialValue(value);
 const isInsideStringLiteral = (content, matchIndex) => {
 	const lineStart = content.lastIndexOf("\n", matchIndex - 1) + 1;
 	const prefix = content.slice(lineStart, matchIndex);
@@ -21496,16 +21550,69 @@ const shouldSkipSecretFinding = (relativePath, name, lineText, matchedText) => {
 	if ((name === "Hardcoded password/secret" || name === "Authentication token") && isSymbolicConstantValue(matchedText)) return true;
 	return false;
 };
+const collectSourceCandidates = (content, relativePath) => {
+	const candidates = [];
+	for (const { pattern, name, keywordPrefixed, specific } of SECRET_PATTERNS) for (const match of content.matchAll(new RegExp(pattern.source, pattern.flags))) {
+		const matchedText = match[1] ?? match[0];
+		const lineText = lineForMatch(content, match.index);
+		if (isPlaceholderValue(matchedText)) continue;
+		if (shouldSkipSecretFinding(relativePath, name, lineText, matchedText)) continue;
+		if (keywordPrefixed && isInsideStringLiteral(content, match.index)) continue;
+		candidates.push({
+			name,
+			start: match.index,
+			end: match.index + match[0].length,
+			specific: Boolean(specific)
+		});
+	}
+	return candidates;
+};
+const collectConfigCandidates = (content, relativePath) => {
+	const candidates = [];
+	const template = DOTENV_TEMPLATE_RE.test(path.posix.basename(relativePath));
+	for (const { pattern, name } of FORMAT_PATTERNS) for (const match of content.matchAll(new RegExp(pattern.source, pattern.flags))) {
+		const lineText = lineForMatch(content, match.index);
+		if (isPlaceholderValue(match[0])) continue;
+		if (template && isLocalDatabaseUrl(match[0])) continue;
+		if (shouldSkipSecretFinding(relativePath, name, lineText, match[0])) continue;
+		candidates.push({
+			name,
+			start: match.index,
+			end: match.index + match[0].length,
+			specific: true
+		});
+	}
+	for (const match of content.matchAll(new RegExp(CONFIG_ASSIGNMENT_RE.source, CONFIG_ASSIGNMENT_RE.flags))) {
+		const [, key, value] = match;
+		const name = configAssignmentName(key);
+		const lineText = lineForMatch(content, match.index);
+		if (isConfigValueIgnorable(key, value) || isPlaceholderValue(value)) continue;
+		if (shouldSkipSecretFinding(relativePath, name, lineText, value)) continue;
+		candidates.push({
+			name,
+			start: match.index,
+			end: match.index + match[0].length,
+			specific: false
+		});
+	}
+	return candidates;
+};
+const dedupeCandidates = (candidates) => {
+	const ordered = [...candidates].sort((a, b) => Number(b.specific) - Number(a.specific) || a.start - b.start);
+	const kept = [];
+	for (const candidate of ordered) {
+		if (kept.some((k) => candidate.start < k.end && k.start < candidate.end)) continue;
+		kept.push(candidate);
+	}
+	return kept.sort((a, b) => a.start - b.start);
+};
+const resolveSecretFiles = (context) => {
+	const extras = [...SECRET_CONFIG_EXTENSIONS];
+	return context.secretFiles ? filterExplicitFiles(context.rootDirectory, context.secretFiles, extras) : getSourceFilesWithExtras(context, extras);
+};
 const scanSecrets = async (context) => {
-	const files = getSourceFilesWithExtras(context, [
-		".env",
-		".yaml",
-		".yml",
-		".json",
-		".toml"
-	]);
 	const diagnostics = [];
-	for (const filePath of files) {
+	for (const filePath of resolveSecretFiles(context)) {
 		let content;
 		try {
 			content = fs.readFileSync(filePath, "utf-8");
@@ -21514,30 +21621,20 @@ const scanSecrets = async (context) => {
 		}
 		content = maskComments(content, path.extname(filePath));
 		const relativePath = relativePosix(context.rootDirectory, filePath);
-		for (const { pattern, name, keywordPrefixed } of SECRET_PATTERNS) {
-			const regex = new RegExp(pattern.source, pattern.flags);
-			for (const match of content.matchAll(regex)) {
-				const matchedText = match[1] ?? match[0];
-				const lineText = lineForMatch(content, match.index);
-				if (isPlaceholderValue(matchedText)) continue;
-				if (shouldSkipSecretFinding(relativePath, name, lineText, matchedText)) continue;
-				if (keywordPrefixed && isInsideStringLiteral(content, match.index)) continue;
-				const line = content.slice(0, match.index).split("\n").length;
-				diagnostics.push({
-					filePath: relativePath,
-					engine: "security",
-					rule: "security/hardcoded-secret",
-					severity: "error",
-					message: `Possible ${name} detected in source code`,
-					help: "Move secrets to environment variables or a secrets manager",
-					line,
-					column: 0,
-					category: "Security",
-					fixable: false,
-					redactSource: true
-				});
-			}
-		}
+		const candidates = isConfigFile(filePath) ? collectConfigCandidates(content, relativePath) : collectSourceCandidates(content, relativePath);
+		for (const { name, start } of dedupeCandidates(candidates)) diagnostics.push({
+			filePath: relativePath,
+			engine: "security",
+			rule: "security/hardcoded-secret",
+			severity: "error",
+			message: `Possible ${name} detected in source code`,
+			help: "Move secrets to environment variables or a secrets manager",
+			line: content.slice(0, start).split("\n").length,
+			column: 0,
+			category: "Security",
+			fixable: false,
+			redactSource: true
+		});
 	}
 	return diagnostics;
 };
@@ -25231,7 +25328,7 @@ const maybeNotifyUpdate = async (now = Date.now()) => {
 	if (!process.stderr.isTTY) return;
 	const cachePath = resolveUpdateCachePath();
 	const cache = readCache(cachePath);
-	if (cache && isOutdated("0.2.6", cache.latest)) process.stderr.write(formatUpdateNotice(APP_VERSION, cache.latest));
+	if (cache && isOutdated("0.2.7", cache.latest)) process.stderr.write(formatUpdateNotice(APP_VERSION, cache.latest));
 	if (!cache || now - cache.checkedAt > CHECK_INTERVAL_MS) {
 		const latest = await fetchLatestVersion$1();
 		if (latest) writeCache(cachePath, {
@@ -25756,7 +25853,7 @@ const renderCommandGroup = (group, commandWidth) => {
 	return lines;
 };
 const renderCommandReference = (input = {}) => {
-	const version = input.version ?? "0.2.6";
+	const version = input.version ?? "0.2.7";
 	const commandWidth = Math.max(...COMMAND_REFERENCE.map((item) => item.command.length));
 	const lines = [renderHeader({
 		version,
@@ -25979,7 +26076,7 @@ const renderHelpDetails = () => [
 ].map((line) => highlightRaigal(line, theme)).join("\n");
 const renderHome = (input = {}) => {
 	let out = renderHeader({
-		version: input.version ?? "0.2.6",
+		version: input.version ?? "0.2.7",
 		command: "--bare",
 		context: []
 	});
@@ -26726,22 +26823,10 @@ const getChangedLineMap = (cwd, base) => {
 	return map;
 };
 //#endregion
-//#region src/commands/scan-hook-nudge.ts
-const shouldShowHookNudge = (ctx) => ctx.isTty && !ctx.isCi && ctx.installedAgentCount === 0;
-const buildHookNudge = (ctx) => {
-	if (!shouldShowHookNudge(ctx)) return null;
-	return [
-		"",
-		"Next: install the per-edit hook so your coding agent fixes slop before it lands.",
-		ctx.invocation === "raigal" ? "  raigal hook install" : "  npm install -g @methiu/raigal && raigal hook install",
-		""
-	].join("\n");
-};
-//#endregion
 //#region src/commands/scan-coverage.ts
 const coverageReason = (c) => {
 	if (c.supportedFiles === 0 && c.dominantUnsupported) return `This repository is ${c.dominantUnsupported} (${c.unsupportedFiles} files), which Raigal does not analyze. No score — it would not reflect this code.`;
-	if (c.supportedFiles === 0) return "No files in a language Raigal analyzes (TypeScript, JavaScript, Python, Go, Rust, Ruby, PHP, Java). Nothing to score.";
+	if (c.supportedFiles === 0) return "No files in a language Raigal analyzes (TypeScript, JavaScript, Python, Go, Rust, Ruby, PHP, C#, C/C++). Nothing to score.";
 	const lang = c.dominantUnsupported ?? "an unsupported language";
 	const files = `${c.supportedFiles} supported file${c.supportedFiles === 1 ? "" : "s"}`;
 	return `This repository is mostly ${lang} (${c.unsupportedFiles} files); Raigal analyzed only ${files}. Score withheld — it would represent a sliver of the codebase.`;
@@ -26980,10 +27065,23 @@ const collectScanFileScope = (request) => {
 		projectFiles: [.../* @__PURE__ */ new Set([...projectSourceFiles, ...declarations])],
 		scoreFileCount: projectSourceFiles.length + projectTestFiles.length,
 		scopeLabel: candidates.label,
+		secretFiles: filterEnumeratedProjectFiles(request.rootDirectory, candidates.files, [...SECRET_CONFIG_EXTENSIONS], request.excludePatterns, request.includePatterns),
 		testFiles
 	};
 };
 //#endregion
+//#region src/commands/scan-hook-nudge.ts
+const shouldShowHookNudge = (ctx) => ctx.isTty && !ctx.isCi && ctx.installedAgentCount === 0;
+const buildHookNudge = (ctx) => {
+	if (!shouldShowHookNudge(ctx)) return null;
+	return [
+		"",
+		"Next: install the per-edit hook so your coding agent fixes slop before it lands.",
+		ctx.invocation === "raigal" ? "  raigal hook install" : "  npm install -g @methiu/raigal && raigal hook install",
+		""
+	].join("\n");
+};
+//#endregion
 //#region src/commands/scan-options.ts
 const isMachineOutput = (options) => Boolean(options.json) || Boolean(options.sarif);
 const isHistoryComparableScan = (options) => !options.staged && !options.changes && options.command !== "ci";
@@ -27428,7 +27526,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 	const projectName = projectInfo.projectName ?? "project";
 	const language = projectInfo.languages[0] ?? "unknown";
 	const printedHumanHeader = !machineOutput && showHeader;
-	const { dependencyAuditFiles, dependencyAuditScope, files, projectFiles, scoreFileCount, scopeLabel, testFiles } = scanScope;
+	const { dependencyAuditFiles, dependencyAuditScope, files, projectFiles, scoreFileCount, scopeLabel, secretFiles, testFiles } = scanScope;
 	const excludePatterns = [...config.exclude, ...readAislopIgnorePatterns(resolvedDir)];
 	const scanCoverage = deriveScanCoverage(projectInfo.coverage, scoreFileCount);
 	const reportProjectInfo = {
@@ -27469,6 +27567,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		excludePatterns,
 		testFiles,
 		projectFiles,
+		secretFiles,
 		installedTools: projectInfo.installedTools,
 		config: engineConfig
 	}, config.engines, machineOutput)).map((result) => ({