@methiu/raigal 1.0.1 → 1.0.3

package/dist/{core-o3KNKhg2.js → core-kJtASBYe.js}

@@ -20,11 +20,21 @@ const resolveRaigalRunRequest = (framework, options = {}) => {
 	};
 };
 const runRaigal = async (request) => new Promise((resolve) => {
-	spawn(request.bin, request.args, {
+	const child = spawn(request.bin, request.args, {
 		cwd: request.cwd,
 		env: request.env,
 		stdio: "inherit"
-	}).on("close", (exitCode, signal) => {
+	});
+	child.on("error", () => {
+		resolve({
+			command: request.bin,
+			args: request.args,
+			exitCode: 1,
+			signal: null,
+			skipped: false
+		});
+	});
+	child.on("close", (exitCode, signal) => {
 		resolve({
 			command: request.bin,
 			args: request.args,

package/dist/index.js

@@ -1,4 +1,4 @@
-import { t as APP_VERSION } from "./version-om7oAIVO.js";
+import { t as APP_VERSION } from "./version-gBpAhuDc.js";
 import { a as getEngineLabel, i as ENGINE_INFO, r as scoreImpactForRule, t as summarizeFindingAssessments } from "./finding-assessment-M5fUTE-C.js";
 import { n as isSecretClassRule, r as maskSecrets, t as FIXED_SECRET_DIAGNOSTIC_MESSAGE } from "./mask-secrets-BXn-ZSEh.js";
 import { createRequire, isBuiltin } from "node:module";
@@ -15803,7 +15803,8 @@ const Finding = z.object({
 	severity: Severity,
 	path: z.string().max(500),
 	line: z.number().int().nonnegative(),
-	fingerprint: z.string().length(32)
+	fingerprint: z.string().length(32),
+	message: z.string().max(500).optional()
 });
 const RepoRef = z.object({
 	provider: z.literal("github"),
@@ -15818,12 +15819,21 @@ const Step = z.object({
 	ms: z.number().int().nonnegative(),
 	counts: z.record(z.string(), z.number()).optional()
 });
+const AgentTelemetry = z.object({
+	provider: z.string().max(80),
+	before_score: z.number().min(0).max(100).nullable(),
+	after_score: z.number().min(0).max(100).nullable(),
+	pr_url: z.string().url().max(500).optional(),
+	patch_diff: z.string().max(2e4).optional(),
+	duration_ms: z.number().int().nonnegative().optional()
+});
 const Report = z.object({
 	score: z.number().min(0).max(100).nullable(),
 	scoreable: z.boolean(),
 	engine_scores: z.record(z.string(), z.number()).optional(),
 	files_scanned: z.number().int().nonnegative(),
-	findings: z.array(Finding).max(5e3)
+	findings: z.array(Finding).max(5e3),
+	agent_telemetry: AgentTelemetry.optional()
 });
 z.object({
 	run_id: z.uuid(),
@@ -15840,7 +15850,13 @@ z.object({
 		branch: z.string().max(200).optional(),
 		head_sha: z.string().max(64).optional(),
 		base_ref: z.string().max(200).optional(),
-		pr_number: z.number().int().optional()
+		pr_number: z.number().int().optional(),
+		diff_summary: z.object({
+			files_changed: z.number().int().nonnegative(),
+			additions: z.number().int().nonnegative(),
+			deletions: z.number().int().nonnegative()
+		}).optional(),
+		diff_preview: z.string().max(1e4).optional()
 	}),
 	ci: z.object({
 		provider: z.string().max(40),
@@ -15856,7 +15872,8 @@ z.object({
 	ended_at: z.iso.datetime(),
 	exit_code: z.number().int(),
 	steps: z.array(Step).max(200),
-	report: Report.optional()
+	report: Report.optional(),
+	agent_telemetry: AgentTelemetry.optional()
 });
 const Policy = z.object({
 	version: z.number().int(),
@@ -16051,7 +16068,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const claims = parsed.data;
 	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
 	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("1.0.1", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (!isVersionAtLeast("1.0.3", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -16218,7 +16235,7 @@ const getEntitlement = async () => {
 };
 //#endregion
 //#region src/cloud/owner.ts
-const GITHUB_REMOTE_RE = /^(?:git@github\.com:|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/.\s]+?)(?:\.git)?\s*$/;
+const GITHUB_REMOTE_RE = /^(?:(?:git@|ssh:\/\/(?:git@)?)github\.com(?::(?:\d+\/)?|[:/])|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/.\s]+?)(?:\.git)?\s*$/;
 const parseGitRemote = (rawUrl) => {
 	if (!rawUrl) return {
 		owner: null,
@@ -17916,6 +17933,17 @@ const detectRepoRef = (directory, ownerId) => {
 	};
 };
 //#endregion
+//#region src/output/rule-message.ts
+/**
+* Pure deterministic formatter for diagnostic messages.
+* Secret-class rules (or redactSource: true) unconditionally return FIXED_SECRET_DIAGNOSTIC_MESSAGE.
+* Non-secret rules return diagnostic.message (clamped to max 500 chars).
+*/
+const formatFindingMessage = (diagnostic) => {
+	if (diagnostic.redactSource || isSecretClassRule(diagnostic.rule)) return FIXED_SECRET_DIAGNOSTIC_MESSAGE;
+	return diagnostic.message.slice(0, 500);
+};
+//#endregion
 //#region src/cloud/fingerprint.ts
 /**
 * Normalizes line text: trims leading/trailing whitespace and compresses
@@ -17955,7 +17983,8 @@ const toContractFinding = (diagnostic, rootDirectory, lineTextOverride) => {
 		severity,
 		path: relativePath,
 		line: Math.max(0, diagnostic.line),
-		fingerprint
+		fingerprint,
+		message: formatFindingMessage(diagnostic)
 	};
 };
 //#endregion
@@ -19171,12 +19200,12 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		scoreFileCount
 	});
 	if (options.sarif) {
-		const { buildSarifLog } = await import("./sarif-C9k9QYGi.js");
+		const { buildSarifLog } = await import("./sarif-CuuawcSp.js");
 		console.log(JSON.stringify(buildSarifLog(results), null, 2));
 		return completion;
 	}
 	if (options.json) {
-		const { buildJsonOutput } = await import("./json-Be-AUuDb.js");
+		const { buildJsonOutput } = await import("./json-BpPaIvrn.js");
 		const jsonOut = buildJsonOutput(results, scoreResult, scoreFileCount, elapsedMs, scanCoverage);
 		console.log(JSON.stringify(jsonOut, null, 2));
 		return completion;

package/dist/{json-Be-AUuDb.js → json-BpPaIvrn.js}

@@ -1,4 +1,4 @@
-import { t as APP_VERSION } from "./version-om7oAIVO.js";
+import { t as APP_VERSION } from "./version-gBpAhuDc.js";
 import { i as ENGINE_INFO, n as withFindingAssessments, t as summarizeFindingAssessments } from "./finding-assessment-M5fUTE-C.js";
 //#region src/output/json.ts
 const buildJsonOutput = (results, scoreResult, fileCount, elapsedMs, coverage) => {

package/dist/{json-DBN8fnd3.js → json-C9fBWj3V.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { i as APP_VERSION, n as withFindingAssessments, r as ENGINE_INFO, t as summarizeFindingAssessments } from "./cli.js";
+import { n as withFindingAssessments, r as ENGINE_INFO, s as APP_VERSION, t as summarizeFindingAssessments } from "./cli.js";
 //#region src/output/json.ts
 const buildJsonOutput = (results, scoreResult, fileCount, elapsedMs, coverage) => {
 	const allDiagnostics = results.flatMap((r) => r.diagnostics);

package/dist/mcp.js

@@ -84,7 +84,7 @@ const getActiveToken = () => {
 };
 //#endregion
 //#region src/version.ts
-const APP_VERSION = "1.0.1";
+const APP_VERSION = "1.0.3";
 //#endregion
 //#region src/cloud/contract.ts
 const Severity = z.enum(["error", "warning"]);
@@ -94,7 +94,8 @@ const Finding = z.object({
 	severity: Severity,
 	path: z.string().max(500),
 	line: z.number().int().nonnegative(),
-	fingerprint: z.string().length(32)
+	fingerprint: z.string().length(32),
+	message: z.string().max(500).optional()
 });
 const RepoRef = z.object({
 	provider: z.literal("github"),
@@ -109,12 +110,21 @@ const Step = z.object({
 	ms: z.number().int().nonnegative(),
 	counts: z.record(z.string(), z.number()).optional()
 });
+const AgentTelemetry = z.object({
+	provider: z.string().max(80),
+	before_score: z.number().min(0).max(100).nullable(),
+	after_score: z.number().min(0).max(100).nullable(),
+	pr_url: z.string().url().max(500).optional(),
+	patch_diff: z.string().max(2e4).optional(),
+	duration_ms: z.number().int().nonnegative().optional()
+});
 const Report = z.object({
 	score: z.number().min(0).max(100).nullable(),
 	scoreable: z.boolean(),
 	engine_scores: z.record(z.string(), z.number()).optional(),
 	files_scanned: z.number().int().nonnegative(),
-	findings: z.array(Finding).max(5e3)
+	findings: z.array(Finding).max(5e3),
+	agent_telemetry: AgentTelemetry.optional()
 });
 z.object({
 	run_id: z.uuid(),
@@ -131,7 +141,13 @@ z.object({
 		branch: z.string().max(200).optional(),
 		head_sha: z.string().max(64).optional(),
 		base_ref: z.string().max(200).optional(),
-		pr_number: z.number().int().optional()
+		pr_number: z.number().int().optional(),
+		diff_summary: z.object({
+			files_changed: z.number().int().nonnegative(),
+			additions: z.number().int().nonnegative(),
+			deletions: z.number().int().nonnegative()
+		}).optional(),
+		diff_preview: z.string().max(1e4).optional()
 	}),
 	ci: z.object({
 		provider: z.string().max(40),
@@ -147,7 +163,8 @@ z.object({
 	ended_at: z.iso.datetime(),
 	exit_code: z.number().int(),
 	steps: z.array(Step).max(200),
-	report: Report.optional()
+	report: Report.optional(),
+	agent_telemetry: AgentTelemetry.optional()
 });
 z.object({
 	version: z.number().int(),
@@ -342,7 +359,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const claims = parsed.data;
 	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
 	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("1.0.1", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (!isVersionAtLeast("1.0.3", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -509,7 +526,7 @@ const getEntitlement = async () => {
 };
 //#endregion
 //#region src/cloud/owner.ts
-const GITHUB_REMOTE_RE = /^(?:git@github\.com:|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/.\s]+?)(?:\.git)?\s*$/;
+const GITHUB_REMOTE_RE = /^(?:(?:git@|ssh:\/\/(?:git@)?)github\.com(?::(?:\d+\/)?|[:/])|https:\/\/(?:[^@]+@)?github\.com\/)([^/]+)\/([^/.\s]+?)(?:\.git)?\s*$/;
 const parseGitRemote = (rawUrl) => {
 	if (!rawUrl) return {
 		owner: null,

package/dist/report-pr-closed-CDdQjRWj.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+import { a as requestApi, c as log, i as detectRepoRef, o as getActiveToken } from "./cli.js";
+import fs from "node:fs";
+//#region src/commands/report-pr-closed.ts
+const reportPrClosedCommand = async (options = {}) => {
+	try {
+		let prNumber = options.prNumber;
+		let merged = options.merged ?? false;
+		const eventPath = process.env.GITHUB_EVENT_PATH;
+		if (eventPath && fs.existsSync(eventPath)) try {
+			const eventData = JSON.parse(fs.readFileSync(eventPath, "utf-8"));
+			if (typeof eventData.pull_request?.number === "number") prNumber = eventData.pull_request.number;
+			else if (typeof eventData.number === "number") prNumber = eventData.number;
+			if (typeof eventData.pull_request?.merged === "boolean") merged = eventData.pull_request.merged;
+		} catch {}
+		if (!prNumber) {
+			log.info("No pull request number detected to report closed.");
+			return { exitCode: 0 };
+		}
+		const repo = detectRepoRef(process.cwd());
+		if (!repo) {
+			log.info("No repository detected.");
+			return { exitCode: 0 };
+		}
+		const token = getActiveToken()?.token;
+		await requestApi("/v1/pr-events", {
+			method: "POST",
+			token,
+			body: {
+				repo,
+				pr_number: prNumber,
+				event: "closed",
+				merged
+			},
+			timeoutMs: 3e3
+		});
+		log.info(`Reported PR #${prNumber} as ${merged ? "merged" : "closed"}.`);
+		return { exitCode: 0 };
+	} catch {
+		return { exitCode: 0 };
+	}
+};
+//#endregion
+export { reportPrClosedCommand };

package/dist/{sarif-B-l1Fhzd.js → sarif--DI_2p2r.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as FIXED_SECRET_DIAGNOSTIC_MESSAGE, i as APP_VERSION, o as isSecretClassRule } from "./cli.js";
+import { l as FIXED_SECRET_DIAGNOSTIC_MESSAGE, s as APP_VERSION, u as isSecretClassRule } from "./cli.js";
 import path from "node:path";
 //#region src/output/sarif.ts
 const SARIF_VERSION = "2.1.0";

package/dist/{sarif-C9k9QYGi.js → sarif-CuuawcSp.js}

@@ -1,4 +1,4 @@
-import { t as APP_VERSION } from "./version-om7oAIVO.js";
+import { t as APP_VERSION } from "./version-gBpAhuDc.js";
 import { n as isSecretClassRule, t as FIXED_SECRET_DIAGNOSTIC_MESSAGE } from "./mask-secrets-BXn-ZSEh.js";
 import path from "node:path";
 //#region src/output/sarif.ts

package/dist/{version-om7oAIVO.js → version-gBpAhuDc.js}

@@ -1,6 +1,6 @@
 import "node:fs";
 import "node:url";
 //#region src/version.ts
-const APP_VERSION = "1.0.1";
+const APP_VERSION = "1.0.3";
 //#endregion
 export { APP_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@methiu/raigal",
-	"version": "1.0.1",
+	"version": "1.0.3",
 	"publishConfig": {
 		"access": "public"
 	},