@praneeth_54/agentdoctor 0.2.0-beta → 0.3.0-beta

package/CHANGELOG.md

@@ -7,10 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.0-beta] — 2026-08-07
+
+Minor beta: completes the Scan → Fix → Verify CLI loop and corrects release-facing honesty.
+
+### Added
+
+- `agentdoctor verify` — re-scan and compare against a prior `scan --json` baseline
+  (`fixed` / `remaining` / `new` / `unchanged`). Supports `--json`, `--ci` (fails on new
+  findings), `--baseline`, and `--min-score`. Completes the Scan → Fix → Verify CLI loop.
+- Terminal summary prints overall readiness (`N/100`); category/agent scores remain in JSON.
+
+### Fixed
+
+- `agentdoctor scan --json` (and `--ci` / `--verbose` / `--min-score` on the `scan`
+  subcommand) now honor flags correctly. Overlapping root/subcommand options are read via
+  Commander `optsWithGlobals()`, so CI scripts using `scan … --json` receive JSON instead of
+  a terminal report.
+- `instructions/missing-path-reference` no longer treats Go/npm module imports
+  (`github.com/…`, `@scope/pkg`), Go stdlib paths (`io/ioutil`), glob patterns, code tokens
+  (`try/finally`), or bare build roots (`dist/`) as missing local paths.
+- `agentdoctor fix` now reports skip reasons for review/manual findings instead of an empty
+  “no applicable fixes” message with no explanation.
+- Sample/test/example paths and env templates no longer inflate security/context false positives.
+
+### Compatibility
+
+- Default Action `version` input is `0.3.0-beta` (pin CI smoke to last published until npm ships)
+- Fix remains Cursor `.cursorignore` safe-context only; security findings stay review/manual
+
 ### Planned
 
-- Safe automatic fixes
-- Terminal readiness line and GitHub Action score-gate inputs (deferred; see scoring.md v2+)
+- GitHub Action score-gate inputs (deferred; see scoring.md v2+)
 
 ## [0.2.0-beta] — 2026-08-02
 
@@ -143,7 +171,8 @@ First public beta.
 - Not a complete secret scanner
 - Git “tracked secret” detection deferred
 
-[Unreleased]: https://github.com/pranee54/AgentDoctor/compare/v0.2.0-beta...HEAD
+[Unreleased]: https://github.com/pranee54/AgentDoctor/compare/v0.3.0-beta...HEAD
+[0.3.0-beta]: https://github.com/pranee54/AgentDoctor/releases/tag/v0.3.0-beta
 [0.2.0-beta]: https://github.com/pranee54/AgentDoctor/releases/tag/v0.2.0-beta
 [0.1.4-beta]: https://github.com/pranee54/AgentDoctor/releases/tag/v0.1.4-beta
 [0.1.3-beta]: https://github.com/pranee54/AgentDoctor/releases/tag/v0.1.3-beta

package/README.md

@@ -16,7 +16,7 @@ AgentDoctor is a local CLI that inspects project-level AI coding agent setup —
 npx @praneeth_54/agentdoctor
 ```
 
-Public beta (`0.1.x-beta`). Deterministic readiness scores ship in JSON; automatic fixes are not available yet.
+Public beta (`0.3.0-beta`). Scan → Fix → Verify. Deterministic scores in the terminal and JSON.
 
 ---
 
@@ -24,12 +24,12 @@ Public beta (`0.1.x-beta`). Deterministic readiness scores ship in JSON; automat
 
 ![AgentDoctor scanning a repository and reporting coding-agent security findings](docs/images/cli-scan.png)
 
-_Real scan of the included `insecure-agent-project` fixture using AgentDoctor v0.2.0-beta._
+_Real scan of the included `insecure-agent-project` fixture using AgentDoctor v0.3.0-beta._
 
 ```text
 $ npx @praneeth_54/agentdoctor
 
-🩺 AgentDoctor v0.2.0-beta
+🩺 AgentDoctor v0.3.0-beta
 
 Scanning repository...
 
@@ -71,10 +71,11 @@ Summary
   1 warning
   0 info
 
-Scoring: not included in this release
+  Readiness: 13/100
+  Category and agent scores: agentdoctor scan --json
 ```
 
-Abbreviated text example from the same fixture for accessibility and search. Secret values are never printed.
+Abbreviated text example from the same fixture for accessibility and search. Secret values are never printed. Re-run the scan if counts change.
 
 ---
 
@@ -99,7 +100,7 @@ Manually reviewing all of that across Cursor, Claude Code, and Codex is slow and
 | ESLint          | Source code                      |
 | **AgentDoctor** | **AI coding agent environments** |
 
-AgentDoctor analyzes configuration. It does not run agents, call an LLM, or modify your repository in this release.
+AgentDoctor analyzes configuration. It does not run agents or call an LLM. `agentdoctor fix` may append safe Cursor ignore patterns; it does not rewrite security settings or credentials.
 
 ---
 
@@ -139,8 +140,9 @@ You get deterministic findings with:
 - evidence paths
 - affected agents when exposure claims are supported
 - conservative recommendations
+- readiness score (`scores.overall` in JSON; overall line in the terminal)
 
-Automatic repair is **not** included in this beta. Findings tell you what to review; you decide what to change.
+Safe Cursor context exclusions can be applied with `agentdoctor fix`. Security and review findings stay manual — Fix explains why and does not invent unsafe edits.
 
 ---
 
@@ -155,7 +157,7 @@ npx @praneeth_54/agentdoctor
 Pin a beta version when you need a fixed install:
 
 ```bash
-npx @praneeth_54/agentdoctor@0.2.0-beta
+npx @praneeth_54/agentdoctor@0.3.0-beta
 ```
 
 ### Global (optional)
@@ -165,12 +167,29 @@ npm install -g @praneeth_54/agentdoctor
 agentdoctor
 ```
 
+### Scan → Fix → Verify
+
+```bash
+# 1. Scan (save a baseline for Verify)
+npx @praneeth_54/agentdoctor scan . --json > agentdoctor-report.json
+
+# 2. Fix safe Cursor context exclusions (preview first with --dry-run)
+npx @praneeth_54/agentdoctor fix . --dry-run
+npx @praneeth_54/agentdoctor fix . -y
+
+# 3. Verify against the baseline
+npx @praneeth_54/agentdoctor verify . --baseline agentdoctor-report.json
+```
+
+`fix` currently writes `.cursorignore` patterns for safe context findings (for example unignored `build/` or large logs). Review/manual security findings are listed as skipped — address those yourself, then re-run `verify`.
+
 ### Common commands
 
 ```bash
 agentdoctor .
-agentdoctor . --json
-agentdoctor . --verbose
+agentdoctor scan . --json
+agentdoctor fix . --dry-run
+agentdoctor verify . --ci --baseline agentdoctor-report.json
 agentdoctor explain security/env-file-exposure
 agentdoctor doctor
 ```
@@ -184,10 +203,11 @@ npm install @praneeth_54/agentdoctor
 ```
 
 ```ts
-import { scan } from "@praneeth_54/agentdoctor";
+import { scan, verify, buildFixPlan, applyFixPlan } from "@praneeth_54/agentdoctor";
 
 const result = await scan({ cwd: process.cwd() });
 console.log(result.summary);
+console.log(result.scores?.overall);
 console.log(result.agentSecurityAnalysis); // "full" | "limited"
 ```
 
@@ -259,7 +279,7 @@ steps:
 
   - name: Audit coding-agent configuration
     id: agentdoctor
-    uses: pranee54/AgentDoctor@v0.2.0-beta
+    uses: pranee54/AgentDoctor@v0.3.0-beta
     with:
       path: .
       output-file: agentdoctor-report.json
@@ -271,7 +291,7 @@ steps:
       path: ${{ steps.agentdoctor.outputs.report-path }}
 ```
 
-The action installs the published `@praneeth_54/agentdoctor@0.2.0-beta` package, runs it with
+The action installs the published `@praneeth_54/agentdoctor@0.3.0-beta` package, runs it with
 `--ci --json`, and writes the report inside the checked-out workspace. It sets up Node.js 20
 for the CLI. The optional `version` input accepts an exact npm version or the `latest` / `beta`
 dist-tag.
@@ -297,8 +317,8 @@ Exit codes: [docs/exit-codes.md](docs/exit-codes.md). Compatibility promises: [d
 ### Readiness scoring
 
 Scans populate `scoringAvailable: true` and a deterministic `scores` object
-(overall, categories, agents). The terminal report does not render a readiness line yet;
-scores are available in JSON (`--json`).
+(overall, categories, agents). The terminal prints overall readiness; category and agent
+scores are in JSON (`--json`).
 
 `--min-score N` is enforced by the CLI. Details (weights, security caps, threshold rules,
 and deferred v2 items): [docs/scoring.md](docs/scoring.md).
@@ -309,16 +329,17 @@ and deferred v2 items): [docs/scoring.md](docs/scoring.md).
 
 Honest limits of the current public beta:
 
-| Limitation                          | Status                                                          |
-| ----------------------------------- | --------------------------------------------------------------- |
-| Terminal readiness line             | Scores ship in JSON only; terminal does not print N/100 yet     |
-| GitHub Action score gates           | Action remains `--ci --json` report-only (no `min-score` input) |
-| Automatic fixes (`agentdoctor fix`) | Stub only — does not modify files                               |
-| Secret-content scanning             | Filename / config heuristics only                               |
-| Detection style                     | Intentionally conservative; false security findings are avoided |
-| Agent coverage                      | Cursor, Claude Code, Codex project configs                      |
-
-See [CHANGELOG.md](CHANGELOG.md) and [docs/release-notes-v0.2.0-beta.md](docs/release-notes-v0.2.0-beta.md).
+| Limitation                  | Status                                                              |
+| --------------------------- | ------------------------------------------------------------------- |
+| Automatic fixes             | Safe Cursor `.cursorignore` context exclusions only                 |
+| Claude Code / Codex writers | Not implemented — Fix skips with an explicit reason                 |
+| Security findings           | Review/manual — Fix does not rewrite secrets or permission settings |
+| GitHub Action score gates   | Action remains `--ci --json` report-only (no `min-score` input)     |
+| Secret-content scanning     | Filename / config heuristics only                                   |
+| Detection style             | Intentionally conservative; false security findings are avoided     |
+| Agent coverage              | Cursor, Claude Code, Codex project configs                          |
+
+See [CHANGELOG.md](CHANGELOG.md) and [docs/compatibility.md](docs/compatibility.md).
 
 ---
 

package/dist/cli/commands/doctor.js

@@ -15,7 +15,7 @@ export async function runDoctorCommand() {
     lines.push(`  ${symbolOk()} Core scan API available`);
     lines.push("");
     lines.push(colors.dim("Environment looks ready."));
-    lines.push(colors.dim("Automatic fixes are not available yet."));
+    lines.push(colors.dim("Run agentdoctor scan → fix → verify to complete the readiness loop."));
     lines.push("");
     process.stdout.write(lines.join("\n"));
     return EXIT_CODES.SUCCESS;

package/dist/cli/commands/explain.js

@@ -39,9 +39,9 @@ export async function runExplainCommand(ruleId) {
     lines.push("");
     lines.push(colors.bold("Can AgentDoctor safely fix it?"));
     lines.push(rule.fixability === "safe"
-        ? "  Potentially yes. Conservative auto-fix is planned but not applied today."
+        ? "  Yes for Cursor context exclusions (`agentdoctor fix`). Other agents may still need a manual step."
         : rule.fixability === "review"
-            ? "  Only with review. Automatic fixes are not applied today."
+            ? "  No — requires human review. Fix reports why and leaves the file unchanged."
             : rule.fixability === "manual"
                 ? "  No automatic fix. Manual remediation required."
                 : "  No fix available.");

package/dist/cli/commands/fix.d.ts

@@ -1,8 +1,10 @@
 import { type ExitCode } from "../../types/index.js";
-/**
- * Safe automatic fixes are not implemented yet.
- */
-export declare function runFixCommand(options: {
+export interface FixCommandOptions {
+    targetPath?: string;
     dryRun?: boolean;
     yes?: boolean;
-}): Promise<ExitCode>;
+}
+/**
+ * Safe Repository Mutation — apply allowlisted agent-config exclusions.
+ */
+export declare function runFixCommand(options: FixCommandOptions): Promise<ExitCode>;

package/dist/cli/commands/fix.js

@@ -1,19 +1,64 @@
 import { EXIT_CODES } from "../../types/index.js";
+import { isDirectory } from "../../utils/fs.js";
+import { resolveRepoRoot } from "../../utils/path.js";
+import { applyFixPlan, readCursorignore } from "../../core/fix/apply.js";
+import { buildFixPlan } from "../../core/fix/plan.js";
+import { renderFixPlanTerminal } from "../../core/fix/render.js";
+import { runFix } from "../../core/fix/run.js";
+import { scan } from "../../core/scanner/scan.js";
 import { colors } from "../../utils/colors.js";
 /**
- * Safe automatic fixes are not implemented yet.
+ * Safe Repository Mutation — apply allowlisted agent-config exclusions.
  */
 export async function runFixCommand(options) {
-    const lines = [];
-    lines.push("");
-    lines.push(colors.bold("AgentDoctor fix"));
-    lines.push("");
-    if (options.dryRun) {
-        lines.push("  Dry-run mode requested.");
+    const target = resolveRepoRoot(options.targetPath ?? process.cwd());
+    if (!(await isDirectory(target))) {
+        console.error(`Error: not a directory: ${target}`);
+        return EXIT_CODES.USAGE_ERROR;
+    }
+    const dryRun = options.dryRun === true;
+    const yes = options.yes === true;
+    try {
+        if (dryRun) {
+            const result = await scan({ cwd: target });
+            const plan = await buildFixPlan(result);
+            const cursorContent = await readCursorignore(plan.root);
+            const applyResult = await applyFixPlan(plan, { dryRun: true });
+            process.stdout.write(renderFixPlanTerminal(plan, {
+                dryRun: true,
+                cursorContent,
+                applyResult,
+            }));
+            return EXIT_CODES.SUCCESS;
+        }
+        const { plan, applyResult, cancelled } = await runFix({
+            cwd: target,
+            dryRun: false,
+            yes,
+        });
+        if (cancelled) {
+            process.stdout.write("\n  Cancelled. No files were modified.\n\n");
+            return EXIT_CODES.SUCCESS;
+        }
+        const cursorContentAfter = await readCursorignore(plan.root);
+        process.stdout.write(renderFixPlanTerminal(plan, {
+            dryRun: false,
+            cursorContent: cursorContentAfter,
+            applyResult,
+        }));
+        // After apply, show a short re-scan hint / delta for Cursor-fixable rules
+        if (applyResult.writtenFiles.length > 0) {
+            const after = await scan({ cwd: target });
+            const remainingSafeContext = after.findings.filter((f) => f.fixability === "safe" &&
+                (f.ruleId === "context/generated-directory" || f.ruleId === "context/large-log-file") &&
+                f.affectedAgents.includes("cursor"));
+            process.stdout.write(colors.dim(`  Re-scan: ${remainingSafeContext.length} Cursor-related safe context finding(s) remain.\n\n`));
+        }
+        return EXIT_CODES.SUCCESS;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(`Error: ${message}`);
+        return EXIT_CODES.INTERNAL_ERROR;
     }
-    lines.push("  Fix mode is not implemented yet.");
-    lines.push("  No files were modified.");
-    lines.push("");
-    process.stdout.write(lines.join("\n"));
-    return EXIT_CODES.SUCCESS;
 }

package/dist/cli/commands/verify.d.ts

@@ -0,0 +1,13 @@
+import { type ExitCode } from "../../types/index.js";
+export interface VerifyCommandOptions {
+    targetPath?: string;
+    baselinePath?: string;
+    json?: boolean;
+    ci?: boolean;
+    verbose?: boolean;
+    minScore?: number;
+}
+/**
+ * Verify: re-scan after Fix and compare against a prior scan JSON baseline.
+ */
+export declare function runVerifyCommand(options: VerifyCommandOptions): Promise<ExitCode>;

package/dist/cli/commands/verify.js

@@ -0,0 +1,56 @@
+import { verify } from "../../core/verify/verify.js";
+import { renderVerifyJsonReport } from "../../reporters/verify/json.js";
+import { renderVerifyTerminalReport } from "../../reporters/verify/terminal.js";
+import { EXIT_CODES } from "../../types/index.js";
+import { isDirectory } from "../../utils/fs.js";
+import { resolveRepoRoot } from "../../utils/path.js";
+/**
+ * Verify: re-scan after Fix and compare against a prior scan JSON baseline.
+ */
+export async function runVerifyCommand(options) {
+    const target = resolveRepoRoot(options.targetPath ?? process.cwd());
+    if (!(await isDirectory(target))) {
+        console.error(`Error: not a directory: ${target}`);
+        return EXIT_CODES.USAGE_ERROR;
+    }
+    try {
+        const result = await verify({
+            cwd: target,
+            verbose: options.verbose ?? false,
+            ...(options.baselinePath !== undefined ? { baselinePath: options.baselinePath } : {}),
+        });
+        if (options.json) {
+            process.stdout.write(renderVerifyJsonReport(result));
+        }
+        else {
+            process.stdout.write(renderVerifyTerminalReport(result, options.verbose === true));
+        }
+        if (options.minScore !== undefined && result.scores !== null) {
+            if (result.scores.overall < options.minScore) {
+                if (!options.json) {
+                    console.error(`\nCI check failed: overall score ${result.scores.overall} is below --min-score ${options.minScore}`);
+                }
+                return EXIT_CODES.ISSUES_OR_THRESHOLD;
+            }
+        }
+        // In CI, newly introduced findings are regressions after Fix.
+        if (options.ci === true && result.summary.new > 0) {
+            if (!options.json) {
+                console.error(`\nCI check failed: verify found ${result.summary.new} new finding(s) not present in the baseline`);
+            }
+            return EXIT_CODES.ISSUES_OR_THRESHOLD;
+        }
+        return EXIT_CODES.SUCCESS;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(`Error: ${message}`);
+        if (options.verbose && error instanceof Error && error.stack) {
+            console.error(error.stack);
+        }
+        if (message.includes("baseline") || message.includes("No verify baseline")) {
+            return EXIT_CODES.USAGE_ERROR;
+        }
+        return EXIT_CODES.INTERNAL_ERROR;
+    }
+}

package/dist/cli/program.js

@@ -4,6 +4,7 @@ import { runDoctorCommand } from "./commands/doctor.js";
 import { runExplainCommand } from "./commands/explain.js";
 import { runFixCommand } from "./commands/fix.js";
 import { resolveTargetArgument, runScanCommand } from "./commands/scan.js";
+import { runVerifyCommand } from "./commands/verify.js";
 import { EXIT_CODES } from "../types/index.js";
 function parseMinScore(value) {
     const parsed = Number(value);
@@ -21,59 +22,81 @@ function readMinScore(options) {
     }
     return undefined;
 }
+/**
+ * Scan flags are declared on both the root program and the `scan` subcommand
+ * so `--help` stays accurate. Commander stores overlapping flags on the parent
+ * when `scan` is invoked, so callers must read `optsWithGlobals()`.
+ */
+function addScanOptions(command) {
+    return command
+        .option("--json", "Emit machine-readable JSON (no decorative output)", false)
+        .option("--ci", "CI mode (non-interactive; report-only unless --min-score is set)", false)
+        .option("--verbose", "Show timing and extra diagnostics", false)
+        .option("--min-score <number>", "Exit 1 when overall readiness score is below this (0-100)", parseMinScore);
+}
+async function runScanFromCli(pathArg, command) {
+    const options = command.optsWithGlobals();
+    const minScore = readMinScore(options);
+    const code = await runScanCommand({
+        targetPath: resolveTargetArgument(pathArg),
+        json: Boolean(options.json),
+        ci: Boolean(options.ci),
+        verbose: Boolean(options.verbose),
+        ...(minScore !== undefined ? { minScore } : {}),
+    });
+    process.exitCode = code;
+}
 export function createProgram() {
     const program = new Command();
-    program
+    addScanOptions(program
         .name("agentdoctor")
         .description("Audit AI coding agent configuration in a repository (local, deterministic, no API key).")
         .version(PACKAGE_VERSION, "-V, --version", "Print AgentDoctor version")
-        .argument("[path]", "Repository path to scan (default: current directory)")
-        .option("--json", "Emit machine-readable JSON (no decorative output)", false)
-        .option("--ci", "CI mode (non-interactive; report-only unless --min-score is set)", false)
-        .option("--verbose", "Show timing and extra diagnostics", false)
-        .option("--min-score <number>", "Exit 1 when overall readiness score is below this (0-100)", parseMinScore)
+        .argument("[path]", "Repository path to scan (default: current directory)")).action(async (pathArg, _options, command) => {
+        await runScanFromCli(pathArg, command);
+    });
+    addScanOptions(program
+        .command("scan")
+        .description("Scan a repository for AI coding agent configuration issues (default command)")
+        .argument("[path]", "Repository path to scan")).action(async (pathArg, _options, command) => {
+        await runScanFromCli(pathArg, command);
+    });
+    program
+        .command("fix")
+        .description("Apply safe automatic fixes (Cursor .cursorignore for safe context findings)")
+        .argument("[path]", "Repository path (default: current directory)")
+        .option("--dry-run", "Show proposed fixes without writing files", false)
+        .option("-y, --yes", "Skip confirmation prompts", false)
         .action(async (pathArg, options) => {
-        const minScore = readMinScore(options);
-        const code = await runScanCommand({
+        const code = await runFixCommand({
             targetPath: resolveTargetArgument(pathArg),
-            json: Boolean(options.json),
-            ci: Boolean(options.ci),
-            verbose: Boolean(options.verbose),
-            ...(minScore !== undefined ? { minScore } : {}),
+            dryRun: Boolean(options.dryRun),
+            yes: Boolean(options.yes),
         });
         process.exitCode = code;
     });
     program
-        .command("scan")
-        .description("Scan a repository for AI coding agent configuration issues (default command)")
-        .argument("[path]", "Repository path to scan")
+        .command("verify")
+        .description("Re-scan and compare against a prior scan JSON baseline (Scan → Fix → Verify)")
+        .argument("[path]", "Repository path (default: current directory)")
         .option("--json", "Emit machine-readable JSON", false)
-        .option("--ci", "CI mode (non-interactive; report-only unless --min-score is set)", false)
+        .option("--ci", "CI mode: exit 1 when new findings appear (also honors --min-score)", false)
         .option("--verbose", "Show timing and extra diagnostics", false)
+        .option("--baseline <file>", "Prior scan JSON report (default: agentdoctor-report.json or .agentdoctor-baseline.json)")
         .option("--min-score <number>", "Exit 1 when overall readiness score is below this (0-100)", parseMinScore)
-        .action(async (pathArg, options) => {
+        .action(async (pathArg, _options, command) => {
+        const options = command.optsWithGlobals();
         const minScore = readMinScore(options);
-        const code = await runScanCommand({
+        const code = await runVerifyCommand({
             targetPath: resolveTargetArgument(pathArg),
             json: Boolean(options.json),
             ci: Boolean(options.ci),
             verbose: Boolean(options.verbose),
+            ...(typeof options.baseline === "string" ? { baselinePath: options.baseline } : {}),
             ...(minScore !== undefined ? { minScore } : {}),
         });
         process.exitCode = code;
     });
-    program
-        .command("fix")
-        .description("Apply safe automatic fixes (not implemented yet)")
-        .option("--dry-run", "Show proposed fixes without writing files", false)
-        .option("-y, --yes", "Skip confirmation prompts", false)
-        .action(async (options) => {
-        const code = await runFixCommand({
-            dryRun: Boolean(options.dryRun),
-            yes: Boolean(options.yes),
-        });
-        process.exitCode = code;
-    });
     program
         .command("explain")
         .description("Explain a rule by id")

package/dist/constants.d.ts

@@ -1,4 +1,4 @@
-export declare const PACKAGE_VERSION = "0.2.0-beta";
+export declare const PACKAGE_VERSION = "0.3.0-beta";
 export declare const DEFAULT_MAX_FILE_SIZE_BYTES: number;
 /** Directories skipped during normal discovery (unless a rule needs them later). */
 export declare const DEFAULT_IGNORE_DIRECTORIES: Set<string>;

package/dist/constants.js

@@ -1,4 +1,4 @@
-export const PACKAGE_VERSION = "0.2.0-beta";
+export const PACKAGE_VERSION = "0.3.0-beta";
 export const DEFAULT_MAX_FILE_SIZE_BYTES = 2 * 1024 * 1024; // 2 MiB
 /** Directories skipped during normal discovery (unless a rule needs them later). */
 export const DEFAULT_IGNORE_DIRECTORIES = new Set([

package/dist/core/fix/apply.d.ts

@@ -0,0 +1,10 @@
+import type { FixApplyResult, FixPlan } from "./types.js";
+import { previewCursorignoreActions, readCursorignore } from "./writers/cursorignore.js";
+/**
+ * Apply (or dry-run) a fix plan.
+ * Week 1: only `.cursorignore` mutations are supported.
+ */
+export declare function applyFixPlan(plan: FixPlan, options: {
+    dryRun: boolean;
+}): Promise<FixApplyResult>;
+export { previewCursorignoreActions, readCursorignore };

package/dist/core/fix/apply.js

@@ -0,0 +1,27 @@
+import { previewCursorignoreActions, readCursorignore, writeCursorignore, } from "./writers/cursorignore.js";
+/**
+ * Apply (or dry-run) a fix plan.
+ * Week 1: only `.cursorignore` mutations are supported.
+ */
+export async function applyFixPlan(plan, options) {
+    const current = await readCursorignore(plan.root);
+    const preview = previewCursorignoreActions(current, plan.actions);
+    if (!preview) {
+        return {
+            plan,
+            dryRun: options.dryRun,
+            writtenFiles: [],
+            changedFiles: [],
+        };
+    }
+    if (!options.dryRun) {
+        await writeCursorignore(plan.root, preview.after);
+    }
+    return {
+        plan,
+        dryRun: options.dryRun,
+        writtenFiles: options.dryRun ? [] : [preview.targetRelativePath],
+        changedFiles: [preview.targetRelativePath],
+    };
+}
+export { previewCursorignoreActions, readCursorignore };

package/dist/core/fix/patterns.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/index.js";
+export declare function isSafeContextFixRule(ruleId: string): boolean;
+/**
+ * Build a gitignore-style pattern that excludes the finding evidence path.
+ * Directories (generated-directory) get a trailing slash.
+ */
+export declare function patternForFinding(finding: Finding): string | null;

package/dist/core/fix/patterns.js

@@ -0,0 +1,21 @@
+const SAFE_CONTEXT_RULES = new Set(["context/generated-directory", "context/large-log-file"]);
+export function isSafeContextFixRule(ruleId) {
+    return SAFE_CONTEXT_RULES.has(ruleId);
+}
+/**
+ * Build a gitignore-style pattern that excludes the finding evidence path.
+ * Directories (generated-directory) get a trailing slash.
+ */
+export function patternForFinding(finding) {
+    const evidencePath = finding.evidence?.path?.replace(/\\/g, "/").replace(/^\/+/, "");
+    if (!evidencePath) {
+        return null;
+    }
+    if (finding.ruleId === "context/generated-directory") {
+        return evidencePath.endsWith("/") ? evidencePath : `${evidencePath}/`;
+    }
+    if (finding.ruleId === "context/large-log-file") {
+        return evidencePath;
+    }
+    return null;
+}

package/dist/core/fix/plan.d.ts

@@ -0,0 +1,9 @@
+import type { ScanResult } from "../../types/index.js";
+import type { FixPlan } from "./types.js";
+/**
+ * Build a fix plan from a scan result.
+ * Week 1: Cursor `.cursorignore` appends for safe context findings only.
+ */
+export declare function buildFixPlan(result: ScanResult): Promise<FixPlan>;
+/** Patterns that would be newly appended given current file contents. */
+export declare function missingPatternsForCursorignore(currentContent: string | null, patterns: string[]): string[];