aislop 0.5.1 → 0.6.1

package/dist/index.js

@@ -1,4 +1,4 @@
-import { n as ENGINE_INFO, r as getEngineLabel, t as APP_VERSION } from "./version-CIlgPf8Q.js";
+import { n as ENGINE_INFO, r as getEngineLabel, t as APP_VERSION } from "./version-DukdnmKT.js";
 import { n as runSubprocess, t as isToolInstalled } from "./subprocess-CQUJDGgn.js";
 import { r as runGenericLinter, t as fixRubyLint } from "./generic-BrcWMW7E.js";
 import { n as runExpoDoctor } from "./expo-doctor-Bz0LZhQ6.js";
@@ -10,6 +10,7 @@ import { z } from "zod/v4";
 import pc from "picocolors";
 import wcwidth from "wcwidth";
 import { spawnSync } from "node:child_process";
+import micromatch from "micromatch";
 import { fileURLToPath } from "node:url";
 import { performance } from "node:perf_hooks";
 import os from "node:os";
@@ -19,6 +20,13 @@ import { isCancel, multiselect, select, text } from "@clack/prompts";
 //#region src/config/defaults.ts
 const DEFAULT_CONFIG = {
 	version: 1,
+	exclude: [
+		"node_modules",
+		".git",
+		"dist",
+		"build",
+		"coverage"
+	],
 	engines: {
 		format: true,
 		lint: true,
@@ -172,7 +180,14 @@ const AislopConfigSchema = z.object({
 		failBelow: 0,
 		format: "json"
 	})),
-	telemetry: TelemetrySchema.default(() => ({ enabled: true }))
+	telemetry: TelemetrySchema.default(() => ({ enabled: true })),
+	exclude: z.array(z.string()).default(() => [
+		"node_modules",
+		".git",
+		"dist",
+		"build",
+		"coverage"
+	])
 });
 const defaults = AislopConfigSchema.parse({});
 /**
@@ -600,7 +615,15 @@ const listProjectFiles = (rootDirectory) => {
 	if (findResult.error || findResult.status !== 0) return [];
 	return findResult.stdout.split("\n").filter((file) => file.length > 0).map((file) => file.replace(/^\.\//, ""));
 };
-const filterProjectFiles = (rootDirectory, files, extraExtensions = []) => {
+const normalizeExcludePatterns = (patterns) => {
+	return patterns.flatMap((pattern) => {
+		const p = pattern.trim();
+		if (p.startsWith(".")) return [`**/*${p}`];
+		if (!p.includes("*") && !p.includes(".")) return [`${p}/**`];
+		return [p];
+	});
+};
+const filterProjectFiles = (rootDirectory, files, extraExtensions = [], exclude = []) => {
 	const extraSet = new Set(extraExtensions);
 	const normalizedFiles = files.map((file) => {
 		const absolutePath = path.isAbsolute(file) ? file : path.resolve(rootDirectory, file);
@@ -610,7 +633,14 @@ const filterProjectFiles = (rootDirectory, files, extraExtensions = []) => {
 		};
 	}).filter(({ relativePath }) => isWithinProject(relativePath));
 	const ignoredPaths = getIgnoredPaths(rootDirectory, normalizedFiles.map(({ relativePath }) => relativePath));
-	return normalizedFiles.filter(({ absolutePath, relativePath }) => hasAllowedExtension(relativePath, extraSet) && !isExcludedPath(relativePath) && !isTestFile(relativePath) && !ignoredPaths.has(relativePath) && fs.existsSync(absolutePath)).map(({ absolutePath }) => absolutePath);
+	const normalizedExcludePatterns = exclude.length ? normalizeExcludePatterns(exclude) : [];
+	const isUserExcluded = (relativePath) => {
+		if (!normalizedExcludePatterns.length) return false;
+		return micromatch.isMatch(relativePath, normalizedExcludePatterns, { dot: true });
+	};
+	return normalizedFiles.filter(({ absolutePath, relativePath }) => {
+		return hasAllowedExtension(relativePath, extraSet) && !isExcludedPath(relativePath) && !isTestFile(relativePath) && !ignoredPaths.has(relativePath) && !isUserExcluded(relativePath) && fs.existsSync(absolutePath);
+	}).map(({ absolutePath }) => absolutePath);
 };
 const filterExplicitFiles = (rootDirectory, files, extraExtensions = []) => {
 	const extraSet = new Set(extraExtensions);
@@ -875,53 +905,44 @@ const primaryLanguage = (langs) => {
 	]) if (langs.includes(lang)) return lang;
 	return null;
 };
+const systemToolDecision = (installed, spec) => installed[spec.binary] ? {
+	tool: `${spec.toolLabel} (system)`,
+	status: "ok"
+} : {
+	tool: `${spec.toolLabel} not found`,
+	status: "missing",
+	remediation: spec.remediation
+};
+const firstMatching = (langs, installed, specs) => {
+	for (const spec of specs) if (langs.includes(spec.language)) return systemToolDecision(installed, spec);
+	return null;
+};
+const spec = (language, binary, toolLabel, remediation) => ({
+	language,
+	binary,
+	toolLabel,
+	remediation
+});
+const FORMAT_SPECS = [
+	spec("python", "ruff", "ruff", "Install: pipx install ruff"),
+	spec("go", "gofmt", "gofmt", "Install: via go toolchain — https://go.dev/dl/"),
+	spec("rust", "cargo", "cargo fmt", "Install: rustup component add rustfmt"),
+	spec("ruby", "rubocop", "rubocop", "Install: gem install rubocop"),
+	spec("php", "php-cs-fixer", "php-cs-fixer", "Install: composer global require friendsofphp/php-cs-fixer")
+];
+const LINT_SPECS = [
+	spec("python", "ruff", "ruff", "Install: pipx install ruff"),
+	spec("go", "golangci-lint", "golangci-lint", "Install: brew install golangci-lint"),
+	spec("rust", "clippy-driver", "clippy", "Install: rustup component add clippy"),
+	spec("ruby", "rubocop", "rubocop", "Install: gem install rubocop")
+];
 const planFormat = (ctx) => {
 	const { languages, installedTools } = ctx.projectInfo;
 	if (hasJsLike(languages)) return {
 		tool: "biome (bundled)",
 		status: "ok"
 	};
-	if (languages.includes("python")) return installedTools["ruff"] ? {
-		tool: "ruff (system)",
-		status: "ok"
-	} : {
-		tool: "ruff not found",
-		status: "missing",
-		remediation: "Install: pipx install ruff"
-	};
-	if (languages.includes("go")) return installedTools["gofmt"] ? {
-		tool: "gofmt (system)",
-		status: "ok"
-	} : {
-		tool: "gofmt not found",
-		status: "missing",
-		remediation: "Install: via go toolchain — https://go.dev/dl/"
-	};
-	if (languages.includes("rust")) return installedTools["cargo"] ? {
-		tool: "cargo fmt (system)",
-		status: "ok"
-	} : {
-		tool: "cargo fmt not found",
-		status: "missing",
-		remediation: "Install: rustup component add rustfmt"
-	};
-	if (languages.includes("ruby")) return installedTools["rubocop"] ? {
-		tool: "rubocop (system)",
-		status: "ok"
-	} : {
-		tool: "rubocop not found",
-		status: "missing",
-		remediation: "Install: gem install rubocop"
-	};
-	if (languages.includes("php")) return installedTools["php-cs-fixer"] ? {
-		tool: "php-cs-fixer (system)",
-		status: "ok"
-	} : {
-		tool: "php-cs-fixer not found",
-		status: "missing",
-		remediation: "Install: composer global require friendsofphp/php-cs-fixer"
-	};
-	return {
+	return firstMatching(languages, installedTools, FORMAT_SPECS) ?? {
 		tool: "no formatter",
 		status: "skipped",
 		skipReason: "no supported language"
@@ -937,39 +958,7 @@ const planLint = (ctx) => {
 		tool: "oxlint (bundled)",
 		status: "ok"
 	};
-	if (languages.includes("python")) return installedTools["ruff"] ? {
-		tool: "ruff (system)",
-		status: "ok"
-	} : {
-		tool: "ruff not found",
-		status: "missing",
-		remediation: "Install: pipx install ruff"
-	};
-	if (languages.includes("go")) return installedTools["golangci-lint"] ? {
-		tool: "golangci-lint (system)",
-		status: "ok"
-	} : {
-		tool: "golangci-lint not found",
-		status: "missing",
-		remediation: "Install: brew install golangci-lint"
-	};
-	if (languages.includes("rust")) return installedTools["clippy-driver"] ? {
-		tool: "clippy (system)",
-		status: "ok"
-	} : {
-		tool: "clippy not found",
-		status: "missing",
-		remediation: "Install: rustup component add clippy"
-	};
-	if (languages.includes("ruby")) return installedTools["rubocop"] ? {
-		tool: "rubocop (system)",
-		status: "ok"
-	} : {
-		tool: "rubocop not found",
-		status: "missing",
-		remediation: "Install: gem install rubocop"
-	};
-	return {
+	return firstMatching(languages, installedTools, LINT_SPECS) ?? {
 		tool: "no linter",
 		status: "skipped",
 		skipReason: "no supported language"
@@ -989,42 +978,64 @@ const planAiSlop = (_ctx) => ({
 	tool: "built-in",
 	status: "ok"
 });
+const AUDIT_SPECS = [
+	{
+		files: ["pnpm-lock.yaml"],
+		bundled: "pnpm audit"
+	},
+	{
+		files: ["package-lock.json"],
+		bundled: "npm audit"
+	},
+	{
+		files: [
+			"requirements.txt",
+			"poetry.lock",
+			"Pipfile.lock"
+		],
+		systemTool: {
+			binary: "pip-audit",
+			toolLabel: "pip-audit",
+			remediation: "Install: pipx install pip-audit"
+		}
+	},
+	{
+		files: ["Cargo.toml"],
+		systemTool: {
+			binary: "cargo-audit",
+			toolLabel: "cargo audit",
+			remediation: "Install: cargo install cargo-audit",
+			requiresBinaries: ["cargo", "cargo-audit"]
+		}
+	},
+	{
+		files: ["go.mod"],
+		systemTool: {
+			binary: "govulncheck",
+			toolLabel: "govulncheck",
+			remediation: "Install: go install golang.org/x/vuln/cmd/govulncheck@latest"
+		}
+	}
+];
 const planSecurity = (ctx) => {
 	const { rootDirectory, projectInfo } = ctx;
 	const { installedTools } = projectInfo;
 	const hasFile = (rel) => fs.existsSync(path.join(rootDirectory, rel));
-	if (hasFile("pnpm-lock.yaml")) return {
-		tool: "pnpm audit",
-		status: "ok"
-	};
-	if (hasFile("package-lock.json")) return {
-		tool: "npm audit",
-		status: "ok"
-	};
-	if (hasFile("requirements.txt") || hasFile("poetry.lock") || hasFile("Pipfile.lock")) return installedTools["pip-audit"] ? {
-		tool: "pip-audit (system)",
-		status: "ok"
-	} : {
-		tool: "pip-audit not found",
-		status: "missing",
-		remediation: "Install: pipx install pip-audit"
-	};
-	if (hasFile("Cargo.toml")) return installedTools["cargo"] && installedTools["cargo-audit"] ? {
-		tool: "cargo audit (system)",
-		status: "ok"
-	} : {
-		tool: "cargo audit not found",
-		status: "missing",
-		remediation: "Install: cargo install cargo-audit"
-	};
-	if (hasFile("go.mod")) return installedTools["govulncheck"] ? {
-		tool: "govulncheck (system)",
-		status: "ok"
-	} : {
-		tool: "govulncheck not found",
-		status: "missing",
-		remediation: "Install: go install golang.org/x/vuln/cmd/govulncheck@latest"
-	};
+	for (const spec of AUDIT_SPECS) {
+		if (!spec.files.some(hasFile)) continue;
+		if (spec.bundled) return {
+			tool: spec.bundled,
+			status: "ok"
+		};
+		if (spec.systemTool) return (spec.systemTool.requiresBinaries ?? [spec.systemTool.binary]).every((b) => installedTools[b]) ? {
+			tool: `${spec.systemTool.toolLabel} (system)`,
+			status: "ok"
+		} : {
+			tool: `${spec.systemTool.toolLabel} not found`,
+			status: "missing",
+			remediation: spec.systemTool.remediation
+		};
+	}
 	return {
 		tool: "no auditor",
 		status: "skipped",
@@ -1206,23 +1217,9 @@ const detectOverAbstraction = async (context) => {
 
 //#endregion
 //#region src/engines/ai-slop/comments.ts
-const TRIVIAL_JS_COMMENT_PATTERNS = [
-	/\/\/\s*This (?:function|method|class|variable|constant) (?:will |is used to |is responsible for )?/i,
-	/\/\/\s*Import(?:ing|s)?\s+/i,
-	/\/\/\s*Defin(?:e|ing)\s+(?:the\s+)?/i,
-	/\/\/\s*Initializ(?:e|ing)\s+(?:the\s+)?/i,
-	/\/\/\s*Set(?:ting)?\s+\w+\s+to\s+/i,
-	/\/\/\s*Return(?:ing|s)?\s+(?:the\s+)?/i,
-	/\/\/\s*Check(?:ing)?\s+(?:if|whether)\s+/i,
-	/\/\/\s*(?:Loop(?:ing)?\s+through|Iterat(?:e|ing)\s+over)\s+/i,
-	/\/\/\s*Creat(?:e|ing)\s+(?:a\s+(?:new\s+)?)?/i,
-	/\/\/\s*Updat(?:e|ing)\s+(?:the\s+)?/i,
-	/\/\/\s*(?:Delet|Remov)(?:e|ing)\s+(?:the\s+)?/i,
-	/\/\/\s*Handl(?:e|ing)\s+(?:the\s+)?/i,
-	/\/\/\s*(?:Get(?:ting)?|Fetch(?:ing)?)\s+(?:the\s+)?/i,
-	/\/\/\s*(?:Increment|Decrement)(?:ing)?\s+/i
-];
-const TRIVIAL_PYTHON_COMMENT_PATTERNS = [/^#\s*This (?:function|method|class) (?:will |is used to )?/i, /^#\s*(?:Import|Define|Initialize|Return|Check|Create|Update|Delete|Handle|Get|Fetch)/i];
+const TRIVIAL_VERB_STEMS = "Import|Defin|Initializ|Setting|Set\\s+up|Setup|Return|Check|Loop|Iterat|Creat|Updat|Delet|Remov|Handl|Get|Fetch|Increment|Decrement|Writ|Runn|Run|Pars|Execut|Extract|Sav|Load|Build|Start|Stopp|Stop|Clean(?:up|\\s+up)?|Configur|Validat|Process|Queue|Fire|Emit|Dispatch|Log|Print|Render";
+const TRIVIAL_JS_COMMENT_PATTERNS = [/\/\/\s*This (?:function|method|class|variable|constant) (?:will |is used to |is responsible for )?/i, new RegExp(`\\/\\/\\s*(?:${TRIVIAL_VERB_STEMS})(?:e|es|ing|s)?\\b`, "i")];
+const TRIVIAL_PYTHON_COMMENT_PATTERNS = [/^#\s*This (?:function|method|class) (?:will |is used to )?/i, new RegExp(`^#\\s*(?:${TRIVIAL_VERB_STEMS})(?:e|es|ing|s)?\\b`, "i")];
 const EXPLANATORY_KEYWORDS = /\b(?:because|since|note|todo|fixme|hack|warn|warning|workaround|caveat|important|assumes?)\b/i;
 const COMMENTED_CODE_CHARS = /[({=;}\]>]/;
 const MAX_TRIVIAL_COMMENT_LENGTH = 60;
@@ -1298,6 +1295,18 @@ const JS_EXTENSIONS$1 = new Set([
 	".cjs"
 ]);
 const CONSOLE_LOG_PATTERN = /\bconsole\.(?:log|debug|info|trace|dir|table)\s*\(/;
+const slop = (filePath, line, rule, severity, message, help, fixable) => ({
+	filePath,
+	engine: "ai-slop",
+	rule,
+	severity,
+	message,
+	help,
+	line,
+	column: 0,
+	category: "AI Slop",
+	fixable
+});
 const LOGGER_FILE_PATTERN = /(?:^|\/)(?:logger|logging|log)\.[^/]+$/i;
 const SCRIPT_DIR_PATTERN = /(?:^|\/)(scripts|bin)\//;
 const detectConsoleLeftovers = (content, relativePath, ext) => {
@@ -1312,18 +1321,7 @@ const detectConsoleLeftovers = (content, relativePath, ext) => {
 		if (CONSOLE_LOG_PATTERN.test(trimmed)) {
 			if (/console\.(?:error|warn)\s*\(/.test(trimmed)) continue;
 			if (/console\.log\(\s*JSON\.stringify\b/.test(trimmed)) continue;
-			diagnostics.push({
-				filePath: relativePath,
-				engine: "ai-slop",
-				rule: "ai-slop/console-leftover",
-				severity: "warning",
-				message: "console.log/debug/info statement left in production code",
-				help: "Remove debugging console statements or replace with a proper logger",
-				line: i + 1,
-				column: 0,
-				category: "AI Slop",
-				fixable: true
-			});
+			diagnostics.push(slop(relativePath, i + 1, "ai-slop/console-leftover", "warning", "console.log/debug/info statement left in production code", "Remove debugging console statements or replace with a proper logger", true));
 		}
 	}
 	return diagnostics;
@@ -1344,18 +1342,7 @@ const detectTodoStubs = (content, relativePath) => {
 	for (let i = 0; i < lines.length; i++) {
 		const trimmed = lines[i].trim();
 		if (!trimmed.startsWith("//") && !trimmed.startsWith("#") && !trimmed.startsWith("*") && !trimmed.startsWith("/*")) continue;
-		if (TODO_PATTERN.test(trimmed)) diagnostics.push({
-			filePath: relativePath,
-			engine: "ai-slop",
-			rule: "ai-slop/todo-stub",
-			severity: "info",
-			message: "Unresolved TODO/FIXME/HACK comment indicates incomplete code",
-			help: "Resolve the TODO or create a tracked issue for it",
-			line: i + 1,
-			column: 0,
-			category: "AI Slop",
-			fixable: false
-		});
+		if (TODO_PATTERN.test(trimmed)) diagnostics.push(slop(relativePath, i + 1, "ai-slop/todo-stub", "info", "Unresolved TODO/FIXME/HACK comment indicates incomplete code", "Resolve the TODO or create a tracked issue for it", false));
 	}
 	return diagnostics;
 };
@@ -1365,42 +1352,9 @@ const detectDeadCodePatterns = (content, relativePath, ext) => {
 	for (let i = 0; i < lines.length; i++) {
 		const trimmed = lines[i].trim();
 		const nextLine = i + 1 < lines.length ? lines[i + 1]?.trim() : void 0;
-		if (JS_EXTENSIONS$1.has(ext) && /^(?:return|throw)\b/.test(trimmed) && trimmed.endsWith(";") && nextLine && nextLine.length > 0 && !nextLine.startsWith("}") && !nextLine.startsWith("//") && !nextLine.startsWith("/*") && !nextLine.startsWith("case ") && !nextLine.startsWith("default:") && !nextLine.startsWith("if ") && !nextLine.startsWith("if(") && !nextLine.startsWith("else")) diagnostics.push({
-			filePath: relativePath,
-			engine: "ai-slop",
-			rule: "ai-slop/unreachable-code",
-			severity: "warning",
-			message: "Code after return/throw statement is unreachable",
-			help: "Remove the unreachable code or restructure the control flow",
-			line: i + 2,
-			column: 0,
-			category: "AI Slop",
-			fixable: false
-		});
-		if (/\bif\s*\(\s*(?:false|true|0|1)\s*\)/.test(trimmed) && !trimmed.startsWith("//") && !trimmed.startsWith("*") && !/["'`].*\bif\s*\(/.test(trimmed) && !/\/.*\bif\s*\(/.test(trimmed.replace(/\/\/.*$/, ""))) diagnostics.push({
-			filePath: relativePath,
-			engine: "ai-slop",
-			rule: "ai-slop/constant-condition",
-			severity: "warning",
-			message: "Conditional with a constant value — likely debugging leftover",
-			help: "Remove the constant condition or replace with proper logic",
-			line: i + 1,
-			column: 0,
-			category: "AI Slop",
-			fixable: false
-		});
-		if (JS_EXTENSIONS$1.has(ext) && /(?:function\s+\w+|=>\s*)\s*\{\s*\}\s*;?\s*$/.test(trimmed) && !trimmed.startsWith("interface") && !trimmed.startsWith("type ")) diagnostics.push({
-			filePath: relativePath,
-			engine: "ai-slop",
-			rule: "ai-slop/empty-function",
-			severity: "info",
-			message: "Empty function body — possible stub or unfinished implementation",
-			help: "Implement the function body or add a comment explaining why it's empty",
-			line: i + 1,
-			column: 0,
-			category: "AI Slop",
-			fixable: false
-		});
+		if (JS_EXTENSIONS$1.has(ext) && /^(?:return|throw)\b/.test(trimmed) && trimmed.endsWith(";") && nextLine && nextLine.length > 0 && !nextLine.startsWith("}") && !nextLine.startsWith("//") && !nextLine.startsWith("/*") && !nextLine.startsWith("case ") && !nextLine.startsWith("default:") && !nextLine.startsWith("if ") && !nextLine.startsWith("if(") && !nextLine.startsWith("else")) diagnostics.push(slop(relativePath, i + 2, "ai-slop/unreachable-code", "warning", "Code after return/throw statement is unreachable", "Remove the unreachable code or restructure the control flow", false));
+		if (/\bif\s*\(\s*(?:false|true|0|1)\s*\)/.test(trimmed) && !trimmed.startsWith("//") && !trimmed.startsWith("*") && !/["'`].*\bif\s*\(/.test(trimmed) && !/\/.*\bif\s*\(/.test(trimmed.replace(/\/\/.*$/, ""))) diagnostics.push(slop(relativePath, i + 1, "ai-slop/constant-condition", "warning", "Conditional with a constant value — likely debugging leftover", "Remove the constant condition or replace with proper logic", false));
+		if (JS_EXTENSIONS$1.has(ext) && /(?:function\s+\w+|=>\s*)\s*\{\s*\}\s*;?\s*$/.test(trimmed) && !trimmed.startsWith("interface") && !trimmed.startsWith("type ")) diagnostics.push(slop(relativePath, i + 1, "ai-slop/empty-function", "info", "Empty function body — possible stub or unfinished implementation", "Implement the function body or add a comment explaining why it's empty", false));
 	}
 	return diagnostics;
 };
@@ -1412,46 +1366,13 @@ const detectUnsafeTypePatterns = (content, relativePath, ext) => {
 	const lines = content.split("\n");
 	for (let i = 0; i < lines.length; i++) {
 		const trimmed = lines[i].trim();
-		if (/\/\/\s*@ts-(?:ignore|expect-error)/.test(trimmed) || /\/\*\s*@ts-(?:ignore|expect-error)/.test(trimmed)) diagnostics.push({
-			filePath: relativePath,
-			engine: "ai-slop",
-			rule: "ai-slop/ts-directive",
-			severity: "info",
-			message: "@ts-ignore/@ts-expect-error suppresses type checking — review if still needed",
-			help: "Fix the underlying type issue instead of suppressing the error",
-			line: i + 1,
-			column: 0,
-			category: "AI Slop",
-			fixable: false
-		});
+		if (/\/\/\s*@ts-(?:ignore|expect-error)/.test(trimmed) || /\/\*\s*@ts-(?:ignore|expect-error)/.test(trimmed)) diagnostics.push(slop(relativePath, i + 1, "ai-slop/ts-directive", "info", "@ts-ignore/@ts-expect-error suppresses type checking — review if still needed", "Fix the underlying type issue instead of suppressing the error", false));
 		if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
 		if (/\bRegExp\b|new\s+RegExp|\/.*\\b/.test(trimmed)) continue;
 		if (/["'`].*\\b.*["'`]/.test(trimmed)) continue;
-		if (asAnyPattern.test(trimmed)) diagnostics.push({
-			filePath: relativePath,
-			engine: "ai-slop",
-			rule: "ai-slop/unsafe-type-assertion",
-			severity: "warning",
-			message: `'as any' bypasses type safety`,
-			help: "Use a proper type or a more specific assertion",
-			line: i + 1,
-			column: 0,
-			category: "AI Slop",
-			fixable: false
-		});
+		if (asAnyPattern.test(trimmed)) diagnostics.push(slop(relativePath, i + 1, "ai-slop/unsafe-type-assertion", "warning", `'as any' bypasses type safety`, "Use a proper type or a more specific assertion", false));
 		if (doubleAssertPattern.test(trimmed)) {
-			if (!(/\.query[(<]/.test(trimmed) || /result\[0\]/.test(trimmed) || /rows\s/.test(trimmed))) diagnostics.push({
-				filePath: relativePath,
-				engine: "ai-slop",
-				rule: "ai-slop/double-type-assertion",
-				severity: "warning",
-				message: `Double type assertion (as unknown as X) bypasses type checking`,
-				help: "Refactor to avoid needing a double assertion. If this is an ORM query return, consider a typed wrapper function",
-				line: i + 1,
-				column: 0,
-				category: "AI Slop",
-				fixable: false
-			});
+			if (!(/\.query[(<]/.test(trimmed) || /result\[0\]/.test(trimmed) || /rows\s/.test(trimmed))) diagnostics.push(slop(relativePath, i + 1, "ai-slop/double-type-assertion", "warning", `Double type assertion (as unknown as X) bypasses type checking`, "Refactor to avoid needing a double assertion. If this is an ORM query return, consider a typed wrapper function", false));
 		}
 	}
 	return diagnostics;
@@ -1587,6 +1508,7 @@ const CROSS_REFERENCE_PHRASES = [
 ];
 const JUSTIFICATION_OPENERS = [/^(The idea here|The trick is|This was needed|Originally,?)/i];
 const EXPLANATORY_OPENERS = /^(Matches|Detects|Represents|Holds|Stores|Tracks|Handles|Manages|Controls|Contains|Captures|Encapsulates|Wraps|Describes)\s+[A-Za-z`'"]/;
+const EXPLANATORY_WHY_MARKERS = /\b(?:because|since|otherwise|workaround|caveat|warning|important|assumes?|note:|bug|issue|see\s+(?:issue|above|below)|in\s+prod|in\s+production|breaks?\s+when|fails?\s+when|must\s+run|must\s+be|has\s+to\s+be|hack\s+for|fix\s+for|reason:)\b/i;
 const MEANINGFUL_JSDOC_TAGS = new Set([
 	"deprecated",
 	"see",
@@ -1611,7 +1533,49 @@ const MEANINGFUL_JSDOC_TAGS = new Set([
 	"todo",
 	"link",
 	"license",
-	"preserve"
+	"preserve",
+	"swagger",
+	"openapi",
+	"route",
+	"group",
+	"summary",
+	"description",
+	"operationid",
+	"response",
+	"responses",
+	"request",
+	"requestbody",
+	"security",
+	"tag",
+	"tags",
+	"path",
+	"body",
+	"query",
+	"queryparam",
+	"header",
+	"headers",
+	"produces",
+	"accept",
+	"middleware",
+	"api",
+	"apiname",
+	"apidefine",
+	"apigroup",
+	"apiparam",
+	"apiquery",
+	"apibody",
+	"apiheader",
+	"apisuccess",
+	"apierror",
+	"apiexample",
+	"apiversion",
+	"apidescription",
+	"apipermission",
+	"apiuse",
+	"apiignore",
+	"apiprivate",
+	"namespace",
+	"category"
 ]);
 const SUPPORTED_EXTS = new Set([
 	".ts",
@@ -1755,6 +1719,23 @@ const looksLikeLicenseHeader = (block) => {
 	const text = block.rawLines.join(" ").toLowerCase();
 	return text.includes("copyright") || text.includes("license") || text.includes("spdx-license-identifier");
 };
+const BARE_LABEL_RE = /^[A-Z][A-Za-z0-9 ]{1,28}$/;
+const isBareSectionLabel = (prose) => {
+	if (!BARE_LABEL_RE.test(prose)) return false;
+	if (prose.endsWith(".")) return false;
+	if (prose.split(/\s+/).length > 3) return false;
+	return true;
+};
+const DATA_ENTRY_START = /^\s*(?:\{|\[|["'`]|\d|\w+:\s|case\s)/;
+const nextLineLooksLikeDataEntry = (nextLine) => {
+	if (nextLine === null) return false;
+	if (!DATA_ENTRY_START.test(nextLine)) return false;
+	const trimmed = nextLine.trim();
+	if (trimmed.startsWith("case ")) return true;
+	if (trimmed.startsWith("{") || trimmed.startsWith("[") || trimmed.startsWith("\"") || trimmed.startsWith("'") || trimmed.startsWith("`")) return true;
+	if (/^\w+\s*:/.test(trimmed)) return true;
+	return false;
+};
 const looksLikeSuppressDirective = (block) => block.rawLines.some((l) => /\b(biome-ignore|eslint-disable|ts-ignore|ts-expect-error|@ts-\w+|noqa|pylint:\s*disable|rubocop:disable|noinspection|phpcs:disable)\b/.test(l));
 const detectNarrativeInBlock = (block, ext) => {
 	if (looksLikeLicenseHeader(block)) return {
@@ -1777,6 +1758,10 @@ const detectNarrativeInBlock = (block, ext) => {
 		matched: true,
 		reason: "phase/section header"
 	};
+	if (block.kind === "line" && block.prose.length === 1 && isBareSectionLabel(block.prose[0]) && !nextLineLooksLikeDataEntry(block.nextNonBlankLine)) return {
+		matched: true,
+		reason: "bare section label"
+	};
 	if (block.prose.length >= 3 && looksLikeDeclarationPreamble(block.nextNonBlankLine, ext)) return {
 		matched: true,
 		reason: block.kind === "jsdoc" ? "JSDoc preamble before declaration" : "multi-line preamble before declaration"
@@ -1796,10 +1781,17 @@ const detectNarrativeInBlock = (block, ext) => {
 		matched: true,
 		reason: "explanatory preamble"
 	};
-	if (block.prose.filter((l) => l.length > 0).length >= 5) return {
+	const nonEmptyProseCount = block.prose.filter((l) => l.length > 0).length;
+	const joinedProse = block.prose.join(" ");
+	const hasWhyMarker = EXPLANATORY_WHY_MARKERS.test(joinedProse);
+	if (nonEmptyProseCount >= 5) return {
 		matched: true,
 		reason: "long narrative block"
 	};
+	if (nonEmptyProseCount >= 3 && !hasWhyMarker && block.kind === "line") return {
+		matched: true,
+		reason: "multi-line narrative prose"
+	};
 	return {
 		matched: false,
 		reason: ""
@@ -2559,6 +2551,130 @@ const checkComplexity = async (context) => {
 	return diagnostics;
 };
 
+//#endregion
+//#region src/engines/code-quality/duplicate-block.ts
+const WINDOW_SIZE = 10;
+const MIN_DISTINCT_LINES = 7;
+const SOURCE_EXTS$1 = new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mjs",
+	".cjs"
+]);
+const MEANINGFUL_LINE = /\S/;
+const normaliseLine = (line) => line.replace(/"[^"]*"|'[^']*'|`[^`]*`/g, "\"L\"").replace(/\b\d+(?:\.\d+)?\b/g, "0").replace(/\s+/g, " ").trim();
+const isTrivialLine = (line) => {
+	const trimmed = line.trim();
+	if (trimmed.length === 0) return true;
+	if (trimmed === "{" || trimmed === "}" || trimmed === "});" || trimmed === "},") return true;
+	if (trimmed.startsWith("//")) return true;
+	if (trimmed.startsWith("/*") || trimmed.startsWith("*")) return true;
+	return false;
+};
+const SUPPRESS_RE = /aislop[- ]ignore(?:-next-block|-file)?\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
+const FILE_SUPPRESS_RE = /aislop[- ]ignore-file\b.*\b(?:duplicate-block|code-quality\/duplicate-block)\b/;
+const fileHasSuppression = (content) => FILE_SUPPRESS_RE.test(content);
+const findSuppressedLines = (lines) => {
+	const suppressed = /* @__PURE__ */ new Set();
+	for (let i = 0; i < lines.length; i++) {
+		if (!SUPPRESS_RE.test(lines[i])) continue;
+		let depth = 0;
+		let started = false;
+		for (let j = i + 1; j < lines.length; j++) {
+			suppressed.add(j + 1);
+			const opens = (lines[j].match(/\{/g) ?? []).length;
+			const closes = (lines[j].match(/\}/g) ?? []).length;
+			depth += opens - closes;
+			if (opens > 0) started = true;
+			if (started && depth <= 0) break;
+		}
+	}
+	return suppressed;
+};
+const collectMeaningfulLines = (content) => {
+	if (fileHasSuppression(content)) return [];
+	const lines = content.split("\n");
+	const suppressed = findSuppressedLines(lines);
+	const hits = [];
+	for (let i = 0; i < lines.length - WINDOW_SIZE + 1; i++) {
+		if (suppressed.has(i + 1)) continue;
+		const window = lines.slice(i, i + WINDOW_SIZE);
+		if (window.some((l) => !MEANINGFUL_LINE.test(l))) continue;
+		if (window.every(isTrivialLine)) continue;
+		const normalised = window.map(normaliseLine);
+		if (normalised.filter((n) => n.length > 0 && n !== "}" && n !== "{").length < WINDOW_SIZE - 1) continue;
+		if (new Set(normalised).size < MIN_DISTINCT_LINES) continue;
+		hits.push({
+			startLine: i + 1,
+			normalised
+		});
+	}
+	return hits;
+};
+const findDuplicateBlocks = (content, relativePath) => {
+	const blocks = collectMeaningfulLines(content);
+	const seen = /* @__PURE__ */ new Map();
+	const reports = [];
+	const reportedCurrent = /* @__PURE__ */ new Set();
+	for (const block of blocks) {
+		const key = block.normalised.join("\n");
+		const prior = seen.get(key);
+		if (prior === void 0) {
+			seen.set(key, block.startLine);
+			continue;
+		}
+		if (block.startLine - prior < WINDOW_SIZE) continue;
+		if (reportedCurrent.has(prior)) continue;
+		const last = reports[reports.length - 1];
+		if (last && block.startLine - last.currentStart < WINDOW_SIZE && prior - last.priorStart < WINDOW_SIZE) {
+			last.priorEnd = Math.max(last.priorEnd, prior + WINDOW_SIZE - 1);
+			last.currentEnd = Math.max(last.currentEnd, block.startLine + WINDOW_SIZE - 1);
+			continue;
+		}
+		reportedCurrent.add(prior);
+		reports.push({
+			priorStart: prior,
+			priorEnd: prior + WINDOW_SIZE - 1,
+			currentStart: block.startLine,
+			currentEnd: block.startLine + WINDOW_SIZE - 1
+		});
+	}
+	return reports.map((r) => {
+		return {
+			filePath: relativePath,
+			engine: "code-quality",
+			rule: "code-quality/duplicate-block",
+			severity: "warning",
+			message: `${r.currentEnd - r.currentStart + 1}-line block at line ${r.currentStart} duplicates a block starting at line ${r.priorStart}. Extract a shared helper.`,
+			help: `Pull the shared logic into a function both sites can call. Keeps one version of the truth and makes future changes one-shot instead of N-shot.`,
+			line: r.currentStart,
+			column: 0,
+			category: "Complexity",
+			fixable: false
+		};
+	});
+};
+const detectDuplicateBlocks = async (context) => {
+	const files = getSourceFiles(context);
+	const diagnostics = [];
+	for (const filePath of files) {
+		const ext = path.extname(filePath).toLowerCase();
+		if (!SOURCE_EXTS$1.has(ext)) continue;
+		if (isAutoGenerated(filePath)) continue;
+		let content;
+		try {
+			content = fs.readFileSync(filePath, "utf-8");
+		} catch {
+			continue;
+		}
+		const relative = path.relative(context.rootDirectory, filePath);
+		diagnostics.push(...findDuplicateBlocks(content, relative));
+	}
+	return diagnostics;
+};
+
 //#endregion
 //#region src/engines/code-quality/knip.ts
 const KNIP_MESSAGE_MAP = {
@@ -2733,6 +2849,78 @@ const runKnip = async (rootDirectory) => {
 	}
 };
 
+//#endregion
+//#region src/engines/code-quality/repeated-chained-call.ts
+const METHOD_CALL_RE = /^\s*\.([A-Za-z_$][\w$]*)\s*\(/;
+const CHAIN_THRESHOLD = 5;
+const hasOnlyLiteralDifferences = (lines) => {
+	const normalised = lines.map((l) => l.replace(/"[^"]*"|'[^']*'|`[^`]*`/g, "\"L\"").trim().replace(/;\s*$/, ""));
+	return new Set(normalised).size === 1;
+};
+const findRepeatedChains = (content, relativePath) => {
+	const diagnostics = [];
+	const lines = content.split("\n");
+	let i = 0;
+	while (i < lines.length) {
+		const match = lines[i].match(METHOD_CALL_RE);
+		if (!match) {
+			i += 1;
+			continue;
+		}
+		const methodName = match[1];
+		const runStart = i;
+		let runEnd = i;
+		while (runEnd + 1 < lines.length) {
+			const next = lines[runEnd + 1].match(METHOD_CALL_RE);
+			if (!next || next[1] !== methodName) break;
+			runEnd += 1;
+		}
+		const runLength = runEnd - runStart + 1;
+		if (runLength >= CHAIN_THRESHOLD && hasOnlyLiteralDifferences(lines.slice(runStart, runEnd + 1))) {
+			diagnostics.push({
+				filePath: relativePath,
+				engine: "code-quality",
+				rule: "code-quality/repeated-chained-call",
+				severity: "warning",
+				message: `${runLength} consecutive \`.${methodName}()\` calls that differ only in string literals. Extract a data table + loop.`,
+				help: `Move the per-call args into an array and call \`.${methodName}()\` in a \`for\` loop. Keeps the registration in one place and lets you document the table once.`,
+				line: runStart + 1,
+				column: 0,
+				category: "Complexity",
+				fixable: false
+			});
+			i = runEnd + 1;
+		} else i += 1;
+	}
+	return diagnostics;
+};
+const SOURCE_EXTS = new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mjs",
+	".cjs"
+]);
+const detectRepeatedChainedCalls = async (context) => {
+	const files = getSourceFiles(context);
+	const diagnostics = [];
+	for (const filePath of files) {
+		const ext = path.extname(filePath).toLowerCase();
+		if (!SOURCE_EXTS.has(ext)) continue;
+		if (isAutoGenerated(filePath)) continue;
+		let content;
+		try {
+			content = fs.readFileSync(filePath, "utf-8");
+		} catch {
+			continue;
+		}
+		const relative = path.relative(context.rootDirectory, filePath);
+		diagnostics.push(...findRepeatedChains(content, relative));
+	}
+	return diagnostics;
+};
+
 //#endregion
 //#region src/engines/code-quality/index.ts
 const codeQualityEngine = {
@@ -2742,6 +2930,8 @@ const codeQualityEngine = {
 		const promises = [];
 		if (context.languages.includes("typescript") || context.languages.includes("javascript")) promises.push(runKnip(context.rootDirectory));
 		promises.push(checkComplexity(context));
+		promises.push(detectRepeatedChainedCalls(context));
+		promises.push(detectDuplicateBlocks(context));
 		const results = await Promise.allSettled(promises);
 		for (const result of results) if (result.status === "fulfilled") diagnostics.push(...result.value);
 		return {
@@ -3990,6 +4180,54 @@ const maskStringsAndComments = (content, ext) => {
 	if (family === "js") return maskJs(content);
 	return maskSimple(content, family);
 };
+const handleQuotesAndComments = (content, i, tplStack, mask) => {
+	const len = content.length;
+	const c = content[i];
+	const next = content[i + 1];
+	if (c === "\"" || c === "'") {
+		const strStart = i;
+		const end = consumeQuotedString(content, i, c);
+		mask(strStart + 1, end - 1);
+		return {
+			handled: true,
+			nextI: end
+		};
+	}
+	if (c === "`") {
+		const scan = consumeTemplateString(content, i + 1);
+		mask(i + 1, scan.maskEnd);
+		if (scan.openedInterp) tplStack.push(0);
+		return {
+			handled: true,
+			nextI: scan.resumeAt
+		};
+	}
+	if (c === "/" && next === "/") {
+		const strStart = i;
+		let k = i;
+		while (k < len && content[k] !== "\n") k++;
+		mask(strStart, k);
+		return {
+			handled: true,
+			nextI: k
+		};
+	}
+	if (c === "/" && next === "*") {
+		const strStart = i;
+		let k = i + 2;
+		while (k < len - 1 && !(content[k] === "*" && content[k + 1] === "/")) k++;
+		if (k < len - 1) k += 2;
+		mask(strStart, k);
+		return {
+			handled: true,
+			nextI: k
+		};
+	}
+	return {
+		handled: false,
+		nextI: i
+	};
+};
 const maskJs = (content) => {
 	const out = content.split("");
 	const len = content.length;
@@ -4000,7 +4238,6 @@ const maskJs = (content) => {
 	};
 	while (i < len) {
 		const c = content[i];
-		const next = content[i + 1];
 		if (tplStack.length > 0) {
 			if (c === "{") {
 				tplStack[tplStack.length - 1]++;
@@ -4020,61 +4257,10 @@ const maskJs = (content) => {
 				i++;
 				continue;
 			}
-			if (c === "\"" || c === "'") {
-				const strStart = i;
-				i = consumeQuotedString(content, i, c);
-				mask(strStart + 1, i - 1);
-				continue;
-			}
-			if (c === "`") {
-				const scan = consumeTemplateString(content, i + 1);
-				mask(i + 1, scan.maskEnd);
-				if (scan.openedInterp) tplStack.push(0);
-				i = scan.resumeAt;
-				continue;
-			}
-			if (c === "/" && next === "/") {
-				const strStart = i;
-				while (i < len && content[i] !== "\n") i++;
-				mask(strStart, i);
-				continue;
-			}
-			if (c === "/" && next === "*") {
-				const strStart = i;
-				i += 2;
-				while (i < len - 1 && !(content[i] === "*" && content[i + 1] === "/")) i++;
-				if (i < len - 1) i += 2;
-				mask(strStart, i);
-				continue;
-			}
-			i++;
-			continue;
 		}
-		if (c === "\"" || c === "'") {
-			const strStart = i;
-			i = consumeQuotedString(content, i, c);
-			mask(strStart + 1, i - 1);
-			continue;
-		}
-		if (c === "`") {
-			const scan = consumeTemplateString(content, i + 1);
-			mask(i + 1, scan.maskEnd);
-			if (scan.openedInterp) tplStack.push(0);
-			i = scan.resumeAt;
-			continue;
-		}
-		if (c === "/" && next === "/") {
-			const strStart = i;
-			while (i < len && content[i] !== "\n") i++;
-			mask(strStart, i);
-			continue;
-		}
-		if (c === "/" && next === "*") {
-			const strStart = i;
-			i += 2;
-			while (i < len - 1 && !(content[i] === "*" && content[i + 1] === "/")) i++;
-			if (i < len - 1) i += 2;
-			mask(strStart, i);
+		const handled = handleQuotesAndComments(content, i, tplStack, mask);
+		if (handled.handled) {
+			i = handled.nextI;
 			continue;
 		}
 		i++;
@@ -4951,7 +5137,7 @@ const renderCleanRun = (input, deps = {}) => {
 //#region src/utils/git.ts
 const MAX_BUFFER = 50 * 1024 * 1024;
 const getChangedFiles = (cwd, base) => {
-	const result = spawnSync("git", [
+	const diff = spawnSync("git", [
 		"diff",
 		"--name-only",
 		"--diff-filter=ACMR",
@@ -4961,8 +5147,22 @@ const getChangedFiles = (cwd, base) => {
 		encoding: "utf-8",
 		maxBuffer: MAX_BUFFER
 	});
-	if (result.error || result.status !== 0) return [];
-	return result.stdout.split("\n").filter((f) => f.length > 0).map((f) => path.resolve(cwd, f));
+	if (diff.error || diff.status !== 0) return [];
+	const untracked = spawnSync("git", [
+		"ls-files",
+		"--others",
+		"--exclude-standard"
+	], {
+		cwd,
+		encoding: "utf-8",
+		maxBuffer: MAX_BUFFER
+	});
+	const names = /* @__PURE__ */ new Set();
+	for (const line of diff.stdout.split("\n")) if (line.length > 0) names.add(line);
+	if (!untracked.error && untracked.status === 0) {
+		for (const line of untracked.stdout.split("\n")) if (line.length > 0) names.add(line);
+	}
+	return Array.from(names).map((f) => path.resolve(cwd, f));
 };
 const getStagedFiles = (cwd) => {
 	const result = spawnSync("git", [
@@ -5055,11 +5255,14 @@ const scanCommand = async (directory, config, options) => {
 	const projectInfo = await discoverProject(resolvedDir);
 	let files;
 	if (options.staged) {
-		files = filterProjectFiles(resolvedDir, getStagedFiles(resolvedDir));
+		files = filterProjectFiles(resolvedDir, getStagedFiles(resolvedDir), [], config.exclude);
 		if (!options.json) log.muted(`Scope: ${files.length} staged file(s)`);
 	} else if (options.changes) {
-		files = filterProjectFiles(resolvedDir, getChangedFiles(resolvedDir));
+		files = filterProjectFiles(resolvedDir, getChangedFiles(resolvedDir), [], config.exclude);
 		if (!options.json) log.muted(`Scope: ${files.length} changed file(s)`);
+	} else {
+		files = filterProjectFiles(resolvedDir, listProjectFiles(resolvedDir), [], config.exclude);
+		if (!options.json) log.muted(`Scope: ${files.length} file(s) after exclusions`);
 	}
 	const configDir = findConfigDir(resolvedDir);
 	const rulesPath = configDir ? path.join(configDir, RULES_FILE) : void 0;
@@ -5133,7 +5336,7 @@ const scanCommand = async (directory, config, options) => {
 		});
 	}
 	if (options.json) {
-		const { buildJsonOutput } = await import("./json-D_i2_5_-.js");
+		const { buildJsonOutput } = await import("./json-DIW4kCBS.js");
 		const jsonOut = buildJsonOutput(results, scoreResult, projectInfo.sourceFileCount, elapsedMs);
 		console.log(JSON.stringify(jsonOut, null, 2));
 		return { exitCode };
@@ -5919,7 +6122,13 @@ const fixDependencyAudit = async (context, onProgress) => {
 		await tryNpmOverrides(context.rootDirectory, onProgress);
 		return;
 	}
-	await tryPnpmOverrides(context.rootDirectory, onProgress);
+	if (await tryPnpmOverrides(context.rootDirectory, onProgress)) return;
+	if (fs.existsSync(path.join(context.rootDirectory, "package-lock.json"))) {
+		await runNpmAuditFix(context.rootDirectory, onProgress);
+		await tryNpmOverrides(context.rootDirectory, onProgress);
+		return;
+	}
+	onProgress?.("Dependency audit fixes · skipping (pnpm audit unavailable and no package-lock.json for npm fallback)");
 };
 const runNpmAuditFix = async (rootDir, onProgress) => {
 	onProgress?.("Dependency audit fixes · running npm audit fix (can take a few minutes)");
@@ -5951,11 +6160,11 @@ const fetchLatestVersion = async (rootDir, pkgName, pm) => {
 		return null;
 	}
 };
-const collectNpmOverrides = async (rootDir, vulnerabilities) => {
+const collectOverrides = async (rootDir, vulnerabilities, pm) => {
 	const overrides = {};
 	for (const [pkgName, vuln] of Object.entries(vulnerabilities)) {
 		if (vuln.fixAvailable !== false || !vuln.range) continue;
-		const latest = await fetchLatestVersion(rootDir, pkgName, "npm");
+		const latest = await fetchLatestVersion(rootDir, pkgName, pm);
 		if (latest) overrides[pkgName] = latest;
 	}
 	return overrides;
@@ -5969,7 +6178,7 @@ const tryNpmOverrides = async (rootDir, onProgress) => {
 		if (!auditResult.stdout) return;
 		const vulnerabilities = JSON.parse(auditResult.stdout).vulnerabilities;
 		if (!vulnerabilities) return;
-		const overrides = await collectNpmOverrides(rootDir, vulnerabilities);
+		const overrides = await collectOverrides(rootDir, vulnerabilities, "npm");
 		if (Object.keys(overrides).length === 0) return;
 		const pkgPath = path.join(rootDir, "package.json");
 		const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
@@ -6005,23 +6214,31 @@ const collectPnpmOverrides = (advisories) => {
 	}
 	return overrides;
 };
+const isPnpmAuditRetired = (stdout, stderr) => {
+	const haystack = `${stdout}\n${stderr}`.toLowerCase();
+	return haystack.includes("410") || haystack.includes("gone") || haystack.includes("retired") || haystack.includes("endpoint") || haystack.includes("err_pnpm_audit") || haystack.includes("audit endpoint");
+};
 const tryPnpmOverrides = async (rootDir, onProgress) => {
 	onProgress?.("Dependency audit fixes · running pnpm audit");
 	const auditResult = await runSubprocess("pnpm", ["audit", "--json"], {
 		cwd: rootDir,
 		timeout: AUDIT_TIMEOUT
 	});
-	if (!auditResult.stdout) return;
+	if (!auditResult.stdout) {
+		if (isPnpmAuditRetired(auditResult.stdout ?? "", auditResult.stderr ?? "")) return false;
+		return auditResult.exitCode === 0;
+	}
 	let parsed;
 	try {
 		parsed = JSON.parse(auditResult.stdout);
 	} catch {
-		return;
+		if (auditResult.exitCode !== 0 || isPnpmAuditRetired(auditResult.stdout, auditResult.stderr ?? "")) return false;
+		return true;
 	}
 	const advisories = parsed.advisories;
-	if (!advisories || Object.keys(advisories).length === 0) return;
+	if (!advisories || Object.keys(advisories).length === 0) return true;
 	const overrides = collectPnpmOverrides(advisories);
-	if (Object.keys(overrides).length === 0) return;
+	if (Object.keys(overrides).length === 0) return true;
 	const pkgPath = path.join(rootDir, "package.json");
 	const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
 	const pnpmBlock = pkg.pnpm ?? {};
@@ -6039,6 +6256,7 @@ const tryPnpmOverrides = async (rootDir, onProgress) => {
 		cwd: rootDir,
 		timeout: INSTALL_TIMEOUT
 	});
+	return true;
 };
 const fixExpoDependencies = async (context, onProgress) => {
 	await removeDisallowedExpoPackages(context.rootDirectory, onProgress);
@@ -6064,6 +6282,10 @@ const fixExpoDependencies = async (context, onProgress) => {
 	});
 	if (checkResult.exitCode !== 0) throw new Error(checkResult.stderr || checkResult.stdout || "expo dependency check failed");
 };
+/**
+* Run expo-doctor to detect packages that should not be installed directly,
+* then uninstall them. No hardcoded list — expo-doctor is the source of truth.
+*/
 const removeDisallowedExpoPackages = async (rootDir, onProgress) => {
 	try {
 		onProgress?.("Expo dependency alignment · running expo-doctor");