@wrongstack/plugins 0.287.0 → 0.289.0

package/dist/spec-linker.js

@@ -486,10 +486,10 @@ async function runAutoDoc(input, api) {
       continue;
     }
     try {
-      const { readFileSync: readFileSync25, writeFileSync: writeFileSync8 } = await import("node:fs");
+      const { readFileSync: readFileSync26, writeFileSync: writeFileSync8 } = await import("node:fs");
       let content;
       try {
-        content = readFileSync25(safeFile, "utf-8");
+        content = readFileSync26(safeFile, "utf-8");
       } catch {
         api.log.warn(`auto-doc: could not read file ${safeFile}`);
         continue;
@@ -890,14 +890,14 @@ function hasDisabledPluginEntry(raw) {
   });
 }
 function runGit(args, cwd, signal) {
-  return new Promise((resolve27, reject) => {
+  return new Promise((resolve28, reject) => {
     execFile(
       "git",
       args,
       { encoding: "utf-8", timeout: 3e3, cwd, windowsHide: true, signal },
       (error, stdout) => {
         if (error) reject(error);
-        else resolve27(stdout);
+        else resolve28(stdout);
       }
     );
   });
@@ -2866,11 +2866,13 @@ var digestCounters = {
   mailboxDigestErrors: 0
 };
 function readCostTrackerConfig(raw) {
+  const digestEveryN = raw?.["mailboxDigestEveryN"];
+  const digestTo = raw?.["mailboxDigestTo"];
   return {
     budgetLimit: typeof raw?.["budgetLimit"] === "number" ? raw["budgetLimit"] : 0,
     warningThreshold: typeof raw?.["warningThreshold"] === "number" ? raw["warningThreshold"] : 80,
-    mailboxDigestEveryN: typeof raw?.["mailboxDigestEveryN"] === "number" && raw?.["mailboxDigestEveryN"] >= 0 ? Math.floor(raw?.["mailboxDigestEveryN"]) : 0,
-    mailboxDigestTo: typeof raw?.["mailboxDigestTo"] === "string" && (raw?.["mailboxDigestTo"]).length > 0 ? raw?.["mailboxDigestTo"] : "cost-tracker"
+    mailboxDigestEveryN: typeof digestEveryN === "number" && digestEveryN >= 0 ? Math.floor(digestEveryN) : 0,
+    mailboxDigestTo: typeof digestTo === "string" && digestTo.length > 0 ? digestTo : "cost-tracker"
   };
 }
 function estimateCost(model, promptTokens, completionTokens) {
@@ -3839,7 +3841,8 @@ import { execFileSync } from "node:child_process";
 
 // src/runtime/index.ts
 import { execFile as execFile2 } from "node:child_process";
-import { basename, isAbsolute as isAbsolute5, relative as relative5, resolve as resolve5 } from "node:path";
+import { existsSync, readdirSync, statSync as statSync3 } from "node:fs";
+import { basename, extname, isAbsolute as isAbsolute5, relative as relative5, resolve as resolve5 } from "node:path";
 
 // src/runtime/llm.ts
 function stripOuterMarkdownFence(text) {
@@ -3986,12 +3989,15 @@ function runRunnerCommand(argv, options) {
       });
       return;
     }
-    const timedOut = false;
+    let timedOut = false;
     let spawnErrored = false;
     const stdoutChunks = [];
     const stderrChunks = [];
     let stdoutBytes = 0;
     let stderrBytes = 0;
+    options.signal?.addEventListener("abort", () => {
+      timedOut = true;
+    }, { once: true });
     const child = execFile2(
       argv[0],
       argv.slice(1),
@@ -4003,12 +4009,12 @@ function runRunnerCommand(argv, options) {
         windowsHide: true,
         shell: false
       },
-      (err, stdout, stderr) => {
+      (err) => {
         if (timedOut) {
           resolvePromise({
             code: null,
-            stdout: Buffer.concat([...stdoutChunks, ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]]).toString("utf8"),
-            stderr: Buffer.concat([...stderrChunks, ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]]).toString("utf8"),
+            stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+            stderr: Buffer.concat(stderrChunks).toString("utf8"),
             timedOut: true,
             spawnError: false
           });
@@ -4017,8 +4023,8 @@ function runRunnerCommand(argv, options) {
         if (spawnErrored) {
           resolvePromise({
             code: 127,
-            stdout: Buffer.concat([...stdoutChunks, ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]]).toString("utf8"),
-            stderr: Buffer.concat([...stderrChunks, ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]]).toString("utf8"),
+            stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+            stderr: Buffer.concat(stderrChunks).toString("utf8"),
             timedOut: false,
             spawnError: true
           });
@@ -4029,14 +4035,8 @@ function runRunnerCommand(argv, options) {
           const code = typeof anyErr.code === "number" ? anyErr.code : 1;
           resolvePromise({
             code,
-            stdout: Buffer.concat([
-              ...stdoutChunks,
-              ...anyErr.stdout ? [Buffer.isBuffer(anyErr.stdout) ? anyErr.stdout : Buffer.from(anyErr.stdout)] : []
-            ]).toString("utf8"),
-            stderr: Buffer.concat([
-              ...stderrChunks,
-              ...anyErr.stderr ? [Buffer.isBuffer(anyErr.stderr) ? anyErr.stderr : Buffer.from(anyErr.stderr)] : []
-            ]).toString("utf8"),
+            stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+            stderr: Buffer.concat(stderrChunks).toString("utf8"),
             timedOut: false,
             spawnError: false
           });
@@ -4044,19 +4044,18 @@ function runRunnerCommand(argv, options) {
         }
         resolvePromise({
           code: 0,
-          stdout: Buffer.concat([
-            ...stdoutChunks,
-            ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]
-          ]).toString("utf8"),
-          stderr: Buffer.concat([
-            ...stderrChunks,
-            ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]
-          ]).toString("utf8"),
+          stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+          stderr: Buffer.concat(stderrChunks).toString("utf8"),
           timedOut: false,
           spawnError: false
         });
       }
     );
+    child.on("exit", (_code, signal) => {
+      if (signal !== null) {
+        timedOut = true;
+      }
+    });
     child.stdout?.on("data", (chunk) => {
       stdoutBytes += chunk.length;
       if (stdoutBytes <= MAX_BUFFER_BYTES) stdoutChunks.push(chunk);
@@ -4075,6 +4074,47 @@ function runRunnerCommand(argv, options) {
 function withinProject(p) {
   return withinProjectPath(process.cwd(), p) || relative5(process.cwd(), p) === ".";
 }
+var DEFAULT_EXCLUDE_DIRS = ["node_modules", "dist", ".git", "coverage"];
+function collectSourceFiles(root, opts) {
+  const files = [];
+  if (!existsSync(root)) return files;
+  const s = statSync3(root);
+  if (s.isFile()) {
+    if (matchesExtension(root, opts.extensions)) files.push(root);
+    return files;
+  }
+  if (!s.isDirectory()) return files;
+  const exclude = opts.excludeDirs ?? DEFAULT_EXCLUDE_DIRS;
+  function walk(dir, depth) {
+    if (opts.maxDepth !== void 0 && depth > opts.maxDepth) return;
+    let entries;
+    try {
+      entries = readdirSync(dir);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (exclude.includes(entry)) continue;
+      const full = resolve5(dir, entry);
+      let st;
+      try {
+        st = statSync3(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        walk(full, depth + 1);
+      } else if (st.isFile() && matchesExtension(full, opts.extensions)) {
+        files.push(full);
+      }
+    }
+  }
+  walk(root, 0);
+  return files;
+}
+function matchesExtension(p, exts) {
+  return exts.includes(extname(p).toLowerCase());
+}
 
 // src/diff-summary/index.ts
 var API_VERSION6 = "^0.1.10";
@@ -4665,7 +4705,7 @@ var error_lens_default = plugin14;
 
 // src/file-watcher/index.ts
 import { watch as fsWatch } from "node:fs";
-import { isAbsolute as isAbsolute6, relative as relative6, resolve as resolve6 } from "node:path";
+import { isAbsolute as isAbsolute6, join, relative as relative6, resolve as resolve6 } from "node:path";
 var API_VERSION7 = "^0.1.10";
 function withinProject2(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
@@ -4774,7 +4814,11 @@ var plugin15 = {
       try {
         const watcher = fsWatch(dirPath, { recursive }, (eventType, filename) => {
           if (!filename) return;
-          const fullPath = `${dirPath}/${filename}`;
+          if (handle.events.length > 0 && !(eventType === "change" ? handle.events.includes("change") : handle.events.includes("add") || handle.events.includes("delete"))) {
+            return;
+          }
+          const rawPath = filename.startsWith(dirPath) ? filename : join(dirPath, filename);
+          const fullPath = rawPath.replace(/\\/g, "/");
           const key = `${handle.id}:${fullPath}:${eventType}`;
           debounceEvent(
             key,
@@ -4993,7 +5037,7 @@ var file_watcher_default = plugin15;
 
 // src/format-on-save/index.ts
 import { execFileSync as execFileSync2, execSync } from "node:child_process";
-import { existsSync, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync2, statSync as statSync4 } from "node:fs";
 var API_VERSION8 = "^0.1.10";
 var state14 = {
   invocationCount: 0,
@@ -5054,10 +5098,10 @@ function evictExpired(ttlMs) {
 }
 function formatFile(filePath, timeoutMs) {
   if (!withinProject(filePath)) return null;
-  if (!existsSync(filePath)) return null;
+  if (!existsSync2(filePath)) return null;
   let bytesBefore;
   try {
-    bytesBefore = statSync3(filePath).size;
+    bytesBefore = statSync4(filePath).size;
   } catch {
     return null;
   }
@@ -5074,7 +5118,7 @@ function formatFile(filePath, timeoutMs) {
   }
   let bytesAfter;
   try {
-    bytesAfter = statSync3(filePath).size;
+    bytesAfter = statSync4(filePath).size;
   } catch {
     return null;
   }
@@ -5280,7 +5324,7 @@ var format_on_save_default = plugin16;
 
 // src/git-autocommit/index.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync as existsSync3 } from "node:fs";
 var API_VERSION9 = "^0.1.10";
 var commitCount = { value: 0 };
 var lastCommit = { hash: null, at: null };
@@ -5315,7 +5359,7 @@ function stageFiles(files, cwd) {
   if (!files || !Array.isArray(files)) return;
   const existing = files.filter((f) => {
     try {
-      return existsSync2(f);
+      return existsSync3(f);
     } catch {
       return false;
     }
@@ -5740,7 +5784,7 @@ var git_autocommit_default = plugin17;
 
 // src/import-organizer/index.ts
 import { spawn } from "node:child_process";
-import { existsSync as existsSync3, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync4, statSync as statSync5 } from "node:fs";
 import { basename as basename2, isAbsolute as isAbsolute7 } from "node:path";
 var ALLOWED_FIRST_TOKENS = /* @__PURE__ */ new Set([
   "npx",
@@ -5802,7 +5846,7 @@ function readConfig13(raw) {
   };
 }
 function runCommand(command, args, timeoutMs, cwd) {
-  return new Promise((resolve27) => {
+  return new Promise((resolve28) => {
     let timedOut = false;
     const stdoutChunks = [];
     const stderrChunks = [];
@@ -5814,17 +5858,17 @@ function runCommand(command, args, timeoutMs, cwd) {
         signal: AbortSignal.timeout(timeoutMs)
       });
     } catch {
-      resolve27({ code: 127, stdout: "", stderr: "", timedOut: false });
+      resolve28({ code: 127, stdout: "", stderr: "", timedOut: false });
       return;
     }
     child.stdout?.on("data", (c) => stdoutChunks.push(c));
     child.stderr?.on("data", (c) => stderrChunks.push(c));
     child.on("error", () => {
-      resolve27({ code: 127, stdout: "", stderr: "", timedOut: false });
+      resolve28({ code: 127, stdout: "", stderr: "", timedOut: false });
     });
     child.on("close", (code) => {
       if (timedOut) return;
-      resolve27({
+      resolve28({
         code,
         stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
         stderr: Buffer.concat(stderrChunks).toString("utf-8"),
@@ -5833,16 +5877,16 @@ function runCommand(command, args, timeoutMs, cwd) {
     });
     child.on("abort", () => {
       timedOut = true;
-      resolve27({ code: null, stdout: "", stderr: "", timedOut: true });
+      resolve28({ code: null, stdout: "", stderr: "", timedOut: true });
     });
   });
 }
 async function organizeImports(filePath, cfg, cwd) {
   if (!withinProject(filePath)) return null;
-  if (!existsSync3(filePath)) return null;
+  if (!existsSync4(filePath)) return null;
   let bytesBefore;
   try {
-    bytesBefore = statSync4(filePath).size;
+    bytesBefore = statSync5(filePath).size;
   } catch {
     return null;
   }
@@ -5863,7 +5907,7 @@ async function organizeImports(filePath, cfg, cwd) {
   if (result.code === 127) return null;
   let bytesAfter;
   try {
-    bytesAfter = statSync4(filePath).size;
+    bytesAfter = statSync5(filePath).size;
   } catch {
     return null;
   }
@@ -6589,9 +6633,11 @@ var knowledge_graph_default = plugin20;
 
 // src/lint-gate/index.ts
 import { execFile as execFile3 } from "node:child_process";
+import { readFileSync as readFileSync6 } from "node:fs";
 import { mkdtemp, readFile as readFile2, rm, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname as dirname4, isAbsolute as isAbsolute9, join as join2, relative as relative8, resolve as resolve8, sep } from "node:path";
 var API_VERSION12 = "^0.1.10";
 var state18 = {
   /** Total PreToolUse invocations. */
@@ -6625,55 +6671,74 @@ function readConfig16(raw) {
     fixRules: Array.isArray(r["fixRules"]) ? r["fixRules"].filter((x) => typeof x === "string") : []
   };
 }
-function executable(command) {
-  return process.platform === "win32" && command === "npx" ? "npx.cmd" : command;
+var LINTER_PACKAGES = {
+  biome: "@biomejs/biome",
+  eslint: "eslint"
+};
+function isInside(parent, candidate) {
+  const rel = relative8(parent, candidate);
+  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute9(rel);
+}
+function resolveLocalLinter(name, cwd) {
+  try {
+    const packageName = LINTER_PACKAGES[name];
+    const requireFromProject = createRequire(resolve8(cwd, "package.json"));
+    const packagePath = requireFromProject.resolve(`${packageName}/package.json`);
+    const packageJson = JSON.parse(readFileSync6(packagePath, "utf-8"));
+    const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.[name] ?? Object.values(packageJson.bin ?? {})[0];
+    if (!relativeBin || isAbsolute9(relativeBin)) return null;
+    const packageDir = dirname4(packagePath);
+    const entry = resolve8(packageDir, relativeBin);
+    if (!isInside(packageDir, entry)) return null;
+    return {
+      cmd: process.execPath,
+      args: name === "biome" ? [entry, "check", "--reporter=json"] : [entry, "--format=json"],
+      name
+    };
+  } catch {
+    return null;
+  }
 }
-function runCommand2(command, args, timeoutMs, signal) {
-  return new Promise((resolve27) => {
+function runCommand2(command, args, timeoutMs, cwd, signal) {
+  return new Promise((resolveResult) => {
     try {
       execFile3(
-        executable(command),
+        command,
         args,
         {
           encoding: "utf-8",
           timeout: timeoutMs,
-          cwd: process.cwd(),
+          cwd,
           windowsHide: true,
+          shell: false,
           maxBuffer: 2 * 1024 * 1024,
           ...signal ? { signal } : {}
         },
-        (error, stdout) => resolve27({ stdout, error })
+        (error, stdout) => resolveResult({ stdout, error })
       );
     } catch (err) {
-      resolve27({ stdout: "", error: err instanceof Error ? err : new Error(String(err)) });
+      resolveResult({ stdout: "", error: err instanceof Error ? err : new Error(String(err)) });
     }
   });
 }
-async function detectLinter(requested) {
-  const tryBiome = requested === "biome" || requested === "auto";
-  const tryEslint = requested === "eslint" || requested === "auto";
-  if (tryBiome) {
-    const probe = await runCommand2("npx", ["biome", "--version"], 5e3);
-    if (!probe.error) {
-      return { cmd: "npx", args: ["biome", "check", "--reporter=json"], name: "biome" };
-    }
-  }
-  if (tryEslint) {
-    const probe = await runCommand2("npx", ["eslint", "--version"], 5e3);
-    if (!probe.error) {
-      return { cmd: "npx", args: ["eslint", "--format=json"], name: "eslint" };
-    }
+async function detectLinter(requested, cwd) {
+  const candidates = requested === "auto" ? ["biome", "eslint"] : [requested];
+  for (const name of candidates) {
+    const linter = resolveLocalLinter(name, cwd);
+    if (!linter) continue;
+    const probe = await runCommand2(linter.cmd, [linter.args[0], "--version"], 5e3, cwd);
+    if (!probe.error) return linter;
   }
   return null;
 }
-async function lintContent(content, filePath, linter, timeoutMs, signal) {
+async function lintContent(content, filePath, linter, timeoutMs, cwd, signal) {
   const ext = filePath.includes(".") ? filePath.slice(filePath.lastIndexOf(".")) : ".ts";
-  const tmpDir = await mkdtemp(join(tmpdir(), "lint-gate-"));
-  const tmpFile = join(tmpDir, `input${ext}`);
+  const tmpDir = await mkdtemp(join2(tmpdir(), "lint-gate-"));
+  const tmpFile = join2(tmpDir, `input${ext}`);
   try {
     await writeFile(tmpFile, content, "utf-8");
     const fullArgs = [...linter.args, tmpFile];
-    const result = await runCommand2(linter.cmd, fullArgs, timeoutMs, signal);
+    const result = await runCommand2(linter.cmd, fullArgs, timeoutMs, cwd, signal);
     if (signal.aborted) throw signal.reason;
     if (result.error && !result.stdout) return null;
     return parseLinterOutput(result.stdout, linter.name);
@@ -6684,14 +6749,14 @@ async function lintContent(content, filePath, linter, timeoutMs, signal) {
     await rm(tmpDir, { recursive: true, force: true }).catch(() => void 0);
   }
 }
-async function lintAndFix(content, filePath, linter, timeoutMs, signal) {
+async function lintAndFix(content, filePath, linter, timeoutMs, cwd, signal) {
   const ext = filePath.includes(".") ? filePath.slice(filePath.lastIndexOf(".")) : ".ts";
-  const tmpDir = await mkdtemp(join(tmpdir(), "lint-gate-fix-"));
-  const tmpFile = join(tmpDir, `input${ext}`);
+  const tmpDir = await mkdtemp(join2(tmpdir(), "lint-gate-fix-"));
+  const tmpFile = join2(tmpDir, `input${ext}`);
   try {
     await writeFile(tmpFile, content, "utf-8");
-    const fixArgs = linter.name === "biome" ? ["biome", "check", "--write", tmpFile] : ["eslint", "--fix", tmpFile];
-    await runCommand2(linter.cmd, fixArgs, timeoutMs, signal);
+    const fixArgs = linter.name === "biome" ? [linter.args[0], "check", "--write", tmpFile] : [linter.args[0], "--fix", tmpFile];
+    await runCommand2(linter.cmd, fixArgs, timeoutMs, cwd, signal);
     if (signal.aborted) throw signal.reason;
     return await readFile2(tmpFile, "utf-8");
   } catch {
@@ -6792,7 +6857,8 @@ var plugin21 = {
     state18.hookUnregister = null;
     state18.lastResult = null;
     const cfg = readConfig16(api.config.extensions?.["lint-gate"]);
-    const linterReady = detectLinter(cfg.linter).then((linter) => {
+    const cwd = resolve8(api.config.cwd ?? process.cwd());
+    const linterReady = detectLinter(cfg.linter, cwd).then((linter) => {
       if (!linter) {
         api.log.warn("lint-gate: no linter found (biome or eslint) \u2014 hook will be a no-op", {
           requested: cfg.linter
@@ -6829,7 +6895,14 @@ var plugin21 = {
       } else {
         return;
       }
-      const issues = await lintContent(content, filePath, linter, cfg.timeoutMs, runtime.signal);
+      const issues = await lintContent(
+        content,
+        filePath,
+        linter,
+        cfg.timeoutMs,
+        cwd,
+        runtime.signal
+      );
       if (issues === null) {
         state18.linterErrorCount += 1;
         return;
@@ -6869,6 +6942,7 @@ ${summary}${truncated}`
             filePath,
             linter,
             cfg.timeoutMs,
+            cwd,
             runtime.signal
           );
           if (fixedContent !== content) {
@@ -6907,6 +6981,7 @@ ${remainingSummary}` : "")
               filePath,
               linter,
               cfg.timeoutMs,
+              cwd,
               runtime.signal
             );
             if (fixedNewStr !== newStr) {
@@ -7366,7 +7441,7 @@ function hashString2(value) {
 }
 async function gitDiffFingerprint(cwd, signal) {
   try {
-    const diff = await new Promise((resolve27, reject) => {
+    const diff = await new Promise((resolve28, reject) => {
       execFile4(
         "git",
         ["diff", "--no-ext-diff", "--"],
@@ -7383,7 +7458,7 @@ async function gitDiffFingerprint(cwd, signal) {
         },
         (error, stdout) => {
           if (error) reject(error);
-          else resolve27(stdout);
+          else resolve28(stdout);
         }
       );
     });
@@ -8641,7 +8716,7 @@ var plugin_stack_observer_default = PLUGIN;
 // src/pr-drafter/index.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname4, isAbsolute as isAbsolute9, relative as relative8, resolve as resolve8 } from "node:path";
+import { dirname as dirname5, isAbsolute as isAbsolute10, relative as relative9, resolve as resolve9 } from "node:path";
 var API_VERSION13 = "^0.1.10";
 var state25 = {
   commits: [],
@@ -8680,10 +8755,10 @@ function readConfig23(raw) {
 }
 function resolveProjectPath6(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
-  const root = resolve8(cwd);
-  const resolved = isAbsolute9(rawPath) ? resolve8(rawPath) : resolve8(root, rawPath);
-  const rel = relative8(root, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute9(rel)) return resolved;
+  const root = resolve9(cwd);
+  const resolved = isAbsolute10(rawPath) ? resolve9(rawPath) : resolve9(root, rawPath);
+  const rel = relative9(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute10(rel)) return resolved;
   return null;
 }
 function gitBranch() {
@@ -8770,7 +8845,7 @@ async function writeDraft(cfg, llm) {
   }
   const draft = await buildDraft(cfg, llm);
   try {
-    mkdirSync4(dirname4(resolved), { recursive: true });
+    mkdirSync4(dirname5(resolved), { recursive: true });
     writeFileSync5(resolved, draft.body);
     state25.draftsWritten += 1;
   } catch {
@@ -8897,7 +8972,7 @@ var plugin27 = {
         const resolved = resolveProjectPath6(cfg.outputPath);
         if (!resolved) return { ok: false, error: "outputPath resolves outside project" };
         try {
-          mkdirSync4(dirname4(resolved), { recursive: true });
+          mkdirSync4(dirname5(resolved), { recursive: true });
           writeFileSync5(resolved, draft.body);
           state25.draftsWritten += 1;
           return {
@@ -9048,7 +9123,7 @@ function redactDeep(value, allow, counter) {
 function readConfig24(raw) {
   const base = {
     enabled: false,
-    mode: "warn",
+    mode: "redact",
     scanResponse: true,
     allow: []
   };
@@ -9063,7 +9138,7 @@ function readConfig24(raw) {
   }) : [];
   return {
     enabled: r["enabled"] === true,
-    mode: r["mode"] === "redact" ? "redact" : r["mode"] === "block" ? "block" : "warn",
+    mode: r["mode"] === "warn" ? "warn" : r["mode"] === "block" ? "block" : "redact",
     scanResponse: r["scanResponse"] !== false,
     allow
   };
@@ -9081,10 +9156,10 @@ var state26 = {
 var plugin28 = {
   name: "prompt-firewall",
   version: "0.1.0",
-  description: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); warn/redact/block. Opt-in; warn by default.",
+  description: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
   apiVersion: "^0.1.10",
   capabilities: { tools: true },
-  defaultConfig: { enabled: false, mode: "warn", scanResponse: true, allow: [] },
+  defaultConfig: { enabled: false, mode: "redact", scanResponse: true, allow: [] },
   configSchema: {
     type: "object",
     properties: {
@@ -9096,8 +9171,8 @@ var plugin28 = {
       mode: {
         type: "string",
         enum: ["warn", "redact", "block"],
-        default: "warn",
-        description: "warn = detect only; redact = strip secrets from the request/response; block = refuse the request."
+        default: "redact",
+        description: "redact (default) = strip secrets from the request/response; warn = detect only; block = refuse the request."
       },
       scanResponse: {
         type: "boolean",
@@ -9321,6 +9396,8 @@ var BASE_PATTERNS = [
 ];
 var PATTERNS3 = [...BASE_PATTERNS];
 var COMBINED_REGEX = buildCombinedRegex(PATTERNS3);
+var RE_DOS_MAX_SCAN_LENGTH = 1e5;
+var RE_DOS_TIMEOUT_MS = 100;
 function buildCombinedRegex(patterns) {
   return new RegExp(patterns.map((p) => `(${p.regex.source})`).join("|"), "g");
 }
@@ -9341,10 +9418,17 @@ var state27 = {
 };
 function findMatches(text) {
   if (!text) return [];
+  if (text.length > RE_DOS_MAX_SCAN_LENGTH) return [];
   const found = /* @__PURE__ */ new Set();
   COMBINED_REGEX.lastIndex = 0;
   let m;
+  const startTime = performance.now();
   while ((m = COMBINED_REGEX.exec(text)) !== null) {
+    if (performance.now() - startTime > RE_DOS_TIMEOUT_MS) {
+      throw new Error(
+        `secret-scanner: ReDoS timeout \u2014 regex scan exceeded ${RE_DOS_TIMEOUT_MS}ms on ${text.length}-char input`
+      );
+    }
     for (let i = 0; i < PATTERNS3.length; i++) {
       if (m[i + 1] !== void 0) {
         found.add(PATTERNS3[i].type);
@@ -9357,30 +9441,32 @@ function findMatches(text) {
   }
   return Array.from(found);
 }
-function scanInput(input) {
+function scanInput(input, depth = 0) {
   if (input === null || input === void 0) return null;
+  if (depth > 50) return null;
   if (typeof input === "string") {
     const found = findMatches(input);
     return found.length > 0 ? found : null;
   }
   if (Array.isArray(input)) {
     for (const item of input) {
-      const found = scanInput(item);
+      const found = scanInput(item, depth + 1);
       if (found) return found;
     }
     return null;
   }
   if (typeof input === "object") {
     for (const value of Object.values(input)) {
-      const found = scanInput(value);
+      const found = scanInput(value, depth + 1);
       if (found) return found;
     }
     return null;
   }
   return null;
 }
-function redactInput(input) {
+function redactInput(input, depth = 0) {
   if (input === null || input === void 0) return input;
+  if (depth > 50) return input;
   if (typeof input === "string") {
     return input.replace(COMBINED_REGEX, (_match, ...groups) => {
       for (let i = 0; i < PATTERNS3.length; i++) {
@@ -9392,12 +9478,12 @@ function redactInput(input) {
     });
   }
   if (Array.isArray(input)) {
-    return input.map((item) => redactInput(item));
+    return input.map((item) => redactInput(item, depth + 1));
   }
   if (typeof input === "object") {
     const out = {};
     for (const [k, v] of Object.entries(input)) {
-      out[k] = redactInput(v);
+      out[k] = redactInput(v, depth + 1);
     }
     return out;
   }
@@ -9691,15 +9777,15 @@ var secret_scanner_default = plugin29;
 import { expectDefined as expectDefined2 } from "@wrongstack/core";
 import { toErrorMessage } from "@wrongstack/core/utils";
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync4, readFileSync as readFileSync6, readdirSync, writeFileSync as writeFileSync6 } from "node:fs";
-import { isAbsolute as isAbsolute10, join as join2, relative as relative9, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync7, readdirSync as readdirSync2, writeFileSync as writeFileSync6 } from "node:fs";
+import { isAbsolute as isAbsolute11, join as join3, relative as relative10, resolve as resolve10 } from "node:path";
 var API_VERSION14 = "^0.1.10";
 function resolveProjectRoot(rawCwd, root = process.cwd()) {
   if (typeof rawCwd !== "string" || rawCwd.length === 0) return root;
-  const base = resolve9(root);
-  const resolved = isAbsolute10(rawCwd) ? resolve9(rawCwd) : resolve9(base, rawCwd);
-  const rel = relative9(base, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute10(rel)) return resolved;
+  const base = resolve10(root);
+  const resolved = isAbsolute11(rawCwd) ? resolve10(rawCwd) : resolve10(base, rawCwd);
+  const rel = relative10(base, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute11(rel)) return resolved;
   return null;
 }
 var state28 = {
@@ -9727,24 +9813,24 @@ function runGit3(args, cwd) {
 }
 function getPackageJson(cwd) {
   const path = cwd ? `${cwd}/package.json` : "package.json";
-  if (!existsSync4(path)) return null;
+  if (!existsSync5(path)) return null;
   try {
-    return JSON.parse(readFileSync6(path, "utf-8"));
+    return JSON.parse(readFileSync7(path, "utf-8"));
   } catch {
     return null;
   }
 }
 function collectManifests(root) {
   const paths = [];
-  const rootPkg = join2(root, "package.json");
-  if (existsSync4(rootPkg)) paths.push(rootPkg);
+  const rootPkg = join3(root, "package.json");
+  if (existsSync5(rootPkg)) paths.push(rootPkg);
   for (const group of ["packages", "apps"]) {
-    const groupDir = join2(root, group);
-    if (!existsSync4(groupDir)) continue;
-    for (const entry of readdirSync(groupDir, { withFileTypes: true })) {
+    const groupDir = join3(root, group);
+    if (!existsSync5(groupDir)) continue;
+    for (const entry of readdirSync2(groupDir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
-      const candidate = join2(groupDir, entry.name, "package.json");
-      if (existsSync4(candidate)) paths.push(candidate);
+      const candidate = join3(groupDir, entry.name, "package.json");
+      if (existsSync5(candidate)) paths.push(candidate);
     }
   }
   return paths;
@@ -9934,9 +10020,9 @@ var plugin30 = {
         };
       }
       const root = cwd ?? process.cwd();
-      const bumpScript = join2(root, "scripts", "bump-version.mjs");
+      const bumpScript = join3(root, "scripts", "bump-version.mjs");
       const changed = collectManifests(root);
-      if (existsSync4(bumpScript)) {
+      if (existsSync5(bumpScript)) {
         try {
           execFileSync5(process.execPath, [bumpScript, "set", newVersion], {
             cwd: root,
@@ -9949,12 +10035,12 @@ var plugin30 = {
           return { ok: false, error: `bump script failed: ${msg}` };
         }
         for (const rel of ["package.json", "package-lock.json", "src/lib/utils.ts", "index.html"]) {
-          const p = join2(root, "website", rel);
-          if (existsSync4(p)) changed.push(p);
+          const p = join3(root, "website", rel);
+          if (existsSync5(p)) changed.push(p);
         }
       } else {
         for (const manifest of changed) {
-          const pkgData = JSON.parse(readFileSync6(manifest, "utf-8"));
+          const pkgData = JSON.parse(readFileSync7(manifest, "utf-8"));
           pkgData.version = newVersion;
           writeFileSync6(manifest, JSON.stringify(pkgData, null, 2) + "\n", "utf-8");
         }
@@ -10629,16 +10715,16 @@ var session_recap_default = plugin31;
 
 // src/shell-check/index.ts
 import { execFileSync as execFileSync6, execSync as execSync2 } from "node:child_process";
-import { existsSync as existsSync5, readdirSync as readdirSync2 } from "node:fs";
-import { isAbsolute as isAbsolute11, join as join3, relative as relative10, resolve as resolve10 } from "node:path";
+import { existsSync as existsSync6, readdirSync as readdirSync3 } from "node:fs";
+import { isAbsolute as isAbsolute12, join as join4, relative as relative11, resolve as resolve11 } from "node:path";
 var API_VERSION15 = "^0.1.10";
 function withinProject3(p) {
   const root = process.cwd();
-  const resolved = isAbsolute11(p) ? resolve10(p) : resolve10(root, p);
-  const rel = relative10(root, resolved);
+  const resolved = isAbsolute12(p) ? resolve11(p) : resolve11(root, p);
+  const rel = relative11(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute11(rel)) return false;
+  if (isAbsolute12(rel)) return false;
   return true;
 }
 var MAX_PATH_LEN = 4096;
@@ -10651,7 +10737,7 @@ var state30 = {
   lastRun: null
 };
 function runShellCheck(files, severity, cwd) {
-  if (!existsSync5("shellcheck")) {
+  if (!existsSync6("shellcheck")) {
     try {
       execSync2("shellcheck --version", { encoding: "utf-8", stdio: "ignore", windowsHide: true });
     } catch {
@@ -10703,9 +10789,9 @@ function runShellCheck(files, severity, cwd) {
 function findShellFiles(dir, pattern) {
   const results = [];
   try {
-    const entries = readdirSync2(dir, { withFileTypes: true });
+    const entries = readdirSync3(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = join3(dir, entry.name);
+      const full = join4(dir, entry.name);
       if (entry.isDirectory() && entry.name !== "node_modules" && entry.name !== ".git") {
         results.push(...findShellFiles(full, pattern));
       } else if (entry.isFile() && (entry.name.endsWith(".sh") || entry.name === "Dockerfile")) {
@@ -10906,7 +10992,7 @@ var plugin32 = {
 var shell_check_default = plugin32;
 
 // src/template-engine/index.ts
-import { isAbsolute as isAbsolute12 } from "node:path";
+import { isAbsolute as isAbsolute13 } from "node:path";
 var API_VERSION16 = "^0.1.10";
 var templates = /* @__PURE__ */ new Map();
 function expandTemplate(template, variables) {
@@ -10953,7 +11039,7 @@ function renderTemplateRaw(template, variables) {
   return result;
 }
 function validateRelativeTemplatePath(field, value) {
-  if (isAbsolute12(value) || value.split(/[\\/]+/).includes("..")) {
+  if (isAbsolute13(value) || value.split(/[\\/]+/).includes("..")) {
     return `${field} must be a relative path without ".." components`;
   }
   return null;
@@ -11080,8 +11166,8 @@ var plugin33 = {
         }
         let content;
         try {
-          const { readFileSync: readFileSync25 } = await import("node:fs");
-          content = readFileSync25(template_path, "utf-8");
+          const { readFileSync: readFileSync26 } = await import("node:fs");
+          content = readFileSync26(template_path, "utf-8");
         } catch (err) {
           return { ok: false, error: `Could not read template file: ${err}` };
         }
@@ -11214,8 +11300,8 @@ var plugin33 = {
 var template_engine_default = plugin33;
 
 // src/test-coverage-gate/index.ts
-import { readFileSync as readFileSync7 } from "node:fs";
-import { isAbsolute as isAbsolute13, relative as relative11, resolve as resolve11 } from "node:path";
+import { readFileSync as readFileSync8 } from "node:fs";
+import { isAbsolute as isAbsolute14, relative as relative12, resolve as resolve12 } from "node:path";
 var API_VERSION17 = "^0.1.10";
 var state31 = {
   invocationCount: 0,
@@ -11251,16 +11337,16 @@ function readConfig27(raw) {
 function withinProject4(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute13(p) ? resolve11(p) : resolve11(root, p);
-  const rel = relative11(root, resolved);
+  const resolved = isAbsolute14(p) ? resolve12(p) : resolve12(root, p);
+  const rel = relative12(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute13(rel)) return false;
+  if (isAbsolute14(rel)) return false;
   return true;
 }
 function readCoverageSummary(coveragePath) {
   try {
-    const raw = readFileSync7(coveragePath, "utf-8");
+    const raw = readFileSync8(coveragePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -11477,7 +11563,7 @@ var test_coverage_gate_default = plugin34;
 // src/test-runner-gate/index.ts
 import { execFile as execFile5 } from "node:child_process";
 import { access } from "node:fs/promises";
-import { basename as basename3, dirname as dirname5, isAbsolute as isAbsolute14, join as join4 } from "node:path";
+import { basename as basename3, dirname as dirname6, isAbsolute as isAbsolute15, join as join5 } from "node:path";
 var API_VERSION18 = "^0.1.10";
 var state32 = {
   invocationCount: 0,
@@ -11560,7 +11646,7 @@ var ALLOWED_COMMAND_TOKENS = /* @__PURE__ */ new Set([
 function resolveTestFiles(sourcePath, patterns) {
   const name = basename3(sourcePath).replace(/\.[^.]+$/, "");
   const pathNoExt = sourcePath.replace(/\.[^.]+$/, "");
-  const dir = dirname5(sourcePath);
+  const dir = dirname6(sourcePath);
   const candidates = [];
   for (const pattern of patterns) {
     const candidate = pattern.replace(/\{name\}/g, name).replace(/\{path\}/g, pathNoExt).replace(/\{dir\}/g, dir);
@@ -11569,7 +11655,7 @@ function resolveTestFiles(sourcePath, patterns) {
         candidates.push(candidate);
       } else {
         candidates.push(candidate);
-        candidates.push(join4(dir, candidate));
+        candidates.push(join5(dir, candidate));
       }
     }
   }
@@ -11596,12 +11682,12 @@ async function detectRunner(requested) {
     const match = candidates.find((c) => c.name === requested);
     if (!match) return null;
     try {
-      await new Promise((resolve27, reject) => {
+      await new Promise((resolve28, reject) => {
         execFile5("npx", [`${match.name}`, "--version"], {
           encoding: "utf-8",
           timeout: 5e3,
           cwd: process.cwd()
-        }, (err) => err ? reject(err) : resolve27());
+        }, (err) => err ? reject(err) : resolve28());
       });
       return match;
     } catch {
@@ -11610,12 +11696,12 @@ async function detectRunner(requested) {
   }
   for (const candidate of candidates) {
     try {
-      await new Promise((resolve27, reject) => {
+      await new Promise((resolve28, reject) => {
         execFile5("npx", [`${candidate.name}`, "--version"], {
           encoding: "utf-8",
           timeout: 5e3,
           cwd: process.cwd()
-        }, (err) => err ? reject(err) : resolve27());
+        }, (err) => err ? reject(err) : resolve28());
       });
       return candidate;
     } catch {
@@ -11630,7 +11716,7 @@ function resolveAllowedCommand2(customCommand) {
   if (ALLOWED_COMMAND_TOKENS.has(head)) {
     return { cmd: head, args: tokens.slice(1) };
   }
-  if (isAbsolute14(head)) {
+  if (isAbsolute15(head)) {
     if (!withinProject(head)) return null;
     const base = basename3(head);
     if (ALLOWED_COMMAND_TOKENS.has(base)) {
@@ -11661,14 +11747,14 @@ async function runTests(testFile, runner, customCommand, timeoutMs) {
   let stdout = "";
   try {
     const { stdout: out } = await new Promise(
-      (resolve27, reject) => {
+      (resolve28, reject) => {
         execFile5(
           cmd,
           fullArgs,
           { encoding: "utf-8", timeout: timeoutMs, cwd: process.cwd() },
           (err, out2, stderr) => {
             if (err) reject(Object.assign(err, { stdout: out2, stderr }));
-            else resolve27({ stdout: out2, stderr });
+            else resolve28({ stdout: out2, stderr });
           }
         );
       }
@@ -11965,7 +12051,7 @@ var test_runner_gate_default = plugin35;
 
 // src/type-gate/index.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 var API_VERSION19 = "^0.1.10";
 var state33 = {
   invocationCount: 0,
@@ -12038,7 +12124,7 @@ function runTypeCheck(cfg) {
       argv = [...argv, "-p", tsConfig];
     }
   }
-  if (!cfg.command && tsConfig && !existsSync6(tsConfig)) {
+  if (!cfg.command && tsConfig && !existsSync7(tsConfig)) {
     return null;
   }
   let stdout = "";
@@ -13233,7 +13319,7 @@ function estimateRequestTokens(request, charsPerToken) {
   walk(request["messages"]);
   return Math.ceil(chars / charsPerToken);
 }
-var sleep = (ms) => new Promise((resolve27) => setTimeout(resolve27, ms));
+var sleep = (ms) => new Promise((resolve28) => setTimeout(resolve28, ms));
 var plugin40 = {
   name: "token-throttle",
   version: "0.1.0",
@@ -13379,8 +13465,8 @@ var plugin40 = {
 var token_throttle_default = plugin40;
 
 // src/accessibility-auditor/index.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8, readdirSync as readdirSync3, statSync as statSync5 } from "node:fs";
-import { isAbsolute as isAbsolute15, relative as relative12, resolve as resolve12 } from "node:path";
+import { readFileSync as readFileSync9 } from "node:fs";
+import { isAbsolute as isAbsolute16, relative as relative13, resolve as resolve13 } from "node:path";
 var API_VERSION21 = "^0.1.10";
 var state38 = {
   auditCount: 0,
@@ -13411,45 +13497,6 @@ function readConfig33(raw) {
 function normalizeExtensions(exts) {
   return exts.map((e) => e.startsWith(".") ? e.toLowerCase() : `.${e.toLowerCase()}`);
 }
-function matchesExtension(p, exts) {
-  const dot = p.lastIndexOf(".");
-  if (dot === -1) return false;
-  return exts.includes(p.slice(dot).toLowerCase());
-}
-function collectUiFiles(root, exts) {
-  const files = [];
-  if (!existsSync7(root)) return files;
-  const s = statSync5(root);
-  if (s.isFile()) {
-    if (matchesExtension(root, exts)) files.push(root);
-    return files;
-  }
-  if (!s.isDirectory()) return files;
-  function walk(dir) {
-    let entries;
-    try {
-      entries = readdirSync3(dir);
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      const full = resolve12(dir, entry);
-      let st;
-      try {
-        st = statSync5(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        walk(full);
-      } else if (st.isFile() && matchesExtension(full, exts)) {
-        files.push(full);
-      }
-    }
-  }
-  walk(root);
-  return files;
-}
 var TAG_IMG = /<img\b[^>]*>/gi;
 var TAG_INPUT = /<input\b[^>]*\/?>/gi;
 var TAG_BUTTON = /<button\b[^>]*>([\s\S]*?)<\/button>/gi;
@@ -13470,7 +13517,7 @@ function hasMeaningfulAlt(tag) {
 function auditFile(filePath, projectRoot) {
   let content;
   try {
-    content = readFileSync8(filePath, "utf-8");
+    content = readFileSync9(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -13479,7 +13526,7 @@ function auditFile(filePath, projectRoot) {
   const idsByValue = /* @__PURE__ */ new Map();
   function add(line, rule, severity, message) {
     findings.push({
-      file: relative12(projectRoot, filePath),
+      file: relative13(projectRoot, filePath),
       line,
       rule,
       severity,
@@ -13558,9 +13605,9 @@ function auditFile(filePath, projectRoot) {
 }
 function auditPath(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute15(rawPath) ? resolve12(rawPath) : resolve12(root, rawPath);
+  const resolved = isAbsolute16(rawPath) ? resolve13(rawPath) : resolve13(root, rawPath);
   const exts = normalizeExtensions(cfg.includeExtensions);
-  const files = collectUiFiles(resolved, exts);
+  const files = collectSourceFiles(resolved, { extensions: exts });
   const findings = [];
   for (const file of files) {
     const fileFindings = auditFile(file, root);
@@ -13568,7 +13615,7 @@ function auditPath(rawPath, cfg) {
     if (findings.length >= cfg.maxFindings) break;
   }
   return {
-    path: relative12(root, resolved),
+    path: relative13(root, resolved),
     findings: findings.slice(0, cfg.maxFindings),
     fileCount: files.length
   };
@@ -13774,8 +13821,8 @@ var accessibility_auditor_default = plugin41;
 
 // src/api-compatibility-gate/index.ts
 import { execFileSync as execFileSync8 } from "node:child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync9 } from "node:fs";
-import { basename as basename4, dirname as dirname6, extname, isAbsolute as isAbsolute16, relative as relative13, resolve as resolve13 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync10 } from "node:fs";
+import { basename as basename4, dirname as dirname7, extname as extname2, isAbsolute as isAbsolute17, relative as relative14, resolve as resolve14 } from "node:path";
 var API_VERSION22 = "^0.1.10";
 var state39 = {
   invocationCount: 0,
@@ -13839,25 +13886,25 @@ function matchesAnyPattern(filePath, patterns) {
   return patterns.some((p) => patternToRegex(p).test(normalized));
 }
 function resolveToProjectRoot(filePath) {
-  if (isAbsolute16(filePath)) return resolve13(filePath);
-  return resolve13(process.cwd(), filePath);
+  if (isAbsolute17(filePath)) return resolve14(filePath);
+  return resolve14(process.cwd(), filePath);
 }
 function withinProject5(filePath) {
   if (typeof filePath !== "string" || filePath.length === 0 || filePath.length > 4096) return false;
   const resolved = resolveToProjectRoot(filePath);
-  const rel = relative13(process.cwd(), resolved);
+  const rel = relative14(process.cwd(), resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute16(rel)) return false;
+  if (isAbsolute17(rel)) return false;
   return true;
 }
 function isPackageEntryPoint(filePath) {
   const resolved = resolveToProjectRoot(filePath);
-  const dir = dirname6(resolved);
-  const pkgPath = resolve13(dir, "package.json");
+  const dir = dirname7(resolved);
+  const pkgPath = resolve14(dir, "package.json");
   if (!existsSync8(pkgPath)) return false;
   try {
-    const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
     const entries = [];
     if (pkg.main) entries.push(pkg.main);
     if (pkg.module) entries.push(pkg.module);
@@ -13875,9 +13922,9 @@ function isPackageEntryPoint(filePath) {
       }
     }
     for (const entry of entries) {
-      const entryResolved = resolve13(dir, entry);
+      const entryResolved = resolve14(dir, entry);
       if (entryResolved === resolved) return true;
-      if (basename4(dirname6(entryResolved)) === basename4(dirname6(resolved)) && basename4(entryResolved, extname(entryResolved)) === basename4(resolved, extname(resolved))) {
+      if (basename4(dirname7(entryResolved)) === basename4(dirname7(resolved)) && basename4(entryResolved, extname2(entryResolved)) === basename4(resolved, extname2(resolved))) {
         return true;
       }
     }
@@ -13928,7 +13975,7 @@ function extractExports(source) {
 }
 function readGitVersion(filePath) {
   const resolved = resolveToProjectRoot(filePath);
-  const relPath = normalizePath2(relative13(process.cwd(), resolved));
+  const relPath = normalizePath2(relative14(process.cwd(), resolved));
   try {
     const out = execFileSync8("git", ["show", `HEAD:${relPath}`], {
       encoding: "utf-8",
@@ -13943,7 +13990,7 @@ function readGitVersion(filePath) {
 function readCurrentFile(filePath) {
   try {
     const resolved = resolveToProjectRoot(filePath);
-    return readFileSync9(resolved, "utf-8");
+    return readFileSync10(resolved, "utf-8");
   } catch {
     return null;
   }
@@ -14128,7 +14175,7 @@ var plugin42 = {
 var api_compatibility_gate_default = plugin42;
 
 // src/auto-i18n-extractor/index.ts
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 var API_VERSION23 = "^0.1.10";
 var state40 = {
   filesScanned: 0,
@@ -14213,7 +14260,7 @@ function extractStrings(content, cfg) {
 }
 function readSourceFile(filePath) {
   try {
-    return readFileSync10(filePath, "utf-8");
+    return readFileSync11(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -14449,8 +14496,8 @@ ${lines.join("\n")}${more}`;
 var auto_i18n_extractor_default = plugin43;
 
 // src/code-metrics/index.ts
-import { existsSync as existsSync9, readFileSync as readFileSync11, readdirSync as readdirSync4, statSync as statSync6 } from "node:fs";
-import { extname as extname2, isAbsolute as isAbsolute17, relative as relative14, resolve as resolve14 } from "node:path";
+import { readFileSync as readFileSync12 } from "node:fs";
+import { isAbsolute as isAbsolute18, relative as relative15, resolve as resolve15 } from "node:path";
 var API_VERSION24 = "^0.1.10";
 var state41 = {
   measureCount: 0,
@@ -14476,49 +14523,11 @@ function readConfig36(raw) {
 function normalizeExtensions2(exts) {
   return exts.map((e) => e.startsWith(".") ? e.toLowerCase() : `.${e.toLowerCase()}`);
 }
-function matchesExtension2(p, exts) {
-  return exts.includes(extname2(p).toLowerCase());
-}
-function collectSourceFiles(root, exts) {
-  const files = [];
-  if (!existsSync9(root)) return files;
-  const s = statSync6(root);
-  if (s.isFile()) {
-    if (matchesExtension2(root, exts)) files.push(root);
-    return files;
-  }
-  if (!s.isDirectory()) return files;
-  function walk(dir) {
-    let entries;
-    try {
-      entries = readdirSync4(dir);
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (entry === "node_modules" || entry === "dist" || entry === ".git" || entry === "coverage") continue;
-      const full = resolve14(dir, entry);
-      let st;
-      try {
-        st = statSync6(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        walk(full);
-      } else if (st.isFile() && matchesExtension2(full, exts)) {
-        files.push(full);
-      }
-    }
-  }
-  walk(root);
-  return files;
-}
 function toPosix(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath(p) {
-  return toPosix(relative14(process.cwd(), p));
+  return toPosix(relative15(process.cwd(), p));
 }
 function countFunctions(content) {
   let count = 0;
@@ -14595,14 +14604,14 @@ function analyzeFile(filePath, content) {
 }
 function measurePath(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute17(rawPath) ? resolve14(rawPath) : resolve14(root, rawPath);
+  const resolved = isAbsolute18(rawPath) ? resolve15(rawPath) : resolve15(root, rawPath);
   const exts = normalizeExtensions2(cfg.extensions);
-  const allFiles = collectSourceFiles(resolved, exts);
+  const allFiles = collectSourceFiles(resolved, { extensions: exts });
   const files = allFiles.slice(0, cfg.maxFiles);
   const metrics = [];
   for (const p of files) {
     try {
-      const content = readFileSync11(p, "utf-8");
+      const content = readFileSync12(p, "utf-8");
       metrics.push(analyzeFile(p, content));
     } catch {
     }
@@ -14656,12 +14665,12 @@ var plugin44 = {
       if (!sourcePath || typeof sourcePath !== "string") return;
       if (!withinProject(sourcePath)) return;
       const exts = normalizeExtensions2(cfg.extensions);
-      if (!matchesExtension2(sourcePath, exts)) return;
+      if (!matchesExtension(sourcePath, exts)) return;
       state41.hookInvocationCount += 1;
-      const resolved = resolve14(process.cwd(), sourcePath);
+      const resolved = resolve15(process.cwd(), sourcePath);
       let content;
       try {
-        content = readFileSync11(resolved, "utf-8");
+        content = readFileSync12(resolved, "utf-8");
       } catch {
         state41.errorCount += 1;
         return;
@@ -14702,7 +14711,7 @@ var plugin44 = {
         state41.fileCount += result.files.length;
         return {
           ok: true,
-          path: relativePath(resolve14(process.cwd(), rawPath)),
+          path: relativePath(resolve15(process.cwd(), rawPath)),
           files: result.files,
           totalFiles: result.totalFiles,
           capped: result.totalFiles > cfg.maxFiles
@@ -14773,8 +14782,8 @@ var plugin44 = {
 var code_metrics_default = plugin44;
 
 // src/dead-code-detector/index.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync12, statSync as statSync7 } from "node:fs";
-import { extname as extname3, join as join5, relative as relative15, resolve as resolve15 } from "node:path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync13, statSync as statSync6 } from "node:fs";
+import { extname as extname3, join as join6, relative as relative16, resolve as resolve16 } from "node:path";
 var API_VERSION25 = "^0.1.10";
 var state42 = {
   scanCount: 0,
@@ -14808,24 +14817,24 @@ function gatherFiles(root, depth, cfg) {
   function walk(dir, remaining) {
     let entries;
     try {
-      entries = readdirSync5(dir, { withFileTypes: true });
+      entries = readdirSync4(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (remaining > 0 && !cfg.excludeDirs.includes(entry.name)) {
-          walk(join5(dir, entry.name), remaining - 1);
+          walk(join6(dir, entry.name), remaining - 1);
         }
       } else if (entry.isFile()) {
         const ext = extname3(entry.name).toLowerCase();
         if (cfg.extensions.includes(ext)) {
-          files.push(join5(dir, entry.name));
+          files.push(join6(dir, entry.name));
         }
       }
     }
   }
-  walk(resolve15(root), depth);
+  walk(resolve16(root), depth);
   return files;
 }
 function stripNoise(content) {
@@ -14901,7 +14910,7 @@ function scan(root, depth, cfg) {
   const files = [];
   for (const p of filePaths) {
     try {
-      const content = readFileSync12(p, "utf-8");
+      const content = readFileSync13(p, "utf-8");
       files.push({ path: p, content, stripped: stripNoise(content) });
     } catch {
     }
@@ -14909,11 +14918,11 @@ function scan(root, depth, cfg) {
   return { findings: findUnusedSymbols(files), scannedFiles: files.length };
 }
 function resolveScanRoot(rawPath) {
-  const resolved = resolve15(process.cwd(), rawPath);
+  const resolved = resolve16(process.cwd(), rawPath);
   try {
-    const stats = statSync7(resolved);
+    const stats = statSync6(resolved);
     if (!stats.isDirectory()) {
-      return resolve15(resolved, "..");
+      return resolve16(resolved, "..");
     }
   } catch {
   }
@@ -14923,7 +14932,7 @@ function toPosix2(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath2(p) {
-  return toPosix2(relative15(process.cwd(), p));
+  return toPosix2(relative16(process.cwd(), p));
 }
 var plugin45 = {
   name: "dead-code-detector",
@@ -14994,8 +15003,8 @@ var plugin45 = {
         state42.errorCount += 1;
         return;
       }
-      const changedFile = resolve15(process.cwd(), sourcePath);
-      const relevant = result.findings.filter((f) => resolve15(f.file) === changedFile);
+      const changedFile = resolve16(process.cwd(), sourcePath);
+      const relevant = result.findings.filter((f) => resolve16(f.file) === changedFile);
       if (relevant.length === 0) {
         state42.missCount += 1;
         return;
@@ -15115,7 +15124,7 @@ var dead_code_detector_default = plugin45;
 
 // src/dependency-vulnerability-gate/index.ts
 import { execFileSync as execFileSync9 } from "node:child_process";
-import { existsSync as existsSync10 } from "node:fs";
+import { existsSync as existsSync9 } from "node:fs";
 var API_VERSION26 = "^0.1.10";
 var state43 = {
   invocations: 0,
@@ -15228,7 +15237,7 @@ function isInstallCommand(input) {
   return INSTALL_RE2.test(command);
 }
 function detectManager() {
-  return existsSync10("pnpm-lock.yaml") ? "pnpm" : "npm";
+  return existsSync9("pnpm-lock.yaml") ? "pnpm" : "npm";
 }
 function runAudit(cfg) {
   const manager = detectManager();
@@ -15631,8 +15640,8 @@ Consider mentioning these changes in the documentation.`;
 var doc_sync_guard_default = plugin47;
 
 // src/duplicate-code-detector/index.ts
-import { existsSync as existsSync11, readFileSync as readFileSync13, readdirSync as readdirSync6, statSync as statSync8 } from "node:fs";
-import { extname as extname5, isAbsolute as isAbsolute18, relative as relative16, resolve as resolve16 } from "node:path";
+import { readFileSync as readFileSync14 } from "node:fs";
+import { isAbsolute as isAbsolute19, relative as relative17, resolve as resolve17 } from "node:path";
 var API_VERSION28 = "^0.1.10";
 var state45 = {
   scanCount: 0,
@@ -15663,49 +15672,11 @@ function readConfig40(raw) {
     maxFindings: typeof r["maxFindings"] === "number" && r["maxFindings"] >= 1 && r["maxFindings"] <= 500 ? r["maxFindings"] : DEFAULTS37.maxFindings
   };
 }
-function matchesExtension3(p, exts) {
-  const ext = extname5(p).toLowerCase();
-  return exts.includes(ext);
-}
-function collectSourceFiles2(root, cfg) {
-  const files = [];
-  if (!existsSync11(root)) return files;
-  const s = statSync8(root);
-  if (s.isFile()) {
-    if (matchesExtension3(root, cfg.extensions)) files.push(root);
-    return files;
-  }
-  if (!s.isDirectory()) return files;
-  function walk(dir) {
-    let entries;
-    try {
-      entries = readdirSync6(dir);
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      const full = resolve16(dir, entry);
-      let st;
-      try {
-        st = statSync8(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (!cfg.excludeDirs.includes(entry)) walk(full);
-      } else if (st.isFile() && matchesExtension3(full, cfg.extensions)) {
-        files.push(full);
-      }
-    }
-  }
-  walk(root);
-  return files;
-}
 function toPosix3(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath3(p) {
-  return toPosix3(relative16(process.cwd(), p));
+  return toPosix3(relative17(process.cwd(), p));
 }
 function removeInlineComments(line) {
   return line.replace(/\/\/.*$/, "").replace(/\/\*[\s\S]*?\*\//, "");
@@ -15763,12 +15734,12 @@ function findDuplicates(files, minLines, maxFindings) {
 }
 function scanPath(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute18(rawPath) ? resolve16(rawPath) : resolve16(root, rawPath);
-  const filePaths = collectSourceFiles2(resolved, cfg);
+  const resolved = isAbsolute19(rawPath) ? resolve17(rawPath) : resolve17(root, rawPath);
+  const filePaths = collectSourceFiles(resolved, { extensions: cfg.extensions, excludeDirs: cfg.excludeDirs });
   const files = /* @__PURE__ */ new Map();
   for (const p of filePaths) {
     try {
-      files.set(p, readFileSync13(p, "utf-8"));
+      files.set(p, readFileSync14(p, "utf-8"));
     } catch {
     }
   }
@@ -15848,24 +15819,24 @@ var plugin48 = {
       const now = Date.now();
       const lastWarning = state45.lastHookWarning.get(sourcePath);
       if (lastWarning !== void 0 && now - lastWarning < 6e4) return;
-      const changedFile = resolve16(process.cwd(), sourcePath);
+      const changedFile = resolve17(process.cwd(), sourcePath);
       let content;
       try {
-        content = readFileSync13(changedFile, "utf-8");
+        content = readFileSync14(changedFile, "utf-8");
       } catch {
         state45.errorCount += 1;
         return;
       }
       const changedWindows = extractWindows(changedFile, content, cfg.minLines);
       if (changedWindows.length === 0) return;
-      const projectRoot = resolve16(process.cwd());
+      const projectRoot = resolve17(process.cwd());
       let otherFiles;
       try {
-        const filePaths = collectSourceFiles2(projectRoot, cfg).filter((p) => p !== changedFile);
+        const filePaths = collectSourceFiles(projectRoot, { extensions: cfg.extensions, excludeDirs: cfg.excludeDirs }).filter((p) => p !== changedFile);
         otherFiles = /* @__PURE__ */ new Map();
         for (const p of filePaths) {
           try {
-            otherFiles.set(p, readFileSync13(p, "utf-8"));
+            otherFiles.set(p, readFileSync14(p, "utf-8"));
           } catch {
           }
         }
@@ -15924,7 +15895,7 @@ var plugin48 = {
         state45.findingCount += result.findings.length;
         return {
           ok: true,
-          path: relativePath3(resolve16(process.cwd(), rawPath)),
+          path: relativePath3(resolve17(process.cwd(), rawPath)),
           scannedFiles: result.scannedFiles,
           minLines: cfg.minLines,
           findings: result.findings
@@ -16003,8 +15974,8 @@ var plugin48 = {
 var duplicate_code_detector_default = plugin48;
 
 // src/feature-flag-tracker/index.ts
-import { existsSync as existsSync12, readFileSync as readFileSync14, readdirSync as readdirSync7, statSync as statSync9 } from "node:fs";
-import { extname as extname6, isAbsolute as isAbsolute19, relative as relative17, resolve as resolve17 } from "node:path";
+import { readFileSync as readFileSync15 } from "node:fs";
+import { isAbsolute as isAbsolute20, relative as relative18, resolve as resolve18 } from "node:path";
 var API_VERSION29 = "^0.1.10";
 var state46 = {
   scanCount: 0,
@@ -16039,49 +16010,11 @@ function readConfig41(raw) {
 function normalizeExtensions3(exts) {
   return exts.map((e) => e.startsWith(".") ? e.toLowerCase() : `.${e.toLowerCase()}`);
 }
-function matchesExtension4(p, exts) {
-  return exts.includes(extname6(p).toLowerCase());
-}
-function collectSourceFiles3(root, exts) {
-  const files = [];
-  if (!existsSync12(root)) return files;
-  const s = statSync9(root);
-  if (s.isFile()) {
-    if (matchesExtension4(root, exts)) files.push(root);
-    return files;
-  }
-  if (!s.isDirectory()) return files;
-  function walk(dir) {
-    let entries;
-    try {
-      entries = readdirSync7(dir);
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (entry === "node_modules" || entry === "dist" || entry === ".git" || entry === "coverage") continue;
-      const full = resolve17(dir, entry);
-      let st;
-      try {
-        st = statSync9(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        walk(full);
-      } else if (st.isFile() && matchesExtension4(full, exts)) {
-        files.push(full);
-      }
-    }
-  }
-  walk(root);
-  return files;
-}
 function toPosix4(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath4(p) {
-  return toPosix4(relative17(process.cwd(), p));
+  return toPosix4(relative18(process.cwd(), p));
 }
 function compilePatterns(patterns) {
   const sources = [...DEFAULT_PATTERNS2, ...patterns];
@@ -16111,14 +16044,14 @@ function scanFile(filePath, content, patterns, maxFindings) {
 }
 function scanPath2(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute19(rawPath) ? resolve17(rawPath) : resolve17(root, rawPath);
+  const resolved = isAbsolute20(rawPath) ? resolve18(rawPath) : resolve18(root, rawPath);
   const exts = normalizeExtensions3(cfg.extensions);
-  const files = collectSourceFiles3(resolved, exts);
+  const files = collectSourceFiles(resolved, { extensions: exts });
   const patterns = compilePatterns(cfg.patterns);
   const usages = [];
   for (const p of files) {
     try {
-      const content = readFileSync14(p, "utf-8");
+      const content = readFileSync15(p, "utf-8");
       usages.push(...scanFile(p, content, patterns, cfg.maxFindings));
       if (usages.length >= cfg.maxFindings) break;
     } catch {
@@ -16180,12 +16113,12 @@ var plugin49 = {
       if (!sourcePath || typeof sourcePath !== "string") return;
       if (!withinProject(sourcePath)) return;
       const exts = normalizeExtensions3(cfg.extensions);
-      if (!matchesExtension4(sourcePath, exts)) return;
+      if (!matchesExtension(sourcePath, exts)) return;
       state46.hookInvocationCount += 1;
-      const resolved = resolve17(process.cwd(), sourcePath);
+      const resolved = resolve18(process.cwd(), sourcePath);
       let content;
       try {
-        content = readFileSync14(resolved, "utf-8");
+        content = readFileSync15(resolved, "utf-8");
       } catch {
         state46.errorCount += 1;
         return;
@@ -16231,7 +16164,7 @@ Make sure flag behavior is intentional and consider updating flag inventory/docs
         state46.flagCount += result.usages.length;
         return {
           ok: true,
-          path: relativePath4(resolve17(process.cwd(), rawPath)),
+          path: relativePath4(resolve18(process.cwd(), rawPath)),
           scannedFiles: result.scannedFiles,
           usages: result.usages
         };
@@ -16306,8 +16239,8 @@ Make sure flag behavior is intentional and consider updating flag inventory/docs
 var feature_flag_tracker_default = plugin49;
 
 // src/interface-contract-guard/index.ts
-import { existsSync as existsSync13, readFileSync as readFileSync15, readdirSync as readdirSync8, statSync as statSync10 } from "node:fs";
-import { extname as extname7, isAbsolute as isAbsolute20, relative as relative18, resolve as resolve18 } from "node:path";
+import { readFileSync as readFileSync16 } from "node:fs";
+import { isAbsolute as isAbsolute21, relative as relative19, resolve as resolve19 } from "node:path";
 var API_VERSION30 = "^0.1.10";
 var state47 = {
   scanCount: 0,
@@ -16334,49 +16267,11 @@ function readConfig42(raw) {
 function normalizeExtensions4(exts) {
   return exts.map((e) => e.startsWith(".") ? e.toLowerCase() : `.${e.toLowerCase()}`);
 }
-function matchesExtension5(p, exts) {
-  return exts.includes(extname7(p).toLowerCase());
-}
-function collectSourceFiles4(root, exts) {
-  const files = [];
-  if (!existsSync13(root)) return files;
-  const s = statSync10(root);
-  if (s.isFile()) {
-    if (matchesExtension5(root, exts)) files.push(root);
-    return files;
-  }
-  if (!s.isDirectory()) return files;
-  function walk(dir) {
-    let entries;
-    try {
-      entries = readdirSync8(dir);
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (entry === "node_modules" || entry === "dist" || entry === ".git" || entry === "coverage") continue;
-      const full = resolve18(dir, entry);
-      let st;
-      try {
-        st = statSync10(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        walk(full);
-      } else if (st.isFile() && matchesExtension5(full, exts)) {
-        files.push(full);
-      }
-    }
-  }
-  walk(root);
-  return files;
-}
 function toPosix5(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath5(p) {
-  return toPosix5(relative18(process.cwd(), p));
+  return toPosix5(relative19(process.cwd(), p));
 }
 var INTERFACE_RE = /(?:export\s+)?interface\s+([A-Za-z_$][A-Za-z0-9_$]*)/g;
 function extractInterfaceNames(content) {
@@ -16396,13 +16291,13 @@ function hasImplementer(name, contents) {
 }
 function scanPath3(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute20(rawPath) ? resolve18(rawPath) : resolve18(root, rawPath);
+  const resolved = isAbsolute21(rawPath) ? resolve19(rawPath) : resolve19(root, rawPath);
   const exts = normalizeExtensions4(cfg.extensions);
-  const files = collectSourceFiles4(resolved, exts);
+  const files = collectSourceFiles(resolved, { extensions: exts });
   const contents = [];
   for (const p of files) {
     try {
-      contents.push({ path: p, content: readFileSync15(p, "utf-8") });
+      contents.push({ path: p, content: readFileSync16(p, "utf-8") });
     } catch {
     }
   }
@@ -16472,12 +16367,12 @@ var plugin50 = {
       if (!sourcePath || typeof sourcePath !== "string") return;
       if (!withinProject(sourcePath)) return;
       const exts = normalizeExtensions4(cfg.extensions);
-      if (!matchesExtension5(sourcePath, exts)) return;
+      if (!matchesExtension(sourcePath, exts)) return;
       state47.hookInvocationCount += 1;
-      const resolved = resolve18(process.cwd(), sourcePath);
+      const resolved = resolve19(process.cwd(), sourcePath);
       let content;
       try {
-        content = readFileSync15(resolved, "utf-8");
+        content = readFileSync16(resolved, "utf-8");
       } catch {
         state47.errorCount += 1;
         return;
@@ -16522,7 +16417,7 @@ If you changed member shapes, search the project for implementers/\`satisfies\`/
         state47.findingCount += result.findings.length;
         return {
           ok: true,
-          path: relativePath5(resolve18(process.cwd(), rawPath)),
+          path: relativePath5(resolve19(process.cwd(), rawPath)),
           scannedFiles: result.scannedFiles,
           findings: result.findings
         };
@@ -16595,8 +16490,8 @@ If you changed member shapes, search the project for implementers/\`satisfies\`/
 var interface_contract_guard_default = plugin50;
 
 // src/license-audit-gate/index.ts
-import { readFileSync as readFileSync16 } from "node:fs";
-import { resolve as resolve19 } from "node:path";
+import { readFileSync as readFileSync17 } from "node:fs";
+import { resolve as resolve20 } from "node:path";
 var API_VERSION31 = "^0.1.10";
 var state48 = {
   invocations: 0,
@@ -16672,8 +16567,8 @@ function auditPackages(names, allowedLicenses) {
   for (const name of names) {
     let licenses = [];
     try {
-      const pkgPath = resolve19("node_modules", name, "package.json");
-      const raw = JSON.parse(readFileSync16(pkgPath, "utf-8"));
+      const pkgPath = resolve20("node_modules", name, "package.json");
+      const raw = JSON.parse(readFileSync17(pkgPath, "utf-8"));
       licenses = extractLicenseStrings(raw);
     } catch {
       errors.push(name);
@@ -16852,7 +16747,7 @@ Allowed licenses: ${cfg.allowedLicenses.join(", ")}
 var license_audit_gate_default = plugin51;
 
 // src/migration-planner/index.ts
-import { existsSync as existsSync14, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync18 } from "node:fs";
 var API_VERSION32 = "^0.1.10";
 var state49 = {
   plansGenerated: 0,
@@ -16890,9 +16785,9 @@ function readChangelog(packageName, cfg) {
   candidates.push(`node_modules/${packageName}/changelog.md`);
   for (const candidate of candidates) {
     if (!withinProject(candidate)) continue;
-    if (existsSync14(candidate)) {
+    if (existsSync10(candidate)) {
       try {
-        const content = readFileSync17(candidate, "utf-8");
+        const content = readFileSync18(candidate, "utf-8");
         return { source: candidate, content: content.slice(0, cfg.maxChars) };
       } catch {
       }
@@ -17314,8 +17209,8 @@ var plugin52 = {
 var migration_planner_default = plugin52;
 
 // src/performance-regression-gate/index.ts
-import { existsSync as existsSync15, readFileSync as readFileSync18 } from "node:fs";
-import { isAbsolute as isAbsolute21, relative as relative19, resolve as resolve20 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync19 } from "node:fs";
+import { isAbsolute as isAbsolute22, relative as relative20, resolve as resolve21 } from "node:path";
 var API_VERSION33 = "^0.1.10";
 var state50 = {
   invocationCount: 0,
@@ -17340,18 +17235,18 @@ function readConfig45(raw) {
 }
 function withinProject6(p, cwd = process.cwd()) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
-  const root = resolve20(cwd);
-  const resolved = isAbsolute21(p) ? resolve20(p) : resolve20(root, p);
-  const rel = relative19(root, resolved);
+  const root = resolve21(cwd);
+  const resolved = isAbsolute22(p) ? resolve21(p) : resolve21(root, p);
+  const rel = relative20(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute21(rel)) return false;
+  if (isAbsolute22(rel)) return false;
   return true;
 }
 function resolveProjectPath7(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
-  const root = resolve20(cwd);
-  const resolved = isAbsolute21(rawPath) ? resolve20(rawPath) : resolve20(root, rawPath);
+  const root = resolve21(cwd);
+  const resolved = isAbsolute22(rawPath) ? resolve21(rawPath) : resolve21(root, rawPath);
   if (!withinProject6(resolved, cwd)) return null;
   return resolved;
 }
@@ -17380,9 +17275,9 @@ function flattenResults(results) {
   return flat;
 }
 function loadResults(path) {
-  if (!path || !existsSync15(path)) return null;
+  if (!path || !existsSync11(path)) return null;
   try {
-    const raw = JSON.parse(readFileSync18(path, "utf-8"));
+    const raw = JSON.parse(readFileSync19(path, "utf-8"));
     return raw;
   } catch {
     return null;
@@ -17627,8 +17522,8 @@ var plugin53 = {
 var performance_regression_gate_default = plugin53;
 
 // src/refactor-suggester/index.ts
-import { existsSync as existsSync16, readFileSync as readFileSync19, readdirSync as readdirSync9, statSync as statSync11 } from "node:fs";
-import { extname as extname8, isAbsolute as isAbsolute22, relative as relative20, resolve as resolve21 } from "node:path";
+import { readFileSync as readFileSync20 } from "node:fs";
+import { isAbsolute as isAbsolute23, relative as relative21, resolve as resolve22 } from "node:path";
 var API_VERSION34 = "^0.1.10";
 var state51 = {
   scanCount: 0,
@@ -17667,49 +17562,11 @@ function readConfig46(raw) {
 function normalizeExtensions5(exts) {
   return exts.map((e) => e.startsWith(".") ? e.toLowerCase() : `.${e.toLowerCase()}`);
 }
-function matchesExtension6(p, exts) {
-  return exts.includes(extname8(p).toLowerCase());
-}
-function collectSourceFiles5(root, exts) {
-  const files = [];
-  if (!existsSync16(root)) return files;
-  const s = statSync11(root);
-  if (s.isFile()) {
-    if (matchesExtension6(root, exts)) files.push(root);
-    return files;
-  }
-  if (!s.isDirectory()) return files;
-  function walk(dir) {
-    let entries;
-    try {
-      entries = readdirSync9(dir);
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (entry === "node_modules" || entry === "dist" || entry === ".git" || entry === "coverage") continue;
-      const full = resolve21(dir, entry);
-      let st;
-      try {
-        st = statSync11(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        walk(full);
-      } else if (st.isFile() && matchesExtension6(full, exts)) {
-        files.push(full);
-      }
-    }
-  }
-  walk(root);
-  return files;
-}
 function toPosix6(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath6(p) {
-  return toPosix6(relative20(process.cwd(), p));
+  return toPosix6(relative21(process.cwd(), p));
 }
 function leadingIndentLevel(line) {
   const leading = line.match(/^(\s*)/)?.[1] ?? "";
@@ -17796,13 +17653,13 @@ function detectSmells(filePath, content, rules) {
 }
 function scanPath4(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute22(rawPath) ? resolve21(rawPath) : resolve21(root, rawPath);
+  const resolved = isAbsolute23(rawPath) ? resolve22(rawPath) : resolve22(root, rawPath);
   const exts = normalizeExtensions5(cfg.extensions);
-  const files = collectSourceFiles5(resolved, exts);
+  const files = collectSourceFiles(resolved, { extensions: exts });
   const suggestions = [];
   for (const p of files) {
     try {
-      const content = readFileSync19(p, "utf-8");
+      const content = readFileSync20(p, "utf-8");
       suggestions.push(...detectSmells(p, content, cfg.rules));
       if (suggestions.length >= cfg.maxSuggestions) break;
     } catch {
@@ -17867,15 +17724,15 @@ var plugin54 = {
       if (!sourcePath || typeof sourcePath !== "string") return;
       if (!withinProject(sourcePath)) return;
       const exts = normalizeExtensions5(cfg.extensions);
-      if (!matchesExtension6(sourcePath, exts)) return;
+      if (!matchesExtension(sourcePath, exts)) return;
       state51.hookInvocationCount += 1;
       const now = Date.now();
       const lastWarning = state51.lastHookWarning.get(sourcePath);
       if (lastWarning !== void 0 && now - lastWarning < 6e4) return;
-      const resolved = resolve21(process.cwd(), sourcePath);
+      const resolved = resolve22(process.cwd(), sourcePath);
       let content;
       try {
-        content = readFileSync19(resolved, "utf-8");
+        content = readFileSync20(resolved, "utf-8");
       } catch {
         state51.errorCount += 1;
         return;
@@ -17919,7 +17776,7 @@ var plugin54 = {
         state51.suggestionCount += result.suggestions.length;
         return {
           ok: true,
-          path: relativePath6(resolve21(process.cwd(), rawPath)),
+          path: relativePath6(resolve22(process.cwd(), rawPath)),
           scannedFiles: result.scannedFiles,
           suggestions: result.suggestions,
           rules: cfg.rules
@@ -18322,7 +18179,7 @@ var plugin55 = {
 var release_notes_generator_default = plugin55;
 
 // src/schema-evolution-guard/index.ts
-import { readFileSync as readFileSync20 } from "node:fs";
+import { readFileSync as readFileSync21 } from "node:fs";
 import { basename as basename6 } from "node:path";
 var API_VERSION36 = "^0.1.10";
 var state53 = {
@@ -18525,7 +18382,7 @@ var plugin56 = {
         content = toolInput["content"];
       } else if (withinProject(filePath)) {
         try {
-          content = readFileSync20(filePath, "utf-8");
+          content = readFileSync21(filePath, "utf-8");
         } catch {
           content = void 0;
         }
@@ -18629,8 +18486,8 @@ ${body}${suffix}`;
 var schema_evolution_guard_default = plugin56;
 
 // src/security-hotspot-scanner/index.ts
-import { readdirSync as readdirSync10, readFileSync as readFileSync21, statSync as statSync12 } from "node:fs";
-import { isAbsolute as isAbsolute23, relative as relative21, resolve as resolve22 } from "node:path";
+import { readdirSync as readdirSync5, readFileSync as readFileSync22, statSync as statSync7 } from "node:fs";
+import { isAbsolute as isAbsolute24, relative as relative22, resolve as resolve23 } from "node:path";
 var API_VERSION37 = "^0.1.10";
 var state54 = {
   scanCount: 0,
@@ -18715,7 +18572,7 @@ function isSourceFile2(filePath, extensions) {
 function scanPath5(inputPath, cfg) {
   const start = Date.now();
   const root = process.cwd();
-  const resolved = isAbsolute23(inputPath) ? resolve22(inputPath) : resolve22(root, inputPath);
+  const resolved = isAbsolute24(inputPath) ? resolve23(inputPath) : resolve23(root, inputPath);
   if (!withinProject(inputPath)) {
     return {
       path: inputPath,
@@ -18732,11 +18589,11 @@ function scanPath5(inputPath, cfg) {
   const scanFile2 = (filePath) => {
     if (!isSourceFile2(filePath, cfg.scanOnChange)) return;
     try {
-      const content = readFileSync21(filePath, "utf-8");
+      const content = readFileSync22(filePath, "utf-8");
       filesScanned += 1;
       const findings = scanSource(content, maxPerFile);
       for (const f of findings) {
-        allFindings.push({ ...f, snippet: `${relative21(root, filePath)}:${f.line}: ${f.snippet}` });
+        allFindings.push({ ...f, snippet: `${relative22(root, filePath)}:${f.line}: ${f.snippet}` });
         if (allFindings.length >= cfg.maxFindings) return;
       }
     } catch {
@@ -18745,15 +18602,15 @@ function scanPath5(inputPath, cfg) {
   const walk = (dir) => {
     let entries;
     try {
-      entries = readdirSync10(dir);
+      entries = readdirSync5(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (allFindings.length >= cfg.maxFindings) return;
-      const full = resolve22(dir, entry);
+      const full = resolve23(dir, entry);
       try {
-        const st = statSync12(full);
+        const st = statSync7(full);
         if (st.isDirectory()) {
           if (entry.startsWith(".") || entry === "node_modules" || entry === "dist" || entry === "coverage") {
             continue;
@@ -18767,7 +18624,7 @@ function scanPath5(inputPath, cfg) {
     }
   };
   try {
-    const st = statSync12(resolved);
+    const st = statSync7(resolved);
     if (st.isDirectory()) {
       walk(resolved);
     } else if (st.isFile()) {
@@ -19020,7 +18877,7 @@ var security_hotspot_scanner_default = plugin57;
 
 // src/semantic-search-indexer/index.ts
 import * as fs2 from "node:fs/promises";
-import { isAbsolute as isAbsolute24, relative as relative22, resolve as resolve23 } from "node:path";
+import { isAbsolute as isAbsolute25, relative as relative23, resolve as resolve24 } from "node:path";
 var API_VERSION38 = "^0.1.10";
 var state55 = {
   index: null,
@@ -19095,18 +18952,18 @@ function normalizeSlashes2(p) {
 function withinProject7(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = normalizeSlashes2(process.cwd());
-  const resolved = normalizeSlashes2(isAbsolute24(p) ? resolve23(p) : resolve23(root, p));
-  const rel = normalizeSlashes2(relative22(root, resolved));
+  const resolved = normalizeSlashes2(isAbsolute25(p) ? resolve24(p) : resolve24(root, p));
+  const rel = normalizeSlashes2(relative23(root, resolved));
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute24(rel)) return false;
+  if (isAbsolute25(rel)) return false;
   return true;
 }
 function resolveProjectPath8(p) {
   const raw = typeof p === "string" && p.length > 0 ? p : ".";
   if (!withinProject7(raw)) return null;
   const root = normalizeSlashes2(process.cwd());
-  return normalizeSlashes2(isAbsolute24(raw) ? resolve23(raw) : resolve23(root, raw));
+  return normalizeSlashes2(isAbsolute25(raw) ? resolve24(raw) : resolve24(root, raw));
 }
 function tokenize(text, minLength) {
   const tokens = [];
@@ -19136,7 +18993,7 @@ function shouldIndexFile(filePath, cfg) {
 var INDEX_BATCH_SIZE = 32;
 var YIELD_EVERY_FILES = 64;
 function yieldEventLoop() {
-  return new Promise((resolve27) => setImmediate(resolve27));
+  return new Promise((resolve28) => setImmediate(resolve28));
 }
 function addFileToIndex(relPath, content, size, cfg) {
   if (!state55.index || content.includes("\0")) return;
@@ -19190,8 +19047,8 @@ async function walkDirectory(absPath, cfg, excludes, fileBatch) {
       state55.truncated = true;
       return;
     }
-    const absChild = normalizeSlashes2(resolve23(absPath, ent.name));
-    const relChild = normalizeSlashes2(relative22(root, absChild));
+    const absChild = normalizeSlashes2(resolve24(absPath, ent.name));
+    const relChild = normalizeSlashes2(relative23(root, absChild));
     if (relChild === "" || relChild === ".") continue;
     if (excludes.some((re) => re.test(relChild))) continue;
     if (ent.isDirectory()) {
@@ -19233,7 +19090,7 @@ async function buildIndex(rootPath, cfg) {
     return;
   }
   if (rootStats.isFile()) {
-    const relPath = normalizeSlashes2(relative22(normalizeSlashes2(process.cwd()), rootPath));
+    const relPath = normalizeSlashes2(relative23(normalizeSlashes2(process.cwd()), rootPath));
     await indexFileFromStats(rootPath, relPath === "" ? "." : relPath, rootStats, cfg);
     state55.fileCount = state55.index.files.size;
   } else if (rootStats.isDirectory()) {
@@ -19526,8 +19383,8 @@ var plugin58 = {
 var semantic_search_indexer_default = plugin58;
 
 // src/smart-rename/index.ts
-import { readFileSync as readFileSync22, writeFileSync as writeFileSync7 } from "node:fs";
-import { extname as extname9, isAbsolute as isAbsolute25, relative as relative23, resolve as resolve24 } from "node:path";
+import { readFileSync as readFileSync23, writeFileSync as writeFileSync7 } from "node:fs";
+import { extname as extname5, isAbsolute as isAbsolute26, relative as relative24, resolve as resolve25 } from "node:path";
 var API_VERSION39 = "^0.1.10";
 var state56 = {
   renameCount: 0,
@@ -19549,18 +19406,18 @@ function readConfig51(raw) {
 function withinProject8(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute25(p) ? resolve24(p) : resolve24(root, p);
-  const rel = relative23(root, resolved);
+  const resolved = isAbsolute26(p) ? resolve25(p) : resolve25(root, p);
+  const rel = relative24(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute25(rel)) return false;
+  if (isAbsolute26(rel)) return false;
   return true;
 }
 function toPosix7(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath7(p) {
-  return toPosix7(relative23(process.cwd(), p));
+  return toPosix7(relative24(process.cwd(), p));
 }
 function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -19631,14 +19488,14 @@ var plugin59 = {
         if (!withinProject8(rawPath)) {
           return { ok: false, error: "path is outside the project root" };
         }
-        const ext = extname9(rawPath).toLowerCase();
+        const ext = extname5(rawPath).toLowerCase();
         if (!cfg.extensions.includes(ext)) {
           return { ok: false, error: `extension ${ext} is not allowed for rename` };
         }
-        const resolved = resolve24(process.cwd(), rawPath);
+        const resolved = resolve25(process.cwd(), rawPath);
         let content;
         try {
-          content = readFileSync22(resolved, "utf-8");
+          content = readFileSync23(resolved, "utf-8");
         } catch (err) {
           state56.errorCount += 1;
           return { ok: false, error: String(err) };
@@ -19695,9 +19552,9 @@ var smart_rename_default = plugin59;
 
 // src/test-flake-detector/index.ts
 import { execFileSync as execFileSync11 } from "node:child_process";
-import { readFileSync as readFileSync23 } from "node:fs";
-import { createRequire } from "node:module";
-import { dirname as dirname7, isAbsolute as isAbsolute26, relative as relative24, resolve as resolve25 } from "node:path";
+import { readFileSync as readFileSync24 } from "node:fs";
+import { createRequire as createRequire2 } from "node:module";
+import { dirname as dirname8, isAbsolute as isAbsolute27, relative as relative25, resolve as resolve26 } from "node:path";
 var API_VERSION40 = "^0.1.10";
 var state57 = {
   invocationCount: 0,
@@ -19768,15 +19625,15 @@ var ALLOWED_RUNNER_FLAGS = /* @__PURE__ */ new Set([
 ]);
 function withinProject9(p) {
   if (p.length === 0 || p.length > 4096 || p.startsWith("-")) return false;
-  const root = resolve25(process.cwd());
-  const resolved = isAbsolute26(p) ? resolve25(p) : resolve25(root, p);
-  const rel = relative24(root, resolved);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute26(rel);
+  const root = resolve26(process.cwd());
+  const resolved = isAbsolute27(p) ? resolve26(p) : resolve26(root, p);
+  const rel = relative25(root, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute27(rel);
 }
-function isInside(parent, child) {
+function isInside2(parent, child) {
   if (parent === child) return true;
-  const rel = relative24(parent, child);
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute26(rel);
+  const rel = relative25(parent, child);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute27(rel);
 }
 function tokenizeCommand(command) {
   const trimmed = command.trim();
@@ -19813,14 +19670,14 @@ function resolveTestCommand(baseCommand, testPattern) {
   if (runnerArgs.some((arg) => !ALLOWED_RUNNER_FLAGS.has(arg))) return null;
   let resolvedEntry;
   try {
-    const requireFromProject = createRequire(resolve25(process.cwd(), "package.json"));
+    const requireFromProject = createRequire2(resolve26(process.cwd(), "package.json"));
     const packagePath = requireFromProject.resolve(`${runner}/package.json`);
-    const packageJson = JSON.parse(readFileSync23(packagePath, "utf8"));
+    const packageJson = JSON.parse(readFileSync24(packagePath, "utf8"));
     const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.[runner] ?? Object.values(packageJson.bin ?? {})[0];
     if (!relativeBin) return null;
-    const packageDir = dirname7(packagePath);
-    const candidate = resolve25(packageDir, relativeBin);
-    if (isAbsolute26(relativeBin) || !isInside(packageDir, candidate)) {
+    const packageDir = dirname8(packagePath);
+    const candidate = resolve26(packageDir, relativeBin);
+    if (isAbsolute27(relativeBin) || !isInside2(packageDir, candidate)) {
       return null;
     }
     resolvedEntry = candidate;
@@ -20051,8 +19908,8 @@ var plugin60 = {
 var test_flake_detector_default = plugin60;
 
 // src/test-generator/index.ts
-import { readFileSync as readFileSync24 } from "node:fs";
-import { isAbsolute as isAbsolute27, relative as relative25, resolve as resolve26 } from "node:path";
+import { readFileSync as readFileSync25 } from "node:fs";
+import { isAbsolute as isAbsolute28, relative as relative26, resolve as resolve27 } from "node:path";
 var API_VERSION41 = "^0.1.10";
 var state58 = {
   generateCount: 0,
@@ -20087,18 +19944,18 @@ function readConfig53(raw) {
 function withinProject10(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute27(p) ? resolve26(p) : resolve26(root, p);
-  const rel = relative25(root, resolved);
+  const resolved = isAbsolute28(p) ? resolve27(p) : resolve27(root, p);
+  const rel = relative26(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute27(rel)) return false;
+  if (isAbsolute28(rel)) return false;
   return true;
 }
 function toPosix8(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath8(p) {
-  return toPosix8(relative25(process.cwd(), p));
+  return toPosix8(relative26(process.cwd(), p));
 }
 function detectExports(content) {
   const exports = [];
@@ -20192,7 +20049,7 @@ function generateTestContent(sourcePath, sourceModule, detected, cfg) {
   return lines.join("\n");
 }
 function generateForFile(filePath, cfg) {
-  const sourceContent = readFileSync24(filePath, "utf-8");
+  const sourceContent = readFileSync25(filePath, "utf-8");
   const detected = detectExports(sourceContent);
   const sourceFile = relativePath8(filePath);
   const sourceParts = sourceFile.split("/");
@@ -20311,7 +20168,7 @@ var plugin61 = {
         if (!withinProject10(rawPath)) {
           return { ok: false, error: "path is outside the project root" };
         }
-        const resolved = resolve26(process.cwd(), rawPath);
+        const resolved = resolve27(process.cwd(), rawPath);
         state58.generateCount += 1;
         let result;
         try {