@undercurrentai/eslint-plugin-ai-guard 2.0.0-beta.3

package/dist/cli/index.js

@@ -0,0 +1,2293 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// cli/utils/constants.ts
+var constants_exports = {};
+__export(constants_exports, {
+  LEGACY_PLUGIN_NAME: () => LEGACY_PLUGIN_NAME,
+  PLUGIN_NAME: () => PLUGIN_NAME,
+  PLUGIN_NAMES: () => PLUGIN_NAMES,
+  contentReferencesPlugin: () => contentReferencesPlugin
+});
+function contentReferencesPlugin(content) {
+  return /['"`]@undercurrent\/eslint-plugin-ai-guard['"`]/.test(content) || /['"`]eslint-plugin-ai-guard['"`]/.test(content) || content.includes("'ai-guard'") || content.includes('"ai-guard"');
+}
+var PLUGIN_NAME, LEGACY_PLUGIN_NAME, PLUGIN_NAMES;
+var init_constants = __esm({
+  "cli/utils/constants.ts"() {
+    "use strict";
+    PLUGIN_NAME = "@undercurrentai/eslint-plugin-ai-guard";
+    LEGACY_PLUGIN_NAME = "eslint-plugin-ai-guard";
+    PLUGIN_NAMES = [PLUGIN_NAME, LEGACY_PLUGIN_NAME];
+  }
+});
+
+// cli/utils/config-manager.ts
+var config_manager_exports = {};
+__export(config_manager_exports, {
+  addIgnoresToFlatConfig: () => addIgnoresToFlatConfig,
+  addIgnoresToLegacyConfig: () => addIgnoresToLegacyConfig,
+  backupConfig: () => backupConfig,
+  generateFlatConfig: () => generateFlatConfig,
+  generateLegacyConfig: () => generateLegacyConfig,
+  getConfigFilePath: () => getConfigFilePath,
+  isInvalidAiGuardConfig: () => isInvalidAiGuardConfig,
+  patchFlatConfig: () => patchFlatConfig,
+  patchLegacyConfig: () => patchLegacyConfig,
+  readConfig: () => readConfig,
+  removeNukeIgnore: () => removeNukeIgnore,
+  repairInvalidFlatConfig: () => repairInvalidFlatConfig,
+  switchFlatPreset: () => switchFlatPreset,
+  switchLegacyPreset: () => switchLegacyPreset,
+  validateFlatConfigText: () => validateFlatConfigText,
+  validateLegacyConfigText: () => validateLegacyConfigText,
+  writeConfig: () => writeConfig
+});
+function backupConfig(configPath) {
+  const backupPath = `${configPath}.bak`;
+  import_fs3.default.copyFileSync(configPath, backupPath);
+  return backupPath;
+}
+function readConfig(configPath) {
+  return import_fs3.default.readFileSync(configPath, "utf-8");
+}
+function writeConfig(configPath, content) {
+  import_fs3.default.writeFileSync(configPath, content, "utf-8");
+}
+function generateFlatConfig(preset) {
+  return `import aiGuard from '${PLUGIN_NAME}';
+
+export default [
+  // Ignore generated / dependency directories
+  {
+    ignores: [
+      'node_modules/**',
+      '.next/**',
+      'dist/**',
+      'build/**',
+      'coverage/**',
+      'out/**',
+    ],
+  },
+
+  // ai-guard: catch AI-generated code patterns
+  {
+    plugins: {
+      'ai-guard': aiGuard,
+    },
+    rules: {
+      ...aiGuard.configs.${preset}.rules,
+    },
+  },
+];
+`;
+}
+function generateLegacyConfig(preset) {
+  return `module.exports = {
+  plugins: ['ai-guard'],
+  extends: ['plugin:ai-guard/${preset}'],
+  ignorePatterns: [
+    'node_modules/',
+    '.next/',
+    'dist/',
+    'build/',
+    'coverage/',
+    'out/',
+  ],
+};
+`;
+}
+function isInvalidAiGuardConfig(content) {
+  if (!contentReferencesPlugin(content) && !content.includes("ai-guard")) {
+    return false;
+  }
+  if (/['"]ai-guard['"]\s*:\s*aiGuard\.default/.test(content)) return true;
+  if (/\.\.\.aiGuard\.(recommended|strict|security)\.rules/.test(content)) return true;
+  if (/rules\s*:\s*aiGuard\.(recommended|strict|security)\.rules/.test(content)) return true;
+  return false;
+}
+function repairInvalidFlatConfig(content) {
+  let repaired = content;
+  repaired = repaired.replace(/(['"]ai-guard['"]\s*:\s*)aiGuard\.default/g, "$1aiGuard");
+  repaired = repaired.replace(
+    /rules\s*:\s*aiGuard\.([a-zA-Z0-9_]+)\.rules(,?)/g,
+    "rules: {\n      ...aiGuard.configs.$1.rules,\n    }$2"
+  );
+  repaired = repaired.replace(/\.\.\.aiGuard\.([a-zA-Z0-9_]+)\.rules/g, "...aiGuard.configs.$1.rules");
+  return repaired;
+}
+function patchFlatConfig(existing, preset) {
+  if (isInvalidAiGuardConfig(existing)) {
+    return repairInvalidFlatConfig(existing);
+  }
+  if (contentReferencesPlugin(existing)) {
+    return existing;
+  }
+  const importLine = `import aiGuard from '${PLUGIN_NAME}';
+`;
+  const rulesBlock = `
+  // ai-guard injected by ai-guard CLI
+  {
+    plugins: {
+      'ai-guard': aiGuard,
+    },
+    rules: {
+      ...aiGuard.configs.${preset}.rules,
+    },
+  },
+`;
+  let patched = existing;
+  const lastImportIdx = findLastImportEnd(patched);
+  if (lastImportIdx > -1) {
+    patched = patched.slice(0, lastImportIdx) + importLine + patched.slice(lastImportIdx);
+  } else {
+    patched = importLine + patched;
+  }
+  const arrayCloseMatch = findConfigArrayClose(patched);
+  if (arrayCloseMatch !== null) {
+    patched = patched.slice(0, arrayCloseMatch) + rulesBlock + patched.slice(arrayCloseMatch);
+  }
+  return patched;
+}
+function findConfigArrayClose(src) {
+  const matches = Array.from(src.matchAll(/\](\))?\s*;?/g));
+  if (matches.length === 0) return null;
+  const last = matches[matches.length - 1];
+  return last.index ?? null;
+}
+function findLastImportEnd(src) {
+  const lines = src.split("\n");
+  let lastImportLine = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if (/^\s*import\s+/.test(lines[i])) lastImportLine = i;
+  }
+  if (lastImportLine === -1) return -1;
+  let offset = 0;
+  for (let i = 0; i <= lastImportLine; i++) {
+    offset += lines[i].length + 1;
+  }
+  return offset;
+}
+function patchLegacyConfig(existing, preset) {
+  if (existing.includes("ai-guard")) {
+    return existing;
+  }
+  let patched = existing;
+  if (patched.includes("plugins:")) {
+    patched = patched.replace(/plugins:\s*\[/, `plugins: ['ai-guard', `);
+  } else {
+    patched = patched.replace(
+      "module.exports = {",
+      `module.exports = {
+  plugins: ['ai-guard'],`
+    );
+  }
+  if (patched.includes("extends:")) {
+    patched = patched.replace(
+      /extends:\s*\[/,
+      `extends: ['plugin:ai-guard/${preset}', `
+    );
+  } else {
+    patched = patched.replace(
+      "module.exports = {",
+      `module.exports = {
+  extends: ['plugin:ai-guard/${preset}'],`
+    );
+  }
+  return patched;
+}
+function switchFlatPreset(existing, preset) {
+  let patched = existing;
+  patched = patched.replace(
+    /\.\.\.aiGuard\.configs\.(recommended|strict|security)\.rules/g,
+    `...aiGuard.configs.${preset}.rules`
+  );
+  patched = patched.replace(
+    /['"]ai-guard\/(recommended|strict|security)['"]/g,
+    `'ai-guard/${preset}'`
+  );
+  return patched;
+}
+function switchLegacyPreset(existing, preset) {
+  let patched = existing;
+  patched = patched.replace(
+    /['"]plugin:ai-guard\/(recommended|strict|security)['"]/g,
+    `'plugin:ai-guard/${preset}'`
+  );
+  patched = patched.replace(
+    /['"]ai-guard\/(recommended|strict|security)['"]/g,
+    `'ai-guard/${preset}'`
+  );
+  return patched;
+}
+function removeNukeIgnore(existing) {
+  const nukePatterns = [/^\s*['"]\*\*\/\*['"]\s*,?\s*$/gm];
+  const hasNuke = existing.includes('"**/*"') || existing.includes("'**/*'");
+  if (!hasNuke) return { content: existing, changed: false };
+  let patched = existing.replace(
+    /ignorePatterns:\s*\[.*?\*\*\/\*.*?\]/gs,
+    `ignorePatterns: ['node_modules/', '.next/', 'dist/', 'build/', 'coverage/']`
+  ).replace(
+    /ignores:\s*\[.*?\*\*\/\*.*?\]/gs,
+    `ignores: ['node_modules/**', '.next/**', 'dist/**', 'build/**', 'coverage/**']`
+  );
+  if (patched === existing) {
+    for (const re of nukePatterns) {
+      patched = patched.replace(re, "");
+    }
+  }
+  return { content: patched, changed: patched !== existing };
+}
+function addIgnoresToFlatConfig(existing) {
+  if (existing.includes("ignores:")) return existing;
+  const block = `
+  // Default ignores added by ai-guard CLI
+  {
+    ignores: ${JSON.stringify(DEFAULT_FLAT_IGNORES)},
+  },
+`;
+  const lastBracket = existing.lastIndexOf("];");
+  if (lastBracket !== -1) {
+    return existing.slice(0, lastBracket) + block + existing.slice(lastBracket);
+  }
+  return existing;
+}
+function addIgnoresToLegacyConfig(existing) {
+  if (existing.includes("ignorePatterns")) return existing;
+  return existing.replace(
+    "module.exports = {",
+    `module.exports = {
+  ignorePatterns: ${JSON.stringify(DEFAULT_LEGACY_IGNORES)},`
+  );
+}
+function getConfigFilePath(configType, cwd = process.cwd()) {
+  switch (configType) {
+    case "flat-js":
+      return import_path3.default.join(cwd, "eslint.config.js");
+    case "flat-mjs":
+      return import_path3.default.join(cwd, "eslint.config.mjs");
+    case "flat-cjs":
+      return import_path3.default.join(cwd, "eslint.config.cjs");
+    case "eslintrc-js":
+      return import_path3.default.join(cwd, ".eslintrc.js");
+    case "eslintrc-cjs":
+      return import_path3.default.join(cwd, ".eslintrc.cjs");
+    case "eslintrc-json":
+      return import_path3.default.join(cwd, ".eslintrc.json");
+    default:
+      return import_path3.default.join(cwd, ".eslintrc.js");
+  }
+}
+function validateFlatConfigText(content) {
+  const problems = [];
+  if (!content.includes("export default")) {
+    problems.push("Missing `export default` \u2014 file must be an ES module");
+  }
+  if (!contentReferencesPlugin(content) && !content.includes("aiGuard")) {
+    problems.push("Plugin import not found \u2014 ai-guard plugin may not be referenced");
+  }
+  if (content.includes('"**/*"') || content.includes("'**/*'")) {
+    problems.push(
+      'Config contains "**/*" ignore pattern \u2014 this will prevent all files from being linted'
+    );
+  }
+  return problems;
+}
+function validateLegacyConfigText(content) {
+  const problems = [];
+  if (!content.includes("module.exports")) {
+    problems.push("Missing `module.exports` \u2014 legacy config must use CJS exports");
+  }
+  if (!content.includes("ai-guard")) {
+    problems.push("Plugin not referenced \u2014 add ai-guard to plugins and extends");
+  }
+  if (content.includes('"**/*"') || content.includes("'**/*'")) {
+    problems.push(
+      'Config contains "**/*" ignore pattern \u2014 this will prevent all files from being linted'
+    );
+  }
+  return problems;
+}
+var import_fs3, import_path3, DEFAULT_FLAT_IGNORES, DEFAULT_LEGACY_IGNORES;
+var init_config_manager = __esm({
+  "cli/utils/config-manager.ts"() {
+    "use strict";
+    import_fs3 = __toESM(require("fs"));
+    import_path3 = __toESM(require("path"));
+    init_constants();
+    DEFAULT_FLAT_IGNORES = [
+      "node_modules/**",
+      ".next/**",
+      "dist/**",
+      "build/**",
+      "coverage/**",
+      "out/**"
+    ];
+    DEFAULT_LEGACY_IGNORES = [
+      "node_modules/",
+      ".next/",
+      "dist/",
+      "build/",
+      "coverage/",
+      "out/"
+    ];
+  }
+});
+
+// cli/index.ts
+var import_commander = require("commander");
+var import_fs7 = __toESM(require("fs"));
+var import_path10 = __toESM(require("path"));
+
+// cli/commands/run.ts
+var import_ora = __toESM(require("ora"));
+var import_chalk2 = __toESM(require("chalk"));
+
+// cli/utils/eslint-runner.ts
+var import_fs = __toESM(require("fs"));
+var import_path = __toESM(require("path"));
+var import_url = require("url");
+
+// cli/utils/logger.ts
+var import_chalk = __toESM(require("chalk"));
+var PREFIX = {
+  success: import_chalk.default.green("\u2714"),
+  error: import_chalk.default.red("\u2716"),
+  warn: import_chalk.default.yellow("\u26A0"),
+  info: import_chalk.default.cyan("\u2139"),
+  section: import_chalk.default.bold.white,
+  bullet: import_chalk.default.gray("\u2022")
+};
+var log = {
+  info(msg) {
+    console.log(`  ${PREFIX.info}  ${import_chalk.default.white(msg)}`);
+  },
+  success(msg) {
+    console.log(`  ${PREFIX.success}  ${import_chalk.default.green(msg)}`);
+  },
+  warn(msg) {
+    console.log(`  ${PREFIX.warn}  ${import_chalk.default.yellow(msg)}`);
+  },
+  error(msg) {
+    console.error(`  ${PREFIX.error}  ${import_chalk.default.red(msg)}`);
+  },
+  section(title) {
+    console.log("");
+    console.log(import_chalk.default.bold.cyan(`  \u2500\u2500 ${title} \u2500\u2500`));
+    console.log("");
+  },
+  rule(ruleName, count) {
+    console.log(
+      `    ${PREFIX.bullet} ${import_chalk.default.yellow(ruleName)} ${import_chalk.default.gray(`(${count} issue${count !== 1 ? "s" : ""})`)}`
+    );
+  },
+  file(filePath, count) {
+    console.log(
+      `    ${PREFIX.bullet} ${import_chalk.default.white(filePath)} ${import_chalk.default.gray(`\u2192 ${count} issue${count !== 1 ? "s" : ""}`)}`
+    );
+  },
+  issue(msg, severity, line, col) {
+    const icon = severity === 2 ? import_chalk.default.red("error") : import_chalk.default.yellow(" warn");
+    console.log(
+      `      ${import_chalk.default.gray(`${line}:${col}`).padEnd(12)} ${icon}  ${import_chalk.default.white(msg)}`
+    );
+  },
+  divider() {
+    console.log(import_chalk.default.gray("  " + "\u2500".repeat(60)));
+  },
+  blank() {
+    console.log("");
+  },
+  banner(title) {
+    console.log("");
+    console.log(import_chalk.default.bold.bgCyan.black(`  ${title}  `));
+    console.log("");
+  },
+  print(msg) {
+    console.log(msg);
+  },
+  debug(msg) {
+    if (process.env.AI_GUARD_DEBUG === "1") {
+      console.log(`  ${import_chalk.default.gray("\xB7")}  ${import_chalk.default.gray(msg)}`);
+    }
+  }
+};
+
+// cli/utils/eslint-runner.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function normalizePlugin(raw) {
+  if (isRecord(raw) && isRecord(raw.default) && isRecord(raw.default.rules)) {
+    return raw.default;
+  }
+  if (isRecord(raw) && isRecord(raw.rules)) {
+    return raw;
+  }
+  throw new Error(
+    "Could not load @undercurrentai/eslint-plugin-ai-guard. Run: npm install --save-dev @undercurrentai/eslint-plugin-ai-guard@next"
+  );
+}
+var RECOMMENDED_RULES = {
+  "ai-guard/no-empty-catch": "error",
+  "ai-guard/no-floating-promise": "error",
+  "ai-guard/no-hardcoded-secret": "error",
+  "ai-guard/no-eval-dynamic": "error",
+  "ai-guard/require-framework-auth": "warn",
+  "ai-guard/no-sql-string-concat": "warn",
+  "ai-guard/no-async-array-callback": "warn",
+  "ai-guard/no-unsafe-deserialize": "warn",
+  "ai-guard/require-framework-authz": "warn",
+  "ai-guard/require-webhook-signature": "warn"
+};
+var STRICT_RULES = {
+  "ai-guard/no-empty-catch": "error",
+  "ai-guard/no-catch-log-rethrow": "error",
+  "ai-guard/no-async-array-callback": "error",
+  "ai-guard/no-floating-promise": "error",
+  "ai-guard/no-hardcoded-secret": "error",
+  "ai-guard/no-eval-dynamic": "error",
+  "ai-guard/no-sql-string-concat": "error",
+  "ai-guard/no-unsafe-deserialize": "error",
+  "ai-guard/require-framework-auth": "error",
+  "ai-guard/require-framework-authz": "error",
+  "ai-guard/require-webhook-signature": "error",
+  "ai-guard/no-console-in-handler": "error",
+  "ai-guard/no-duplicate-logic-block": "error"
+};
+var SECURITY_RULES = {
+  "ai-guard/no-hardcoded-secret": "error",
+  "ai-guard/no-eval-dynamic": "error",
+  "ai-guard/no-sql-string-concat": "error",
+  "ai-guard/no-unsafe-deserialize": "warn",
+  "ai-guard/require-framework-auth": "warn",
+  "ai-guard/require-framework-authz": "warn",
+  "ai-guard/require-webhook-signature": "warn"
+};
+function getRules(preset) {
+  if (preset === "strict") return STRICT_RULES;
+  if (preset === "security") return SECURITY_RULES;
+  return RECOMMENDED_RULES;
+}
+var DEFAULT_IGNORE_PATTERNS = [
+  "**/node_modules/**",
+  "**/.next/**",
+  "**/dist/**",
+  "**/build/**",
+  "**/coverage/**",
+  "**/out/**",
+  "**/.git/**"
+];
+function isSkippablePatternError(error) {
+  const msg = error.message.toLowerCase();
+  const hasNoFilesSignal = msg.includes("no files") || msg.includes("no files matching");
+  const hasIgnoredSignal = msg.includes("ignored") || msg.includes("all files matched by") || msg.includes("are ignored") || msg.includes("was ignored") || msg.includes("file ignored");
+  return hasNoFilesSignal || hasIgnoredSignal;
+}
+async function loadPluginModuleFromCwd(cwd) {
+  const { createRequire: createRequire2 } = await import("module");
+  const { PLUGIN_NAMES: PLUGIN_NAMES2 } = await Promise.resolve().then(() => (init_constants(), constants_exports));
+  const cwdPkg = import_path.default.join(cwd, "package.json");
+  const anchor = import_fs.default.existsSync(cwdPkg) ? cwdPkg : import_path.default.join(cwd, "index.js");
+  const requireFromCwd = createRequire2(anchor);
+  let lastResolveError = null;
+  for (const pkgName of PLUGIN_NAMES2) {
+    let resolved;
+    try {
+      resolved = requireFromCwd.resolve(pkgName);
+    } catch (err) {
+      lastResolveError = err;
+      continue;
+    }
+    return requireFromCwd(resolved);
+  }
+  const localDistEntry = import_path.default.join(cwd, "dist", "index.js");
+  if (import_fs.default.existsSync(localDistEntry)) {
+    return requireFromCwd(localDistEntry);
+  }
+  const localSrcEntry = import_path.default.join(cwd, "src", "index.ts");
+  if (import_fs.default.existsSync(localSrcEntry)) {
+    try {
+      return await import((0, import_url.pathToFileURL)(localSrcEntry).href);
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      log.debug(`Local src plugin import failed: ${reason}`);
+    }
+  }
+  const detail = lastResolveError instanceof Error ? ` (${lastResolveError.message})` : "";
+  throw new Error(
+    `@undercurrentai/eslint-plugin-ai-guard is not installed${detail}. Run: npm install --save-dev @undercurrentai/eslint-plugin-ai-guard@next`
+  );
+}
+async function runEslint(options) {
+  const { ESLint } = await import("eslint").catch(() => {
+    throw new Error(
+      "ESLint is not installed. Run: npm install --save-dev eslint"
+    );
+  });
+  const rawPlugin = await loadPluginModuleFromCwd(process.cwd());
+  const plugin = normalizePlugin(rawPlugin);
+  const rules = getRules(options.preset);
+  const resolvedTargetPath = import_path.default.resolve(options.targetPath);
+  if (!import_fs.default.existsSync(resolvedTargetPath)) {
+    throw new Error(`Path not found: ${options.targetPath}`);
+  }
+  const targetStat = import_fs.default.statSync(resolvedTargetPath);
+  const isSingleFileTarget = targetStat.isFile();
+  const eslintCwd = isSingleFileTarget ? import_path.default.dirname(resolvedTargetPath) : resolvedTargetPath;
+  const startMs = Date.now();
+  const JS_TS_FILES = [
+    "**/*.js",
+    "**/*.jsx",
+    "**/*.ts",
+    "**/*.tsx",
+    "**/*.mts",
+    "**/*.cts",
+    "**/*.mjs",
+    "**/*.cjs"
+  ];
+  let tsParser = null;
+  try {
+    try {
+      tsParser = require(import_path.default.join(
+        process.cwd(),
+        "node_modules",
+        "@typescript-eslint",
+        "parser"
+      ));
+    } catch {
+      tsParser = require("@typescript-eslint/parser");
+    }
+  } catch {
+  }
+  const configBlocks = [
+    // JS/JSX files — default espree parser
+    {
+      files: ["**/*.js", "**/*.jsx", "**/*.mjs", "**/*.cjs"],
+      plugins: { "ai-guard": plugin },
+      languageOptions: {
+        parserOptions: {
+          ecmaVersion: "latest",
+          sourceType: "module",
+          ecmaFeatures: { jsx: true }
+        }
+      },
+      rules
+    },
+    // Ignore generated directories
+    { ignores: DEFAULT_IGNORE_PATTERNS }
+  ];
+  if (tsParser) {
+    configBlocks.splice(1, 0, {
+      files: ["**/*.ts", "**/*.tsx", "**/*.mts", "**/*.cts"],
+      plugins: { "ai-guard": plugin },
+      languageOptions: {
+        parser: tsParser,
+        parserOptions: {
+          // project: true would be needed for type-aware rules — skip for speed
+          ecmaVersion: "latest",
+          sourceType: "module"
+        }
+      },
+      rules
+    });
+  } else {
+    configBlocks.splice(1, 0, {
+      files: ["**/*.ts", "**/*.tsx", "**/*.mts", "**/*.cts"],
+      plugins: { "ai-guard": plugin },
+      rules
+    });
+  }
+  const eslint = new ESLint({
+    cwd: eslintCwd,
+    overrideConfigFile: true,
+    overrideConfig: configBlocks
+  });
+  const patterns = isSingleFileTarget ? [import_path.default.basename(resolvedTargetPath)] : JS_TS_FILES;
+  const perPatternResults = await Promise.all(
+    patterns.map(async (pattern) => {
+      try {
+        return await eslint.lintFiles([pattern]);
+      } catch (err) {
+        const error = err instanceof Error ? err : new Error(String(err));
+        if (isSkippablePatternError(error)) {
+          log.debug(`Skipping pattern '${pattern}' (no lintable files)`);
+          return [];
+        }
+        throw error;
+      }
+    })
+  );
+  const rawResults = perPatternResults.flat();
+  const durationMs = Date.now() - startMs;
+  const files = [];
+  const ruleBreakdown = /* @__PURE__ */ new Map();
+  let totalErrors = 0;
+  let totalWarnings = 0;
+  for (const result of rawResults) {
+    if (result.messages.length === 0) continue;
+    const issues = result.messages.map((m) => ({
+      ruleId: m.ruleId ?? "unknown",
+      severity: m.severity,
+      message: m.message,
+      line: m.line,
+      column: m.column
+    }));
+    const errorCount = result.errorCount;
+    const warningCount = result.warningCount;
+    totalErrors += errorCount;
+    totalWarnings += warningCount;
+    for (const issue of issues) {
+      ruleBreakdown.set(
+        issue.ruleId,
+        (ruleBreakdown.get(issue.ruleId) ?? 0) + 1
+      );
+    }
+    const relPath = import_path.default.relative(process.cwd(), result.filePath);
+    files.push({ filePath: relPath, issues, errorCount, warningCount });
+  }
+  const topFiles = [...files].sort((a, b) => b.issues.length - a.issues.length).slice(0, 10).map((f) => ({ path: f.filePath, count: f.issues.length }));
+  return {
+    files,
+    totalErrors,
+    totalWarnings,
+    totalIssues: totalErrors + totalWarnings,
+    ruleBreakdown,
+    topFiles,
+    durationMs
+  };
+}
+
+// cli/commands/run.ts
+function registerRunCommand(program2) {
+  program2.command("run").description("Run ai-guard rules on your project (zero ESLint config required)").option("--path <dir>", "Directory or file to scan", ".").option("--strict", "Use the strict rule preset (all rules at error)").option("--security", "Use the security-only rule preset").option("--json", "Output results as JSON").option(
+    "--max-warnings <n>",
+    "Fail if warnings exceed this count",
+    (value) => Number.parseInt(value, 10)
+  ).action(async (opts) => {
+    if (opts.maxWarnings !== void 0 && (!Number.isInteger(opts.maxWarnings) || opts.maxWarnings < 0)) {
+      log.blank();
+      log.error("--max-warnings must be a non-negative integer.");
+      log.blank();
+      process.exit(1);
+      return;
+    }
+    const preset = opts.strict ? "strict" : opts.security ? "security" : "recommended";
+    if (opts.strict && opts.security && !opts.json) {
+      log.warn("Both --strict and --security were provided. Using --strict.");
+      log.blank();
+    }
+    if (!opts.json) {
+      log.banner("AI GUARD RESULTS");
+      log.blank();
+    }
+    const spinner = opts.json ? null : (0, import_ora.default)({ text: "Scanning\u2026", color: "cyan" }).start();
+    let result;
+    try {
+      result = await runEslint({ preset, targetPath: opts.path });
+      spinner?.stop();
+    } catch (err) {
+      spinner?.stop();
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg.toLowerCase().includes("typescript") && msg.toLowerCase().includes("parser")) {
+        log.blank();
+        log.error("TypeScript detected but parser not found.");
+        log.blank();
+        log.print(`  ${import_chalk2.default.bold("Install the TypeScript parser:")}`);
+        log.blank();
+        log.print(`    ${import_chalk2.default.cyan("npm install --save-dev @typescript-eslint/parser")}`);
+        log.blank();
+      } else {
+        log.blank();
+        log.error(msg);
+        log.blank();
+        log.print(`  ${import_chalk2.default.bold("Fix:")} Run ${import_chalk2.default.cyan("ai-guard doctor")} to diagnose your setup.`);
+        log.blank();
+      }
+      process.exit(1);
+      return;
+    }
+    if (opts.json) {
+      const jsonOutput = {
+        preset,
+        scannedPath: opts.path,
+        totalErrors: result.totalErrors,
+        totalWarnings: result.totalWarnings,
+        totalIssues: result.totalIssues,
+        durationMs: result.durationMs,
+        ruleBreakdown: Object.fromEntries(result.ruleBreakdown),
+        topFiles: result.topFiles,
+        files: result.files
+      };
+      console.log(JSON.stringify(jsonOutput, null, 2));
+      process.exit(getRunExitCode(result, opts.maxWarnings));
+      return;
+    }
+    log.success(`Scanned:  ${import_chalk2.default.white(opts.path)}`);
+    log.success(`Duration: ${import_chalk2.default.white(result.durationMs + "ms")}`);
+    log.blank();
+    if (result.totalIssues === 0) {
+      log.print(
+        `  ${import_chalk2.default.green("\u2714")}  ${import_chalk2.default.bold.green("No AI issues found \u2014 your code looks clean")}`
+      );
+      log.blank();
+      process.exit(0);
+      return;
+    }
+    log.print(
+      `  ${import_chalk2.default.bold("Total Issues:")} ${formatIssueCount(result.totalErrors, result.totalWarnings)}`
+    );
+    log.blank();
+    if (result.ruleBreakdown.size > 0) {
+      log.section("By Rule");
+      const sorted = [...result.ruleBreakdown.entries()].sort(
+        (a, b) => b[1] - a[1]
+      );
+      for (const [rule, count] of sorted) {
+        const shortRule = rule.replace(/^ai-guard\//, "");
+        log.print(
+          `    ${import_chalk2.default.gray("\u2022")} ${import_chalk2.default.yellow(shortRule)}${import_chalk2.default.gray(":")} ${import_chalk2.default.white(String(count))}`
+        );
+      }
+      log.blank();
+    }
+    if (result.topFiles.length > 0) {
+      log.section("Top Files");
+      for (const { path: fp, count } of result.topFiles) {
+        log.print(
+          `    ${import_chalk2.default.gray("\u2022")} ${import_chalk2.default.white(fp)} ${import_chalk2.default.gray(`(${count})`)}`
+        );
+      }
+      log.blank();
+    }
+    log.section("Issues by File");
+    log.blank();
+    for (const file of result.files) {
+      log.print(
+        `  ${import_chalk2.default.bold.white(file.filePath)} ` + import_chalk2.default.gray(
+          `(${file.errorCount} error${file.errorCount !== 1 ? "s" : ""}, ${file.warningCount} warning${file.warningCount !== 1 ? "s" : ""})`
+        )
+      );
+      for (const issue of file.issues) {
+        const sev = issue.severity === 2 ? import_chalk2.default.red("error") : import_chalk2.default.yellow(" warn");
+        const loc = import_chalk2.default.gray(`${String(issue.line)}:${String(issue.column)}`).padEnd(12);
+        const ruleShort = import_chalk2.default.gray(issue.ruleId.replace(/^ai-guard\//, ""));
+        log.print(
+          `    ${loc} ${sev}  ${import_chalk2.default.white(issue.message)}  ${ruleShort}`
+        );
+      }
+      log.blank();
+    }
+    log.divider();
+    log.blank();
+    log.section("Next Steps");
+    if (!result.topFiles.length) {
+      log.info(`Run ${import_chalk2.default.cyan("ai-guard init")}     to wire up ESLint for your editor`);
+    }
+    log.info(`Run ${import_chalk2.default.cyan("ai-guard baseline")} to save these issues and track only new ones`);
+    log.info(`Run ${import_chalk2.default.cyan("ai-guard ignore")}    to suppress dist/build noise`);
+    log.blank();
+    process.exit(getRunExitCode(result, opts.maxWarnings));
+  });
+}
+function getRunExitCode(result, maxWarnings) {
+  if (result.totalErrors > 0) return 1;
+  if (maxWarnings !== void 0 && result.totalWarnings > maxWarnings) return 1;
+  return 0;
+}
+function formatIssueCount(errors, warnings) {
+  const parts = [];
+  if (errors > 0) parts.push(import_chalk2.default.red.bold(`${errors} error${errors !== 1 ? "s" : ""}`));
+  if (warnings > 0) parts.push(import_chalk2.default.yellow.bold(`${warnings} warning${warnings !== 1 ? "s" : ""}`));
+  return parts.join(import_chalk2.default.gray(" \xB7 "));
+}
+
+// cli/commands/init.ts
+var import_chalk3 = __toESM(require("chalk"));
+var import_path4 = __toESM(require("path"));
+var import_fs4 = __toESM(require("fs"));
+
+// cli/utils/detector.ts
+var import_fs2 = __toESM(require("fs"));
+var import_path2 = __toESM(require("path"));
+var import_module = require("module");
+init_constants();
+var FLAT_CONFIG_FILES = [
+  { file: "eslint.config.js", type: "flat-js" },
+  { file: "eslint.config.mjs", type: "flat-mjs" },
+  { file: "eslint.config.cjs", type: "flat-cjs" }
+];
+var LEGACY_CONFIG_FILES = [
+  { file: ".eslintrc.js", type: "eslintrc-js" },
+  { file: ".eslintrc.cjs", type: "eslintrc-cjs" },
+  { file: ".eslintrc.json", type: "eslintrc-json" },
+  { file: ".eslintrc.yaml", type: "eslintrc-yaml" },
+  { file: ".eslintrc.yml", type: "eslintrc-yaml" }
+];
+var ALL_CONFIG_FILES = [...FLAT_CONFIG_FILES, ...LEGACY_CONFIG_FILES];
+function isPackageInstalled(pkgName, cwd = process.cwd()) {
+  try {
+    const pkgPath = import_path2.default.join(cwd, "node_modules", pkgName, "package.json");
+    if (import_fs2.default.existsSync(pkgPath)) {
+      return true;
+    }
+    const req = (0, import_module.createRequire)(import_path2.default.join(cwd, "package.json"));
+    req.resolve(`${pkgName}/package.json`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getPackageVersion(pkgName, cwd = process.cwd()) {
+  try {
+    const pkgPath = import_path2.default.join(cwd, "node_modules", pkgName, "package.json");
+    const resolvedPath = import_fs2.default.existsSync(pkgPath) ? pkgPath : (0, import_module.createRequire)(import_path2.default.join(cwd, "package.json")).resolve(`${pkgName}/package.json`);
+    const raw = import_fs2.default.readFileSync(resolvedPath, "utf-8");
+    const json = JSON.parse(raw);
+    return json.version ?? null;
+  } catch {
+    return null;
+  }
+}
+function parseMajor(version) {
+  if (!version) return null;
+  const n = parseInt(version.split(".")[0], 10);
+  return isNaN(n) ? null : n;
+}
+function detectConfigType(cwd = process.cwd()) {
+  const found = [];
+  let first = null;
+  for (const { file, type } of ALL_CONFIG_FILES) {
+    const fullPath = import_path2.default.join(cwd, file);
+    if (import_fs2.default.existsSync(fullPath)) {
+      found.push(fullPath);
+      if (!first) first = { type, path: fullPath };
+    }
+  }
+  return {
+    type: first?.type ?? "none",
+    path: first?.path ?? null,
+    allPaths: found
+  };
+}
+function isFlat(type) {
+  return type === "flat-js" || type === "flat-mjs" || type === "flat-cjs";
+}
+function isLegacy(type) {
+  return type === "eslintrc-js" || type === "eslintrc-cjs" || type === "eslintrc-json" || type === "eslintrc-yaml";
+}
+function requiresFlatConfig(eslintMajor) {
+  return eslintMajor !== null && eslintMajor >= 9;
+}
+function detectNukeIgnore(configPath) {
+  if (!configPath) return false;
+  try {
+    const content = import_fs2.default.readFileSync(configPath, "utf-8");
+    return content.includes('"**/*"') || content.includes("'**/*'");
+  } catch {
+    return false;
+  }
+}
+function detect(cwd = process.cwd()) {
+  const eslintVersion = getPackageVersion("eslint", cwd);
+  const eslintMajor = parseMajor(eslintVersion);
+  const pluginInstalled = PLUGIN_NAMES.some((name) => isPackageInstalled(name, cwd));
+  const { type: configType, path: configPath, allPaths } = detectConfigType(cwd);
+  const hasFlatConfig = allPaths.some(
+    (p) => FLAT_CONFIG_FILES.some((c) => p.endsWith(c.file))
+  );
+  const hasLegacyConfig = allPaths.some(
+    (p) => LEGACY_CONFIG_FILES.some((c) => p.endsWith(c.file))
+  );
+  const hasConflictingConfigs = hasFlatConfig && hasLegacyConfig;
+  const hasNukeIgnore = detectNukeIgnore(configPath);
+  return {
+    eslintVersion,
+    eslintMajor,
+    pluginInstalled,
+    configType,
+    configPath,
+    allConfigPaths: allPaths,
+    hasConflictingConfigs,
+    hasNukeIgnore
+  };
+}
+
+// cli/commands/init.ts
+init_config_manager();
+function classifyVerifyError(err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  const clean = msg.replace(/\s+at\s+.+/gm, "").trim();
+  const modNotFound = clean.match(
+    /Cannot find module '([^']+)'|Cannot find package '([^']+)'/
+  );
+  if (modNotFound) {
+    const pkg = modNotFound[1] ?? modNotFound[2] ?? "unknown";
+    return { kind: "module-not-found", pkg, message: clean };
+  }
+  if (clean.includes("SyntaxError") || clean.includes("Unexpected token") || clean.includes("Invalid or unexpected token")) {
+    return { kind: "syntax", message: clean };
+  }
+  return { kind: "unknown", message: clean };
+}
+async function verifyConfigLoads(configPath, cwd) {
+  try {
+    const { ESLint } = await import("eslint");
+    const eslint = new ESLint({
+      cwd,
+      overrideConfigFile: configPath
+    });
+    await eslint.lintText("", {
+      filePath: import_path4.default.join(cwd, "_ai_guard_probe_.js")
+    });
+    return null;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("No files matching") || msg.includes("_ai_guard_probe_")) {
+      return null;
+    }
+    return classifyVerifyError(err);
+  }
+}
+function registerInitCommand(program2) {
+  program2.command("init").description("Configure @undercurrentai/eslint-plugin-ai-guard in this project").option("--preset <name>", "Preset to use: recommended | strict | security", "recommended").option("--flat", "Force flat config format (eslint.config.mjs) regardless of ESLint version").option("--dry-run", "Preview what would change without writing any files").action(async (opts) => {
+    const preset = opts.preset ?? "recommended";
+    const cwd = process.cwd();
+    const isDryRun = opts.dryRun === true;
+    log.banner("AI GUARD INIT");
+    if (isDryRun) {
+      log.print(`  ${import_chalk3.default.yellow("\u2691  DRY RUN \u2014 no files will be written")}`);
+      log.blank();
+    }
+    log.info("Detecting your project setup\u2026");
+    log.blank();
+    const env = detect(cwd);
+    log.section("Environment");
+    if (env.eslintVersion) {
+      log.success(`ESLint ${env.eslintVersion} detected (v${env.eslintMajor})`);
+    } else {
+      log.warn("ESLint not found in node_modules");
+    }
+    if (env.pluginInstalled) {
+      log.success("@undercurrentai/eslint-plugin-ai-guard is installed");
+    } else {
+      log.warn("@undercurrentai/eslint-plugin-ai-guard not found");
+    }
+    if (env.configType !== "none") {
+      log.success(`ESLint config found: ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath ?? env.configType))}`);
+    } else {
+      log.info("No ESLint config found \u2014 will generate one");
+    }
+    const eslintNeedsFlat = requiresFlatConfig(env.eslintMajor);
+    if (env.hasConflictingConfigs && !eslintNeedsFlat) {
+      log.blank();
+      log.warn("Conflicting configs detected:");
+      for (const p of env.allConfigPaths) {
+        log.print(`    ${import_chalk3.default.yellow("\u2192")} ${import_chalk3.default.white(import_path4.default.relative(cwd, p))}`);
+      }
+      log.print(`  ${import_chalk3.default.gray("Multiple config formats found \u2014 this can cause unpredictable behavior.")}`);
+    }
+    log.blank();
+    const toInstall = [];
+    if (!env.eslintVersion) toInstall.push("eslint");
+    if (!env.pluginInstalled) toInstall.push("@undercurrentai/eslint-plugin-ai-guard@next");
+    if (toInstall.length > 0) {
+      log.section("Missing Dependencies");
+      log.warn("The following packages are not installed:");
+      log.blank();
+      for (const pkg of toInstall) {
+        log.print(`    ${import_chalk3.default.yellow("\u2192")} ${import_chalk3.default.white(pkg)}`);
+      }
+      log.blank();
+      log.print(`  ${import_chalk3.default.bold("Run this first:")}`);
+      log.blank();
+      log.print(`    ${import_chalk3.default.cyan(`npm install --save-dev ${toInstall.join(" ")}`)}`);
+      log.blank();
+      log.print(`  Then re-run ${import_chalk3.default.cyan("ai-guard init")} to complete setup.`);
+      log.blank();
+      process.exit(1);
+      return;
+    }
+    try {
+      const { createRequire: createRequire2 } = await import("module");
+      const { pathToFileURL: pathToFileURL2 } = await import("url");
+      const req = createRequire2(import_path4.default.join(cwd, "_probe.js"));
+      const resolvedPath = req.resolve("@undercurrentai/eslint-plugin-ai-guard");
+      const aiGuard = await import(pathToFileURL2(resolvedPath).href);
+      const plugin = aiGuard.default || aiGuard;
+      const hasPresetRules = !!plugin.configs && !!plugin.configs[preset] && !!plugin.configs[preset].rules;
+      if (!hasPresetRules) {
+        log.debug("Plugin precheck could not verify configs shape; continuing to validation step.");
+      }
+    } catch (e) {
+      const reason = e instanceof Error ? e.message : String(e);
+      log.debug(`Skipped plugin precheck: ${reason}`);
+    }
+    const forceFlat = opts.flat === true;
+    const existingIsFlat = isFlat(env.configType);
+    const existingIsLegacy = isLegacy(env.configType);
+    const useFlat = forceFlat || eslintNeedsFlat || existingIsFlat || env.configType === "none";
+    if (eslintNeedsFlat && existingIsLegacy) {
+      log.section("Config Migration Required");
+      log.warn(`ESLint v${env.eslintMajor} requires flat config, but a legacy config was found:`);
+      log.print(`    ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath))}`);
+      log.blank();
+      log.print(`  ${import_chalk3.default.bold("ai-guard will create a new flat config.")}`);
+      log.blank();
+    }
+    log.section(`Configuring ESLint${isDryRun ? " (dry run)" : ""}`);
+    let finalConfigPath;
+    let configWritten = false;
+    if (env.configPath && env.hasNukeIgnore) {
+      const raw = readConfig(env.configPath);
+      const { content: fixed, changed } = removeNukeIgnore(raw);
+      if (changed) {
+        log.warn(`Removed "**/*" ignore pattern from ${import_path4.default.relative(cwd, env.configPath)}`);
+        if (!isDryRun) {
+          backupConfig(env.configPath);
+          writeConfig(env.configPath, fixed);
+          log.success("Ignore pattern fixed");
+        } else {
+          log.print(`  ${import_chalk3.default.gray("[dry-run] would remove nuke-ignore from existing config")}`);
+        }
+      }
+    }
+    if (env.configType === "none" || eslintNeedsFlat && existingIsLegacy) {
+      const targetName = useFlat ? "eslint.config.mjs" : ".eslintrc.js";
+      finalConfigPath = import_path4.default.join(cwd, targetName);
+      const content2 = useFlat ? generateFlatConfig(preset) : generateLegacyConfig(preset);
+      if (isDryRun) {
+        log.print(`  ${import_chalk3.default.gray(`[dry-run] would create: ${targetName}`)}`);
+        log.blank();
+        log.print(import_chalk3.default.gray("\u2500\u2500\u2500 Preview \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+        log.blank();
+        for (const line of content2.split("\n")) {
+          log.print(import_chalk3.default.gray(`  ${line}`));
+        }
+        log.blank();
+      } else {
+        writeConfig(finalConfigPath, content2);
+        log.success(`Created ${import_chalk3.default.white(targetName)}`);
+        log.info(`  Preset: ${import_chalk3.default.cyan(preset)}`);
+        log.info(`  Format: ${import_chalk3.default.cyan(useFlat ? "ESLint v9 flat config (eslint.config.mjs)" : "ESLint v8 legacy config (.eslintrc.js)")}`);
+        configWritten = true;
+      }
+    } else if (useFlat && existingIsFlat) {
+      const { isInvalidAiGuardConfig: isInvalidAiGuardConfig2 } = await Promise.resolve().then(() => (init_config_manager(), config_manager_exports));
+      const existing = readConfig(env.configPath);
+      const isInvalid = isInvalidAiGuardConfig2(existing);
+      const patched = patchFlatConfig(existing, preset);
+      if (patched === existing && !isInvalid) {
+        log.warn("ai-guard is already present in your config \u2014 no changes made");
+        finalConfigPath = env.configPath;
+      } else if (isDryRun) {
+        finalConfigPath = env.configPath;
+        log.print(`  ${import_chalk3.default.gray(`[dry-run] would patch: ${import_path4.default.relative(cwd, env.configPath)}`)}`);
+      } else {
+        const bak = backupConfig(env.configPath);
+        log.info(`Backed up \u2192 ${import_chalk3.default.gray(import_path4.default.relative(cwd, bak))}`);
+        writeConfig(env.configPath, patched);
+        if (isInvalid) {
+          log.success(`Detected invalid ai-guard config \u2014 repairing ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath))}`);
+        } else {
+          log.success(`Patched ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath))}`);
+        }
+        finalConfigPath = env.configPath;
+        configWritten = true;
+      }
+    } else {
+      const existing = readConfig(env.configPath);
+      const patched = patchLegacyConfig(existing, preset);
+      if (patched === existing) {
+        log.warn("ai-guard is already present in your config \u2014 no changes made");
+        finalConfigPath = env.configPath;
+      } else if (isDryRun) {
+        finalConfigPath = env.configPath;
+        log.print(`  ${import_chalk3.default.gray(`[dry-run] would patch: ${import_path4.default.relative(cwd, env.configPath)}`)}`);
+      } else {
+        const bak = backupConfig(env.configPath);
+        log.info(`Backed up \u2192 ${import_chalk3.default.gray(import_path4.default.relative(cwd, bak))}`);
+        writeConfig(env.configPath, patched);
+        log.success(`Patched ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath))}`);
+        finalConfigPath = env.configPath;
+        configWritten = true;
+      }
+    }
+    if (eslintNeedsFlat) {
+      const legacyConfigs = env.allConfigPaths.filter((p) => !p.includes("eslint.config."));
+      let cleanedUp = false;
+      for (const p of legacyConfigs) {
+        if (import_fs4.default.existsSync(p)) {
+          if (!isDryRun) {
+            try {
+              import_fs4.default.renameSync(p, `${p}.bak`);
+              cleanedUp = true;
+            } catch (err) {
+              const reason = err instanceof Error ? err.message : String(err);
+              log.warn(`Could not back up ${import_path4.default.relative(cwd, p)}: ${reason}`);
+            }
+          } else {
+            cleanedUp = true;
+            log.print(`  ${import_chalk3.default.gray(`[dry-run] would rename ${import_path4.default.relative(cwd, p)} to ${import_path4.default.basename(p)}.bak`)}`);
+          }
+        }
+      }
+      if (cleanedUp && !isDryRun) {
+        log.success("Legacy config backed up to avoid ESLint conflict");
+      }
+    }
+    if (isDryRun) {
+      log.blank();
+      log.print(`  ${import_chalk3.default.yellow("Dry run complete \u2014 no files written.")}`);
+      log.print(`  Re-run without ${import_chalk3.default.cyan("--dry-run")} to apply.`);
+      log.blank();
+      process.exit(0);
+      return;
+    }
+    log.blank();
+    log.section("Validation");
+    if (!import_fs4.default.existsSync(finalConfigPath)) {
+      log.error(`Config file not found after write: ${import_path4.default.relative(cwd, finalConfigPath)}`);
+      log.blank();
+      log.print(`  ${import_chalk3.default.bold("Problem:")} File write may have failed.`);
+      log.print(`  ${import_chalk3.default.bold("Fix:")} Check disk space and file permissions, then re-run.`);
+      log.blank();
+      process.exit(1);
+      return;
+    }
+    const content = readConfig(finalConfigPath);
+    const validationErrors = useFlat ? validateFlatConfigText(content) : validateLegacyConfigText(content);
+    if (validationErrors.length > 0) {
+      log.warn("Config validation found issues:");
+      for (const e of validationErrors) {
+        log.print(`    ${import_chalk3.default.red("\u2716")} ${e}`);
+      }
+    } else {
+      log.success(`Config structure valid: ${import_chalk3.default.white(import_path4.default.relative(cwd, finalConfigPath))}`);
+    }
+    log.info("Verifying ESLint can load the config\u2026");
+    const loadError = await verifyConfigLoads(finalConfigPath, cwd);
+    if (loadError !== null) {
+      log.blank();
+      if (loadError.kind === "module-not-found") {
+        log.warn(`Could not verify: module not found: ${import_chalk3.default.yellow(loadError.pkg)}`);
+        log.blank();
+        log.print(`  ${import_chalk3.default.bold("Install the missing package:")}`);
+        log.print(`    ${import_chalk3.default.cyan(`npm install --save-dev ${loadError.pkg}`)}`);
+        log.print(`  Then run ${import_chalk3.default.cyan("ai-guard doctor")} to confirm.`);
+        log.blank();
+      } else {
+        log.error("ESLint failed to load the generated config.");
+        log.blank();
+        log.print(`  ${import_chalk3.default.bold("Problem:")}`);
+        log.print(`    ${import_chalk3.default.red(loadError.message)}`);
+        if (loadError.kind === "unknown") {
+          log.blank();
+          log.print(`    ${import_chalk3.default.yellow("Generated config may be using incorrect plugin structure.")}`);
+        }
+        log.blank();
+        log.print(`  ${import_chalk3.default.bold("Fix:")}`);
+        log.print(`    1. Check the syntax in ${import_chalk3.default.cyan(import_path4.default.relative(cwd, finalConfigPath))}`);
+        log.print(`    2. Make sure ${import_chalk3.default.cyan("@undercurrentai/eslint-plugin-ai-guard")} is installed`);
+        log.print(`    3. Run ${import_chalk3.default.cyan("ai-guard doctor")} for full diagnostics`);
+        log.blank();
+        process.exit(1);
+        return;
+      }
+    } else {
+      log.success("ESLint loaded config successfully");
+    }
+    log.blank();
+    log.section("Setup Complete");
+    log.blank();
+    let cleanedUpInfo = false;
+    if (eslintNeedsFlat) {
+      const legacyConfigs = env.allConfigPaths.filter((p) => !p.includes("eslint.config."));
+      cleanedUpInfo = legacyConfigs.some((p) => import_fs4.default.existsSync(`${p}.bak`) && !import_fs4.default.existsSync(p));
+    }
+    const lingeringConflicts = env.hasConflictingConfigs && !eslintNeedsFlat && !cleanedUpInfo;
+    if (loadError === null && !lingeringConflicts) {
+      log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold.green("Configuration validated successfully")}`);
+    }
+    log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold("ESLint config:")} ${import_chalk3.default.cyan(import_path4.default.relative(cwd, finalConfigPath))}`);
+    log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold("Mode:")} ${import_chalk3.default.cyan(useFlat ? `Flat config (ESLint v${env.eslintMajor ?? 9})` : `Legacy config (ESLint v${env.eslintMajor ?? 8})`)}`);
+    log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold("Preset:")} ${import_chalk3.default.cyan(preset)}`);
+    log.blank();
+    log.info(`Run ${import_chalk3.default.cyan("npx eslint .")}         \u2192 lint with your editor integration`);
+    log.info(`Run ${import_chalk3.default.cyan("ai-guard run")}          \u2192 zero-config scan`);
+    log.info(`Run ${import_chalk3.default.cyan("ai-guard doctor")}       \u2192 verify the full setup`);
+    log.info(`Run ${import_chalk3.default.cyan("ai-guard baseline")}     \u2192 save baseline, track only new issues`);
+    log.blank();
+  });
+}
+
+// cli/commands/doctor.ts
+var import_chalk4 = __toESM(require("chalk"));
+var import_path5 = __toESM(require("path"));
+init_config_manager();
+async function probeConfigLoad(configPath, cwd) {
+  try {
+    const { ESLint } = await import("eslint");
+    const eslint = new ESLint({ cwd, overrideConfigFile: configPath });
+    await eslint.lintText("", { filePath: import_path5.default.join(cwd, "_probe_.js") });
+    return { ok: true, error: null };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("No files") || msg.includes("no files") || msg.includes("_probe_")) {
+      return { ok: true, error: null };
+    }
+    const clean = msg.replace(/\s+at\s+.+/gm, "").trim();
+    return { ok: false, error: clean };
+  }
+}
+function registerDoctorCommand(program2) {
+  program2.command("doctor").description("Diagnose your ai-guard setup and print actionable fixes").action(async () => {
+    const cwd = process.cwd();
+    log.banner("AI GUARD DOCTOR");
+    log.info("Checking your environment\u2026");
+    log.blank();
+    const env = detect(cwd);
+    const checks = [];
+    checks.push({
+      label: "ESLint installed",
+      pass: env.eslintVersion !== null,
+      detail: env.eslintVersion ? `ESLint ${env.eslintVersion}` : "Not found in node_modules",
+      fix: env.eslintVersion ? void 0 : "npm install --save-dev eslint"
+    });
+    checks.push({
+      label: "ai-guard plugin installed",
+      pass: env.pluginInstalled,
+      detail: env.pluginInstalled ? "Found in node_modules (scoped or legacy package)" : "Not found in node_modules",
+      fix: env.pluginInstalled ? void 0 : "npm install --save-dev @undercurrentai/eslint-plugin-ai-guard@next"
+    });
+    const hasConfig = env.configType !== "none";
+    checks.push({
+      label: "ESLint config present",
+      pass: hasConfig,
+      detail: hasConfig ? `${import_path5.default.relative(cwd, env.configPath ?? "")} (${env.configType})` : "No eslint.config.* or .eslintrc.* found",
+      fix: hasConfig ? void 0 : "ai-guard init",
+      note: hasConfig ? void 0 : "This will generate the correct config format for your ESLint version"
+    });
+    if (env.eslintMajor !== null && hasConfig) {
+      const needsFlat = requiresFlatConfig(env.eslintMajor);
+      const actuallyFlat = isFlat(env.configType);
+      const actuallyLegacy = isLegacy(env.configType);
+      const aligned = needsFlat && actuallyFlat || !needsFlat && actuallyLegacy;
+      checks.push({
+        label: "Config format matches ESLint version",
+        pass: aligned,
+        detail: aligned ? `${actuallyFlat ? "Flat config" : "Legacy config"} \u2714 matches ESLint v${env.eslintMajor}` : `ESLint v${env.eslintMajor} requires ${needsFlat ? "flat config (eslint.config.*)" : "legacy config (.eslintrc.*)"} but found ${actuallyFlat ? "flat" : "legacy"} config`,
+        fix: aligned ? void 0 : needsFlat ? "ai-guard init  (will create eslint.config.mjs)" : "npm install --save-dev eslint@8  (or upgrade to v9 and run ai-guard init)",
+        note: aligned ? void 0 : needsFlat ? "ESLint v9 ignores .eslintrc.* files. The flat config must be used." : void 0
+      });
+    }
+    if (hasConfig && env.configPath) {
+      let pluginWired = false;
+      let isInvalidConfig = false;
+      let readError = null;
+      try {
+        const { isInvalidAiGuardConfig: isInvalidAiGuardConfig2 } = await Promise.resolve().then(() => (init_config_manager(), config_manager_exports));
+        const content = readConfig(env.configPath);
+        pluginWired = content.includes("ai-guard") || content.includes("@undercurrentai/eslint-plugin-ai-guard");
+        isInvalidConfig = isInvalidAiGuardConfig2(content);
+      } catch (err) {
+        readError = err instanceof Error ? err.message : String(err);
+      }
+      checks.push({
+        label: "Plugin wired in config",
+        pass: pluginWired && !isInvalidConfig,
+        detail: readError ? `Could not read config: ${readError}` : isInvalidConfig ? "Invalid ai-guard config detected (wrong export usage)" : pluginWired ? "@undercurrentai/eslint-plugin-ai-guard referenced in config" : `Config exists but ai-guard plugin not found in ${import_path5.default.relative(cwd, env.configPath)}`,
+        fix: isInvalidConfig || !pluginWired && !readError ? "ai-guard init  (will patch/repair your existing config)" : void 0
+      });
+    }
+    checks.push({
+      label: "No conflicting config files",
+      pass: !env.hasConflictingConfigs,
+      detail: env.hasConflictingConfigs ? `Conflicting config detected:
+${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}`).join("\n")}` : "Only one config format detected",
+      fix: env.hasConflictingConfigs ? "Remove or backup legacy config" : void 0,
+      note: env.hasConflictingConfigs ? "ESLint v9 silently ignores .eslintrc.* when a flat config exists. This can cause confusion." : void 0
+    });
+    if (hasConfig && env.hasNukeIgnore) {
+      checks.push({
+        label: 'No "ignore everything" pattern',
+        pass: false,
+        detail: `Config contains "**/*" ignore pattern \u2014 this silently prevents all files from being linted`,
+        fix: "ai-guard init  (will remove the pattern and replace with safe ignores)"
+      });
+    }
+    const versionOk = env.eslintMajor !== null && env.eslintMajor >= 8;
+    checks.push({
+      label: "ESLint version compatible",
+      pass: versionOk,
+      detail: versionOk ? `v${env.eslintMajor} \u2714 (requires \u2265 v8)` : env.eslintMajor !== null ? `v${env.eslintMajor} is too old \u2014 requires ESLint \u2265 8` : "ESLint not installed",
+      fix: versionOk ? void 0 : "npm install --save-dev eslint@latest"
+    });
+    const configChecksPass = checks.every((c) => c.pass);
+    if (hasConfig && env.configPath && env.pluginInstalled && configChecksPass) {
+      log.info("Probing ESLint config load\u2026");
+      const probe = await probeConfigLoad(env.configPath, cwd);
+      checks.push({
+        label: "ESLint config loads without errors",
+        pass: probe.ok,
+        detail: probe.ok ? "ESLint loaded config successfully" : probe.error ?? "Unknown error",
+        fix: probe.ok ? void 0 : `Check syntax in ${import_path5.default.relative(cwd, env.configPath)}`,
+        note: probe.ok ? void 0 : "Run: ai-guard init --dry-run  to preview a fresh config"
+      });
+    }
+    log.section("Diagnostics");
+    let allPassed = true;
+    for (const check of checks) {
+      const icon = check.pass ? import_chalk4.default.green("\u2714") : import_chalk4.default.red("\u2716");
+      const label = check.pass ? import_chalk4.default.white(check.label) : import_chalk4.default.red.bold(check.label);
+      log.print(`  ${icon}  ${label}`);
+      log.print(`       ${import_chalk4.default.gray(check.detail)}`);
+      if (!check.pass) {
+        allPassed = false;
+        if (check.fix) {
+          log.print(`       ${import_chalk4.default.cyan("\u2192 Fix:")} ${import_chalk4.default.yellow(check.fix)}`);
+        }
+        if (check.note) {
+          log.print(`       ${import_chalk4.default.gray(check.note)}`);
+        }
+      }
+      log.blank();
+    }
+    log.divider();
+    log.blank();
+    if (allPassed) {
+      log.print(`  ${import_chalk4.default.green("\u2714")}  ${import_chalk4.default.bold.green("All checks passed! Your setup is correct.")}`);
+      log.blank();
+      log.info(`Run ${import_chalk4.default.cyan("ai-guard run")} to start scanning.`);
+      log.info(`Run ${import_chalk4.default.cyan("npx eslint .")} to lint with ESLint directly.`);
+    } else {
+      log.error("Some checks failed. Follow the fixes above.");
+      log.blank();
+      const configFormatMismatch = checks.some(
+        (c) => c.label === "Config format matches ESLint version" && !c.pass
+      );
+      const configMissing = checks.some(
+        (c) => c.label === "ESLint config present" && !c.pass
+      );
+      const pluginMissing = checks.some(
+        (c) => c.label === "ai-guard plugin installed" && !c.pass
+      );
+      if (pluginMissing) {
+        log.print(
+          `  Install missing packages first, then re-run ${import_chalk4.default.cyan("ai-guard doctor")}.`
+        );
+      } else if (configMissing || configFormatMismatch) {
+        log.print(
+          `  Run ${import_chalk4.default.cyan("ai-guard init")} to generate the correct config for your ESLint version.`
+        );
+      } else {
+        log.print(
+          `  Run ${import_chalk4.default.cyan("ai-guard init --dry-run")} to preview what would change.`
+        );
+      }
+    }
+    log.blank();
+    process.exit(allPassed ? 0 : 1);
+  });
+}
+
+// cli/commands/preset.ts
+var import_prompts = require("@inquirer/prompts");
+var import_chalk5 = __toESM(require("chalk"));
+init_config_manager();
+var import_path6 = __toESM(require("path"));
+function registerPresetCommand(program2) {
+  program2.command("preset").description("Interactively select and apply an ai-guard preset to your ESLint config").action(async () => {
+    const cwd = process.cwd();
+    log.banner("AI GUARD PRESET");
+    log.blank();
+    const preset = await (0, import_prompts.select)({
+      message: "Choose a preset:",
+      choices: [
+        {
+          name: `${import_chalk5.default.green("recommended")} \u2014 balanced defaults, low noise. Best starting point.`,
+          value: "recommended"
+        },
+        {
+          name: `${import_chalk5.default.yellow("strict")}      \u2014 all rules at error. For mature codebases.`,
+          value: "strict"
+        },
+        {
+          name: `${import_chalk5.default.red("security")}   \u2014 security rules only. For AppSec teams.`,
+          value: "security"
+        }
+      ]
+    });
+    log.blank();
+    log.info(`Applying preset: ${import_chalk5.default.cyan(preset)}`);
+    const env = detect(cwd);
+    const useFlat = env.eslintMajor !== null && env.eslintMajor >= 9 || isFlat(env.configType);
+    if (env.configType === "none") {
+      const configPath = useFlat ? import_path6.default.join(cwd, "eslint.config.mjs") : import_path6.default.join(cwd, ".eslintrc.js");
+      const content = useFlat ? generateFlatConfig(preset) : generateLegacyConfig(preset);
+      writeConfig(configPath, content);
+      log.success(`Created ${import_chalk5.default.white(import_path6.default.relative(cwd, configPath))} with ${import_chalk5.default.cyan(preset)} preset`);
+    } else {
+      const configPath = env.configPath;
+      const backupPath = backupConfig(configPath);
+      log.info(`Backed up \u2192 ${import_chalk5.default.gray(import_path6.default.relative(cwd, backupPath))}`);
+      const existing = readConfig(configPath);
+      const withPlugin = isFlat(env.configType) ? patchFlatConfig(existing, preset) : patchLegacyConfig(existing, preset);
+      const patched = isFlat(env.configType) ? switchFlatPreset(withPlugin, preset) : switchLegacyPreset(withPlugin, preset);
+      if (patched === existing) {
+        log.warn("No preset changes needed. Config already matches selected preset.");
+      } else {
+        writeConfig(configPath, patched);
+        log.success(`Updated ${import_chalk5.default.white(import_path6.default.relative(cwd, configPath))} to ${import_chalk5.default.cyan(preset)} preset`);
+      }
+    }
+    log.blank();
+    log.section("Preset Details");
+    const ruleMap = preset === "strict" ? STRICT_RULES : preset === "security" ? SECURITY_RULES : RECOMMENDED_RULES;
+    const entries = Object.entries(ruleMap).map(([ruleId, level]) => ({
+      rule: ruleId.replace(/^ai-guard\//, ""),
+      level: level === "error" ? import_chalk5.default.red("error") : import_chalk5.default.yellow("warn")
+    }));
+    for (const { rule, level } of entries) {
+      log.print(`    ${import_chalk5.default.gray("\u2022")} ${import_chalk5.default.white(rule).padEnd(32)}${level}`);
+    }
+    log.blank();
+    log.info(`Run ${import_chalk5.default.cyan("ai-guard run")} to see results with the new preset.`);
+    log.blank();
+  });
+}
+
+// cli/commands/ignore.ts
+var import_chalk6 = __toESM(require("chalk"));
+init_config_manager();
+var import_path7 = __toESM(require("path"));
+var DEFAULT_IGNORES = [
+  ".next/",
+  "dist/",
+  "build/",
+  "coverage/",
+  "out/",
+  "node_modules/"
+];
+function registerIgnoreCommand(program2) {
+  program2.command("ignore").description("Add default ignore patterns (.next, dist, build, coverage) to ESLint config").action(() => {
+    const cwd = process.cwd();
+    log.banner("AI GUARD IGNORE");
+    log.blank();
+    log.section("Default Ignores");
+    for (const p of DEFAULT_IGNORES) {
+      log.print(`    ${import_chalk6.default.gray("\u2022")} ${import_chalk6.default.yellow(p)}`);
+    }
+    log.blank();
+    const env = detect(cwd);
+    if (env.configType === "none") {
+      const useFlat = env.eslintMajor !== null && env.eslintMajor >= 9;
+      const configPath = useFlat ? import_path7.default.join(cwd, "eslint.config.mjs") : import_path7.default.join(cwd, ".eslintrc.js");
+      const content = useFlat ? generateFlatConfig("recommended") : generateLegacyConfig("recommended");
+      writeConfig(configPath, content);
+      log.success(`No config found \u2014 generated ${import_chalk6.default.white(import_path7.default.relative(cwd, configPath))} with ignores included`);
+    } else {
+      const configPath = env.configPath;
+      const backupPath = backupConfig(configPath);
+      log.info(`Backed up \u2192 ${import_chalk6.default.gray(import_path7.default.relative(cwd, backupPath))}`);
+      const existing = readConfig(configPath);
+      const patched = isFlat(env.configType) ? addIgnoresToFlatConfig(existing) : addIgnoresToLegacyConfig(existing);
+      if (patched === existing) {
+        log.warn("Ignore patterns already present in config \u2014 no changes made.");
+      } else {
+        writeConfig(configPath, patched);
+        log.success(`Patched ${import_chalk6.default.white(import_path7.default.relative(cwd, configPath))} with ignore patterns`);
+      }
+    }
+    log.blank();
+    log.info("Noisy directories will now be skipped in all future ESLint runs.");
+    log.info(`Run ${import_chalk6.default.cyan("ai-guard run")} to verify cleaner results.`);
+    log.blank();
+  });
+}
+
+// cli/commands/baseline.ts
+var import_fs5 = __toESM(require("fs"));
+var import_path8 = __toESM(require("path"));
+var import_chalk7 = __toESM(require("chalk"));
+var import_ora2 = __toESM(require("ora"));
+var BASELINE_FILE = ".ai-guard-baseline.json";
+function saveBaseline(result, preset, mode, cwd) {
+  const entries = result.files.map((f) => ({
+    filePath: f.filePath,
+    issues: f.issues.map((i) => ({
+      ruleId: i.ruleId,
+      message: i.message,
+      line: i.line,
+      column: i.column
+    }))
+  }));
+  const baseline = {
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    preset,
+    mode,
+    totalIssues: result.totalIssues,
+    entries
+  };
+  const baselinePath = import_path8.default.join(cwd, BASELINE_FILE);
+  import_fs5.default.writeFileSync(baselinePath, JSON.stringify(baseline, null, 2), "utf-8");
+  return baselinePath;
+}
+function loadBaseline(cwd) {
+  const baselinePath = import_path8.default.join(cwd, BASELINE_FILE);
+  if (!import_fs5.default.existsSync(baselinePath)) return null;
+  try {
+    const raw = import_fs5.default.readFileSync(baselinePath, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || typeof parsed.preset !== "string" || !Array.isArray(parsed.entries)) {
+      log.warn(
+        `Baseline file ${BASELINE_FILE} is malformed \u2014 ignoring. Run 'ai-guard baseline --save' to regenerate.`
+      );
+      return null;
+    }
+    return parsed;
+  } catch {
+    log.warn(
+      `Baseline file ${BASELINE_FILE} could not be parsed \u2014 ignoring. Run 'ai-guard baseline --save' to regenerate.`
+    );
+    return null;
+  }
+}
+function issueKey(filePath, issue) {
+  return `${filePath}::${issue.ruleId}::${issue.line}::${issue.column}::${issue.message}`;
+}
+function stableIssueKey(filePath, issue) {
+  return `${filePath}::${issue.ruleId}::${issue.message}`;
+}
+function buildBaselineSet(baseline, mode) {
+  const toKey = mode === "stable" ? stableIssueKey : issueKey;
+  const set = /* @__PURE__ */ new Set();
+  for (const entry of baseline.entries) {
+    for (const issue of entry.issues) {
+      set.add(toKey(entry.filePath, issue));
+    }
+  }
+  return set;
+}
+function computeNewIssues(result, baselineSet, mode) {
+  const toKey = mode === "stable" ? stableIssueKey : issueKey;
+  const newFiles = [];
+  let totalErrors = 0;
+  let totalWarnings = 0;
+  const ruleBreakdown = /* @__PURE__ */ new Map();
+  for (const file of result.files) {
+    const newIssues = file.issues.filter(
+      (i) => !baselineSet.has(toKey(file.filePath, i))
+    );
+    if (newIssues.length === 0) continue;
+    const errorCount = newIssues.filter((i) => i.severity === 2).length;
+    const warningCount = newIssues.filter((i) => i.severity === 1).length;
+    totalErrors += errorCount;
+    totalWarnings += warningCount;
+    for (const issue of newIssues) {
+      ruleBreakdown.set(
+        issue.ruleId,
+        (ruleBreakdown.get(issue.ruleId) ?? 0) + 1
+      );
+    }
+    newFiles.push({ ...file, issues: newIssues, errorCount, warningCount });
+  }
+  const topFiles = [...newFiles].sort((a, b) => b.issues.length - a.issues.length).slice(0, 10).map((f) => ({ path: f.filePath, count: f.issues.length }));
+  return {
+    files: newFiles,
+    totalErrors,
+    totalWarnings,
+    totalIssues: totalErrors + totalWarnings,
+    ruleBreakdown,
+    topFiles,
+    durationMs: result.durationMs
+  };
+}
+function registerBaselineCommand(program2) {
+  program2.command("baseline").description("Save current issues as baseline; future runs show only new issues").option("--save", "Save current state as the new baseline").option("--check", "Show only issues introduced since the last baseline").option("--mode <name>", "Baseline match mode: strict | stable", "stable").option("--path <dir>", "Directory to scan", ".").option("--preset <name>", "Preset: recommended | strict | security", "recommended").action(async (opts) => {
+    const cwd = process.cwd();
+    const preset = opts.preset ?? "recommended";
+    const mode = opts.mode ?? "stable";
+    if (mode !== "strict" && mode !== "stable") {
+      log.error("Invalid --mode. Use strict or stable.");
+      process.exit(1);
+      return;
+    }
+    log.banner("AI GUARD BASELINE");
+    log.blank();
+    const existingBaseline = loadBaseline(cwd);
+    const doSave = opts.save ?? (!existingBaseline && !opts.check);
+    const doCheck = opts.check ?? (existingBaseline !== null && !opts.save);
+    if (doSave) {
+      log.info("Scanning project to save baseline\u2026");
+      const spinner = (0, import_ora2.default)({ text: "Running analysis\u2026", color: "cyan" }).start();
+      let result;
+      try {
+        result = await runEslint({ preset, targetPath: opts.path });
+        spinner.stop();
+      } catch (err) {
+        spinner.stop();
+        log.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+        return;
+      }
+      const baselinePath = saveBaseline(result, preset, mode, cwd);
+      log.success(
+        `Baseline saved \u2192 ${import_chalk7.default.white(import_path8.default.relative(cwd, baselinePath))}`
+      );
+      log.info(`  ${result.totalIssues} issues recorded (${result.totalErrors} errors, ${result.totalWarnings} warnings)`);
+      log.info(`  Preset: ${import_chalk7.default.cyan(preset)}`);
+      log.info(`  Mode: ${import_chalk7.default.cyan(mode)}`);
+      log.blank();
+      log.info("Future runs of " + import_chalk7.default.cyan("ai-guard baseline --check") + " will show only NEW issues.");
+      log.info("Add " + import_chalk7.default.white(BASELINE_FILE) + " to your git repository to share baseline with your team.");
+      log.blank();
+      return;
+    }
+    if (doCheck) {
+      if (!existingBaseline) {
+        log.error(`No baseline found at ${import_chalk7.default.white(BASELINE_FILE)}`);
+        log.info(`Run ${import_chalk7.default.cyan("ai-guard baseline --save")} first to create one.`);
+        process.exit(1);
+        return;
+      }
+      const baselineDate = new Date(existingBaseline.createdAt).toLocaleString();
+      log.info(`Baseline from: ${import_chalk7.default.gray(baselineDate)}`);
+      log.info(`Baseline preset: ${import_chalk7.default.cyan(existingBaseline.preset)}`);
+      log.info(`Baseline mode: ${import_chalk7.default.cyan(existingBaseline.mode ?? "strict")}`);
+      log.info(`Baseline issues: ${import_chalk7.default.gray(existingBaseline.totalIssues)}`);
+      const scanPreset = existingBaseline.preset;
+      if (opts.preset && opts.preset !== scanPreset) {
+        log.warn(
+          `--preset ${import_chalk7.default.cyan(opts.preset)} ignored: scanning with baseline's preset ${import_chalk7.default.cyan(scanPreset)} to keep the comparison apples-to-apples.`
+        );
+      }
+      log.blank();
+      const spinner = (0, import_ora2.default)({ text: "Scanning for new issues\u2026", color: "cyan" }).start();
+      let result;
+      try {
+        result = await runEslint({ preset: scanPreset, targetPath: opts.path });
+        spinner.stop();
+      } catch (err) {
+        spinner.stop();
+        log.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+        return;
+      }
+      const compareMode = existingBaseline.mode ?? "strict";
+      const baselineSet = buildBaselineSet(existingBaseline, compareMode);
+      const newResult = computeNewIssues(result, baselineSet, compareMode);
+      if (newResult.totalIssues === 0) {
+        log.success("No new issues since baseline! \u2728");
+        log.info(
+          `Total in codebase: ${result.totalIssues} (all existing, none new)`
+        );
+        log.blank();
+        process.exit(0);
+        return;
+      }
+      log.print(
+        import_chalk7.default.bold.red(`  \u2716  ${newResult.totalIssues} new issue${newResult.totalIssues !== 1 ? "s" : ""} since baseline`)
+      );
+      log.blank();
+      if (newResult.ruleBreakdown.size > 0) {
+        log.section("New Issues by Rule");
+        for (const [rule, count] of [...newResult.ruleBreakdown.entries()].sort(
+          (a, b) => b[1] - a[1]
+        )) {
+          log.rule(rule, count);
+        }
+      }
+      if (newResult.files.length > 0) {
+        log.section("New Issues by File");
+        log.blank();
+        for (const file of newResult.files) {
+          log.print(
+            `  ${import_chalk7.default.bold.white(file.filePath)} ` + import_chalk7.default.gray(`(${file.issues.length} new)`)
+          );
+          for (const issue of file.issues) {
+            log.issue(issue.message, issue.severity, issue.line, issue.column);
+          }
+        }
+      }
+      log.blank();
+      log.divider();
+      log.blank();
+      log.error(
+        `${newResult.totalIssues} new issue${newResult.totalIssues !== 1 ? "s" : ""} introduced since baseline.`
+      );
+      log.info(`Run ${import_chalk7.default.cyan("ai-guard baseline --save")} to update the baseline after fixing them.`);
+      log.blank();
+      process.exit(1);
+    }
+  });
+}
+
+// cli/commands/init-context.ts
+var import_fs6 = __toESM(require("fs"));
+var import_path9 = __toESM(require("path"));
+var import_chalk8 = __toESM(require("chalk"));
+var import_prompts2 = require("@inquirer/prompts");
+var RULE_CATEGORIES = {
+  "error-handling": [
+    "no-empty-catch",
+    "no-catch-log-rethrow"
+  ],
+  async: [
+    "no-async-array-callback",
+    "no-floating-promise"
+  ],
+  security: [
+    "no-hardcoded-secret",
+    "no-eval-dynamic",
+    "no-sql-string-concat",
+    "no-unsafe-deserialize",
+    "require-framework-auth",
+    "require-framework-authz",
+    "require-webhook-signature"
+  ],
+  quality: [
+    "no-console-in-handler",
+    "no-duplicate-logic-block"
+  ]
+};
+var ALL_CATEGORIES = ["error-handling", "async", "security", "quality"];
+var ACTIVE_RULE_COUNT = Object.values(RULE_CATEGORIES).flat().length;
+function errorHandlingSection() {
+  return `## Error Handling
+**Never** generate empty catch blocks:
+  \u274C  try { await fetchUser() } catch (e) {}
+  \u2705  try { await fetchUser() } catch (e) { logger.error(e); throw e; }
+
+**Never** catch, log, and immediately rethrow without adding context:
+  \u274C  catch (e) { console.error(e); throw e; }
+  \u2705  catch (e) { throw new Error('fetchUser failed', { cause: e }); }`;
+}
+function asyncSection() {
+  return `## Async Correctness
+**Never** pass async callbacks to array.map(), filter(), forEach(), or reduce():
+  \u274C  const results = ids.map(async (id) => await fetchUser(id));
+  \u2705  const results = await Promise.all(ids.map((id) => fetchUser(id)));
+
+**Never** call an async function without await or .catch():
+  \u274C  sendEmail(user);
+  \u2705  await sendEmail(user);`;
+}
+function securitySection() {
+  return `## Security
+**Never** hardcode secrets, API keys, tokens, or passwords inline:
+  \u274C  const apiKey = 'sk-prod-abc123';
+  \u2705  const apiKey = process.env.API_KEY;
+
+**Never** concatenate user input into SQL strings:
+  \u274C  db.query('SELECT * FROM users WHERE id = ' + req.params.id);
+  \u2705  db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);
+
+**Never** use eval() or new Function() with dynamic/user-supplied strings.
+
+**Never** call JSON.parse() on req.body, req.query, or req.params directly
+without schema validation.
+
+**Always** add authentication middleware before route handlers:
+  \u274C  router.get('/admin/users', getUsers);
+  \u2705  router.get('/admin/users', requireAuth, getUsers);
+
+**Always** verify that the authenticated user owns or has access to the
+resource being accessed when using req.params.id or similar identifiers.
+
+**Always** verify webhook signatures before parsing or trusting webhook
+payloads.`;
+}
+function qualitySection() {
+  return `## Code Quality
+**Never** leave console.log or console.debug statements inside HTTP route
+handlers or event listeners in production code.
+
+**Never** copy-paste the same logic block consecutively \u2014 extract shared
+logic into a helper function or consolidate duplicated code.`;
+}
+var SECTION_MAP = {
+  "error-handling": errorHandlingSection,
+  async: asyncSection,
+  security: securitySection,
+  quality: qualitySection
+};
+function getSections(categories) {
+  return categories.map((cat) => SECTION_MAP[cat]()).join("\n\n");
+}
+function workflowGuidanceMarkdown() {
+  return `## Workflow Guardrails
+- Follow user and repository instructions first; apply these rules on top.
+- Reuse existing project patterns and libraries before introducing new abstractions.
+- If a rule must be bypassed intentionally, add a suppression comment with reason:
+  \`ai-guard-disable <rule-name> -- reason: <why>\`.
+- Before finalizing changes, run tests/lint and \`ai-guard run\` when available.`;
+}
+function workflowGuidanceCursor() {
+  return `## Workflow Guardrails
+
+- Follow user and repository instructions first.
+- Prefer existing project patterns and dependencies.
+- If bypassing a rule intentionally, add: ai-guard-disable <rule-name> -- reason: <why>.
+- Validate generated code with tests/lint and ai-guard run when available.`;
+}
+function workflowGuidanceCopilot() {
+  return `## Required Workflow
+
+- Follow user and repository instructions first.
+- Prefer edits that match existing architecture and dependencies.
+- If intentionally violating an ai-guard rule, add an inline suppression with a reason.
+- Run tests/lint and \`ai-guard run\` before finalizing changes when possible.`;
+}
+function generateClaudeFile(version, categories) {
+  return `<!-- DO NOT EDIT MANUALLY \u2014 generated by @undercurrentai/eslint-plugin-ai-guard -->
+<!-- Regenerate: npx ai-guard init-context --force -->
+
+# AI Guard Rules \u2014 Claude Code Instructions
+
+You are coding in a project that uses @undercurrentai/eslint-plugin-ai-guard.
+Avoid generating the following patterns. They will be flagged as lint errors.
+
+${workflowGuidanceMarkdown()}
+
+${getSections(categories)}
+
+---
+Generated by @undercurrentai/eslint-plugin-ai-guard v${version}.
+Run \`npx ai-guard init-context --force\` to regenerate.
+`;
+}
+function cursorErrorHandling() {
+  return `## Error Handling
+
+Rule: no-empty-catch
+Bad:  try { await fetchUser() } catch (e) {}
+Good: try { await fetchUser() } catch (e) { logger.error(e); throw e; }
+
+Rule: no-catch-log-rethrow
+Bad:  catch (e) { console.error(e); throw e; }
+Good: catch (e) { throw new Error('fetchUser failed', { cause: e }); }`;
+}
+function cursorAsyncSection() {
+  return `## Async Correctness
+
+Rule: no-async-array-callback
+Bad:  const results = ids.map(async (id) => await fetchUser(id));
+Good: const results = await Promise.all(ids.map((id) => fetchUser(id)));
+
+Rule: no-floating-promise
+Bad:  sendEmail(user);
+Good: await sendEmail(user);`;
+}
+function cursorSecuritySection() {
+  return `## Security
+
+Rule: no-hardcoded-secret
+Bad:  const apiKey = 'sk-prod-abc123';
+Good: const apiKey = process.env.API_KEY;
+
+Rule: no-sql-string-concat
+Bad:  db.query('SELECT * FROM users WHERE id = ' + req.params.id);
+Good: db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);
+
+Rule: no-eval-dynamic
+Bad:  eval(userInput);
+Good: Use a safe parser or allowlist approach instead.
+
+Rule: no-unsafe-deserialize
+Bad:  const data = JSON.parse(req.body);
+Good: const data = schema.parse(req.body);
+
+Rule: require-framework-auth
+Bad:  router.get('/admin/users', getUsers);
+Good: router.get('/admin/users', requireAuth, getUsers);
+
+Rule: require-framework-authz
+Bad:  const user = await db.findById(req.params.id); res.json(user);
+Good: const user = await db.findById(req.params.id); if (user.ownerId !== req.user.id) throw new ForbiddenError(); res.json(user);
+
+Rule: require-webhook-signature
+Bad:  app.post('/webhooks/stripe', async (req, res) => handleStripe(req.body));
+Good: app.post('/webhooks/stripe', express.raw({ type: 'application/json' }), verifyStripeSignature, handleStripe);`;
+}
+function cursorQualitySection() {
+  return `## Code Quality
+
+Rule: no-console-in-handler
+Bad:  router.get('/users', (req, res) => { console.log('hit'); ... });
+Good: router.get('/users', (req, res) => { logger.info('hit'); ... });
+
+Rule: no-duplicate-logic-block
+Bad:  Two identical consecutive code blocks copy-pasted.
+Good: Extract the duplicated logic into a shared helper function.`;
+}
+var CURSOR_SECTION_MAP = {
+  "error-handling": cursorErrorHandling,
+  async: cursorAsyncSection,
+  security: cursorSecuritySection,
+  quality: cursorQualitySection
+};
+function generateCursorFile(version, categories) {
+  const sections = categories.map((cat) => CURSOR_SECTION_MAP[cat]()).join("\n\n");
+  return `# AI Guard Rules \u2014 Cursor Instructions
+# DO NOT EDIT MANUALLY \u2014 generated by @undercurrentai/eslint-plugin-ai-guard
+# Regenerate: npx ai-guard init-context --force
+
+This project uses @undercurrentai/eslint-plugin-ai-guard to catch ${ACTIVE_RULE_COUNT} active
+AI-risk rules. Follow these rules when
+generating or editing code in this project. Violations will be flagged
+as lint errors.
+
+${workflowGuidanceCursor()}
+
+${sections}
+
+---
+These rules mirror @undercurrentai/eslint-plugin-ai-guard v${version}.
+Run \`npx ai-guard init-context --force\` to regenerate.
+`;
+}
+function copilotQuickRef(categories) {
+  const lines = [];
+  if (categories.includes("error-handling")) {
+    lines.push(
+      "Never: generate empty catch blocks",
+      "Never: catch, log, and rethrow without adding context"
+    );
+  }
+  if (categories.includes("async")) {
+    lines.push(
+      "Never: pass async callbacks to .map(), .filter(), .forEach()",
+      "Never: call async functions without await or .catch()"
+    );
+  }
+  if (categories.includes("security")) {
+    lines.push(
+      "Never: hardcode API keys, secrets, or passwords",
+      "Never: concatenate user input into SQL strings",
+      "Never: use eval() or new Function() with dynamic input",
+      "Never: JSON.parse() untrusted input without validation",
+      "Always: add auth middleware before route handlers",
+      "Always: verify resource ownership in handlers",
+      "Always: verify webhook signatures before trusting payloads"
+    );
+  }
+  if (categories.includes("quality")) {
+    lines.push(
+      "Never: leave console.log in route handlers",
+      "Never: copy-paste identical consecutive code blocks"
+    );
+  }
+  return lines.map((l) => `- ${l}`).join("\n");
+}
+function copilotDetails(categories) {
+  const details = [];
+  if (categories.includes("async")) {
+    details.push(`### no-floating-promise
+\`\`\`typescript
+// \u274C Bad \u2014 promise rejected silently
+sendEmail(user);
+
+// \u2705 Good
+await sendEmail(user);
+\`\`\``);
+    details.push(`### no-async-array-callback
+\`\`\`typescript
+// \u274C Bad \u2014 returns Promise[], not values
+ids.map(async (id) => await fetchUser(id));
+
+// \u2705 Good
+await Promise.all(ids.map((id) => fetchUser(id)));
+\`\`\``);
+  }
+  if (categories.includes("error-handling")) {
+    details.push(`### no-empty-catch
+\`\`\`typescript
+// \u274C Bad \u2014 error swallowed silently
+try { await fetchUser() } catch (e) {}
+
+// \u2705 Good
+try { await fetchUser() } catch (e) { logger.error(e); throw e; }
+\`\`\``);
+  }
+  if (categories.includes("security")) {
+    details.push(`### no-hardcoded-secret
+\`\`\`typescript
+// \u274C Bad
+const apiKey = 'sk-prod-abc123';
+
+// \u2705 Good
+const apiKey = process.env.API_KEY;
+\`\`\``);
+    details.push(`### no-sql-string-concat
+\`\`\`typescript
+// \u274C Bad \u2014 SQL injection
+db.query('SELECT * FROM users WHERE id = ' + req.params.id);
+
+// \u2705 Good
+db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);
+\`\`\``);
+  }
+  return details.join("\n\n");
+}
+function generateCopilotFile(version, categories) {
+  return `<!-- DO NOT EDIT MANUALLY \u2014 generated by @undercurrentai/eslint-plugin-ai-guard -->
+<!-- Regenerate: npx ai-guard init-context --force -->
+
+# AI Guard \u2014 GitHub Copilot Instructions
+
+This project uses \`@undercurrentai/eslint-plugin-ai-guard\`. Follow these rules to avoid
+generating patterns that will be flagged as lint errors.
+
+${workflowGuidanceCopilot()}
+
+## Quick Reference
+
+${copilotQuickRef(categories)}
+
+## Details
+
+${copilotDetails(categories)}
+
+---
+Generated by @undercurrentai/eslint-plugin-ai-guard v${version}.
+Run \`npx ai-guard init-context --force\` to regenerate.
+`;
+}
+var AGENTS = [
+  {
+    id: "claude",
+    label: "Claude Code",
+    filePath: "CLAUDE.md",
+    generate: generateClaudeFile
+  },
+  {
+    id: "cursor",
+    label: "Cursor",
+    filePath: ".cursorrules",
+    generate: generateCursorFile
+  },
+  {
+    id: "copilot",
+    label: "GitHub Copilot",
+    filePath: import_path9.default.join(".github", "copilot-instructions.md"),
+    generate: generateCopilotFile
+  }
+];
+function getPackageVersion2(cwd) {
+  try {
+    const pkgPath = import_path9.default.join(cwd, "node_modules", "@undercurrentai/eslint-plugin-ai-guard", "package.json");
+    if (import_fs6.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs6.default.readFileSync(pkgPath, "utf-8"));
+      if (pkg.version) return pkg.version;
+    }
+  } catch {
+  }
+  try {
+    const pkgPath = import_path9.default.join(cwd, "package.json");
+    if (import_fs6.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs6.default.readFileSync(pkgPath, "utf-8"));
+      if (pkg.version) return pkg.version;
+    }
+  } catch {
+  }
+  return "0.0.0";
+}
+function parseCategories(raw) {
+  if (!raw) return ALL_CATEGORIES;
+  const parts = raw.split(",").map((s) => s.trim().toLowerCase());
+  const valid = [];
+  for (const part of parts) {
+    if (part in RULE_CATEGORIES) {
+      valid.push(part);
+    }
+  }
+  return valid.length > 0 ? valid : ALL_CATEGORIES;
+}
+function registerInitContextCommand(program2) {
+  program2.command("init-context").description(
+    `Generate AI agent instruction files (CLAUDE.md, .cursorrules, copilot-instructions.md)
+so Claude Code, Cursor, and GitHub Copilot align with ${ACTIVE_RULE_COUNT} active ai-guard rules.`
+  ).option("-a, --all", "Generate files for all agents (skip prompt)").option("--force", "Overwrite existing files without asking").option("--dry-run", "Print what would be generated without writing files").option("--rules <categories>", "Comma-separated categories: async,security,error-handling,quality").action(async (opts) => {
+    const cwd = process.cwd();
+    const version = getPackageVersion2(cwd);
+    const categories = parseCategories(opts.rules);
+    const isDryRun = opts.dryRun === true;
+    const isForce = opts.force === true;
+    log.banner("AI GUARD INIT-CONTEXT");
+    if (isDryRun) {
+      log.print(`  ${import_chalk8.default.yellow("\u2691  DRY RUN \u2014 no files will be written")}`);
+      log.blank();
+    }
+    let selectedAgents;
+    if (opts.all) {
+      selectedAgents = [...AGENTS];
+    } else {
+      let selected;
+      try {
+        selected = await (0, import_prompts2.checkbox)({
+          message: "Which AI agents do you use?",
+          choices: [
+            { name: "Claude Code -> writes CLAUDE.md", value: "claude" },
+            { name: "Cursor -> writes .cursorrules", value: "cursor" },
+            { name: "GitHub Copilot -> writes .github/copilot-instructions.md", value: "copilot" },
+            { name: "All three (recommended) -> writes all files", value: "all" }
+          ],
+          required: true
+        });
+      } catch {
+        log.info("Selection cancelled. Nothing to do.");
+        return;
+      }
+      if (selected.length === 0) {
+        log.info("No valid agents selected. Use --all to generate all files.");
+        return;
+      }
+      if (selected.includes("all")) {
+        selectedAgents = [...AGENTS];
+      } else {
+        selectedAgents = AGENTS.filter((a) => selected.includes(a.id));
+      }
+    }
+    log.info(`Categories: ${import_chalk8.default.cyan(categories.join(", "))}`);
+    log.info(`Version: ${import_chalk8.default.cyan(version)}`);
+    log.blank();
+    const results = [];
+    for (const agent of selectedAgents) {
+      const fullPath = import_path9.default.join(cwd, agent.filePath);
+      const exists = import_fs6.default.existsSync(fullPath);
+      if (exists && !isForce && !isDryRun) {
+        const overwrite = await (0, import_prompts2.confirm)({
+          message: `${agent.filePath} already exists. Overwrite?`,
+          default: false
+        });
+        if (!overwrite) {
+          results.push({ file: agent.filePath, status: "skipped" });
+          continue;
+        }
+      }
+      const content = agent.generate(version, categories);
+      if (isDryRun) {
+        log.section(`Preview: ${agent.filePath}`);
+        log.print(import_chalk8.default.gray("\u2500".repeat(60)));
+        for (const line of content.split("\n").slice(0, 20)) {
+          log.print(import_chalk8.default.gray(`  ${line}`));
+        }
+        log.print(import_chalk8.default.gray("  ... (truncated)"));
+        log.print(import_chalk8.default.gray("\u2500".repeat(60)));
+        log.blank();
+        results.push({ file: agent.filePath, status: "dry-run" });
+        continue;
+      }
+      const parentDir = import_path9.default.dirname(fullPath);
+      if (!import_fs6.default.existsSync(parentDir)) {
+        import_fs6.default.mkdirSync(parentDir, { recursive: true });
+      }
+      import_fs6.default.writeFileSync(fullPath, content, "utf-8");
+      results.push({ file: agent.filePath, status: "created" });
+    }
+    log.section("Summary");
+    for (const result of results) {
+      switch (result.status) {
+        case "created":
+          log.print(`  ${import_chalk8.default.green("\u2705")} Created ${import_chalk8.default.white(result.file)}`);
+          break;
+        case "skipped":
+          log.print(`  ${import_chalk8.default.yellow("\u23ED")}  Skipped ${import_chalk8.default.white(result.file)} ${import_chalk8.default.gray("(already exists \u2014 use --force to overwrite)")}`);
+          break;
+        case "dry-run":
+          log.print(`  ${import_chalk8.default.cyan("\u{1F4DD}")} Would create ${import_chalk8.default.white(result.file)}`);
+          break;
+      }
+    }
+    log.blank();
+    if (isDryRun) {
+      log.info("Dry run complete \u2014 no files were written.");
+      log.info(`Re-run without ${import_chalk8.default.cyan("--dry-run")} to apply.`);
+    } else {
+      const createdCount = results.filter((r) => r.status === "created").length;
+      if (createdCount > 0) {
+        log.success(
+          `Done. Your AI agents will now avoid ${ACTIVE_RULE_COUNT} active ai-guard rules.`
+        );
+      }
+    }
+    log.blank();
+  });
+}
+
+// cli/index.ts
+function getVersion() {
+  try {
+    const pkgPath = import_path10.default.resolve(__dirname, "../../package.json");
+    const raw = import_fs7.default.readFileSync(pkgPath, "utf-8");
+    const pkg = JSON.parse(raw);
+    return typeof pkg.version === "string" ? pkg.version : "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+var program = new import_commander.Command();
+program.name("ai-guard").description(
+  "Production-grade CLI for @undercurrentai/eslint-plugin-ai-guard\nCatch AI-generated code issues instantly \u2014 no ESLint config required.\n\nQuick start:\n  npx ai-guard run          Scan current project\n  npx ai-guard init         Auto-configure ESLint\n  npx ai-guard init-context Generate AI agent rules\n  npx ai-guard doctor       Check your setup\n  npx ai-guard baseline     Save baseline, track new issues only"
+).version(getVersion(), "-v, --version", "Print version number").helpOption("-h, --help", "Show help");
+registerRunCommand(program);
+registerInitCommand(program);
+registerDoctorCommand(program);
+registerPresetCommand(program);
+registerIgnoreCommand(program);
+registerBaselineCommand(program);
+registerInitContextCommand(program);
+program.configureOutput({
+  writeErr(str) {
+    const cleaned = str.replace(/^error:\s*/i, "").trim();
+    log.error(cleaned);
+  }
+});
+process.on("unhandledRejection", (reason) => {
+  const msg = reason instanceof Error ? reason.message : String(reason);
+  log.error(`Unexpected error: ${msg}`);
+  log.info("If this looks like a bug, please report it at:");
+  log.info("  https://github.com/undercurrentai/eslint-plugin-ai-guard/issues");
+  process.exit(1);
+});
+process.on("SIGINT", () => {
+  log.blank();
+  log.info("Cancelled.");
+  process.exit(130);
+});
+program.parseAsync(process.argv).catch((err) => {
+  const msg = err instanceof Error ? err.message : String(err);
+  log.error(msg);
+  process.exit(1);
+});
+//# sourceMappingURL=index.js.map