@wispbit/local 1.0.25 → 1.0.27

package/dist/cli.js

@@ -10,6 +10,340 @@ import dotenv from "dotenv";
 import meow from "meow";
 import semver from "semver";
 
+// src/api/WispbitApiClient.ts
+import pRetry from "p-retry";
+import { z as z2 } from "zod";
+
+// src/validationSchemas.ts
+import { z } from "zod";
+
+// src/languages.ts
+import { existsSync } from "fs";
+import { createRequire } from "module";
+import path from "path";
+import angular from "@ast-grep/lang-angular";
+import bash from "@ast-grep/lang-bash";
+import c from "@ast-grep/lang-c";
+import cpp from "@ast-grep/lang-cpp";
+import csharp from "@ast-grep/lang-csharp";
+import css from "@ast-grep/lang-css";
+import dart from "@ast-grep/lang-dart";
+import elixir from "@ast-grep/lang-elixir";
+import go from "@ast-grep/lang-go";
+import haskell from "@ast-grep/lang-haskell";
+import html from "@ast-grep/lang-html";
+import java from "@ast-grep/lang-java";
+import javascript from "@ast-grep/lang-javascript";
+import json from "@ast-grep/lang-json";
+import kotlin from "@ast-grep/lang-kotlin";
+import lua from "@ast-grep/lang-lua";
+import markdown from "@ast-grep/lang-markdown";
+import php from "@ast-grep/lang-php";
+import python from "@ast-grep/lang-python";
+import ruby from "@ast-grep/lang-ruby";
+import rust from "@ast-grep/lang-rust";
+import scala from "@ast-grep/lang-scala";
+import sql from "@ast-grep/lang-sql";
+import swift from "@ast-grep/lang-swift";
+import toml from "@ast-grep/lang-toml";
+import tsx from "@ast-grep/lang-tsx";
+import typescript from "@ast-grep/lang-typescript";
+import yaml from "@ast-grep/lang-yaml";
+import { registerDynamicLanguage } from "@ast-grep/napi";
+console.debug = () => {
+};
+var Language = /* @__PURE__ */ ((Language2) => {
+  Language2["Angular"] = "Angular";
+  Language2["Bash"] = "Bash";
+  Language2["C"] = "C";
+  Language2["Cpp"] = "Cpp";
+  Language2["Csharp"] = "Csharp";
+  Language2["Css"] = "Css";
+  Language2["Dart"] = "Dart";
+  Language2["Elixir"] = "Elixir";
+  Language2["Go"] = "Go";
+  Language2["Haskell"] = "Haskell";
+  Language2["Html"] = "Html";
+  Language2["Java"] = "Java";
+  Language2["JavaScript"] = "JavaScript";
+  Language2["Json"] = "Json";
+  Language2["Kotlin"] = "Kotlin";
+  Language2["Lua"] = "Lua";
+  Language2["Markdown"] = "Markdown";
+  Language2["Php"] = "Php";
+  Language2["Python"] = "Python";
+  Language2["Ruby"] = "Ruby";
+  Language2["Rust"] = "Rust";
+  Language2["Scala"] = "Scala";
+  Language2["Sql"] = "Sql";
+  Language2["Swift"] = "Swift";
+  Language2["Toml"] = "Toml";
+  Language2["Tsx"] = "Tsx";
+  Language2["TypeScript"] = "TypeScript";
+  Language2["Yaml"] = "Yaml";
+  Language2["GraphQL"] = "GraphQL";
+  Language2["Unknown"] = "Unknown";
+  return Language2;
+})(Language || {});
+var require2 = createRequire(import.meta.url ? import.meta.url : __filename);
+function getGraphQLLibPath() {
+  const graphqlDir = path.dirname(require2.resolve("tree-sitter-graphql"));
+  const releaseNode = path.join(graphqlDir, "../../build/Release/tree_sitter_graphql_binding.node");
+  if (existsSync(releaseNode)) {
+    return releaseNode;
+  }
+  const debugNode = path.join(graphqlDir, "../../build/Debug/tree_sitter_graphql_binding.node");
+  if (existsSync(debugNode)) {
+    return debugNode;
+  }
+  const soFile = path.join(graphqlDir, "parser.so");
+  if (existsSync(soFile)) {
+    return soFile;
+  }
+  return null;
+}
+var graphqlPath = getGraphQLLibPath();
+var graphql = {
+  // node-gyp-build puts the .node file in build/Release/
+  libraryPath: graphqlPath,
+  /** the file extensions of the language. e.g. mojo */
+  extensions: ["graphql"],
+  /** the dylib symbol to load ts-language, default is `tree_sitter_{name}` */
+  languageSymbol: "tree_sitter_graphql",
+  /** the meta variable leading character, default is $ */
+  metaVarChar: "$",
+  /**
+   * An optional char to replace $ in your pattern.
+   * See https://ast-grep.github.io/advanced/custom-language.html#register-language-in-sgconfig-yml
+   */
+  expandoChar: void 0
+};
+var registeredLanguages = {
+  ["Angular" /* Angular */]: angular,
+  ["Bash" /* Bash */]: bash,
+  ["C" /* C */]: c,
+  ["Cpp" /* Cpp */]: cpp,
+  ["Csharp" /* Csharp */]: csharp,
+  ["Css" /* Css */]: css,
+  ["Dart" /* Dart */]: dart,
+  ["Elixir" /* Elixir */]: elixir,
+  ["Go" /* Go */]: go,
+  ["Haskell" /* Haskell */]: haskell,
+  ["Html" /* Html */]: html,
+  ["Java" /* Java */]: java,
+  ["JavaScript" /* JavaScript */]: javascript,
+  ["Json" /* Json */]: json,
+  ["Kotlin" /* Kotlin */]: kotlin,
+  ["Lua" /* Lua */]: lua,
+  ["Markdown" /* Markdown */]: markdown,
+  ["Php" /* Php */]: php,
+  ["Python" /* Python */]: python,
+  ["Ruby" /* Ruby */]: ruby,
+  ["Rust" /* Rust */]: rust,
+  ["Scala" /* Scala */]: scala,
+  ["Sql" /* Sql */]: sql,
+  ["Swift" /* Swift */]: swift,
+  ["Toml" /* Toml */]: toml,
+  ["Tsx" /* Tsx */]: tsx,
+  ["TypeScript" /* TypeScript */]: typescript,
+  ["Yaml" /* Yaml */]: yaml,
+  ...graphqlPath ? { ["GraphQL" /* GraphQL */]: graphql } : {}
+};
+registerDynamicLanguage(registeredLanguages);
+var REGISTERED_LANGUAGE_EXTENSIONS = Object.entries(
+  registeredLanguages
+).reduce(
+  (acc, [language, registration]) => {
+    acc[language] = registration.extensions ?? [];
+    return acc;
+  },
+  {}
+);
+function getLanguageFromFilePath(filePath) {
+  const extension = path.extname(filePath).slice(1);
+  const language = findRegisteredLanguageFromExtension(extension);
+  return language ?? "Unknown" /* Unknown */;
+}
+function findRegisteredLanguageFromExtension(extension) {
+  return Object.keys(REGISTERED_LANGUAGE_EXTENSIONS).find(
+    (language) => REGISTERED_LANGUAGE_EXTENSIONS[language].includes(extension)
+  );
+}
+
+// src/validationSchemas.ts
+var MatchRangeSchema = z.object({
+  start: z.object({
+    line: z.number().describe("0-based line number"),
+    column: z.number().describe("0-based column number")
+  }),
+  end: z.object({
+    line: z.number().describe("0-based line number"),
+    column: z.number().describe("0-based column number")
+  })
+});
+var MatchSourceSchema = z.lazy(
+  () => z.object({
+    filePath: z.string().describe("File path where this source match occurred"),
+    text: z.string().optional().describe("The matched text at this source step"),
+    range: MatchRangeSchema.describe("Position range of this source match"),
+    symbol: z.string().optional().describe("Optional symbol name if applicable"),
+    language: z.nativeEnum(Language).describe(
+      "The language this source match was found in (e.g., Language.TypeScript, Language.Python)"
+    )
+  })
+);
+var MatchMetadataSchema = z.object({
+  fromCache: z.boolean().optional().describe("Whether this match was retrieved from cache"),
+  llmValidation: z.object({
+    isViolation: z.boolean().describe("Whether the LLM determined this is a violation"),
+    confidence: z.number().min(0).max(1).describe("Confidence score (0-1) of the validation"),
+    reason: z.string().describe("Explanation of the validation decision")
+  }).optional().describe("LLM validation metadata if applicable")
+}).optional().describe("Metadata about the match and its processing");
+var MatchSchema = z.object({
+  filePath: z.string().describe("File path where the match was found"),
+  text: z.string().optional().describe("The matched text/code snippet"),
+  range: MatchRangeSchema.describe("Position range of the match"),
+  symbol: z.string().optional().describe("Optional symbol name if applicable"),
+  language: z.nativeEnum(Language).describe("The language this match was found in (e.g., Language.TypeScript, Language.Python)"),
+  source: z.array(MatchSourceSchema).optional().describe(
+    "Chain of sources that led to this match. First entry is the original source, last entry is the immediate parent."
+  ),
+  metadata: MatchMetadataSchema
+});
+var ValidateViolationResponseSchema = z.object({
+  validMatches: z.array(MatchSchema).describe("Matches that are valid violations"),
+  skippedMatches: z.array(MatchSchema).describe("Matches that are not violations")
+});
+
+// src/api/WispbitApiClient.ts
+var InitializeRequestSchema = z2.object({
+  repository_url: z2.string(),
+  powerlint_version: z2.string(),
+  schema_version: z2.string()
+});
+var InitializeResponseSchema = z2.object({
+  configured: z2.boolean(),
+  invalid_api_key: z2.boolean().optional(),
+  is_valid_repository: z2.boolean().optional(),
+  config: z2.object({
+    ignored_globs: z2.array(z2.string())
+  }).optional()
+});
+var GetRulesRequestSchema = z2.object({
+  repository_url: z2.string(),
+  rule_ids: z2.array(z2.string()).optional(),
+  schema_version: z2.string(),
+  powerlint_version: z2.string()
+});
+var GetRulesResponseSchema = z2.object({
+  rules: z2.array(
+    z2.object({
+      id: z2.string(),
+      internalId: z2.string(),
+      internalVersionId: z2.string(),
+      message: z2.string(),
+      prompt: z2.string(),
+      severity: z2.enum(["suggestion", "violation"]),
+      schema: z2.any()
+    })
+  )
+});
+var ValidateViolationRequestSchema = z2.object({
+  rule: z2.object({
+    internalId: z2.string(),
+    internalVersionId: z2.string(),
+    contents: z2.string()
+  }),
+  matches: z2.array(z2.any()),
+  powerlint_version: z2.string(),
+  schema_version: z2.string()
+});
+var WispbitApiClient = class {
+  baseUrl;
+  apiKey;
+  constructor(config) {
+    this.baseUrl = config.baseUrl;
+    this.apiKey = config.apiKey;
+  }
+  /**
+   * Make a request to the Wispbit API with retry logic
+   */
+  async request(endpoint, data, responseSchema) {
+    const url = `${this.baseUrl}${endpoint}`;
+    const response = await pRetry(
+      async () => {
+        const res = await fetch(url, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${this.apiKey}`
+          },
+          body: JSON.stringify(data)
+        });
+        if (!res.ok) {
+          const errorText = await res.text();
+          throw new Error(
+            `Wispbit API request failed: ${res.status} ${res.statusText} - ${errorText}`
+          );
+        }
+        return res;
+      },
+      {
+        retries: 3,
+        minTimeout: 1e3,
+        maxTimeout: 5e3,
+        onFailedAttempt: (error) => {
+          console.warn(
+            `API request to ${endpoint} failed (attempt ${error.attemptNumber}/4): ${error.message}`
+          );
+        }
+      }
+    );
+    const json2 = await response.json();
+    if (responseSchema) {
+      return responseSchema.parse(json2);
+    }
+    return json2;
+  }
+  /**
+   * Initialize PowerLint configuration with Wispbit
+   */
+  async initialize(request) {
+    const validatedRequest = InitializeRequestSchema.parse(request);
+    return await this.request("/plv1/initialize", validatedRequest, InitializeResponseSchema);
+  }
+  /**
+   * Get rules from Wispbit Cloud
+   */
+  async getRules(request) {
+    const validatedRequest = GetRulesRequestSchema.parse(request);
+    return await this.request("/plv1/get-rules", validatedRequest, GetRulesResponseSchema);
+  }
+  /**
+   * Validate violations with Wispbit
+   */
+  async validateViolation(request) {
+    const validatedRequest = ValidateViolationRequestSchema.parse(request);
+    return await this.request(
+      "/plv1/validate-violation",
+      validatedRequest,
+      ValidateViolationResponseSchema
+    );
+  }
+  /**
+   * Validate violations with Wispbit (internal endpoint for testing)
+   */
+  async validateViolationInternal(request) {
+    const validatedRequest = ValidateViolationRequestSchema.parse(request);
+    return await this.request(
+      "/plv1/internal/validate-violation",
+      validatedRequest,
+      ValidateViolationResponseSchema
+    );
+  }
+};
+
 // src/version.ts
 import { readFileSync } from "fs";
 import { dirname, join } from "path";
@@ -41,13 +375,22 @@ var Config = class _Config {
   config;
   apiKey = null;
   baseUrl = null;
-  constructor(config) {
+  apiClient = null;
+  useInternalEndpoint = false;
+  constructor(config, options) {
     this.config = {
       ...config,
       ignoredGlobs: config.ignoredGlobs || []
     };
     this.apiKey = config.apiKey || null;
     this.baseUrl = config.baseUrl || null;
+    this.useInternalEndpoint = (options == null ? void 0 : options.useInternalEndpoint) ?? false;
+    if (this.apiKey && this.baseUrl) {
+      this.apiClient = new WispbitApiClient({
+        baseUrl: this.baseUrl,
+        apiKey: this.apiKey
+      });
+    }
   }
   getIgnoredGlobs() {
     return this.config.ignoredGlobs || [];
@@ -66,6 +409,16 @@ var Config = class _Config {
   getBaseUrl() {
     return this.baseUrl;
   }
+  /**
+   * Get the Wispbit API client
+   * @returns The API client instance
+   */
+  getApiClient() {
+    if (!this.apiClient) {
+      throw new Error("API client not initialized. Config must have both apiKey and baseUrl.");
+    }
+    return this.apiClient;
+  }
   /**
    * Get the local PowerLint version
    * @returns The current PowerLint version
@@ -80,24 +433,6 @@ var Config = class _Config {
   getSchemaVersion() {
     return "v1";
   }
-  /**
-   * Validate API key with Wispbit API
-   */
-  static async validateApiKey(apiKey, repositoryUrl, baseUrl) {
-    const response = await fetch(`${baseUrl}/plv1/initialize`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${apiKey}`
-      },
-      body: JSON.stringify({
-        repository_url: repositoryUrl,
-        powerlint_version: getCurrentVersion(),
-        schema_version: "v1"
-      })
-    });
-    return response.ok;
-  }
   /**
    * Initialize configuration without network validation (for testing)
    * @param options Optional configuration options
@@ -107,11 +442,16 @@ var Config = class _Config {
     const finalBaseUrl = options.baseUrl || process.env.WISPBIT_API_BASE_URL || "https://api.wispbit.com";
     const finalApiKey = options.apiKey || process.env.WISPBIT_API_KEY || null;
     const ignoredGlobs = options.ignoredGlobs || [];
-    return new _Config({
-      ignoredGlobs,
-      apiKey: finalApiKey || void 0,
-      baseUrl: finalBaseUrl
-    });
+    return new _Config(
+      {
+        ignoredGlobs,
+        apiKey: finalApiKey || void 0,
+        baseUrl: finalBaseUrl
+      },
+      {
+        useInternalEndpoint: true
+      }
+    );
   }
   /**
    * Initialize configuration by validating API key and repository URL with Wispbit
@@ -131,23 +471,15 @@ var Config = class _Config {
       return { failed: true, error: "INVALID_API_KEY" };
     }
     const repositoryUrl = await environment.getRepositoryUrl();
-    const isValidApiKey = await _Config.validateApiKey(finalApiKey, repositoryUrl, finalBaseUrl);
-    if (!isValidApiKey) {
-      return { failed: true, error: "INVALID_API_KEY" };
-    }
-    const response = await fetch(`${finalBaseUrl}/plv1/initialize`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${finalApiKey}`
-      },
-      body: JSON.stringify({
-        repository_url: repositoryUrl,
-        powerlint_version: getCurrentVersion(),
-        schema_version: "v1"
-      })
+    const tempClient = new WispbitApiClient({
+      baseUrl: finalBaseUrl,
+      apiKey: finalApiKey
+    });
+    const result = await tempClient.initialize({
+      repository_url: repositoryUrl,
+      powerlint_version: getCurrentVersion(),
+      schema_version: "v1"
     });
-    const result = await response.json();
     if (result.invalid_api_key) {
       return { failed: true, error: "INVALID_API_KEY" };
     }
@@ -164,10 +496,17 @@ var Config = class _Config {
   isConfigured() {
     return this.getApiKey() !== null;
   }
+  /**
+   * Check if the internal validation endpoint should be used
+   */
+  shouldUseInternalEndpoint() {
+    return this.useInternalEndpoint;
+  }
 };
 
 // src/utils/git.ts
 import { exec, execSync } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { promisify } from "util";
 
 // src/utils/hashString.ts
@@ -182,189 +521,498 @@ function findGitRoot() {
   const stdout = execSync("git rev-parse --show-toplevel", { encoding: "utf-8" });
   return stdout.trim();
 }
+async function getGitIgnoredFiles(repoRoot) {
+  const { stdout } = await execPromise("git ls-files --ignored --exclude-standard --others", {
+    cwd: repoRoot,
+    maxBuffer: 50 * 1024 * 1024
+  });
+  return stdout.split("\n").filter(Boolean).map((file) => file.trim());
+}
 async function getRepositoryUrl(repoRoot, remoteName = "origin") {
-  var _a;
-  const { stdout } = await execPromise(`git remote show ${remoteName}`, {
+  const { stdout } = await execPromise(`git config --get remote.${remoteName}.url`, {
     cwd: repoRoot
   });
-  const fetchUrlLine = stdout.split("\n").find((line) => line.includes("Fetch URL:"));
-  if (fetchUrlLine) {
-    return ((_a = fetchUrlLine.split("Fetch URL:").pop()) == null ? void 0 : _a.trim()) || null;
-  }
-  return null;
+  return stdout.trim() || null;
 }
 async function getDefaultBranch(repoRoot, remoteName = "origin") {
-  var _a;
-  const { stdout } = await execPromise(`git remote show ${remoteName}`, {
+  try {
+    const { stdout } = await execPromise(`git rev-parse --abbrev-ref ${remoteName}/HEAD`, {
+      cwd: repoRoot
+    });
+    const fullRef = stdout.trim();
+    const branchName = fullRef.split("/").pop();
+    return branchName || null;
+  } catch (error) {
+    const commonBranches = ["main", "master"];
+    for (const branch of commonBranches) {
+      try {
+        await execPromise(`git rev-parse --verify ${branch}`, { cwd: repoRoot });
+        return branch;
+      } catch {
+      }
+    }
+    return null;
+  }
+}
+async function tryGetUpstream(repoRoot) {
+  const { stdout } = await execPromise(`git rev-parse --abbrev-ref --symbolic-full-name @{u}`, {
+    cwd: repoRoot
+  });
+  return stdout.trim() || void 0;
+}
+function tryGetGraphiteParent(repoRoot, branch) {
+  const metadataPath = `.git/refs/branch-metadata/${branch}`;
+  const fullPath = `${repoRoot}/${metadataPath}`;
+  if (!existsSync2(fullPath)) {
+    return void 0;
+  }
+  const content = readFileSync2(fullPath, "utf-8");
+  const match = content.match(/"parent"\s*:\s*"([^"]+)"/);
+  return match == null ? void 0 : match[1];
+}
+function shellQuote(path11) {
+  return `'${path11.replace(/'/g, "'\\''")}'`;
+}
+function joinAsShellArgs(paths) {
+  return paths.map(shellQuote).join(" ");
+}
+function resolveIncludes(raw) {
+  const all = {
+    committed: true,
+    staged: true,
+    unstaged: true,
+    untracked: true
+  };
+  if (!raw || raw.length === 0) return all;
+  const s = new Set(raw);
+  return {
+    committed: s.has("committed"),
+    staged: s.has("staged"),
+    unstaged: s.has("unstaged"),
+    untracked: s.has("untracked")
+  };
+}
+function parseNameStatusZ(buffer, source) {
+  if (!buffer) return [];
+  const entries = [];
+  const parts = buffer.split("\0").filter(Boolean);
+  for (let i = 0; i < parts.length; ) {
+    const status = parts[i];
+    if (!status) break;
+    if (status.startsWith("R")) {
+      const oldPath = parts[i + 1];
+      const newPath = parts[i + 2];
+      if (oldPath && newPath) {
+        entries.push({ status, path: newPath, oldPath, source });
+        i += 3;
+      } else {
+        i++;
+      }
+    } else {
+      const path11 = parts[i + 1];
+      if (path11) {
+        entries.push({ status, path: path11, source });
+        i += 2;
+      } else {
+        i++;
+      }
+    }
+  }
+  return entries;
+}
+function parseLsFilesZ(buffer) {
+  if (!buffer) return [];
+  return buffer.split("\0").filter(Boolean).map((path11) => ({ status: "U", path: path11, source: "untracked" }));
+}
+function dedupeEntries(entries) {
+  const byPath = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const existing = byPath.get(entry.path);
+    if (!existing) {
+      byPath.set(entry.path, entry);
+    } else {
+      const existingPriority = getPriority(existing.source);
+      const newPriority = getPriority(entry.source);
+      if (newPriority > existingPriority) {
+        byPath.set(entry.path, entry);
+      } else if (newPriority === existingPriority && entry.oldPath) {
+        existing.oldPath = existing.oldPath || entry.oldPath;
+      }
+    }
+  }
+  return Array.from(byPath.values());
+}
+function getPriority(source) {
+  switch (source) {
+    case "untracked":
+      return 4;
+    case "unstaged":
+      return 3;
+    case "staged":
+      return 2;
+    case "committed":
+      return 1;
+  }
+}
+function splitGitPatchPerFile(patchOutput) {
+  const patches = /* @__PURE__ */ new Map();
+  if (!patchOutput) return patches;
+  const sections = patchOutput.split(/^diff --git /m).filter(Boolean);
+  for (const section of sections) {
+    const lines = section.split("\n");
+    const firstLine = lines[0];
+    const match = firstLine.match(/a\/(.+?) b\//);
+    if (match) {
+      const filename = match[1];
+      patches.set(filename, "diff --git " + section);
+    }
+  }
+  return patches;
+}
+function toChangeStatus(entry) {
+  if (entry.status === "U" || entry.status === "A") return "added";
+  if (entry.status === "D") return "removed";
+  return "modified";
+}
+function stripDiffHeaders(patch) {
+  if (!patch) return "";
+  const lines = patch.split("\n");
+  const output = [];
+  let inHunk = false;
+  for (const line of lines) {
+    if (line.startsWith("diff --git") || line.startsWith("index ") || line.startsWith("--- ") || line.startsWith("+++ ") || line.startsWith("new file mode") || line.startsWith("deleted file mode") || line.startsWith("old mode") || line.startsWith("new mode") || line.startsWith("similarity index") || line.startsWith("rename from") || line.startsWith("rename to") || line.startsWith("copy from") || line.startsWith("copy to") || line === "\") {
+      continue;
+    }
+    if (line.startsWith("@@")) {
+      inHunk = true;
+    }
+    if (inHunk) {
+      output.push(line);
+    }
+  }
+  return output.join("\n").trimEnd();
+}
+function parseRange(selector) {
+  const threeDotsMatch = selector.match(/^(.+)\.\.\.(.+)$/);
+  if (threeDotsMatch) {
+    return [threeDotsMatch[1], threeDotsMatch[2], true];
+  }
+  const twoDotsMatch = selector.match(/^(.+)\.\.([^.].*)$/);
+  if (twoDotsMatch) {
+    return [twoDotsMatch[1], twoDotsMatch[2], false];
+  }
+  return [selector, selector, false];
+}
+function parseRangeRight(selector) {
+  const [, right] = parseRange(selector);
+  return right;
+}
+async function getCurrentBranch(repoRoot) {
+  const { stdout } = await execPromise("git rev-parse --abbrev-ref HEAD", {
     cwd: repoRoot
   });
-  const headBranchLine = stdout.split("\n").find((line) => line.includes("HEAD branch"));
-  if (headBranchLine) {
-    return ((_a = headBranchLine.split(":").pop()) == null ? void 0 : _a.trim()) || null;
+  return stdout.trim();
+}
+function validateWorktreeIncludes(commitSelector, includes, currentBranch) {
+  const isRange = commitSelector.includes("..");
+  if (!isRange) {
+    return null;
+  }
+  const hasWorktreeIncludes = includes.includes("staged") || includes.includes("unstaged") || includes.includes("untracked");
+  if (!hasWorktreeIncludes) {
+    return null;
+  }
+  const rangeRight = parseRangeRight(commitSelector);
+  const endsAtCurrent = rangeRight === "HEAD" || rangeRight === currentBranch;
+  if (!endsAtCurrent) {
+    return `Worktree includes (staged, unstaged, untracked) require range to end at HEAD or current branch (${currentBranch}). Got: ${commitSelector}`;
   }
   return null;
 }
-async function getChangedFiles(repoRoot, base) {
-  var _a, _b;
+async function getDefaultCommitSelector(repoRoot) {
   const { stdout: currentBranchOutput } = await execPromise("git rev-parse --abbrev-ref HEAD", {
     cwd: repoRoot
   });
   const currentBranch = currentBranchOutput.trim();
+  const defaultInclude = ["committed", "staged", "unstaged", "untracked"];
+  const graphiteParent = tryGetGraphiteParent(repoRoot, currentBranch);
+  if (graphiteParent) {
+    return {
+      commitSelector: `${graphiteParent}...${currentBranch}`,
+      include: defaultInclude
+    };
+  }
   const defaultBranch = await getDefaultBranch(repoRoot);
-  const compareTo = base ?? (defaultBranch ? `origin/${defaultBranch}` : "HEAD^");
-  let currentCommit;
-  try {
-    const { stdout: remoteCommitOutput } = await execPromise(
-      `git rev-parse origin/${currentBranch}`,
-      { cwd: repoRoot }
-    );
-    currentCommit = remoteCommitOutput.trim();
-  } catch (error) {
-    const { stdout: currentCommitOutput } = await execPromise("git rev-parse HEAD", {
+  if (defaultBranch) {
+    if (currentBranch === defaultBranch) {
+      const upstream = await tryGetUpstream(repoRoot).catch(() => void 0);
+      if (upstream) {
+        return {
+          commitSelector: `${upstream}...HEAD`,
+          include: defaultInclude
+        };
+      }
+      return {
+        commitSelector: `HEAD~1...HEAD`,
+        include: defaultInclude
+      };
+    }
+    const originBranch = `origin/${defaultBranch}`;
+    const { stdout } = await execPromise(`git rev-parse --verify ${originBranch}`, {
       cwd: repoRoot
     });
-    currentCommit = currentCommitOutput.trim();
-  }
-  let mergeBase;
-  try {
-    const { stdout: mergeBaseOutput } = await execPromise(
-      `git merge-base ${currentBranch} ${compareTo}`,
-      { cwd: repoRoot }
-    );
-    mergeBase = mergeBaseOutput.trim();
-  } catch (error) {
-    mergeBase = "HEAD^";
+    const base = stdout.trim() ? originBranch : defaultBranch;
+    return {
+      commitSelector: `${base}...${currentBranch}`,
+      include: defaultInclude
+    };
   }
-  const { stdout: statusOutput } = await execPromise("git status --porcelain", {
-    cwd: repoRoot
-  });
-  const statusLines = statusOutput.split("\n").filter(Boolean);
-  const fileStatuses = /* @__PURE__ */ new Map();
-  statusLines.forEach((line) => {
-    const statusCode = line.substring(0, 2).trim();
-    const filename = line.substring(3);
-    fileStatuses.set(filename, statusCode);
-  });
-  const { stdout: diffOutput } = await execPromise(`git diff ${mergeBase} --name-only`, {
+  return {
+    commitSelector: `HEAD...HEAD`,
+    include: defaultInclude
+  };
+}
+async function getChangedFiles(repoRoot, options) {
+  const selector = options.commitSelector.trim();
+  const isRange = selector.includes("..");
+  const { stdout: currentBranchOutput } = await execPromise("git rev-parse --abbrev-ref HEAD", {
     cwd: repoRoot
   });
-  const allFiles = diffOutput.split("\n").filter(Boolean);
-  const { stdout: deletedFilesOutput } = await execPromise("git ls-files --deleted", {
+  const currentBranch = currentBranchOutput.trim();
+  const { stdout: currentCommitOutput } = await execPromise("git rev-parse HEAD", {
     cwd: repoRoot
   });
-  const deletedFiles = deletedFilesOutput.split("\n").filter(Boolean);
-  allFiles.push(...deletedFiles.filter((file) => !allFiles.includes(file)));
-  const { stdout: untrackedOutput } = await execPromise(
-    "git ls-files --others --exclude-standard",
-    {
-      cwd: repoRoot
+  const currentCommit = currentCommitOutput.trim();
+  let compareTo = "";
+  let parentRef = "";
+  if (isRange) {
+    compareTo = selector;
+    parentRef = selector;
+  } else {
+    const graphiteParent = tryGetGraphiteParent(repoRoot, currentBranch);
+    const defaultBranch = await getDefaultBranch(repoRoot);
+    const target = selector || graphiteParent || `origin/${defaultBranch || "main"}`;
+    parentRef = target;
+    const mergeBaseCmd = `git merge-base --fork-point ${shellQuote(target)} HEAD || git merge-base ${shellQuote(target)} HEAD`;
+    const { stdout: mergeBaseOutput } = await execPromise(mergeBaseCmd, { cwd: repoRoot });
+    compareTo = mergeBaseOutput.trim();
+    if (!selector && currentBranch === (defaultBranch || "main")) {
+      const upstream = await tryGetUpstream(repoRoot).catch(() => void 0);
+      if (upstream) {
+        parentRef = upstream;
+        const { stdout: upstreamMergeBase } = await execPromise(
+          `git merge-base --fork-point ${shellQuote(upstream)} HEAD || git merge-base ${shellQuote(upstream)} HEAD`,
+          { cwd: repoRoot }
+        );
+        compareTo = upstreamMergeBase.trim();
+      } else {
+        parentRef = "HEAD~1";
+        compareTo = "HEAD~1";
+      }
     }
-  );
-  const untrackedFiles = untrackedOutput.split("\n").filter(Boolean);
-  allFiles.push(...untrackedFiles.filter((file) => !allFiles.includes(file)));
-  const nonDeletedFiles = [];
-  const deletedFilesSet = new Set(deletedFiles);
-  const fileIsDeleted = /* @__PURE__ */ new Map();
-  for (const file of allFiles) {
-    const isDeleted = deletedFilesSet.has(file) || ((_a = fileStatuses.get(file)) == null ? void 0 : _a.includes("D")) || ((_b = fileStatuses.get(file)) == null ? void 0 : _b.includes("R"));
-    fileIsDeleted.set(file, Boolean(isDeleted));
-    if (!isDeleted) {
-      nonDeletedFiles.push(file);
-    }
-  }
-  const fileStats = /* @__PURE__ */ new Map();
-  if (nonDeletedFiles.length > 0) {
-    const { stdout: batchNumstatOutput } = await execPromise(
-      `git diff ${mergeBase} --numstat -- ${nonDeletedFiles.map((f) => `'${f.replace(/'/g, "'\\''")}'`).join(" ")}`,
-      { cwd: repoRoot }
-    );
-    const numstatLines = batchNumstatOutput.split("\n").filter(Boolean);
-    numstatLines.forEach((line) => {
+  }
+  const includes = resolveIncludes(options.include);
+  const validationError = validateWorktreeIncludes(selector, options.include, currentBranch);
+  if (validationError) {
+    throw new Error(validationError);
+  }
+  const allEntries = [];
+  if (includes.committed) {
+    if (isRange) {
+      const [rangeA, rangeB] = parseRange(selector);
+      const { stdout } = await execPromise(
+        `git diff --name-status -M -z ${shellQuote(rangeA)}..${shellQuote(rangeB)}`,
+        { cwd: repoRoot, maxBuffer: 50 * 1024 * 1024 }
+      );
+      allEntries.push(...parseNameStatusZ(stdout, "committed"));
+    } else {
+      const { stdout } = await execPromise(`git diff --name-status -M -z ${compareTo}..HEAD`, {
+        cwd: repoRoot,
+        maxBuffer: 50 * 1024 * 1024
+      });
+      allEntries.push(...parseNameStatusZ(stdout, "committed"));
+    }
+  }
+  if (includes.staged) {
+    const { stdout } = await execPromise(`git diff --name-status -M -z --cached`, {
+      cwd: repoRoot,
+      maxBuffer: 50 * 1024 * 1024
+    });
+    allEntries.push(...parseNameStatusZ(stdout, "staged"));
+  }
+  if (includes.unstaged) {
+    const { stdout } = await execPromise(`git diff --name-status -M -z`, {
+      cwd: repoRoot,
+      maxBuffer: 50 * 1024 * 1024
+    });
+    allEntries.push(...parseNameStatusZ(stdout, "unstaged"));
+  }
+  if (includes.untracked) {
+    const { stdout } = await execPromise(`git ls-files --others --exclude-standard -z`, {
+      cwd: repoRoot,
+      maxBuffer: 50 * 1024 * 1024
+    });
+    allEntries.push(...parseLsFilesZ(stdout));
+  }
+  const entries = dedupeEntries(allEntries);
+  const committedEntries = entries.filter((e) => e.source === "committed");
+  const stagedEntries = entries.filter((e) => e.source === "staged");
+  const unstagedEntries = entries.filter((e) => e.source === "unstaged");
+  const untrackedEntries = entries.filter((e) => e.source === "untracked");
+  const patchByFile = /* @__PURE__ */ new Map();
+  if (committedEntries.length > 0) {
+    const paths = committedEntries.map((e) => e.path);
+    let diffCmd = "";
+    if (isRange) {
+      const [rangeA, rangeB] = parseRange(selector);
+      diffCmd = `git diff -U0 -M ${shellQuote(rangeA)}..${shellQuote(rangeB)} -- ${joinAsShellArgs(paths)}`;
+    } else {
+      diffCmd = `git diff -U0 -M ${compareTo}..HEAD -- ${joinAsShellArgs(paths)}`;
+    }
+    const { stdout: patchOutput } = await execPromise(diffCmd, {
+      cwd: repoRoot,
+      maxBuffer: 50 * 1024 * 1024
+    });
+    const patches = splitGitPatchPerFile(patchOutput);
+    patches.forEach((patch, filename) => patchByFile.set(filename, stripDiffHeaders(patch)));
+  }
+  if (stagedEntries.length > 0) {
+    const paths = stagedEntries.map((e) => e.path);
+    const diffCmd = `git diff -U0 -M --cached -- ${joinAsShellArgs(paths)}`;
+    const { stdout: patchOutput } = await execPromise(diffCmd, {
+      cwd: repoRoot,
+      maxBuffer: 50 * 1024 * 1024
+    });
+    const patches = splitGitPatchPerFile(patchOutput);
+    patches.forEach((patch, filename) => patchByFile.set(filename, stripDiffHeaders(patch)));
+  }
+  if (unstagedEntries.length > 0) {
+    const paths = unstagedEntries.map((e) => e.path);
+    const diffCmd = `git diff -U0 -M -- ${joinAsShellArgs(paths)}`;
+    const { stdout: patchOutput } = await execPromise(diffCmd, {
+      cwd: repoRoot,
+      maxBuffer: 50 * 1024 * 1024
+    });
+    const patches = splitGitPatchPerFile(patchOutput);
+    patches.forEach((patch, filename) => patchByFile.set(filename, stripDiffHeaders(patch)));
+  }
+  for (const entry of untrackedEntries) {
+    try {
+      const { stdout } = await execPromise(
+        `git diff -U0 --no-index /dev/null ${shellQuote(entry.path)}`,
+        { cwd: repoRoot, maxBuffer: 50 * 1024 * 1024 }
+      );
+      patchByFile.set(entry.path, stripDiffHeaders(stdout));
+    } catch (error) {
+      if (error.stdout) {
+        patchByFile.set(entry.path, stripDiffHeaders(error.stdout));
+      } else {
+        throw error;
+      }
+    }
+  }
+  const statsByFile = /* @__PURE__ */ new Map();
+  if (committedEntries.length > 0) {
+    const paths = committedEntries.map((e) => e.path);
+    let numstatCmd = "";
+    if (isRange) {
+      const [rangeA, rangeB] = parseRange(selector);
+      numstatCmd = `git diff --numstat ${shellQuote(rangeA)}..${shellQuote(rangeB)} -- ${joinAsShellArgs(paths)}`;
+    } else {
+      numstatCmd = `git diff --numstat ${compareTo}..HEAD -- ${joinAsShellArgs(paths)}`;
+    }
+    const { stdout: numstatOutput } = await execPromise(numstatCmd, {
+      cwd: repoRoot,
+      maxBuffer: 50 * 1024 * 1024
+    });
+    const lines = numstatOutput.split("\n").filter(Boolean);
+    for (const line of lines) {
       const parts = line.split("	");
       if (parts.length >= 3) {
-        const [additionsStr, deletionsStr, filename] = parts;
-        fileStats.set(filename, {
-          additions: parseInt(additionsStr) || 0,
-          deletions: parseInt(deletionsStr) || 0
+        const [addStr, delStr, filename] = parts;
+        statsByFile.set(filename, {
+          additions: parseInt(addStr) || 0,
+          deletions: parseInt(delStr) || 0
         });
       }
-    });
+    }
   }
-  const fileDiffs = /* @__PURE__ */ new Map();
-  if (nonDeletedFiles.length > 0) {
-    const { stdout: batchDiffOutput } = await execPromise(
-      `git diff ${mergeBase} -- ${nonDeletedFiles.map((f) => `'${f.replace(/'/g, "'\\''")}'`).join(" ")}`,
-      { cwd: repoRoot }
-    );
-    const diffSections = batchDiffOutput.split(/^diff --git /m).filter(Boolean);
-    diffSections.forEach((section) => {
-      const lines = section.split("\n");
-      const firstLine = lines[0];
-      const match = firstLine.match(/a\/(.+?) b\//);
-      if (match) {
-        const filename = match[1];
-        const diffContent = lines.slice(1).filter((line) => {
-          return !(line.startsWith("index ") || line.startsWith("--- ") || line.startsWith("+++ "));
-        }).join("\n");
-        fileDiffs.set(filename, diffContent);
-      }
+  if (stagedEntries.length > 0) {
+    const paths = stagedEntries.map((e) => e.path);
+    const numstatCmd = `git diff --numstat --cached -- ${joinAsShellArgs(paths)}`;
+    const { stdout: numstatOutput } = await execPromise(numstatCmd, {
+      cwd: repoRoot,
+      maxBuffer: 50 * 1024 * 1024
     });
+    const lines = numstatOutput.split("\n").filter(Boolean);
+    for (const line of lines) {
+      const parts = line.split("	");
+      if (parts.length >= 3) {
+        const [addStr, delStr, filename] = parts;
+        statsByFile.set(filename, {
+          additions: parseInt(addStr) || 0,
+          deletions: parseInt(delStr) || 0
+        });
+      }
+    }
   }
-  const deletedFileContents = /* @__PURE__ */ new Map();
-  const actualDeletedFiles = allFiles.filter((file) => fileIsDeleted.get(file));
-  if (actualDeletedFiles.length > 0) {
-    const deletedFilePromises = actualDeletedFiles.map(async (file) => {
-      const { stdout: lastContent } = await execPromise(
-        `git show '${mergeBase}:${file.replace(/'/g, "'\\''")}'`,
-        {
-          cwd: repoRoot
-        }
-      );
-      return { file, content: lastContent };
+  if (unstagedEntries.length > 0) {
+    const paths = unstagedEntries.map((e) => e.path);
+    const numstatCmd = `git diff --numstat -- ${joinAsShellArgs(paths)}`;
+    const { stdout: numstatOutput } = await execPromise(numstatCmd, {
+      cwd: repoRoot,
+      maxBuffer: 50 * 1024 * 1024
     });
-    const results = await Promise.allSettled(deletedFilePromises);
-    results.forEach((result, index) => {
-      if (result.status === "fulfilled") {
-        deletedFileContents.set(actualDeletedFiles[index], result.value.content);
+    const lines = numstatOutput.split("\n").filter(Boolean);
+    for (const line of lines) {
+      const parts = line.split("	");
+      if (parts.length >= 3) {
+        const [addStr, delStr, filename] = parts;
+        statsByFile.set(filename, {
+          additions: parseInt(addStr) || 0,
+          deletions: parseInt(delStr) || 0
+        });
       }
-    });
+    }
   }
-  const fileChanges = [];
-  for (const file of allFiles) {
-    const isDeleted = fileIsDeleted.get(file);
+  for (const entry of untrackedEntries) {
+    const patch = patchByFile.get(entry.path) || "";
+    const lines = patch.split("\n");
     let additions = 0;
     let deletions = 0;
-    let diffOutput2 = "";
-    if (isDeleted) {
-      const lastContent = deletedFileContents.get(file);
-      if (lastContent) {
-        deletions = lastContent.split("\n").length;
-        diffOutput2 = lastContent.split("\n").map((line) => `-${line}`).join("\n");
-      }
-    } else {
-      const stats = fileStats.get(file);
-      if (stats) {
-        additions = stats.additions;
-        deletions = stats.deletions;
+    for (const line of lines) {
+      if (line.startsWith("+") && !line.startsWith("+++")) {
+        additions++;
+      } else if (line.startsWith("-") && !line.startsWith("---")) {
+        deletions++;
       }
-      diffOutput2 = fileDiffs.get(file) || "";
     }
-    const status = isDeleted ? "removed" : additions > 0 && deletions === 0 ? "added" : "modified";
-    fileChanges.push({
-      filename: file,
+    statsByFile.set(entry.path, { additions, deletions });
+  }
+  const fileChanges = [];
+  for (const entry of entries) {
+    const patch = patchByFile.get(entry.path) || "";
+    const stats = statsByFile.get(entry.path) || { additions: 0, deletions: 0 };
+    const status = toChangeStatus(entry);
+    const fileChange = {
+      filename: entry.path,
       status,
-      patch: diffOutput2,
-      additions,
-      deletions,
-      sha: hashString(diffOutput2)
-    });
+      patch,
+      additions: stats.additions,
+      deletions: stats.deletions,
+      sha: hashString(patch)
+    };
+    if (entry.oldPath) {
+      fileChange.oldFilename = entry.oldPath;
+    }
+    fileChanges.push(fileChange);
   }
   return {
     files: fileChanges,
     currentBranch,
     currentCommit,
-    diffCommit: mergeBase,
-    diffBranch: compareTo
+    diffBranch: parentRef,
+    diffCommit: compareTo
   };
 }
 
@@ -404,7 +1052,7 @@ var Environment = class {
 // src/environment/Storage.ts
 import * as fs from "fs/promises";
 import os from "os";
-import path from "path";
+import path2 from "path";
 import Keyv from "keyv";
 import { KeyvFile } from "keyv-file";
 var Storage = class {
@@ -418,13 +1066,13 @@ var Storage = class {
    * This replaces the getConfigDirectory functionality
    */
   getStorageDirectory() {
-    return path.join(os.homedir(), ".powerlint");
+    return path2.join(os.homedir(), ".powerlint");
   }
   /**
    * Get the base directory for indexes
    */
   getIndexDirectory() {
-    return path.join(
+    return path2.join(
       this.getStorageDirectory(),
       "indexes",
       hashString(this.environment.getWorkspaceRoot())
@@ -434,7 +1082,7 @@ var Storage = class {
    * Get the base directory for caches
    */
   getCacheDirectory() {
-    return path.join(
+    return path2.join(
       this.getStorageDirectory(),
       "cache",
       hashString(this.environment.getWorkspaceRoot())
@@ -454,7 +1102,7 @@ var Storage = class {
     const indexDir = this.getIndexDirectory();
     await this.ensureDirectory(indexDir);
     const file = fileName || `${language.toLowerCase()}-index.scip`;
-    return path.join(indexDir, `${language.toLowerCase()}-${file}`);
+    return path2.join(indexDir, `${language.toLowerCase()}-${file}`);
   }
   /**
    * Check if an index exists for a language
@@ -491,7 +1139,7 @@ var Storage = class {
    * Get the cache file path
    */
   getCacheFilePath() {
-    return path.join(this.getCacheDirectory(), "cache.json");
+    return path2.join(this.getCacheDirectory(), "cache.json");
   }
   /**
    * Purge all storage (cache and indexes)
@@ -536,7 +1184,7 @@ var Storage = class {
       const cacheDir = this.getCacheDirectory();
       this.cacheStore = new Keyv({
         store: new KeyvFile({
-          filename: path.join(cacheDir, "cache.json")
+          filename: path2.join(cacheDir, "cache.json")
         })
       });
     }
@@ -579,13 +1227,6 @@ var Storage = class {
 };
 
 // src/providers/WispbitRuleProvider.ts
-import { z } from "zod";
-var GetRulesSchema = z.object({
-  repository_url: z.string(),
-  rule_ids: z.array(z.string()).optional(),
-  schema_version: z.string(),
-  powerlint_version: z.string()
-});
 var WispbitRuleProvider = class {
   config;
   environment;
@@ -593,26 +1234,6 @@ var WispbitRuleProvider = class {
     this.config = config;
     this.environment = environment;
   }
-  /**
-   * Make a request to the Wispbit API
-   */
-  async makeApiRequest(endpoint, data) {
-    const baseUrl = this.config.getBaseUrl();
-    const apiKey = this.config.getApiKey();
-    const url = `${baseUrl}${endpoint}`;
-    const response = await fetch(url, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${apiKey}`
-      },
-      body: JSON.stringify(data)
-    });
-    if (!response.ok) {
-      throw new Error(`Wispbit API request failed: ${response.status} ${response.statusText}`);
-    }
-    return await response.json();
-  }
   /**
    * Get the repository URL for API requests
    */
@@ -646,19 +1267,14 @@ var WispbitRuleProvider = class {
    */
   async fetchRules(ruleIds) {
     const repositoryUrl = await this.getRepositoryUrl();
-    const requestData = {
+    const apiClient = this.config.getApiClient();
+    const response = await apiClient.getRules({
       repository_url: repositoryUrl,
       rule_ids: ruleIds,
       schema_version: this.config.getSchemaVersion(),
       powerlint_version: this.config.getLocalVersion()
-    };
-    GetRulesSchema.parse(requestData);
-    const response = await this.makeApiRequest("/plv1/get-rules", requestData);
-    if (!Array.isArray(response.rules)) {
-      throw new Error("Invalid response format from Wispbit API: expected rules array");
-    }
-    const rules = response.rules;
-    return rules.map((rule) => ({
+    });
+    return response.rules.map((rule) => ({
       id: rule.id,
       internalId: rule.internalId,
       config: {
@@ -670,27 +1286,6 @@ var WispbitRuleProvider = class {
       testCases: []
     }));
   }
-  /**
-   * Create a new rule in Wispbit Cloud
-   */
-  async createRule(_rule) {
-    await Promise.resolve();
-    throw new Error("Creating rules in Wispbit Cloud is not yet implemented");
-  }
-  /**
-   * Update an existing rule in Wispbit Cloud
-   */
-  async updateRule(_ruleId, _rule) {
-    await Promise.resolve();
-    throw new Error("Updating rules in Wispbit Cloud is not yet implemented");
-  }
-  /**
-   * Delete a rule from Wispbit Cloud
-   */
-  async deleteRule(_ruleId) {
-    await Promise.resolve();
-    throw new Error("Deleting rules from Wispbit Cloud is not yet implemented");
-  }
 };
 
 // src/steps/ExecutionEventEmitter.ts
@@ -773,11 +1368,18 @@ var ExecutionEventEmitter = class extends EventEmitter {
     this.emit("indexing:complete", { language, executionTime });
   }
   // Helper methods for step debugging
-  startStep(ruleId, stepName, stepType, inputs) {
-    this.emit("step:start", { ruleId, stepName, stepType, inputs });
+  startStep(ruleId, stepName, stepType, inputs, parentStepName) {
+    this.emit("step:start", { ruleId, stepName, stepType, inputs, parentStepName });
   }
-  completeStep(ruleId, stepName, stepType, outputs, executionTime = 0) {
-    this.emit("step:complete", { ruleId, stepName, stepType, outputs, executionTime });
+  completeStep(ruleId, stepName, stepType, outputs, executionTime = 0, parentStepName) {
+    this.emit("step:complete", {
+      ruleId,
+      stepName,
+      stepType,
+      outputs,
+      executionTime,
+      parentStepName
+    });
   }
   // Helper methods for test events
   startTest(ruleId, testName) {
@@ -786,6 +1388,9 @@ var ExecutionEventEmitter = class extends EventEmitter {
   testMatches(ruleId, testName, matches) {
     this.emit("test:matches", { ruleId, testName, matches });
   }
+  completeTest(ruleId, testName, matches, stepExecutions) {
+    this.emit("test:complete", { ruleId, testName, matches, stepExecutions });
+  }
   // Helper methods for LLM validation events
   startLLMValidation(ruleId, matchCount, estimatedCost) {
     this.emit("llm:validation:start", { ruleId, matchCount, estimatedCost });
@@ -806,9 +1411,18 @@ var ExecutionEventEmitter = class extends EventEmitter {
 
 // src/steps/FileExecutionContext.ts
 import * as fs2 from "fs";
-import * as path2 from "path";
+import * as path3 from "path";
 import { glob } from "glob";
-import { minimatch } from "minimatch";
+
+// src/utils/patternMatching.ts
+import ignore from "ignore";
+function matchesAnyPattern(filePath, patterns) {
+  if (patterns.length === 0) return false;
+  const ig = ignore().add(patterns);
+  return ig.ignores(filePath);
+}
+
+// src/steps/FileExecutionContext.ts
 var FileExecutionContext = class _FileExecutionContext {
   environment;
   _filePaths = [];
@@ -825,9 +1439,33 @@ var FileExecutionContext = class _FileExecutionContext {
   /**
    * Create and initialize an ExecutionContext
    */
-  static async initialize(config, environment, mode, eventEmitter, filePath, baseSha) {
+  static async initialize(config, environment, mode, eventEmitter, filePath, diffOptions) {
     const context = new _FileExecutionContext(config, environment, mode, eventEmitter);
-    const initialFiles = await context.discoverFiles(filePath, baseSha);
+    if (mode === "diff" && !filePath) {
+      const workspaceRoot = context.environment.getWorkspaceRoot();
+      const include = diffOptions == null ? void 0 : diffOptions.include;
+      const commitSelector = diffOptions == null ? void 0 : diffOptions.commitSelector;
+      if (!commitSelector || !include)
+        throw new Error("Commit selector and include are required in diff mode");
+      const gitChanges = await getChangedFiles(workspaceRoot, {
+        include,
+        commitSelector
+      }).catch(() => {
+        throw new Error(
+          "Diff mode requires a git repository. Please run this command from within a git repository."
+        );
+      });
+      context.diffMode = {
+        gitChanges,
+        changedFiles: gitChanges.files.map((f) => f.filename),
+        fileChangeMap: new Map(gitChanges.files.map((file) => [file.filename, file]))
+      };
+      context.eventEmitter.fileDiscoveryProgress(
+        `Found ${context.diffMode.changedFiles.length} changed files`
+      );
+    }
+    const gitIgnoredFiles = mode === "check" ? await context.loadGitIgnoredFiles() : /* @__PURE__ */ new Set();
+    const initialFiles = await context.discoverFiles(filePath, gitIgnoredFiles);
     context._filePaths = initialFiles;
     return context;
   }
@@ -843,8 +1481,6 @@ var FileExecutionContext = class _FileExecutionContext {
     let filteredFiles;
     if (this.mode === "check") {
       filteredFiles = filePaths;
-    } else if (!this.diffMode) {
-      filteredFiles = filePaths;
     } else {
       filteredFiles = filePaths.filter((filePath) => this.isFileValid({ filePath }));
     }
@@ -881,6 +1517,27 @@ var FileExecutionContext = class _FileExecutionContext {
   get executionMode() {
     return this.mode;
   }
+  // ===== Git Ignored Files =====
+  /**
+   * Load git-ignored files from the repository
+   * Uses: git ls-files --ignored --exclude-standard --others
+   *
+   * Only called in "check" mode - in "diff" mode, git automatically excludes ignored files.
+   * Returns a Set for efficient lookup, which can be discarded after file discovery.
+   * If not in a git repository, returns an empty Set.
+   */
+  async loadGitIgnoredFiles() {
+    const workspaceRoot = this.environment.getWorkspaceRoot();
+    const ignoredFiles = await getGitIgnoredFiles(workspaceRoot).catch(() => {
+      this.eventEmitter.fileDiscoveryProgress("Not in a git repository, skipping git-ignored files");
+      return [];
+    });
+    const ignoredFilesSet = new Set(ignoredFiles);
+    if (ignoredFiles.length > 0) {
+      this.eventEmitter.fileDiscoveryProgress(`Found ${ignoredFiles.length} git-ignored files`);
+    }
+    return ignoredFilesSet;
+  }
   // ===== File Discovery =====
   /**
    * Discover files based on the execution mode
@@ -892,38 +1549,23 @@ var FileExecutionContext = class _FileExecutionContext {
    * - A directory path (e.g., "src/components/")
    * - A glob pattern (e.g., ".ts")
    */
-  async discoverFiles(filePath, baseSha) {
+  async discoverFiles(filePath, gitIgnoredFiles) {
     this.eventEmitter.startFileDiscovery(this.mode);
     let discoveredFiles;
     if (filePath) {
-      discoveredFiles = await this.discoverFilesFromPath(filePath);
+      discoveredFiles = await this.discoverFilesFromPath(filePath, gitIgnoredFiles);
     } else if (this.mode === "diff") {
       const workspaceRoot = this.environment.getWorkspaceRoot();
-      if (baseSha) {
-        this.eventEmitter.fileDiscoveryProgress(`Getting changed files from ${baseSha}...`);
-      } else {
-        this.eventEmitter.fileDiscoveryProgress("Getting changed files from git...");
-      }
-      const gitChanges = await getChangedFiles(workspaceRoot, baseSha);
-      this.diffMode = {
-        gitChanges,
-        changedFiles: gitChanges.files.map((f) => f.filename),
-        fileChangeMap: new Map(gitChanges.files.map((file) => [file.filename, file]))
-      };
-      this.eventEmitter.fileDiscoveryProgress(
-        `Found ${this.diffMode.changedFiles.length} changed files`
-      );
-      discoveredFiles = this.diffMode.changedFiles.filter((file) => fs2.existsSync(path2.resolve(workspaceRoot, file))).map((file) => file);
-      this.eventEmitter.fileDiscoveryProgress("Applying ignore patterns...");
+      discoveredFiles = this.diffMode.changedFiles.filter(
+        (file) => fs2.existsSync(path3.resolve(workspaceRoot, file))
+      ).map((file) => file);
       const allIgnorePatterns = this.config.getIgnoredGlobs();
       if (allIgnorePatterns.length > 0) {
+        this.eventEmitter.fileDiscoveryProgress("Applying ignore patterns...");
         const beforeIgnore = discoveredFiles.length;
-        discoveredFiles = discoveredFiles.filter((filePath2) => {
-          const matchesIgnore = allIgnorePatterns.some(
-            (pattern) => this.matchesPattern(filePath2, pattern)
-          );
-          return !matchesIgnore;
-        });
+        discoveredFiles = discoveredFiles.filter(
+          (filePath2) => !matchesAnyPattern(filePath2, allIgnorePatterns)
+        );
         if (beforeIgnore !== discoveredFiles.length) {
           this.eventEmitter.fileDiscoveryProgress(
             `Filtered out ${beforeIgnore - discoveredFiles.length} ignored files`
@@ -934,7 +1576,11 @@ var FileExecutionContext = class _FileExecutionContext {
       this.eventEmitter.fileDiscoveryProgress("Scanning workspace for files...");
       const workspaceRoot = this.environment.getWorkspaceRoot();
       const allIgnorePatterns = this.config.getIgnoredGlobs();
-      discoveredFiles = await this.discoverAllFiles([workspaceRoot], allIgnorePatterns);
+      discoveredFiles = await this.discoverAllFiles(
+        [workspaceRoot],
+        allIgnorePatterns,
+        gitIgnoredFiles
+      );
     }
     this.eventEmitter.completeFileDiscovery(discoveredFiles.length, this.mode);
     return discoveredFiles;
@@ -942,15 +1588,15 @@ var FileExecutionContext = class _FileExecutionContext {
   /**
    * Discover files from a given path which can be a file, directory, or glob pattern
    */
-  async discoverFilesFromPath(filePath) {
+  async discoverFilesFromPath(filePath, gitIgnoredFiles) {
     const workspaceRoot = this.environment.getWorkspaceRoot();
-    const fullPath = path2.resolve(workspaceRoot, filePath);
+    const fullPath = path3.resolve(workspaceRoot, filePath);
     const allIgnorePatterns = this.config.getIgnoredGlobs();
     if (this.isGlobPattern(filePath)) {
       this.eventEmitter.fileDiscoveryProgress(
         `Discovering files matching glob pattern: ${filePath}`
       );
-      return await this.discoverFilesFromGlob(filePath, allIgnorePatterns);
+      return await this.discoverFilesFromGlob(filePath, allIgnorePatterns, gitIgnoredFiles);
     }
     if (!fs2.existsSync(fullPath)) {
       throw new Error(`Path not found: ${filePath}`);
@@ -958,10 +1604,11 @@ var FileExecutionContext = class _FileExecutionContext {
     const stats = fs2.statSync(fullPath);
     if (stats.isFile()) {
       this.eventEmitter.fileDiscoveryProgress(`Checking specific file: ${filePath}`);
-      const matchesIgnore = allIgnorePatterns.some(
-        (pattern) => this.matchesPattern(filePath, pattern)
-      );
-      if (matchesIgnore) {
+      if (gitIgnoredFiles.has(filePath)) {
+        this.eventEmitter.fileDiscoveryProgress(`File ${filePath} is ignored by git`);
+        return [];
+      }
+      if (matchesAnyPattern(filePath, allIgnorePatterns)) {
         this.eventEmitter.fileDiscoveryProgress(`File ${filePath} is ignored by patterns`);
         return [];
       } else {
@@ -969,7 +1616,7 @@ var FileExecutionContext = class _FileExecutionContext {
       }
     } else if (stats.isDirectory()) {
       this.eventEmitter.fileDiscoveryProgress(`Discovering files in directory: ${filePath}`);
-      return await this.discoverFilesFromDirectory(filePath, allIgnorePatterns);
+      return await this.discoverFilesFromDirectory(filePath, allIgnorePatterns, gitIgnoredFiles);
     } else {
       throw new Error(`Path is neither a file nor directory: ${filePath}`);
     }
@@ -983,7 +1630,7 @@ var FileExecutionContext = class _FileExecutionContext {
   /**
    * Discover files matching a glob pattern
    */
-  async discoverFilesFromGlob(globPattern, ignorePatterns) {
+  async discoverFilesFromGlob(globPattern, ignorePatterns, gitIgnoredFiles) {
     const workspaceRoot = this.environment.getWorkspaceRoot();
     const allIgnorePatterns = ["**/node_modules/**", "**/.git/**", ...ignorePatterns];
     const matches = await glob(globPattern, {
@@ -992,15 +1639,18 @@ var FileExecutionContext = class _FileExecutionContext {
       absolute: false,
       ignore: allIgnorePatterns
     });
-    this.eventEmitter.fileDiscoveryProgress(`Found ${matches.length} files matching pattern`);
-    return matches;
+    const filteredMatches = matches.filter((match) => !gitIgnoredFiles.has(match));
+    this.eventEmitter.fileDiscoveryProgress(
+      `Found ${filteredMatches.length} files matching pattern`
+    );
+    return filteredMatches;
   }
   /**
    * Discover all files in a directory
    */
-  async discoverFilesFromDirectory(dirPath, ignorePatterns) {
+  async discoverFilesFromDirectory(dirPath, ignorePatterns, gitIgnoredFiles) {
     const workspaceRoot = this.environment.getWorkspaceRoot();
-    const globPattern = path2.join(dirPath, "**/*").replace(/\\/g, "/");
+    const globPattern = path3.join(dirPath, "**/*").replace(/\\/g, "/");
     const allIgnorePatterns = ["**/node_modules/**", "**/.git/**", ...ignorePatterns];
     const matches = await glob(globPattern, {
       cwd: workspaceRoot,
@@ -1008,22 +1658,25 @@ var FileExecutionContext = class _FileExecutionContext {
       absolute: false,
       ignore: allIgnorePatterns
     });
-    this.eventEmitter.fileDiscoveryProgress(`Found ${matches.length} files in directory`);
-    return matches;
+    const filteredMatches = matches.filter((match) => !gitIgnoredFiles.has(match));
+    this.eventEmitter.fileDiscoveryProgress(`Found ${filteredMatches.length} files in directory`);
+    return filteredMatches;
   }
   /**
    * Discover all files from directories using glob patterns (scan mode)
    */
-  async discoverAllFiles(directories, ignorePatterns) {
+  async discoverAllFiles(directories, ignorePatterns, gitIgnoredFiles) {
     const allFiles = [];
     const workspaceRoot = this.environment.getWorkspaceRoot();
     const allIgnorePatterns = ["**/node_modules/**", "**/.git/**", ...ignorePatterns];
     for (const dir of directories) {
       const stats = fs2.statSync(dir);
       if (!stats.isDirectory()) {
-        const shouldIgnore = ignorePatterns.some((pattern) => this.matchesPattern(dir, pattern));
-        if (!shouldIgnore) {
-          allFiles.push(path2.relative(workspaceRoot, dir));
+        const relativePath = path3.relative(workspaceRoot, dir);
+        const isGitIgnored = gitIgnoredFiles.has(relativePath);
+        const shouldIgnore = matchesAnyPattern(relativePath, ignorePatterns);
+        if (!isGitIgnored && !shouldIgnore) {
+          allFiles.push(relativePath);
         }
         continue;
       }
@@ -1035,19 +1688,13 @@ var FileExecutionContext = class _FileExecutionContext {
         ignore: allIgnorePatterns
       });
       const relativePaths = matches.map((match) => {
-        const absolutePath = path2.resolve(dir, match);
-        return path2.relative(workspaceRoot, absolutePath);
-      });
+        const absolutePath = path3.resolve(dir, match);
+        return path3.relative(workspaceRoot, absolutePath);
+      }).filter((relativePath) => !gitIgnoredFiles.has(relativePath));
       allFiles.push(...relativePaths);
     }
     return [...new Set(allFiles)];
   }
-  /**
-   * Pattern matching function that uses consistent options
-   */
-  matchesPattern(filePath, pattern) {
-    return minimatch(filePath, pattern, { dot: true });
-  }
   /**
    * Check if a file should be processed
    */
@@ -1055,9 +1702,6 @@ var FileExecutionContext = class _FileExecutionContext {
     if (this.mode === "check") {
       return true;
     }
-    if (!this.diffMode) {
-      return true;
-    }
     const { filePath } = options;
     return this.diffMode.changedFiles.some((changedFile) => {
       return filePath === changedFile || filePath.endsWith(changedFile) || changedFile.endsWith(filePath);
@@ -1070,9 +1714,6 @@ var FileExecutionContext = class _FileExecutionContext {
     if (this.mode === "check") {
       return true;
     }
-    if (!this.diffMode) {
-      return true;
-    }
     const { filePath, startLine, endLine } = options;
     const fileChange = this.diffMode.fileChangeMap.get(filePath);
     if (!fileChange) {
@@ -1093,9 +1734,6 @@ var FileExecutionContext = class _FileExecutionContext {
     if (this.mode === "check") {
       return true;
     }
-    if (!this.diffMode) {
-      return true;
-    }
     const { match } = options;
     return this.isFileValid({ filePath: match.filePath }) && this.isLineRangeValid({
       filePath: match.filePath,
@@ -1141,48 +1779,34 @@ var FileExecutionContext = class _FileExecutionContext {
 
 // src/steps/FileFilterStep.ts
 import * as fs3 from "fs";
-import * as path3 from "path";
-import { minimatch as minimatch2 } from "minimatch";
+import * as path4 from "path";
 var FileFilterStep = class {
   environment;
   constructor(environment) {
     this.environment = environment;
   }
-  /**
-   * Centralized pattern matching function that uses consistent options
-   * @param path - The path to test
-   * @param pattern - The glob pattern to match against
-   * @returns true if the path matches the pattern
-   */
-  matchesPattern(path11, pattern) {
-    return minimatch2(path11, pattern, { dot: true });
-  }
   /**
    * Evaluate a single file filter condition for a given file path
    */
   evaluateCondition(condition, filePath) {
     const workspaceRoot = this.environment.getWorkspaceRoot();
-    const absoluteFilePath = path3.resolve(workspaceRoot, filePath);
+    const absoluteFilePath = path4.resolve(workspaceRoot, filePath);
     if ("fs.siblingExists" in condition) {
       const { filename } = condition["fs.siblingExists"];
-      const dir = path3.dirname(absoluteFilePath);
-      const siblingPath = path3.join(dir, filename);
+      const dir = path4.dirname(absoluteFilePath);
+      const siblingPath = path4.join(dir, filename);
       return fs3.existsSync(siblingPath);
     }
-    if ("fs.pathMatches" in condition) {
-      const { pattern } = condition["fs.pathMatches"];
-      return this.matchesPattern(filePath, pattern);
-    }
     if ("fs.ancestorHas" in condition) {
       const { filename } = condition["fs.ancestorHas"];
-      let currentDir = path3.dirname(absoluteFilePath);
-      const root = path3.parse(currentDir).root;
+      let currentDir = path4.dirname(absoluteFilePath);
+      const root = path4.parse(currentDir).root;
       while (currentDir !== root) {
-        const targetPath = path3.join(currentDir, filename);
+        const targetPath = path4.join(currentDir, filename);
         if (fs3.existsSync(targetPath)) {
           return true;
         }
-        const parentDir = path3.dirname(currentDir);
+        const parentDir = path4.dirname(currentDir);
         if (parentDir === currentDir) break;
         currentDir = parentDir;
       }
@@ -1190,12 +1814,12 @@ var FileFilterStep = class {
     }
     if ("fs.siblingAny" in condition) {
       const { pattern } = condition["fs.siblingAny"];
-      const dir = path3.dirname(absoluteFilePath);
+      const dir = path4.dirname(absoluteFilePath);
       if (!fs3.existsSync(dir)) {
         return false;
       }
       const siblings = fs3.readdirSync(dir);
-      return siblings.some((sibling) => this.matchesPattern(sibling, pattern));
+      return siblings.some((sibling) => matchesAnyPattern(sibling, [pattern]));
     }
     return false;
   }
@@ -1204,13 +1828,13 @@ var FileFilterStep = class {
    */
   evaluateConditions(conditions, filePath) {
     const results = [];
-    if (conditions.all) {
+    if (conditions.all && conditions.all.length > 0) {
       results.push(conditions.all.every((condition) => this.evaluateCondition(condition, filePath)));
     }
-    if (conditions.any) {
+    if (conditions.any && conditions.any.length > 0) {
       results.push(conditions.any.some((condition) => this.evaluateCondition(condition, filePath)));
     }
-    if (conditions.not) {
+    if (conditions.not && conditions.not.length > 0) {
       results.push(!conditions.not.some((condition) => this.evaluateCondition(condition, filePath)));
     }
     return results.length === 0 ? true : results.every((result) => result === true);
@@ -1224,18 +1848,15 @@ var FileFilterStep = class {
     let filteredPaths = filePaths;
     if ((_a = options.include) == null ? void 0 : _a.length) {
       filteredPaths = filteredPaths.filter(
-        (filePath) => options.include.some((pattern) => this.matchesPattern(filePath, pattern))
+        (filePath) => matchesAnyPattern(filePath, options.include)
       );
     }
     if ((_b = options.ignore) == null ? void 0 : _b.length) {
-      filteredPaths = filteredPaths.filter((filePath) => {
-        const matchesIgnore = options.ignore.some(
-          (pattern) => this.matchesPattern(filePath, pattern)
-        );
-        return !matchesIgnore;
-      });
+      filteredPaths = filteredPaths.filter(
+        (filePath) => !matchesAnyPattern(filePath, options.ignore)
+      );
     }
-    if (options.conditions) {
+    if (Object.keys(options.conditions || {}).length > 0 && filteredPaths.length > 0) {
       filteredPaths = filteredPaths.filter(
         (filePath) => this.evaluateConditions(options.conditions, filePath)
       );
@@ -1251,126 +1872,6 @@ var FileFilterStep = class {
 // src/steps/FindMatchesStep.ts
 import path8 from "path";
 
-// src/languages.ts
-import { existsSync as existsSync3 } from "fs";
-import { createRequire } from "module";
-import path4 from "path";
-import angular from "@ast-grep/lang-angular";
-import bash from "@ast-grep/lang-bash";
-import c from "@ast-grep/lang-c";
-import cpp from "@ast-grep/lang-cpp";
-import csharp from "@ast-grep/lang-csharp";
-import css from "@ast-grep/lang-css";
-import dart from "@ast-grep/lang-dart";
-import elixir from "@ast-grep/lang-elixir";
-import go from "@ast-grep/lang-go";
-import haskell from "@ast-grep/lang-haskell";
-import html from "@ast-grep/lang-html";
-import java from "@ast-grep/lang-java";
-import javascript from "@ast-grep/lang-javascript";
-import json from "@ast-grep/lang-json";
-import kotlin from "@ast-grep/lang-kotlin";
-import lua from "@ast-grep/lang-lua";
-import markdown from "@ast-grep/lang-markdown";
-import php from "@ast-grep/lang-php";
-import python from "@ast-grep/lang-python";
-import ruby from "@ast-grep/lang-ruby";
-import rust from "@ast-grep/lang-rust";
-import scala from "@ast-grep/lang-scala";
-import sql from "@ast-grep/lang-sql";
-import swift from "@ast-grep/lang-swift";
-import toml from "@ast-grep/lang-toml";
-import tsx from "@ast-grep/lang-tsx";
-import typescript from "@ast-grep/lang-typescript";
-import yaml from "@ast-grep/lang-yaml";
-import { registerDynamicLanguage } from "@ast-grep/napi";
-console.debug = () => {
-};
-var require2 = createRequire(import.meta.url ? import.meta.url : __filename);
-function getGraphQLLibPath() {
-  const graphqlDir = path4.dirname(require2.resolve("tree-sitter-graphql"));
-  const releaseNode = path4.join(graphqlDir, "../../build/Release/tree_sitter_graphql_binding.node");
-  if (existsSync3(releaseNode)) {
-    return releaseNode;
-  }
-  const debugNode = path4.join(graphqlDir, "../../build/Debug/tree_sitter_graphql_binding.node");
-  if (existsSync3(debugNode)) {
-    return debugNode;
-  }
-  const soFile = path4.join(graphqlDir, "parser.so");
-  if (existsSync3(soFile)) {
-    return soFile;
-  }
-  return null;
-}
-var graphqlPath = getGraphQLLibPath();
-var graphql = {
-  // node-gyp-build puts the .node file in build/Release/
-  libraryPath: graphqlPath,
-  /** the file extensions of the language. e.g. mojo */
-  extensions: ["graphql"],
-  /** the dylib symbol to load ts-language, default is `tree_sitter_{name}` */
-  languageSymbol: "tree_sitter_graphql",
-  /** the meta variable leading character, default is $ */
-  metaVarChar: "$",
-  /**
-   * An optional char to replace $ in your pattern.
-   * See https://ast-grep.github.io/advanced/custom-language.html#register-language-in-sgconfig-yml
-   */
-  expandoChar: void 0
-};
-var registeredLanguages = {
-  ["Angular" /* Angular */]: angular,
-  ["Bash" /* Bash */]: bash,
-  ["C" /* C */]: c,
-  ["Cpp" /* Cpp */]: cpp,
-  ["Csharp" /* Csharp */]: csharp,
-  ["Css" /* Css */]: css,
-  ["Dart" /* Dart */]: dart,
-  ["Elixir" /* Elixir */]: elixir,
-  ["Go" /* Go */]: go,
-  ["Haskell" /* Haskell */]: haskell,
-  ["Html" /* Html */]: html,
-  ["Java" /* Java */]: java,
-  ["JavaScript" /* JavaScript */]: javascript,
-  ["Json" /* Json */]: json,
-  ["Kotlin" /* Kotlin */]: kotlin,
-  ["Lua" /* Lua */]: lua,
-  ["Markdown" /* Markdown */]: markdown,
-  ["Php" /* Php */]: php,
-  ["Python" /* Python */]: python,
-  ["Ruby" /* Ruby */]: ruby,
-  ["Rust" /* Rust */]: rust,
-  ["Scala" /* Scala */]: scala,
-  ["Sql" /* Sql */]: sql,
-  ["Swift" /* Swift */]: swift,
-  ["Toml" /* Toml */]: toml,
-  ["Tsx" /* Tsx */]: tsx,
-  ["TypeScript" /* TypeScript */]: typescript,
-  ["Yaml" /* Yaml */]: yaml,
-  ...graphqlPath ? { ["GraphQL" /* GraphQL */]: graphql } : {}
-};
-registerDynamicLanguage(registeredLanguages);
-var REGISTERED_LANGUAGE_EXTENSIONS = Object.entries(
-  registeredLanguages
-).reduce(
-  (acc, [language, registration]) => {
-    acc[language] = registration.extensions ?? [];
-    return acc;
-  },
-  {}
-);
-function getLanguageFromFilePath(filePath) {
-  const extension = path4.extname(filePath).slice(1);
-  const language = findRegisteredLanguageFromExtension(extension);
-  return language ?? "Unknown" /* Unknown */;
-}
-function findRegisteredLanguageFromExtension(extension) {
-  return Object.keys(REGISTERED_LANGUAGE_EXTENSIONS).find(
-    (language) => REGISTERED_LANGUAGE_EXTENSIONS[language].includes(extension)
-  );
-}
-
 // src/providers/AstGrepAstProvider.ts
 import { readFile as readFile2 } from "fs/promises";
 import path5 from "path";
@@ -2130,7 +2631,7 @@ var FindMatchesStep = class {
 
 // src/steps/GotoDefinitionStep.ts
 import path9 from "path";
-import { minimatch as minimatch3 } from "minimatch";
+import ignore2 from "ignore";
 var GotoDefinitionStep = class {
   maxDepth = 1;
   environment;
@@ -2297,7 +2798,8 @@ var GotoDefinitionStep = class {
       return relativePath === spec.path;
     }
     if (spec.glob) {
-      return minimatch3(relativePath, spec.glob);
+      const ig = ignore2().add(spec.glob);
+      return ig.ignores(relativePath);
     }
     if (spec.regex) {
       const regex = new RegExp(spec.regex);
@@ -2310,70 +2812,29 @@ var GotoDefinitionStep = class {
 // src/providers/WispbitViolationValidationProvider.ts
 var WispbitViolationValidationProvider = class {
   config;
-  constructor(config) {
+  useInternalEndpoint;
+  constructor(config, useInternalEndpoint = false) {
     this.config = config;
+    this.useInternalEndpoint = useInternalEndpoint;
   }
   async validateViolations(params) {
-    var _a;
-    const matchesWithIds = params.matches.map((match) => ({
-      match,
-      matchId: this.generateMatchId(match)
-    }));
-    const baseUrl = this.config.getBaseUrl();
-    const apiKey = this.config.getApiKey();
-    const response = await fetch(`${baseUrl}/plv1/validate-violation`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${apiKey}`
-      },
-      body: JSON.stringify({
-        rule: params.rule,
-        matches: matchesWithIds.map(({ match, matchId }) => ({
-          matchId,
-          filePath: match.filePath,
-          range: match.range,
-          text: match.text,
-          language: match.language,
-          symbol: match.symbol,
-          source: match.source
-        })),
-        powerlint_version: this.config.getLocalVersion(),
-        schema_version: this.config.getSchemaVersion()
-      })
+    const apiClient = this.config.getApiClient();
+    const rulePayload = {
+      internalId: params.rule.internalId,
+      internalVersionId: params.rule.internalId,
+      contents: params.rule.prompt
+    };
+    const method = this.useInternalEndpoint ? apiClient.validateViolationInternal.bind(apiClient) : apiClient.validateViolation.bind(apiClient);
+    const result = await method({
+      rule: rulePayload,
+      matches: params.matches,
+      powerlint_version: this.config.getLocalVersion(),
+      schema_version: this.config.getSchemaVersion()
     });
-    if (!response.ok) {
-      const errorText = await response.text();
-      throw new Error(
-        `Wispbit validation failed: ${response.status} ${response.statusText} - ${errorText}`
-      );
-    }
-    const result = await response.json();
-    const results = [];
-    for (const { matchId } of matchesWithIds) {
-      const validationResult = (_a = result.results) == null ? void 0 : _a.find((r) => r.matchId === matchId);
-      results.push({
-        matchId,
-        isViolation: Boolean(validationResult == null ? void 0 : validationResult.isViolation),
-        reason: String((validationResult == null ? void 0 : validationResult.reason) || "No violation detected"),
-        confidence: typeof (validationResult == null ? void 0 : validationResult.confidence) === "number" ? validationResult.confidence : 1
-      });
-    }
-    return results;
-  }
-  /**
-   * Generate a unique ID for a single match
-   */
-  generateMatchId(match) {
-    const matchData = {
-      filePath: match.filePath,
-      startLine: match.range.start.line,
-      startColumn: match.range.start.column || 0,
-      endLine: match.range.end.line,
-      endColumn: match.range.end.column || 0,
-      text: match.text
+    return {
+      validMatches: result.validMatches,
+      skippedMatches: result.skippedMatches
     };
-    return hashString(JSON.stringify(matchData)).substring(0, 16);
   }
 };
 
@@ -2390,31 +2851,20 @@ var LLMStep = class {
     this.storage = new Storage(environment);
   }
   /**
-   * Generate a unique ID for a single match
-   * Hash is based on filePath + range + text
+   * Generate a cache key for a single match LLM validation
    */
-  generateMatchId(match) {
+  generateMatchCacheKey(match) {
     const matchData = {
       filePath: match.filePath,
       startLine: match.range.start.line,
       startColumn: match.range.start.column || 0,
       endLine: match.range.end.line,
       endColumn: match.range.end.column || 0,
-      text: match.text
+      text: match.text,
+      prompt: match.text
+      // Include prompt in cache key
     };
-    return hashString(JSON.stringify(matchData)).substring(0, 16);
-  }
-  /**
-   * Generate a hash for a prompt string
-   */
-  hashPrompt(prompt) {
-    return hashString(prompt);
-  }
-  /**
-   * Generate a cache key for a single match LLM validation
-   */
-  generateMatchCacheKey(matchId, promptHash) {
-    return `match_${matchId}_prompt_${promptHash}.json`;
+    return JSON.stringify(matchData);
   }
   /**
    * Execute the actual LLM validation for uncached matches
@@ -2424,38 +2874,42 @@ var LLMStep = class {
    */
   async executeLLMValidation(rule, uncachedMatches) {
     const llmStartTime = Date.now();
-    const promptHash = this.hashPrompt(rule.prompt);
-    const validationProvider = new WispbitViolationValidationProvider(this.config);
+    const validationProvider = new WispbitViolationValidationProvider(
+      this.config,
+      this.config.shouldUseInternalEndpoint()
+    );
     const validationParams = {
       rule,
       matches: uncachedMatches
     };
     this.eventEmitter.startLLMValidation(rule.id, uncachedMatches.length);
-    const validationResults = await validationProvider.validateViolations(validationParams);
-    const newViolationMatches = [];
-    for (const result of validationResults) {
-      const originalMatch = uncachedMatches.find(
-        (match) => this.generateMatchId(match) === result.matchId
-      );
-      if (originalMatch && result.isViolation) {
-        newViolationMatches.push({
-          ...originalMatch,
-          metadata: {
-            fromCache: false,
-            llmValidation: {
-              isViolation: true,
-              confidence: result.confidence,
-              reason: result.reason
-            }
-          }
-        });
+    const validationResponse = await validationProvider.validateViolations(validationParams);
+    const newViolationMatches = validationResponse.validMatches.map((match) => ({
+      ...match,
+      metadata: {
+        fromCache: false,
+        llmValidation: {
+          isViolation: true,
+          confidence: 1,
+          reason: "Confirmed violation"
+        }
       }
-      const cacheKey = this.generateMatchCacheKey(result.matchId, promptHash);
+    }));
+    for (const match of validationResponse.validMatches) {
+      const cacheKey = this.generateMatchCacheKey(match);
+      const decision = {
+        isViolation: true,
+        confidence: 1,
+        reason: "Confirmed violation"
+      };
+      await this.storage.saveCache(rule.id, cacheKey, decision);
+    }
+    for (const match of validationResponse.skippedMatches) {
+      const cacheKey = this.generateMatchCacheKey(match);
       const decision = {
-        matchId: result.matchId,
-        isViolation: result.isViolation,
-        confidence: result.confidence,
-        reason: result.reason
+        isViolation: false,
+        confidence: 1,
+        reason: "Not a violation"
       };
       await this.storage.saveCache(rule.id, cacheKey, decision);
     }
@@ -2479,12 +2933,10 @@ var LLMStep = class {
    */
   async execute(rule, previousMatches) {
     const startTime = Date.now();
-    const promptHash = this.hashPrompt(rule.prompt);
     const cachedMatches = [];
     const uncachedMatches = [];
     for (const match of previousMatches) {
-      const matchId = this.generateMatchId(match);
-      const cacheKey = this.generateMatchCacheKey(matchId, promptHash);
+      const cacheKey = this.generateMatchCacheKey(match);
       const cachedDecision = await this.storage.readCache(rule.id, cacheKey);
       if (cachedDecision) {
         if (cachedDecision.isViolation) {
@@ -2551,7 +3003,7 @@ var RuleExecutor = class {
   /**
    * Execute a single step
    */
-  async executeStep(rule, stepName, stepConfig, filePaths, matches, options) {
+  async executeStep(rule, stepName, stepConfig, filePaths, matches, options, _parentStepName) {
     const stepType = stepConfig.type;
     if (stepType === "ast-grep") {
       const { type: _type, language, ...schema } = stepConfig;
@@ -2568,13 +3020,34 @@ var RuleExecutor = class {
       for (let i = 0; i < stepConfig.steps.length; i++) {
         const subStep = stepConfig.steps[i];
         const subStepName = `${stepName}[${i}]`;
+        this.eventEmitter.startStep(
+          rule.id,
+          subStepName,
+          subStep.type,
+          { filePaths, matches },
+          stepName
+          // parent step name
+        );
+        const subStepStartTime = Date.now();
         const subResult = await this.executeStep(
           rule,
           subStepName,
           subStep,
           filePaths,
           matches,
-          options
+          options,
+          stepName
+          // parent step name
+        );
+        const subStepExecutionTime = Date.now() - subStepStartTime;
+        this.eventEmitter.completeStep(
+          rule.id,
+          subStepName,
+          subStep.type,
+          subResult,
+          subStepExecutionTime,
+          stepName
+          // parent step name
         );
         if (subResult.matches) {
           allMatches = allMatches.concat(subResult.matches);
@@ -2643,7 +3116,7 @@ var RuleExecutor = class {
         options.mode,
         this.eventEmitter,
         options.filePath,
-        options.baseSha
+        options.diffOptions
       );
       this.currentMode = options.mode;
     }
@@ -2680,13 +3153,7 @@ var RuleExecutor = class {
           options
         );
         const stepExecutionTime = Date.now() - stepStartTime;
-        this.eventEmitter.emit("step:complete", {
-          ruleId,
-          stepName,
-          stepType: stepConfig.type,
-          outputs: result,
-          executionTime: stepExecutionTime
-        });
+        this.eventEmitter.completeStep(ruleId, stepName, stepConfig.type, result, stepExecutionTime);
         if (result.filePaths !== void 0) {
           currentFilePaths = this.executionContext.filterFiles(result.filePaths);
           currentMatches = this.executionContext.filterMatchesByFilePaths(
@@ -2732,9 +3199,9 @@ var SKIPPED_COLOR = "#9b59b6";
 var BRAND_COLOR = "#fbbf24";
 function formatClickableRuleId(ruleId, internalId) {
   if (internalId) {
-    return chalk.underline.dim(
-      `\x1B]8;;https://app.wispbit.com/rules/${internalId}\x1B\\${ruleId}\x1B]8;;\x1B\\`
-    );
+    const url = `https://app.wispbit.com/rules/${internalId}`;
+    const link = `\x1B]8;;${url}\x07${chalk.dim.underline(ruleId)}\x1B]8;;\x07`;
+    return link;
   }
   return chalk.dim(ruleId);
 }
@@ -2855,12 +3322,12 @@ function printSummary(results, summary) {
 `;
     } else {
       const sortedMatches = ruleData.matches.sort((a, b) => a.filePath.localeCompare(b.filePath));
-      const shouldShowCodeSnippets = sortedMatches.length < 10 && sortedMatches.some((match) => match.text && match.text.split("\n").length <= 10);
+      const shouldShowCodeSnippets = sortedMatches.length < 10 && sortedMatches.some((match) => match.text && match.text.split("\n").length <= 20);
       if (shouldShowCodeSnippets) {
         sortedMatches.forEach((match, index) => {
           output += `  ${match.filePath}
 `;
-          if (match.text && match.text.split("\n").length <= 10) {
+          if (match.text && match.text.split("\n").length <= 20) {
             const lines = match.text.split("\n");
             lines.forEach((line, lineIndex) => {
               const lineNumber = match.line + lineIndex;
@@ -2888,24 +3355,22 @@ function printSummary(results, summary) {
 `;
     }
   });
+  console.log(output);
   const total = violationCount + suggestionCount;
-  if (total === 0) {
-    console.log(`
-no results`);
-  }
   const violationText = violationCount > 0 ? `${chalk.dim("violations".padStart(12))} ${chalk.hex(VIOLATION_COLOR)("\u25A0")} ${chalk.hex(VIOLATION_COLOR).bold(violationCount)}` : `${chalk.dim("violations".padStart(12))} ${chalk.dim(violationCount)}`;
   const suggestionText = suggestionCount > 0 ? `${chalk.dim("suggestions".padStart(12))} ${chalk.hex(SUGGESTION_COLOR)("\u25CF")} ${chalk.hex(SUGGESTION_COLOR).bold(suggestionCount)}` : `${chalk.dim("suggestions".padStart(12))} ${chalk.dim(suggestionCount)}`;
   const filesText = summary.totalFiles ? `${summary.totalFiles} ${pluralize("file", summary.totalFiles)}` : "0 files";
   const rulesText = `${summary.totalRules} ${pluralize("rule", summary.totalRules)}`;
   const timeText = summary.executionTime ? `${Math.round(summary.executionTime)}ms` : "";
   const detailsText = [filesText, rulesText, timeText].filter(Boolean).join(", ");
-  output += `${violationText}
+  let summaryOutput = "";
+  summaryOutput += `${violationText}
 `;
-  output += `${suggestionText}
+  summaryOutput += `${suggestionText}
 `;
-  output += `${chalk.dim("summary".padStart(12))} ${detailsText}
+  summaryOutput += `${chalk.dim("summary".padStart(12))} ${detailsText}
 `;
-  console.log(total > 0 ? chalk.reset(output) : output);
+  console.log(total > 0 ? chalk.reset(summaryOutput) : summaryOutput);
   if (violationCount > 0) {
     process.exit(1);
   }
@@ -3336,6 +3801,9 @@ async function saveApiKey(apiKey) {
   await fs5.writeFile(configPath, JSON.stringify(newConfig, null, 2));
 }
 async function loadApiKey() {
+  if (process.env.WISPBIT_API_KEY) {
+    return process.env.WISPBIT_API_KEY;
+  }
   const configPath = getConfigFilePath();
   try {
     const configContent = await fs5.readFile(configPath, "utf-8");
@@ -3406,13 +3874,13 @@ https://wispbit.com/
 Usage:
   $ wispbit [diff-options] (run diff by default)
   $ wispbit check [file-path/directory] [check-options]
-  $ wispbit diff [diff-options]
+  $ wispbit diff [commit] [diff-options]
   $ wispbit list
   $ wispbit cache purge
 
 Commands:
-  check [file-path/directory]                  Run linting rules against a specific file/folder or entire codebase
-  diff                               Run linting rules only on changed files in the current PR
+  check [file-path/directory]        Run linting rules against a specific file/folder or entire codebase
+  diff [commit]                      Run linting rules on changed files
   list                               List all available rules with their ID, message, and severity
   cache purge                        Purge the cache directory (indexes, caching, etc.)
 
@@ -3424,10 +3892,21 @@ Options for check:
 Options for diff:
   --rule <ruleId>                    Optional rule ID to run specific rule
   --json [format]                    Output in JSON format (pretty, stream, compact)
-  --base <commit>                    Base commit/branch/SHA to compare against (defaults to origin/main)
-  --head <commit>                    Head commit/branch/SHA to compare against (defaults to current branch)
+  --include <types>                  Include change types (comma-separated): committed, staged, unstaged, untracked
+                                     \u2022 committed: All committed changes (modified, deleted, renamed)
+                                     \u2022 staged: Only staged changes ready to commit
+                                     \u2022 unstaged: Only unstaged tracked file modifications
+                                     \u2022 untracked: Only new untracked files
+                                     (default: all four types)
   -d, --debug                        Enable debug output
 
+Diff examples:
+  $ wispbit diff                     Show all changes (default: committed,staged,unstaged,untracked)
+  $ wispbit diff --include staged    Show only staged changes
+  $ wispbit diff --include staged,untracked  Show staged and untracked changes
+  $ wispbit diff HEAD~3              Compare working directory against 3 commits ago
+  $ wispbit diff main..HEAD          Compare against main branch including worktree changes
+  $ wispbit abc123 --include committed Compare against specific commit SHA, show only committed
 
 Global options:
   -v, --version                      Show version number
@@ -3443,10 +3922,8 @@ Global options:
       json: {
         type: "string"
       },
-      base: {
-        type: "string"
-      },
-      head: {
+      // Diff include
+      include: {
         type: "string"
       },
       // Debug option
@@ -3472,14 +3949,43 @@ async function executeCommand(options) {
   const environment = new Environment();
   const config = await ensureConfigured();
   const { ruleId, json: json2, mode, filePath } = options;
+  let { commitSelector, diffInclude } = options;
+  if (mode === "diff") {
+    const repoRoot = environment.getWorkspaceRoot();
+    if (!commitSelector) {
+      const defaults = await getDefaultCommitSelector(repoRoot);
+      commitSelector = defaults.commitSelector;
+      if (!diffInclude) {
+        diffInclude = defaults.include;
+      }
+    } else {
+      if (!diffInclude) {
+        const defaults = await getDefaultCommitSelector(repoRoot);
+        diffInclude = defaults.include;
+      }
+    }
+  }
+  if (mode === "diff" && commitSelector && diffInclude) {
+    const repoRoot = environment.getWorkspaceRoot();
+    const currentBranch = await getCurrentBranch(repoRoot);
+    const validationError = validateWorktreeIncludes(commitSelector, diffInclude, currentBranch);
+    if (validationError) {
+      console.error(chalk4.red(validationError));
+      process.exit(1);
+    }
+  }
   let jsonOutput = false;
   let jsonFormat = "pretty";
-  if (json2) {
+  if (json2 !== void 0) {
     jsonOutput = true;
-    if (json2 === "stream") {
-      jsonFormat = "stream";
-    } else if (json2 === "compact") {
-      jsonFormat = "compact";
+    if (typeof json2 === "string") {
+      if (json2 === "stream") {
+        jsonFormat = "stream";
+      } else if (json2 === "compact") {
+        jsonFormat = "compact";
+      } else {
+        jsonFormat = "pretty";
+      }
     } else {
       jsonFormat = "pretty";
     }
@@ -3508,26 +4014,30 @@ async function executeCommand(options) {
     }
     throw error;
   }
-  if (!json2) {
+  if (!jsonOutput) {
     if (mode === "check") {
       const modeBox = chalk4.bgHex("#eab308").black(" CHECK ");
       const targetInfo = chalk4.dim(` (${filePath || "all files"})`);
       console.log(`${modeBox}${targetInfo}`);
     } else {
-      const baseCommit = cli.flags.base || "origin/main";
-      const headCommit = cli.flags.head || "HEAD";
       const modeBox = chalk4.bgHex("#4a90e2").black(" DIFF ");
-      const branchInfo = chalk4.dim(` (${headCommit}..${baseCommit})`);
-      console.log(`${modeBox}${branchInfo}`);
+      const truncatedRange = (commitSelector || "").replace(
+        /\b[0-9a-f]{30,}\b/gi,
+        (match) => match.substring(0, 7)
+      );
+      const includeInfo = diffInclude ? ` ${truncatedRange} ${chalk4.dim(`[${diffInclude.join("/")}]`)}` : ` ${truncatedRange}`;
+      console.log(`${modeBox}${includeInfo}`);
     }
   }
   const eventEmitter = new ExecutionEventEmitter();
   if (mode === "check") {
     eventEmitter.setExecutionMode("check", { filePath });
   } else {
-    const baseCommit = cli.flags.base || "origin/main";
-    const headCommit = cli.flags.head || "current branch";
-    eventEmitter.setExecutionMode("diff", { baseCommit, headCommit });
+    const includeDisplay = diffInclude ? diffInclude.join(", ") : "all";
+    eventEmitter.setExecutionMode("diff", {
+      baseCommit: commitSelector || "",
+      headCommit: includeDisplay
+    });
   }
   const cleanupTerminalReporter = !options.json ? setupTerminalReporter(eventEmitter, options.debug || false) : void 0;
   const executionStartTime = Date.now();
@@ -3539,7 +4049,10 @@ async function executeCommand(options) {
   const ruleResults = await ruleExecutor.execute(rules, {
     mode,
     filePath,
-    baseSha: cli.flags.base
+    diffOptions: mode === "diff" ? {
+      include: diffInclude,
+      commitSelector
+    } : void 0
   });
   const results = [];
   for (const ruleResult of ruleResults) {
@@ -3574,9 +4087,16 @@ async function executeCommand(options) {
     if (mode === "check") {
       executionModeInfo = { mode: "check", filePath };
     } else {
-      const baseCommit = cli.flags.base || "origin/main";
-      const headCommit = cli.flags.head || "current branch";
-      executionModeInfo = { mode: "diff", baseCommit, headCommit };
+      const truncatedRange = (commitSelector || "").replace(
+        /\b[0-9a-f]{30,}\b/gi,
+        (match) => match.substring(0, 7)
+      );
+      const includeDisplay = diffInclude ? diffInclude.join(", ") : "all";
+      executionModeInfo = {
+        mode: "diff",
+        baseCommit: truncatedRange,
+        headCommit: includeDisplay
+      };
     }
     const executionTime = Date.now() - executionStartTime;
     printSummary(results, {
@@ -3616,11 +4136,30 @@ async function main() {
       break;
     }
     case "diff": {
+      let diffInclude;
+      if (cli.flags.include) {
+        const includeString = cli.flags.include;
+        const includes = includeString.split(",").map((f) => f.trim());
+        const validIncludes = ["committed", "staged", "unstaged", "untracked"];
+        const invalidIncludes = includes.filter((f) => !validIncludes.includes(f));
+        if (invalidIncludes.length > 0) {
+          console.error(
+            chalk4.red(
+              `Invalid include(s): ${invalidIncludes.join(", ")}. Valid includes: ${validIncludes.join(", ")}`
+            )
+          );
+          process.exit(1);
+        }
+        diffInclude = includes;
+      }
+      const commitSelector = cli.input[1];
       await executeCommand({
         ruleId: cli.flags.rule,
         json: cli.flags.json,
         debug: cli.flags.debug,
-        mode: "diff"
+        mode: "diff",
+        diffInclude,
+        commitSelector
       });
       break;
     }
@@ -3645,18 +4184,31 @@ ${chalk4.green("Cache purged successfully.")} Removed ${result.deletedCount} ite
       break;
     }
     default: {
-      if (!command) {
-        await executeCommand({
-          ruleId: cli.flags.rule,
-          json: cli.flags.json,
-          debug: cli.flags.debug,
-          mode: "diff"
-        });
-      } else {
-        console.error(chalk4.red("Unknown command:"), command);
-        cli.showHelp();
-        process.exit(1);
+      let diffInclude;
+      if (cli.flags.include) {
+        const includeString = cli.flags.include;
+        const includes = includeString.split(",").map((f) => f.trim());
+        const validIncludes = ["committed", "staged", "unstaged", "untracked"];
+        const invalidIncludes = includes.filter((f) => !validIncludes.includes(f));
+        if (invalidIncludes.length > 0) {
+          console.error(
+            chalk4.red(
+              `Invalid include(s): ${invalidIncludes.join(", ")}. Valid includes: ${validIncludes.join(", ")}`
+            )
+          );
+          process.exit(1);
+        }
+        diffInclude = includes;
       }
+      const commitSelector = cli.input[0];
+      await executeCommand({
+        ruleId: cli.flags.rule,
+        json: cli.flags.json,
+        debug: cli.flags.debug,
+        mode: "diff",
+        diffInclude,
+        commitSelector
+      });
       break;
     }
   }