@rigour-labs/core 2.1.0 → 2.3.0

package/dist/discovery.js

@@ -61,15 +61,20 @@ export class DiscoveryService {
         return false;
     }
     async findSourceFiles(cwd) {
-        // Find a few files to sample
         const extensions = ['.ts', '.js', '.py', '.go', '.java', '.tf', 'package.json'];
         const samples = [];
-        const files = await fs.readdir(cwd);
-        for (const file of files) {
-            if (extensions.some(ext => file.endsWith(ext))) {
-                samples.push(path.join(cwd, file));
-                if (samples.length >= 5)
-                    break;
+        const commonDirs = ['.', 'src', 'app', 'lib', 'api', 'pkg'];
+        for (const dir of commonDirs) {
+            const fullDir = path.join(cwd, dir);
+            if (!(await fs.pathExists(fullDir)))
+                continue;
+            const files = await fs.readdir(fullDir);
+            for (const file of files) {
+                if (extensions.some(ext => file.endsWith(ext))) {
+                    samples.push(path.join(fullDir, file));
+                    if (samples.length >= 5)
+                        return samples;
+                }
             }
         }
         return samples;

package/dist/discovery.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/discovery.test.js

@@ -0,0 +1,57 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { DiscoveryService } from './discovery.js';
+import fs from 'fs-extra';
+vi.mock('fs-extra');
+describe('DiscoveryService', () => {
+    beforeEach(() => {
+        vi.resetAllMocks();
+    });
+    it('should discover project marker in root directory', async () => {
+        const service = new DiscoveryService();
+        vi.mocked(fs.pathExists).mockImplementation(async (p) => p.includes('package.json'));
+        vi.mocked(fs.readdir).mockResolvedValue(['package.json']);
+        vi.mocked(fs.readFile).mockResolvedValue('{}');
+        const result = await service.discover('/test');
+        // If package.json doesn't match a specific role marker, it stays Universal.
+        // Let's mock a specific one like 'express'
+        vi.mocked(fs.pathExists).mockImplementation(async (p) => p.includes('express'));
+        const result2 = await service.discover('/test');
+        expect(result2.matches.preset?.name).toBe('api');
+    });
+    it('should discover project marker in src/ directory (Deep Detection)', async () => {
+        const service = new DiscoveryService();
+        vi.mocked(fs.pathExists).mockImplementation((async (p) => {
+            if (p.endsWith('src'))
+                return true;
+            if (p.includes('src/index.ts'))
+                return true;
+            return false;
+        }));
+        vi.mocked(fs.readdir).mockImplementation((async (p) => {
+            if (p.toString().endsWith('/test'))
+                return ['src'];
+            if (p.toString().endsWith('src'))
+                return ['index.ts'];
+            return [];
+        }));
+        vi.mocked(fs.readFile).mockResolvedValue('export const x = 1;');
+        const result = await service.discover('/test');
+        // Since UNIVERSAL_CONFIG has a default, we check if it found something extra or matches expectation
+        // Default is universal, but detecting .ts should tilt it towards node or similar if configured
+        // In our current templates, package.json is the node marker.
+        // Let's check for paradigm detection which uses content
+        expect(result.config).toBeDefined();
+    });
+    it('should identify OOP paradigm from content in subfolder', async () => {
+        const service = new DiscoveryService();
+        vi.mocked(fs.pathExists).mockImplementation((async (p) => p.endsWith('src') || p.endsWith('src/Service.ts')));
+        vi.mocked(fs.readdir).mockImplementation((async (p) => {
+            if (p.toString().endsWith('src'))
+                return ['Service.ts'];
+            return ['src'];
+        }));
+        vi.mocked(fs.readFile).mockResolvedValue('class MyService {}');
+        const result = await service.discover('/test');
+        expect(result.matches.paradigm?.name).toBe('oop');
+    });
+});

package/dist/gates/ast-handlers/python.js

@@ -10,8 +10,22 @@ export class PythonHandler extends ASTHandler {
     async run(context) {
         const failures = [];
         const scriptPath = path.join(__dirname, 'python_parser.py');
+        // Dynamic command detection for cross-platform support (Mac/Linux usually python3, Windows usually python)
+        let pythonCmd = 'python3';
         try {
-            const { stdout } = await execa('python3', [scriptPath], {
+            await execa('python3', ['--version']);
+        }
+        catch (e) {
+            try {
+                await execa('python', ['--version']);
+                pythonCmd = 'python';
+            }
+            catch (e2) {
+                // Both missing - handled by main catch
+            }
+        }
+        try {
+            const { stdout } = await execa(pythonCmd, [scriptPath], {
                 input: context.content,
                 cwd: context.cwd
             });

package/dist/gates/base.d.ts

@@ -11,5 +11,5 @@ export declare abstract class Gate {
     readonly title: string;
     constructor(id: string, title: string);
     abstract run(context: GateContext): Promise<Failure[]>;
-    protected createFailure(details: string, files?: string[], hint?: string): Failure;
+    protected createFailure(details: string, files?: string[], hint?: string, title?: string): Failure;
 }

package/dist/gates/base.js

@@ -5,10 +5,10 @@ export class Gate {
         this.id = id;
         this.title = title;
     }
-    createFailure(details, files, hint) {
+    createFailure(details, files, hint, title) {
         return {
             id: this.id,
-            title: this.title,
+            title: title || this.title,
             details,
             files,
             hint,

package/dist/gates/coverage.js

@@ -51,7 +51,12 @@ export class CoverageGate extends Gate {
                 results[currentFile] = { found: 0, hit: 0, isComplex: false };
             }
             else if (line.startsWith('LF:')) {
-                results[currentFile].found = parseInt(line.substring(3));
+                const found = parseInt(line.substring(3));
+                results[currentFile].found = found;
+                // SME Logic: If a file has > 100 logical lines, it's considered "Complex"
+                // and triggers the higher (80%) coverage requirement.
+                if (found > 100)
+                    results[currentFile].isComplex = true;
             }
             else if (line.startsWith('LH:')) {
                 results[currentFile].hit = parseInt(line.substring(3));

package/dist/gates/dependency.js

@@ -25,12 +25,51 @@ export class DependencyGate extends Gate {
                 };
                 for (const dep of forbidden) {
                     if (allDeps[dep]) {
-                        failures.push(this.createFailure(`The package '${dep}' is forbidden by project standards.`, ['package.json'], `Remove '${dep}' from package.json and use approved alternatives.`));
+                        failures.push(this.createFailure(`The package '${dep}' is forbidden by project standards.`, ['package.json'], `Remove '${dep}' from package.json and use approved alternatives.`, 'Forbidden Dependency'));
                     }
                 }
             }
             catch (e) { }
         }
+        // 2. Scan Python (requirements.txt, pyproject.toml)
+        const reqPath = path.join(cwd, 'requirements.txt');
+        if (await fs.pathExists(reqPath)) {
+            const content = await fs.readFile(reqPath, 'utf-8');
+            for (const dep of forbidden) {
+                if (new RegExp(`^${dep}([=<>! ]|$)`, 'm').test(content)) {
+                    failures.push(this.createFailure(`The Python package '${dep}' is forbidden.`, ['requirements.txt'], `Remove '${dep}' from requirements.txt.`, 'Forbidden Dependency'));
+                }
+            }
+        }
+        const pyprojPath = path.join(cwd, 'pyproject.toml');
+        if (await fs.pathExists(pyprojPath)) {
+            const content = await fs.readFile(pyprojPath, 'utf-8');
+            for (const dep of forbidden) {
+                if (new RegExp(`^${dep}\\s*=`, 'm').test(content)) {
+                    failures.push(this.createFailure(`The Python package '${dep}' is forbidden in pyproject.toml.`, ['pyproject.toml'], `Remove '${dep}' from pyproject.toml dependencies.`, 'Forbidden Dependency'));
+                }
+            }
+        }
+        // 3. Scan Go (go.mod)
+        const goModPath = path.join(cwd, 'go.mod');
+        if (await fs.pathExists(goModPath)) {
+            const content = await fs.readFile(goModPath, 'utf-8');
+            for (const dep of forbidden) {
+                if (content.includes(dep)) {
+                    failures.push(this.createFailure(`The Go module '${dep}' is forbidden.`, ['go.mod'], `Remove '${dep}' from go.mod.`, 'Forbidden Dependency'));
+                }
+            }
+        }
+        // 4. Scan Java (pom.xml)
+        const pomPath = path.join(cwd, 'pom.xml');
+        if (await fs.pathExists(pomPath)) {
+            const content = await fs.readFile(pomPath, 'utf-8');
+            for (const dep of forbidden) {
+                if (content.includes(`<artifactId>${dep}</artifactId>`)) {
+                    failures.push(this.createFailure(`The Java artifact '${dep}' is forbidden.`, ['pom.xml'], `Remove '${dep}' from pom.xml.`, 'Forbidden Dependency'));
+                }
+            }
+        }
         return failures;
     }
 }

package/dist/gates/safety.js

@@ -17,11 +17,17 @@ export class SafetyGate extends Gate {
             // This is a "Safety Rail" - if an agent touched these, we fail.
             const { stdout } = await execa('git', ['status', '--porcelain'], { cwd: context.cwd });
             const modifiedFiles = stdout.split('\n')
-                .filter(line => line.trim().length > 0)
-                .map(line => line.slice(3));
+                .filter(line => {
+                const status = line.slice(0, 2);
+                // M: Modified, A: Added (staged), D: Deleted, R: Renamed
+                // We ignore ?? (Untracked) to allow rigour init and new doc creation
+                return /M|A|D|R/.test(status);
+            })
+                .map(line => line.slice(3).trim());
             for (const file of modifiedFiles) {
                 if (this.isProtected(file, protectedPaths)) {
-                    failures.push(this.createFailure(`Protected file '${file}' was modified.`, [file], `Agents are forbidden from modifying files in ${protectedPaths.join(', ')}.`));
+                    const message = `Protected file '${file}' was modified.`;
+                    failures.push(this.createFailure(message, [file], `Agents are forbidden from modifying files in ${protectedPaths.join(', ')}.`, message));
                 }
             }
         }

package/dist/safety.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/safety.test.js

@@ -0,0 +1,42 @@
+import { describe, it, expect, vi } from 'vitest';
+import { SafetyGate } from './gates/safety.js';
+import { execa } from 'execa';
+vi.mock('execa');
+describe('SafetyGate', () => {
+    const config = {
+        safety: {
+            protected_paths: ['docs/'],
+            max_files_changed_per_cycle: 10
+        }
+    };
+    it('should flag modified (M) protected files', async () => {
+        const gate = new SafetyGate(config);
+        vi.mocked(execa).mockResolvedValueOnce({ stdout: ' M docs/SPEC.md\n' });
+        const failures = await gate.run({ cwd: '/test', record: {} });
+        expect(failures).toHaveLength(1);
+        expect(failures[0].title).toContain("Protected file 'docs/SPEC.md' was modified.");
+    });
+    it('should flag added (A) protected files', async () => {
+        const gate = new SafetyGate(config);
+        vi.mocked(execa).mockResolvedValueOnce({ stdout: 'A  docs/NEW.md\n' });
+        const failures = await gate.run({ cwd: '/test', record: {} });
+        expect(failures).toHaveLength(1);
+        expect(failures[0].title).toContain("Protected file 'docs/NEW.md' was modified.");
+    });
+    it('should NOT flag untracked (??) protected files', async () => {
+        const gate = new SafetyGate(config);
+        vi.mocked(execa).mockResolvedValueOnce({ stdout: '?? docs/UNTRAKED.md\n' });
+        const failures = await gate.run({ cwd: '/test', record: {} });
+        expect(failures).toHaveLength(0);
+    });
+    it('should correctly handle multiple mixed statuses', async () => {
+        const gate = new SafetyGate(config);
+        vi.mocked(execa).mockResolvedValueOnce({
+            stdout: ' M docs/MODIFIED.md\n?? docs/NEW_UNTRACKED.md\n D docs/DELETED.md\n'
+        });
+        const failures = await gate.run({ cwd: '/test', record: {} });
+        expect(failures).toHaveLength(2);
+        expect(failures.map(f => f.title)).toContain("Protected file 'docs/MODIFIED.md' was modified.");
+        expect(failures.map(f => f.title)).toContain("Protected file 'docs/DELETED.md' was modified.");
+    });
+});

package/dist/utils/scanner.js

@@ -13,7 +13,8 @@ export class FileScanner {
     ];
     static async findFiles(options) {
         const patterns = (options.patterns || this.DEFAULT_PATTERNS).map(p => p.replace(/\\/g, '/'));
-        const ignore = (options.ignore || this.DEFAULT_IGNORE).map(p => p.replace(/\\/g, '/'));
+        const userIgnore = options.ignore || [];
+        const ignore = [...new Set([...this.DEFAULT_IGNORE, ...userIgnore])].map(p => p.replace(/\\/g, '/'));
         const normalizedCwd = options.cwd.replace(/\\/g, '/');
         return globby(patterns, {
             cwd: normalizedCwd,

package/dist/utils/scanner.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/scanner.test.js

@@ -0,0 +1,29 @@
+import { describe, it, expect, vi } from 'vitest';
+import { FileScanner } from './scanner.js';
+import { globby } from 'globby';
+vi.mock('globby', () => ({
+    globby: vi.fn(),
+}));
+describe('FileScanner', () => {
+    it('should merge default ignores with user ignores', async () => {
+        const options = {
+            cwd: '/test',
+            ignore: ['custom-ignore']
+        };
+        await FileScanner.findFiles(options);
+        const call = vi.mocked(globby).mock.calls[0];
+        const ignore = call[1].ignore;
+        expect(ignore).toContain('**/node_modules/**');
+        expect(ignore).toContain('custom-ignore');
+    });
+    it('should normalize paths to forward slashes', async () => {
+        const options = {
+            cwd: 'C:\\test\\path',
+            patterns: ['**\\*.ts']
+        };
+        await FileScanner.findFiles(options);
+        const call = vi.mocked(globby).mock.calls[1];
+        expect(call[0][0]).toBe('**/*.ts');
+        expect(call[1]?.cwd).toBe('C:/test/path');
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/discovery.test.ts

@@ -0,0 +1,61 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { DiscoveryService } from './discovery.js';
+import fs from 'fs-extra';
+import path from 'path';
+
+vi.mock('fs-extra');
+
+describe('DiscoveryService', () => {
+    beforeEach(() => {
+        vi.resetAllMocks();
+    });
+
+    it('should discover project marker in root directory', async () => {
+        const service = new DiscoveryService();
+        vi.mocked(fs.pathExists).mockImplementation(async (p: string) => p.includes('package.json'));
+        vi.mocked(fs.readdir).mockResolvedValue(['package.json'] as any);
+        vi.mocked(fs.readFile).mockResolvedValue('{}' as any);
+
+        const result = await service.discover('/test');
+        // If package.json doesn't match a specific role marker, it stays Universal.
+        // Let's mock a specific one like 'express'
+        vi.mocked(fs.pathExists).mockImplementation(async (p: string) => p.includes('express'));
+        const result2 = await service.discover('/test');
+        expect(result2.matches.preset?.name).toBe('api');
+    });
+
+    it('should discover project marker in src/ directory (Deep Detection)', async () => {
+        const service = new DiscoveryService();
+        vi.mocked(fs.pathExists).mockImplementation((async (p: string) => {
+            if (p.endsWith('src')) return true;
+            if (p.includes('src/index.ts')) return true;
+            return false;
+        }) as any);
+        vi.mocked(fs.readdir).mockImplementation((async (p: string) => {
+            if (p.toString().endsWith('/test')) return ['src'] as any;
+            if (p.toString().endsWith('src')) return ['index.ts'] as any;
+            return [] as any;
+        }) as any);
+        vi.mocked(fs.readFile).mockResolvedValue('export const x = 1;' as any);
+
+        const result = await service.discover('/test');
+        // Since UNIVERSAL_CONFIG has a default, we check if it found something extra or matches expectation
+        // Default is universal, but detecting .ts should tilt it towards node or similar if configured
+        // In our current templates, package.json is the node marker.
+        // Let's check for paradigm detection which uses content
+        expect(result.config).toBeDefined();
+    });
+
+    it('should identify OOP paradigm from content in subfolder', async () => {
+        const service = new DiscoveryService();
+        vi.mocked(fs.pathExists).mockImplementation((async (p: string) => p.endsWith('src') || p.endsWith('src/Service.ts')) as any);
+        vi.mocked(fs.readdir).mockImplementation((async (p: string) => {
+            if (p.toString().endsWith('src')) return ['Service.ts'] as any;
+            return ['src'] as any;
+        }) as any);
+        vi.mocked(fs.readFile).mockResolvedValue('class MyService {}' as any);
+
+        const result = await service.discover('/test');
+        expect(result.matches.paradigm?.name).toBe('oop');
+    });
+});

package/src/discovery.ts

@@ -78,15 +78,20 @@ export class DiscoveryService {
     }
 
     private async findSourceFiles(cwd: string): Promise<string[]> {
-        // Find a few files to sample
         const extensions = ['.ts', '.js', '.py', '.go', '.java', '.tf', 'package.json'];
         const samples: string[] = [];
+        const commonDirs = ['.', 'src', 'app', 'lib', 'api', 'pkg'];
 
-        const files = await fs.readdir(cwd);
-        for (const file of files) {
-            if (extensions.some(ext => file.endsWith(ext))) {
-                samples.push(path.join(cwd, file));
-                if (samples.length >= 5) break;
+        for (const dir of commonDirs) {
+            const fullDir = path.join(cwd, dir);
+            if (!(await fs.pathExists(fullDir))) continue;
+
+            const files = await fs.readdir(fullDir);
+            for (const file of files) {
+                if (extensions.some(ext => file.endsWith(ext))) {
+                    samples.push(path.join(fullDir, file));
+                    if (samples.length >= 5) return samples;
+                }
             }
         }
         return samples;

package/src/gates/ast-handlers/python.ts

@@ -15,8 +15,21 @@ export class PythonHandler extends ASTHandler {
         const failures: Failure[] = [];
         const scriptPath = path.join(__dirname, 'python_parser.py');
 
+        // Dynamic command detection for cross-platform support (Mac/Linux usually python3, Windows usually python)
+        let pythonCmd = 'python3';
         try {
-            const { stdout } = await execa('python3', [scriptPath], {
+            await execa('python3', ['--version']);
+        } catch (e) {
+            try {
+                await execa('python', ['--version']);
+                pythonCmd = 'python';
+            } catch (e2) {
+                // Both missing - handled by main catch
+            }
+        }
+
+        try {
+            const { stdout } = await execa(pythonCmd, [scriptPath], {
                 input: context.content,
                 cwd: context.cwd
             });

package/src/gates/base.ts

@@ -13,10 +13,10 @@ export abstract class Gate {
 
     abstract run(context: GateContext): Promise<Failure[]>;
 
-    protected createFailure(details: string, files?: string[], hint?: string): Failure {
+    protected createFailure(details: string, files?: string[], hint?: string, title?: string): Failure {
         return {
             id: this.id,
-            title: this.title,
+            title: title || this.title,
             details,
             files,
             hint,

package/src/gates/coverage.ts

@@ -60,7 +60,11 @@ export class CoverageGate extends Gate {
                 currentFile = line.substring(3);
                 results[currentFile] = { found: 0, hit: 0, isComplex: false };
             } else if (line.startsWith('LF:')) {
-                results[currentFile].found = parseInt(line.substring(3));
+                const found = parseInt(line.substring(3));
+                results[currentFile].found = found;
+                // SME Logic: If a file has > 100 logical lines, it's considered "Complex"
+                // and triggers the higher (80%) coverage requirement.
+                if (found > 100) results[currentFile].isComplex = true;
             } else if (line.startsWith('LH:')) {
                 results[currentFile].hit = parseInt(line.substring(3));
             }

package/src/gates/dependency.ts

@@ -32,13 +32,77 @@ export class DependencyGate extends Gate {
                         failures.push(this.createFailure(
                             `The package '${dep}' is forbidden by project standards.`,
                             ['package.json'],
-                            `Remove '${dep}' from package.json and use approved alternatives.`
+                            `Remove '${dep}' from package.json and use approved alternatives.`,
+                            'Forbidden Dependency'
                         ));
                     }
                 }
             } catch (e) { }
         }
 
+        // 2. Scan Python (requirements.txt, pyproject.toml)
+        const reqPath = path.join(cwd, 'requirements.txt');
+        if (await fs.pathExists(reqPath)) {
+            const content = await fs.readFile(reqPath, 'utf-8');
+            for (const dep of forbidden) {
+                if (new RegExp(`^${dep}([=<>! ]|$)`, 'm').test(content)) {
+                    failures.push(this.createFailure(
+                        `The Python package '${dep}' is forbidden.`,
+                        ['requirements.txt'],
+                        `Remove '${dep}' from requirements.txt.`,
+                        'Forbidden Dependency'
+                    ));
+                }
+            }
+        }
+
+        const pyprojPath = path.join(cwd, 'pyproject.toml');
+        if (await fs.pathExists(pyprojPath)) {
+            const content = await fs.readFile(pyprojPath, 'utf-8');
+            for (const dep of forbidden) {
+                if (new RegExp(`^${dep}\\s*=`, 'm').test(content)) {
+                    failures.push(this.createFailure(
+                        `The Python package '${dep}' is forbidden in pyproject.toml.`,
+                        ['pyproject.toml'],
+                        `Remove '${dep}' from pyproject.toml dependencies.`,
+                        'Forbidden Dependency'
+                    ));
+                }
+            }
+        }
+
+        // 3. Scan Go (go.mod)
+        const goModPath = path.join(cwd, 'go.mod');
+        if (await fs.pathExists(goModPath)) {
+            const content = await fs.readFile(goModPath, 'utf-8');
+            for (const dep of forbidden) {
+                if (content.includes(dep)) {
+                    failures.push(this.createFailure(
+                        `The Go module '${dep}' is forbidden.`,
+                        ['go.mod'],
+                        `Remove '${dep}' from go.mod.`,
+                        'Forbidden Dependency'
+                    ));
+                }
+            }
+        }
+
+        // 4. Scan Java (pom.xml)
+        const pomPath = path.join(cwd, 'pom.xml');
+        if (await fs.pathExists(pomPath)) {
+            const content = await fs.readFile(pomPath, 'utf-8');
+            for (const dep of forbidden) {
+                if (content.includes(`<artifactId>${dep}</artifactId>`)) {
+                    failures.push(this.createFailure(
+                        `The Java artifact '${dep}' is forbidden.`,
+                        ['pom.xml'],
+                        `Remove '${dep}' from pom.xml.`,
+                        'Forbidden Dependency'
+                    ));
+                }
+            }
+        }
+
         return failures;
     }
 }

package/src/gates/safety.ts

@@ -19,15 +19,22 @@ export class SafetyGate extends Gate {
             // This is a "Safety Rail" - if an agent touched these, we fail.
             const { stdout } = await execa('git', ['status', '--porcelain'], { cwd: context.cwd });
             const modifiedFiles = stdout.split('\n')
-                .filter(line => line.trim().length > 0)
-                .map(line => line.slice(3));
+                .filter(line => {
+                    const status = line.slice(0, 2);
+                    // M: Modified, A: Added (staged), D: Deleted, R: Renamed
+                    // We ignore ?? (Untracked) to allow rigour init and new doc creation
+                    return /M|A|D|R/.test(status);
+                })
+                .map(line => line.slice(3).trim());
 
             for (const file of modifiedFiles) {
                 if (this.isProtected(file, protectedPaths)) {
+                    const message = `Protected file '${file}' was modified.`;
                     failures.push(this.createFailure(
-                        `Protected file '${file}' was modified.`,
+                        message,
                         [file],
-                        `Agents are forbidden from modifying files in ${protectedPaths.join(', ')}.`
+                        `Agents are forbidden from modifying files in ${protectedPaths.join(', ')}.`,
+                        message
                     ));
                 }
             }

package/src/safety.test.ts

@@ -0,0 +1,53 @@
+import { describe, it, expect, vi } from 'vitest';
+import { SafetyGate } from './gates/safety.js';
+import { Gates } from './types/index.js';
+import { execa } from 'execa';
+
+vi.mock('execa');
+
+describe('SafetyGate', () => {
+    const config: Gates = {
+        safety: {
+            protected_paths: ['docs/'],
+            max_files_changed_per_cycle: 10
+        }
+    } as any;
+
+    it('should flag modified (M) protected files', async () => {
+        const gate = new SafetyGate(config);
+        vi.mocked(execa).mockResolvedValueOnce({ stdout: ' M docs/SPEC.md\n' } as any);
+
+        const failures = await gate.run({ cwd: '/test', record: {} as any });
+        expect(failures).toHaveLength(1);
+        expect(failures[0].title).toContain("Protected file 'docs/SPEC.md' was modified.");
+    });
+
+    it('should flag added (A) protected files', async () => {
+        const gate = new SafetyGate(config);
+        vi.mocked(execa).mockResolvedValueOnce({ stdout: 'A  docs/NEW.md\n' } as any);
+
+        const failures = await gate.run({ cwd: '/test', record: {} as any });
+        expect(failures).toHaveLength(1);
+        expect(failures[0].title).toContain("Protected file 'docs/NEW.md' was modified.");
+    });
+
+    it('should NOT flag untracked (??) protected files', async () => {
+        const gate = new SafetyGate(config);
+        vi.mocked(execa).mockResolvedValueOnce({ stdout: '?? docs/UNTRAKED.md\n' } as any);
+
+        const failures = await gate.run({ cwd: '/test', record: {} as any });
+        expect(failures).toHaveLength(0);
+    });
+
+    it('should correctly handle multiple mixed statuses', async () => {
+        const gate = new SafetyGate(config);
+        vi.mocked(execa).mockResolvedValueOnce({
+            stdout: ' M docs/MODIFIED.md\n?? docs/NEW_UNTRACKED.md\n D docs/DELETED.md\n'
+        } as any);
+
+        const failures = await gate.run({ cwd: '/test', record: {} as any });
+        expect(failures).toHaveLength(2);
+        expect(failures.map(f => f.title)).toContain("Protected file 'docs/MODIFIED.md' was modified.");
+        expect(failures.map(f => f.title)).toContain("Protected file 'docs/DELETED.md' was modified.");
+    });
+});

package/src/utils/scanner.test.ts

@@ -0,0 +1,37 @@
+import { describe, it, expect, vi } from 'vitest';
+import { FileScanner } from './scanner.js';
+import { globby } from 'globby';
+
+vi.mock('globby', () => ({
+    globby: vi.fn(),
+}));
+
+describe('FileScanner', () => {
+    it('should merge default ignores with user ignores', async () => {
+        const options = {
+            cwd: '/test',
+            ignore: ['custom-ignore']
+        };
+
+        await FileScanner.findFiles(options);
+
+        const call = vi.mocked(globby).mock.calls[0];
+        const ignore = (call[1] as any).ignore;
+
+        expect(ignore).toContain('**/node_modules/**');
+        expect(ignore).toContain('custom-ignore');
+    });
+
+    it('should normalize paths to forward slashes', async () => {
+        const options = {
+            cwd: 'C:\\test\\path',
+            patterns: ['**\\*.ts']
+        };
+
+        await FileScanner.findFiles(options);
+
+        const call = vi.mocked(globby).mock.calls[1];
+        expect(call[0][0]).toBe('**/*.ts');
+        expect(call[1]?.cwd).toBe('C:/test/path');
+    });
+});

package/src/utils/scanner.ts

@@ -21,7 +21,8 @@ export class FileScanner {
 
     static async findFiles(options: ScannerOptions): Promise<string[]> {
         const patterns = (options.patterns || this.DEFAULT_PATTERNS).map(p => p.replace(/\\/g, '/'));
-        const ignore = (options.ignore || this.DEFAULT_IGNORE).map(p => p.replace(/\\/g, '/'));
+        const userIgnore = options.ignore || [];
+        const ignore = [...new Set([...this.DEFAULT_IGNORE, ...userIgnore])].map(p => p.replace(/\\/g, '/'));
         const normalizedCwd = options.cwd.replace(/\\/g, '/');
 
         return globby(patterns, {