eslint-plugin-ai-guard 1.1.14 → 1.2.1

package/dist/cli/index.js

@@ -53,14 +53,14 @@ __export(config_manager_exports, {
 });
 function backupConfig(configPath) {
   const backupPath = `${configPath}.bak`;
-  import_fs3.default.copyFileSync(configPath, backupPath);
+  import_fs6.default.copyFileSync(configPath, backupPath);
   return backupPath;
 }
 function readConfig(configPath) {
-  return import_fs3.default.readFileSync(configPath, "utf-8");
+  return import_fs6.default.readFileSync(configPath, "utf-8");
 }
 function writeConfig(configPath, content) {
-  import_fs3.default.writeFileSync(configPath, content, "utf-8");
+  import_fs6.default.writeFileSync(configPath, content, "utf-8");
 }
 function generateFlatConfig(preset) {
   return `import aiGuard from 'eslint-plugin-ai-guard';
@@ -266,19 +266,19 @@ function addIgnoresToLegacyConfig(existing) {
 function getConfigFilePath(configType, cwd = process.cwd()) {
   switch (configType) {
     case "flat-js":
-      return import_path3.default.join(cwd, "eslint.config.js");
+      return import_path5.default.join(cwd, "eslint.config.js");
     case "flat-mjs":
-      return import_path3.default.join(cwd, "eslint.config.mjs");
+      return import_path5.default.join(cwd, "eslint.config.mjs");
     case "flat-cjs":
-      return import_path3.default.join(cwd, "eslint.config.cjs");
+      return import_path5.default.join(cwd, "eslint.config.cjs");
     case "eslintrc-js":
-      return import_path3.default.join(cwd, ".eslintrc.js");
+      return import_path5.default.join(cwd, ".eslintrc.js");
     case "eslintrc-cjs":
-      return import_path3.default.join(cwd, ".eslintrc.cjs");
+      return import_path5.default.join(cwd, ".eslintrc.cjs");
     case "eslintrc-json":
-      return import_path3.default.join(cwd, ".eslintrc.json");
+      return import_path5.default.join(cwd, ".eslintrc.json");
     default:
-      return import_path3.default.join(cwd, ".eslintrc.js");
+      return import_path5.default.join(cwd, ".eslintrc.js");
   }
 }
 function validateFlatConfigText(content) {
@@ -313,12 +313,12 @@ function validateLegacyConfigText(content) {
   }
   return problems;
 }
-var import_fs3, import_path3, AI_GUARD_MARKER, DEFAULT_FLAT_IGNORES, DEFAULT_LEGACY_IGNORES;
+var import_fs6, import_path5, AI_GUARD_MARKER, DEFAULT_FLAT_IGNORES, DEFAULT_LEGACY_IGNORES;
 var init_config_manager = __esm({
   "cli/utils/config-manager.ts"() {
     "use strict";
-    import_fs3 = __toESM(require("fs"));
-    import_path3 = __toESM(require("path"));
+    import_fs6 = __toESM(require("fs"));
+    import_path5 = __toESM(require("path"));
     AI_GUARD_MARKER = "eslint-plugin-ai-guard";
     DEFAULT_FLAT_IGNORES = [
       "node_modules/**",
@@ -341,17 +341,18 @@ var init_config_manager = __esm({
 
 // cli/index.ts
 var import_commander = require("commander");
-var import_fs8 = __toESM(require("fs"));
-var import_path11 = __toESM(require("path"));
+var import_fs11 = __toESM(require("fs"));
+var import_path13 = __toESM(require("path"));
 
 // cli/commands/run.ts
 var import_ora = __toESM(require("ora"));
-var import_chalk2 = __toESM(require("chalk"));
+var import_chalk3 = __toESM(require("chalk"));
 
 // cli/utils/eslint-runner.ts
 var import_fs = __toESM(require("fs"));
 var import_path = __toESM(require("path"));
 var import_url = require("url");
+var import_chalk2 = __toESM(require("chalk"));
 
 // cli/utils/logger.ts
 var import_chalk = __toESM(require("chalk"));
@@ -382,13 +383,54 @@ var RULE_CATEGORY = {
   "ai-guard/no-duplicate-logic-block": "AI Patterns",
   "ai-guard/no-dead-branch": "AI Patterns"
 };
+var CONFIDENCE_TIER = {
+  // High confidence — near-zero false positive rate
+  "ai-guard/no-hardcoded-secret": "high",
+  "ai-guard/no-eval-dynamic": "high",
+  "ai-guard/no-floating-promise": "high",
+  "ai-guard/no-empty-catch": "high",
+  // Medium confidence — context matters, usually valid
+  "ai-guard/no-sql-string-concat": "medium",
+  "ai-guard/no-await-in-loop": "medium",
+  "ai-guard/require-auth-middleware": "medium",
+  "ai-guard/require-authz-check": "medium",
+  "ai-guard/no-catch-log-rethrow": "medium",
+  "ai-guard/no-catch-without-use": "medium",
+  "ai-guard/no-unsafe-deserialize": "medium",
+  // Low confidence — review case-by-case
+  "ai-guard/no-async-array-callback": "low",
+  "ai-guard/no-dead-branch": "low",
+  "ai-guard/no-broad-exception": "low",
+  "ai-guard/no-console-in-handler": "low",
+  "ai-guard/no-duplicate-logic-block": "low",
+  // Informational — mostly stylistic, high framework FP rate, collapsed by default
+  "ai-guard/no-async-without-await": "informational",
+  "ai-guard/no-redundant-await": "informational"
+};
+var ECOSYSTEM_FIX_HINTS = {
+  "react-hooks/exhaustive-deps": "npm install --save-dev eslint-plugin-react-hooks",
+  "react-hooks/rules-of-hooks": "npm install --save-dev eslint-plugin-react-hooks",
+  "@typescript-eslint/": "npm install --save-dev @typescript-eslint/eslint-plugin @typescript-eslint/parser",
+  "import/": "npm install --save-dev eslint-plugin-import",
+  "jsx-a11y/": "npm install --save-dev eslint-plugin-jsx-a11y",
+  "prettier/": "npm install --save-dev eslint-plugin-prettier"
+};
+function getEcosystemFix(ruleId) {
+  if (!ruleId) return null;
+  for (const [prefix, fix] of Object.entries(ECOSYSTEM_FIX_HINTS)) {
+    if (ruleId.startsWith(prefix)) return fix;
+  }
+  return null;
+}
 var PREFIX = {
   success: import_chalk.default.green("\u2714"),
   error: import_chalk.default.red("\u2716"),
   warn: import_chalk.default.yellow("\u26A0"),
   info: import_chalk.default.cyan("\u2139"),
   section: import_chalk.default.bold.white,
-  bullet: import_chalk.default.gray("\u2022")
+  bullet: import_chalk.default.gray("\u2022"),
+  ecosystem: import_chalk.default.yellow("\u26A0"),
+  parser: import_chalk.default.magenta("\u26A1")
 };
 var log = {
   info(msg) {
@@ -408,6 +450,14 @@ var log = {
     console.log(import_chalk.default.bold.cyan(`  \u2500\u2500 ${title} \u2500\u2500`));
     console.log("");
   },
+  /**
+   * Ecosystem section — distinct styling to communicate it's NOT ai-guard output
+   */
+  ecosystemSection(title) {
+    console.log("");
+    console.log(import_chalk.default.bold.yellow(`  \u2500\u2500 ${title} \u2500\u2500`) + import_chalk.default.dim(" (not ai-guard findings)"));
+    console.log("");
+  },
   rule(ruleName, count) {
     console.log(
       `    ${PREFIX.bullet} ${import_chalk.default.yellow(ruleName)} ${import_chalk.default.gray(`(${count} issue${count !== 1 ? "s" : ""})`)}`
@@ -424,9 +474,36 @@ var log = {
       `      ${import_chalk.default.gray(`${line}:${col}`).padEnd(12)} ${icon}  ${import_chalk.default.white(msg)}`
     );
   },
+  /**
+   * Print an ESLint ecosystem issue (missing rule definition, foreign plugin rule, etc.)
+   * with a clear disclaimer that this is NOT an ai-guard finding.
+   */
+  ecosystemIssue(issue, count = 1) {
+    const ruleLabel = issue.ruleId ? import_chalk.default.yellow(issue.ruleId) : import_chalk.default.gray("(no rule id)");
+    const typeLabel = issue.type === "missing-rule" ? import_chalk.default.dim("[missing rule definition]") : issue.type === "config-error" ? import_chalk.default.dim("[config error]") : import_chalk.default.dim("[foreign rule]");
+    const countLabel = count > 1 ? import_chalk.default.gray(` \xD7 ${count}`) : "";
+    console.log(`  ${PREFIX.ecosystem}  ${ruleLabel} ${typeLabel}${countLabel}`);
+    console.log(`       ${import_chalk.default.gray("File:")} ${import_chalk.default.dim(issue.filePath)}${issue.line > 0 ? import_chalk.default.dim(`:${issue.line}`) : ""}`);
+    console.log(`       ${import_chalk.default.gray("Msg:")}  ${import_chalk.default.dim(issue.message.slice(0, 120))}`);
+    const fix = getEcosystemFix(issue.ruleId);
+    if (fix) {
+      console.log(`       ${import_chalk.default.cyan("\u2192 Fix:")} ${import_chalk.default.yellow(fix)}`);
+    }
+    console.log(
+      import_chalk.default.dim(`       Note: This comes from your ESLint config, not from ai-guard.`)
+    );
+    console.log("");
+  },
+  /**
+   * Print a parser/syntax error — clearly NOT an ai-guard finding.
+   */
+  parserError(pe) {
+    console.log(`  ${PREFIX.parser}  ${import_chalk.default.magenta("Parse failure")}  ${import_chalk.default.dim(pe.filePath)}${pe.line > 0 ? import_chalk.default.dim(`:${pe.line}`) : ""}`);
+    console.log(`       ${import_chalk.default.dim(pe.message.slice(0, 120))}`);
+    console.log("");
+  },
   /**
    * Print a category summary line with icon, label, and count.
-   * e.g.  🔴 Security        3 errors · 0 warnings
    */
   category(icon, label, errors, warnings) {
     const parts = [];
@@ -437,7 +514,7 @@ var log = {
     console.log(`  ${icon}  ${import_chalk.default.bold.white(labelPadded)} ${counts}`);
   },
   /**
-   * Print the scan stats line: files scanned, duration, preset.
+   * Print the scan stats line.
    */
   scanStats(filesScanned, filesWithIssues, durationMs, preset) {
     console.log(
@@ -466,6 +543,74 @@ var log = {
 };
 
 // cli/utils/eslint-runner.ts
+var ISSUE_CONFIDENCE = {
+  "ai-guard/no-hardcoded-secret": "high",
+  "ai-guard/no-eval-dynamic": "high",
+  "ai-guard/no-floating-promise": "high",
+  "ai-guard/no-empty-catch": "high",
+  "ai-guard/no-sql-string-concat": "medium",
+  "ai-guard/no-await-in-loop": "medium",
+  "ai-guard/require-auth-middleware": "medium",
+  "ai-guard/require-authz-check": "medium",
+  "ai-guard/no-catch-log-rethrow": "medium",
+  "ai-guard/no-catch-without-use": "medium",
+  "ai-guard/no-unsafe-deserialize": "medium",
+  "ai-guard/no-async-array-callback": "low",
+  "ai-guard/no-dead-branch": "low",
+  "ai-guard/no-broad-exception": "low",
+  "ai-guard/no-console-in-handler": "low",
+  "ai-guard/no-duplicate-logic-block": "low",
+  "ai-guard/no-async-without-await": "informational",
+  "ai-guard/no-redundant-await": "informational"
+};
+var ISSUE_CATEGORY = {
+  "ai-guard/no-floating-promise": "Async Reliability",
+  "ai-guard/no-await-in-loop": "Async Reliability",
+  "ai-guard/no-async-without-await": "Async Reliability",
+  "ai-guard/no-async-array-callback": "Async Reliability",
+  "ai-guard/no-redundant-await": "Async Reliability",
+  "ai-guard/no-empty-catch": "Reliability",
+  "ai-guard/no-broad-exception": "Reliability",
+  "ai-guard/no-catch-log-rethrow": "Reliability",
+  "ai-guard/no-catch-without-use": "Reliability",
+  "ai-guard/no-hardcoded-secret": "Security",
+  "ai-guard/no-eval-dynamic": "Security",
+  "ai-guard/no-sql-string-concat": "Security",
+  "ai-guard/no-unsafe-deserialize": "Security",
+  "ai-guard/require-auth-middleware": "Security",
+  "ai-guard/require-authz-check": "Security",
+  "ai-guard/no-console-in-handler": "AI Patterns",
+  "ai-guard/no-duplicate-logic-block": "AI Patterns",
+  "ai-guard/no-dead-branch": "AI Patterns"
+};
+var ISSUE_ASYNC_RISK_TYPE = {
+  "ai-guard/no-floating-promise": "floating-promise",
+  "ai-guard/no-await-in-loop": "sequential-await",
+  "ai-guard/no-async-without-await": "unnecessary-async",
+  "ai-guard/no-async-array-callback": "async-array-callback",
+  "ai-guard/no-redundant-await": "redundant-await"
+};
+var ISSUE_REMEDIATION = {
+  "ai-guard/no-floating-promise": "Add `await` before the call, assign to a variable, or add `.catch()` to handle rejection.",
+  "ai-guard/no-await-in-loop": "Collect promises in an array and use `await Promise.all(...)` outside the loop.",
+  "ai-guard/no-async-without-await": "Remove `async` if no async operations are needed, or add an `await` expression.",
+  "ai-guard/no-async-array-callback": "Use `Promise.all(array.map(async item => ...))` to ensure all async callbacks are awaited.",
+  "ai-guard/no-redundant-await": "Remove the `await` \u2014 the value is already resolved.",
+  "ai-guard/no-empty-catch": "Add error handling in the catch block, or at minimum log the error.",
+  "ai-guard/no-broad-exception": "Catch specific error types or re-throw after handling.",
+  "ai-guard/no-catch-log-rethrow": "Either log the error OR rethrow it \u2014 doing both duplicates the error in logs.",
+  "ai-guard/no-catch-without-use": "Use the caught error variable or rename to `_` to signal intentional suppression.",
+  "ai-guard/no-hardcoded-secret": "Move credentials to environment variables: `process.env.SECRET_KEY`.",
+  "ai-guard/no-eval-dynamic": "Avoid eval and Function constructors. Use safer alternatives like JSON.parse.",
+  "ai-guard/no-sql-string-concat": "Use parameterized queries or an ORM to prevent SQL injection.",
+  "ai-guard/no-unsafe-deserialize": "Validate input with a schema library (zod, joi, yup) before parsing.",
+  "ai-guard/require-auth-middleware": "Add an authentication middleware before the route handler.",
+  "ai-guard/require-authz-check": "Verify the requesting user has permission to access this resource.",
+  "ai-guard/no-console-in-handler": "Replace console.log with a structured logger (pino, winston, etc.).",
+  "ai-guard/no-duplicate-logic-block": "Extract the duplicated logic into a shared function.",
+  "ai-guard/no-dead-branch": "Remove the unreachable branch or fix the condition."
+};
+var _runnerCache = /* @__PURE__ */ new Map();
 function isRecord(value) {
   return typeof value === "object" && value !== null;
 }
@@ -537,19 +682,64 @@ function getRules(preset) {
   return RECOMMENDED_RULES;
 }
 var DEFAULT_IGNORE_PATTERNS = [
+  // Core — always skip
   "**/node_modules/**",
   "**/.next/**",
   "**/dist/**",
   "**/build/**",
   "**/coverage/**",
   "**/out/**",
-  "**/.git/**"
+  "**/.git/**",
+  // Build artifacts and caches
+  "**/.cache/**",
+  "**/.turbo/**",
+  "**/.nx/**",
+  "**/.parcel-cache/**",
+  "**/.webpack/**",
+  "**/tmp/**",
+  "**/temp/**",
+  // Package manager artifacts
+  "**/.yarn/**",
+  "**/.pnp.*",
+  // Framework generated
+  "**/.expo/**",
+  "**/.svelte-kit/**",
+  "**/storybook-static/**",
+  "**/.storybook/generated/**",
+  // Generated code
+  "**/generated/**",
+  "**/__generated__/**",
+  "**/vendor/**",
+  // Test outputs
+  "**/test-results/**",
+  "**/playwright-report/**",
+  // Misc
+  "**/.docusaurus/**",
+  "**/.vitepress/cache/**"
 ];
 function isSkippablePatternError(error) {
   const msg = error.message.toLowerCase();
-  const hasNoFilesSignal = msg.includes("no files") || msg.includes("no files matching");
-  const hasIgnoredSignal = msg.includes("ignored") || msg.includes("all files matched by") || msg.includes("are ignored") || msg.includes("was ignored") || msg.includes("file ignored");
-  return hasNoFilesSignal || hasIgnoredSignal;
+  return msg.includes("no files") || msg.includes("no files matching") || msg.includes("ignored") || msg.includes("all files matched by") || msg.includes("are ignored") || msg.includes("was ignored") || msg.includes("file ignored");
+}
+function classifyMessage(msg) {
+  if (msg.fatal === true) return "parser-error";
+  if (msg.ruleId === null && (msg.message.startsWith("Parsing error") || msg.message.includes("Unexpected token") || msg.message.includes("SyntaxError"))) {
+    return "parser-error";
+  }
+  if (msg.ruleId && msg.ruleId.startsWith("ai-guard/")) {
+    return "ai-guard";
+  }
+  return "ecosystem";
+}
+function classifyEcosystemType(msg) {
+  const lower = msg.message.toLowerCase();
+  if (lower.includes("definition for rule") && lower.includes("was not found")) {
+    return "missing-rule";
+  }
+  if (lower.includes("configuration") || lower.includes("config")) {
+    return "config-error";
+  }
+  return "foreign-rule";
 }
 async function loadPluginModuleFromCwd(cwd) {
   const { createRequire: createRequire2 } = await import("module");
@@ -576,23 +766,44 @@ async function loadPluginModuleFromCwd(cwd) {
     "eslint-plugin-ai-guard is not installed. Run: npm install --save-dev eslint-plugin-ai-guard"
   );
 }
-async function runEslint(options) {
-  const { ESLint } = await import("eslint").catch(() => {
-    throw new Error(
-      "ESLint is not installed. Run: npm install --save-dev eslint"
-    );
-  });
-  const rawPlugin = await loadPluginModuleFromCwd(process.cwd());
-  const plugin = normalizePlugin(rawPlugin);
-  const rules = getRules(options.preset);
-  const resolvedTargetPath = import_path.default.resolve(options.targetPath);
-  if (!import_fs.default.existsSync(resolvedTargetPath)) {
-    throw new Error(`Path not found: ${options.targetPath}`);
+async function getOrBuildRunner(cwd, preset, eslintCwd) {
+  const cacheKey = `${eslintCwd}::${preset}`;
+  const cached = _runnerCache.get(cacheKey);
+  if (cached) {
+    return { runner: cached, fromCache: true };
   }
-  const targetStat = import_fs.default.statSync(resolvedTargetPath);
-  const isSingleFileTarget = targetStat.isFile();
-  const eslintCwd = isSingleFileTarget ? import_path.default.dirname(resolvedTargetPath) : resolvedTargetPath;
-  const startMs = Date.now();
+  const [{ ESLint }, rawPlugin, tsParserResult] = await Promise.all([
+    // 1. Load ESLint
+    import("eslint").catch(() => {
+      throw new Error("ESLint is not installed. Run: npm install --save-dev eslint");
+    }),
+    // 2. Load plugin
+    loadPluginModuleFromCwd(cwd),
+    // 3. Load TS parser (optional — errors are caught)
+    Promise.resolve().then(() => {
+      const parserStart = Date.now();
+      try {
+        let tsParser2;
+        try {
+          tsParser2 = require(import_path.default.join(
+            cwd,
+            "node_modules",
+            "@typescript-eslint",
+            "parser"
+          ));
+        } catch {
+          tsParser2 = require("@typescript-eslint/parser");
+        }
+        return { tsParser: tsParser2, available: true, loadMs: Date.now() - parserStart };
+      } catch {
+        log.debug("@typescript-eslint/parser not found \u2014 TypeScript files will use espree fallback");
+        return { tsParser: null, available: false, loadMs: Date.now() - parserStart };
+      }
+    })
+  ]);
+  const plugin = normalizePlugin(rawPlugin);
+  const rules = getRules(preset);
+  const { tsParser, available: tsParserAvailable } = tsParserResult;
   const JS_TS_FILES = [
     "**/*.js",
     "**/*.jsx",
@@ -603,22 +814,10 @@ async function runEslint(options) {
     "**/*.mjs",
     "**/*.cjs"
   ];
-  let tsParser = null;
-  try {
-    try {
-      tsParser = require(import_path.default.join(
-        process.cwd(),
-        "node_modules",
-        "@typescript-eslint",
-        "parser"
-      ));
-    } catch {
-      tsParser = require("@typescript-eslint/parser");
-    }
-  } catch {
-  }
   const configBlocks = [
-    // JS/JSX files — default espree parser
+    // Ignore block first — ESLint can skip excluded files without processing
+    { ignores: DEFAULT_IGNORE_PATTERNS },
+    // JS/JSX — espree parser with JSX support
     {
       files: ["**/*.js", "**/*.jsx", "**/*.mjs", "**/*.cjs"],
       plugins: { "ai-guard": plugin },
@@ -630,277 +829,1356 @@ async function runEslint(options) {
         }
       },
       rules
-    },
-    // Ignore generated directories
-    { ignores: DEFAULT_IGNORE_PATTERNS }
+    }
   ];
   if (tsParser) {
-    configBlocks.splice(1, 0, {
+    configBlocks.push({
       files: ["**/*.ts", "**/*.tsx", "**/*.mts", "**/*.cts"],
       plugins: { "ai-guard": plugin },
       languageOptions: {
         parser: tsParser,
         parserOptions: {
-          // project: true would be needed for type-aware rules — skip for speed
           ecmaVersion: "latest",
-          sourceType: "module"
+          sourceType: "module",
+          ecmaFeatures: { jsx: true }
         }
       },
       rules
     });
   } else {
-    configBlocks.splice(1, 0, {
+    configBlocks.push({
       files: ["**/*.ts", "**/*.tsx", "**/*.mts", "**/*.cts"],
       plugins: { "ai-guard": plugin },
+      languageOptions: {
+        parserOptions: {
+          ecmaVersion: "latest",
+          sourceType: "module",
+          ecmaFeatures: { jsx: true }
+        }
+      },
       rules
     });
   }
-  const eslint = new ESLint({
-    cwd: eslintCwd,
-    overrideConfigFile: true,
-    overrideConfig: configBlocks
-  });
-  const patterns = isSingleFileTarget ? [import_path.default.basename(resolvedTargetPath)] : JS_TS_FILES;
-  const perPatternResults = await Promise.all(
-    patterns.map(async (pattern) => {
-      try {
-        return await eslint.lintFiles([pattern]);
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err));
-        if (isSkippablePatternError(error)) {
-          log.debug(`Skipping pattern '${pattern}' (no lintable files)`);
-          return [];
+  const eslint = new ESLint({
+    cwd: eslintCwd,
+    overrideConfigFile: true,
+    overrideConfig: configBlocks
+  });
+  const runner = {
+    eslint,
+    tsParserAvailable,
+    pluginLoadMs: 0,
+    // accounted in parallel Promise.all
+    parserLoadMs: tsParserResult.loadMs
+  };
+  _runnerCache.set(cacheKey, runner);
+  return { runner, fromCache: false };
+}
+var JS_TS_FILE_PATTERNS = [
+  "**/*.js",
+  "**/*.jsx",
+  "**/*.ts",
+  "**/*.tsx",
+  "**/*.mts",
+  "**/*.cts",
+  "**/*.mjs",
+  "**/*.cjs"
+];
+async function runEslint(options) {
+  const overallStart = Date.now();
+  const resolvedTargetPath = import_path.default.resolve(options.targetPath);
+  if (!import_fs.default.existsSync(resolvedTargetPath)) {
+    throw new Error(`Path not found: ${options.targetPath}`);
+  }
+  const targetStat = import_fs.default.statSync(resolvedTargetPath);
+  const isSingleFileTarget = targetStat.isFile();
+  const eslintCwd = isSingleFileTarget ? import_path.default.dirname(resolvedTargetPath) : resolvedTargetPath;
+  const cwd = process.cwd();
+  const initStart = Date.now();
+  const { runner, fromCache } = await getOrBuildRunner(cwd, options.preset, eslintCwd);
+  const initMs = Date.now() - initStart;
+  const timing = {
+    pluginLoadMs: fromCache ? 0 : runner.pluginLoadMs,
+    parserLoadMs: fromCache ? 0 : runner.parserLoadMs,
+    lintMs: 0,
+    processMs: 0,
+    fromCache
+  };
+  const hasExplicitFiles = options.files && options.files.length > 0;
+  const patterns = hasExplicitFiles ? options.files : isSingleFileTarget ? [import_path.default.basename(resolvedTargetPath)] : JS_TS_FILE_PATTERNS;
+  const lintStart = Date.now();
+  let rawResults;
+  const eslint = runner.eslint;
+  try {
+    rawResults = await eslint.lintFiles(patterns);
+  } catch (err) {
+    const error = err instanceof Error ? err : new Error(String(err));
+    if (isSkippablePatternError(error)) {
+      log.debug("Single-call lintFiles failed, falling back to per-pattern");
+      const perPatternResults = await Promise.allSettled(
+        patterns.map(async (pattern) => {
+          try {
+            return await eslint.lintFiles([pattern]);
+          } catch (patternErr) {
+            const patternError = patternErr instanceof Error ? patternErr : new Error(String(patternErr));
+            if (isSkippablePatternError(patternError)) {
+              log.debug(`Skipping pattern '${pattern}' (no lintable files)`);
+              return [];
+            }
+            throw patternError;
+          }
+        })
+      );
+      rawResults = perPatternResults.filter((r) => r.status === "fulfilled").flatMap((r) => r.value);
+    } else {
+      const cacheKey = `${eslintCwd}::${options.preset}`;
+      _runnerCache.delete(cacheKey);
+      throw error;
+    }
+  }
+  timing.lintMs = Date.now() - lintStart;
+  const processStart = Date.now();
+  const files = [];
+  const ecosystemIssues = [];
+  const parserErrors = [];
+  const ruleBreakdown = /* @__PURE__ */ new Map();
+  let totalErrors = 0;
+  let totalWarnings = 0;
+  const filesScanned = rawResults.length;
+  for (const result of rawResults) {
+    if (result.messages.length === 0) continue;
+    const relPath = import_path.default.relative(cwd, result.filePath);
+    const aiGuardIssues = [];
+    let fileErrors = 0;
+    let fileWarnings = 0;
+    for (const m of result.messages) {
+      const source = classifyMessage(m);
+      if (source === "parser-error") {
+        parserErrors.push({
+          filePath: relPath,
+          message: m.message,
+          line: m.line ?? 0
+        });
+        continue;
+      }
+      if (source === "ecosystem") {
+        ecosystemIssues.push({
+          type: classifyEcosystemType(m),
+          ruleId: m.ruleId,
+          message: m.message,
+          filePath: relPath,
+          line: m.line ?? 0,
+          column: m.column ?? 0
+        });
+        continue;
+      }
+      const ruleId = m.ruleId ?? "unknown";
+      const issue = {
+        ruleId,
+        severity: m.severity,
+        message: m.message,
+        line: m.line,
+        column: m.column,
+        endLine: m.endLine,
+        endColumn: m.endColumn,
+        confidence: ISSUE_CONFIDENCE[ruleId],
+        category: ISSUE_CATEGORY[ruleId],
+        asyncRiskType: ISSUE_ASYNC_RISK_TYPE[ruleId],
+        remediation: ISSUE_REMEDIATION[ruleId]
+      };
+      aiGuardIssues.push(issue);
+      if (m.severity === 2) {
+        fileErrors++;
+        totalErrors++;
+      } else {
+        fileWarnings++;
+        totalWarnings++;
+      }
+      ruleBreakdown.set(
+        issue.ruleId,
+        (ruleBreakdown.get(issue.ruleId) ?? 0) + 1
+      );
+    }
+    if (aiGuardIssues.length > 0) {
+      files.push({
+        filePath: relPath,
+        issues: aiGuardIssues,
+        errorCount: fileErrors,
+        warningCount: fileWarnings
+      });
+    }
+  }
+  const topFiles = [...files].sort((a, b) => b.issues.length - a.issues.length).slice(0, 10).map((f) => ({ path: f.filePath, count: f.issues.length }));
+  timing.processMs = Date.now() - processStart;
+  if (options.debugTiming) {
+    const totalMs = Date.now() - overallStart;
+    const cacheLabel = fromCache ? import_chalk2.default.green("warm cache") : import_chalk2.default.yellow("cold start");
+    log.debug(`Init:    ${initMs}ms (${cacheLabel})`);
+    log.debug(`Lint:    ${timing.lintMs}ms`);
+    log.debug(`Process: ${timing.processMs}ms`);
+    log.debug(`Total:   ${totalMs}ms | Files: ${filesScanned} | ${filesScanned > 0 ? Math.round(totalMs / filesScanned) : 0}ms/file`);
+  }
+  return {
+    files,
+    totalErrors,
+    totalWarnings,
+    totalIssues: totalErrors + totalWarnings,
+    filesScanned,
+    ruleBreakdown,
+    topFiles,
+    durationMs: Date.now() - overallStart,
+    timing,
+    ecosystemIssues,
+    parserErrors,
+    tsParserAvailable: runner.tsParserAvailable
+  };
+}
+
+// cli/utils/sarif.ts
+var RULE_DOCS = {
+  "ai-guard/no-empty-catch": { shortDesc: "Empty catch block silently swallows errors", tags: ["reliability"] },
+  "ai-guard/no-broad-exception": { shortDesc: "Catching broad Exception/Error masks specific failures", tags: ["reliability"] },
+  "ai-guard/no-catch-log-rethrow": { shortDesc: "Catch block logs and rethrows \u2014 use one or the other", tags: ["reliability"] },
+  "ai-guard/no-catch-without-use": { shortDesc: "Caught error variable is not used", tags: ["reliability"] },
+  "ai-guard/no-floating-promise": { shortDesc: "Promise not awaited or error-handled \u2014 async failures will be silently swallowed", tags: ["async", "async-reliability"] },
+  "ai-guard/no-await-in-loop": { shortDesc: "Sequential await in loop \u2014 consider Promise.all for parallel execution", tags: ["async", "async-reliability", "performance"] },
+  "ai-guard/no-async-without-await": { shortDesc: "Async function contains no await expressions", tags: ["async", "async-reliability"] },
+  "ai-guard/no-async-array-callback": { shortDesc: "Async callback in array method may not behave as expected", tags: ["async", "async-reliability"] },
+  "ai-guard/no-redundant-await": { shortDesc: "Redundant await on already-resolved value", tags: ["async"] },
+  "ai-guard/no-hardcoded-secret": { shortDesc: "Hardcoded secret or credential detected", tags: ["security", "secrets"] },
+  "ai-guard/no-eval-dynamic": { shortDesc: "Dynamic eval or Function constructor is dangerous", tags: ["security"] },
+  "ai-guard/no-sql-string-concat": { shortDesc: "SQL query built via string concatenation \u2014 SQL injection risk", tags: ["security", "injection"] },
+  "ai-guard/no-unsafe-deserialize": { shortDesc: "Unsafe deserialization of untrusted data", tags: ["security"] },
+  "ai-guard/require-auth-middleware": { shortDesc: "Route handler appears to lack authentication middleware", tags: ["security", "auth"] },
+  "ai-guard/require-authz-check": { shortDesc: "Handler lacks authorization check", tags: ["security", "auth"] },
+  "ai-guard/no-console-in-handler": { shortDesc: "console.log in request handler \u2014 use structured logging", tags: ["ai-patterns"] },
+  "ai-guard/no-duplicate-logic-block": { shortDesc: "Duplicate logic block detected", tags: ["ai-patterns"] },
+  "ai-guard/no-dead-branch": { shortDesc: "Dead code branch that can never execute", tags: ["ai-patterns"] }
+};
+var BASE_DOCS_URL = "https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules";
+function confidenceToSarifLevel(confidence) {
+  switch (confidence) {
+    case "high":
+      return "error";
+    case "medium":
+      return "warning";
+    case "low":
+      return "warning";
+    case "informational":
+      return "note";
+    default:
+      return "warning";
+  }
+}
+function confidenceToRank(confidence) {
+  switch (confidence) {
+    case "high":
+      return 90;
+    case "medium":
+      return 60;
+    case "low":
+      return 30;
+    case "informational":
+      return 10;
+    default:
+      return 30;
+  }
+}
+function confidenceToGitHubSeverity(confidence) {
+  switch (confidence) {
+    case "high":
+      return "high";
+    case "medium":
+      return "medium";
+    case "low":
+      return "low";
+    case "informational":
+      return "recommendation";
+    default:
+      return "low";
+  }
+}
+function filePathToUri(filePath) {
+  return filePath.replace(/\\/g, "/");
+}
+function collectUsedRuleIds(result) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const file of result.files) {
+    for (const issue of file.issues) {
+      ids.add(issue.ruleId);
+    }
+  }
+  return [...ids].sort();
+}
+function buildRuleDescriptors(ruleIds) {
+  return ruleIds.map((id) => {
+    const meta = RULE_DOCS[id];
+    const shortName = id.replace("ai-guard/", "");
+    const confidence = ISSUE_CONFIDENCE[id];
+    const category = ISSUE_CATEGORY[id] ?? "AI Patterns";
+    const remediation = ISSUE_REMEDIATION[id];
+    const helpMarkdown = [
+      `**${meta?.shortDesc ?? shortName}**`,
+      "",
+      remediation ? `**Fix:** ${remediation}` : "",
+      "",
+      `[View rule documentation](${BASE_DOCS_URL}/${shortName}.md)`
+    ].filter(Boolean).join("\n");
+    return {
+      id,
+      shortDescription: {
+        text: meta?.shortDesc ?? `ai-guard rule: ${shortName}`
+      },
+      fullDescription: {
+        text: meta?.shortDesc ?? `ai-guard rule: ${shortName}`
+      },
+      help: {
+        text: remediation ?? meta?.shortDesc ?? shortName,
+        markdown: helpMarkdown
+      },
+      helpUri: `${BASE_DOCS_URL}/${shortName}.md`,
+      defaultConfiguration: {
+        level: confidenceToSarifLevel(confidence)
+      },
+      properties: {
+        tags: [...meta?.tags ?? ["ai-guard"], category.toLowerCase().replace(/ /g, "-")],
+        confidence: confidence ?? "low",
+        category,
+        "problem.severity": confidenceToGitHubSeverity(confidence)
+      }
+    };
+  });
+}
+function buildSarifResult(issue, file) {
+  const confidence = ISSUE_CONFIDENCE[issue.ruleId];
+  const asyncRiskType = ISSUE_ASYNC_RISK_TYPE[issue.ruleId];
+  const category = ISSUE_CATEGORY[issue.ruleId];
+  return {
+    ruleId: issue.ruleId,
+    level: confidenceToSarifLevel(confidence),
+    kind: confidence === "informational" ? "informational" : "fail",
+    rank: confidenceToRank(confidence),
+    message: { text: issue.message },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: {
+            uri: filePathToUri(file.filePath),
+            uriBaseId: "%SRCROOT%"
+          },
+          region: {
+            startLine: Math.max(1, issue.line),
+            startColumn: issue.column > 0 ? issue.column : 1,
+            ...issue.endLine !== void 0 && { endLine: issue.endLine },
+            ...issue.endColumn !== void 0 && { endColumn: issue.endColumn }
+          }
+        },
+        message: { text: issue.message }
+      }
+    ],
+    properties: {
+      confidence: confidence ?? "low",
+      ...asyncRiskType && { asyncRiskType },
+      ...category && { category }
+    }
+  };
+}
+function buildSarifLog(result, version = "1.3.0") {
+  const usedRuleIds = collectUsedRuleIds(result);
+  const rules = buildRuleDescriptors(usedRuleIds);
+  const sarifResults = [];
+  for (const file of result.files) {
+    for (const issue of file.issues) {
+      sarifResults.push(buildSarifResult(issue, file));
+    }
+  }
+  return {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "ai-guard",
+            version,
+            informationUri: "https://github.com/YashJadhav21/eslint-plugin-ai-guard",
+            rules
+          }
+        },
+        results: sarifResults,
+        properties: {
+          preset: "recommended",
+          filesScanned: result.filesScanned,
+          durationMs: result.durationMs,
+          ecosystemIssuesCount: result.ecosystemIssues.length,
+          parserErrorsCount: result.parserErrors.length
+        }
+      }
+    ]
+  };
+}
+function sarifToJson(log2) {
+  return JSON.stringify(log2, null, 2);
+}
+
+// cli/utils/github-summary.ts
+var import_fs2 = __toESM(require("fs"));
+function escapeMarkdown(text) {
+  return text.replace(/[|`*_[\]<>]/g, "\\$&");
+}
+function tierEmoji(tier) {
+  switch (tier) {
+    case "high":
+      return "\u{1F534}";
+    case "medium":
+      return "\u{1F7E1}";
+    case "low":
+      return "\u{1F535}";
+    case "informational":
+      return "\u2B1C";
+    default:
+      return "\u2B1C";
+  }
+}
+function tierLabel(tier) {
+  switch (tier) {
+    case "high":
+      return "High";
+    case "medium":
+      return "Medium";
+    case "low":
+      return "Low";
+    case "informational":
+      return "Info";
+    default:
+      return "Low";
+  }
+}
+function emitGitHubAnnotations(result) {
+  if (process.env.GITHUB_ACTIONS !== "true") return;
+  for (const file of result.files) {
+    for (const issue of file.issues) {
+      const tier = CONFIDENCE_TIER[issue.ruleId];
+      if (tier === "informational") continue;
+      const level = issue.severity === 2 ? "error" : "warning";
+      const filePath = file.filePath.replace(/\\/g, "/");
+      const shortRule = issue.ruleId.replace("ai-guard/", "");
+      const parts = [`file=${filePath}`, `line=${issue.line}`];
+      if (issue.endLine) parts.push(`endLine=${issue.endLine}`);
+      if (issue.column > 0) parts.push(`col=${issue.column}`);
+      if (issue.endColumn) parts.push(`endColumn=${issue.endColumn}`);
+      parts.push(`title=ai-guard/${shortRule}`);
+      const msg = issue.message.replace(/\n/g, " ");
+      process.stdout.write(`::${level} ${parts.join(",")}::${msg}
+`);
+    }
+  }
+}
+function buildGitHubSummaryMarkdown(result, options) {
+  const lines = [];
+  lines.push("## AI Guard \u2014 Async Reliability Report");
+  lines.push("");
+  lines.push(`> **Preset:** \`${options.preset}\` &nbsp;|&nbsp; **Mode:** ${options.scanMode === "changed" ? "Changed files only" : options.scanMode === "staged" ? "Staged files" : "Full scan"}`);
+  if (options.changedFilesCount !== void 0) {
+    lines.push(`> **Files scanned:** ${result.filesScanned} (${options.changedFilesCount} changed)`);
+  } else {
+    lines.push(`> **Files scanned:** ${result.filesScanned}`);
+  }
+  lines.push(`> **Duration:** ${result.durationMs}ms`);
+  lines.push("");
+  if (result.totalIssues === 0) {
+    lines.push("### \u2705 No issues found");
+    lines.push("");
+    lines.push("All scanned files passed AI Guard reliability checks.");
+    lines.push("");
+    return lines.join("\n");
+  }
+  const { high = 0, medium = 0, low = 0, informational = 0 } = buildSignalCounts(result);
+  if (high > 0) {
+    lines.push(`### \u26A0\uFE0F ${high} high-confidence issue${high !== 1 ? "s" : ""} found`);
+  } else if (medium > 0) {
+    lines.push(`### \u{1F535} ${medium} medium-confidence issue${medium !== 1 ? "s" : ""} found`);
+  } else {
+    lines.push("### \u2139\uFE0F Informational hints only");
+  }
+  lines.push("");
+  lines.push("| Category | \u{1F534} High | \u{1F7E1} Medium | \u{1F535} Low | \u2B1C Info |");
+  lines.push("|----------|---------|----------|-------|--------|");
+  const categoryBreakdown = buildCategoryBreakdown(result);
+  for (const [cat, counts] of Object.entries(categoryBreakdown)) {
+    if (counts.high + counts.medium + counts.low + counts.informational === 0) continue;
+    lines.push(`| ${cat} | ${counts.high} | ${counts.medium} | ${counts.low} | ${counts.informational} |`);
+  }
+  lines.push("");
+  const allIssues = result.files.flatMap(
+    (f) => f.issues.map((i) => ({ ...i, filePath: f.filePath }))
+  );
+  const actionableIssues = allIssues.filter((i) => {
+    const tier = CONFIDENCE_TIER[i.ruleId];
+    return tier !== "informational";
+  }).sort((a, b) => {
+    const tierOrder = { high: 0, medium: 1, low: 2, informational: 3 };
+    const ta = CONFIDENCE_TIER[a.ruleId];
+    const tb = CONFIDENCE_TIER[b.ruleId];
+    return (tierOrder[ta ?? "low"] ?? 2) - (tierOrder[tb ?? "low"] ?? 2);
+  }).slice(0, 10);
+  if (actionableIssues.length > 0) {
+    lines.push("### Top Findings");
+    lines.push("");
+    lines.push("| File | Line | Rule | Confidence |");
+    lines.push("|------|------|------|------------|");
+    for (const issue of actionableIssues) {
+      const tier = CONFIDENCE_TIER[issue.ruleId];
+      const shortFile = issue.filePath.replace(/\\/g, "/").split("/").slice(-2).join("/");
+      const shortRule = issue.ruleId.replace("ai-guard/", "");
+      lines.push(
+        `| \`${escapeMarkdown(shortFile)}\` | ${issue.line} | \`${shortRule}\` | ${tierEmoji(tier)} ${tierLabel(tier)} |`
+      );
+    }
+    lines.push("");
+  }
+  if (informational > 0) {
+    lines.push("<details>");
+    lines.push(`<summary>\u{1F4A1} ${informational} informational hint${informational !== 1 ? "s" : ""} (click to expand)</summary>`);
+    lines.push("");
+    lines.push("These are stylistic hints with higher false-positive rates in frameworks like Next.js and React. Review manually before acting.");
+    lines.push("");
+    const infoIssues = allIssues.filter((i) => {
+      const tier = CONFIDENCE_TIER[i.ruleId];
+      return tier === "informational";
+    }).slice(0, 20);
+    lines.push("| File | Line | Rule |");
+    lines.push("|------|------|------|");
+    for (const issue of infoIssues) {
+      const shortFile = issue.filePath.replace(/\\/g, "/").split("/").slice(-2).join("/");
+      const shortRule = issue.ruleId.replace("ai-guard/", "");
+      lines.push(`| \`${escapeMarkdown(shortFile)}\` | ${issue.line} | \`${shortRule}\` |`);
+    }
+    lines.push("</details>");
+    lines.push("");
+  }
+  if (result.ecosystemIssues.length > 0) {
+    lines.push("<details>");
+    lines.push(`<summary>\u{1F527} ${result.ecosystemIssues.length} ESLint config issue${result.ecosystemIssues.length !== 1 ? "s" : ""} (not ai-guard findings)</summary>`);
+    lines.push("");
+    lines.push("These are from your project's ESLint configuration, not from ai-guard rules. Run `ai-guard doctor` to diagnose.");
+    lines.push("</details>");
+    lines.push("");
+  }
+  lines.push("---");
+  lines.push("");
+  lines.push("**Next steps:**");
+  if (high > 0 || medium > 0) {
+    lines.push("- Review high/medium confidence findings in the **Files changed** tab");
+    lines.push("- Run `ai-guard run --verbose` locally to see full details");
+  }
+  if (informational > 0) {
+    lines.push("- Run `ai-guard run --verbose` to expand informational hints");
+  }
+  lines.push("- Run `ai-guard baseline` to suppress known issues and track only new ones");
+  lines.push("");
+  lines.push("*Powered by [eslint-plugin-ai-guard](https://github.com/YashJadhav21/eslint-plugin-ai-guard)*");
+  return lines.join("\n");
+}
+function buildSignalCounts(result) {
+  let high = 0, medium = 0, low = 0, informational = 0;
+  for (const file of result.files) {
+    for (const issue of file.issues) {
+      const tier = CONFIDENCE_TIER[issue.ruleId];
+      if (tier === "high") high++;
+      else if (tier === "medium") medium++;
+      else if (tier === "informational") informational++;
+      else low++;
+    }
+  }
+  return { high, medium, low, informational };
+}
+function buildCategoryBreakdown(result) {
+  const breakdown = {};
+  for (const file of result.files) {
+    for (const issue of file.issues) {
+      const cat = RULE_CATEGORY[issue.ruleId] ?? "Other";
+      const tier = CONFIDENCE_TIER[issue.ruleId];
+      if (!breakdown[cat]) breakdown[cat] = { high: 0, medium: 0, low: 0, informational: 0 };
+      if (tier === "high") breakdown[cat].high++;
+      else if (tier === "medium") breakdown[cat].medium++;
+      else if (tier === "informational") breakdown[cat].informational++;
+      else breakdown[cat].low++;
+    }
+  }
+  return breakdown;
+}
+function writeGitHubSummary(result, options) {
+  const summaryPath = process.env.GITHUB_STEP_SUMMARY;
+  if (!summaryPath) return;
+  try {
+    const markdown = buildGitHubSummaryMarkdown(result, options);
+    import_fs2.default.appendFileSync(summaryPath, markdown + "\n");
+  } catch {
+  }
+}
+function writeGitHubOutputs(result, sarifPath) {
+  const outputPath = process.env.GITHUB_OUTPUT;
+  if (!outputPath) return;
+  const { high, medium, low, informational } = buildSignalCounts(result);
+  const outputs = [
+    `issues-found=${result.totalIssues}`,
+    `high-confidence-count=${high}`,
+    `medium-confidence-count=${medium}`,
+    `low-confidence-count=${low}`,
+    `informational-count=${informational}`,
+    `files-scanned=${result.filesScanned}`,
+    `duration-ms=${result.durationMs}`,
+    ...sarifPath ? [`sarif-file=${sarifPath}`] : []
+  ];
+  try {
+    import_fs2.default.appendFileSync(outputPath, outputs.join("\n") + "\n");
+  } catch {
+  }
+}
+
+// cli/utils/git-diff.ts
+var import_child_process = require("child_process");
+var import_path2 = __toESM(require("path"));
+var import_fs3 = __toESM(require("fs"));
+var DEFAULT_EXTENSIONS = [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".mts", ".cts"];
+var IGNORE_PREFIXES = [
+  "node_modules/",
+  "dist/",
+  "build/",
+  ".next/",
+  "out/",
+  "coverage/",
+  ".cache/",
+  ".turbo/",
+  ".nx/",
+  "vendor/",
+  "tmp/",
+  "temp/",
+  "__generated__/",
+  "generated/",
+  "storybook-static/",
+  ".expo/",
+  ".svelte-kit/"
+];
+function runGit(args, cwd) {
+  try {
+    return (0, import_child_process.execSync)(`git ${args}`, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function isGitAvailable(cwd) {
+  return runGit("rev-parse --is-inside-work-tree", cwd) === "true";
+}
+function filterFiles(rawFiles, extensions, workingDirectory, cwd) {
+  let dropped = 0;
+  const kept = [];
+  for (const rel of rawFiles) {
+    const ext = import_path2.default.extname(rel).toLowerCase();
+    if (!extensions.includes(ext)) {
+      dropped++;
+      continue;
+    }
+    const normalized = rel.replace(/\\/g, "/");
+    if (IGNORE_PREFIXES.some((prefix) => normalized.startsWith(prefix))) {
+      dropped++;
+      continue;
+    }
+    if (workingDirectory) {
+      const wdNorm = workingDirectory.replace(/\\/g, "/").replace(/\/$/, "");
+      if (!normalized.startsWith(wdNorm + "/") && normalized !== wdNorm) {
+        dropped++;
+        continue;
+      }
+    }
+    const abs = import_path2.default.resolve(cwd, rel);
+    if (!import_fs3.default.existsSync(abs)) {
+      dropped++;
+      continue;
+    }
+    kept.push(abs);
+  }
+  return { kept, dropped };
+}
+function parseFileList(output) {
+  return output.split("\n").map((f) => f.trim()).filter(Boolean);
+}
+function getChangedFiles(options = {}) {
+  const {
+    staged = false,
+    base,
+    cwd = process.cwd(),
+    extensions = DEFAULT_EXTENSIONS,
+    workingDirectory
+  } = options;
+  const effectiveBase = base ?? process.env.GITHUB_BASE_REF ? `origin/${process.env.GITHUB_BASE_REF ?? ""}` : void 0;
+  if (!isGitAvailable(cwd)) {
+    return { files: [], mode: "fallback", totalDetected: 0, filteredOut: 0 };
+  }
+  let rawOutput = null;
+  let mode;
+  let usedBase;
+  if (effectiveBase && !staged) {
+    const mergeBase = runGit(`merge-base HEAD ${effectiveBase}`, cwd);
+    if (mergeBase) {
+      rawOutput = runGit(`diff --name-only --diff-filter=ACMRT ${mergeBase}...HEAD`, cwd);
+    }
+    if (!rawOutput) {
+      rawOutput = runGit(`diff --name-only --diff-filter=ACMRT ${effectiveBase}`, cwd);
+    }
+    mode = "pr-diff";
+    usedBase = effectiveBase;
+  } else if (staged) {
+    rawOutput = runGit("diff --name-only --cached --diff-filter=ACMRT", cwd);
+    mode = "staged";
+  } else {
+    const staged_ = runGit("diff --name-only --cached --diff-filter=ACMRT", cwd) ?? "";
+    const unstaged = runGit("diff --name-only --diff-filter=ACMRT", cwd) ?? "";
+    const combined = /* @__PURE__ */ new Set([...parseFileList(staged_), ...parseFileList(unstaged)]);
+    rawOutput = [...combined].join("\n");
+    mode = "uncommitted";
+  }
+  if (!rawOutput) {
+    return { files: [], mode, base: usedBase, totalDetected: 0, filteredOut: 0 };
+  }
+  const rawFiles = parseFileList(rawOutput);
+  const { kept, dropped } = filterFiles(rawFiles, extensions, workingDirectory, cwd);
+  return {
+    files: kept,
+    mode,
+    base: usedBase,
+    totalDetected: rawFiles.length,
+    filteredOut: dropped
+  };
+}
+function isGitHubActions() {
+  return process.env.GITHUB_ACTIONS === "true";
+}
+function getGitHubBaseRef() {
+  return process.env.GITHUB_BASE_REF || void 0;
+}
+
+// cli/commands/run.ts
+function registerRunCommand(program2) {
+  program2.command("run").description("Run ai-guard rules on your project (zero ESLint config required)").option("--path <dir>", "Directory or file to scan", ".").option("--strict", "Use the strict rule preset (all rules at error)").option("--security", "Use the security-only rule preset").option("--json", "Output results as JSON (CI-friendly)").option("--sarif", "Output results as SARIF 2.1.0 (for GitHub Code Scanning)").option("--fail-on <level>", "Fail CI on: errors (default) | high | medium | any | none", "errors").option(
+    "--max-warnings <n>",
+    "Fail with exit code 1 if warnings exceed this count",
+    (value) => Number.parseInt(value, 10)
+  ).option("--verbose", "Show all issues \u2014 disable grouping of repeated warnings").option("--quiet", "Only show errors \u2014 suppress warnings and informational hints").option("--debug-timing", "Print per-phase timing diagnostics").action(async (opts) => {
+    if (opts.maxWarnings !== void 0 && (!Number.isInteger(opts.maxWarnings) || opts.maxWarnings < 0)) {
+      log.blank();
+      log.error("--max-warnings must be a non-negative integer.");
+      log.blank();
+      process.exit(1);
+      return;
+    }
+    const preset = opts.strict ? "strict" : opts.security ? "security" : "recommended";
+    if (opts.strict && opts.security && !opts.json) {
+      log.warn("Both --strict and --security were provided. Using --strict.");
+      log.blank();
+    }
+    if (!opts.json) {
+      log.banner("AI GUARD");
+      log.blank();
+    }
+    const spinner = opts.json ? null : (0, import_ora.default)({ text: "Scanning\u2026", color: "cyan" }).start();
+    let result;
+    try {
+      result = await runEslint({
+        preset,
+        targetPath: opts.path,
+        debugTiming: opts.debugTiming
+      });
+      spinner?.stop();
+    } catch (err) {
+      spinner?.stop();
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg.toLowerCase().includes("typescript") && msg.toLowerCase().includes("parser")) {
+        log.blank();
+        log.error("TypeScript detected but parser not found.");
+        log.blank();
+        log.print(`  ${import_chalk3.default.bold("Install the TypeScript parser:")}`);
+        log.blank();
+        log.print(`    ${import_chalk3.default.cyan("npm install --save-dev @typescript-eslint/parser")}`);
+        log.blank();
+      } else {
+        log.blank();
+        log.error(msg);
+        log.blank();
+        log.print(`  ${import_chalk3.default.bold("Fix:")} Run ${import_chalk3.default.cyan("ai-guard doctor")} to diagnose your setup.`);
+        log.blank();
+      }
+      process.exit(1);
+      return;
+    }
+    if (isGitHubActions()) {
+      emitGitHubAnnotations(result);
+      writeGitHubSummary(result, { preset, scanMode: "full" });
+      writeGitHubOutputs(result);
+    }
+    if (opts.sarif) {
+      const sarifLog = buildSarifLog(result);
+      console.log(sarifToJson(sarifLog));
+      process.exit(resolveExitCode(result, opts.failOn ?? "errors", opts.maxWarnings));
+      return;
+    }
+    if (opts.json) {
+      const signalSummary = buildSignalSummary(result);
+      const jsonOutput = {
+        preset,
+        scannedPath: opts.path,
+        filesScanned: result.filesScanned,
+        totalErrors: result.totalErrors,
+        totalWarnings: result.totalWarnings,
+        totalIssues: result.totalIssues,
+        durationMs: result.durationMs,
+        timing: result.timing,
+        signalSummary,
+        ruleBreakdown: Object.fromEntries(result.ruleBreakdown),
+        topFiles: result.topFiles,
+        files: result.files,
+        ecosystemIssues: result.ecosystemIssues,
+        parserErrors: result.parserErrors,
+        tsParserAvailable: result.tsParserAvailable
+      };
+      console.log(JSON.stringify(jsonOutput, null, 2));
+      process.exit(resolveExitCode(result, opts.failOn ?? "errors", opts.maxWarnings));
+      return;
+    }
+    log.scanStats(result.filesScanned, result.files.length, result.durationMs, preset);
+    if (!result.tsParserAvailable) {
+      log.print(
+        import_chalk3.default.dim(`  \u2139  TypeScript parser not found \u2014 .ts/.tsx files use espree fallback`) + import_chalk3.default.dim(`  (install @typescript-eslint/parser for full TS support)`)
+      );
+    }
+    log.blank();
+    if (result.totalIssues === 0 && result.ecosystemIssues.length === 0 && result.parserErrors.length === 0) {
+      log.print(
+        `  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold.green("No AI issues found")}  ${import_chalk3.default.gray(`\u2014 ${result.filesScanned} file${result.filesScanned !== 1 ? "s" : ""} scanned, all clean`)}`
+      );
+      log.blank();
+      process.exit(0);
+      return;
+    }
+    if (result.totalIssues === 0) {
+      log.print(
+        `  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold.green("No AI issues found")}  ${import_chalk3.default.gray(`\u2014 ${result.filesScanned} file${result.filesScanned !== 1 ? "s" : ""} scanned, all clean`)}`
+      );
+      log.blank();
+    }
+    if (result.totalIssues > 0) {
+      const verbose = opts.verbose ?? false;
+      const quiet = opts.quiet ?? false;
+      const { actionableFiles, informationalFiles } = partitionByTier(result, quiet);
+      log.section("Summary by Category");
+      const categoryErrors = {};
+      const categoryWarnings = {};
+      for (const file of actionableFiles) {
+        for (const issue of file.issues) {
+          const cat = RULE_CATEGORY[issue.ruleId] ?? "Other";
+          if (issue.severity === 2) {
+            categoryErrors[cat] = (categoryErrors[cat] ?? 0) + 1;
+          } else {
+            categoryWarnings[cat] = (categoryWarnings[cat] ?? 0) + 1;
+          }
+        }
+      }
+      const allCategories = /* @__PURE__ */ new Set([
+        ...CATEGORY_ORDER,
+        ...Object.keys(categoryErrors),
+        ...Object.keys(categoryWarnings)
+      ]);
+      const sortedCategories = [...allCategories].filter(
+        (cat) => (categoryErrors[cat] ?? 0) + (categoryWarnings[cat] ?? 0) > 0
+      );
+      sortedCategories.sort((a, b) => {
+        const ai = CATEGORY_ORDER.indexOf(a);
+        const bi = CATEGORY_ORDER.indexOf(b);
+        if (ai !== -1 && bi !== -1) return ai - bi;
+        if (ai !== -1) return -1;
+        if (bi !== -1) return 1;
+        return a.localeCompare(b);
+      });
+      for (const cat of sortedCategories) {
+        const icon = CATEGORY_ICONS[cat] ?? "\u26AA";
+        log.category(icon, cat, categoryErrors[cat] ?? 0, categoryWarnings[cat] ?? 0);
+      }
+      log.blank();
+      log.print(
+        `  ${import_chalk3.default.bold("Total:")} ${formatIssueCount(result.totalErrors, result.totalWarnings)}`
+      );
+      log.blank();
+      if (result.ruleBreakdown.size > 0) {
+        log.section("By Rule");
+        const sorted = [...result.ruleBreakdown.entries()].sort(
+          (a, b) => b[1] - a[1]
+        );
+        for (const [rule, count] of sorted) {
+          const shortRule = rule.replace(/^ai-guard\//, "");
+          const tier = CONFIDENCE_TIER[rule];
+          const tierLabel2 = tier === "high" ? import_chalk3.default.red.dim("[high]") : tier === "medium" ? import_chalk3.default.yellow.dim("[medium]") : tier === "informational" ? import_chalk3.default.gray.dim("[info]") : import_chalk3.default.gray.dim("[low]");
+          if (quiet && tier === "informational") continue;
+          log.print(
+            `    ${import_chalk3.default.gray("\u2022")} ${import_chalk3.default.yellow(shortRule)} ${tierLabel2}${import_chalk3.default.gray(":")} ${import_chalk3.default.white(String(count))}`
+          );
+        }
+        log.blank();
+      }
+      if (result.topFiles.length > 0) {
+        log.section("Top Files");
+        for (const { path: fp, count } of result.topFiles) {
+          log.print(
+            `    ${import_chalk3.default.gray("\u2022")} ${import_chalk3.default.white(fp)} ${import_chalk3.default.gray(`(${count})`)}`
+          );
+        }
+        log.blank();
+      }
+      if (actionableFiles.length > 0) {
+        log.section("Issues by File");
+        log.blank();
+        renderIssuesByFile({ ...result, files: actionableFiles }, verbose, quiet);
+      }
+      const totalInfoCount = informationalFiles.reduce((n, f) => n + f.issues.length, 0);
+      if (totalInfoCount > 0 && !quiet) {
+        if (verbose) {
+          log.section("Informational Hints");
+          log.print(import_chalk3.default.dim(`  Stylistic hints with higher false-positive rate \u2014 review before acting.`));
+          log.blank();
+          renderIssuesByFile({ ...result, files: informationalFiles }, true, false);
+        } else {
+          log.blank();
+          log.print(
+            `  ${import_chalk3.default.gray("\u25B8")}  ${import_chalk3.default.gray(`${totalInfoCount} informational hint${totalInfoCount !== 1 ? "s" : ""} \u2014 run with ${import_chalk3.default.cyan("--verbose")} to expand`)}`
+          );
+        }
+      }
+    }
+    if (result.ecosystemIssues.length > 0) {
+      log.ecosystemSection("ESLint Config Issues");
+      log.print(
+        import_chalk3.default.dim(`  These issues come from your project's ESLint config, not from ai-guard.`)
+      );
+      log.blank();
+      const seen = /* @__PURE__ */ new Map();
+      for (const issue of result.ecosystemIssues) {
+        const key = `${issue.ruleId ?? "null"}::${issue.message}`;
+        const existing = seen.get(key);
+        if (existing) {
+          existing.count++;
+        } else {
+          seen.set(key, { issue, count: 1 });
+        }
+      }
+      for (const { issue, count } of seen.values()) {
+        log.ecosystemIssue(issue, count);
+      }
+      log.blank();
+    }
+    if (result.parserErrors.length > 0) {
+      log.ecosystemSection("Parser Errors");
+      log.print(
+        import_chalk3.default.dim(`  These files could not be parsed \u2014 not ai-guard findings.`)
+      );
+      log.blank();
+      for (const pe of result.parserErrors) {
+        log.parserError(pe);
+      }
+      if (!result.tsParserAvailable) {
+        log.blank();
+        log.print(
+          `  ${import_chalk3.default.cyan("\u2192 Fix:")} ${import_chalk3.default.yellow("npm install --save-dev @typescript-eslint/parser")}`
+        );
+        log.print(
+          import_chalk3.default.dim(`  TypeScript parser resolves most .ts/.tsx parse failures.`)
+        );
+      }
+      log.blank();
+    }
+    log.divider();
+    log.blank();
+    log.section("Next Steps");
+    if (result.totalIssues > 0) {
+      log.info(`Run ${import_chalk3.default.cyan("ai-guard baseline")} to save these issues and track only new ones`);
+      log.info(`Run ${import_chalk3.default.cyan("ai-guard report")}   to generate a shareable HTML report`);
+      log.info(`Run ${import_chalk3.default.cyan("ai-guard ignore")}   to suppress dist/build noise`);
+    }
+    if (result.ecosystemIssues.length > 0) {
+      log.info(`Run ${import_chalk3.default.cyan("ai-guard doctor")}   to diagnose ESLint config issues`);
+    }
+    if (!opts.verbose && hasGroupedWarnings(result)) {
+      log.info(`Run with ${import_chalk3.default.cyan("--verbose")} to expand grouped warnings`);
+    }
+    log.blank();
+    process.exit(getRunExitCode(result, opts.maxWarnings));
+  });
+}
+var GROUP_THRESHOLD = 4;
+function partitionByTier(result, quiet) {
+  const actionableFiles = [];
+  const informationalFiles = [];
+  for (const file of result.files) {
+    const actionableIssues = file.issues.filter((i) => {
+      const tier = CONFIDENCE_TIER[i.ruleId];
+      if (quiet && (tier === "informational" || i.severity === 1)) return false;
+      return tier !== "informational";
+    });
+    const infoIssues = file.issues.filter((i) => {
+      const tier = CONFIDENCE_TIER[i.ruleId];
+      return tier === "informational";
+    });
+    if (actionableIssues.length > 0) {
+      actionableFiles.push({ ...file, issues: actionableIssues });
+    }
+    if (infoIssues.length > 0) {
+      informationalFiles.push({ ...file, issues: infoIssues });
+    }
+  }
+  return { actionableFiles, informationalFiles };
+}
+function buildSignalSummary(result) {
+  let high = 0, medium = 0, low = 0, informational = 0;
+  for (const file of result.files) {
+    for (const issue of file.issues) {
+      const tier = CONFIDENCE_TIER[issue.ruleId];
+      if (tier === "high") high++;
+      else if (tier === "medium") medium++;
+      else if (tier === "informational") informational++;
+      else low++;
+    }
+  }
+  return {
+    high,
+    medium,
+    low,
+    informational,
+    ecosystemIssues: result.ecosystemIssues.length,
+    parserErrors: result.parserErrors.length
+  };
+}
+function hasGroupedWarnings(result) {
+  for (const file of result.files) {
+    const ruleCounts = /* @__PURE__ */ new Map();
+    for (const issue of file.issues) {
+      ruleCounts.set(issue.ruleId, (ruleCounts.get(issue.ruleId) ?? 0) + 1);
+    }
+    for (const count of ruleCounts.values()) {
+      if (count >= GROUP_THRESHOLD) return true;
+    }
+  }
+  return false;
+}
+function renderIssuesByFile(result, verbose, quiet = false) {
+  for (const file of result.files) {
+    log.print(
+      `  ${import_chalk3.default.bold.white(file.filePath)} ` + import_chalk3.default.gray(
+        `(${file.errorCount} error${file.errorCount !== 1 ? "s" : ""}, ${file.warningCount} warning${file.warningCount !== 1 ? "s" : ""})`
+      )
+    );
+    if (!verbose) {
+      const ruleCounts = /* @__PURE__ */ new Map();
+      for (const issue of file.issues) {
+        const arr = ruleCounts.get(issue.ruleId) ?? [];
+        arr.push(issue);
+        ruleCounts.set(issue.ruleId, arr);
+      }
+      for (const issues of ruleCounts.values()) {
+        const tier = CONFIDENCE_TIER[issues[0].ruleId] ?? "low";
+        if (tier === "low" && issues.length >= GROUP_THRESHOLD) {
+          const sev = issues[0].severity === 2 ? import_chalk3.default.red("error") : import_chalk3.default.yellow(" warn");
+          const shortRule = import_chalk3.default.gray(issues[0].ruleId.replace(/^ai-guard\//, ""));
+          log.print(
+            `    ${sev}  ${import_chalk3.default.white(issues[0].message)}  ${shortRule}`
+          );
+          log.print(
+            import_chalk3.default.dim(`           \u21B3 ${issues.length} occurrences \u2014 run with --verbose to expand`)
+          );
+        } else {
+          for (const issue of issues) {
+            renderSingleIssue(issue);
+          }
         }
-        throw error;
       }
-    })
+    } else {
+      for (const issue of file.issues) {
+        renderSingleIssue(issue);
+      }
+    }
+    log.blank();
+  }
+}
+function renderSingleIssue(issue) {
+  const sev = issue.severity === 2 ? import_chalk3.default.red("error") : import_chalk3.default.yellow(" warn");
+  const loc = import_chalk3.default.gray(`${String(issue.line)}:${String(issue.column)}`).padEnd(12);
+  const ruleShort = import_chalk3.default.gray(issue.ruleId.replace(/^ai-guard\//, ""));
+  const tier = CONFIDENCE_TIER[issue.ruleId];
+  const tierTag = tier === "informational" ? import_chalk3.default.dim(" [info]") : "";
+  log.print(
+    `    ${loc} ${sev}  ${import_chalk3.default.white(issue.message)}${tierTag}  ${ruleShort}`
   );
-  const rawResults = perPatternResults.flat();
-  const durationMs = Date.now() - startMs;
-  const files = [];
-  const ruleBreakdown = /* @__PURE__ */ new Map();
-  let totalErrors = 0;
-  let totalWarnings = 0;
-  const filesScanned = rawResults.length;
-  for (const result of rawResults) {
-    if (result.messages.length === 0) continue;
-    const issues = result.messages.map((m) => ({
-      ruleId: m.ruleId ?? "unknown",
-      severity: m.severity,
-      message: m.message,
-      line: m.line,
-      column: m.column
-    }));
-    const errorCount = result.errorCount;
-    const warningCount = result.warningCount;
-    totalErrors += errorCount;
-    totalWarnings += warningCount;
-    for (const issue of issues) {
-      ruleBreakdown.set(
-        issue.ruleId,
-        (ruleBreakdown.get(issue.ruleId) ?? 0) + 1
-      );
+}
+function getRunExitCode(result, maxWarnings) {
+  if (result.totalErrors > 0) return 1;
+  if (maxWarnings !== void 0 && result.totalWarnings > maxWarnings) return 1;
+  return 0;
+}
+function formatIssueCount(errors, warnings) {
+  const parts = [];
+  if (errors > 0) parts.push(import_chalk3.default.red.bold(`${errors} error${errors !== 1 ? "s" : ""}`));
+  if (warnings > 0) parts.push(import_chalk3.default.yellow.bold(`${warnings} warning${warnings !== 1 ? "s" : ""}`));
+  return parts.join(import_chalk3.default.gray(" \xB7 "));
+}
+function resolveExitCode(result, failOn, maxWarnings) {
+  if (maxWarnings !== void 0 && result.totalWarnings > maxWarnings) return 1;
+  switch (failOn) {
+    case "none":
+      return 0;
+    case "errors":
+      return result.totalErrors > 0 ? 1 : 0;
+    case "high": {
+      const high = result.files.flatMap((f) => f.issues).filter((i) => CONFIDENCE_TIER[i.ruleId] === "high").length;
+      return high > 0 ? 1 : 0;
+    }
+    case "medium": {
+      const highMed = result.files.flatMap((f) => f.issues).filter((i) => CONFIDENCE_TIER[i.ruleId] === "high" || CONFIDENCE_TIER[i.ruleId] === "medium").length;
+      return highMed > 0 ? 1 : 0;
     }
-    const relPath = import_path.default.relative(process.cwd(), result.filePath);
-    files.push({ filePath: relPath, issues, errorCount, warningCount });
+    case "any": {
+      const actionable = result.files.flatMap((f) => f.issues).filter((i) => CONFIDENCE_TIER[i.ruleId] !== "informational").length;
+      return actionable > 0 ? 1 : 0;
+    }
+    default:
+      return getRunExitCode(result, maxWarnings);
   }
-  const topFiles = [...files].sort((a, b) => b.issues.length - a.issues.length).slice(0, 10).map((f) => ({ path: f.filePath, count: f.issues.length }));
-  return {
-    files,
-    totalErrors,
-    totalWarnings,
-    totalIssues: totalErrors + totalWarnings,
-    filesScanned,
-    ruleBreakdown,
-    topFiles,
-    durationMs
-  };
 }
 
-// cli/commands/run.ts
-function registerRunCommand(program2) {
-  program2.command("run").description("Run ai-guard rules on your project (zero ESLint config required)").option("--path <dir>", "Directory or file to scan", ".").option("--strict", "Use the strict rule preset (all rules at error)").option("--security", "Use the security-only rule preset").option("--json", "Output results as JSON (CI-friendly)").option(
+// cli/commands/changed.ts
+var import_path3 = __toESM(require("path"));
+var import_fs4 = __toESM(require("fs"));
+var import_ora2 = __toESM(require("ora"));
+var import_chalk4 = __toESM(require("chalk"));
+function registerChangedCommand(program2) {
+  program2.command("changed").description("Scan only changed files in the current PR or working tree (fastest CI mode)").option("--pr", "Scan files changed vs base branch (auto-detects GITHUB_BASE_REF in CI)").option("--staged", "Scan only staged (git add'd) files").option("--base <branch>", "Base branch to diff against (e.g. main, origin/main)").option("--path <dir>", "Root path / working directory for scanning", ".").option("--strict", "Use the strict rule preset (all rules at error)").option("--security", "Use the security-only rule preset").option("--fail-on <level>", "Fail CI on: high | medium | any | none", "high").option("--json", "Output results as JSON").option("--sarif", "Output results as SARIF 2.1.0 (for GitHub Code Scanning)").option("--sarif-output <file>", "Write SARIF to file instead of stdout").option("--github-summary", "Write GitHub step summary (auto-enabled in GitHub Actions)").option(
     "--max-warnings <n>",
-    "Fail with exit code 1 if warnings exceed this count",
-    (value) => Number.parseInt(value, 10)
-  ).action(async (opts) => {
-    if (opts.maxWarnings !== void 0 && (!Number.isInteger(opts.maxWarnings) || opts.maxWarnings < 0)) {
-      log.blank();
-      log.error("--max-warnings must be a non-negative integer.");
-      log.blank();
-      process.exit(1);
-      return;
-    }
+    "Fail if warnings exceed this count",
+    (v) => Number.parseInt(v, 10)
+  ).option("--verbose", "Expand all findings (disable grouping)").option("--quiet", "Show errors only").option("--debug-timing", "Print per-phase timing diagnostics").action(async (opts) => {
     const preset = opts.strict ? "strict" : opts.security ? "security" : "recommended";
-    if (opts.strict && opts.security && !opts.json) {
-      log.warn("Both --strict and --security were provided. Using --strict.");
-      log.blank();
-    }
-    if (!opts.json) {
+    const inCI = isGitHubActions();
+    const baseRef = opts.base ?? (opts.pr || inCI ? getGitHubBaseRef() : void 0);
+    if (!opts.json && !opts.sarif) {
       log.banner("AI GUARD");
-      log.blank();
     }
-    const spinner = opts.json ? null : (0, import_ora.default)({ text: "Scanning\u2026", color: "cyan" }).start();
-    let result;
-    try {
-      result = await runEslint({ preset, targetPath: opts.path });
-      spinner?.stop();
-    } catch (err) {
+    const cwd = process.cwd();
+    const resolvedPath = import_path3.default.resolve(opts.path);
+    const workingDirectory = opts.path !== "." ? opts.path : void 0;
+    const spinner = opts.json || opts.sarif ? null : (0, import_ora2.default)({ text: import_chalk4.default.dim("Detecting changed files\u2026"), color: "cyan" }).start();
+    const changedResult = getChangedFiles({
+      staged: opts.staged ?? false,
+      base: baseRef ? `origin/${baseRef}` : opts.base,
+      cwd,
+      workingDirectory
+    });
+    if (changedResult.files.length === 0) {
       spinner?.stop();
-      const msg = err instanceof Error ? err.message : String(err);
-      if (msg.toLowerCase().includes("typescript") && msg.toLowerCase().includes("parser")) {
-        log.blank();
-        log.error("TypeScript detected but parser not found.");
-        log.blank();
-        log.print(`  ${import_chalk2.default.bold("Install the TypeScript parser:")}`);
-        log.blank();
-        log.print(`    ${import_chalk2.default.cyan("npm install --save-dev @typescript-eslint/parser")}`);
-        log.blank();
-      } else {
-        log.blank();
-        log.error(msg);
+      if (changedResult.mode === "fallback") {
+        if (!opts.json && !opts.sarif) {
+          log.warn("Git not available. Falling back to full scan.");
+          log.blank();
+        }
+        const result2 = await runEslint({
+          preset,
+          targetPath: resolvedPath.toString(),
+          debugTiming: opts.debugTiming
+        });
+        handleResults(result2, opts, preset, "full", 0, inCI);
+        return;
+      }
+      if (!opts.json && !opts.sarif) {
         log.blank();
-        log.print(`  ${import_chalk2.default.bold("Fix:")} Run ${import_chalk2.default.cyan("ai-guard doctor")} to diagnose your setup.`);
+        log.print(`  ${import_chalk4.default.green("\u2714")}  No changed JS/TS files detected \u2014 nothing to scan`);
+        if (changedResult.filteredOut > 0) {
+          log.print(import_chalk4.default.dim(`     (${changedResult.filteredOut} changed file${changedResult.filteredOut !== 1 ? "s" : ""} skipped \u2014 not JS/TS)`));
+        }
         log.blank();
+      } else if (opts.json) {
+        console.log(JSON.stringify({
+          preset,
+          scanMode: changedResult.mode,
+          changedFiles: 0,
+          filesScanned: 0,
+          totalIssues: 0,
+          totalErrors: 0,
+          totalWarnings: 0,
+          signalSummary: { high: 0, medium: 0, low: 0, informational: 0, ecosystemIssues: 0, parserErrors: 0 }
+        }, null, 2));
       }
-      process.exit(1);
+      process.exit(0);
       return;
     }
-    if (opts.json) {
-      const jsonOutput = {
-        preset,
-        scannedPath: opts.path,
-        filesScanned: result.filesScanned,
-        totalErrors: result.totalErrors,
-        totalWarnings: result.totalWarnings,
-        totalIssues: result.totalIssues,
-        durationMs: result.durationMs,
-        ruleBreakdown: Object.fromEntries(result.ruleBreakdown),
-        topFiles: result.topFiles,
-        files: result.files
-      };
-      console.log(JSON.stringify(jsonOutput, null, 2));
-      process.exit(getRunExitCode(result, opts.maxWarnings));
-      return;
+    if (spinner) {
+      spinner.text = import_chalk4.default.dim(`Scanning ${changedResult.files.length} changed file${changedResult.files.length !== 1 ? "s" : ""}\u2026`);
     }
-    log.scanStats(result.filesScanned, result.files.length, result.durationMs, preset);
-    log.blank();
-    if (result.totalIssues === 0) {
-      log.print(
-        `  ${import_chalk2.default.green("\u2714")}  ${import_chalk2.default.bold.green("No AI issues found")}  ${import_chalk2.default.gray(`\u2014 ${result.filesScanned} file${result.filesScanned !== 1 ? "s" : ""} scanned, all clean`)}`
-      );
-      log.blank();
-      process.exit(0);
-      return;
+    const result = await runEslint({
+      preset,
+      targetPath: resolvedPath.toString(),
+      files: changedResult.files,
+      debugTiming: opts.debugTiming
+    });
+    spinner?.stop();
+    handleResults(result, opts, preset, changedResult.mode === "pr-diff" ? "changed" : changedResult.mode === "staged" ? "staged" : "changed", changedResult.files.length, inCI);
+  });
+}
+function handleResults(result, opts, preset, scanMode, changedFilesCount, inCI) {
+  if (inCI || opts.githubSummary) {
+    writeGitHubSummary(result, { preset, scanMode, changedFilesCount });
+    writeGitHubOutputs(result, opts.sarifOutput);
+    emitGitHubAnnotations(result);
+  }
+  if (opts.sarif) {
+    const sarifLog = buildSarifLog(result);
+    const sarifJson = sarifToJson(sarifLog);
+    if (opts.sarifOutput) {
+      import_fs4.default.writeFileSync(opts.sarifOutput, sarifJson, "utf-8");
+    } else {
+      console.log(sarifJson);
     }
+    process.exit(getFailOnExitCode(result, opts.failOn, opts.maxWarnings));
+    return;
+  }
+  if (opts.json) {
+    const signalSummary = buildSignalSummary(result);
+    const jsonOutput = {
+      version: "1.3.0",
+      preset,
+      scanMode,
+      scannedPath: opts.path,
+      filesScanned: result.filesScanned,
+      changedFilesCount,
+      totalErrors: result.totalErrors,
+      totalWarnings: result.totalWarnings,
+      totalIssues: result.totalIssues,
+      durationMs: result.durationMs,
+      signalSummary,
+      ruleBreakdown: Object.fromEntries(result.ruleBreakdown),
+      topFiles: result.topFiles,
+      files: result.files,
+      ecosystemIssues: result.ecosystemIssues,
+      parserErrors: result.parserErrors,
+      tsParserAvailable: result.tsParserAvailable
+    };
+    console.log(JSON.stringify(jsonOutput, null, 2));
+    process.exit(getFailOnExitCode(result, opts.failOn, opts.maxWarnings));
+    return;
+  }
+  const scanModeLabel = scanMode === "changed" ? "Changed files" : scanMode === "staged" ? "Staged files" : "Full scan";
+  const modeTag = changedFilesCount > 0 ? `${changedFilesCount} changed` : "";
+  log.summary(
+    result.filesScanned,
+    result.totalIssues,
+    result.files.filter((f) => f.issues.length > 0).length,
+    result.durationMs,
+    `${preset} \xB7 ${scanModeLabel}${modeTag ? ` (${modeTag})` : ""}`
+  );
+  if (result.totalIssues === 0) {
+    log.blank();
+    log.success(`No AI issues found \u2014 ${result.filesScanned} file${result.filesScanned !== 1 ? "s" : ""} scanned, all clean`);
+    log.blank();
+  } else {
+    const verbose = opts.verbose ?? false;
+    const quiet = opts.quiet ?? false;
+    const { actionableFiles, informationalFiles } = partitionByTier(result, quiet);
     log.section("Summary by Category");
     const categoryErrors = {};
     const categoryWarnings = {};
-    for (const file of result.files) {
+    for (const file of actionableFiles) {
       for (const issue of file.issues) {
         const cat = RULE_CATEGORY[issue.ruleId] ?? "Other";
-        if (issue.severity === 2) {
-          categoryErrors[cat] = (categoryErrors[cat] ?? 0) + 1;
-        } else {
-          categoryWarnings[cat] = (categoryWarnings[cat] ?? 0) + 1;
-        }
+        if (issue.severity === 2) categoryErrors[cat] = (categoryErrors[cat] ?? 0) + 1;
+        else categoryWarnings[cat] = (categoryWarnings[cat] ?? 0) + 1;
       }
     }
-    const allCategories = /* @__PURE__ */ new Set([
-      ...CATEGORY_ORDER,
-      ...Object.keys(categoryErrors),
-      ...Object.keys(categoryWarnings)
-    ]);
-    const sortedCategories = [...allCategories].filter(
-      (cat) => (categoryErrors[cat] ?? 0) + (categoryWarnings[cat] ?? 0) > 0
-    );
-    sortedCategories.sort((a, b) => {
-      const ai = CATEGORY_ORDER.indexOf(a);
-      const bi = CATEGORY_ORDER.indexOf(b);
+    const allCategories = /* @__PURE__ */ new Set([...CATEGORY_ORDER, ...Object.keys(categoryErrors), ...Object.keys(categoryWarnings)]);
+    const sortedCats = [...allCategories].filter((c) => (categoryErrors[c] ?? 0) + (categoryWarnings[c] ?? 0) > 0).sort((a, b) => {
+      const ai = CATEGORY_ORDER.indexOf(a), bi = CATEGORY_ORDER.indexOf(b);
       if (ai !== -1 && bi !== -1) return ai - bi;
       if (ai !== -1) return -1;
       if (bi !== -1) return 1;
       return a.localeCompare(b);
     });
-    for (const cat of sortedCategories) {
+    for (const cat of sortedCats) {
       const icon = CATEGORY_ICONS[cat] ?? "\u26AA";
       log.category(icon, cat, categoryErrors[cat] ?? 0, categoryWarnings[cat] ?? 0);
     }
     log.blank();
-    log.print(
-      `  ${import_chalk2.default.bold("Total:")} ${formatIssueCount(result.totalErrors, result.totalWarnings)}`
-    );
+    log.print(`  ${import_chalk4.default.bold("Total:")} ${formatIssueCount(result.totalErrors, result.totalWarnings)}`);
     log.blank();
-    if (result.ruleBreakdown.size > 0) {
-      log.section("By Rule");
-      const sorted = [...result.ruleBreakdown.entries()].sort(
-        (a, b) => b[1] - a[1]
-      );
-      for (const [rule, count] of sorted) {
-        const shortRule = rule.replace(/^ai-guard\//, "");
-        log.print(
-          `    ${import_chalk2.default.gray("\u2022")} ${import_chalk2.default.yellow(shortRule)}${import_chalk2.default.gray(":")} ${import_chalk2.default.white(String(count))}`
-        );
-      }
+    if (actionableFiles.length > 0) {
+      log.section("Issues by File");
       log.blank();
+      renderIssuesByFile({ ...result, files: actionableFiles }, verbose, quiet);
     }
-    if (result.topFiles.length > 0) {
-      log.section("Top Files");
-      for (const { path: fp, count } of result.topFiles) {
-        log.print(
-          `    ${import_chalk2.default.gray("\u2022")} ${import_chalk2.default.white(fp)} ${import_chalk2.default.gray(`(${count})`)}`
-        );
+    const totalInfoCount = informationalFiles.reduce((n, f) => n + f.issues.length, 0);
+    if (totalInfoCount > 0 && !quiet) {
+      if (verbose) {
+        log.section("Informational Hints");
+        log.print(import_chalk4.default.dim("  Stylistic hints with higher false-positive rate \u2014 review before acting."));
+        log.blank();
+        renderIssuesByFile({ ...result, files: informationalFiles }, true, false);
+      } else {
+        log.blank();
+        log.print(`  ${import_chalk4.default.gray("\u25B8")}  ${import_chalk4.default.gray(`${totalInfoCount} informational hint${totalInfoCount !== 1 ? "s" : ""} \u2014 run with ${import_chalk4.default.cyan("--verbose")} to expand`)}`);
       }
-      log.blank();
     }
-    log.section("Issues by File");
+  }
+  if (result.ecosystemIssues.length > 0) {
+    log.ecosystemSection("ESLint Config Issues");
+    log.print(import_chalk4.default.dim("  These issues come from your project's ESLint config, not from ai-guard."));
     log.blank();
-    for (const file of result.files) {
-      log.print(
-        `  ${import_chalk2.default.bold.white(file.filePath)} ` + import_chalk2.default.gray(
-          `(${file.errorCount} error${file.errorCount !== 1 ? "s" : ""}, ${file.warningCount} warning${file.warningCount !== 1 ? "s" : ""})`
-        )
-      );
-      for (const issue of file.issues) {
-        const sev = issue.severity === 2 ? import_chalk2.default.red("error") : import_chalk2.default.yellow(" warn");
-        const loc = import_chalk2.default.gray(`${String(issue.line)}:${String(issue.column)}`).padEnd(12);
-        const ruleShort = import_chalk2.default.gray(issue.ruleId.replace(/^ai-guard\//, ""));
-        log.print(
-          `    ${loc} ${sev}  ${import_chalk2.default.white(issue.message)}  ${ruleShort}`
-        );
+    const seen = /* @__PURE__ */ new Map();
+    for (const issue of result.ecosystemIssues) {
+      const key = `${issue.ruleId ?? "null"}::${issue.message}`;
+      const existing = seen.get(key);
+      if (existing) {
+        existing.count++;
+      } else {
+        seen.set(key, { issue, count: 1 });
       }
-      log.blank();
     }
-    log.divider();
-    log.blank();
-    log.section("Next Steps");
-    log.info(`Run ${import_chalk2.default.cyan("ai-guard baseline")} to save these issues and track only new ones`);
-    log.info(`Run ${import_chalk2.default.cyan("ai-guard report")}   to generate a shareable HTML report`);
-    log.info(`Run ${import_chalk2.default.cyan("ai-guard ignore")}   to suppress dist/build noise`);
+    for (const { issue, count } of seen.values()) {
+      log.ecosystemIssue(issue, count);
+    }
     log.blank();
-    process.exit(getRunExitCode(result, opts.maxWarnings));
-  });
-}
-function getRunExitCode(result, maxWarnings) {
-  if (result.totalErrors > 0) return 1;
-  if (maxWarnings !== void 0 && result.totalWarnings > maxWarnings) return 1;
-  return 0;
+  }
+  log.divider();
+  log.blank();
+  log.section("Next Steps");
+  if (result.totalIssues > 0) {
+    log.info(`Run ${import_chalk4.default.cyan("ai-guard baseline")} to save these issues and track only new ones`);
+    log.info(`Run ${import_chalk4.default.cyan("ai-guard report")}   to generate a shareable HTML report`);
+  }
+  if (result.ecosystemIssues.length > 0) {
+    log.info(`Run ${import_chalk4.default.cyan("ai-guard doctor")}   to diagnose ESLint config issues`);
+  }
+  log.blank();
+  process.exit(getFailOnExitCode(result, opts.failOn, opts.maxWarnings));
 }
-function formatIssueCount(errors, warnings) {
-  const parts = [];
-  if (errors > 0) parts.push(import_chalk2.default.red.bold(`${errors} error${errors !== 1 ? "s" : ""}`));
-  if (warnings > 0) parts.push(import_chalk2.default.yellow.bold(`${warnings} warning${warnings !== 1 ? "s" : ""}`));
-  return parts.join(import_chalk2.default.gray(" \xB7 "));
+function getFailOnExitCode(result, failOn, maxWarnings) {
+  return resolveExitCode(result, failOn, maxWarnings);
 }
 
 // cli/commands/init.ts
-var import_chalk3 = __toESM(require("chalk"));
-var import_path4 = __toESM(require("path"));
-var import_fs4 = __toESM(require("fs"));
+var import_chalk5 = __toESM(require("chalk"));
+var import_path6 = __toESM(require("path"));
+var import_fs7 = __toESM(require("fs"));
 
 // cli/utils/detector.ts
-var import_fs2 = __toESM(require("fs"));
-var import_path2 = __toESM(require("path"));
+var import_fs5 = __toESM(require("fs"));
+var import_path4 = __toESM(require("path"));
 var import_module = require("module");
 var FLAT_CONFIG_FILES = [
   { file: "eslint.config.js", type: "flat-js" },
@@ -917,11 +2195,11 @@ var LEGACY_CONFIG_FILES = [
 var ALL_CONFIG_FILES = [...FLAT_CONFIG_FILES, ...LEGACY_CONFIG_FILES];
 function isPackageInstalled(pkgName, cwd = process.cwd()) {
   try {
-    const pkgPath = import_path2.default.join(cwd, "node_modules", pkgName, "package.json");
-    if (import_fs2.default.existsSync(pkgPath)) {
+    const pkgPath = import_path4.default.join(cwd, "node_modules", pkgName, "package.json");
+    if (import_fs5.default.existsSync(pkgPath)) {
       return true;
     }
-    const req = (0, import_module.createRequire)(import_path2.default.join(cwd, "package.json"));
+    const req = (0, import_module.createRequire)(import_path4.default.join(cwd, "package.json"));
     req.resolve(`${pkgName}/package.json`);
     return true;
   } catch {
@@ -930,9 +2208,9 @@ function isPackageInstalled(pkgName, cwd = process.cwd()) {
 }
 function getPackageVersion(pkgName, cwd = process.cwd()) {
   try {
-    const pkgPath = import_path2.default.join(cwd, "node_modules", pkgName, "package.json");
-    const resolvedPath = import_fs2.default.existsSync(pkgPath) ? pkgPath : (0, import_module.createRequire)(import_path2.default.join(cwd, "package.json")).resolve(`${pkgName}/package.json`);
-    const raw = import_fs2.default.readFileSync(resolvedPath, "utf-8");
+    const pkgPath = import_path4.default.join(cwd, "node_modules", pkgName, "package.json");
+    const resolvedPath = import_fs5.default.existsSync(pkgPath) ? pkgPath : (0, import_module.createRequire)(import_path4.default.join(cwd, "package.json")).resolve(`${pkgName}/package.json`);
+    const raw = import_fs5.default.readFileSync(resolvedPath, "utf-8");
     const json = JSON.parse(raw);
     return json.version ?? null;
   } catch {
@@ -948,8 +2226,8 @@ function detectConfigType(cwd = process.cwd()) {
   const found = [];
   let first = null;
   for (const { file, type } of ALL_CONFIG_FILES) {
-    const fullPath = import_path2.default.join(cwd, file);
-    if (import_fs2.default.existsSync(fullPath)) {
+    const fullPath = import_path4.default.join(cwd, file);
+    if (import_fs5.default.existsSync(fullPath)) {
       found.push(fullPath);
       if (!first) first = { type, path: fullPath };
     }
@@ -972,7 +2250,7 @@ function requiresFlatConfig(eslintMajor) {
 function detectNukeIgnore(configPath) {
   if (!configPath) return false;
   try {
-    const content = import_fs2.default.readFileSync(configPath, "utf-8");
+    const content = import_fs5.default.readFileSync(configPath, "utf-8");
     return content.includes('"**/*"') || content.includes("'**/*'");
   } catch {
     return false;
@@ -1028,7 +2306,7 @@ async function verifyConfigLoads(configPath, cwd) {
       overrideConfigFile: configPath
     });
     await eslint.lintText("", {
-      filePath: import_path4.default.join(cwd, "_ai_guard_probe_.js")
+      filePath: import_path6.default.join(cwd, "_ai_guard_probe_.js")
     });
     return null;
   } catch (err) {
@@ -1046,7 +2324,7 @@ function registerInitCommand(program2) {
     const isDryRun = opts.dryRun === true;
     log.banner("AI GUARD INIT");
     if (isDryRun) {
-      log.print(`  ${import_chalk3.default.yellow("\u2691  DRY RUN \u2014 no files will be written")}`);
+      log.print(`  ${import_chalk5.default.yellow("\u2691  DRY RUN \u2014 no files will be written")}`);
       log.blank();
     }
     log.info("Detecting your project setup\u2026");
@@ -1064,7 +2342,7 @@ function registerInitCommand(program2) {
       log.warn("eslint-plugin-ai-guard not found");
     }
     if (env.configType !== "none") {
-      log.success(`ESLint config found: ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath ?? env.configType))}`);
+      log.success(`ESLint config found: ${import_chalk5.default.white(import_path6.default.relative(cwd, env.configPath ?? env.configType))}`);
     } else {
       log.info("No ESLint config found \u2014 will generate one");
     }
@@ -1073,9 +2351,9 @@ function registerInitCommand(program2) {
       log.blank();
       log.warn("Conflicting configs detected:");
       for (const p of env.allConfigPaths) {
-        log.print(`    ${import_chalk3.default.yellow("\u2192")} ${import_chalk3.default.white(import_path4.default.relative(cwd, p))}`);
+        log.print(`    ${import_chalk5.default.yellow("\u2192")} ${import_chalk5.default.white(import_path6.default.relative(cwd, p))}`);
       }
-      log.print(`  ${import_chalk3.default.gray("Multiple config formats found \u2014 this can cause unpredictable behavior.")}`);
+      log.print(`  ${import_chalk5.default.gray("Multiple config formats found \u2014 this can cause unpredictable behavior.")}`);
     }
     log.blank();
     const toInstall = [];
@@ -1086,14 +2364,14 @@ function registerInitCommand(program2) {
       log.warn("The following packages are not installed:");
       log.blank();
       for (const pkg of toInstall) {
-        log.print(`    ${import_chalk3.default.yellow("\u2192")} ${import_chalk3.default.white(pkg)}`);
+        log.print(`    ${import_chalk5.default.yellow("\u2192")} ${import_chalk5.default.white(pkg)}`);
       }
       log.blank();
-      log.print(`  ${import_chalk3.default.bold("Run this first:")}`);
+      log.print(`  ${import_chalk5.default.bold("Run this first:")}`);
       log.blank();
-      log.print(`    ${import_chalk3.default.cyan(`npm install --save-dev ${toInstall.join(" ")}`)}`);
+      log.print(`    ${import_chalk5.default.cyan(`npm install --save-dev ${toInstall.join(" ")}`)}`);
       log.blank();
-      log.print(`  Then re-run ${import_chalk3.default.cyan("ai-guard init")} to complete setup.`);
+      log.print(`  Then re-run ${import_chalk5.default.cyan("ai-guard init")} to complete setup.`);
       log.blank();
       process.exit(1);
       return;
@@ -1101,7 +2379,7 @@ function registerInitCommand(program2) {
     try {
       const { createRequire: createRequire2 } = await import("module");
       const { pathToFileURL: pathToFileURL2 } = await import("url");
-      const req = createRequire2(import_path4.default.join(cwd, "_probe.js"));
+      const req = createRequire2(import_path6.default.join(cwd, "_probe.js"));
       const resolvedPath = req.resolve("eslint-plugin-ai-guard");
       const aiGuard = await import(pathToFileURL2(resolvedPath).href);
       const plugin = aiGuard.default || aiGuard;
@@ -1120,9 +2398,9 @@ function registerInitCommand(program2) {
     if (eslintNeedsFlat && existingIsLegacy) {
       log.section("Config Migration Required");
       log.warn(`ESLint v${env.eslintMajor} requires flat config, but a legacy config was found:`);
-      log.print(`    ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath))}`);
+      log.print(`    ${import_chalk5.default.white(import_path6.default.relative(cwd, env.configPath))}`);
       log.blank();
-      log.print(`  ${import_chalk3.default.bold("ai-guard will create a new flat config.")}`);
+      log.print(`  ${import_chalk5.default.bold("ai-guard will create a new flat config.")}`);
       log.blank();
     }
     log.section(`Configuring ESLint${isDryRun ? " (dry run)" : ""}`);
@@ -1132,34 +2410,34 @@ function registerInitCommand(program2) {
       const raw = readConfig(env.configPath);
       const { content: fixed, changed } = removeNukeIgnore(raw);
       if (changed) {
-        log.warn(`Removed "**/*" ignore pattern from ${import_path4.default.relative(cwd, env.configPath)}`);
+        log.warn(`Removed "**/*" ignore pattern from ${import_path6.default.relative(cwd, env.configPath)}`);
         if (!isDryRun) {
           backupConfig(env.configPath);
           writeConfig(env.configPath, fixed);
           log.success("Ignore pattern fixed");
         } else {
-          log.print(`  ${import_chalk3.default.gray("[dry-run] would remove nuke-ignore from existing config")}`);
+          log.print(`  ${import_chalk5.default.gray("[dry-run] would remove nuke-ignore from existing config")}`);
         }
       }
     }
     if (env.configType === "none" || eslintNeedsFlat && existingIsLegacy) {
       const targetName = useFlat ? "eslint.config.mjs" : ".eslintrc.js";
-      finalConfigPath = import_path4.default.join(cwd, targetName);
+      finalConfigPath = import_path6.default.join(cwd, targetName);
       const content2 = useFlat ? generateFlatConfig(preset) : generateLegacyConfig(preset);
       if (isDryRun) {
-        log.print(`  ${import_chalk3.default.gray(`[dry-run] would create: ${targetName}`)}`);
+        log.print(`  ${import_chalk5.default.gray(`[dry-run] would create: ${targetName}`)}`);
         log.blank();
-        log.print(import_chalk3.default.gray("\u2500\u2500\u2500 Preview \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+        log.print(import_chalk5.default.gray("\u2500\u2500\u2500 Preview \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
         log.blank();
         for (const line of content2.split("\n")) {
-          log.print(import_chalk3.default.gray(`  ${line}`));
+          log.print(import_chalk5.default.gray(`  ${line}`));
         }
         log.blank();
       } else {
         writeConfig(finalConfigPath, content2);
-        log.success(`Created ${import_chalk3.default.white(targetName)}`);
-        log.info(`  Preset: ${import_chalk3.default.cyan(preset)}`);
-        log.info(`  Format: ${import_chalk3.default.cyan(useFlat ? "ESLint v9 flat config (eslint.config.mjs)" : "ESLint v8 legacy config (.eslintrc.js)")}`);
+        log.success(`Created ${import_chalk5.default.white(targetName)}`);
+        log.info(`  Preset: ${import_chalk5.default.cyan(preset)}`);
+        log.info(`  Format: ${import_chalk5.default.cyan(useFlat ? "ESLint v9 flat config (eslint.config.mjs)" : "ESLint v8 legacy config (.eslintrc.js)")}`);
         configWritten = true;
       }
     } else if (useFlat && existingIsFlat) {
@@ -1172,15 +2450,15 @@ function registerInitCommand(program2) {
         finalConfigPath = env.configPath;
       } else if (isDryRun) {
         finalConfigPath = env.configPath;
-        log.print(`  ${import_chalk3.default.gray(`[dry-run] would patch: ${import_path4.default.relative(cwd, env.configPath)}`)}`);
+        log.print(`  ${import_chalk5.default.gray(`[dry-run] would patch: ${import_path6.default.relative(cwd, env.configPath)}`)}`);
       } else {
         const bak = backupConfig(env.configPath);
-        log.info(`Backed up \u2192 ${import_chalk3.default.gray(import_path4.default.relative(cwd, bak))}`);
+        log.info(`Backed up \u2192 ${import_chalk5.default.gray(import_path6.default.relative(cwd, bak))}`);
         writeConfig(env.configPath, patched);
         if (isInvalid) {
-          log.success(`Detected invalid ai-guard config \u2014 repairing ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath))}`);
+          log.success(`Detected invalid ai-guard config \u2014 repairing ${import_chalk5.default.white(import_path6.default.relative(cwd, env.configPath))}`);
         } else {
-          log.success(`Patched ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath))}`);
+          log.success(`Patched ${import_chalk5.default.white(import_path6.default.relative(cwd, env.configPath))}`);
         }
         finalConfigPath = env.configPath;
         configWritten = true;
@@ -1193,12 +2471,12 @@ function registerInitCommand(program2) {
         finalConfigPath = env.configPath;
       } else if (isDryRun) {
         finalConfigPath = env.configPath;
-        log.print(`  ${import_chalk3.default.gray(`[dry-run] would patch: ${import_path4.default.relative(cwd, env.configPath)}`)}`);
+        log.print(`  ${import_chalk5.default.gray(`[dry-run] would patch: ${import_path6.default.relative(cwd, env.configPath)}`)}`);
       } else {
         const bak = backupConfig(env.configPath);
-        log.info(`Backed up \u2192 ${import_chalk3.default.gray(import_path4.default.relative(cwd, bak))}`);
+        log.info(`Backed up \u2192 ${import_chalk5.default.gray(import_path6.default.relative(cwd, bak))}`);
         writeConfig(env.configPath, patched);
-        log.success(`Patched ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath))}`);
+        log.success(`Patched ${import_chalk5.default.white(import_path6.default.relative(cwd, env.configPath))}`);
         finalConfigPath = env.configPath;
         configWritten = true;
       }
@@ -1207,18 +2485,18 @@ function registerInitCommand(program2) {
       const legacyConfigs = env.allConfigPaths.filter((p) => !p.includes("eslint.config."));
       let cleanedUp = false;
       for (const p of legacyConfigs) {
-        if (import_fs4.default.existsSync(p)) {
+        if (import_fs7.default.existsSync(p)) {
           if (!isDryRun) {
             try {
-              import_fs4.default.renameSync(p, `${p}.bak`);
+              import_fs7.default.renameSync(p, `${p}.bak`);
               cleanedUp = true;
             } catch (err) {
               const reason = err instanceof Error ? err.message : String(err);
-              log.warn(`Could not back up ${import_path4.default.relative(cwd, p)}: ${reason}`);
+              log.warn(`Could not back up ${import_path6.default.relative(cwd, p)}: ${reason}`);
             }
           } else {
             cleanedUp = true;
-            log.print(`  ${import_chalk3.default.gray(`[dry-run] would rename ${import_path4.default.relative(cwd, p)} to ${import_path4.default.basename(p)}.bak`)}`);
+            log.print(`  ${import_chalk5.default.gray(`[dry-run] would rename ${import_path6.default.relative(cwd, p)} to ${import_path6.default.basename(p)}.bak`)}`);
           }
         }
       }
@@ -1228,19 +2506,19 @@ function registerInitCommand(program2) {
     }
     if (isDryRun) {
       log.blank();
-      log.print(`  ${import_chalk3.default.yellow("Dry run complete \u2014 no files written.")}`);
-      log.print(`  Re-run without ${import_chalk3.default.cyan("--dry-run")} to apply.`);
+      log.print(`  ${import_chalk5.default.yellow("Dry run complete \u2014 no files written.")}`);
+      log.print(`  Re-run without ${import_chalk5.default.cyan("--dry-run")} to apply.`);
       log.blank();
       process.exit(0);
       return;
     }
     log.blank();
     log.section("Validation");
-    if (!import_fs4.default.existsSync(finalConfigPath)) {
-      log.error(`Config file not found after write: ${import_path4.default.relative(cwd, finalConfigPath)}`);
+    if (!import_fs7.default.existsSync(finalConfigPath)) {
+      log.error(`Config file not found after write: ${import_path6.default.relative(cwd, finalConfigPath)}`);
       log.blank();
-      log.print(`  ${import_chalk3.default.bold("Problem:")} File write may have failed.`);
-      log.print(`  ${import_chalk3.default.bold("Fix:")} Check disk space and file permissions, then re-run.`);
+      log.print(`  ${import_chalk5.default.bold("Problem:")} File write may have failed.`);
+      log.print(`  ${import_chalk5.default.bold("Fix:")} Check disk space and file permissions, then re-run.`);
       log.blank();
       process.exit(1);
       return;
@@ -1250,36 +2528,36 @@ function registerInitCommand(program2) {
     if (validationErrors.length > 0) {
       log.warn("Config validation found issues:");
       for (const e of validationErrors) {
-        log.print(`    ${import_chalk3.default.red("\u2716")} ${e}`);
+        log.print(`    ${import_chalk5.default.red("\u2716")} ${e}`);
       }
     } else {
-      log.success(`Config structure valid: ${import_chalk3.default.white(import_path4.default.relative(cwd, finalConfigPath))}`);
+      log.success(`Config structure valid: ${import_chalk5.default.white(import_path6.default.relative(cwd, finalConfigPath))}`);
     }
     log.info("Verifying ESLint can load the config\u2026");
     const loadError = await verifyConfigLoads(finalConfigPath, cwd);
     if (loadError !== null) {
       log.blank();
       if (loadError.kind === "module-not-found") {
-        log.warn(`Could not verify: module not found: ${import_chalk3.default.yellow(loadError.pkg)}`);
+        log.warn(`Could not verify: module not found: ${import_chalk5.default.yellow(loadError.pkg)}`);
         log.blank();
-        log.print(`  ${import_chalk3.default.bold("Install the missing package:")}`);
-        log.print(`    ${import_chalk3.default.cyan(`npm install --save-dev ${loadError.pkg}`)}`);
-        log.print(`  Then run ${import_chalk3.default.cyan("ai-guard doctor")} to confirm.`);
+        log.print(`  ${import_chalk5.default.bold("Install the missing package:")}`);
+        log.print(`    ${import_chalk5.default.cyan(`npm install --save-dev ${loadError.pkg}`)}`);
+        log.print(`  Then run ${import_chalk5.default.cyan("ai-guard doctor")} to confirm.`);
         log.blank();
       } else {
         log.error("ESLint failed to load the generated config.");
         log.blank();
-        log.print(`  ${import_chalk3.default.bold("Problem:")}`);
-        log.print(`    ${import_chalk3.default.red(loadError.message)}`);
+        log.print(`  ${import_chalk5.default.bold("Problem:")}`);
+        log.print(`    ${import_chalk5.default.red(loadError.message)}`);
         if (loadError.kind === "unknown") {
           log.blank();
-          log.print(`    ${import_chalk3.default.yellow("Generated config may be using incorrect plugin structure.")}`);
+          log.print(`    ${import_chalk5.default.yellow("Generated config may be using incorrect plugin structure.")}`);
         }
         log.blank();
-        log.print(`  ${import_chalk3.default.bold("Fix:")}`);
-        log.print(`    1. Check the syntax in ${import_chalk3.default.cyan(import_path4.default.relative(cwd, finalConfigPath))}`);
-        log.print(`    2. Make sure ${import_chalk3.default.cyan("eslint-plugin-ai-guard")} is installed`);
-        log.print(`    3. Run ${import_chalk3.default.cyan("ai-guard doctor")} for full diagnostics`);
+        log.print(`  ${import_chalk5.default.bold("Fix:")}`);
+        log.print(`    1. Check the syntax in ${import_chalk5.default.cyan(import_path6.default.relative(cwd, finalConfigPath))}`);
+        log.print(`    2. Make sure ${import_chalk5.default.cyan("eslint-plugin-ai-guard")} is installed`);
+        log.print(`    3. Run ${import_chalk5.default.cyan("ai-guard doctor")} for full diagnostics`);
         log.blank();
         process.exit(1);
         return;
@@ -1293,33 +2571,34 @@ function registerInitCommand(program2) {
     let cleanedUpInfo = false;
     if (eslintNeedsFlat) {
       const legacyConfigs = env.allConfigPaths.filter((p) => !p.includes("eslint.config."));
-      cleanedUpInfo = legacyConfigs.some((p) => import_fs4.default.existsSync(`${p}.bak`) && !import_fs4.default.existsSync(p));
+      cleanedUpInfo = legacyConfigs.some((p) => import_fs7.default.existsSync(`${p}.bak`) && !import_fs7.default.existsSync(p));
     }
     const lingeringConflicts = env.hasConflictingConfigs && !eslintNeedsFlat && !cleanedUpInfo;
     if (loadError === null && !lingeringConflicts) {
-      log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold.green("Configuration validated successfully")}`);
+      log.print(`  ${import_chalk5.default.green("\u2714")}  ${import_chalk5.default.bold.green("Configuration validated successfully")}`);
     }
-    log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold("ESLint config:")} ${import_chalk3.default.cyan(import_path4.default.relative(cwd, finalConfigPath))}`);
-    log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold("Mode:")} ${import_chalk3.default.cyan(useFlat ? `Flat config (ESLint v${env.eslintMajor ?? 9})` : `Legacy config (ESLint v${env.eslintMajor ?? 8})`)}`);
-    log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold("Preset:")} ${import_chalk3.default.cyan(preset)}`);
+    log.print(`  ${import_chalk5.default.green("\u2714")}  ${import_chalk5.default.bold("ESLint config:")} ${import_chalk5.default.cyan(import_path6.default.relative(cwd, finalConfigPath))}`);
+    log.print(`  ${import_chalk5.default.green("\u2714")}  ${import_chalk5.default.bold("Mode:")} ${import_chalk5.default.cyan(useFlat ? `Flat config (ESLint v${env.eslintMajor ?? 9})` : `Legacy config (ESLint v${env.eslintMajor ?? 8})`)}`);
+    log.print(`  ${import_chalk5.default.green("\u2714")}  ${import_chalk5.default.bold("Preset:")} ${import_chalk5.default.cyan(preset)}`);
     log.blank();
-    log.info(`Run ${import_chalk3.default.cyan("npx eslint .")}         \u2192 lint with your editor integration`);
-    log.info(`Run ${import_chalk3.default.cyan("ai-guard run")}          \u2192 zero-config scan`);
-    log.info(`Run ${import_chalk3.default.cyan("ai-guard doctor")}       \u2192 verify the full setup`);
-    log.info(`Run ${import_chalk3.default.cyan("ai-guard baseline")}     \u2192 save baseline, track only new issues`);
+    log.info(`Run ${import_chalk5.default.cyan("npx eslint .")}         \u2192 lint with your editor integration`);
+    log.info(`Run ${import_chalk5.default.cyan("ai-guard run")}          \u2192 zero-config scan`);
+    log.info(`Run ${import_chalk5.default.cyan("ai-guard doctor")}       \u2192 verify the full setup`);
+    log.info(`Run ${import_chalk5.default.cyan("ai-guard baseline")}     \u2192 save baseline, track only new issues`);
     log.blank();
   });
 }
 
 // cli/commands/doctor.ts
-var import_chalk4 = __toESM(require("chalk"));
-var import_path5 = __toESM(require("path"));
+var import_chalk6 = __toESM(require("chalk"));
+var import_path7 = __toESM(require("path"));
 init_config_manager();
+var import_meta = {};
 async function probeConfigLoad(configPath, cwd) {
   try {
     const { ESLint } = await import("eslint");
     const eslint = new ESLint({ cwd, overrideConfigFile: configPath });
-    await eslint.lintText("", { filePath: import_path5.default.join(cwd, "_probe_.js") });
+    await eslint.lintText("", { filePath: import_path7.default.join(cwd, "_probe_.js") });
     return { ok: true, error: null };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -1354,7 +2633,7 @@ function registerDoctorCommand(program2) {
     checks.push({
       label: "ESLint config present",
       pass: hasConfig,
-      detail: hasConfig ? `${import_path5.default.relative(cwd, env.configPath ?? "")} (${env.configType})` : "No eslint.config.* or .eslintrc.* found",
+      detail: hasConfig ? `${import_path7.default.relative(cwd, env.configPath ?? "")} (${env.configType})` : "No eslint.config.* or .eslintrc.* found",
       fix: hasConfig ? void 0 : "ai-guard init",
       note: hasConfig ? void 0 : "This will generate the correct config format for your ESLint version"
     });
@@ -1386,7 +2665,7 @@ function registerDoctorCommand(program2) {
       checks.push({
         label: "Plugin wired in config",
         pass: pluginWired && !isInvalidConfig,
-        detail: readError ? `Could not read config: ${readError}` : isInvalidConfig ? "Invalid ai-guard config detected (wrong export usage)" : pluginWired ? "eslint-plugin-ai-guard referenced in config" : `Config exists but ai-guard plugin not found in ${import_path5.default.relative(cwd, env.configPath)}`,
+        detail: readError ? `Could not read config: ${readError}` : isInvalidConfig ? "Invalid ai-guard config detected (wrong export usage)" : pluginWired ? "eslint-plugin-ai-guard referenced in config" : `Config exists but ai-guard plugin not found in ${import_path7.default.relative(cwd, env.configPath)}`,
         fix: isInvalidConfig || !pluginWired && !readError ? "ai-guard init  (will patch/repair your existing config)" : void 0
       });
     }
@@ -1394,7 +2673,7 @@ function registerDoctorCommand(program2) {
       label: "No conflicting config files",
       pass: !env.hasConflictingConfigs,
       detail: env.hasConflictingConfigs ? `Conflicting config detected:
-${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}`).join("\n")}` : "Only one config format detected",
+${env.allConfigPaths.map((p) => `       ${import_path7.default.relative(cwd, p)}`).join("\n")}` : "Only one config format detected",
       fix: env.hasConflictingConfigs ? "Remove or backup legacy config" : void 0,
       note: env.hasConflictingConfigs ? "ESLint v9 silently ignores .eslintrc.* when a flat config exists. This can cause confusion." : void 0
     });
@@ -1421,24 +2700,91 @@ ${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}
         label: "ESLint config loads without errors",
         pass: probe.ok,
         detail: probe.ok ? "ESLint loaded config successfully" : probe.error ?? "Unknown error",
-        fix: probe.ok ? void 0 : `Check syntax in ${import_path5.default.relative(cwd, env.configPath)}`,
+        fix: probe.ok ? void 0 : `Check syntax in ${import_path7.default.relative(cwd, env.configPath)}`,
         note: probe.ok ? void 0 : "Run: ai-guard init --dry-run  to preview a fresh config"
       });
     }
+    {
+      let utilsOk = false;
+      let utilsVersion = null;
+      try {
+        const { createRequire: createRequire2 } = await import("module");
+        const req = createRequire2(import_path7.default.join(cwd, "package.json"));
+        const pkgPath = req.resolve("@typescript-eslint/utils/package.json");
+        const pkg = JSON.parse(
+          (await import("fs")).readFileSync(pkgPath, "utf-8")
+        );
+        utilsVersion = pkg.version ?? null;
+        utilsOk = true;
+      } catch {
+      }
+      if (!utilsOk) {
+        try {
+          const selfDir = import_path7.default.dirname(
+            new URL(import_meta.url).pathname.replace(/^\/([A-Za-z]:)/, "$1")
+          );
+          const pkgPath = import_path7.default.join(selfDir, "../../node_modules/@typescript-eslint/utils/package.json");
+          if ((await import("fs")).existsSync(pkgPath)) {
+            utilsOk = true;
+          }
+        } catch {
+        }
+      }
+      checks.push({
+        label: "@typescript-eslint/utils available at runtime",
+        pass: utilsOk,
+        detail: utilsOk ? `Found${utilsVersion ? ` v${utilsVersion}` : ""}` : "Not found \u2014 rule engine may crash on fresh installs",
+        fix: utilsOk ? void 0 : "npm install @typescript-eslint/utils",
+        note: utilsOk ? void 0 : "This is a runtime dependency of eslint-plugin-ai-guard rules."
+      });
+    }
+    {
+      let parserOk = false;
+      let parserVersion = null;
+      try {
+        const { createRequire: createRequire2 } = await import("module");
+        const req = createRequire2(import_path7.default.join(cwd, "package.json"));
+        const pkgPath = req.resolve("@typescript-eslint/parser/package.json");
+        const pkg = JSON.parse(
+          (await import("fs")).readFileSync(pkgPath, "utf-8")
+        );
+        parserVersion = pkg.version ?? null;
+        parserOk = true;
+      } catch {
+      }
+      const hasTsFiles = (() => {
+        try {
+          const { readdirSync } = require("fs");
+          const files = readdirSync(cwd);
+          return files.some((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
+        } catch {
+          return false;
+        }
+      })();
+      if (!parserOk && hasTsFiles) {
+        checks.push({
+          label: "@typescript-eslint/parser installed (TypeScript project)",
+          pass: false,
+          detail: ".ts/.tsx files detected but TypeScript parser not found",
+          fix: "npm install --save-dev @typescript-eslint/parser",
+          note: "TypeScript files will use espree fallback without this \u2014 some rules may not work correctly."
+        });
+      }
+    }
     log.section("Diagnostics");
     let allPassed = true;
     for (const check of checks) {
-      const icon = check.pass ? import_chalk4.default.green("\u2714") : import_chalk4.default.red("\u2716");
-      const label = check.pass ? import_chalk4.default.white(check.label) : import_chalk4.default.red.bold(check.label);
+      const icon = check.pass ? import_chalk6.default.green("\u2714") : import_chalk6.default.red("\u2716");
+      const label = check.pass ? import_chalk6.default.white(check.label) : import_chalk6.default.red.bold(check.label);
       log.print(`  ${icon}  ${label}`);
-      log.print(`       ${import_chalk4.default.gray(check.detail)}`);
+      log.print(`       ${import_chalk6.default.gray(check.detail)}`);
       if (!check.pass) {
         allPassed = false;
         if (check.fix) {
-          log.print(`       ${import_chalk4.default.cyan("\u2192 Fix:")} ${import_chalk4.default.yellow(check.fix)}`);
+          log.print(`       ${import_chalk6.default.cyan("\u2192 Fix:")} ${import_chalk6.default.yellow(check.fix)}`);
         }
         if (check.note) {
-          log.print(`       ${import_chalk4.default.gray(check.note)}`);
+          log.print(`       ${import_chalk6.default.gray(check.note)}`);
         }
       }
       log.blank();
@@ -1446,10 +2792,10 @@ ${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}
     log.divider();
     log.blank();
     if (allPassed) {
-      log.print(`  ${import_chalk4.default.green("\u2714")}  ${import_chalk4.default.bold.green("All checks passed! Your setup is correct.")}`);
+      log.print(`  ${import_chalk6.default.green("\u2714")}  ${import_chalk6.default.bold.green("All checks passed! Your setup is correct.")}`);
       log.blank();
-      log.info(`Run ${import_chalk4.default.cyan("ai-guard run")} to start scanning.`);
-      log.info(`Run ${import_chalk4.default.cyan("npx eslint .")} to lint with ESLint directly.`);
+      log.info(`Run ${import_chalk6.default.cyan("ai-guard run")} to start scanning.`);
+      log.info(`Run ${import_chalk6.default.cyan("npx eslint .")} to lint with ESLint directly.`);
     } else {
       log.error("Some checks failed. Follow the fixes above.");
       log.blank();
@@ -1464,15 +2810,15 @@ ${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}
       );
       if (pluginMissing) {
         log.print(
-          `  Install missing packages first, then re-run ${import_chalk4.default.cyan("ai-guard doctor")}.`
+          `  Install missing packages first, then re-run ${import_chalk6.default.cyan("ai-guard doctor")}.`
         );
       } else if (configMissing || configFormatMismatch) {
         log.print(
-          `  Run ${import_chalk4.default.cyan("ai-guard init")} to generate the correct config for your ESLint version.`
+          `  Run ${import_chalk6.default.cyan("ai-guard init")} to generate the correct config for your ESLint version.`
         );
       } else {
         log.print(
-          `  Run ${import_chalk4.default.cyan("ai-guard init --dry-run")} to preview what would change.`
+          `  Run ${import_chalk6.default.cyan("ai-guard init --dry-run")} to preview what would change.`
         );
       }
     }
@@ -1483,9 +2829,9 @@ ${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}
 
 // cli/commands/preset.ts
 var import_prompts = require("@inquirer/prompts");
-var import_chalk5 = __toESM(require("chalk"));
+var import_chalk7 = __toESM(require("chalk"));
 init_config_manager();
-var import_path6 = __toESM(require("path"));
+var import_path8 = __toESM(require("path"));
 function registerPresetCommand(program2) {
   program2.command("preset").description("Interactively select and apply an ai-guard preset to your ESLint config").action(async () => {
     const cwd = process.cwd();
@@ -1495,32 +2841,32 @@ function registerPresetCommand(program2) {
       message: "Choose a preset:",
       choices: [
         {
-          name: `${import_chalk5.default.green("recommended")} \u2014 balanced defaults, low noise. Best starting point.`,
+          name: `${import_chalk7.default.green("recommended")} \u2014 balanced defaults, low noise. Best starting point.`,
           value: "recommended"
         },
         {
-          name: `${import_chalk5.default.yellow("strict")}      \u2014 all rules at error. For mature codebases.`,
+          name: `${import_chalk7.default.yellow("strict")}      \u2014 all rules at error. For mature codebases.`,
           value: "strict"
         },
         {
-          name: `${import_chalk5.default.red("security")}   \u2014 security rules only. For AppSec teams.`,
+          name: `${import_chalk7.default.red("security")}   \u2014 security rules only. For AppSec teams.`,
           value: "security"
         }
       ]
     });
     log.blank();
-    log.info(`Applying preset: ${import_chalk5.default.cyan(preset)}`);
+    log.info(`Applying preset: ${import_chalk7.default.cyan(preset)}`);
     const env = detect(cwd);
     const useFlat = env.eslintMajor !== null && env.eslintMajor >= 9 || isFlat(env.configType);
     if (env.configType === "none") {
-      const configPath = useFlat ? import_path6.default.join(cwd, "eslint.config.mjs") : import_path6.default.join(cwd, ".eslintrc.js");
+      const configPath = useFlat ? import_path8.default.join(cwd, "eslint.config.mjs") : import_path8.default.join(cwd, ".eslintrc.js");
       const content = useFlat ? generateFlatConfig(preset) : generateLegacyConfig(preset);
       writeConfig(configPath, content);
-      log.success(`Created ${import_chalk5.default.white(import_path6.default.relative(cwd, configPath))} with ${import_chalk5.default.cyan(preset)} preset`);
+      log.success(`Created ${import_chalk7.default.white(import_path8.default.relative(cwd, configPath))} with ${import_chalk7.default.cyan(preset)} preset`);
     } else {
       const configPath = env.configPath;
       const backupPath = backupConfig(configPath);
-      log.info(`Backed up \u2192 ${import_chalk5.default.gray(import_path6.default.relative(cwd, backupPath))}`);
+      log.info(`Backed up \u2192 ${import_chalk7.default.gray(import_path8.default.relative(cwd, backupPath))}`);
       const existing = readConfig(configPath);
       const withPlugin = isFlat(env.configType) ? patchFlatConfig(existing, preset) : patchLegacyConfig(existing, preset);
       const patched = isFlat(env.configType) ? switchFlatPreset(withPlugin, preset) : switchLegacyPreset(withPlugin, preset);
@@ -1528,47 +2874,47 @@ function registerPresetCommand(program2) {
         log.warn("No preset changes needed. Config already matches selected preset.");
       } else {
         writeConfig(configPath, patched);
-        log.success(`Updated ${import_chalk5.default.white(import_path6.default.relative(cwd, configPath))} to ${import_chalk5.default.cyan(preset)} preset`);
+        log.success(`Updated ${import_chalk7.default.white(import_path8.default.relative(cwd, configPath))} to ${import_chalk7.default.cyan(preset)} preset`);
       }
     }
     log.blank();
     log.section("Preset Details");
     const presetDetails = {
       recommended: [
-        { rule: "no-empty-catch", level: import_chalk5.default.red("error") },
-        { rule: "no-floating-promise", level: import_chalk5.default.red("error") },
-        { rule: "no-hardcoded-secret", level: import_chalk5.default.red("error") },
-        { rule: "no-eval-dynamic", level: import_chalk5.default.red("error") },
-        { rule: "no-broad-exception", level: import_chalk5.default.yellow("warn") },
-        { rule: "no-async-array-callback", level: import_chalk5.default.yellow("warn") },
-        { rule: "no-await-in-loop", level: import_chalk5.default.yellow("warn") },
-        { rule: "+ 5 more\u2026", level: import_chalk5.default.gray("warn") }
+        { rule: "no-empty-catch", level: import_chalk7.default.red("error") },
+        { rule: "no-floating-promise", level: import_chalk7.default.red("error") },
+        { rule: "no-hardcoded-secret", level: import_chalk7.default.red("error") },
+        { rule: "no-eval-dynamic", level: import_chalk7.default.red("error") },
+        { rule: "no-broad-exception", level: import_chalk7.default.yellow("warn") },
+        { rule: "no-async-array-callback", level: import_chalk7.default.yellow("warn") },
+        { rule: "no-await-in-loop", level: import_chalk7.default.yellow("warn") },
+        { rule: "+ 5 more\u2026", level: import_chalk7.default.gray("warn") }
       ],
       strict: [
-        { rule: "All 17 rules", level: import_chalk5.default.red("error") }
+        { rule: "All 17 rules", level: import_chalk7.default.red("error") }
       ],
       security: [
-        { rule: "no-hardcoded-secret", level: import_chalk5.default.red("error") },
-        { rule: "no-eval-dynamic", level: import_chalk5.default.red("error") },
-        { rule: "no-sql-string-concat", level: import_chalk5.default.red("error") },
-        { rule: "no-unsafe-deserialize", level: import_chalk5.default.yellow("warn") },
-        { rule: "require-auth-middleware", level: import_chalk5.default.yellow("warn") },
-        { rule: "require-authz-check", level: import_chalk5.default.yellow("warn") }
+        { rule: "no-hardcoded-secret", level: import_chalk7.default.red("error") },
+        { rule: "no-eval-dynamic", level: import_chalk7.default.red("error") },
+        { rule: "no-sql-string-concat", level: import_chalk7.default.red("error") },
+        { rule: "no-unsafe-deserialize", level: import_chalk7.default.yellow("warn") },
+        { rule: "require-auth-middleware", level: import_chalk7.default.yellow("warn") },
+        { rule: "require-authz-check", level: import_chalk7.default.yellow("warn") }
       ]
     };
     for (const { rule, level } of presetDetails[preset]) {
-      log.print(`    ${import_chalk5.default.gray("\u2022")} ${import_chalk5.default.white(rule).padEnd(32)}${level}`);
+      log.print(`    ${import_chalk7.default.gray("\u2022")} ${import_chalk7.default.white(rule).padEnd(32)}${level}`);
     }
     log.blank();
-    log.info(`Run ${import_chalk5.default.cyan("ai-guard run")} to see results with the new preset.`);
+    log.info(`Run ${import_chalk7.default.cyan("ai-guard run")} to see results with the new preset.`);
     log.blank();
   });
 }
 
 // cli/commands/ignore.ts
-var import_chalk6 = __toESM(require("chalk"));
+var import_chalk8 = __toESM(require("chalk"));
 init_config_manager();
-var import_path7 = __toESM(require("path"));
+var import_path9 = __toESM(require("path"));
 var DEFAULT_IGNORES = [
   ".next/",
   "dist/",
@@ -1584,41 +2930,41 @@ function registerIgnoreCommand(program2) {
     log.blank();
     log.section("Default Ignores");
     for (const p of DEFAULT_IGNORES) {
-      log.print(`    ${import_chalk6.default.gray("\u2022")} ${import_chalk6.default.yellow(p)}`);
+      log.print(`    ${import_chalk8.default.gray("\u2022")} ${import_chalk8.default.yellow(p)}`);
     }
     log.blank();
     const env = detect(cwd);
     if (env.configType === "none") {
       const useFlat = env.eslintMajor !== null && env.eslintMajor >= 9;
-      const configPath = useFlat ? import_path7.default.join(cwd, "eslint.config.mjs") : import_path7.default.join(cwd, ".eslintrc.js");
+      const configPath = useFlat ? import_path9.default.join(cwd, "eslint.config.mjs") : import_path9.default.join(cwd, ".eslintrc.js");
       const content = useFlat ? generateFlatConfig("recommended") : generateLegacyConfig("recommended");
       writeConfig(configPath, content);
-      log.success(`No config found \u2014 generated ${import_chalk6.default.white(import_path7.default.relative(cwd, configPath))} with ignores included`);
+      log.success(`No config found \u2014 generated ${import_chalk8.default.white(import_path9.default.relative(cwd, configPath))} with ignores included`);
     } else {
       const configPath = env.configPath;
       const backupPath = backupConfig(configPath);
-      log.info(`Backed up \u2192 ${import_chalk6.default.gray(import_path7.default.relative(cwd, backupPath))}`);
+      log.info(`Backed up \u2192 ${import_chalk8.default.gray(import_path9.default.relative(cwd, backupPath))}`);
       const existing = readConfig(configPath);
       const patched = isFlat(env.configType) ? addIgnoresToFlatConfig(existing) : addIgnoresToLegacyConfig(existing);
       if (patched === existing) {
         log.warn("Ignore patterns already present in config \u2014 no changes made.");
       } else {
         writeConfig(configPath, patched);
-        log.success(`Patched ${import_chalk6.default.white(import_path7.default.relative(cwd, configPath))} with ignore patterns`);
+        log.success(`Patched ${import_chalk8.default.white(import_path9.default.relative(cwd, configPath))} with ignore patterns`);
       }
     }
     log.blank();
     log.info("Noisy directories will now be skipped in all future ESLint runs.");
-    log.info(`Run ${import_chalk6.default.cyan("ai-guard run")} to verify cleaner results.`);
+    log.info(`Run ${import_chalk8.default.cyan("ai-guard run")} to verify cleaner results.`);
     log.blank();
   });
 }
 
 // cli/commands/baseline.ts
-var import_fs5 = __toESM(require("fs"));
-var import_path8 = __toESM(require("path"));
-var import_chalk7 = __toESM(require("chalk"));
-var import_ora2 = __toESM(require("ora"));
+var import_fs8 = __toESM(require("fs"));
+var import_path10 = __toESM(require("path"));
+var import_chalk9 = __toESM(require("chalk"));
+var import_ora3 = __toESM(require("ora"));
 var BASELINE_FILE = ".ai-guard-baseline.json";
 function saveBaseline(result, preset, mode, cwd) {
   const entries = result.files.map((f) => ({
@@ -1637,15 +2983,15 @@ function saveBaseline(result, preset, mode, cwd) {
     totalIssues: result.totalIssues,
     entries
   };
-  const baselinePath = import_path8.default.join(cwd, BASELINE_FILE);
-  import_fs5.default.writeFileSync(baselinePath, JSON.stringify(baseline, null, 2), "utf-8");
+  const baselinePath = import_path10.default.join(cwd, BASELINE_FILE);
+  import_fs8.default.writeFileSync(baselinePath, JSON.stringify(baseline, null, 2), "utf-8");
   return baselinePath;
 }
 function loadBaseline(cwd) {
-  const baselinePath = import_path8.default.join(cwd, BASELINE_FILE);
-  if (!import_fs5.default.existsSync(baselinePath)) return null;
+  const baselinePath = import_path10.default.join(cwd, BASELINE_FILE);
+  if (!import_fs8.default.existsSync(baselinePath)) return null;
   try {
-    const raw = import_fs5.default.readFileSync(baselinePath, "utf-8");
+    const raw = import_fs8.default.readFileSync(baselinePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -1717,7 +3063,7 @@ function registerBaselineCommand(program2) {
     const doCheck = opts.check ?? (existingBaseline !== null && !opts.save);
     if (doSave) {
       log.info("Scanning project to save baseline\u2026");
-      const spinner = (0, import_ora2.default)({ text: "Running analysis\u2026", color: "cyan" }).start();
+      const spinner = (0, import_ora3.default)({ text: "Running analysis\u2026", color: "cyan" }).start();
       let result;
       try {
         result = await runEslint({ preset, targetPath: opts.path });
@@ -1729,30 +3075,30 @@ function registerBaselineCommand(program2) {
       }
       const baselinePath = saveBaseline(result, preset, mode, cwd);
       log.success(
-        `Baseline saved \u2192 ${import_chalk7.default.white(import_path8.default.relative(cwd, baselinePath))}`
+        `Baseline saved \u2192 ${import_chalk9.default.white(import_path10.default.relative(cwd, baselinePath))}`
       );
       log.info(`  ${result.totalIssues} issues recorded (${result.totalErrors} errors, ${result.totalWarnings} warnings)`);
-      log.info(`  Preset: ${import_chalk7.default.cyan(preset)}`);
-      log.info(`  Mode: ${import_chalk7.default.cyan(mode)}`);
+      log.info(`  Preset: ${import_chalk9.default.cyan(preset)}`);
+      log.info(`  Mode: ${import_chalk9.default.cyan(mode)}`);
       log.blank();
-      log.info("Future runs of " + import_chalk7.default.cyan("ai-guard baseline --check") + " will show only NEW issues.");
-      log.info("Add " + import_chalk7.default.white(BASELINE_FILE) + " to your git repository to share baseline with your team.");
+      log.info("Future runs of " + import_chalk9.default.cyan("ai-guard baseline --check") + " will show only NEW issues.");
+      log.info("Add " + import_chalk9.default.white(BASELINE_FILE) + " to your git repository to share baseline with your team.");
       log.blank();
       return;
     }
     if (doCheck) {
       if (!existingBaseline) {
-        log.error(`No baseline found at ${import_chalk7.default.white(BASELINE_FILE)}`);
-        log.info(`Run ${import_chalk7.default.cyan("ai-guard baseline --save")} first to create one.`);
+        log.error(`No baseline found at ${import_chalk9.default.white(BASELINE_FILE)}`);
+        log.info(`Run ${import_chalk9.default.cyan("ai-guard baseline --save")} first to create one.`);
         process.exit(1);
       }
       const baselineDate = new Date(existingBaseline.createdAt).toLocaleString();
-      log.info(`Baseline from: ${import_chalk7.default.gray(baselineDate)}`);
-      log.info(`Baseline preset: ${import_chalk7.default.cyan(existingBaseline.preset)}`);
-      log.info(`Baseline mode: ${import_chalk7.default.cyan(existingBaseline.mode ?? "strict")}`);
-      log.info(`Baseline issues: ${import_chalk7.default.gray(existingBaseline.totalIssues)}`);
+      log.info(`Baseline from: ${import_chalk9.default.gray(baselineDate)}`);
+      log.info(`Baseline preset: ${import_chalk9.default.cyan(existingBaseline.preset)}`);
+      log.info(`Baseline mode: ${import_chalk9.default.cyan(existingBaseline.mode ?? "strict")}`);
+      log.info(`Baseline issues: ${import_chalk9.default.gray(existingBaseline.totalIssues)}`);
       log.blank();
-      const spinner = (0, import_ora2.default)({ text: "Scanning for new issues\u2026", color: "cyan" }).start();
+      const spinner = (0, import_ora3.default)({ text: "Scanning for new issues\u2026", color: "cyan" }).start();
       let result;
       try {
         result = await runEslint({ preset, targetPath: opts.path });
@@ -1775,7 +3121,7 @@ function registerBaselineCommand(program2) {
         return;
       }
       log.print(
-        import_chalk7.default.bold.red(`  \u2716  ${newResult.totalIssues} new issue${newResult.totalIssues !== 1 ? "s" : ""} since baseline`)
+        import_chalk9.default.bold.red(`  \u2716  ${newResult.totalIssues} new issue${newResult.totalIssues !== 1 ? "s" : ""} since baseline`)
       );
       log.blank();
       if (newResult.ruleBreakdown.size > 0) {
@@ -1791,7 +3137,7 @@ function registerBaselineCommand(program2) {
         log.blank();
         for (const file of newResult.files) {
           log.print(
-            `  ${import_chalk7.default.bold.white(file.filePath)} ` + import_chalk7.default.gray(`(${file.issues.length} new)`)
+            `  ${import_chalk9.default.bold.white(file.filePath)} ` + import_chalk9.default.gray(`(${file.issues.length} new)`)
           );
           for (const issue of file.issues) {
             log.issue(issue.message, issue.severity, issue.line, issue.column);
@@ -1804,7 +3150,7 @@ function registerBaselineCommand(program2) {
       log.error(
         `${newResult.totalIssues} new issue${newResult.totalIssues !== 1 ? "s" : ""} introduced since baseline.`
       );
-      log.info(`Run ${import_chalk7.default.cyan("ai-guard baseline --save")} to update the baseline after fixing them.`);
+      log.info(`Run ${import_chalk9.default.cyan("ai-guard baseline --save")} to update the baseline after fixing them.`);
       log.blank();
       process.exit(1);
     }
@@ -1812,9 +3158,9 @@ function registerBaselineCommand(program2) {
 }
 
 // cli/commands/init-context.ts
-var import_fs6 = __toESM(require("fs"));
-var import_path9 = __toESM(require("path"));
-var import_chalk8 = __toESM(require("chalk"));
+var import_fs9 = __toESM(require("fs"));
+var import_path11 = __toESM(require("path"));
+var import_chalk10 = __toESM(require("chalk"));
 var import_prompts2 = require("@inquirer/prompts");
 var RULE_CATEGORIES = {
   "error-handling": [
@@ -2177,23 +3523,23 @@ var AGENTS = [
   {
     id: "copilot",
     label: "GitHub Copilot",
-    filePath: import_path9.default.join(".github", "copilot-instructions.md"),
+    filePath: import_path11.default.join(".github", "copilot-instructions.md"),
     generate: generateCopilotFile
   }
 ];
 function getPackageVersion2(cwd) {
   try {
-    const pkgPath = import_path9.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
-    if (import_fs6.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs6.default.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = import_path11.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
+    if (import_fs9.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs9.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
     }
   } catch {
   }
   try {
-    const pkgPath = import_path9.default.join(cwd, "package.json");
-    if (import_fs6.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs6.default.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = import_path11.default.join(cwd, "package.json");
+    if (import_fs9.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs9.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
     }
   } catch {
@@ -2222,7 +3568,7 @@ function registerInitContextCommand(program2) {
     const isForce = opts.force === true;
     log.banner("AI GUARD INIT-CONTEXT");
     if (isDryRun) {
-      log.print(`  ${import_chalk8.default.yellow("\u2691  DRY RUN \u2014 no files will be written")}`);
+      log.print(`  ${import_chalk10.default.yellow("\u2691  DRY RUN \u2014 no files will be written")}`);
       log.blank();
     }
     let selectedAgents;
@@ -2255,13 +3601,13 @@ function registerInitContextCommand(program2) {
         selectedAgents = AGENTS.filter((a) => selected.includes(a.id));
       }
     }
-    log.info(`Categories: ${import_chalk8.default.cyan(categories.join(", "))}`);
-    log.info(`Version: ${import_chalk8.default.cyan(version)}`);
+    log.info(`Categories: ${import_chalk10.default.cyan(categories.join(", "))}`);
+    log.info(`Version: ${import_chalk10.default.cyan(version)}`);
     log.blank();
     const results = [];
     for (const agent of selectedAgents) {
-      const fullPath = import_path9.default.join(cwd, agent.filePath);
-      const exists = import_fs6.default.existsSync(fullPath);
+      const fullPath = import_path11.default.join(cwd, agent.filePath);
+      const exists = import_fs9.default.existsSync(fullPath);
       if (exists && !isForce && !isDryRun) {
         const overwrite = await (0, import_prompts2.confirm)({
           message: `${agent.filePath} already exists. Overwrite?`,
@@ -2275,41 +3621,41 @@ function registerInitContextCommand(program2) {
       const content = agent.generate(version, categories);
       if (isDryRun) {
         log.section(`Preview: ${agent.filePath}`);
-        log.print(import_chalk8.default.gray("\u2500".repeat(60)));
+        log.print(import_chalk10.default.gray("\u2500".repeat(60)));
         for (const line of content.split("\n").slice(0, 20)) {
-          log.print(import_chalk8.default.gray(`  ${line}`));
+          log.print(import_chalk10.default.gray(`  ${line}`));
         }
-        log.print(import_chalk8.default.gray("  ... (truncated)"));
-        log.print(import_chalk8.default.gray("\u2500".repeat(60)));
+        log.print(import_chalk10.default.gray("  ... (truncated)"));
+        log.print(import_chalk10.default.gray("\u2500".repeat(60)));
         log.blank();
         results.push({ file: agent.filePath, status: "dry-run" });
         continue;
       }
-      const parentDir = import_path9.default.dirname(fullPath);
-      if (!import_fs6.default.existsSync(parentDir)) {
-        import_fs6.default.mkdirSync(parentDir, { recursive: true });
+      const parentDir = import_path11.default.dirname(fullPath);
+      if (!import_fs9.default.existsSync(parentDir)) {
+        import_fs9.default.mkdirSync(parentDir, { recursive: true });
       }
-      import_fs6.default.writeFileSync(fullPath, content, "utf-8");
+      import_fs9.default.writeFileSync(fullPath, content, "utf-8");
       results.push({ file: agent.filePath, status: "created" });
     }
     log.section("Summary");
     for (const result of results) {
       switch (result.status) {
         case "created":
-          log.print(`  ${import_chalk8.default.green("\u2705")} Created ${import_chalk8.default.white(result.file)}`);
+          log.print(`  ${import_chalk10.default.green("\u2705")} Created ${import_chalk10.default.white(result.file)}`);
           break;
         case "skipped":
-          log.print(`  ${import_chalk8.default.yellow("\u23ED")}  Skipped ${import_chalk8.default.white(result.file)} ${import_chalk8.default.gray("(already exists \u2014 use --force to overwrite)")}`);
+          log.print(`  ${import_chalk10.default.yellow("\u23ED")}  Skipped ${import_chalk10.default.white(result.file)} ${import_chalk10.default.gray("(already exists \u2014 use --force to overwrite)")}`);
           break;
         case "dry-run":
-          log.print(`  ${import_chalk8.default.cyan("\u{1F4DD}")} Would create ${import_chalk8.default.white(result.file)}`);
+          log.print(`  ${import_chalk10.default.cyan("\u{1F4DD}")} Would create ${import_chalk10.default.white(result.file)}`);
           break;
       }
     }
     log.blank();
     if (isDryRun) {
       log.info("Dry run complete \u2014 no files were written.");
-      log.info(`Re-run without ${import_chalk8.default.cyan("--dry-run")} to apply.`);
+      log.info(`Re-run without ${import_chalk10.default.cyan("--dry-run")} to apply.`);
     } else {
       const createdCount = results.filter((r) => r.status === "created").length;
       if (createdCount > 0) {
@@ -2323,9 +3669,9 @@ function registerInitContextCommand(program2) {
 }
 
 // cli/commands/report.ts
-var import_fs7 = __toESM(require("fs"));
-var import_path10 = __toESM(require("path"));
-var import_ora3 = __toESM(require("ora"));
+var import_fs10 = __toESM(require("fs"));
+var import_path12 = __toESM(require("path"));
+var import_ora4 = __toESM(require("ora"));
 var RULE_META = {
   "ai-guard/no-empty-catch": { description: "Empty catch blocks silently swallow errors", category: "Reliability" },
   "ai-guard/no-broad-exception": { description: "Catching all exceptions hides bugs", category: "Reliability" },
@@ -2348,28 +3694,28 @@ var RULE_META = {
 };
 function getProjectName(cwd) {
   try {
-    const pkgPath = import_path10.default.join(cwd, "package.json");
-    if (import_fs7.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs7.default.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = import_path12.default.join(cwd, "package.json");
+    if (import_fs10.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.name) return pkg.name;
     }
   } catch {
   }
-  return import_path10.default.basename(cwd);
+  return import_path12.default.basename(cwd);
 }
 function getPluginVersion(cwd) {
   try {
-    const pkgPath = import_path10.default.resolve(__dirname, "../../package.json");
-    if (import_fs7.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs7.default.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = import_path12.default.resolve(__dirname, "../../package.json");
+    if (import_fs10.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
     }
   } catch {
   }
   try {
-    const pkgPath = import_path10.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
-    if (import_fs7.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs7.default.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = import_path12.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
+    if (import_fs10.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
     }
   } catch {
@@ -2419,6 +3765,37 @@ function buildReportData(result, preset, scannedPath, cwd) {
       example
     };
   });
+  const CONFIDENCE_ASSIGNMENT = {
+    "ai-guard/no-hardcoded-secret": "high",
+    "ai-guard/no-eval-dynamic": "high",
+    "ai-guard/no-floating-promise": "high",
+    "ai-guard/no-empty-catch": "high",
+    "ai-guard/no-sql-string-concat": "medium",
+    "ai-guard/no-await-in-loop": "medium",
+    "ai-guard/require-auth-middleware": "medium",
+    "ai-guard/require-authz-check": "medium",
+    "ai-guard/no-catch-log-rethrow": "medium",
+    "ai-guard/no-catch-without-use": "medium",
+    "ai-guard/no-unsafe-deserialize": "medium",
+    "ai-guard/no-async-without-await": "low",
+    "ai-guard/no-async-array-callback": "low",
+    "ai-guard/no-dead-branch": "low",
+    "ai-guard/no-broad-exception": "low",
+    "ai-guard/no-console-in-handler": "low",
+    "ai-guard/no-duplicate-logic-block": "low",
+    "ai-guard/no-redundant-await": "low"
+  };
+  let highCount = 0;
+  let mediumCount = 0;
+  let lowCount = 0;
+  for (const [rule, count] of result.ruleBreakdown.entries()) {
+    const tier = CONFIDENCE_ASSIGNMENT[rule] ?? "low";
+    if (tier === "high") highCount += count;
+    else if (tier === "medium") mediumCount += count;
+    else lowCount += count;
+  }
+  const ecosystemCount = result.ecosystemIssues?.length ?? 0;
+  const parserErrorCount = result.parserErrors?.length ?? 0;
   return {
     projectName,
     version,
@@ -2433,7 +3810,12 @@ function buildReportData(result, preset, scannedPath, cwd) {
     ruleBreakdown: Object.fromEntries(result.ruleBreakdown),
     topFiles,
     topRules,
-    categoryBreakdown
+    categoryBreakdown,
+    highCount,
+    mediumCount,
+    lowCount,
+    ecosystemCount,
+    parserErrorCount
   };
 }
 function generateHtml(data) {
@@ -2533,12 +3915,23 @@ function generateHtml(data) {
         <p style="color:#6b7280;font-size:0.85rem;margin-top:0.25rem;">Scanned: <code style="color:#94a3b8;">${escHtml(data.scannedPath)}</code> \xB7 Preset: <code style="color:#94a3b8;">${escHtml(data.preset)}</code> \xB7 ${data.durationMs}ms</p>
       </div>
       <div style="text-align:center;">
-        <div style="font-size:0.75rem;color:#6b7280;margin-bottom:0.5rem;letter-spacing:0.05em;">AI CODE HEALTH SCORE</div>
-        <div style="width:100px;height:100px;border-radius:50%;background:conic-gradient(${scoreColor} ${data.score}%, #1f2937 0%);display:flex;align-items:center;justify-content:center;box-shadow:0 0 30px ${scoreColor}33;">
-          <div style="width:80px;height:80px;border-radius:50%;background:#030712;display:flex;flex-direction:column;align-items:center;justify-content:center;">
-            <span style="font-size:1.6rem;font-weight:800;color:${scoreColor};">${data.score}</span>
-            <span style="font-size:0.65rem;color:${scoreColor};font-weight:600;">${scoreLabel}</span>
+        <div style="font-size:0.75rem;color:#6b7280;margin-bottom:0.75rem;letter-spacing:0.05em;">SIGNAL CONFIDENCE</div>
+        <div style="display:flex;flex-direction:column;gap:0.4rem;">
+          <div style="display:flex;align-items:center;gap:0.5rem;">
+            <span style="width:8px;height:8px;border-radius:50%;background:#ef4444;display:inline-block;"></span>
+            <span style="font-size:0.8rem;color:#f87171;font-weight:600;">${data.highCount} high-confidence</span>
+          </div>
+          <div style="display:flex;align-items:center;gap:0.5rem;">
+            <span style="width:8px;height:8px;border-radius:50%;background:#f59e0b;display:inline-block;"></span>
+            <span style="font-size:0.8rem;color:#fbbf24;font-weight:600;">${data.mediumCount} medium-confidence</span>
+          </div>
+          <div style="display:flex;align-items:center;gap:0.5rem;">
+            <span style="width:8px;height:8px;border-radius:50%;background:#6b7280;display:inline-block;"></span>
+            <span style="font-size:0.8rem;color:#9ca3af;font-weight:600;">${data.lowCount} suggestions</span>
           </div>
+          ${data.ecosystemCount > 0 ? `<div style="display:flex;align-items:center;gap:0.5rem;margin-top:0.25rem;">
+            <span style="font-size:0.75rem;color:#4b5563;">\u26A0 ${data.ecosystemCount} config issue${data.ecosystemCount !== 1 ? "s" : ""} (not ai-guard)</span>
+          </div>` : ""}
         </div>
       </div>
     </div>
@@ -2677,7 +4070,7 @@ function registerReportCommand(program2) {
     "Generate a beautiful HTML report of AI Guard scan results\nPerfect for sharing with your team or in Slack."
   ).option("--path <dir>", "Directory or file to scan", ".").option("--preset <preset>", "Rule preset: recommended | strict | security", "recommended").option("--html", "Generate HTML report (default behavior)").option("--json", "Output raw JSON to stdout instead of writing HTML").option("--output <filename>", "Output file name", "ai-guard-report.html").option("--no-open", "Do not open the report in the browser after generating").action(async (opts) => {
     const preset = ["recommended", "strict", "security"].includes(opts.preset) ? opts.preset : "recommended";
-    const spinner = opts.json ? null : (0, import_ora3.default)({ text: "Scanning\u2026", color: "cyan" }).start();
+    const spinner = opts.json ? null : (0, import_ora4.default)({ text: "Scanning\u2026", color: "cyan" }).start();
     let result;
     try {
       result = await runEslint({ preset, targetPath: opts.path });
@@ -2699,8 +4092,8 @@ function registerReportCommand(program2) {
     log.banner("AI GUARD REPORT");
     log.blank();
     const html = generateHtml(reportData);
-    const outputPath = import_path10.default.resolve(cwd, opts.output);
-    import_fs7.default.writeFileSync(outputPath, html, "utf-8");
+    const outputPath = import_path12.default.resolve(cwd, opts.output);
+    import_fs10.default.writeFileSync(outputPath, html, "utf-8");
     log.success(`Report saved: ${opts.output}`);
     log.info(
       `Score: ${reportData.score}/100 \xB7 ${reportData.totalErrors} errors \xB7 ${reportData.totalWarnings} warnings`
@@ -2715,9 +4108,9 @@ function registerReportCommand(program2) {
           await open(outputPath);
           log.info("Opened in your browser.");
         } else {
-          const { execSync } = await import("child_process");
+          const { execSync: execSync2 } = await import("child_process");
           const cmd = process.platform === "win32" ? `start "" "${outputPath}"` : process.platform === "darwin" ? `open "${outputPath}"` : `xdg-open "${outputPath}"`;
-          execSync(cmd);
+          execSync2(cmd);
           log.info("Opened in your browser.");
         }
       } catch {
@@ -2733,8 +4126,8 @@ function registerReportCommand(program2) {
 // cli/index.ts
 function getVersion() {
   try {
-    const pkgPath = import_path11.default.resolve(__dirname, "../../package.json");
-    const raw = import_fs8.default.readFileSync(pkgPath, "utf-8");
+    const pkgPath = import_path13.default.resolve(__dirname, "../../package.json");
+    const raw = import_fs11.default.readFileSync(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     return typeof pkg.version === "string" ? pkg.version : "0.0.0";
   } catch {
@@ -2743,9 +4136,10 @@ function getVersion() {
 }
 var program = new import_commander.Command();
 program.name("ai-guard").description(
-  "Production-grade CLI for eslint-plugin-ai-guard\nCatch AI-generated code issues instantly \u2014 no ESLint config required.\n\nQuick start:\n  npx ai-guard run          Scan current project\n  npx ai-guard init         Auto-configure ESLint\n  npx ai-guard init-context Generate AI agent rules\n  npx ai-guard report       Generate shareable HTML report\n  npx ai-guard doctor       Check your setup\n  npx ai-guard baseline     Save baseline, track new issues only"
+  "Production-grade CLI for eslint-plugin-ai-guard\nCatch AI-generated code issues instantly \u2014 no ESLint config required.\n\nQuick start:\n  npx ai-guard run          Scan current project\n  npx ai-guard changed      Scan only changed files (CI mode)\n  npx ai-guard init         Auto-configure ESLint\n  npx ai-guard init-context Generate AI agent rules\n  npx ai-guard report       Generate shareable HTML report\n  npx ai-guard doctor       Check your setup\n  npx ai-guard baseline     Save baseline, track new issues only"
 ).version(getVersion(), "-v, --version", "Print version number").helpOption("-h, --help", "Show help");
 registerRunCommand(program);
+registerChangedCommand(program);
 registerInitCommand(program);
 registerDoctorCommand(program);
 registerPresetCommand(program);