eslint-plugin-ai-guard 1.1.14 → 1.2.0

package/dist/cli/index.js

@@ -382,13 +382,53 @@ var RULE_CATEGORY = {
   "ai-guard/no-duplicate-logic-block": "AI Patterns",
   "ai-guard/no-dead-branch": "AI Patterns"
 };
+var CONFIDENCE_TIER = {
+  // High confidence — near-zero false positive rate
+  "ai-guard/no-hardcoded-secret": "high",
+  "ai-guard/no-eval-dynamic": "high",
+  "ai-guard/no-floating-promise": "high",
+  "ai-guard/no-empty-catch": "high",
+  // Medium confidence — context matters, usually valid
+  "ai-guard/no-sql-string-concat": "medium",
+  "ai-guard/no-await-in-loop": "medium",
+  "ai-guard/require-auth-middleware": "medium",
+  "ai-guard/require-authz-check": "medium",
+  "ai-guard/no-catch-log-rethrow": "medium",
+  "ai-guard/no-catch-without-use": "medium",
+  "ai-guard/no-unsafe-deserialize": "medium",
+  // Low confidence — suggestions, may be intentional
+  "ai-guard/no-async-without-await": "low",
+  "ai-guard/no-async-array-callback": "low",
+  "ai-guard/no-dead-branch": "low",
+  "ai-guard/no-broad-exception": "low",
+  "ai-guard/no-console-in-handler": "low",
+  "ai-guard/no-duplicate-logic-block": "low",
+  "ai-guard/no-redundant-await": "low"
+};
+var ECOSYSTEM_FIX_HINTS = {
+  "react-hooks/exhaustive-deps": "npm install --save-dev eslint-plugin-react-hooks",
+  "react-hooks/rules-of-hooks": "npm install --save-dev eslint-plugin-react-hooks",
+  "@typescript-eslint/": "npm install --save-dev @typescript-eslint/eslint-plugin @typescript-eslint/parser",
+  "import/": "npm install --save-dev eslint-plugin-import",
+  "jsx-a11y/": "npm install --save-dev eslint-plugin-jsx-a11y",
+  "prettier/": "npm install --save-dev eslint-plugin-prettier"
+};
+function getEcosystemFix(ruleId) {
+  if (!ruleId) return null;
+  for (const [prefix, fix] of Object.entries(ECOSYSTEM_FIX_HINTS)) {
+    if (ruleId.startsWith(prefix)) return fix;
+  }
+  return null;
+}
 var PREFIX = {
   success: import_chalk.default.green("\u2714"),
   error: import_chalk.default.red("\u2716"),
   warn: import_chalk.default.yellow("\u26A0"),
   info: import_chalk.default.cyan("\u2139"),
   section: import_chalk.default.bold.white,
-  bullet: import_chalk.default.gray("\u2022")
+  bullet: import_chalk.default.gray("\u2022"),
+  ecosystem: import_chalk.default.yellow("\u26A0"),
+  parser: import_chalk.default.magenta("\u26A1")
 };
 var log = {
   info(msg) {
@@ -408,6 +448,14 @@ var log = {
     console.log(import_chalk.default.bold.cyan(`  \u2500\u2500 ${title} \u2500\u2500`));
     console.log("");
   },
+  /**
+   * Ecosystem section — distinct styling to communicate it's NOT ai-guard output
+   */
+  ecosystemSection(title) {
+    console.log("");
+    console.log(import_chalk.default.bold.yellow(`  \u2500\u2500 ${title} \u2500\u2500`) + import_chalk.default.dim(" (not ai-guard findings)"));
+    console.log("");
+  },
   rule(ruleName, count) {
     console.log(
       `    ${PREFIX.bullet} ${import_chalk.default.yellow(ruleName)} ${import_chalk.default.gray(`(${count} issue${count !== 1 ? "s" : ""})`)}`
@@ -424,9 +472,36 @@ var log = {
       `      ${import_chalk.default.gray(`${line}:${col}`).padEnd(12)} ${icon}  ${import_chalk.default.white(msg)}`
     );
   },
+  /**
+   * Print an ESLint ecosystem issue (missing rule definition, foreign plugin rule, etc.)
+   * with a clear disclaimer that this is NOT an ai-guard finding.
+   */
+  ecosystemIssue(issue, count = 1) {
+    const ruleLabel = issue.ruleId ? import_chalk.default.yellow(issue.ruleId) : import_chalk.default.gray("(no rule id)");
+    const typeLabel = issue.type === "missing-rule" ? import_chalk.default.dim("[missing rule definition]") : issue.type === "config-error" ? import_chalk.default.dim("[config error]") : import_chalk.default.dim("[foreign rule]");
+    const countLabel = count > 1 ? import_chalk.default.gray(` \xD7 ${count}`) : "";
+    console.log(`  ${PREFIX.ecosystem}  ${ruleLabel} ${typeLabel}${countLabel}`);
+    console.log(`       ${import_chalk.default.gray("File:")} ${import_chalk.default.dim(issue.filePath)}${issue.line > 0 ? import_chalk.default.dim(`:${issue.line}`) : ""}`);
+    console.log(`       ${import_chalk.default.gray("Msg:")}  ${import_chalk.default.dim(issue.message.slice(0, 120))}`);
+    const fix = getEcosystemFix(issue.ruleId);
+    if (fix) {
+      console.log(`       ${import_chalk.default.cyan("\u2192 Fix:")} ${import_chalk.default.yellow(fix)}`);
+    }
+    console.log(
+      import_chalk.default.dim(`       Note: This comes from your ESLint config, not from ai-guard.`)
+    );
+    console.log("");
+  },
+  /**
+   * Print a parser/syntax error — clearly NOT an ai-guard finding.
+   */
+  parserError(pe) {
+    console.log(`  ${PREFIX.parser}  ${import_chalk.default.magenta("Parse failure")}  ${import_chalk.default.dim(pe.filePath)}${pe.line > 0 ? import_chalk.default.dim(`:${pe.line}`) : ""}`);
+    console.log(`       ${import_chalk.default.dim(pe.message.slice(0, 120))}`);
+    console.log("");
+  },
   /**
    * Print a category summary line with icon, label, and count.
-   * e.g.  🔴 Security        3 errors · 0 warnings
    */
   category(icon, label, errors, warnings) {
     const parts = [];
@@ -437,7 +512,7 @@ var log = {
     console.log(`  ${icon}  ${import_chalk.default.bold.white(labelPadded)} ${counts}`);
   },
   /**
-   * Print the scan stats line: files scanned, duration, preset.
+   * Print the scan stats line.
    */
   scanStats(filesScanned, filesWithIssues, durationMs, preset) {
     console.log(
@@ -547,9 +622,27 @@ var DEFAULT_IGNORE_PATTERNS = [
 ];
 function isSkippablePatternError(error) {
   const msg = error.message.toLowerCase();
-  const hasNoFilesSignal = msg.includes("no files") || msg.includes("no files matching");
-  const hasIgnoredSignal = msg.includes("ignored") || msg.includes("all files matched by") || msg.includes("are ignored") || msg.includes("was ignored") || msg.includes("file ignored");
-  return hasNoFilesSignal || hasIgnoredSignal;
+  return msg.includes("no files") || msg.includes("no files matching") || msg.includes("ignored") || msg.includes("all files matched by") || msg.includes("are ignored") || msg.includes("was ignored") || msg.includes("file ignored");
+}
+function classifyMessage(msg) {
+  if (msg.fatal === true) return "parser-error";
+  if (msg.ruleId === null && (msg.message.startsWith("Parsing error") || msg.message.includes("Unexpected token") || msg.message.includes("SyntaxError"))) {
+    return "parser-error";
+  }
+  if (msg.ruleId && msg.ruleId.startsWith("ai-guard/")) {
+    return "ai-guard";
+  }
+  return "ecosystem";
+}
+function classifyEcosystemType(msg) {
+  const lower = msg.message.toLowerCase();
+  if (lower.includes("definition for rule") && lower.includes("was not found")) {
+    return "missing-rule";
+  }
+  if (lower.includes("configuration") || lower.includes("config")) {
+    return "config-error";
+  }
+  return "foreign-rule";
 }
 async function loadPluginModuleFromCwd(cwd) {
   const { createRequire: createRequire2 } = await import("module");
@@ -577,13 +670,22 @@ async function loadPluginModuleFromCwd(cwd) {
   );
 }
 async function runEslint(options) {
+  const overallStart = Date.now();
+  const timing = {
+    pluginLoadMs: 0,
+    parserLoadMs: 0,
+    lintMs: 0,
+    processMs: 0
+  };
   const { ESLint } = await import("eslint").catch(() => {
     throw new Error(
       "ESLint is not installed. Run: npm install --save-dev eslint"
     );
   });
+  const pluginStart = Date.now();
   const rawPlugin = await loadPluginModuleFromCwd(process.cwd());
   const plugin = normalizePlugin(rawPlugin);
+  timing.pluginLoadMs = Date.now() - pluginStart;
   const rules = getRules(options.preset);
   const resolvedTargetPath = import_path.default.resolve(options.targetPath);
   if (!import_fs.default.existsSync(resolvedTargetPath)) {
@@ -592,18 +694,9 @@ async function runEslint(options) {
   const targetStat = import_fs.default.statSync(resolvedTargetPath);
   const isSingleFileTarget = targetStat.isFile();
   const eslintCwd = isSingleFileTarget ? import_path.default.dirname(resolvedTargetPath) : resolvedTargetPath;
-  const startMs = Date.now();
-  const JS_TS_FILES = [
-    "**/*.js",
-    "**/*.jsx",
-    "**/*.ts",
-    "**/*.tsx",
-    "**/*.mts",
-    "**/*.cts",
-    "**/*.mjs",
-    "**/*.cjs"
-  ];
+  const parserStart = Date.now();
   let tsParser = null;
+  let tsParserAvailable = false;
   try {
     try {
       tsParser = require(import_path.default.join(
@@ -615,10 +708,23 @@ async function runEslint(options) {
     } catch {
       tsParser = require("@typescript-eslint/parser");
     }
+    tsParserAvailable = true;
   } catch {
+    log.debug("@typescript-eslint/parser not found \u2014 TypeScript files will use espree fallback");
   }
+  timing.parserLoadMs = Date.now() - parserStart;
+  const JS_TS_FILES = [
+    "**/*.js",
+    "**/*.jsx",
+    "**/*.ts",
+    "**/*.tsx",
+    "**/*.mts",
+    "**/*.cts",
+    "**/*.mjs",
+    "**/*.cjs"
+  ];
   const configBlocks = [
-    // JS/JSX files — default espree parser
+    // JS/JSX files — default espree parser with JSX support
     {
       files: ["**/*.js", "**/*.jsx", "**/*.mjs", "**/*.cjs"],
       plugins: { "ai-guard": plugin },
@@ -641,9 +747,9 @@ async function runEslint(options) {
       languageOptions: {
         parser: tsParser,
         parserOptions: {
-          // project: true would be needed for type-aware rules — skip for speed
           ecmaVersion: "latest",
-          sourceType: "module"
+          sourceType: "module",
+          ecmaFeatures: { jsx: true }
         }
       },
       rules
@@ -652,6 +758,13 @@ async function runEslint(options) {
     configBlocks.splice(1, 0, {
       files: ["**/*.ts", "**/*.tsx", "**/*.mts", "**/*.cts"],
       plugins: { "ai-guard": plugin },
+      languageOptions: {
+        parserOptions: {
+          ecmaVersion: "latest",
+          sourceType: "module",
+          ecmaFeatures: { jsx: true }
+        }
+      },
       rules
     });
   }
@@ -661,50 +774,107 @@ async function runEslint(options) {
     overrideConfig: configBlocks
   });
   const patterns = isSingleFileTarget ? [import_path.default.basename(resolvedTargetPath)] : JS_TS_FILES;
-  const perPatternResults = await Promise.all(
-    patterns.map(async (pattern) => {
-      try {
-        return await eslint.lintFiles([pattern]);
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err));
-        if (isSkippablePatternError(error)) {
-          log.debug(`Skipping pattern '${pattern}' (no lintable files)`);
-          return [];
-        }
-        throw error;
-      }
-    })
-  );
-  const rawResults = perPatternResults.flat();
-  const durationMs = Date.now() - startMs;
+  const lintStart = Date.now();
+  let rawResults;
+  try {
+    rawResults = await eslint.lintFiles(patterns);
+  } catch (err) {
+    const error = err instanceof Error ? err : new Error(String(err));
+    if (isSkippablePatternError(error)) {
+      log.debug("Single-call lintFiles failed with no-files, falling back to per-pattern");
+      const perPatternResults = await Promise.all(
+        patterns.map(async (pattern) => {
+          try {
+            return await eslint.lintFiles([pattern]);
+          } catch (patternErr) {
+            const patternError = patternErr instanceof Error ? patternErr : new Error(String(patternErr));
+            if (isSkippablePatternError(patternError)) {
+              log.debug(`Skipping pattern '${pattern}' (no lintable files)`);
+              return [];
+            }
+            throw patternError;
+          }
+        })
+      );
+      rawResults = perPatternResults.flat();
+    } else {
+      throw error;
+    }
+  }
+  timing.lintMs = Date.now() - lintStart;
+  const processStart = Date.now();
   const files = [];
+  const ecosystemIssues = [];
+  const parserErrors = [];
   const ruleBreakdown = /* @__PURE__ */ new Map();
   let totalErrors = 0;
   let totalWarnings = 0;
   const filesScanned = rawResults.length;
   for (const result of rawResults) {
     if (result.messages.length === 0) continue;
-    const issues = result.messages.map((m) => ({
-      ruleId: m.ruleId ?? "unknown",
-      severity: m.severity,
-      message: m.message,
-      line: m.line,
-      column: m.column
-    }));
-    const errorCount = result.errorCount;
-    const warningCount = result.warningCount;
-    totalErrors += errorCount;
-    totalWarnings += warningCount;
-    for (const issue of issues) {
+    const relPath = import_path.default.relative(process.cwd(), result.filePath);
+    const aiGuardIssues = [];
+    let fileErrors = 0;
+    let fileWarnings = 0;
+    for (const m of result.messages) {
+      const source = classifyMessage(m);
+      if (source === "parser-error") {
+        parserErrors.push({
+          filePath: relPath,
+          message: m.message,
+          line: m.line ?? 0
+        });
+        continue;
+      }
+      if (source === "ecosystem") {
+        ecosystemIssues.push({
+          type: classifyEcosystemType(m),
+          ruleId: m.ruleId,
+          message: m.message,
+          filePath: relPath,
+          line: m.line ?? 0,
+          column: m.column ?? 0
+        });
+        continue;
+      }
+      const issue = {
+        ruleId: m.ruleId ?? "unknown",
+        severity: m.severity,
+        message: m.message,
+        line: m.line,
+        column: m.column
+      };
+      aiGuardIssues.push(issue);
+      if (m.severity === 2) {
+        fileErrors++;
+        totalErrors++;
+      } else {
+        fileWarnings++;
+        totalWarnings++;
+      }
       ruleBreakdown.set(
         issue.ruleId,
         (ruleBreakdown.get(issue.ruleId) ?? 0) + 1
       );
     }
-    const relPath = import_path.default.relative(process.cwd(), result.filePath);
-    files.push({ filePath: relPath, issues, errorCount, warningCount });
+    if (aiGuardIssues.length > 0) {
+      files.push({
+        filePath: relPath,
+        issues: aiGuardIssues,
+        errorCount: fileErrors,
+        warningCount: fileWarnings
+      });
+    }
   }
   const topFiles = [...files].sort((a, b) => b.issues.length - a.issues.length).slice(0, 10).map((f) => ({ path: f.filePath, count: f.issues.length }));
+  timing.processMs = Date.now() - processStart;
+  if (options.debugTiming) {
+    log.debug(`Plugin load: ${timing.pluginLoadMs}ms`);
+    log.debug(`Parser load: ${timing.parserLoadMs}ms`);
+    log.debug(`Lint: ${timing.lintMs}ms`);
+    log.debug(`Process: ${timing.processMs}ms`);
+    log.debug(`Total: ${Date.now() - overallStart}ms`);
+  }
   return {
     files,
     totalErrors,
@@ -713,7 +883,11 @@ async function runEslint(options) {
     filesScanned,
     ruleBreakdown,
     topFiles,
-    durationMs
+    durationMs: Date.now() - overallStart,
+    timing,
+    ecosystemIssues,
+    parserErrors,
+    tsParserAvailable
   };
 }
 
@@ -723,7 +897,7 @@ function registerRunCommand(program2) {
     "--max-warnings <n>",
     "Fail with exit code 1 if warnings exceed this count",
     (value) => Number.parseInt(value, 10)
-  ).action(async (opts) => {
+  ).option("--verbose", "Show all issues \u2014 disable grouping of repeated warnings").option("--debug-timing", "Print per-phase timing diagnostics").action(async (opts) => {
     if (opts.maxWarnings !== void 0 && (!Number.isInteger(opts.maxWarnings) || opts.maxWarnings < 0)) {
       log.blank();
       log.error("--max-warnings must be a non-negative integer.");
@@ -743,7 +917,11 @@ function registerRunCommand(program2) {
     const spinner = opts.json ? null : (0, import_ora.default)({ text: "Scanning\u2026", color: "cyan" }).start();
     let result;
     try {
-      result = await runEslint({ preset, targetPath: opts.path });
+      result = await runEslint({
+        preset,
+        targetPath: opts.path,
+        debugTiming: opts.debugTiming
+      });
       spinner?.stop();
     } catch (err) {
       spinner?.stop();
@@ -775,17 +953,26 @@ function registerRunCommand(program2) {
         totalWarnings: result.totalWarnings,
         totalIssues: result.totalIssues,
         durationMs: result.durationMs,
+        timing: result.timing,
         ruleBreakdown: Object.fromEntries(result.ruleBreakdown),
         topFiles: result.topFiles,
-        files: result.files
+        files: result.files,
+        ecosystemIssues: result.ecosystemIssues,
+        parserErrors: result.parserErrors,
+        tsParserAvailable: result.tsParserAvailable
       };
       console.log(JSON.stringify(jsonOutput, null, 2));
       process.exit(getRunExitCode(result, opts.maxWarnings));
       return;
     }
     log.scanStats(result.filesScanned, result.files.length, result.durationMs, preset);
+    if (!result.tsParserAvailable) {
+      log.print(
+        import_chalk2.default.dim(`  \u2139  TypeScript parser not found \u2014 .ts/.tsx files use espree fallback`) + import_chalk2.default.dim(`  (install @typescript-eslint/parser for full TS support)`)
+      );
+    }
     log.blank();
-    if (result.totalIssues === 0) {
+    if (result.totalIssues === 0 && result.ecosystemIssues.length === 0 && result.parserErrors.length === 0) {
       log.print(
         `  ${import_chalk2.default.green("\u2714")}  ${import_chalk2.default.bold.green("No AI issues found")}  ${import_chalk2.default.gray(`\u2014 ${result.filesScanned} file${result.filesScanned !== 1 ? "s" : ""} scanned, all clean`)}`
       );
@@ -793,80 +980,117 @@ function registerRunCommand(program2) {
       process.exit(0);
       return;
     }
-    log.section("Summary by Category");
-    const categoryErrors = {};
-    const categoryWarnings = {};
-    for (const file of result.files) {
-      for (const issue of file.issues) {
-        const cat = RULE_CATEGORY[issue.ruleId] ?? "Other";
-        if (issue.severity === 2) {
-          categoryErrors[cat] = (categoryErrors[cat] ?? 0) + 1;
-        } else {
-          categoryWarnings[cat] = (categoryWarnings[cat] ?? 0) + 1;
+    if (result.totalIssues === 0) {
+      log.print(
+        `  ${import_chalk2.default.green("\u2714")}  ${import_chalk2.default.bold.green("No AI issues found")}  ${import_chalk2.default.gray(`\u2014 ${result.filesScanned} file${result.filesScanned !== 1 ? "s" : ""} scanned, all clean`)}`
+      );
+      log.blank();
+    }
+    if (result.totalIssues > 0) {
+      log.section("Summary by Category");
+      const categoryErrors = {};
+      const categoryWarnings = {};
+      for (const file of result.files) {
+        for (const issue of file.issues) {
+          const cat = RULE_CATEGORY[issue.ruleId] ?? "Other";
+          if (issue.severity === 2) {
+            categoryErrors[cat] = (categoryErrors[cat] ?? 0) + 1;
+          } else {
+            categoryWarnings[cat] = (categoryWarnings[cat] ?? 0) + 1;
+          }
         }
       }
-    }
-    const allCategories = /* @__PURE__ */ new Set([
-      ...CATEGORY_ORDER,
-      ...Object.keys(categoryErrors),
-      ...Object.keys(categoryWarnings)
-    ]);
-    const sortedCategories = [...allCategories].filter(
-      (cat) => (categoryErrors[cat] ?? 0) + (categoryWarnings[cat] ?? 0) > 0
-    );
-    sortedCategories.sort((a, b) => {
-      const ai = CATEGORY_ORDER.indexOf(a);
-      const bi = CATEGORY_ORDER.indexOf(b);
-      if (ai !== -1 && bi !== -1) return ai - bi;
-      if (ai !== -1) return -1;
-      if (bi !== -1) return 1;
-      return a.localeCompare(b);
-    });
-    for (const cat of sortedCategories) {
-      const icon = CATEGORY_ICONS[cat] ?? "\u26AA";
-      log.category(icon, cat, categoryErrors[cat] ?? 0, categoryWarnings[cat] ?? 0);
-    }
-    log.blank();
-    log.print(
-      `  ${import_chalk2.default.bold("Total:")} ${formatIssueCount(result.totalErrors, result.totalWarnings)}`
-    );
-    log.blank();
-    if (result.ruleBreakdown.size > 0) {
-      log.section("By Rule");
-      const sorted = [...result.ruleBreakdown.entries()].sort(
-        (a, b) => b[1] - a[1]
+      const allCategories = /* @__PURE__ */ new Set([
+        ...CATEGORY_ORDER,
+        ...Object.keys(categoryErrors),
+        ...Object.keys(categoryWarnings)
+      ]);
+      const sortedCategories = [...allCategories].filter(
+        (cat) => (categoryErrors[cat] ?? 0) + (categoryWarnings[cat] ?? 0) > 0
       );
-      for (const [rule, count] of sorted) {
-        const shortRule = rule.replace(/^ai-guard\//, "");
-        log.print(
-          `    ${import_chalk2.default.gray("\u2022")} ${import_chalk2.default.yellow(shortRule)}${import_chalk2.default.gray(":")} ${import_chalk2.default.white(String(count))}`
+      sortedCategories.sort((a, b) => {
+        const ai = CATEGORY_ORDER.indexOf(a);
+        const bi = CATEGORY_ORDER.indexOf(b);
+        if (ai !== -1 && bi !== -1) return ai - bi;
+        if (ai !== -1) return -1;
+        if (bi !== -1) return 1;
+        return a.localeCompare(b);
+      });
+      for (const cat of sortedCategories) {
+        const icon = CATEGORY_ICONS[cat] ?? "\u26AA";
+        log.category(icon, cat, categoryErrors[cat] ?? 0, categoryWarnings[cat] ?? 0);
+      }
+      log.blank();
+      log.print(
+        `  ${import_chalk2.default.bold("Total:")} ${formatIssueCount(result.totalErrors, result.totalWarnings)}`
+      );
+      log.blank();
+      if (result.ruleBreakdown.size > 0) {
+        log.section("By Rule");
+        const sorted = [...result.ruleBreakdown.entries()].sort(
+          (a, b) => b[1] - a[1]
         );
+        for (const [rule, count] of sorted) {
+          const shortRule = rule.replace(/^ai-guard\//, "");
+          const tier = CONFIDENCE_TIER[rule];
+          const tierLabel = tier === "high" ? import_chalk2.default.red.dim("[high]") : tier === "medium" ? import_chalk2.default.yellow.dim("[medium]") : import_chalk2.default.gray.dim("[low]");
+          log.print(
+            `    ${import_chalk2.default.gray("\u2022")} ${import_chalk2.default.yellow(shortRule)} ${tierLabel}${import_chalk2.default.gray(":")} ${import_chalk2.default.white(String(count))}`
+          );
+        }
+        log.blank();
+      }
+      if (result.topFiles.length > 0) {
+        log.section("Top Files");
+        for (const { path: fp, count } of result.topFiles) {
+          log.print(
+            `    ${import_chalk2.default.gray("\u2022")} ${import_chalk2.default.white(fp)} ${import_chalk2.default.gray(`(${count})`)}`
+          );
+        }
+        log.blank();
       }
+      log.section("Issues by File");
       log.blank();
+      const verbose = opts.verbose ?? false;
+      renderIssuesByFile(result, verbose);
     }
-    if (result.topFiles.length > 0) {
-      log.section("Top Files");
-      for (const { path: fp, count } of result.topFiles) {
-        log.print(
-          `    ${import_chalk2.default.gray("\u2022")} ${import_chalk2.default.white(fp)} ${import_chalk2.default.gray(`(${count})`)}`
-        );
+    if (result.ecosystemIssues.length > 0) {
+      log.ecosystemSection("ESLint Config Issues");
+      log.print(
+        import_chalk2.default.dim(`  These issues come from your project's ESLint config, not from ai-guard.`)
+      );
+      log.blank();
+      const seen = /* @__PURE__ */ new Map();
+      for (const issue of result.ecosystemIssues) {
+        const key = `${issue.ruleId ?? "null"}::${issue.message}`;
+        const existing = seen.get(key);
+        if (existing) {
+          existing.count++;
+        } else {
+          seen.set(key, { issue, count: 1 });
+        }
+      }
+      for (const { issue, count } of seen.values()) {
+        log.ecosystemIssue(issue, count);
       }
       log.blank();
     }
-    log.section("Issues by File");
-    log.blank();
-    for (const file of result.files) {
+    if (result.parserErrors.length > 0) {
+      log.ecosystemSection("Parser Errors");
       log.print(
-        `  ${import_chalk2.default.bold.white(file.filePath)} ` + import_chalk2.default.gray(
-          `(${file.errorCount} error${file.errorCount !== 1 ? "s" : ""}, ${file.warningCount} warning${file.warningCount !== 1 ? "s" : ""})`
-        )
+        import_chalk2.default.dim(`  These files could not be parsed \u2014 not ai-guard findings.`)
       );
-      for (const issue of file.issues) {
-        const sev = issue.severity === 2 ? import_chalk2.default.red("error") : import_chalk2.default.yellow(" warn");
-        const loc = import_chalk2.default.gray(`${String(issue.line)}:${String(issue.column)}`).padEnd(12);
-        const ruleShort = import_chalk2.default.gray(issue.ruleId.replace(/^ai-guard\//, ""));
+      log.blank();
+      for (const pe of result.parserErrors) {
+        log.parserError(pe);
+      }
+      if (!result.tsParserAvailable) {
+        log.blank();
         log.print(
-          `    ${loc} ${sev}  ${import_chalk2.default.white(issue.message)}  ${ruleShort}`
+          `  ${import_chalk2.default.cyan("\u2192 Fix:")} ${import_chalk2.default.yellow("npm install --save-dev @typescript-eslint/parser")}`
+        );
+        log.print(
+          import_chalk2.default.dim(`  TypeScript parser resolves most .ts/.tsx parse failures.`)
         );
       }
       log.blank();
@@ -874,13 +1098,83 @@ function registerRunCommand(program2) {
     log.divider();
     log.blank();
     log.section("Next Steps");
-    log.info(`Run ${import_chalk2.default.cyan("ai-guard baseline")} to save these issues and track only new ones`);
-    log.info(`Run ${import_chalk2.default.cyan("ai-guard report")}   to generate a shareable HTML report`);
-    log.info(`Run ${import_chalk2.default.cyan("ai-guard ignore")}   to suppress dist/build noise`);
+    if (result.totalIssues > 0) {
+      log.info(`Run ${import_chalk2.default.cyan("ai-guard baseline")} to save these issues and track only new ones`);
+      log.info(`Run ${import_chalk2.default.cyan("ai-guard report")}   to generate a shareable HTML report`);
+      log.info(`Run ${import_chalk2.default.cyan("ai-guard ignore")}   to suppress dist/build noise`);
+    }
+    if (result.ecosystemIssues.length > 0) {
+      log.info(`Run ${import_chalk2.default.cyan("ai-guard doctor")}   to diagnose ESLint config issues`);
+    }
+    if (!opts.verbose && hasGroupedWarnings(result)) {
+      log.info(`Run with ${import_chalk2.default.cyan("--verbose")} to expand grouped warnings`);
+    }
     log.blank();
     process.exit(getRunExitCode(result, opts.maxWarnings));
   });
 }
+var GROUP_THRESHOLD = 4;
+function hasGroupedWarnings(result) {
+  for (const file of result.files) {
+    const ruleCounts = /* @__PURE__ */ new Map();
+    for (const issue of file.issues) {
+      ruleCounts.set(issue.ruleId, (ruleCounts.get(issue.ruleId) ?? 0) + 1);
+    }
+    for (const count of ruleCounts.values()) {
+      if (count >= GROUP_THRESHOLD) return true;
+    }
+  }
+  return false;
+}
+function renderIssuesByFile(result, verbose) {
+  for (const file of result.files) {
+    log.print(
+      `  ${import_chalk2.default.bold.white(file.filePath)} ` + import_chalk2.default.gray(
+        `(${file.errorCount} error${file.errorCount !== 1 ? "s" : ""}, ${file.warningCount} warning${file.warningCount !== 1 ? "s" : ""})`
+      )
+    );
+    if (!verbose) {
+      const ruleCounts = /* @__PURE__ */ new Map();
+      for (const issue of file.issues) {
+        const arr = ruleCounts.get(issue.ruleId) ?? [];
+        arr.push(issue);
+        ruleCounts.set(issue.ruleId, arr);
+      }
+      for (const issues of ruleCounts.values()) {
+        const tier = CONFIDENCE_TIER[issues[0].ruleId] ?? "low";
+        if (tier === "low" && issues.length >= GROUP_THRESHOLD) {
+          const sev = issues[0].severity === 2 ? import_chalk2.default.red("error") : import_chalk2.default.yellow(" warn");
+          const shortRule = import_chalk2.default.gray(issues[0].ruleId.replace(/^ai-guard\//, ""));
+          log.print(
+            `    ${sev}  ${import_chalk2.default.white(issues[0].message)}  ${shortRule}`
+          );
+          log.print(
+            import_chalk2.default.dim(`           \u21B3 ${issues.length} occurrences \u2014 run with --verbose to expand`)
+          );
+        } else {
+          for (const issue of issues) {
+            renderSingleIssue(issue);
+          }
+        }
+      }
+    } else {
+      for (const issue of file.issues) {
+        renderSingleIssue(issue);
+      }
+    }
+    log.blank();
+  }
+}
+function renderSingleIssue(issue) {
+  const sev = issue.severity === 2 ? import_chalk2.default.red("error") : import_chalk2.default.yellow(" warn");
+  const loc = import_chalk2.default.gray(`${String(issue.line)}:${String(issue.column)}`).padEnd(12);
+  const ruleShort = import_chalk2.default.gray(issue.ruleId.replace(/^ai-guard\//, ""));
+  const tier = CONFIDENCE_TIER[issue.ruleId];
+  const tierTag = tier === "high" ? "" : tier === "medium" ? "" : import_chalk2.default.dim(" [low]");
+  log.print(
+    `    ${loc} ${sev}  ${import_chalk2.default.white(issue.message)}${tierTag}  ${ruleShort}`
+  );
+}
 function getRunExitCode(result, maxWarnings) {
   if (result.totalErrors > 0) return 1;
   if (maxWarnings !== void 0 && result.totalWarnings > maxWarnings) return 1;
@@ -1315,6 +1609,7 @@ function registerInitCommand(program2) {
 var import_chalk4 = __toESM(require("chalk"));
 var import_path5 = __toESM(require("path"));
 init_config_manager();
+var import_meta = {};
 async function probeConfigLoad(configPath, cwd) {
   try {
     const { ESLint } = await import("eslint");
@@ -1425,6 +1720,73 @@ ${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}
         note: probe.ok ? void 0 : "Run: ai-guard init --dry-run  to preview a fresh config"
       });
     }
+    {
+      let utilsOk = false;
+      let utilsVersion = null;
+      try {
+        const { createRequire: createRequire2 } = await import("module");
+        const req = createRequire2(import_path5.default.join(cwd, "package.json"));
+        const pkgPath = req.resolve("@typescript-eslint/utils/package.json");
+        const pkg = JSON.parse(
+          (await import("fs")).readFileSync(pkgPath, "utf-8")
+        );
+        utilsVersion = pkg.version ?? null;
+        utilsOk = true;
+      } catch {
+      }
+      if (!utilsOk) {
+        try {
+          const selfDir = import_path5.default.dirname(
+            new URL(import_meta.url).pathname.replace(/^\/([A-Za-z]:)/, "$1")
+          );
+          const pkgPath = import_path5.default.join(selfDir, "../../node_modules/@typescript-eslint/utils/package.json");
+          if ((await import("fs")).existsSync(pkgPath)) {
+            utilsOk = true;
+          }
+        } catch {
+        }
+      }
+      checks.push({
+        label: "@typescript-eslint/utils available at runtime",
+        pass: utilsOk,
+        detail: utilsOk ? `Found${utilsVersion ? ` v${utilsVersion}` : ""}` : "Not found \u2014 rule engine may crash on fresh installs",
+        fix: utilsOk ? void 0 : "npm install @typescript-eslint/utils",
+        note: utilsOk ? void 0 : "This is a runtime dependency of eslint-plugin-ai-guard rules."
+      });
+    }
+    {
+      let parserOk = false;
+      let parserVersion = null;
+      try {
+        const { createRequire: createRequire2 } = await import("module");
+        const req = createRequire2(import_path5.default.join(cwd, "package.json"));
+        const pkgPath = req.resolve("@typescript-eslint/parser/package.json");
+        const pkg = JSON.parse(
+          (await import("fs")).readFileSync(pkgPath, "utf-8")
+        );
+        parserVersion = pkg.version ?? null;
+        parserOk = true;
+      } catch {
+      }
+      const hasTsFiles = (() => {
+        try {
+          const { readdirSync } = require("fs");
+          const files = readdirSync(cwd);
+          return files.some((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
+        } catch {
+          return false;
+        }
+      })();
+      if (!parserOk && hasTsFiles) {
+        checks.push({
+          label: "@typescript-eslint/parser installed (TypeScript project)",
+          pass: false,
+          detail: ".ts/.tsx files detected but TypeScript parser not found",
+          fix: "npm install --save-dev @typescript-eslint/parser",
+          note: "TypeScript files will use espree fallback without this \u2014 some rules may not work correctly."
+        });
+      }
+    }
     log.section("Diagnostics");
     let allPassed = true;
     for (const check of checks) {
@@ -2419,6 +2781,37 @@ function buildReportData(result, preset, scannedPath, cwd) {
       example
     };
   });
+  const CONFIDENCE_ASSIGNMENT = {
+    "ai-guard/no-hardcoded-secret": "high",
+    "ai-guard/no-eval-dynamic": "high",
+    "ai-guard/no-floating-promise": "high",
+    "ai-guard/no-empty-catch": "high",
+    "ai-guard/no-sql-string-concat": "medium",
+    "ai-guard/no-await-in-loop": "medium",
+    "ai-guard/require-auth-middleware": "medium",
+    "ai-guard/require-authz-check": "medium",
+    "ai-guard/no-catch-log-rethrow": "medium",
+    "ai-guard/no-catch-without-use": "medium",
+    "ai-guard/no-unsafe-deserialize": "medium",
+    "ai-guard/no-async-without-await": "low",
+    "ai-guard/no-async-array-callback": "low",
+    "ai-guard/no-dead-branch": "low",
+    "ai-guard/no-broad-exception": "low",
+    "ai-guard/no-console-in-handler": "low",
+    "ai-guard/no-duplicate-logic-block": "low",
+    "ai-guard/no-redundant-await": "low"
+  };
+  let highCount = 0;
+  let mediumCount = 0;
+  let lowCount = 0;
+  for (const [rule, count] of result.ruleBreakdown.entries()) {
+    const tier = CONFIDENCE_ASSIGNMENT[rule] ?? "low";
+    if (tier === "high") highCount += count;
+    else if (tier === "medium") mediumCount += count;
+    else lowCount += count;
+  }
+  const ecosystemCount = result.ecosystemIssues?.length ?? 0;
+  const parserErrorCount = result.parserErrors?.length ?? 0;
   return {
     projectName,
     version,
@@ -2433,7 +2826,12 @@ function buildReportData(result, preset, scannedPath, cwd) {
     ruleBreakdown: Object.fromEntries(result.ruleBreakdown),
     topFiles,
     topRules,
-    categoryBreakdown
+    categoryBreakdown,
+    highCount,
+    mediumCount,
+    lowCount,
+    ecosystemCount,
+    parserErrorCount
   };
 }
 function generateHtml(data) {
@@ -2533,12 +2931,23 @@ function generateHtml(data) {
         <p style="color:#6b7280;font-size:0.85rem;margin-top:0.25rem;">Scanned: <code style="color:#94a3b8;">${escHtml(data.scannedPath)}</code> \xB7 Preset: <code style="color:#94a3b8;">${escHtml(data.preset)}</code> \xB7 ${data.durationMs}ms</p>
       </div>
       <div style="text-align:center;">
-        <div style="font-size:0.75rem;color:#6b7280;margin-bottom:0.5rem;letter-spacing:0.05em;">AI CODE HEALTH SCORE</div>
-        <div style="width:100px;height:100px;border-radius:50%;background:conic-gradient(${scoreColor} ${data.score}%, #1f2937 0%);display:flex;align-items:center;justify-content:center;box-shadow:0 0 30px ${scoreColor}33;">
-          <div style="width:80px;height:80px;border-radius:50%;background:#030712;display:flex;flex-direction:column;align-items:center;justify-content:center;">
-            <span style="font-size:1.6rem;font-weight:800;color:${scoreColor};">${data.score}</span>
-            <span style="font-size:0.65rem;color:${scoreColor};font-weight:600;">${scoreLabel}</span>
+        <div style="font-size:0.75rem;color:#6b7280;margin-bottom:0.75rem;letter-spacing:0.05em;">SIGNAL CONFIDENCE</div>
+        <div style="display:flex;flex-direction:column;gap:0.4rem;">
+          <div style="display:flex;align-items:center;gap:0.5rem;">
+            <span style="width:8px;height:8px;border-radius:50%;background:#ef4444;display:inline-block;"></span>
+            <span style="font-size:0.8rem;color:#f87171;font-weight:600;">${data.highCount} high-confidence</span>
+          </div>
+          <div style="display:flex;align-items:center;gap:0.5rem;">
+            <span style="width:8px;height:8px;border-radius:50%;background:#f59e0b;display:inline-block;"></span>
+            <span style="font-size:0.8rem;color:#fbbf24;font-weight:600;">${data.mediumCount} medium-confidence</span>
+          </div>
+          <div style="display:flex;align-items:center;gap:0.5rem;">
+            <span style="width:8px;height:8px;border-radius:50%;background:#6b7280;display:inline-block;"></span>
+            <span style="font-size:0.8rem;color:#9ca3af;font-weight:600;">${data.lowCount} suggestions</span>
           </div>
+          ${data.ecosystemCount > 0 ? `<div style="display:flex;align-items:center;gap:0.5rem;margin-top:0.25rem;">
+            <span style="font-size:0.75rem;color:#4b5563;">\u26A0 ${data.ecosystemCount} config issue${data.ecosystemCount !== 1 ? "s" : ""} (not ai-guard)</span>
+          </div>` : ""}
         </div>
       </div>
     </div>