eslint-plugin-ai-guard 1.1.3 → 1.1.4

package/dist/cli/index.js

@@ -1305,29 +1305,29 @@ function getMemberPath(node) {
   }
   return [...objectPath, node.property.name];
 }
-function hasPathPrefix(path8, prefix) {
-  if (!path8 || path8.length < prefix.length) {
+function hasPathPrefix(path9, prefix) {
+  if (!path9 || path9.length < prefix.length) {
     return false;
   }
   for (let i = 0; i < prefix.length; i += 1) {
-    if (path8[i] !== prefix[i]) {
+    if (path9[i] !== prefix[i]) {
       return false;
     }
   }
   return true;
 }
-function isLikelyResourceIdPath(path8) {
-  if (!path8 || path8.length < 3) {
+function isLikelyResourceIdPath(path9) {
+  if (!path9 || path9.length < 3) {
     return false;
   }
-  if (!hasPathPrefix(path8, ["req", "params"]) && !hasPathPrefix(path8, ["req", "body"]) && !hasPathPrefix(path8, ["req", "query"])) {
+  if (!hasPathPrefix(path9, ["req", "params"]) && !hasPathPrefix(path9, ["req", "body"]) && !hasPathPrefix(path9, ["req", "query"])) {
     return false;
   }
-  const last = path8[path8.length - 1].toLowerCase();
+  const last = path9[path9.length - 1].toLowerCase();
   return last === "id" || last.endsWith("id");
 }
-function isReqUserPath(path8) {
-  return hasPathPrefix(path8, ["req", "user"]);
+function isReqUserPath(path9) {
+  return hasPathPrefix(path9, ["req", "user"]);
 }
 function containsAuthorizationHelper(node) {
   if (node.type === import_utils15.AST_NODE_TYPES.CallExpression && (node.callee.type === import_utils15.AST_NODE_TYPES.Identifier && AUTHZ_HELPER_NAMES.includes(node.callee.name) || node.callee.type === import_utils15.AST_NODE_TYPES.MemberExpression && node.callee.property.type === import_utils15.AST_NODE_TYPES.Identifier && AUTHZ_HELPER_NAMES.includes(node.callee.property.name))) {
@@ -1366,8 +1366,8 @@ function collectBodySignals(node) {
       }
     }
     if (current.type === import_utils15.AST_NODE_TYPES.MemberExpression) {
-      const path8 = getMemberPath(current);
-      if (isLikelyResourceIdPath(path8)) {
+      const path9 = getMemberPath(current);
+      if (isLikelyResourceIdPath(path9)) {
         hasResourceIdAccess = true;
       }
     }
@@ -1819,6 +1819,285 @@ var init_src = __esm({
   }
 });
 
+// cli/utils/config-manager.ts
+var config_manager_exports = {};
+__export(config_manager_exports, {
+  addIgnoresToFlatConfig: () => addIgnoresToFlatConfig,
+  addIgnoresToLegacyConfig: () => addIgnoresToLegacyConfig,
+  backupConfig: () => backupConfig,
+  generateFlatConfig: () => generateFlatConfig,
+  generateLegacyConfig: () => generateLegacyConfig,
+  getConfigFilePath: () => getConfigFilePath,
+  isInvalidAiGuardConfig: () => isInvalidAiGuardConfig,
+  patchFlatConfig: () => patchFlatConfig,
+  patchLegacyConfig: () => patchLegacyConfig,
+  readConfig: () => readConfig,
+  removeNukeIgnore: () => removeNukeIgnore,
+  repairInvalidFlatConfig: () => repairInvalidFlatConfig,
+  validateFlatConfigText: () => validateFlatConfigText,
+  validateLegacyConfigText: () => validateLegacyConfigText,
+  writeConfig: () => writeConfig
+});
+function backupConfig(configPath) {
+  const backupPath = `${configPath}.bak`;
+  import_fs2.default.copyFileSync(configPath, backupPath);
+  return backupPath;
+}
+function readConfig(configPath) {
+  return import_fs2.default.readFileSync(configPath, "utf-8");
+}
+function writeConfig(configPath, content) {
+  import_fs2.default.writeFileSync(configPath, content, "utf-8");
+}
+function generateFlatConfig(preset) {
+  return `import aiGuard from 'eslint-plugin-ai-guard';
+
+export default [
+  // Ignore generated / dependency directories
+  {
+    ignores: [
+      'node_modules/**',
+      '.next/**',
+      'dist/**',
+      'build/**',
+      'coverage/**',
+      'out/**',
+    ],
+  },
+
+  // ai-guard: catch AI-generated code patterns
+  {
+    plugins: {
+      'ai-guard': aiGuard.default,
+    },
+    rules: {
+      ...aiGuard.${preset}.rules,
+    },
+  },
+];
+`;
+}
+function generateLegacyConfig(preset) {
+  return `module.exports = {
+  plugins: ['ai-guard'],
+  extends: ['plugin:ai-guard/${preset}'],
+  ignorePatterns: [
+    'node_modules/',
+    '.next/',
+    'dist/',
+    'build/',
+    'coverage/',
+    'out/',
+  ],
+};
+`;
+}
+function isInvalidAiGuardConfig(content) {
+  if (!content.includes("eslint-plugin-ai-guard") && !content.includes("ai-guard")) {
+    return false;
+  }
+  if (content.includes(".configs.")) return true;
+  if (/(['"]ai-guard['"]\s*:\s*aiGuard)(?!\.default)/.test(content)) return true;
+  return false;
+}
+function repairInvalidFlatConfig(content) {
+  let repaired = content;
+  repaired = repaired.replace(/(['"]ai-guard['"]\s*:\s*aiGuard)(?!\.default)/g, "$1.default");
+  repaired = repaired.replace(/rules\s*:\s*aiGuard\.configs\.([a-zA-Z0-9_]+)\.rules(,?)/g, "rules: {\n      ...aiGuard.$1.rules,\n    }$2");
+  repaired = repaired.replace(/\.\.\.aiGuard\.configs\.([a-zA-Z0-9_]+)\.rules/g, "...aiGuard.$1.rules");
+  return repaired;
+}
+function patchFlatConfig(existing, preset) {
+  if (isInvalidAiGuardConfig(existing)) {
+    return repairInvalidFlatConfig(existing);
+  }
+  if (existing.includes(AI_GUARD_MARKER)) {
+    return existing;
+  }
+  const importLine = `import aiGuard from 'eslint-plugin-ai-guard';
+`;
+  const rulesBlock = `
+  // ai-guard injected by ai-guard CLI
+  {
+    plugins: {
+      'ai-guard': aiGuard.default,
+    },
+    rules: {
+      ...aiGuard.${preset}.rules,
+    },
+  },
+`;
+  let patched = existing;
+  const lastImportIdx = findLastImportEnd(patched);
+  if (lastImportIdx > -1) {
+    patched = patched.slice(0, lastImportIdx) + importLine + patched.slice(lastImportIdx);
+  } else {
+    patched = importLine + patched;
+  }
+  const lastBracket = patched.lastIndexOf("];");
+  if (lastBracket !== -1) {
+    patched = patched.slice(0, lastBracket) + rulesBlock + patched.slice(lastBracket);
+  }
+  return patched;
+}
+function findLastImportEnd(src) {
+  const lines = src.split("\n");
+  let lastImportLine = -1;
+  let charCount = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (/^\s*import\s+/.test(line)) lastImportLine = i;
+    charCount += line.length + 1;
+  }
+  if (lastImportLine === -1) return -1;
+  let offset = 0;
+  for (let i = 0; i <= lastImportLine; i++) {
+    offset += lines[i].length + 1;
+  }
+  return offset;
+}
+function patchLegacyConfig(existing, preset) {
+  if (existing.includes("ai-guard")) {
+    return existing;
+  }
+  let patched = existing;
+  if (patched.includes("plugins:")) {
+    patched = patched.replace(/plugins:\s*\[/, `plugins: ['ai-guard', `);
+  } else {
+    patched = patched.replace(
+      "module.exports = {",
+      `module.exports = {
+  plugins: ['ai-guard'],`
+    );
+  }
+  if (patched.includes("extends:")) {
+    patched = patched.replace(
+      /extends:\s*\[/,
+      `extends: ['plugin:ai-guard/${preset}', `
+    );
+  } else {
+    patched = patched.replace(
+      "module.exports = {",
+      `module.exports = {
+  extends: ['plugin:ai-guard/${preset}'],`
+    );
+  }
+  return patched;
+}
+function removeNukeIgnore(existing) {
+  const nukePatterns = [/"?\*\*\/\*"?/g];
+  const hasNuke = existing.includes('"**/*"') || existing.includes("'**/*'");
+  if (!hasNuke) return { content: existing, changed: false };
+  let patched = existing.replace(
+    /ignorePatterns:\s*\[.*?\*\*\/\*.*?\]/gs,
+    `ignorePatterns: ['node_modules/', '.next/', 'dist/', 'build/', 'coverage/']`
+  ).replace(
+    /ignores:\s*\[.*?\*\*\/\*.*?\]/gs,
+    `ignores: ['node_modules/**', '.next/**', 'dist/**', 'build/**', 'coverage/**']`
+  );
+  for (const re of nukePatterns) {
+    patched = patched.replace(re, "");
+  }
+  return { content: patched, changed: patched !== existing };
+}
+function addIgnoresToFlatConfig(existing) {
+  if (existing.includes("ignores:")) return existing;
+  const block = `
+  // Default ignores added by ai-guard CLI
+  {
+    ignores: ${JSON.stringify(DEFAULT_FLAT_IGNORES)},
+  },
+`;
+  const lastBracket = existing.lastIndexOf("];");
+  if (lastBracket !== -1) {
+    return existing.slice(0, lastBracket) + block + existing.slice(lastBracket);
+  }
+  return existing;
+}
+function addIgnoresToLegacyConfig(existing) {
+  if (existing.includes("ignorePatterns")) return existing;
+  return existing.replace(
+    "module.exports = {",
+    `module.exports = {
+  ignorePatterns: ${JSON.stringify(DEFAULT_LEGACY_IGNORES)},`
+  );
+}
+function getConfigFilePath(configType, cwd = process.cwd()) {
+  switch (configType) {
+    case "flat-js":
+      return import_path3.default.join(cwd, "eslint.config.js");
+    case "flat-mjs":
+      return import_path3.default.join(cwd, "eslint.config.mjs");
+    case "flat-cjs":
+      return import_path3.default.join(cwd, "eslint.config.cjs");
+    case "eslintrc-js":
+      return import_path3.default.join(cwd, ".eslintrc.js");
+    case "eslintrc-cjs":
+      return import_path3.default.join(cwd, ".eslintrc.cjs");
+    case "eslintrc-json":
+      return import_path3.default.join(cwd, ".eslintrc.json");
+    default:
+      return import_path3.default.join(cwd, ".eslintrc.js");
+  }
+}
+function validateFlatConfigText(content) {
+  const problems = [];
+  if (!content.includes("export default")) {
+    problems.push("Missing `export default` \u2014 file must be an ES module");
+  }
+  if (!content.includes("eslint-plugin-ai-guard") && !content.includes("aiGuard")) {
+    problems.push("Plugin import not found \u2014 ai-guard plugin may not be referenced");
+  }
+  if (!content.trim().endsWith("];") && !content.trim().endsWith("];")) {
+  }
+  if (content.includes('"**/*"') || content.includes("'**/*'")) {
+    problems.push(
+      'Config contains "**/*" ignore pattern \u2014 this will prevent all files from being linted'
+    );
+  }
+  return problems;
+}
+function validateLegacyConfigText(content) {
+  const problems = [];
+  if (!content.includes("module.exports")) {
+    problems.push("Missing `module.exports` \u2014 legacy config must use CJS exports");
+  }
+  if (!content.includes("ai-guard")) {
+    problems.push("Plugin not referenced \u2014 add ai-guard to plugins and extends");
+  }
+  if (content.includes('"**/*"') || content.includes("'**/*'")) {
+    problems.push(
+      'Config contains "**/*" ignore pattern \u2014 this will prevent all files from being linted'
+    );
+  }
+  return problems;
+}
+var import_fs2, import_path3, AI_GUARD_MARKER, DEFAULT_FLAT_IGNORES, DEFAULT_LEGACY_IGNORES;
+var init_config_manager = __esm({
+  "cli/utils/config-manager.ts"() {
+    "use strict";
+    import_fs2 = __toESM(require("fs"));
+    import_path3 = __toESM(require("path"));
+    AI_GUARD_MARKER = "eslint-plugin-ai-guard";
+    DEFAULT_FLAT_IGNORES = [
+      "node_modules/**",
+      ".next/**",
+      "dist/**",
+      "build/**",
+      "coverage/**",
+      "out/**"
+    ];
+    DEFAULT_LEGACY_IGNORES = [
+      "node_modules/",
+      ".next/",
+      "dist/",
+      "build/",
+      "coverage/",
+      "out/"
+    ];
+  }
+});
+
 // cli/index.ts
 var import_commander = require("commander");
 
@@ -2220,7 +2499,7 @@ function formatIssueCount(errors, warnings) {
 
 // cli/commands/init.ts
 var import_chalk3 = __toESM(require("chalk"));
-var import_path3 = __toESM(require("path"));
+var import_path4 = __toESM(require("path"));
 var import_fs3 = __toESM(require("fs"));
 
 // cli/utils/detector.ts
@@ -2322,225 +2601,8 @@ function detect(cwd = process.cwd()) {
   };
 }
 
-// cli/utils/config-manager.ts
-var import_fs2 = __toESM(require("fs"));
-function backupConfig(configPath) {
-  const backupPath = `${configPath}.bak`;
-  import_fs2.default.copyFileSync(configPath, backupPath);
-  return backupPath;
-}
-function readConfig(configPath) {
-  return import_fs2.default.readFileSync(configPath, "utf-8");
-}
-function writeConfig(configPath, content) {
-  import_fs2.default.writeFileSync(configPath, content, "utf-8");
-}
-function generateFlatConfig(preset) {
-  return `import aiGuard from 'eslint-plugin-ai-guard';
-
-export default [
-  // Ignore generated / dependency directories
-  {
-    ignores: [
-      'node_modules/**',
-      '.next/**',
-      'dist/**',
-      'build/**',
-      'coverage/**',
-      'out/**',
-    ],
-  },
-
-  // ai-guard: catch AI-generated code patterns
-  {
-    plugins: {
-      'ai-guard': aiGuard.default,
-    },
-    rules: {
-      ...aiGuard.${preset}.rules,
-    },
-  },
-];
-`;
-}
-function generateLegacyConfig(preset) {
-  return `module.exports = {
-  plugins: ['ai-guard'],
-  extends: ['plugin:ai-guard/${preset}'],
-  ignorePatterns: [
-    'node_modules/',
-    '.next/',
-    'dist/',
-    'build/',
-    'coverage/',
-    'out/',
-  ],
-};
-`;
-}
-var AI_GUARD_MARKER = "eslint-plugin-ai-guard";
-function patchFlatConfig(existing, preset) {
-  if (existing.includes(AI_GUARD_MARKER)) {
-    return existing;
-  }
-  const importLine = `import aiGuard from 'eslint-plugin-ai-guard';
-`;
-  const rulesBlock = `
-  // ai-guard injected by ai-guard CLI
-  {
-    plugins: {
-      'ai-guard': aiGuard.default,
-    },
-    rules: {
-      ...aiGuard.${preset}.rules,
-    },
-  },
-`;
-  let patched = existing;
-  const lastImportIdx = findLastImportEnd(patched);
-  if (lastImportIdx > -1) {
-    patched = patched.slice(0, lastImportIdx) + importLine + patched.slice(lastImportIdx);
-  } else {
-    patched = importLine + patched;
-  }
-  const lastBracket = patched.lastIndexOf("];");
-  if (lastBracket !== -1) {
-    patched = patched.slice(0, lastBracket) + rulesBlock + patched.slice(lastBracket);
-  }
-  return patched;
-}
-function findLastImportEnd(src) {
-  const lines = src.split("\n");
-  let lastImportLine = -1;
-  let charCount = 0;
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    if (/^\s*import\s+/.test(line)) lastImportLine = i;
-    charCount += line.length + 1;
-  }
-  if (lastImportLine === -1) return -1;
-  let offset = 0;
-  for (let i = 0; i <= lastImportLine; i++) {
-    offset += lines[i].length + 1;
-  }
-  return offset;
-}
-function patchLegacyConfig(existing, preset) {
-  if (existing.includes("ai-guard")) {
-    return existing;
-  }
-  let patched = existing;
-  if (patched.includes("plugins:")) {
-    patched = patched.replace(/plugins:\s*\[/, `plugins: ['ai-guard', `);
-  } else {
-    patched = patched.replace(
-      "module.exports = {",
-      `module.exports = {
-  plugins: ['ai-guard'],`
-    );
-  }
-  if (patched.includes("extends:")) {
-    patched = patched.replace(
-      /extends:\s*\[/,
-      `extends: ['plugin:ai-guard/${preset}', `
-    );
-  } else {
-    patched = patched.replace(
-      "module.exports = {",
-      `module.exports = {
-  extends: ['plugin:ai-guard/${preset}'],`
-    );
-  }
-  return patched;
-}
-function removeNukeIgnore(existing) {
-  const nukePatterns = [/"?\*\*\/\*"?/g];
-  const hasNuke = existing.includes('"**/*"') || existing.includes("'**/*'");
-  if (!hasNuke) return { content: existing, changed: false };
-  let patched = existing.replace(
-    /ignorePatterns:\s*\[.*?\*\*\/\*.*?\]/gs,
-    `ignorePatterns: ['node_modules/', '.next/', 'dist/', 'build/', 'coverage/']`
-  ).replace(
-    /ignores:\s*\[.*?\*\*\/\*.*?\]/gs,
-    `ignores: ['node_modules/**', '.next/**', 'dist/**', 'build/**', 'coverage/**']`
-  );
-  for (const re of nukePatterns) {
-    patched = patched.replace(re, "");
-  }
-  return { content: patched, changed: patched !== existing };
-}
-var DEFAULT_FLAT_IGNORES = [
-  "node_modules/**",
-  ".next/**",
-  "dist/**",
-  "build/**",
-  "coverage/**",
-  "out/**"
-];
-var DEFAULT_LEGACY_IGNORES = [
-  "node_modules/",
-  ".next/",
-  "dist/",
-  "build/",
-  "coverage/",
-  "out/"
-];
-function addIgnoresToFlatConfig(existing) {
-  if (existing.includes("ignores:")) return existing;
-  const block = `
-  // Default ignores added by ai-guard CLI
-  {
-    ignores: ${JSON.stringify(DEFAULT_FLAT_IGNORES)},
-  },
-`;
-  const lastBracket = existing.lastIndexOf("];");
-  if (lastBracket !== -1) {
-    return existing.slice(0, lastBracket) + block + existing.slice(lastBracket);
-  }
-  return existing;
-}
-function addIgnoresToLegacyConfig(existing) {
-  if (existing.includes("ignorePatterns")) return existing;
-  return existing.replace(
-    "module.exports = {",
-    `module.exports = {
-  ignorePatterns: ${JSON.stringify(DEFAULT_LEGACY_IGNORES)},`
-  );
-}
-function validateFlatConfigText(content) {
-  const problems = [];
-  if (!content.includes("export default")) {
-    problems.push("Missing `export default` \u2014 file must be an ES module");
-  }
-  if (!content.includes("eslint-plugin-ai-guard") && !content.includes("aiGuard")) {
-    problems.push("Plugin import not found \u2014 ai-guard plugin may not be referenced");
-  }
-  if (!content.trim().endsWith("];") && !content.trim().endsWith("];")) {
-  }
-  if (content.includes('"**/*"') || content.includes("'**/*'")) {
-    problems.push(
-      'Config contains "**/*" ignore pattern \u2014 this will prevent all files from being linted'
-    );
-  }
-  return problems;
-}
-function validateLegacyConfigText(content) {
-  const problems = [];
-  if (!content.includes("module.exports")) {
-    problems.push("Missing `module.exports` \u2014 legacy config must use CJS exports");
-  }
-  if (!content.includes("ai-guard")) {
-    problems.push("Plugin not referenced \u2014 add ai-guard to plugins and extends");
-  }
-  if (content.includes('"**/*"') || content.includes("'**/*'")) {
-    problems.push(
-      'Config contains "**/*" ignore pattern \u2014 this will prevent all files from being linted'
-    );
-  }
-  return problems;
-}
-
 // cli/commands/init.ts
+init_config_manager();
 function classifyVerifyError(err) {
   const msg = err instanceof Error ? err.message : String(err);
   const clean = msg.replace(/\s+at\s+.+/gm, "").trim();
@@ -2564,7 +2626,7 @@ async function verifyConfigLoads(configPath, cwd) {
       overrideConfigFile: configPath
     });
     await eslint.lintText("", {
-      filePath: import_path3.default.join(cwd, "_ai_guard_probe_.js")
+      filePath: import_path4.default.join(cwd, "_ai_guard_probe_.js")
     });
     return null;
   } catch (err) {
@@ -2600,7 +2662,7 @@ function registerInitCommand(program2) {
       log.warn("eslint-plugin-ai-guard not found");
     }
     if (env.configType !== "none") {
-      log.success(`ESLint config found: ${import_chalk3.default.white(import_path3.default.relative(cwd, env.configPath ?? env.configType))}`);
+      log.success(`ESLint config found: ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath ?? env.configType))}`);
     } else {
       log.info("No ESLint config found \u2014 will generate one");
     }
@@ -2609,7 +2671,7 @@ function registerInitCommand(program2) {
       log.blank();
       log.warn("Conflicting configs detected:");
       for (const p of env.allConfigPaths) {
-        log.print(`    ${import_chalk3.default.yellow("\u2192")} ${import_chalk3.default.white(import_path3.default.relative(cwd, p))}`);
+        log.print(`    ${import_chalk3.default.yellow("\u2192")} ${import_chalk3.default.white(import_path4.default.relative(cwd, p))}`);
       }
       log.print(`  ${import_chalk3.default.gray("Multiple config formats found \u2014 this can cause unpredictable behavior.")}`);
     }
@@ -2637,7 +2699,7 @@ function registerInitCommand(program2) {
     try {
       const { createRequire } = await import("module");
       const { pathToFileURL } = await import("url");
-      const req = createRequire(import_path3.default.join(cwd, "_probe.js"));
+      const req = createRequire(import_path4.default.join(cwd, "_probe.js"));
       const resolvedPath = req.resolve("eslint-plugin-ai-guard");
       const aiGuard = await import(pathToFileURL(resolvedPath).href);
       const plugin2 = aiGuard.default || aiGuard;
@@ -2655,7 +2717,7 @@ function registerInitCommand(program2) {
     if (eslintNeedsFlat && existingIsLegacy) {
       log.section("Config Migration Required");
       log.warn(`ESLint v${env.eslintMajor} requires flat config, but a legacy config was found:`);
-      log.print(`    ${import_chalk3.default.white(import_path3.default.relative(cwd, env.configPath))}`);
+      log.print(`    ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath))}`);
       log.blank();
       log.print(`  ${import_chalk3.default.bold("ai-guard will create a new flat config.")}`);
       log.blank();
@@ -2667,7 +2729,7 @@ function registerInitCommand(program2) {
       const raw = readConfig(env.configPath);
       const { content: fixed, changed } = removeNukeIgnore(raw);
       if (changed) {
-        log.warn(`Removed "**/*" ignore pattern from ${import_path3.default.relative(cwd, env.configPath)}`);
+        log.warn(`Removed "**/*" ignore pattern from ${import_path4.default.relative(cwd, env.configPath)}`);
         if (!isDryRun) {
           backupConfig(env.configPath);
           writeConfig(env.configPath, fixed);
@@ -2679,7 +2741,7 @@ function registerInitCommand(program2) {
     }
     if (env.configType === "none" || eslintNeedsFlat && existingIsLegacy) {
       const targetName = useFlat ? "eslint.config.mjs" : ".eslintrc.js";
-      finalConfigPath = import_path3.default.join(cwd, targetName);
+      finalConfigPath = import_path4.default.join(cwd, targetName);
       const content2 = useFlat ? generateFlatConfig(preset) : generateLegacyConfig(preset);
       if (isDryRun) {
         log.print(`  ${import_chalk3.default.gray(`[dry-run] would create: ${targetName}`)}`);
@@ -2698,19 +2760,25 @@ function registerInitCommand(program2) {
         configWritten = true;
       }
     } else if (useFlat && existingIsFlat) {
+      const { isInvalidAiGuardConfig: isInvalidAiGuardConfig2 } = await Promise.resolve().then(() => (init_config_manager(), config_manager_exports));
       const existing = readConfig(env.configPath);
+      const isInvalid = isInvalidAiGuardConfig2(existing);
       const patched = patchFlatConfig(existing, preset);
-      if (patched === existing) {
+      if (patched === existing && !isInvalid) {
         log.warn("ai-guard is already present in your config \u2014 no changes made");
         finalConfigPath = env.configPath;
       } else if (isDryRun) {
         finalConfigPath = env.configPath;
-        log.print(`  ${import_chalk3.default.gray(`[dry-run] would patch: ${import_path3.default.relative(cwd, env.configPath)}`)}`);
+        log.print(`  ${import_chalk3.default.gray(`[dry-run] would patch: ${import_path4.default.relative(cwd, env.configPath)}`)}`);
       } else {
         const bak = backupConfig(env.configPath);
-        log.info(`Backed up \u2192 ${import_chalk3.default.gray(import_path3.default.relative(cwd, bak))}`);
+        log.info(`Backed up \u2192 ${import_chalk3.default.gray(import_path4.default.relative(cwd, bak))}`);
         writeConfig(env.configPath, patched);
-        log.success(`Patched ${import_chalk3.default.white(import_path3.default.relative(cwd, env.configPath))}`);
+        if (isInvalid) {
+          log.success(`Detected invalid ai-guard config \u2014 repairing ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath))}`);
+        } else {
+          log.success(`Patched ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath))}`);
+        }
         finalConfigPath = env.configPath;
         configWritten = true;
       }
@@ -2722,12 +2790,12 @@ function registerInitCommand(program2) {
         finalConfigPath = env.configPath;
       } else if (isDryRun) {
         finalConfigPath = env.configPath;
-        log.print(`  ${import_chalk3.default.gray(`[dry-run] would patch: ${import_path3.default.relative(cwd, env.configPath)}`)}`);
+        log.print(`  ${import_chalk3.default.gray(`[dry-run] would patch: ${import_path4.default.relative(cwd, env.configPath)}`)}`);
       } else {
         const bak = backupConfig(env.configPath);
-        log.info(`Backed up \u2192 ${import_chalk3.default.gray(import_path3.default.relative(cwd, bak))}`);
+        log.info(`Backed up \u2192 ${import_chalk3.default.gray(import_path4.default.relative(cwd, bak))}`);
         writeConfig(env.configPath, patched);
-        log.success(`Patched ${import_chalk3.default.white(import_path3.default.relative(cwd, env.configPath))}`);
+        log.success(`Patched ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath))}`);
         finalConfigPath = env.configPath;
         configWritten = true;
       }
@@ -2745,7 +2813,7 @@ function registerInitCommand(program2) {
             }
           } else {
             cleanedUp = true;
-            log.print(`  ${import_chalk3.default.gray(`[dry-run] would rename ${import_path3.default.relative(cwd, p)} to ${import_path3.default.basename(p)}.bak`)}`);
+            log.print(`  ${import_chalk3.default.gray(`[dry-run] would rename ${import_path4.default.relative(cwd, p)} to ${import_path4.default.basename(p)}.bak`)}`);
           }
         }
       }
@@ -2764,7 +2832,7 @@ function registerInitCommand(program2) {
     log.blank();
     log.section("Validation");
     if (!import_fs3.default.existsSync(finalConfigPath)) {
-      log.error(`Config file not found after write: ${import_path3.default.relative(cwd, finalConfigPath)}`);
+      log.error(`Config file not found after write: ${import_path4.default.relative(cwd, finalConfigPath)}`);
       log.blank();
       log.print(`  ${import_chalk3.default.bold("Problem:")} File write may have failed.`);
       log.print(`  ${import_chalk3.default.bold("Fix:")} Check disk space and file permissions, then re-run.`);
@@ -2780,7 +2848,7 @@ function registerInitCommand(program2) {
         log.print(`    ${import_chalk3.default.red("\u2716")} ${e}`);
       }
     } else {
-      log.success(`Config structure valid: ${import_chalk3.default.white(import_path3.default.relative(cwd, finalConfigPath))}`);
+      log.success(`Config structure valid: ${import_chalk3.default.white(import_path4.default.relative(cwd, finalConfigPath))}`);
     }
     log.info("Verifying ESLint can load the config\u2026");
     const loadError = await verifyConfigLoads(finalConfigPath, cwd);
@@ -2804,7 +2872,7 @@ function registerInitCommand(program2) {
         }
         log.blank();
         log.print(`  ${import_chalk3.default.bold("Fix:")}`);
-        log.print(`    1. Check the syntax in ${import_chalk3.default.cyan(import_path3.default.relative(cwd, finalConfigPath))}`);
+        log.print(`    1. Check the syntax in ${import_chalk3.default.cyan(import_path4.default.relative(cwd, finalConfigPath))}`);
         log.print(`    2. Make sure ${import_chalk3.default.cyan("eslint-plugin-ai-guard")} is installed`);
         log.print(`    3. Run ${import_chalk3.default.cyan("ai-guard doctor")} for full diagnostics`);
         log.blank();
@@ -2826,7 +2894,7 @@ function registerInitCommand(program2) {
     if (loadError === null && !lingeringConflicts) {
       log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold.green("Configuration validated successfully")}`);
     }
-    log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold("ESLint config:")} ${import_chalk3.default.cyan(import_path3.default.relative(cwd, finalConfigPath))}`);
+    log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold("ESLint config:")} ${import_chalk3.default.cyan(import_path4.default.relative(cwd, finalConfigPath))}`);
     log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold("Mode:")} ${import_chalk3.default.cyan(useFlat ? `Flat config (ESLint v${env.eslintMajor ?? 9})` : `Legacy config (ESLint v${env.eslintMajor ?? 8})`)}`);
     log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold("Preset:")} ${import_chalk3.default.cyan(preset)}`);
     log.blank();
@@ -2840,12 +2908,13 @@ function registerInitCommand(program2) {
 
 // cli/commands/doctor.ts
 var import_chalk4 = __toESM(require("chalk"));
-var import_path4 = __toESM(require("path"));
+var import_path5 = __toESM(require("path"));
+init_config_manager();
 async function probeConfigLoad(configPath, cwd) {
   try {
     const { ESLint } = await import("eslint");
     const eslint = new ESLint({ cwd, overrideConfigFile: configPath });
-    await eslint.lintText("", { filePath: import_path4.default.join(cwd, "_probe_.js") });
+    await eslint.lintText("", { filePath: import_path5.default.join(cwd, "_probe_.js") });
     return { ok: true, error: null };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -2880,7 +2949,7 @@ function registerDoctorCommand(program2) {
     checks.push({
       label: "ESLint config present",
       pass: hasConfig,
-      detail: hasConfig ? `${import_path4.default.relative(cwd, env.configPath ?? "")} (${env.configType})` : "No eslint.config.* or .eslintrc.* found",
+      detail: hasConfig ? `${import_path5.default.relative(cwd, env.configPath ?? "")} (${env.configType})` : "No eslint.config.* or .eslintrc.* found",
       fix: hasConfig ? void 0 : "ai-guard init",
       note: hasConfig ? void 0 : "This will generate the correct config format for your ESLint version"
     });
@@ -2899,25 +2968,28 @@ function registerDoctorCommand(program2) {
     }
     if (hasConfig && env.configPath) {
       let pluginWired = false;
+      let isInvalidConfig = false;
       let readError = null;
       try {
+        const { isInvalidAiGuardConfig: isInvalidAiGuardConfig2 } = await Promise.resolve().then(() => (init_config_manager(), config_manager_exports));
         const content = readConfig(env.configPath);
         pluginWired = content.includes("ai-guard") || content.includes("eslint-plugin-ai-guard");
+        isInvalidConfig = isInvalidAiGuardConfig2(content);
       } catch (err) {
         readError = err instanceof Error ? err.message : String(err);
       }
       checks.push({
         label: "Plugin wired in config",
-        pass: pluginWired,
-        detail: readError ? `Could not read config: ${readError}` : pluginWired ? "eslint-plugin-ai-guard referenced in config" : `Config exists but ai-guard plugin not found in ${import_path4.default.relative(cwd, env.configPath)}`,
-        fix: pluginWired ? void 0 : "ai-guard init  (will patch your existing config)"
+        pass: pluginWired && !isInvalidConfig,
+        detail: readError ? `Could not read config: ${readError}` : isInvalidConfig ? "Invalid ai-guard config detected (wrong export usage)" : pluginWired ? "eslint-plugin-ai-guard referenced in config" : `Config exists but ai-guard plugin not found in ${import_path5.default.relative(cwd, env.configPath)}`,
+        fix: isInvalidConfig || !pluginWired && !readError ? "ai-guard init  (will patch/repair your existing config)" : void 0
       });
     }
     checks.push({
       label: "No conflicting config files",
       pass: !env.hasConflictingConfigs,
       detail: env.hasConflictingConfigs ? `Conflicting config detected:
-${env.allConfigPaths.map((p) => `       ${import_path4.default.relative(cwd, p)}`).join("\n")}` : "Only one config format detected",
+${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}`).join("\n")}` : "Only one config format detected",
       fix: env.hasConflictingConfigs ? "Remove or backup legacy config" : void 0,
       note: env.hasConflictingConfigs ? "ESLint v9 silently ignores .eslintrc.* when a flat config exists. This can cause confusion." : void 0
     });
@@ -2944,7 +3016,7 @@ ${env.allConfigPaths.map((p) => `       ${import_path4.default.relative(cwd, p)}
         label: "ESLint config loads without errors",
         pass: probe.ok,
         detail: probe.ok ? "ESLint loaded config successfully" : probe.error ?? "Unknown error",
-        fix: probe.ok ? void 0 : `Check syntax in ${import_path4.default.relative(cwd, env.configPath)}`,
+        fix: probe.ok ? void 0 : `Check syntax in ${import_path5.default.relative(cwd, env.configPath)}`,
         note: probe.ok ? void 0 : "Run: ai-guard init --dry-run  to preview a fresh config"
       });
     }
@@ -3007,7 +3079,8 @@ ${env.allConfigPaths.map((p) => `       ${import_path4.default.relative(cwd, p)}
 // cli/commands/preset.ts
 var import_prompts = require("@inquirer/prompts");
 var import_chalk5 = __toESM(require("chalk"));
-var import_path5 = __toESM(require("path"));
+init_config_manager();
+var import_path6 = __toESM(require("path"));
 function registerPresetCommand(program2) {
   program2.command("preset").description("Interactively select and apply an ai-guard preset to your ESLint config").action(async () => {
     const cwd = process.cwd();
@@ -3035,21 +3108,21 @@ function registerPresetCommand(program2) {
     const env = detect(cwd);
     const useFlat = env.eslintMajor !== null && env.eslintMajor >= 9 || isFlat(env.configType);
     if (env.configType === "none") {
-      const configPath = useFlat ? import_path5.default.join(cwd, "eslint.config.mjs") : import_path5.default.join(cwd, ".eslintrc.js");
+      const configPath = useFlat ? import_path6.default.join(cwd, "eslint.config.mjs") : import_path6.default.join(cwd, ".eslintrc.js");
       const content = useFlat ? generateFlatConfig(preset) : generateLegacyConfig(preset);
       writeConfig(configPath, content);
-      log.success(`Created ${import_chalk5.default.white(import_path5.default.relative(cwd, configPath))} with ${import_chalk5.default.cyan(preset)} preset`);
+      log.success(`Created ${import_chalk5.default.white(import_path6.default.relative(cwd, configPath))} with ${import_chalk5.default.cyan(preset)} preset`);
     } else {
       const configPath = env.configPath;
       const backupPath = backupConfig(configPath);
-      log.info(`Backed up \u2192 ${import_chalk5.default.gray(import_path5.default.relative(cwd, backupPath))}`);
+      log.info(`Backed up \u2192 ${import_chalk5.default.gray(import_path6.default.relative(cwd, backupPath))}`);
       const existing = readConfig(configPath);
       const patched = isFlat(env.configType) ? patchFlatConfig(existing, preset) : patchLegacyConfig(existing, preset);
       if (patched === existing) {
         log.warn("Config already contains ai-guard. Edit manually to change preset.");
       } else {
         writeConfig(configPath, patched);
-        log.success(`Patched ${import_chalk5.default.white(import_path5.default.relative(cwd, configPath))}`);
+        log.success(`Patched ${import_chalk5.default.white(import_path6.default.relative(cwd, configPath))}`);
       }
     }
     log.blank();
@@ -3088,7 +3161,8 @@ function registerPresetCommand(program2) {
 
 // cli/commands/ignore.ts
 var import_chalk6 = __toESM(require("chalk"));
-var import_path6 = __toESM(require("path"));
+init_config_manager();
+var import_path7 = __toESM(require("path"));
 var DEFAULT_IGNORES = [
   ".next/",
   "dist/",
@@ -3110,21 +3184,21 @@ function registerIgnoreCommand(program2) {
     const env = detect(cwd);
     if (env.configType === "none") {
       const useFlat = env.eslintMajor !== null && env.eslintMajor >= 9;
-      const configPath = useFlat ? import_path6.default.join(cwd, "eslint.config.mjs") : import_path6.default.join(cwd, ".eslintrc.js");
+      const configPath = useFlat ? import_path7.default.join(cwd, "eslint.config.mjs") : import_path7.default.join(cwd, ".eslintrc.js");
       const content = useFlat ? generateFlatConfig("recommended") : generateLegacyConfig("recommended");
       writeConfig(configPath, content);
-      log.success(`No config found \u2014 generated ${import_chalk6.default.white(import_path6.default.relative(cwd, configPath))} with ignores included`);
+      log.success(`No config found \u2014 generated ${import_chalk6.default.white(import_path7.default.relative(cwd, configPath))} with ignores included`);
     } else {
       const configPath = env.configPath;
       const backupPath = backupConfig(configPath);
-      log.info(`Backed up \u2192 ${import_chalk6.default.gray(import_path6.default.relative(cwd, backupPath))}`);
+      log.info(`Backed up \u2192 ${import_chalk6.default.gray(import_path7.default.relative(cwd, backupPath))}`);
       const existing = readConfig(configPath);
       const patched = isFlat(env.configType) ? addIgnoresToFlatConfig(existing) : addIgnoresToLegacyConfig(existing);
       if (patched === existing) {
         log.warn("Ignore patterns already present in config \u2014 no changes made.");
       } else {
         writeConfig(configPath, patched);
-        log.success(`Patched ${import_chalk6.default.white(import_path6.default.relative(cwd, configPath))} with ignore patterns`);
+        log.success(`Patched ${import_chalk6.default.white(import_path7.default.relative(cwd, configPath))} with ignore patterns`);
       }
     }
     log.blank();
@@ -3136,7 +3210,7 @@ function registerIgnoreCommand(program2) {
 
 // cli/commands/baseline.ts
 var import_fs4 = __toESM(require("fs"));
-var import_path7 = __toESM(require("path"));
+var import_path8 = __toESM(require("path"));
 var import_chalk7 = __toESM(require("chalk"));
 var import_ora2 = __toESM(require("ora"));
 var BASELINE_FILE = ".ai-guard-baseline.json";
@@ -3156,12 +3230,12 @@ function saveBaseline(result, preset, cwd) {
     totalIssues: result.totalIssues,
     entries
   };
-  const baselinePath = import_path7.default.join(cwd, BASELINE_FILE);
+  const baselinePath = import_path8.default.join(cwd, BASELINE_FILE);
   import_fs4.default.writeFileSync(baselinePath, JSON.stringify(baseline, null, 2), "utf-8");
   return baselinePath;
 }
 function loadBaseline(cwd) {
-  const baselinePath = import_path7.default.join(cwd, BASELINE_FILE);
+  const baselinePath = import_path8.default.join(cwd, BASELINE_FILE);
   if (!import_fs4.default.existsSync(baselinePath)) return null;
   try {
     const raw = import_fs4.default.readFileSync(baselinePath, "utf-8");
@@ -3238,7 +3312,7 @@ function registerBaselineCommand(program2) {
       }
       const baselinePath = saveBaseline(result, preset, cwd);
       log.success(
-        `Baseline saved \u2192 ${import_chalk7.default.white(import_path7.default.relative(cwd, baselinePath))}`
+        `Baseline saved \u2192 ${import_chalk7.default.white(import_path8.default.relative(cwd, baselinePath))}`
       );
       log.info(`  ${result.totalIssues} issues recorded (${result.totalErrors} errors, ${result.totalWarnings} warnings)`);
       log.info(`  Preset: ${import_chalk7.default.cyan(preset)}`);