@methiu/raigal 1.0.0 → 1.0.2

package/dist/cli.js

@@ -108,7 +108,28 @@ const getProviderStatuses = () => PROVIDERS.map((provider) => {
 	};
 });
 const resolveProvider = (selection, statuses = getProviderStatuses()) => {
-	if (selection !== "auto") return statuses.find((status) => status.provider.id === selection) ?? null;
+	if (selection !== "auto") {
+		const found = statuses.find((status) => status.provider.id === selection);
+		if (found) return found;
+		if (commandExists(selection)) return {
+			provider: {
+				id: selection,
+				label: selection,
+				bin: selection,
+				loginCommand: {
+					command: selection,
+					args: ["login"]
+				},
+				loginHint: `Run \`${selection} login\`.`,
+				buildArgs: (prompt) => [prompt]
+			},
+			installed: true,
+			authenticated: true,
+			version: readVersion(selection),
+			authHint: null
+		};
+		return null;
+	}
 	return statuses.find((status) => status.installed && status.authenticated !== false) ?? statuses.find((status) => status.installed) ?? null;
 };
 //#endregion
@@ -863,7 +884,7 @@ const createLogger = (deps = {}) => {
 const log = createLogger();
 //#endregion
 //#region src/version.ts
-const APP_VERSION = "1.0.0";
+const APP_VERSION = "1.0.2";
 //#endregion
 //#region src/commands/agent-connect.ts
 const commandText = (status) => [status.provider.loginCommand.command, ...status.provider.loginCommand.args].join(" ");
@@ -1058,7 +1079,8 @@ const Finding = z.object({
 	severity: Severity,
 	path: z.string().max(500),
 	line: z.number().int().nonnegative(),
-	fingerprint: z.string().length(32)
+	fingerprint: z.string().length(32),
+	message: z.string().max(500).optional()
 });
 const RepoRef = z.object({
 	provider: z.literal("github"),
@@ -1073,12 +1095,21 @@ const Step = z.object({
 	ms: z.number().int().nonnegative(),
 	counts: z.record(z.string(), z.number()).optional()
 });
+const AgentTelemetry = z.object({
+	provider: z.string().max(80),
+	before_score: z.number().min(0).max(100).nullable(),
+	after_score: z.number().min(0).max(100).nullable(),
+	pr_url: z.string().url().max(500).optional(),
+	patch_diff: z.string().max(2e4).optional(),
+	duration_ms: z.number().int().nonnegative().optional()
+});
 const Report = z.object({
 	score: z.number().min(0).max(100).nullable(),
 	scoreable: z.boolean(),
 	engine_scores: z.record(z.string(), z.number()).optional(),
 	files_scanned: z.number().int().nonnegative(),
-	findings: z.array(Finding).max(5e3)
+	findings: z.array(Finding).max(5e3),
+	agent_telemetry: AgentTelemetry.optional()
 });
 const Run = z.object({
 	run_id: z.uuid(),
@@ -1095,7 +1126,13 @@ const Run = z.object({
 		branch: z.string().max(200).optional(),
 		head_sha: z.string().max(64).optional(),
 		base_ref: z.string().max(200).optional(),
-		pr_number: z.number().int().optional()
+		pr_number: z.number().int().optional(),
+		diff_summary: z.object({
+			files_changed: z.number().int().nonnegative(),
+			additions: z.number().int().nonnegative(),
+			deletions: z.number().int().nonnegative()
+		}).optional(),
+		diff_preview: z.string().max(1e4).optional()
 	}),
 	ci: z.object({
 		provider: z.string().max(40),
@@ -1111,7 +1148,8 @@ const Run = z.object({
 	ended_at: z.iso.datetime(),
 	exit_code: z.number().int(),
 	steps: z.array(Step).max(200),
-	report: Report.optional()
+	report: Report.optional(),
+	agent_telemetry: AgentTelemetry.optional()
 });
 const Policy = z.object({
 	version: z.number().int(),
@@ -1132,7 +1170,7 @@ const AllowedOwner = z.object({
 	login: z.string().max(100)
 });
 const EntitlementClaims = z.object({
-	iss: z.literal("https://app.raigal.dev"),
+	iss: z.literal(process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev"),
 	sub: z.string(),
 	org_name: z.string(),
 	plan: z.enum(["trial", "active"]),
@@ -1345,7 +1383,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const claims = parsed.data;
 	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
 	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("1.0.0", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (!isVersionAtLeast("1.0.2", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -2575,6 +2613,385 @@ var AgentTui = class {
 	}
 };
 //#endregion
+//#region src/cloud/context.ts
+const execGit = (args, cwd) => {
+	try {
+		const res = spawnSync("git", args, {
+			cwd: path.resolve(cwd),
+			encoding: "utf-8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		});
+		if (res.error || res.status !== 0) return void 0;
+		return res.stdout.trim() || void 0;
+	} catch {
+		return;
+	}
+};
+const detectDefaultBranch = (directory) => {
+	try {
+		const out = execGit(["symbolic-ref", "refs/remotes/origin/HEAD"], directory);
+		if (out && out.startsWith("refs/remotes/origin/")) return out.replace("refs/remotes/origin/", "").trim();
+	} catch {}
+	return "main";
+};
+const detectGitDiff = (directory, baseRef) => {
+	const targetBase = baseRef || detectDefaultBranch(directory);
+	try {
+		let shortstat = execGit([
+			"diff",
+			"--shortstat",
+			`${targetBase}...HEAD`
+		], directory);
+		if (!shortstat) shortstat = execGit([
+			"diff",
+			"--shortstat",
+			`origin/${targetBase}...HEAD`
+		], directory);
+		if (!shortstat) shortstat = execGit([
+			"diff",
+			"--shortstat",
+			"HEAD~1"
+		], directory);
+		let diffSummary;
+		if (shortstat) {
+			const filesMatch = shortstat.match(/(\d+)\s+files?\s+changed/);
+			const addMatch = shortstat.match(/(\d+)\s+insertions?\s*\(\+\)/);
+			const delMatch = shortstat.match(/(\d+)\s+deletions?\s*\(-\)/);
+			diffSummary = {
+				files_changed: filesMatch ? Number.parseInt(filesMatch[1], 10) : 1,
+				additions: addMatch ? Number.parseInt(addMatch[1], 10) : 0,
+				deletions: delMatch ? Number.parseInt(delMatch[1], 10) : 0
+			};
+		}
+		let preview = execGit([
+			"diff",
+			"-U2",
+			"--no-color",
+			`${targetBase}...HEAD`
+		], directory);
+		if (!preview) preview = execGit([
+			"diff",
+			"-U2",
+			"--no-color",
+			`origin/${targetBase}...HEAD`
+		], directory);
+		if (!preview) preview = execGit([
+			"diff",
+			"-U2",
+			"--no-color",
+			"HEAD~1"
+		], directory);
+		let diffPreview;
+		if (preview) diffPreview = preview.split("\n").slice(0, 40).join("\n").slice(0, 1e4);
+		return {
+			diffSummary,
+			diffPreview
+		};
+	} catch {
+		return {};
+	}
+};
+const getRootCommitHash = (directory) => {
+	const hash = execGit([
+		"rev-list",
+		"--max-parents=0",
+		"HEAD"
+	], directory);
+	if (!hash) return void 0;
+	const firstLine = hash.split("\n")[0]?.trim();
+	return firstLine && /^[0-9a-f]{40,64}$/i.test(firstLine) ? firstLine : void 0;
+};
+const detectRepoRef = (directory, ownerId) => {
+	const detected = detectLocalRepoOwner(directory);
+	if (!detected.owner || !detected.repo) return null;
+	return {
+		provider: "github",
+		slug: `${detected.owner}/${detected.repo}`.toLowerCase(),
+		owner_id: ownerId,
+		root_commit_hash: getRootCommitHash(directory)
+	};
+};
+const readGitHubEventPayload = () => {
+	const eventPath = process.env.GITHUB_EVENT_PATH;
+	if (!eventPath || !fs.existsSync(eventPath)) return null;
+	try {
+		const content = fs.readFileSync(eventPath, "utf-8");
+		return JSON.parse(content);
+	} catch {
+		return null;
+	}
+};
+const detectGitContext = (directory) => {
+	const eventPayload = readGitHubEventPayload();
+	const pr = eventPayload?.pull_request;
+	let headSha = pr?.head?.sha;
+	if (!headSha) headSha = process.env.GITHUB_SHA || execGit(["rev-parse", "HEAD"], directory);
+	let branch = process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME;
+	if (!branch) {
+		branch = execGit([
+			"rev-parse",
+			"--abbrev-ref",
+			"HEAD"
+		], directory);
+		if (branch === "HEAD") branch = void 0;
+	}
+	let baseRef = pr?.base?.ref || process.env.GITHUB_BASE_REF;
+	if (!baseRef) baseRef = void 0;
+	let prNumber;
+	if (typeof pr?.number === "number") prNumber = pr.number;
+	else if (typeof eventPayload?.number === "number") prNumber = eventPayload.number;
+	else if (process.env.GITHUB_REF) {
+		const match = process.env.GITHUB_REF.match(/^refs\/pull\/(\d+)\//);
+		if (match && match[1]) prNumber = Number.parseInt(match[1], 10);
+	}
+	const result = {};
+	if (branch) result.branch = branch;
+	if (headSha) result.head_sha = headSha;
+	if (baseRef) result.base_ref = baseRef;
+	if (prNumber !== void 0 && !Number.isNaN(prNumber)) result.pr_number = prNumber;
+	const { diffSummary, diffPreview } = detectGitDiff(directory, baseRef);
+	if (diffSummary) result.diff_summary = diffSummary;
+	if (diffPreview) result.diff_preview = diffPreview;
+	return result;
+};
+const detectCiContext = () => {
+	if (process.env.GITHUB_ACTIONS === "true" || process.env.GITHUB_ACTIONS === "1") {
+		const serverUrl = process.env.GITHUB_SERVER_URL || "https://github.com";
+		const repo = process.env.GITHUB_REPOSITORY;
+		const runId = process.env.GITHUB_RUN_ID;
+		let runUrl;
+		if (repo && runId) {
+			const attempt = process.env.GITHUB_RUN_ATTEMPT;
+			runUrl = `${serverUrl}/${repo}/actions/runs/${runId}${attempt ? `/attempts/${attempt}` : ""}`;
+		}
+		return {
+			provider: "github-actions",
+			...runUrl ? { run_url: runUrl } : {}
+		};
+	}
+	if (process.env.CI === "true" || process.env.CI === "1") return { provider: process.env.GITLAB_CI && "gitlab-ci" || process.env.BITBUCKET_BUILD_NUMBER && "bitbucket-pipelines" || process.env.CIRCLECI && "circleci" || process.env.BUILDKITE && "buildkite" || process.env.TRAVIS && "travis-ci" || "generic-ci" };
+};
+//#endregion
+//#region src/cloud/outbox.ts
+const MAX_OUTBOX_BYTES = 5 * 1024 * 1024;
+const getMaxOutboxBytes = () => {
+	const override = process.env.RAIGAL_MAX_OUTBOX_BYTES;
+	if (override) {
+		const parsed = Number.parseInt(override, 10);
+		if (!Number.isNaN(parsed) && parsed > 0) return parsed;
+	}
+	return MAX_OUTBOX_BYTES;
+};
+const loadOutboxRuns = () => {
+	const outboxPath = getOutboxPath();
+	if (!fs.existsSync(outboxPath)) return [];
+	try {
+		const lines = fs.readFileSync(outboxPath, "utf-8").split("\n").filter((l) => l.trim().length > 0);
+		const runs = [];
+		for (const line of lines) try {
+			const parsed = JSON.parse(line);
+			const valid = Run.safeParse(parsed);
+			if (valid.success) runs.push(valid.data);
+		} catch {}
+		return runs;
+	} catch {
+		return [];
+	}
+};
+const writeRunsToOutbox = (runs) => {
+	const outboxPath = getOutboxPath();
+	const dir = path.dirname(outboxPath);
+	if (!fs.existsSync(dir)) fs.mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	let lines = runs.map((r) => JSON.stringify(r));
+	let text = lines.length > 0 ? `${lines.join("\n")}\n` : "";
+	const maxBytes = getMaxOutboxBytes();
+	while (Buffer.byteLength(text, "utf-8") > maxBytes && lines.length > 1) {
+		lines.shift();
+		text = `${lines.join("\n")}\n`;
+	}
+	const temp = `${outboxPath}.${Date.now()}.tmp`;
+	fs.writeFileSync(temp, text, { mode: 384 });
+	try {
+		fs.renameSync(temp, outboxPath);
+	} catch {
+		fs.rmSync(temp, { force: true });
+		fs.writeFileSync(outboxPath, text, { mode: 384 });
+	}
+};
+const enqueueRun = (run) => {
+	const existing = loadOutboxRuns();
+	existing.push(run);
+	writeRunsToOutbox(existing);
+};
+const getLastRecordedRun = () => {
+	const runs = loadOutboxRuns();
+	return runs.length > 0 ? runs[runs.length - 1] ?? null : null;
+};
+const flushOutbox = async (token) => {
+	const runs = loadOutboxRuns();
+	if (runs.length === 0) return {
+		sent: 0,
+		failed: 0,
+		remaining: 0
+	};
+	let sentCount = 0;
+	let failCount = 0;
+	const remainingRuns = [];
+	for (let i = 0; i < runs.length; i++) {
+		const run = runs[i];
+		try {
+			await requestApi("/v1/runs", {
+				method: "POST",
+				token,
+				body: run,
+				timeoutMs: 4e3
+			});
+			sentCount++;
+		} catch (err) {
+			if (err instanceof ApiError) {
+				if ([
+					400,
+					401,
+					403,
+					413,
+					422
+				].includes(err.status)) {
+					failCount++;
+					continue;
+				}
+				if (err.status === 409) {
+					sentCount++;
+					continue;
+				}
+			}
+			failCount++;
+			remainingRuns.push(...runs.slice(i));
+			break;
+		}
+	}
+	writeRunsToOutbox(remainingRuns);
+	return {
+		sent: sentCount,
+		failed: failCount,
+		remaining: remainingRuns.length
+	};
+};
+//#endregion
+//#region src/cloud/recorder.ts
+var CloudRunRecorder = class {
+	runId;
+	command;
+	directory;
+	flags;
+	startedAt;
+	steps = [];
+	report;
+	policyMeta;
+	gitContextOverride;
+	agentTelemetry;
+	seq = 0;
+	finished = false;
+	constructor(command, directory, flags = []) {
+		this.runId = randomUUID();
+		this.command = command;
+		this.directory = directory;
+		this.flags = flags.map((f) => f.replace(/^--?/, "")).filter((f) => f.length > 0).slice(0, 40);
+		this.startedAt = (/* @__PURE__ */ new Date()).toISOString();
+	}
+	recordStep(name, durationMs, ok = true, counts) {
+		if (this.steps.length >= 200) return;
+		this.steps.push({
+			seq: this.seq++,
+			name: name.slice(0, 80),
+			ok,
+			ms: Math.max(0, Math.round(durationMs)),
+			counts
+		});
+	}
+	setReport(report) {
+		this.report = report;
+	}
+	setPolicyMeta(version, hash) {
+		this.policyMeta = {
+			version,
+			hash: hash.slice(0, 64)
+		};
+	}
+	setAgentTelemetry(telemetry) {
+		this.agentTelemetry = telemetry;
+	}
+	setGitContext(git) {
+		this.gitContextOverride = {
+			...this.gitContextOverride,
+			...git
+		};
+	}
+	buildRunPayload(exitCode) {
+		const repo = detectRepoRef(this.directory) || {
+			provider: "github",
+			slug: "unknown/unknown"
+		};
+		const git = {
+			...detectGitContext(this.directory),
+			...this.gitContextOverride
+		};
+		const ci = detectCiContext();
+		const ownerVerified = Boolean(process.env.ACTIONS_ID_TOKEN_REQUEST_URL);
+		return {
+			run_id: this.runId,
+			command: this.command,
+			repo,
+			owner_verified: ownerVerified,
+			git,
+			ci,
+			flags: this.flags,
+			cli_version: APP_VERSION,
+			policy: this.policyMeta,
+			started_at: this.startedAt,
+			ended_at: (/* @__PURE__ */ new Date()).toISOString(),
+			exit_code: exitCode,
+			steps: this.steps.slice(0, 200),
+			report: this.report ? {
+				...this.report,
+				agent_telemetry: this.agentTelemetry || this.report.agent_telemetry
+			} : void 0,
+			agent_telemetry: this.agentTelemetry
+		};
+	}
+	async finish(exitCode) {
+		if (this.finished) return;
+		this.finished = true;
+		try {
+			enqueueRun(this.buildRunPayload(exitCode));
+			const activeToken = getActiveToken();
+			if (activeToken) await flushOutbox(activeToken.token);
+		} catch {}
+	}
+};
+let activeRecorder = null;
+const getActiveRecorder = () => activeRecorder;
+const startRunRecorder = (command, directory, flags = []) => {
+	const recorder = new CloudRunRecorder(command, directory, flags);
+	activeRecorder = recorder;
+	const activeToken = getActiveToken();
+	if (activeToken) flushOutbox(activeToken.token).catch(() => {});
+	return recorder;
+};
+const finishActiveRecorder = async (exitCode = 0) => {
+	if (activeRecorder) {
+		const rec = activeRecorder;
+		activeRecorder = null;
+		await rec.finish(exitCode);
+	}
+};
+//#endregion
 //#region src/commands/agent-local-cli.ts
 const cliPath$1 = () => {
 	const arg = process.argv[1];
@@ -3466,6 +3883,47 @@ const runAgentSession = async (selected, resolvedDir, options, started) => {
 			published: Boolean(published)
 		});
 		await tui.finish({ footer: `Done · ${selected.provider.id} · ${Math.round(performance.now() - started)}ms` });
+		const recorder = getActiveRecorder();
+		if (recorder) {
+			let patchDiff;
+			if (created?.worktree?.path) try {
+				patchDiff = (spawnSync("git", [
+					"diff",
+					"-U2",
+					"--no-color",
+					"HEAD"
+				], {
+					cwd: created.worktree.path,
+					encoding: "utf-8"
+				}).stdout || "").slice(0, 2e4) || void 0;
+			} catch {}
+			if (published) {
+				const prMatch = published.prUrl?.match(/\/pull\/(\d+)/);
+				const prNumber = prMatch ? Number.parseInt(prMatch[1], 10) : void 0;
+				recorder.setGitContext({
+					branch: published.branch,
+					pr_number: prNumber
+				});
+			} else if (options.branch) recorder.setGitContext({ branch: options.branch });
+			const agentTelemetry = {
+				provider: selected.provider.id,
+				before_score: before.score,
+				after_score: verified.after.score,
+				pr_url: published?.prUrl || void 0,
+				patch_diff: patchDiff,
+				duration_ms: Math.round(performance.now() - started)
+			};
+			recorder.setAgentTelemetry(agentTelemetry);
+			recorder.recordStep("agent:baseline", 50, true);
+			recorder.recordStep("agent:verify", Math.round(performance.now() - started), verified.after.score !== null && verified.after.score >= options.targetScore);
+			recorder.setReport({
+				score: verified.after.score,
+				scoreable: true,
+				files_scanned: changedFiles.length,
+				findings: [],
+				agent_telemetry: agentTelemetry
+			});
+		}
 		printAgentSessionSummary({
 			before,
 			after: verified.after,
@@ -7184,169 +7642,61 @@ const pollDeviceAuthorization = async (grant) => {
 				process.exitCode = 1;
 				return;
 			}
-			if (pollResult.status === "expired") {
-				log.error("Login authorization code expired. Please try running `raigal login` again.");
-				process.exitCode = 1;
-				return;
-			}
-			if (pollResult.status === "ok" && pollResult.data) {
-				const { access_token, org, user, expires_at } = pollResult.data;
-				saveStoredCredentials({
-					token: access_token,
-					org,
-					user,
-					expires_at
-				});
-				process.stdout.write("\n");
-				log.success(`Signed in as ${user.email} · ${org.name}`);
-				return;
-			}
-		} catch (err) {
-			log.error(`Polling error: ${err instanceof Error ? err.message : String(err)}`);
-			process.exitCode = 1;
-			return;
-		}
-	}
-	log.error("Login timed out. Please run `raigal login` again.");
-	process.exitCode = 1;
-};
-const loginCommand = async (options = {}) => {
-	if (options.withToken) {
-		await loginWithToken();
-		return;
-	}
-	log.info("Starting browser login...");
-	let grant;
-	try {
-		grant = await startDeviceLogin();
-	} catch (err) {
-		log.error(`Failed to start login: ${err instanceof Error ? err.message : String(err)}`);
-		process.exitCode = 1;
-		return;
-	}
-	process.stdout.write("\n");
-	process.stdout.write(`  Confirmation code:  ${grant.user_code}\n`);
-	process.stdout.write(`  Verification URL:   ${grant.verification_uri_complete}\n\n`);
-	log.muted("Opening browser to confirm authorization...");
-	openBrowser(grant.verification_uri_complete);
-	await pollDeviceAuthorization(grant);
-};
-//#endregion
-//#region src/commands/logout.ts
-const logoutCommand = async () => {
-	const active = getActiveToken();
-	if (active && active.kind === "session") await revokeSessionApi(active.token);
-	clearStoredCredentials();
-	clearCachedEntitlement();
-	log.success("Signed out and cleared cached credentials.");
-};
-//#endregion
-//#region src/cloud/outbox.ts
-const MAX_OUTBOX_BYTES = 5 * 1024 * 1024;
-const getMaxOutboxBytes = () => {
-	const override = process.env.RAIGAL_MAX_OUTBOX_BYTES;
-	if (override) {
-		const parsed = Number.parseInt(override, 10);
-		if (!Number.isNaN(parsed) && parsed > 0) return parsed;
-	}
-	return MAX_OUTBOX_BYTES;
-};
-const loadOutboxRuns = () => {
-	const outboxPath = getOutboxPath();
-	if (!fs.existsSync(outboxPath)) return [];
-	try {
-		const lines = fs.readFileSync(outboxPath, "utf-8").split("\n").filter((l) => l.trim().length > 0);
-		const runs = [];
-		for (const line of lines) try {
-			const parsed = JSON.parse(line);
-			const valid = Run.safeParse(parsed);
-			if (valid.success) runs.push(valid.data);
-		} catch {}
-		return runs;
-	} catch {
-		return [];
-	}
-};
-const writeRunsToOutbox = (runs) => {
-	const outboxPath = getOutboxPath();
-	const dir = path.dirname(outboxPath);
-	if (!fs.existsSync(dir)) fs.mkdirSync(dir, {
-		recursive: true,
-		mode: 448
-	});
-	let lines = runs.map((r) => JSON.stringify(r));
-	let text = lines.length > 0 ? `${lines.join("\n")}\n` : "";
-	const maxBytes = getMaxOutboxBytes();
-	while (Buffer.byteLength(text, "utf-8") > maxBytes && lines.length > 1) {
-		lines.shift();
-		text = `${lines.join("\n")}\n`;
-	}
-	const temp = `${outboxPath}.${Date.now()}.tmp`;
-	fs.writeFileSync(temp, text, { mode: 384 });
-	try {
-		fs.renameSync(temp, outboxPath);
-	} catch {
-		fs.rmSync(temp, { force: true });
-		fs.writeFileSync(outboxPath, text, { mode: 384 });
-	}
-};
-const enqueueRun = (run) => {
-	const existing = loadOutboxRuns();
-	existing.push(run);
-	writeRunsToOutbox(existing);
-};
-const getLastRecordedRun = () => {
-	const runs = loadOutboxRuns();
-	return runs.length > 0 ? runs[runs.length - 1] ?? null : null;
-};
-const flushOutbox = async (token) => {
-	const runs = loadOutboxRuns();
-	if (runs.length === 0) return {
-		sent: 0,
-		failed: 0,
-		remaining: 0
-	};
-	let sentCount = 0;
-	let failCount = 0;
-	const remainingRuns = [];
-	for (let i = 0; i < runs.length; i++) {
-		const run = runs[i];
-		try {
-			await requestApi("/v1/runs", {
-				method: "POST",
-				token,
-				body: run,
-				timeoutMs: 4e3
-			});
-			sentCount++;
-		} catch (err) {
-			if (err instanceof ApiError) {
-				if ([
-					400,
-					401,
-					403,
-					413,
-					422
-				].includes(err.status)) {
-					failCount++;
-					continue;
-				}
-				if (err.status === 409) {
-					sentCount++;
-					continue;
-				}
-			}
-			failCount++;
-			remainingRuns.push(...runs.slice(i));
-			break;
+			if (pollResult.status === "expired") {
+				log.error("Login authorization code expired. Please try running `raigal login` again.");
+				process.exitCode = 1;
+				return;
+			}
+			if (pollResult.status === "ok" && pollResult.data) {
+				const { access_token, org, user, expires_at } = pollResult.data;
+				saveStoredCredentials({
+					token: access_token,
+					org,
+					user,
+					expires_at
+				});
+				process.stdout.write("\n");
+				log.success(`Signed in as ${user.email} · ${org.name}`);
+				return;
+			}
+		} catch (err) {
+			log.error(`Polling error: ${err instanceof Error ? err.message : String(err)}`);
+			process.exitCode = 1;
+			return;
 		}
 	}
-	writeRunsToOutbox(remainingRuns);
-	return {
-		sent: sentCount,
-		failed: failCount,
-		remaining: remainingRuns.length
-	};
+	log.error("Login timed out. Please run `raigal login` again.");
+	process.exitCode = 1;
+};
+const loginCommand = async (options = {}) => {
+	if (options.withToken) {
+		await loginWithToken();
+		return;
+	}
+	log.info("Starting browser login...");
+	let grant;
+	try {
+		grant = await startDeviceLogin();
+	} catch (err) {
+		log.error(`Failed to start login: ${err instanceof Error ? err.message : String(err)}`);
+		process.exitCode = 1;
+		return;
+	}
+	process.stdout.write("\n");
+	process.stdout.write(`  Confirmation code:  ${grant.user_code}\n`);
+	process.stdout.write(`  Verification URL:   ${grant.verification_uri_complete}\n\n`);
+	log.muted("Opening browser to confirm authorization...");
+	openBrowser(grant.verification_uri_complete);
+	await pollDeviceAuthorization(grant);
+};
+//#endregion
+//#region src/commands/logout.ts
+const logoutCommand = async () => {
+	const active = getActiveToken();
+	if (active && active.kind === "session") await revokeSessionApi(active.token);
+	clearStoredCredentials();
+	clearCachedEntitlement();
+	log.success("Signed out and cleared cached credentials.");
 };
 //#endregion
 //#region src/commands/telemetry-show.ts
@@ -7450,6 +7800,14 @@ const registerCloudCommands = (program) => {
 		if (flags.show || isJson) await telemetryShowCommand({ json: isJson });
 		else process.stdout.write("Run `raigal telemetry --show` to inspect recorded telemetry payloads.\n");
 	});
+	program.command("report-pr-closed").description("Report a pull request closed/merged event to Raigal Cloud").option("--pr <number>", "PR number (default: read from GITHUB_EVENT_PATH)").option("--merged", "Flag indicating whether PR was merged").action(async (flags) => {
+		const prNumber = flags.pr ? Number.parseInt(flags.pr, 10) : void 0;
+		const { reportPrClosedCommand } = await import("./report-pr-closed-CDdQjRWj.js");
+		await reportPrClosedCommand({
+			prNumber,
+			merged: Boolean(flags.merged)
+		});
+	});
 };
 //#endregion
 //#region src/hooks/feedback.ts
@@ -23984,7 +24342,7 @@ const maybeNotifyUpdate = async (now = Date.now()) => {
 	if (!process.stderr.isTTY) return;
 	const cachePath = resolveUpdateCachePath();
 	const cache = readCache(cachePath);
-	if (cache && isOutdated("1.0.0", cache.latest)) process.stderr.write(formatUpdateNotice(APP_VERSION, cache.latest));
+	if (cache && isOutdated("1.0.2", cache.latest)) process.stderr.write(formatUpdateNotice(APP_VERSION, cache.latest));
 	if (!cache || now - cache.checkedAt > CHECK_INTERVAL_MS) {
 		const latest = await fetchLatestVersion$1();
 		if (latest) writeCache(cachePath, {
@@ -24504,7 +24862,7 @@ const renderCommandGroup = (group, commandWidth) => {
 	return lines;
 };
 const renderCommandReference = (input = {}) => {
-	const version = input.version ?? "1.0.0";
+	const version = input.version ?? "1.0.2";
 	const commandWidth = Math.max(...COMMAND_REFERENCE.map((item) => item.command.length));
 	const lines = [renderHeader({
 		version,
@@ -24727,7 +25085,7 @@ const renderHelpDetails = () => [
 ].map((line) => highlightRaigal(line, theme)).join("\n");
 const renderHome = (input = {}) => {
 	let out = renderHeader({
-		version: input.version ?? "1.0.0",
+		version: input.version ?? "1.0.2",
 		command: "--bare",
 		context: []
 	});
@@ -24885,100 +25243,15 @@ const matchFixAgent = (flags) => {
 	return FIX_AGENT_FLAGS.find((a) => flags[a.name])?.flag;
 };
 //#endregion
-//#region src/cloud/context.ts
-const execGit = (args, cwd) => {
-	try {
-		const res = spawnSync("git", args, {
-			cwd: path.resolve(cwd),
-			encoding: "utf-8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		});
-		if (res.error || res.status !== 0) return void 0;
-		return res.stdout.trim() || void 0;
-	} catch {
-		return;
-	}
-};
-const getRootCommitHash = (directory) => {
-	const hash = execGit([
-		"rev-list",
-		"--max-parents=0",
-		"HEAD"
-	], directory);
-	if (!hash) return void 0;
-	const firstLine = hash.split("\n")[0]?.trim();
-	return firstLine && /^[0-9a-f]{40,64}$/i.test(firstLine) ? firstLine : void 0;
-};
-const detectRepoRef = (directory, ownerId) => {
-	const detected = detectLocalRepoOwner(directory);
-	if (!detected.owner || !detected.repo) return null;
-	return {
-		provider: "github",
-		slug: `${detected.owner}/${detected.repo}`.toLowerCase(),
-		owner_id: ownerId,
-		root_commit_hash: getRootCommitHash(directory)
-	};
-};
-const readGitHubEventPayload = () => {
-	const eventPath = process.env.GITHUB_EVENT_PATH;
-	if (!eventPath || !fs.existsSync(eventPath)) return null;
-	try {
-		const content = fs.readFileSync(eventPath, "utf-8");
-		return JSON.parse(content);
-	} catch {
-		return null;
-	}
-};
-const detectGitContext = (directory) => {
-	const eventPayload = readGitHubEventPayload();
-	const pr = eventPayload?.pull_request;
-	let headSha = pr?.head?.sha;
-	if (!headSha) headSha = process.env.GITHUB_SHA || execGit(["rev-parse", "HEAD"], directory);
-	let branch = process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME;
-	if (!branch) {
-		branch = execGit([
-			"rev-parse",
-			"--abbrev-ref",
-			"HEAD"
-		], directory);
-		if (branch === "HEAD") branch = void 0;
-	}
-	let baseRef = pr?.base?.ref || process.env.GITHUB_BASE_REF;
-	if (!baseRef) baseRef = void 0;
-	let prNumber;
-	if (typeof pr?.number === "number") prNumber = pr.number;
-	else if (typeof eventPayload?.number === "number") prNumber = eventPayload.number;
-	else if (process.env.GITHUB_REF) {
-		const match = process.env.GITHUB_REF.match(/^refs\/pull\/(\d+)\//);
-		if (match && match[1]) prNumber = Number.parseInt(match[1], 10);
-	}
-	const result = {};
-	if (branch) result.branch = branch;
-	if (headSha) result.head_sha = headSha;
-	if (baseRef) result.base_ref = baseRef;
-	if (prNumber !== void 0 && !Number.isNaN(prNumber)) result.pr_number = prNumber;
-	return result;
-};
-const detectCiContext = () => {
-	if (process.env.GITHUB_ACTIONS === "true" || process.env.GITHUB_ACTIONS === "1") {
-		const serverUrl = process.env.GITHUB_SERVER_URL || "https://github.com";
-		const repo = process.env.GITHUB_REPOSITORY;
-		const runId = process.env.GITHUB_RUN_ID;
-		let runUrl;
-		if (repo && runId) {
-			const attempt = process.env.GITHUB_RUN_ATTEMPT;
-			runUrl = `${serverUrl}/${repo}/actions/runs/${runId}${attempt ? `/attempts/${attempt}` : ""}`;
-		}
-		return {
-			provider: "github-actions",
-			...runUrl ? { run_url: runUrl } : {}
-		};
-	}
-	if (process.env.CI === "true" || process.env.CI === "1") return { provider: process.env.GITLAB_CI && "gitlab-ci" || process.env.BITBUCKET_BUILD_NUMBER && "bitbucket-pipelines" || process.env.CIRCLECI && "circleci" || process.env.BUILDKITE && "buildkite" || process.env.TRAVIS && "travis-ci" || "generic-ci" };
+//#region src/output/rule-message.ts
+/**
+* Pure deterministic formatter for diagnostic messages.
+* Secret-class rules (or redactSource: true) unconditionally return FIXED_SECRET_DIAGNOSTIC_MESSAGE.
+* Non-secret rules return diagnostic.message (clamped to max 500 chars).
+*/
+const formatFindingMessage = (diagnostic) => {
+	if (diagnostic.redactSource || isSecretClassRule(diagnostic.rule)) return FIXED_SECRET_DIAGNOSTIC_MESSAGE;
+	return diagnostic.message.slice(0, 500);
 };
 //#endregion
 //#region src/cloud/fingerprint.ts
@@ -25020,7 +25293,8 @@ const toContractFinding = (diagnostic, rootDirectory, lineTextOverride) => {
 		severity,
 		path: relativePath,
 		line: Math.max(0, diagnostic.line),
-		fingerprint
+		fingerprint,
+		message: formatFindingMessage(diagnostic)
 	};
 };
 //#endregion
@@ -25111,96 +25385,6 @@ const applyPolicyToConfig = (localConfig, policy) => {
 	};
 };
 //#endregion
-//#region src/cloud/recorder.ts
-var CloudRunRecorder = class {
-	runId;
-	command;
-	directory;
-	flags;
-	startedAt;
-	steps = [];
-	report;
-	policyMeta;
-	seq = 0;
-	finished = false;
-	constructor(command, directory, flags = []) {
-		this.runId = randomUUID();
-		this.command = command;
-		this.directory = directory;
-		this.flags = flags.map((f) => f.replace(/^--?/, "")).filter((f) => f.length > 0).slice(0, 40);
-		this.startedAt = (/* @__PURE__ */ new Date()).toISOString();
-	}
-	recordStep(name, durationMs, ok = true, counts) {
-		if (this.steps.length >= 200) return;
-		this.steps.push({
-			seq: this.seq++,
-			name: name.slice(0, 80),
-			ok,
-			ms: Math.max(0, Math.round(durationMs)),
-			counts
-		});
-	}
-	setReport(report) {
-		this.report = report;
-	}
-	setPolicyMeta(version, hash) {
-		this.policyMeta = {
-			version,
-			hash: hash.slice(0, 64)
-		};
-	}
-	buildRunPayload(exitCode) {
-		const repo = detectRepoRef(this.directory) || {
-			provider: "github",
-			slug: "unknown/unknown"
-		};
-		const git = detectGitContext(this.directory);
-		const ci = detectCiContext();
-		const ownerVerified = Boolean(process.env.ACTIONS_ID_TOKEN_REQUEST_URL);
-		return {
-			run_id: this.runId,
-			command: this.command,
-			repo,
-			owner_verified: ownerVerified,
-			git,
-			ci,
-			flags: this.flags,
-			cli_version: APP_VERSION,
-			policy: this.policyMeta,
-			started_at: this.startedAt,
-			ended_at: (/* @__PURE__ */ new Date()).toISOString(),
-			exit_code: exitCode,
-			steps: this.steps.slice(0, 200),
-			report: this.report
-		};
-	}
-	async finish(exitCode) {
-		if (this.finished) return;
-		this.finished = true;
-		try {
-			enqueueRun(this.buildRunPayload(exitCode));
-			const activeToken = getActiveToken();
-			if (activeToken) await flushOutbox(activeToken.token);
-		} catch {}
-	}
-};
-let activeRecorder = null;
-const getActiveRecorder = () => activeRecorder;
-const startRunRecorder = (command, directory, flags = []) => {
-	const recorder = new CloudRunRecorder(command, directory, flags);
-	activeRecorder = recorder;
-	const activeToken = getActiveToken();
-	if (activeToken) flushOutbox(activeToken.token).catch(() => {});
-	return recorder;
-};
-const finishActiveRecorder = async (exitCode = 0) => {
-	if (activeRecorder) {
-		const rec = activeRecorder;
-		activeRecorder = null;
-		await rec.finish(exitCode);
-	}
-};
-//#endregion
 //#region src/engagement/pilot-invitation.ts
 const STATE_BASENAME = "pilot_invitation.scans";
 const INVITATION_SCAN_THRESHOLD = 3;
@@ -26435,12 +26619,12 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		scoreFileCount
 	});
 	if (options.sarif) {
-		const { buildSarifLog } = await import("./sarif-B-l1Fhzd.js");
+		const { buildSarifLog } = await import("./sarif--DI_2p2r.js");
 		console.log(JSON.stringify(buildSarifLog(results), null, 2));
 		return completion;
 	}
 	if (options.json) {
-		const { buildJsonOutput } = await import("./json-DBN8fnd3.js");
+		const { buildJsonOutput } = await import("./json-C9fBWj3V.js");
 		const jsonOut = buildJsonOutput(results, scoreResult, scoreFileCount, elapsedMs, scanCoverage);
 		console.log(JSON.stringify(jsonOut, null, 2));
 		return completion;
@@ -29390,7 +29574,16 @@ const shouldRenderPlainVersion = () => {
 		"version"
 	].includes(args[0] ?? "");
 };
-const program = new Command().name("raigal").description("The quality gate for agentic coding.").version(APP_VERSION, "-v, --version").argument("[directory]", "directory to scan when no command is passed", ".").option("--changes", "only scan changed files (git diff)").option("--staged", "only scan staged files").option("--base <ref>", "diff base for --changes, e.g. origin/main (default HEAD)").option("-d, --verbose", "show file details per rule").option("--json", "output JSON instead of terminal UI").option("--sarif", "output SARIF 2.1.0 (for GitHub code scanning)").option("--format <format>", "output format: json or sarif");
+const program = new Command().name("raigal").description("The quality gate for agentic coding.").version(APP_VERSION, "-v, --version").argument("[directory]", "directory to scan when no command is passed", ".");
+for (const [flag, description] of [
+	["--changes", "only scan changed files (git diff)"],
+	["--staged", "only scan staged files"],
+	["--base <ref>", "diff base for --changes, e.g. origin/main (default HEAD)"],
+	["-d, --verbose", "show file details per rule"],
+	["--json", "output JSON instead of terminal UI"],
+	["--sarif", "output SARIF 2.1.0 (for GitHub code scanning)"],
+	["--format <format>", "output format: json or sarif"]
+]) program.option(flag, description);
 addFilterAndFailOnOptions(program).showSuggestionAfterError().action(async (directory, flags) => {
 	if (hasNoUserArgs() && noFlagsPassed(flags) && process.stdin.isTTY) try {
 		await interactiveCommand(directory, loadConfig(directory));
@@ -29398,7 +29591,17 @@ addFilterAndFailOnOptions(program).showSuggestionAfterError().action(async (dire
 	} catch {}
 	await runScan(directory, flags);
 });
-addFilterAndFailOnOptions(program.command("scan [directory]").description("Score a project and print findings").option("--changes", "only scan changed files").option("--staged", "only scan staged files").option("--base <ref>", "diff base for --changes, e.g. origin/main (default HEAD)").option("-d, --verbose", "show file details per rule").option("--json", "output JSON").option("--sarif", "output SARIF 2.1.0 (for GitHub code scanning)").option("--format <format>", "output format: json or sarif")).action(async (directory = ".", _flags, command) => {
+const scanCmd = program.command("scan [directory]").description("Score a project and print findings");
+for (const [flag, description] of [
+	["--changes", "only scan changed files"],
+	["--staged", "only scan staged files"],
+	["--base <ref>", "diff base for --changes, e.g. origin/main (default HEAD)"],
+	["-d, --verbose", "show file details per rule"],
+	["--json", "output JSON"],
+	["--sarif", "output SARIF 2.1.0 (for GitHub code scanning)"],
+	["--format <format>", "output format: json or sarif"]
+]) scanCmd.option(flag, description);
+addFilterAndFailOnOptions(scanCmd).action(async (directory = ".", _flags, command) => {
 	await runScan(directory, command.optsWithGlobals());
 });
 const fixProgram = program.command("fix [directory]").description("Auto-fix findings or hand off to a coding agent").option("-d, --verbose", "show detailed fix progress").option("-f, --force", "run aggressive fixes (audit and framework dependency alignment)").option("--safe", "only apply reversible fixes (imports, comment removal, safe formatters); skip anything that deletes code, rewrites behaviour, or runs unsafe formatter configs").option("--dry-run", "print planned fix steps without writing files").addOption(new Option("--changes", "only fix changed files (git diff)").conflicts("staged")).addOption(new Option("--staged", "only fix staged files").conflicts("changes")).option("--base <ref>", "diff base for --changes, e.g. origin/main (default HEAD)").option("-p, --prompt", "print a prompt for your coding agent to fix remaining issues");
@@ -29532,4 +29735,4 @@ const main = async () => {
 };
 main();
 //#endregion
-export { FIXED_SECRET_DIAGNOSTIC_MESSAGE as a, APP_VERSION as i, withFindingAssessments as n, isSecretClassRule as o, ENGINE_INFO as r, summarizeFindingAssessments as t };
+export { requestApi as a, log as c, detectRepoRef as i, FIXED_SECRET_DIAGNOSTIC_MESSAGE as l, withFindingAssessments as n, getActiveToken as o, ENGINE_INFO as r, APP_VERSION as s, summarizeFindingAssessments as t, isSecretClassRule as u };