eslint-plugin-ai-guard 1.2.0 → 1.2.2

package/dist/cli/index.js

@@ -30,6 +30,154 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// cli/utils/debug.ts
+var debug_exports = {};
+__export(debug_exports, {
+  debugLog: () => debugLog,
+  printCIDebug: () => printCIDebug,
+  printGitDebug: () => printGitDebug
+});
+function debugLog(message) {
+  process.stderr.write(`${DIM("[debug]")} ${message}
+`);
+}
+function printGitDebug(result) {
+  const d = result.debugInfo;
+  process.stderr.write("\n");
+  process.stderr.write(`${LABEL("  Git Resolution Trace")}
+`);
+  process.stderr.write(`${DIM("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500")}
+`);
+  process.stderr.write(`  ${DIM("Mode:")}          ${import_chalk4.default.white(result.mode)}
+`);
+  if (d.resolvedBase) {
+    process.stderr.write(`  ${DIM("Base branch:")}   ${import_chalk4.default.white(d.resolvedBase)}
+`);
+  } else {
+    process.stderr.write(`  ${DIM("Base branch:")}   ${import_chalk4.default.dim("(none \u2014 uncommitted mode)")}
+`);
+  }
+  if (d.mergeBase) {
+    process.stderr.write(`  ${DIM("Merge base:")}    ${import_chalk4.default.white(d.mergeBase.slice(0, 12))}\u2026
+`);
+  }
+  if (d.isShallowClone) {
+    process.stderr.write(`  ${WARN} ${import_chalk4.default.yellow("Shallow clone detected")} \u2014 use fetch-depth: 0 in workflow
+`);
+  }
+  if (d.isDetachedHead) {
+    process.stderr.write(`  ${WARN} ${import_chalk4.default.yellow("Detached HEAD")} \u2014 branch context unavailable
+`);
+  }
+  process.stderr.write("\n");
+  process.stderr.write(`  ${DIM("Strategies attempted:")}
+`);
+  for (const strategy of d.strategiesAttempted) {
+    const succeeded = strategy === d.strategySucceeded;
+    const icon = succeeded ? OK : ERR;
+    const label = succeeded ? import_chalk4.default.green(strategy) : import_chalk4.default.dim(strategy);
+    process.stderr.write(`    ${icon} ${label}
+`);
+  }
+  if (d.strategySucceeded) {
+    process.stderr.write(`
+  ${OK} ${import_chalk4.default.green("Succeeded:")} ${d.strategySucceeded}
+`);
+  } else {
+    process.stderr.write(`
+  ${ERR} ${import_chalk4.default.red("All strategies failed")}
+`);
+  }
+  process.stderr.write("\n");
+  process.stderr.write(`  ${DIM("Files:")}
+`);
+  process.stderr.write(`    ${ARROW} Detected raw:       ${import_chalk4.default.white(d.rawFileCount)}
+`);
+  process.stderr.write(`    ${ARROW} Kept:               ${import_chalk4.default.green(result.files.length)}
+`);
+  if (d.droppedByExtension > 0) {
+    process.stderr.write(`    ${ARROW} Dropped (ext):      ${import_chalk4.default.dim(d.droppedByExtension)}
+`);
+  }
+  if (d.droppedByIgnore > 0) {
+    process.stderr.write(`    ${ARROW} Dropped (ignored):  ${import_chalk4.default.dim(d.droppedByIgnore)}
+`);
+  }
+  if (d.droppedByWorkingDir > 0) {
+    process.stderr.write(`    ${ARROW} Dropped (dir):      ${import_chalk4.default.dim(d.droppedByWorkingDir)}
+`);
+  }
+  if (d.droppedMissing > 0) {
+    process.stderr.write(`    ${ARROW} Dropped (missing):  ${import_chalk4.default.dim(d.droppedMissing)}
+`);
+  }
+  if (result.zeroFilesReason) {
+    process.stderr.write("\n");
+    process.stderr.write(`  ${WARN} ${import_chalk4.default.yellow("Zero files reason:")}
+`);
+    process.stderr.write(`    ${import_chalk4.default.dim(result.zeroFilesReason)}
+`);
+  }
+  if (result.files.length > 0) {
+    process.stderr.write("\n");
+    process.stderr.write(`  ${DIM("Changed files (first 20):")}
+`);
+    for (const f of result.files.slice(0, 20)) {
+      process.stderr.write(`    ${import_chalk4.default.dim("\xB7")} ${import_chalk4.default.white(f)}
+`);
+    }
+    if (result.files.length > 20) {
+      process.stderr.write(`    ${import_chalk4.default.dim(`\u2026 and ${result.files.length - 20} more`)}
+`);
+    }
+  }
+  process.stderr.write("\n");
+}
+function printCIDebug(info) {
+  process.stderr.write("\n");
+  process.stderr.write(`${LABEL("  CI Environment")}
+`);
+  process.stderr.write(`${DIM("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500")}
+`);
+  const env = (name, value) => {
+    const val = value ? import_chalk4.default.white(value) : import_chalk4.default.dim("(not set)");
+    process.stderr.write(`  ${DIM(name.padEnd(26))} ${val}
+`);
+  };
+  env("GITHUB_ACTIONS:", info.isGitHubActions ? "true" : "false");
+  env("GITHUB_BASE_REF:", info.githubBaseRef);
+  env("GITHUB_SHA:", info.githubSha);
+  env("GITHUB_REF:", info.githubRef);
+  env("GITHUB_REPOSITORY:", info.githubRepository);
+  env("GITHUB_WORKFLOW:", info.githubWorkflow);
+  env("GITHUB_RUN_ID:", info.githubRunId);
+  env("GITHUB_EVENT_NAME:", info.githubEventName);
+  process.stderr.write("\n");
+  env("GITHUB_STEP_SUMMARY:", info.githubStepSummary);
+  env("GITHUB_OUTPUT:", info.githubOutput);
+  process.stderr.write("\n");
+  env("Scan preset:", info.preset);
+  env("Fail on:", info.failOn);
+  env("Scan mode:", info.scanMode);
+  if (info.sarifOutputPath) {
+    env("SARIF output:", info.sarifOutputPath);
+  }
+  process.stderr.write("\n");
+}
+var import_chalk4, DIM, LABEL, OK, WARN, ERR, ARROW;
+var init_debug = __esm({
+  "cli/utils/debug.ts"() {
+    "use strict";
+    import_chalk4 = __toESM(require("chalk"));
+    DIM = import_chalk4.default.dim;
+    LABEL = import_chalk4.default.cyan.bold;
+    OK = import_chalk4.default.green("\u2714");
+    WARN = import_chalk4.default.yellow("\u26A0");
+    ERR = import_chalk4.default.red("\u2716");
+    ARROW = import_chalk4.default.dim("\u2192");
+  }
+});
+
 // cli/utils/config-manager.ts
 var config_manager_exports = {};
 __export(config_manager_exports, {
@@ -53,14 +201,14 @@ __export(config_manager_exports, {
 });
 function backupConfig(configPath) {
   const backupPath = `${configPath}.bak`;
-  import_fs3.default.copyFileSync(configPath, backupPath);
+  import_fs6.default.copyFileSync(configPath, backupPath);
   return backupPath;
 }
 function readConfig(configPath) {
-  return import_fs3.default.readFileSync(configPath, "utf-8");
+  return import_fs6.default.readFileSync(configPath, "utf-8");
 }
 function writeConfig(configPath, content) {
-  import_fs3.default.writeFileSync(configPath, content, "utf-8");
+  import_fs6.default.writeFileSync(configPath, content, "utf-8");
 }
 function generateFlatConfig(preset) {
   return `import aiGuard from 'eslint-plugin-ai-guard';
@@ -266,19 +414,19 @@ function addIgnoresToLegacyConfig(existing) {
 function getConfigFilePath(configType, cwd = process.cwd()) {
   switch (configType) {
     case "flat-js":
-      return import_path3.default.join(cwd, "eslint.config.js");
+      return import_path6.default.join(cwd, "eslint.config.js");
     case "flat-mjs":
-      return import_path3.default.join(cwd, "eslint.config.mjs");
+      return import_path6.default.join(cwd, "eslint.config.mjs");
     case "flat-cjs":
-      return import_path3.default.join(cwd, "eslint.config.cjs");
+      return import_path6.default.join(cwd, "eslint.config.cjs");
     case "eslintrc-js":
-      return import_path3.default.join(cwd, ".eslintrc.js");
+      return import_path6.default.join(cwd, ".eslintrc.js");
     case "eslintrc-cjs":
-      return import_path3.default.join(cwd, ".eslintrc.cjs");
+      return import_path6.default.join(cwd, ".eslintrc.cjs");
     case "eslintrc-json":
-      return import_path3.default.join(cwd, ".eslintrc.json");
+      return import_path6.default.join(cwd, ".eslintrc.json");
     default:
-      return import_path3.default.join(cwd, ".eslintrc.js");
+      return import_path6.default.join(cwd, ".eslintrc.js");
   }
 }
 function validateFlatConfigText(content) {
@@ -313,12 +461,12 @@ function validateLegacyConfigText(content) {
   }
   return problems;
 }
-var import_fs3, import_path3, AI_GUARD_MARKER, DEFAULT_FLAT_IGNORES, DEFAULT_LEGACY_IGNORES;
+var import_fs6, import_path6, AI_GUARD_MARKER, DEFAULT_FLAT_IGNORES, DEFAULT_LEGACY_IGNORES;
 var init_config_manager = __esm({
   "cli/utils/config-manager.ts"() {
     "use strict";
-    import_fs3 = __toESM(require("fs"));
-    import_path3 = __toESM(require("path"));
+    import_fs6 = __toESM(require("fs"));
+    import_path6 = __toESM(require("path"));
     AI_GUARD_MARKER = "eslint-plugin-ai-guard";
     DEFAULT_FLAT_IGNORES = [
       "node_modules/**",
@@ -341,17 +489,18 @@ var init_config_manager = __esm({
 
 // cli/index.ts
 var import_commander = require("commander");
-var import_fs8 = __toESM(require("fs"));
-var import_path11 = __toESM(require("path"));
+var import_fs11 = __toESM(require("fs"));
+var import_path14 = __toESM(require("path"));
 
 // cli/commands/run.ts
 var import_ora = __toESM(require("ora"));
-var import_chalk2 = __toESM(require("chalk"));
+var import_chalk3 = __toESM(require("chalk"));
 
 // cli/utils/eslint-runner.ts
 var import_fs = __toESM(require("fs"));
 var import_path = __toESM(require("path"));
 var import_url = require("url");
+var import_chalk2 = __toESM(require("chalk"));
 
 // cli/utils/logger.ts
 var import_chalk = __toESM(require("chalk"));
@@ -396,14 +545,15 @@ var CONFIDENCE_TIER = {
   "ai-guard/no-catch-log-rethrow": "medium",
   "ai-guard/no-catch-without-use": "medium",
   "ai-guard/no-unsafe-deserialize": "medium",
-  // Low confidence — suggestions, may be intentional
-  "ai-guard/no-async-without-await": "low",
+  // Low confidence — review case-by-case
   "ai-guard/no-async-array-callback": "low",
   "ai-guard/no-dead-branch": "low",
   "ai-guard/no-broad-exception": "low",
   "ai-guard/no-console-in-handler": "low",
   "ai-guard/no-duplicate-logic-block": "low",
-  "ai-guard/no-redundant-await": "low"
+  // Informational — mostly stylistic, high framework FP rate, collapsed by default
+  "ai-guard/no-async-without-await": "informational",
+  "ai-guard/no-redundant-await": "informational"
 };
 var ECOSYSTEM_FIX_HINTS = {
   "react-hooks/exhaustive-deps": "npm install --save-dev eslint-plugin-react-hooks",
@@ -541,6 +691,96 @@ var log = {
 };
 
 // cli/utils/eslint-runner.ts
+var ISSUE_CONFIDENCE = {
+  // HIGH — near-certain bugs: false positive rate <2% in real-world codebases
+  "ai-guard/no-hardcoded-secret": "high",
+  // Literal credential string in source: almost always a mistake
+  "ai-guard/no-eval-dynamic": "high",
+  // Dynamic eval: no legitimate modern use case
+  "ai-guard/no-floating-promise": "high",
+  // Unhandled promise: async failures silently swallowed
+  // MEDIUM — likely bugs, but legitimate patterns exist
+  "ai-guard/no-empty-catch": "medium",
+  // CHANGED from high: empty catch is valid for optional ops (JSON.parse, feature detection)
+  "ai-guard/no-sql-string-concat": "medium",
+  // SQL injection risk, but ORM template literals can FP
+  "ai-guard/no-await-in-loop": "medium",
+  // Sequential await is often intentional (rate limiting, ordering)
+  "ai-guard/require-auth-middleware": "medium",
+  // Context-blind: public routes are valid
+  "ai-guard/require-authz-check": "medium",
+  // Context-blind: some resources are public
+  "ai-guard/no-catch-log-rethrow": "medium",
+  // Log-then-rethrow is a known antipattern but sometimes intentional
+  "ai-guard/no-catch-without-use": "medium",
+  // Unused catch param common in TS
+  "ai-guard/no-unsafe-deserialize": "medium",
+  // JSON.parse is sometimes safe with trusted input
+  // LOW — possible improvement, high false-positive rate
+  "ai-guard/no-async-array-callback": "low",
+  // Promise.all is better, but forEach async is not always a bug
+  "ai-guard/no-dead-branch": "low",
+  // Static analysis of conditions is inherently imprecise
+  "ai-guard/no-broad-exception": "low",
+  // Catching Error is common and sometimes correct
+  "ai-guard/no-console-in-handler": "low",
+  // Stylistic: debug logs left in vs intentional logging
+  "ai-guard/no-duplicate-logic-block": "low",
+  // May be coincidental similarity, not true duplication
+  // INFORMATIONAL — hints only, never fail CI
+  "ai-guard/no-async-without-await": "informational",
+  // Framework patterns (Next.js RSC, etc.) make this very noisy
+  "ai-guard/no-redundant-await": "informational"
+  // Explicit await in return is idiomatic in many codebases
+};
+var ISSUE_CATEGORY = {
+  "ai-guard/no-floating-promise": "Async Reliability",
+  "ai-guard/no-await-in-loop": "Async Reliability",
+  "ai-guard/no-async-without-await": "Async Reliability",
+  "ai-guard/no-async-array-callback": "Async Reliability",
+  "ai-guard/no-redundant-await": "Async Reliability",
+  "ai-guard/no-empty-catch": "Reliability",
+  "ai-guard/no-broad-exception": "Reliability",
+  "ai-guard/no-catch-log-rethrow": "Reliability",
+  "ai-guard/no-catch-without-use": "Reliability",
+  "ai-guard/no-hardcoded-secret": "Security",
+  "ai-guard/no-eval-dynamic": "Security",
+  "ai-guard/no-sql-string-concat": "Security",
+  "ai-guard/no-unsafe-deserialize": "Security",
+  "ai-guard/require-auth-middleware": "Security",
+  "ai-guard/require-authz-check": "Security",
+  "ai-guard/no-console-in-handler": "AI Patterns",
+  "ai-guard/no-duplicate-logic-block": "AI Patterns",
+  "ai-guard/no-dead-branch": "AI Patterns"
+};
+var ISSUE_ASYNC_RISK_TYPE = {
+  "ai-guard/no-floating-promise": "floating-promise",
+  "ai-guard/no-await-in-loop": "sequential-await",
+  "ai-guard/no-async-without-await": "unnecessary-async",
+  "ai-guard/no-async-array-callback": "async-array-callback",
+  "ai-guard/no-redundant-await": "redundant-await"
+};
+var ISSUE_REMEDIATION = {
+  "ai-guard/no-floating-promise": "Add `await` before the call, assign to a variable, or add `.catch()` to handle rejection.",
+  "ai-guard/no-await-in-loop": "Collect promises in an array and use `await Promise.all(...)` outside the loop.",
+  "ai-guard/no-async-without-await": "Remove `async` if no async operations are needed, or add an `await` expression.",
+  "ai-guard/no-async-array-callback": "Use `Promise.all(array.map(async item => ...))` to ensure all async callbacks are awaited.",
+  "ai-guard/no-redundant-await": "Remove the `await` \u2014 the value is already resolved.",
+  "ai-guard/no-empty-catch": "Add error handling in the catch block, or at minimum log the error.",
+  "ai-guard/no-broad-exception": "Catch specific error types or re-throw after handling.",
+  "ai-guard/no-catch-log-rethrow": "Either log the error OR rethrow it \u2014 doing both duplicates the error in logs.",
+  "ai-guard/no-catch-without-use": "Use the caught error variable or rename to `_` to signal intentional suppression.",
+  "ai-guard/no-hardcoded-secret": "Move credentials to environment variables: `process.env.SECRET_KEY`.",
+  "ai-guard/no-eval-dynamic": "Avoid eval and Function constructors. Use safer alternatives like JSON.parse.",
+  "ai-guard/no-sql-string-concat": "Use parameterized queries or an ORM to prevent SQL injection.",
+  "ai-guard/no-unsafe-deserialize": "Validate input with a schema library (zod, joi, yup) before parsing.",
+  "ai-guard/require-auth-middleware": "Add an authentication middleware before the route handler.",
+  "ai-guard/require-authz-check": "Verify the requesting user has permission to access this resource.",
+  "ai-guard/no-console-in-handler": "Replace console.log with a structured logger (pino, winston, etc.).",
+  "ai-guard/no-duplicate-logic-block": "Extract the duplicated logic into a shared function.",
+  "ai-guard/no-dead-branch": "Remove the unreachable branch or fix the condition."
+};
+var _runnerCache = /* @__PURE__ */ new Map();
 function isRecord(value) {
   return typeof value === "object" && value !== null;
 }
@@ -612,13 +852,40 @@ function getRules(preset) {
   return RECOMMENDED_RULES;
 }
 var DEFAULT_IGNORE_PATTERNS = [
+  // Core — always skip
   "**/node_modules/**",
   "**/.next/**",
   "**/dist/**",
   "**/build/**",
   "**/coverage/**",
   "**/out/**",
-  "**/.git/**"
+  "**/.git/**",
+  // Build artifacts and caches
+  "**/.cache/**",
+  "**/.turbo/**",
+  "**/.nx/**",
+  "**/.parcel-cache/**",
+  "**/.webpack/**",
+  "**/tmp/**",
+  "**/temp/**",
+  // Package manager artifacts
+  "**/.yarn/**",
+  "**/.pnp.*",
+  // Framework generated
+  "**/.expo/**",
+  "**/.svelte-kit/**",
+  "**/storybook-static/**",
+  "**/.storybook/generated/**",
+  // Generated code
+  "**/generated/**",
+  "**/__generated__/**",
+  "**/vendor/**",
+  // Test outputs
+  "**/test-results/**",
+  "**/playwright-report/**",
+  // Misc
+  "**/.docusaurus/**",
+  "**/.vitepress/cache/**"
 ];
 function isSkippablePatternError(error) {
   const msg = error.message.toLowerCase();
@@ -645,8 +912,8 @@ function classifyEcosystemType(msg) {
   return "foreign-rule";
 }
 async function loadPluginModuleFromCwd(cwd) {
-  const { createRequire: createRequire2 } = await import("module");
-  const requireFromCwd = createRequire2(import_path.default.join(cwd, "package.json"));
+  const { createRequire: createRequire3 } = await import("module");
+  const requireFromCwd = createRequire3(import_path.default.join(cwd, "package.json"));
   try {
     const resolved = requireFromCwd.resolve("eslint-plugin-ai-guard");
     return import((0, import_url.pathToFileURL)(resolved).href);
@@ -669,50 +936,44 @@ async function loadPluginModuleFromCwd(cwd) {
     "eslint-plugin-ai-guard is not installed. Run: npm install --save-dev eslint-plugin-ai-guard"
   );
 }
-async function runEslint(options) {
-  const overallStart = Date.now();
-  const timing = {
-    pluginLoadMs: 0,
-    parserLoadMs: 0,
-    lintMs: 0,
-    processMs: 0
-  };
-  const { ESLint } = await import("eslint").catch(() => {
-    throw new Error(
-      "ESLint is not installed. Run: npm install --save-dev eslint"
-    );
-  });
-  const pluginStart = Date.now();
-  const rawPlugin = await loadPluginModuleFromCwd(process.cwd());
-  const plugin = normalizePlugin(rawPlugin);
-  timing.pluginLoadMs = Date.now() - pluginStart;
-  const rules = getRules(options.preset);
-  const resolvedTargetPath = import_path.default.resolve(options.targetPath);
-  if (!import_fs.default.existsSync(resolvedTargetPath)) {
-    throw new Error(`Path not found: ${options.targetPath}`);
+async function getOrBuildRunner(cwd, preset, eslintCwd) {
+  const cacheKey = `${eslintCwd}::${preset}`;
+  const cached = _runnerCache.get(cacheKey);
+  if (cached) {
+    return { runner: cached, fromCache: true };
   }
-  const targetStat = import_fs.default.statSync(resolvedTargetPath);
-  const isSingleFileTarget = targetStat.isFile();
-  const eslintCwd = isSingleFileTarget ? import_path.default.dirname(resolvedTargetPath) : resolvedTargetPath;
-  const parserStart = Date.now();
-  let tsParser = null;
-  let tsParserAvailable = false;
-  try {
-    try {
-      tsParser = require(import_path.default.join(
-        process.cwd(),
-        "node_modules",
-        "@typescript-eslint",
-        "parser"
-      ));
-    } catch {
-      tsParser = require("@typescript-eslint/parser");
-    }
-    tsParserAvailable = true;
-  } catch {
-    log.debug("@typescript-eslint/parser not found \u2014 TypeScript files will use espree fallback");
-  }
-  timing.parserLoadMs = Date.now() - parserStart;
+  const [{ ESLint }, rawPlugin, tsParserResult] = await Promise.all([
+    // 1. Load ESLint
+    import("eslint").catch(() => {
+      throw new Error("ESLint is not installed. Run: npm install --save-dev eslint");
+    }),
+    // 2. Load plugin
+    loadPluginModuleFromCwd(cwd),
+    // 3. Load TS parser (optional — errors are caught)
+    Promise.resolve().then(() => {
+      const parserStart = Date.now();
+      try {
+        let tsParser2;
+        try {
+          tsParser2 = require(import_path.default.join(
+            cwd,
+            "node_modules",
+            "@typescript-eslint",
+            "parser"
+          ));
+        } catch {
+          tsParser2 = require("@typescript-eslint/parser");
+        }
+        return { tsParser: tsParser2, available: true, loadMs: Date.now() - parserStart };
+      } catch {
+        log.debug("@typescript-eslint/parser not found \u2014 TypeScript files will use espree fallback");
+        return { tsParser: null, available: false, loadMs: Date.now() - parserStart };
+      }
+    })
+  ]);
+  const plugin = normalizePlugin(rawPlugin);
+  const rules = getRules(preset);
+  const { tsParser, available: tsParserAvailable } = tsParserResult;
   const JS_TS_FILES = [
     "**/*.js",
     "**/*.jsx",
@@ -724,7 +985,9 @@ async function runEslint(options) {
     "**/*.cjs"
   ];
   const configBlocks = [
-    // JS/JSX files — default espree parser with JSX support
+    // Ignore block first — ESLint can skip excluded files without processing
+    { ignores: DEFAULT_IGNORE_PATTERNS },
+    // JS/JSX — espree parser with JSX support
     {
       files: ["**/*.js", "**/*.jsx", "**/*.mjs", "**/*.cjs"],
       plugins: { "ai-guard": plugin },
@@ -736,12 +999,10 @@ async function runEslint(options) {
         }
       },
       rules
-    },
-    // Ignore generated directories
-    { ignores: DEFAULT_IGNORE_PATTERNS }
+    }
   ];
   if (tsParser) {
-    configBlocks.splice(1, 0, {
+    configBlocks.push({
       files: ["**/*.ts", "**/*.tsx", "**/*.mts", "**/*.cts"],
       plugins: { "ai-guard": plugin },
       languageOptions: {
@@ -755,7 +1016,7 @@ async function runEslint(options) {
       rules
     });
   } else {
-    configBlocks.splice(1, 0, {
+    configBlocks.push({
       files: ["**/*.ts", "**/*.tsx", "**/*.mts", "**/*.cts"],
       plugins: { "ai-guard": plugin },
       languageOptions: {
@@ -773,16 +1034,58 @@ async function runEslint(options) {
     overrideConfigFile: true,
     overrideConfig: configBlocks
   });
-  const patterns = isSingleFileTarget ? [import_path.default.basename(resolvedTargetPath)] : JS_TS_FILES;
+  const runner = {
+    eslint,
+    tsParserAvailable,
+    pluginLoadMs: 0,
+    // accounted in parallel Promise.all
+    parserLoadMs: tsParserResult.loadMs
+  };
+  _runnerCache.set(cacheKey, runner);
+  return { runner, fromCache: false };
+}
+var JS_TS_FILE_PATTERNS = [
+  "**/*.js",
+  "**/*.jsx",
+  "**/*.ts",
+  "**/*.tsx",
+  "**/*.mts",
+  "**/*.cts",
+  "**/*.mjs",
+  "**/*.cjs"
+];
+async function runEslint(options) {
+  const overallStart = Date.now();
+  const resolvedTargetPath = import_path.default.resolve(options.targetPath);
+  if (!import_fs.default.existsSync(resolvedTargetPath)) {
+    throw new Error(`Path not found: ${options.targetPath}`);
+  }
+  const targetStat = import_fs.default.statSync(resolvedTargetPath);
+  const isSingleFileTarget = targetStat.isFile();
+  const eslintCwd = isSingleFileTarget ? import_path.default.dirname(resolvedTargetPath) : resolvedTargetPath;
+  const cwd = process.cwd();
+  const initStart = Date.now();
+  const { runner, fromCache } = await getOrBuildRunner(cwd, options.preset, eslintCwd);
+  const initMs = Date.now() - initStart;
+  const timing = {
+    pluginLoadMs: fromCache ? 0 : runner.pluginLoadMs,
+    parserLoadMs: fromCache ? 0 : runner.parserLoadMs,
+    lintMs: 0,
+    processMs: 0,
+    fromCache
+  };
+  const hasExplicitFiles = options.files && options.files.length > 0;
+  const patterns = hasExplicitFiles ? options.files : isSingleFileTarget ? [import_path.default.basename(resolvedTargetPath)] : JS_TS_FILE_PATTERNS;
   const lintStart = Date.now();
   let rawResults;
+  const eslint = runner.eslint;
   try {
     rawResults = await eslint.lintFiles(patterns);
   } catch (err) {
     const error = err instanceof Error ? err : new Error(String(err));
     if (isSkippablePatternError(error)) {
-      log.debug("Single-call lintFiles failed with no-files, falling back to per-pattern");
-      const perPatternResults = await Promise.all(
+      log.debug("Single-call lintFiles failed, falling back to per-pattern");
+      const perPatternResults = await Promise.allSettled(
         patterns.map(async (pattern) => {
           try {
             return await eslint.lintFiles([pattern]);
@@ -796,8 +1099,10 @@ async function runEslint(options) {
           }
         })
       );
-      rawResults = perPatternResults.flat();
+      rawResults = perPatternResults.filter((r) => r.status === "fulfilled").flatMap((r) => r.value);
     } else {
+      const cacheKey = `${eslintCwd}::${options.preset}`;
+      _runnerCache.delete(cacheKey);
       throw error;
     }
   }
@@ -812,7 +1117,7 @@ async function runEslint(options) {
   const filesScanned = rawResults.length;
   for (const result of rawResults) {
     if (result.messages.length === 0) continue;
-    const relPath = import_path.default.relative(process.cwd(), result.filePath);
+    const relPath = import_path.default.relative(cwd, result.filePath);
     const aiGuardIssues = [];
     let fileErrors = 0;
     let fileWarnings = 0;
@@ -837,12 +1142,19 @@ async function runEslint(options) {
         });
         continue;
       }
+      const ruleId = m.ruleId ?? "unknown";
       const issue = {
-        ruleId: m.ruleId ?? "unknown",
+        ruleId,
         severity: m.severity,
         message: m.message,
         line: m.line,
-        column: m.column
+        column: m.column,
+        endLine: m.endLine,
+        endColumn: m.endColumn,
+        confidence: ISSUE_CONFIDENCE[ruleId],
+        category: ISSUE_CATEGORY[ruleId],
+        asyncRiskType: ISSUE_ASYNC_RISK_TYPE[ruleId],
+        remediation: ISSUE_REMEDIATION[ruleId]
       };
       aiGuardIssues.push(issue);
       if (m.severity === 2) {
@@ -869,11 +1181,12 @@ async function runEslint(options) {
   const topFiles = [...files].sort((a, b) => b.issues.length - a.issues.length).slice(0, 10).map((f) => ({ path: f.filePath, count: f.issues.length }));
   timing.processMs = Date.now() - processStart;
   if (options.debugTiming) {
-    log.debug(`Plugin load: ${timing.pluginLoadMs}ms`);
-    log.debug(`Parser load: ${timing.parserLoadMs}ms`);
-    log.debug(`Lint: ${timing.lintMs}ms`);
+    const totalMs = Date.now() - overallStart;
+    const cacheLabel = fromCache ? import_chalk2.default.green("warm cache") : import_chalk2.default.yellow("cold start");
+    log.debug(`Init:    ${initMs}ms (${cacheLabel})`);
+    log.debug(`Lint:    ${timing.lintMs}ms`);
     log.debug(`Process: ${timing.processMs}ms`);
-    log.debug(`Total: ${Date.now() - overallStart}ms`);
+    log.debug(`Total:   ${totalMs}ms | Files: ${filesScanned} | ${filesScanned > 0 ? Math.round(totalMs / filesScanned) : 0}ms/file`);
   }
   return {
     files,
@@ -887,17 +1200,698 @@ async function runEslint(options) {
     timing,
     ecosystemIssues,
     parserErrors,
-    tsParserAvailable
+    tsParserAvailable: runner.tsParserAvailable
+  };
+}
+
+// cli/utils/version.ts
+var import_module = require("module");
+var import_url2 = require("url");
+var import_path2 = __toESM(require("path"));
+var import_meta = {};
+var _version;
+function readVersion() {
+  try {
+    const require_ = (0, import_module.createRequire)(import_meta.url);
+    const pkgPath = import_path2.default.resolve(
+      import_path2.default.dirname((0, import_url2.fileURLToPath)(import_meta.url)),
+      "../../package.json"
+    );
+    const pkg = require_(pkgPath);
+    if (pkg.version) return pkg.version;
+  } catch {
+  }
+  if (typeof __PKG_VERSION__ !== "undefined") {
+    return __PKG_VERSION__;
+  }
+  return "0.0.0";
+}
+var PKG_VERSION = _version ?? (_version = readVersion());
+
+// cli/utils/sarif.ts
+var RULE_DOCS = {
+  "ai-guard/no-empty-catch": { shortDesc: "Empty catch block silently swallows errors", tags: ["reliability"] },
+  "ai-guard/no-broad-exception": { shortDesc: "Catching broad Exception/Error masks specific failures", tags: ["reliability"] },
+  "ai-guard/no-catch-log-rethrow": { shortDesc: "Catch block logs and rethrows \u2014 use one or the other", tags: ["reliability"] },
+  "ai-guard/no-catch-without-use": { shortDesc: "Caught error variable is not used", tags: ["reliability"] },
+  "ai-guard/no-floating-promise": { shortDesc: "Promise not awaited or error-handled \u2014 async failures will be silently swallowed", tags: ["async", "async-reliability"] },
+  "ai-guard/no-await-in-loop": { shortDesc: "Sequential await in loop \u2014 consider Promise.all for parallel execution", tags: ["async", "async-reliability", "performance"] },
+  "ai-guard/no-async-without-await": { shortDesc: "Async function contains no await expressions", tags: ["async", "async-reliability"] },
+  "ai-guard/no-async-array-callback": { shortDesc: "Async callback in array method may not behave as expected", tags: ["async", "async-reliability"] },
+  "ai-guard/no-redundant-await": { shortDesc: "Redundant await on already-resolved value", tags: ["async"] },
+  "ai-guard/no-hardcoded-secret": { shortDesc: "Hardcoded secret or credential detected", tags: ["security", "secrets"] },
+  "ai-guard/no-eval-dynamic": { shortDesc: "Dynamic eval or Function constructor is dangerous", tags: ["security"] },
+  "ai-guard/no-sql-string-concat": { shortDesc: "SQL query built via string concatenation \u2014 SQL injection risk", tags: ["security", "injection"] },
+  "ai-guard/no-unsafe-deserialize": { shortDesc: "Unsafe deserialization of untrusted data", tags: ["security"] },
+  "ai-guard/require-auth-middleware": { shortDesc: "Route handler appears to lack authentication middleware", tags: ["security", "auth"] },
+  "ai-guard/require-authz-check": { shortDesc: "Handler lacks authorization check", tags: ["security", "auth"] },
+  "ai-guard/no-console-in-handler": { shortDesc: "console.log in request handler \u2014 use structured logging", tags: ["ai-patterns"] },
+  "ai-guard/no-duplicate-logic-block": { shortDesc: "Duplicate logic block detected", tags: ["ai-patterns"] },
+  "ai-guard/no-dead-branch": { shortDesc: "Dead code branch that can never execute", tags: ["ai-patterns"] }
+};
+var BASE_DOCS_URL = "https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules";
+function confidenceToSarifLevel(confidence) {
+  switch (confidence) {
+    case "high":
+      return "error";
+    case "medium":
+      return "warning";
+    case "low":
+      return "warning";
+    case "informational":
+      return "note";
+    default:
+      return "warning";
+  }
+}
+function confidenceToRank(confidence) {
+  switch (confidence) {
+    case "high":
+      return 90;
+    case "medium":
+      return 60;
+    case "low":
+      return 30;
+    case "informational":
+      return 10;
+    default:
+      return 30;
+  }
+}
+function confidenceToGitHubSeverity(confidence) {
+  switch (confidence) {
+    case "high":
+      return "high";
+    case "medium":
+      return "medium";
+    case "low":
+      return "low";
+    case "informational":
+      return "recommendation";
+    default:
+      return "low";
+  }
+}
+function filePathToUri(filePath) {
+  return filePath.replace(/\\/g, "/");
+}
+function collectUsedRuleIds(result) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const file of result.files) {
+    for (const issue of file.issues) {
+      ids.add(issue.ruleId);
+    }
+  }
+  return [...ids].sort();
+}
+function buildRuleDescriptors(ruleIds) {
+  return ruleIds.map((id) => {
+    const meta = RULE_DOCS[id];
+    const shortName = id.replace("ai-guard/", "");
+    const confidence = ISSUE_CONFIDENCE[id];
+    const category = ISSUE_CATEGORY[id] ?? "AI Patterns";
+    const remediation = ISSUE_REMEDIATION[id];
+    const helpMarkdown = [
+      `**${meta?.shortDesc ?? shortName}**`,
+      "",
+      remediation ? `**Fix:** ${remediation}` : "",
+      "",
+      `[View rule documentation](${BASE_DOCS_URL}/${shortName}.md)`
+    ].filter(Boolean).join("\n");
+    return {
+      id,
+      shortDescription: {
+        text: meta?.shortDesc ?? `ai-guard rule: ${shortName}`
+      },
+      fullDescription: {
+        text: meta?.shortDesc ?? `ai-guard rule: ${shortName}`
+      },
+      help: {
+        text: remediation ?? meta?.shortDesc ?? shortName,
+        markdown: helpMarkdown
+      },
+      helpUri: `${BASE_DOCS_URL}/${shortName}.md`,
+      defaultConfiguration: {
+        level: confidenceToSarifLevel(confidence)
+      },
+      properties: {
+        tags: [...meta?.tags ?? ["ai-guard"], category.toLowerCase().replace(/ /g, "-")],
+        confidence: confidence ?? "low",
+        category,
+        "problem.severity": confidenceToGitHubSeverity(confidence)
+      }
+    };
+  });
+}
+function buildSarifResult(issue, file) {
+  const confidence = ISSUE_CONFIDENCE[issue.ruleId];
+  const asyncRiskType = ISSUE_ASYNC_RISK_TYPE[issue.ruleId];
+  const category = ISSUE_CATEGORY[issue.ruleId];
+  return {
+    ruleId: issue.ruleId,
+    level: confidenceToSarifLevel(confidence),
+    kind: confidence === "informational" ? "informational" : "fail",
+    rank: confidenceToRank(confidence),
+    message: { text: issue.message },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: {
+            uri: filePathToUri(file.filePath),
+            uriBaseId: "%SRCROOT%"
+          },
+          region: {
+            startLine: Math.max(1, issue.line),
+            startColumn: issue.column > 0 ? issue.column : 1,
+            ...issue.endLine !== void 0 && { endLine: issue.endLine },
+            ...issue.endColumn !== void 0 && { endColumn: issue.endColumn }
+          }
+        },
+        message: { text: issue.message }
+      }
+    ],
+    properties: {
+      confidence: confidence ?? "low",
+      ...asyncRiskType && { asyncRiskType },
+      ...category && { category }
+    }
+  };
+}
+function buildSarifLog(result, version = PKG_VERSION) {
+  const usedRuleIds = collectUsedRuleIds(result);
+  const rules = buildRuleDescriptors(usedRuleIds);
+  const sarifResults = [];
+  for (const file of result.files) {
+    for (const issue of file.issues) {
+      sarifResults.push(buildSarifResult(issue, file));
+    }
+  }
+  return {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "ai-guard",
+            version,
+            informationUri: "https://github.com/YashJadhav21/eslint-plugin-ai-guard",
+            rules
+          }
+        },
+        results: sarifResults,
+        properties: {
+          preset: "recommended",
+          filesScanned: result.filesScanned,
+          durationMs: result.durationMs,
+          ecosystemIssuesCount: result.ecosystemIssues.length,
+          parserErrorsCount: result.parserErrors.length
+        }
+      }
+    ]
+  };
+}
+function sarifToJson(log2) {
+  return JSON.stringify(log2, null, 2);
+}
+
+// cli/utils/github-summary.ts
+var import_fs2 = __toESM(require("fs"));
+function warnEnvIssue(name, filePath, err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  process.stderr.write(
+    `[ai-guard] Warning: Could not write to ${name}=${filePath}: ${msg}
+`
+  );
+}
+function escapeMarkdown(text) {
+  return text.replace(/[|`*_[\]<>]/g, "\\$&");
+}
+function tierEmoji(tier) {
+  switch (tier) {
+    case "high":
+      return "\u{1F534}";
+    case "medium":
+      return "\u{1F7E1}";
+    case "low":
+      return "\u{1F535}";
+    case "informational":
+      return "\u2B1C";
+    default:
+      return "\u2B1C";
+  }
+}
+function tierLabel(tier) {
+  switch (tier) {
+    case "high":
+      return "High";
+    case "medium":
+      return "Medium";
+    case "low":
+      return "Low";
+    case "informational":
+      return "Info";
+    default:
+      return "Low";
+  }
+}
+function emitGitHubAnnotations(result) {
+  if (process.env.GITHUB_ACTIONS !== "true") return;
+  for (const file of result.files) {
+    for (const issue of file.issues) {
+      const tier = CONFIDENCE_TIER[issue.ruleId];
+      if (tier === "informational") continue;
+      const level = issue.severity === 2 ? "error" : "warning";
+      const filePath = file.filePath.replace(/\\/g, "/");
+      const shortRule = issue.ruleId.replace("ai-guard/", "");
+      const parts = [`file=${filePath}`, `line=${issue.line}`];
+      if (issue.endLine) parts.push(`endLine=${issue.endLine}`);
+      if (issue.column > 0) parts.push(`col=${issue.column}`);
+      if (issue.endColumn) parts.push(`endColumn=${issue.endColumn}`);
+      parts.push(`title=ai-guard/${shortRule}`);
+      const msg = issue.message.replace(/\n/g, " ");
+      process.stdout.write(`::${level} ${parts.join(",")}::${msg}
+`);
+    }
+  }
+}
+function buildGitHubSummaryMarkdown(result, options) {
+  const lines = [];
+  lines.push("## AI Guard \u2014 Async Reliability Report");
+  lines.push("");
+  lines.push(`> **Preset:** \`${options.preset}\` &nbsp;|&nbsp; **Mode:** ${options.scanMode === "changed" ? "Changed files only" : options.scanMode === "staged" ? "Staged files" : "Full scan"}`);
+  if (options.changedFilesCount !== void 0) {
+    lines.push(`> **Files scanned:** ${result.filesScanned} (${options.changedFilesCount} changed)`);
+  } else {
+    lines.push(`> **Files scanned:** ${result.filesScanned}`);
+  }
+  lines.push(`> **Duration:** ${result.durationMs}ms`);
+  lines.push("");
+  if (result.totalIssues === 0) {
+    lines.push("### \u2705 No issues found");
+    lines.push("");
+    lines.push("All scanned files passed AI Guard reliability checks.");
+    lines.push("");
+    return lines.join("\n");
+  }
+  const { high = 0, medium = 0, low = 0, informational = 0 } = buildSignalCounts(result);
+  if (high > 0) {
+    lines.push(`### \u26A0\uFE0F ${high} high-confidence issue${high !== 1 ? "s" : ""} found`);
+  } else if (medium > 0) {
+    lines.push(`### \u{1F535} ${medium} medium-confidence issue${medium !== 1 ? "s" : ""} found`);
+  } else {
+    lines.push("### \u2139\uFE0F Informational hints only");
+  }
+  lines.push("");
+  lines.push("| Category | \u{1F534} High | \u{1F7E1} Medium | \u{1F535} Low | \u2B1C Info |");
+  lines.push("|----------|---------|----------|-------|--------|");
+  const categoryBreakdown = buildCategoryBreakdown(result);
+  for (const [cat, counts] of Object.entries(categoryBreakdown)) {
+    if (counts.high + counts.medium + counts.low + counts.informational === 0) continue;
+    lines.push(`| ${cat} | ${counts.high} | ${counts.medium} | ${counts.low} | ${counts.informational} |`);
+  }
+  lines.push("");
+  const allIssues = result.files.flatMap(
+    (f) => f.issues.map((i) => ({ ...i, filePath: f.filePath }))
+  );
+  const actionableIssues = allIssues.filter((i) => {
+    const tier = CONFIDENCE_TIER[i.ruleId];
+    return tier !== "informational";
+  }).sort((a, b) => {
+    const tierOrder = { high: 0, medium: 1, low: 2, informational: 3 };
+    const ta = CONFIDENCE_TIER[a.ruleId];
+    const tb = CONFIDENCE_TIER[b.ruleId];
+    return (tierOrder[ta ?? "low"] ?? 2) - (tierOrder[tb ?? "low"] ?? 2);
+  }).slice(0, 10);
+  if (actionableIssues.length > 0) {
+    lines.push("### Top Findings");
+    lines.push("");
+    lines.push("| File | Line | Rule | Confidence |");
+    lines.push("|------|------|------|------------|");
+    for (const issue of actionableIssues) {
+      const tier = CONFIDENCE_TIER[issue.ruleId];
+      const shortFile = issue.filePath.replace(/\\/g, "/").split("/").slice(-2).join("/");
+      const shortRule = issue.ruleId.replace("ai-guard/", "");
+      lines.push(
+        `| \`${escapeMarkdown(shortFile)}\` | ${issue.line} | \`${shortRule}\` | ${tierEmoji(tier)} ${tierLabel(tier)} |`
+      );
+    }
+    lines.push("");
+  }
+  if (informational > 0) {
+    lines.push("<details>");
+    lines.push(`<summary>\u{1F4A1} ${informational} informational hint${informational !== 1 ? "s" : ""} (click to expand)</summary>`);
+    lines.push("");
+    lines.push("These are stylistic hints with higher false-positive rates in frameworks like Next.js and React. Review manually before acting.");
+    lines.push("");
+    const infoIssues = allIssues.filter((i) => {
+      const tier = CONFIDENCE_TIER[i.ruleId];
+      return tier === "informational";
+    }).slice(0, 20);
+    lines.push("| File | Line | Rule |");
+    lines.push("|------|------|------|");
+    for (const issue of infoIssues) {
+      const shortFile = issue.filePath.replace(/\\/g, "/").split("/").slice(-2).join("/");
+      const shortRule = issue.ruleId.replace("ai-guard/", "");
+      lines.push(`| \`${escapeMarkdown(shortFile)}\` | ${issue.line} | \`${shortRule}\` |`);
+    }
+    lines.push("</details>");
+    lines.push("");
+  }
+  if (result.ecosystemIssues.length > 0) {
+    lines.push("<details>");
+    lines.push(`<summary>\u{1F527} ${result.ecosystemIssues.length} ESLint config issue${result.ecosystemIssues.length !== 1 ? "s" : ""} (not ai-guard findings)</summary>`);
+    lines.push("");
+    lines.push("These are from your project's ESLint configuration, not from ai-guard rules. Run `ai-guard doctor` to diagnose.");
+    lines.push("</details>");
+    lines.push("");
+  }
+  lines.push("---");
+  lines.push("");
+  lines.push("**Next steps:**");
+  if (high > 0 || medium > 0) {
+    lines.push("- Review high/medium confidence findings in the **Files changed** tab");
+    lines.push("- Run `ai-guard run --verbose` locally to see full details");
+  }
+  if (informational > 0) {
+    lines.push("- Run `ai-guard run --verbose` to expand informational hints");
+  }
+  lines.push("- Run `ai-guard baseline` to suppress known issues and track only new ones");
+  lines.push("");
+  lines.push("*Powered by [eslint-plugin-ai-guard](https://github.com/YashJadhav21/eslint-plugin-ai-guard)*");
+  return lines.join("\n");
+}
+function buildSignalCounts(result) {
+  let high = 0, medium = 0, low = 0, informational = 0;
+  for (const file of result.files) {
+    for (const issue of file.issues) {
+      const tier = CONFIDENCE_TIER[issue.ruleId];
+      if (tier === "high") high++;
+      else if (tier === "medium") medium++;
+      else if (tier === "informational") informational++;
+      else low++;
+    }
+  }
+  return { high, medium, low, informational };
+}
+function buildCategoryBreakdown(result) {
+  const breakdown = {};
+  for (const file of result.files) {
+    for (const issue of file.issues) {
+      const cat = RULE_CATEGORY[issue.ruleId] ?? "Other";
+      const tier = CONFIDENCE_TIER[issue.ruleId];
+      if (!breakdown[cat]) breakdown[cat] = { high: 0, medium: 0, low: 0, informational: 0 };
+      if (tier === "high") breakdown[cat].high++;
+      else if (tier === "medium") breakdown[cat].medium++;
+      else if (tier === "informational") breakdown[cat].informational++;
+      else breakdown[cat].low++;
+    }
+  }
+  return breakdown;
+}
+function writeGitHubSummary(result, options) {
+  const summaryPath = process.env.GITHUB_STEP_SUMMARY;
+  if (!summaryPath) return;
+  try {
+    const markdown = buildGitHubSummaryMarkdown(result, options);
+    import_fs2.default.appendFileSync(summaryPath, markdown + "\n", { encoding: "utf-8" });
+  } catch (err) {
+    warnEnvIssue("GITHUB_STEP_SUMMARY", summaryPath, err);
+  }
+}
+function writeGitHubOutputs(result, sarifPath) {
+  const outputPath = process.env.GITHUB_OUTPUT;
+  if (!outputPath) return;
+  const { high, medium, low, informational } = buildSignalCounts(result);
+  const outputs = [
+    `issues-found=${result.totalIssues}`,
+    `high-confidence-count=${high}`,
+    `medium-confidence-count=${medium}`,
+    `low-confidence-count=${low}`,
+    `informational-count=${informational}`,
+    `files-scanned=${result.filesScanned}`,
+    `duration-ms=${result.durationMs}`,
+    ...sarifPath ? [`sarif-file=${sarifPath}`] : []
+  ];
+  try {
+    import_fs2.default.appendFileSync(outputPath, outputs.join("\n") + "\n", { encoding: "utf-8" });
+  } catch (err) {
+    warnEnvIssue("GITHUB_OUTPUT", outputPath, err);
+  }
+}
+
+// cli/utils/git-diff.ts
+var import_child_process = require("child_process");
+var import_path3 = __toESM(require("path"));
+var import_fs3 = __toESM(require("fs"));
+var DEFAULT_EXTENSIONS = [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".mts", ".cts"];
+var IGNORE_PREFIXES = [
+  "node_modules/",
+  "dist/",
+  "build/",
+  ".next/",
+  "out/",
+  "coverage/",
+  ".cache/",
+  ".turbo/",
+  ".nx/",
+  "vendor/",
+  "tmp/",
+  "temp/",
+  "__generated__/",
+  "generated/",
+  "storybook-static/",
+  ".expo/",
+  ".svelte-kit/"
+];
+function runGit(args, cwd) {
+  try {
+    return (0, import_child_process.execSync)(`git ${args}`, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 15e3
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function isGitAvailable(cwd) {
+  return runGit("rev-parse --is-inside-work-tree", cwd) === "true";
+}
+function isShallowClone(cwd) {
+  return runGit("rev-parse --is-shallow-repository", cwd) === "true";
+}
+function isDetachedHead(cwd) {
+  const result = runGit("symbolic-ref --quiet HEAD", cwd);
+  return result === null;
+}
+function normalizeBranchName(ref) {
+  return ref.replace(/^origin\//, "").trim();
+}
+function tryPrDiff(branch, cwd, debugInfo) {
+  const rawBranch = normalizeBranchName(branch);
+  {
+    const strategy = `merge-base HEAD origin/${rawBranch}`;
+    debugInfo.strategiesAttempted.push(strategy);
+    const mergeBase = runGit(`merge-base HEAD origin/${rawBranch}`, cwd);
+    if (mergeBase) {
+      debugInfo.mergeBase = mergeBase;
+      const out = runGit(`diff --name-only --diff-filter=ACMRT ${mergeBase}`, cwd);
+      if (out !== null) {
+        debugInfo.strategySucceeded = strategy;
+        return { output: out, strategy, mergeBase };
+      }
+    }
+  }
+  {
+    const strategy = `merge-base HEAD ${rawBranch}`;
+    debugInfo.strategiesAttempted.push(strategy);
+    const mergeBase = runGit(`merge-base HEAD ${rawBranch}`, cwd);
+    if (mergeBase) {
+      if (!debugInfo.mergeBase) debugInfo.mergeBase = mergeBase;
+      const out = runGit(`diff --name-only --diff-filter=ACMRT ${mergeBase}`, cwd);
+      if (out !== null) {
+        debugInfo.strategySucceeded = strategy;
+        return { output: out, strategy, mergeBase };
+      }
+    }
+  }
+  {
+    const strategy = `diff origin/${rawBranch}...HEAD`;
+    debugInfo.strategiesAttempted.push(strategy);
+    const out = runGit(`diff --name-only --diff-filter=ACMRT origin/${rawBranch}...HEAD`, cwd);
+    if (out !== null) {
+      debugInfo.strategySucceeded = strategy;
+      return { output: out, strategy };
+    }
+  }
+  {
+    const strategy = `diff ${rawBranch}...HEAD`;
+    debugInfo.strategiesAttempted.push(strategy);
+    const out = runGit(`diff --name-only --diff-filter=ACMRT ${rawBranch}...HEAD`, cwd);
+    if (out !== null) {
+      debugInfo.strategySucceeded = strategy;
+      return { output: out, strategy };
+    }
+  }
+  {
+    const strategy = "diff HEAD~1 (shallow fallback)";
+    debugInfo.strategiesAttempted.push(strategy);
+    const out = runGit("diff --name-only --diff-filter=ACMRT HEAD~1", cwd);
+    if (out !== null) {
+      debugInfo.strategySucceeded = strategy;
+      return { output: out, strategy };
+    }
+  }
+  debugInfo.strategySucceeded = null;
+  return null;
+}
+function filterFiles(rawFiles, extensions, workingDirectory, cwd, debugInfo) {
+  const kept = [];
+  for (const rel of rawFiles) {
+    const normalized = rel.replace(/\\/g, "/").trim();
+    if (!normalized) continue;
+    const ext = import_path3.default.extname(normalized).toLowerCase();
+    if (!extensions.includes(ext)) {
+      debugInfo.droppedByExtension++;
+      continue;
+    }
+    if (IGNORE_PREFIXES.some((prefix) => normalized.startsWith(prefix))) {
+      debugInfo.droppedByIgnore++;
+      continue;
+    }
+    if (workingDirectory) {
+      const wdNorm = workingDirectory.replace(/\\/g, "/").replace(/\/$/, "");
+      if (!normalized.startsWith(wdNorm + "/") && normalized !== wdNorm) {
+        debugInfo.droppedByWorkingDir++;
+        continue;
+      }
+    }
+    const abs = import_path3.default.resolve(cwd, normalized);
+    if (!import_fs3.default.existsSync(abs)) {
+      debugInfo.droppedMissing++;
+      continue;
+    }
+    kept.push(abs);
+  }
+  return kept;
+}
+function parseFileList(output) {
+  return output.split("\n").map((f) => f.trim()).filter(Boolean);
+}
+function getChangedFiles(options = {}) {
+  const {
+    staged = false,
+    base,
+    cwd = process.cwd(),
+    extensions = DEFAULT_EXTENSIONS,
+    workingDirectory,
+    debug = false
+  } = options;
+  const debugInfo = {
+    strategiesAttempted: [],
+    strategySucceeded: null,
+    isShallowClone: false,
+    isDetachedHead: false,
+    rawFileCount: 0,
+    droppedByExtension: 0,
+    droppedByIgnore: 0,
+    droppedMissing: 0,
+    droppedByWorkingDir: 0
+  };
+  if (!isGitAvailable(cwd)) {
+    return {
+      files: [],
+      mode: "fallback",
+      totalDetected: 0,
+      filteredOut: 0,
+      debugInfo,
+      zeroFilesReason: "Git is not available in this directory. Run inside a git repository."
+    };
+  }
+  debugInfo.isShallowClone = isShallowClone(cwd);
+  debugInfo.isDetachedHead = isDetachedHead(cwd);
+  const envBase = process.env.GITHUB_BASE_REF ? normalizeBranchName(process.env.GITHUB_BASE_REF) : void 0;
+  const resolvedBranch = base ? normalizeBranchName(base) : envBase;
+  debugInfo.resolvedBase = resolvedBranch;
+  let rawOutput = null;
+  let mode;
+  let usedBase;
+  let zeroFilesReason;
+  if (staged) {
+    rawOutput = runGit("diff --name-only --cached --diff-filter=ACMRT", cwd);
+    mode = "staged";
+    debugInfo.strategiesAttempted.push("git diff --cached");
+    if (rawOutput !== null) debugInfo.strategySucceeded = "git diff --cached";
+    if (!rawOutput) {
+      zeroFilesReason = "No staged files found. Run `git add <files>` before using --staged.";
+    }
+  } else if (resolvedBranch) {
+    mode = "pr-diff";
+    usedBase = resolvedBranch;
+    const diffResult = tryPrDiff(resolvedBranch, cwd, debugInfo);
+    if (diffResult) {
+      rawOutput = diffResult.output;
+    } else {
+      const shallow = debugInfo.isShallowClone ? " Shallow clone detected \u2014 try fetch-depth: 0 in your workflow." : "";
+      const detached = debugInfo.isDetachedHead ? " HEAD is detached \u2014 ensure checkout fetches the branch." : "";
+      zeroFilesReason = `PR diff failed against "${resolvedBranch}". Tried: ${debugInfo.strategiesAttempted.join(", ")}.${shallow}${detached} Run with --debug-git for full diagnosis.`;
+    }
+  } else {
+    mode = "uncommitted";
+    const staged_ = runGit("diff --name-only --cached --diff-filter=ACMRT", cwd) ?? "";
+    const unstaged = runGit("diff --name-only --diff-filter=ACMRT", cwd) ?? "";
+    debugInfo.strategiesAttempted.push("git diff --cached", "git diff (unstaged)");
+    const combined = /* @__PURE__ */ new Set([...parseFileList(staged_), ...parseFileList(unstaged)]);
+    rawOutput = [...combined].join("\n");
+    if (rawOutput) debugInfo.strategySucceeded = "uncommitted changes";
+    if (!rawOutput) {
+      zeroFilesReason = "No uncommitted changes found. Use --pr to scan PR changes, or --staged for staged files.";
+    }
+  }
+  if (!rawOutput) {
+    return {
+      files: [],
+      mode,
+      base: usedBase,
+      totalDetected: 0,
+      filteredOut: 0,
+      debugInfo,
+      zeroFilesReason
+    };
+  }
+  const rawFiles = parseFileList(rawOutput);
+  debugInfo.rawFileCount = rawFiles.length;
+  const kept = filterFiles(rawFiles, extensions, workingDirectory, cwd, debugInfo);
+  const dropped = debugInfo.droppedByExtension + debugInfo.droppedByIgnore + debugInfo.droppedByWorkingDir + debugInfo.droppedMissing;
+  if (kept.length === 0 && rawFiles.length > 0) {
+    zeroFilesReason = `${rawFiles.length} changed file${rawFiles.length !== 1 ? "s" : ""} detected but all filtered out. Extension filter: ${debugInfo.droppedByExtension}, ignored paths: ${debugInfo.droppedByIgnore}, missing from disk: ${debugInfo.droppedMissing}.`;
+  }
+  return {
+    files: kept,
+    mode,
+    base: usedBase,
+    totalDetected: rawFiles.length,
+    filteredOut: dropped,
+    debugInfo,
+    zeroFilesReason: kept.length === 0 ? zeroFilesReason : void 0
   };
 }
+function isGitHubActions() {
+  return process.env.GITHUB_ACTIONS === "true";
+}
+function getGitHubBaseRef() {
+  return process.env.GITHUB_BASE_REF || void 0;
+}
 
 // cli/commands/run.ts
 function registerRunCommand(program2) {
-  program2.command("run").description("Run ai-guard rules on your project (zero ESLint config required)").option("--path <dir>", "Directory or file to scan", ".").option("--strict", "Use the strict rule preset (all rules at error)").option("--security", "Use the security-only rule preset").option("--json", "Output results as JSON (CI-friendly)").option(
+  program2.command("run").description("Run ai-guard rules on your project (zero ESLint config required)").option("--path <dir>", "Directory or file to scan", ".").option("--strict", "Use the strict rule preset (all rules at error)").option("--security", "Use the security-only rule preset").option("--json", "Output results as JSON (CI-friendly)").option("--sarif", "Output results as SARIF 2.1.0 (for GitHub Code Scanning)").option("--fail-on <level>", "Fail CI on: errors (default) | high | medium | any | none", "errors").option(
     "--max-warnings <n>",
     "Fail with exit code 1 if warnings exceed this count",
     (value) => Number.parseInt(value, 10)
-  ).option("--verbose", "Show all issues \u2014 disable grouping of repeated warnings").option("--debug-timing", "Print per-phase timing diagnostics").action(async (opts) => {
+  ).option("--verbose", "Show all issues \u2014 disable grouping of repeated warnings").option("--quiet", "Only show errors \u2014 suppress warnings and informational hints").option("--debug-timing", "Print per-phase timing diagnostics").action(async (opts) => {
     if (opts.maxWarnings !== void 0 && (!Number.isInteger(opts.maxWarnings) || opts.maxWarnings < 0)) {
       log.blank();
       log.error("--max-warnings must be a non-negative integer.");
@@ -930,21 +1924,33 @@ function registerRunCommand(program2) {
         log.blank();
         log.error("TypeScript detected but parser not found.");
         log.blank();
-        log.print(`  ${import_chalk2.default.bold("Install the TypeScript parser:")}`);
+        log.print(`  ${import_chalk3.default.bold("Install the TypeScript parser:")}`);
         log.blank();
-        log.print(`    ${import_chalk2.default.cyan("npm install --save-dev @typescript-eslint/parser")}`);
+        log.print(`    ${import_chalk3.default.cyan("npm install --save-dev @typescript-eslint/parser")}`);
         log.blank();
       } else {
         log.blank();
         log.error(msg);
         log.blank();
-        log.print(`  ${import_chalk2.default.bold("Fix:")} Run ${import_chalk2.default.cyan("ai-guard doctor")} to diagnose your setup.`);
+        log.print(`  ${import_chalk3.default.bold("Fix:")} Run ${import_chalk3.default.cyan("ai-guard doctor")} to diagnose your setup.`);
         log.blank();
       }
       process.exit(1);
       return;
     }
+    if (isGitHubActions()) {
+      emitGitHubAnnotations(result);
+      writeGitHubSummary(result, { preset, scanMode: "full" });
+      writeGitHubOutputs(result);
+    }
+    if (opts.sarif) {
+      const sarifLog = buildSarifLog(result);
+      console.log(sarifToJson(sarifLog));
+      process.exit(resolveExitCode(result, opts.failOn ?? "errors", opts.maxWarnings));
+      return;
+    }
     if (opts.json) {
+      const signalSummary = buildSignalSummary(result);
       const jsonOutput = {
         preset,
         scannedPath: opts.path,
@@ -954,6 +1960,7 @@ function registerRunCommand(program2) {
         totalIssues: result.totalIssues,
         durationMs: result.durationMs,
         timing: result.timing,
+        signalSummary,
         ruleBreakdown: Object.fromEntries(result.ruleBreakdown),
         topFiles: result.topFiles,
         files: result.files,
@@ -962,19 +1969,19 @@ function registerRunCommand(program2) {
         tsParserAvailable: result.tsParserAvailable
       };
       console.log(JSON.stringify(jsonOutput, null, 2));
-      process.exit(getRunExitCode(result, opts.maxWarnings));
+      process.exit(resolveExitCode(result, opts.failOn ?? "errors", opts.maxWarnings));
       return;
     }
     log.scanStats(result.filesScanned, result.files.length, result.durationMs, preset);
     if (!result.tsParserAvailable) {
       log.print(
-        import_chalk2.default.dim(`  \u2139  TypeScript parser not found \u2014 .ts/.tsx files use espree fallback`) + import_chalk2.default.dim(`  (install @typescript-eslint/parser for full TS support)`)
+        import_chalk3.default.dim(`  \u2139  TypeScript parser not found \u2014 .ts/.tsx files use espree fallback`) + import_chalk3.default.dim(`  (install @typescript-eslint/parser for full TS support)`)
       );
     }
     log.blank();
     if (result.totalIssues === 0 && result.ecosystemIssues.length === 0 && result.parserErrors.length === 0) {
       log.print(
-        `  ${import_chalk2.default.green("\u2714")}  ${import_chalk2.default.bold.green("No AI issues found")}  ${import_chalk2.default.gray(`\u2014 ${result.filesScanned} file${result.filesScanned !== 1 ? "s" : ""} scanned, all clean`)}`
+        `  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold.green("No AI issues found")}  ${import_chalk3.default.gray(`\u2014 ${result.filesScanned} file${result.filesScanned !== 1 ? "s" : ""} scanned, all clean`)}`
       );
       log.blank();
       process.exit(0);
@@ -982,15 +1989,18 @@ function registerRunCommand(program2) {
     }
     if (result.totalIssues === 0) {
       log.print(
-        `  ${import_chalk2.default.green("\u2714")}  ${import_chalk2.default.bold.green("No AI issues found")}  ${import_chalk2.default.gray(`\u2014 ${result.filesScanned} file${result.filesScanned !== 1 ? "s" : ""} scanned, all clean`)}`
+        `  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold.green("No AI issues found")}  ${import_chalk3.default.gray(`\u2014 ${result.filesScanned} file${result.filesScanned !== 1 ? "s" : ""} scanned, all clean`)}`
       );
       log.blank();
     }
     if (result.totalIssues > 0) {
+      const verbose = opts.verbose ?? false;
+      const quiet = opts.quiet ?? false;
+      const { actionableFiles, informationalFiles } = partitionByTier(result, quiet);
       log.section("Summary by Category");
       const categoryErrors = {};
       const categoryWarnings = {};
-      for (const file of result.files) {
+      for (const file of actionableFiles) {
         for (const issue of file.issues) {
           const cat = RULE_CATEGORY[issue.ruleId] ?? "Other";
           if (issue.severity === 2) {
@@ -1022,7 +2032,7 @@ function registerRunCommand(program2) {
       }
       log.blank();
       log.print(
-        `  ${import_chalk2.default.bold("Total:")} ${formatIssueCount(result.totalErrors, result.totalWarnings)}`
+        `  ${import_chalk3.default.bold("Total:")} ${formatIssueCount(result.totalErrors, result.totalWarnings)}`
       );
       log.blank();
       if (result.ruleBreakdown.size > 0) {
@@ -1033,9 +2043,10 @@ function registerRunCommand(program2) {
         for (const [rule, count] of sorted) {
           const shortRule = rule.replace(/^ai-guard\//, "");
           const tier = CONFIDENCE_TIER[rule];
-          const tierLabel = tier === "high" ? import_chalk2.default.red.dim("[high]") : tier === "medium" ? import_chalk2.default.yellow.dim("[medium]") : import_chalk2.default.gray.dim("[low]");
+          const tierLabel2 = tier === "high" ? import_chalk3.default.red.dim("[high]") : tier === "medium" ? import_chalk3.default.yellow.dim("[medium]") : tier === "informational" ? import_chalk3.default.gray.dim("[info]") : import_chalk3.default.gray.dim("[low]");
+          if (quiet && tier === "informational") continue;
           log.print(
-            `    ${import_chalk2.default.gray("\u2022")} ${import_chalk2.default.yellow(shortRule)} ${tierLabel}${import_chalk2.default.gray(":")} ${import_chalk2.default.white(String(count))}`
+            `    ${import_chalk3.default.gray("\u2022")} ${import_chalk3.default.yellow(shortRule)} ${tierLabel2}${import_chalk3.default.gray(":")} ${import_chalk3.default.white(String(count))}`
           );
         }
         log.blank();
@@ -1044,20 +2055,35 @@ function registerRunCommand(program2) {
         log.section("Top Files");
         for (const { path: fp, count } of result.topFiles) {
           log.print(
-            `    ${import_chalk2.default.gray("\u2022")} ${import_chalk2.default.white(fp)} ${import_chalk2.default.gray(`(${count})`)}`
+            `    ${import_chalk3.default.gray("\u2022")} ${import_chalk3.default.white(fp)} ${import_chalk3.default.gray(`(${count})`)}`
           );
         }
         log.blank();
       }
-      log.section("Issues by File");
-      log.blank();
-      const verbose = opts.verbose ?? false;
-      renderIssuesByFile(result, verbose);
+      if (actionableFiles.length > 0) {
+        log.section("Issues by File");
+        log.blank();
+        renderIssuesByFile({ ...result, files: actionableFiles }, verbose, quiet);
+      }
+      const totalInfoCount = informationalFiles.reduce((n, f) => n + f.issues.length, 0);
+      if (totalInfoCount > 0 && !quiet) {
+        if (verbose) {
+          log.section("Informational Hints");
+          log.print(import_chalk3.default.dim(`  Stylistic hints with higher false-positive rate \u2014 review before acting.`));
+          log.blank();
+          renderIssuesByFile({ ...result, files: informationalFiles }, true, false);
+        } else {
+          log.blank();
+          log.print(
+            `  ${import_chalk3.default.gray("\u25B8")}  ${import_chalk3.default.gray(`${totalInfoCount} informational hint${totalInfoCount !== 1 ? "s" : ""} \u2014 run with ${import_chalk3.default.cyan("--verbose")} to expand`)}`
+          );
+        }
+      }
     }
     if (result.ecosystemIssues.length > 0) {
       log.ecosystemSection("ESLint Config Issues");
       log.print(
-        import_chalk2.default.dim(`  These issues come from your project's ESLint config, not from ai-guard.`)
+        import_chalk3.default.dim(`  These issues come from your project's ESLint config, not from ai-guard.`)
       );
       log.blank();
       const seen = /* @__PURE__ */ new Map();
@@ -1078,7 +2104,7 @@ function registerRunCommand(program2) {
     if (result.parserErrors.length > 0) {
       log.ecosystemSection("Parser Errors");
       log.print(
-        import_chalk2.default.dim(`  These files could not be parsed \u2014 not ai-guard findings.`)
+        import_chalk3.default.dim(`  These files could not be parsed \u2014 not ai-guard findings.`)
       );
       log.blank();
       for (const pe of result.parserErrors) {
@@ -1087,10 +2113,10 @@ function registerRunCommand(program2) {
       if (!result.tsParserAvailable) {
         log.blank();
         log.print(
-          `  ${import_chalk2.default.cyan("\u2192 Fix:")} ${import_chalk2.default.yellow("npm install --save-dev @typescript-eslint/parser")}`
+          `  ${import_chalk3.default.cyan("\u2192 Fix:")} ${import_chalk3.default.yellow("npm install --save-dev @typescript-eslint/parser")}`
         );
         log.print(
-          import_chalk2.default.dim(`  TypeScript parser resolves most .ts/.tsx parse failures.`)
+          import_chalk3.default.dim(`  TypeScript parser resolves most .ts/.tsx parse failures.`)
         );
       }
       log.blank();
@@ -1099,21 +2125,63 @@ function registerRunCommand(program2) {
     log.blank();
     log.section("Next Steps");
     if (result.totalIssues > 0) {
-      log.info(`Run ${import_chalk2.default.cyan("ai-guard baseline")} to save these issues and track only new ones`);
-      log.info(`Run ${import_chalk2.default.cyan("ai-guard report")}   to generate a shareable HTML report`);
-      log.info(`Run ${import_chalk2.default.cyan("ai-guard ignore")}   to suppress dist/build noise`);
+      log.info(`Run ${import_chalk3.default.cyan("ai-guard baseline")} to save these issues and track only new ones`);
+      log.info(`Run ${import_chalk3.default.cyan("ai-guard report")}   to generate a shareable HTML report`);
+      log.info(`Run ${import_chalk3.default.cyan("ai-guard ignore")}   to suppress dist/build noise`);
     }
     if (result.ecosystemIssues.length > 0) {
-      log.info(`Run ${import_chalk2.default.cyan("ai-guard doctor")}   to diagnose ESLint config issues`);
+      log.info(`Run ${import_chalk3.default.cyan("ai-guard doctor")}   to diagnose ESLint config issues`);
     }
     if (!opts.verbose && hasGroupedWarnings(result)) {
-      log.info(`Run with ${import_chalk2.default.cyan("--verbose")} to expand grouped warnings`);
+      log.info(`Run with ${import_chalk3.default.cyan("--verbose")} to expand grouped warnings`);
     }
     log.blank();
     process.exit(getRunExitCode(result, opts.maxWarnings));
   });
 }
 var GROUP_THRESHOLD = 4;
+function partitionByTier(result, quiet) {
+  const actionableFiles = [];
+  const informationalFiles = [];
+  for (const file of result.files) {
+    const actionableIssues = file.issues.filter((i) => {
+      const tier = CONFIDENCE_TIER[i.ruleId];
+      if (quiet && (tier === "informational" || i.severity === 1)) return false;
+      return tier !== "informational";
+    });
+    const infoIssues = file.issues.filter((i) => {
+      const tier = CONFIDENCE_TIER[i.ruleId];
+      return tier === "informational";
+    });
+    if (actionableIssues.length > 0) {
+      actionableFiles.push({ ...file, issues: actionableIssues });
+    }
+    if (infoIssues.length > 0) {
+      informationalFiles.push({ ...file, issues: infoIssues });
+    }
+  }
+  return { actionableFiles, informationalFiles };
+}
+function buildSignalSummary(result) {
+  let high = 0, medium = 0, low = 0, informational = 0;
+  for (const file of result.files) {
+    for (const issue of file.issues) {
+      const tier = CONFIDENCE_TIER[issue.ruleId];
+      if (tier === "high") high++;
+      else if (tier === "medium") medium++;
+      else if (tier === "informational") informational++;
+      else low++;
+    }
+  }
+  return {
+    high,
+    medium,
+    low,
+    informational,
+    ecosystemIssues: result.ecosystemIssues.length,
+    parserErrors: result.parserErrors.length
+  };
+}
 function hasGroupedWarnings(result) {
   for (const file of result.files) {
     const ruleCounts = /* @__PURE__ */ new Map();
@@ -1126,10 +2194,10 @@ function hasGroupedWarnings(result) {
   }
   return false;
 }
-function renderIssuesByFile(result, verbose) {
+function renderIssuesByFile(result, verbose, quiet = false) {
   for (const file of result.files) {
     log.print(
-      `  ${import_chalk2.default.bold.white(file.filePath)} ` + import_chalk2.default.gray(
+      `  ${import_chalk3.default.bold.white(file.filePath)} ` + import_chalk3.default.gray(
         `(${file.errorCount} error${file.errorCount !== 1 ? "s" : ""}, ${file.warningCount} warning${file.warningCount !== 1 ? "s" : ""})`
       )
     );
@@ -1143,13 +2211,13 @@ function renderIssuesByFile(result, verbose) {
       for (const issues of ruleCounts.values()) {
         const tier = CONFIDENCE_TIER[issues[0].ruleId] ?? "low";
         if (tier === "low" && issues.length >= GROUP_THRESHOLD) {
-          const sev = issues[0].severity === 2 ? import_chalk2.default.red("error") : import_chalk2.default.yellow(" warn");
-          const shortRule = import_chalk2.default.gray(issues[0].ruleId.replace(/^ai-guard\//, ""));
+          const sev = issues[0].severity === 2 ? import_chalk3.default.red("error") : import_chalk3.default.yellow(" warn");
+          const shortRule = import_chalk3.default.gray(issues[0].ruleId.replace(/^ai-guard\//, ""));
           log.print(
-            `    ${sev}  ${import_chalk2.default.white(issues[0].message)}  ${shortRule}`
+            `    ${sev}  ${import_chalk3.default.white(issues[0].message)}  ${shortRule}`
           );
           log.print(
-            import_chalk2.default.dim(`           \u21B3 ${issues.length} occurrences \u2014 run with --verbose to expand`)
+            import_chalk3.default.dim(`           \u21B3 ${issues.length} occurrences \u2014 run with --verbose to expand`)
           );
         } else {
           for (const issue of issues) {
@@ -1166,13 +2234,13 @@ function renderIssuesByFile(result, verbose) {
   }
 }
 function renderSingleIssue(issue) {
-  const sev = issue.severity === 2 ? import_chalk2.default.red("error") : import_chalk2.default.yellow(" warn");
-  const loc = import_chalk2.default.gray(`${String(issue.line)}:${String(issue.column)}`).padEnd(12);
-  const ruleShort = import_chalk2.default.gray(issue.ruleId.replace(/^ai-guard\//, ""));
+  const sev = issue.severity === 2 ? import_chalk3.default.red("error") : import_chalk3.default.yellow(" warn");
+  const loc = import_chalk3.default.gray(`${String(issue.line)}:${String(issue.column)}`).padEnd(12);
+  const ruleShort = import_chalk3.default.gray(issue.ruleId.replace(/^ai-guard\//, ""));
   const tier = CONFIDENCE_TIER[issue.ruleId];
-  const tierTag = tier === "high" ? "" : tier === "medium" ? "" : import_chalk2.default.dim(" [low]");
+  const tierTag = tier === "informational" ? import_chalk3.default.dim(" [info]") : "";
   log.print(
-    `    ${loc} ${sev}  ${import_chalk2.default.white(issue.message)}${tierTag}  ${ruleShort}`
+    `    ${loc} ${sev}  ${import_chalk3.default.white(issue.message)}${tierTag}  ${ruleShort}`
   );
 }
 function getRunExitCode(result, maxWarnings) {
@@ -1182,20 +2250,294 @@ function getRunExitCode(result, maxWarnings) {
 }
 function formatIssueCount(errors, warnings) {
   const parts = [];
-  if (errors > 0) parts.push(import_chalk2.default.red.bold(`${errors} error${errors !== 1 ? "s" : ""}`));
-  if (warnings > 0) parts.push(import_chalk2.default.yellow.bold(`${warnings} warning${warnings !== 1 ? "s" : ""}`));
-  return parts.join(import_chalk2.default.gray(" \xB7 "));
+  if (errors > 0) parts.push(import_chalk3.default.red.bold(`${errors} error${errors !== 1 ? "s" : ""}`));
+  if (warnings > 0) parts.push(import_chalk3.default.yellow.bold(`${warnings} warning${warnings !== 1 ? "s" : ""}`));
+  return parts.join(import_chalk3.default.gray(" \xB7 "));
+}
+function resolveExitCode(result, failOn, maxWarnings) {
+  if (maxWarnings !== void 0 && result.totalWarnings > maxWarnings) return 1;
+  switch (failOn) {
+    case "none":
+      return 0;
+    case "errors":
+      return result.totalErrors > 0 ? 1 : 0;
+    case "high": {
+      const high = result.files.flatMap((f) => f.issues).filter((i) => CONFIDENCE_TIER[i.ruleId] === "high").length;
+      return high > 0 ? 1 : 0;
+    }
+    case "medium": {
+      const highMed = result.files.flatMap((f) => f.issues).filter((i) => CONFIDENCE_TIER[i.ruleId] === "high" || CONFIDENCE_TIER[i.ruleId] === "medium").length;
+      return highMed > 0 ? 1 : 0;
+    }
+    case "any": {
+      const actionable = result.files.flatMap((f) => f.issues).filter((i) => CONFIDENCE_TIER[i.ruleId] !== "informational").length;
+      return actionable > 0 ? 1 : 0;
+    }
+    default:
+      return getRunExitCode(result, maxWarnings);
+  }
 }
 
-// cli/commands/init.ts
-var import_chalk3 = __toESM(require("chalk"));
+// cli/commands/changed.ts
 var import_path4 = __toESM(require("path"));
 var import_fs4 = __toESM(require("fs"));
+var import_ora2 = __toESM(require("ora"));
+var import_chalk5 = __toESM(require("chalk"));
+function registerChangedCommand(program2) {
+  program2.command("changed").description("Scan only changed files in the current PR or working tree (fastest CI mode)").option("--pr", "Scan files changed vs base branch (auto-detects GITHUB_BASE_REF in CI)").option("--staged", "Scan only staged (git add'd) files").option("--base <branch>", "Base branch to diff against (raw name: main, develop \u2014 not origin/main)").option("--path <dir>", "Root path / working directory for scanning", ".").option("--strict", "Use the strict rule preset (all rules at error)").option("--security", "Use the security-only rule preset").option("--fail-on <level>", "Fail CI on: high | medium | any | errors | none", "high").option("--json", "Output results as JSON").option("--sarif", "Output results as SARIF 2.1.0 (for GitHub Code Scanning)").option("--sarif-output <file>", "Write SARIF to this file path").option("--sarif-stdout", "Force SARIF to stdout even in CI (overrides auto-file behavior)").option("--github-summary", "Write GitHub step summary (auto-enabled in GitHub Actions)").option(
+    "--max-warnings <n>",
+    "Fail if warnings exceed this count",
+    (v) => Number.parseInt(v, 10)
+  ).option("--verbose", "Expand all findings (disable grouping)").option("--quiet", "Show errors only").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-git", "Print full git resolution trace (useful for diagnosing zero-file issues)").option("--debug-ci", "Print CI environment state (GITHUB_* vars, SARIF path, summary path)").action(async (opts) => {
+    const preset = opts.strict ? "strict" : opts.security ? "security" : "recommended";
+    const inCI = isGitHubActions();
+    const baseRef = opts.base ?? (opts.pr || inCI ? getGitHubBaseRef() : void 0);
+    const sarifToFile = opts.sarif && !opts.sarifStdout && (opts.sarifOutput || inCI);
+    const resolvedSarifPath = opts.sarifOutput ?? (sarifToFile ? "ai-guard-results.sarif" : void 0);
+    if (!opts.json && !opts.sarif) {
+      log.banner("AI GUARD");
+    }
+    if (opts.debugCi) {
+      const { printCIDebug: printCIDebug2 } = await Promise.resolve().then(() => (init_debug(), debug_exports));
+      printCIDebug2({
+        isGitHubActions: inCI,
+        githubBaseRef: process.env.GITHUB_BASE_REF,
+        githubSha: process.env.GITHUB_SHA,
+        githubRef: process.env.GITHUB_REF,
+        githubRepository: process.env.GITHUB_REPOSITORY,
+        githubWorkflow: process.env.GITHUB_WORKFLOW,
+        githubRunId: process.env.GITHUB_RUN_ID,
+        githubEventName: process.env.GITHUB_EVENT_NAME,
+        githubStepSummary: process.env.GITHUB_STEP_SUMMARY,
+        githubOutput: process.env.GITHUB_OUTPUT,
+        sarifOutputPath: resolvedSarifPath,
+        preset,
+        failOn: opts.failOn,
+        scanMode: opts.staged ? "staged" : baseRef ? "pr-diff" : "uncommitted"
+      });
+    }
+    const cwd = process.cwd();
+    const resolvedPath = import_path4.default.resolve(opts.path);
+    const workingDirectory = opts.path !== "." ? opts.path : void 0;
+    const spinner = opts.json || opts.sarif ? null : (0, import_ora2.default)({ text: import_chalk5.default.dim("Detecting changed files\u2026"), color: "cyan" }).start();
+    const changedResult = getChangedFiles({
+      staged: opts.staged ?? false,
+      base: baseRef,
+      cwd,
+      workingDirectory,
+      debug: opts.debugGit
+    });
+    if (opts.debugGit) {
+      const { printGitDebug: printGitDebug2 } = await Promise.resolve().then(() => (init_debug(), debug_exports));
+      printGitDebug2(changedResult);
+    }
+    if (changedResult.files.length === 0) {
+      spinner?.stop();
+      if (changedResult.mode === "fallback") {
+        if (!opts.json && !opts.sarif) {
+          log.warn("Git not available. Falling back to full scan.");
+          log.blank();
+        }
+        const result2 = await runEslint({
+          preset,
+          targetPath: resolvedPath.toString(),
+          debugTiming: opts.debugTiming
+        });
+        handleResults(result2, opts, preset, "full", 0, inCI, resolvedSarifPath);
+        return;
+      }
+      if (!opts.json && !opts.sarif) {
+        log.blank();
+        log.print(`  ${import_chalk5.default.yellow("\u26A0")}  No changed JS/TS files detected \u2014 nothing to scan`);
+        if (changedResult.zeroFilesReason) {
+          log.print(import_chalk5.default.dim(`     ${changedResult.zeroFilesReason}`));
+        }
+        if (changedResult.filteredOut > 0) {
+          log.print(import_chalk5.default.dim(`     (${changedResult.filteredOut} file${changedResult.filteredOut !== 1 ? "s" : ""} filtered out)`));
+        }
+        if (!opts.debugGit) {
+          log.print(import_chalk5.default.dim("     Run with --debug-git for full git resolution trace."));
+        }
+        log.blank();
+      } else if (opts.json) {
+        console.log(JSON.stringify({
+          version: PKG_VERSION,
+          preset,
+          scanMode: changedResult.mode,
+          changedFiles: 0,
+          filesScanned: 0,
+          totalIssues: 0,
+          totalErrors: 0,
+          totalWarnings: 0,
+          zeroFilesReason: changedResult.zeroFilesReason,
+          debugInfo: opts.debugGit ? changedResult.debugInfo : void 0,
+          signalSummary: { high: 0, medium: 0, low: 0, informational: 0, ecosystemIssues: 0, parserErrors: 0 }
+        }, null, 2));
+      }
+      process.exit(0);
+      return;
+    }
+    if (spinner) {
+      spinner.text = import_chalk5.default.dim(`Scanning ${changedResult.files.length} changed file${changedResult.files.length !== 1 ? "s" : ""}\u2026`);
+    }
+    const result = await runEslint({
+      preset,
+      targetPath: resolvedPath.toString(),
+      files: changedResult.files,
+      debugTiming: opts.debugTiming
+    });
+    spinner?.stop();
+    const scanMode = changedResult.mode === "staged" ? "staged" : "changed";
+    handleResults(result, opts, preset, scanMode, changedResult.files.length, inCI, resolvedSarifPath);
+  });
+}
+function handleResults(result, opts, preset, scanMode, changedFilesCount, inCI, resolvedSarifPath) {
+  if (inCI || opts.githubSummary) {
+    writeGitHubSummary(result, { preset, scanMode, changedFilesCount });
+    writeGitHubOutputs(result, opts.sarifOutput);
+    emitGitHubAnnotations(result);
+  }
+  if (opts.sarif) {
+    const sarifLog = buildSarifLog(result);
+    const sarifJson = sarifToJson(sarifLog);
+    if (resolvedSarifPath) {
+      import_fs4.default.writeFileSync(resolvedSarifPath, sarifJson, "utf-8");
+    } else {
+      console.log(sarifJson);
+    }
+    process.exit(getFailOnExitCode(result, opts.failOn, opts.maxWarnings));
+    return;
+  }
+  if (opts.json) {
+    const signalSummary = buildSignalSummary(result);
+    const jsonOutput = {
+      version: PKG_VERSION,
+      preset,
+      scanMode,
+      scannedPath: opts.path,
+      filesScanned: result.filesScanned,
+      changedFilesCount,
+      totalErrors: result.totalErrors,
+      totalWarnings: result.totalWarnings,
+      totalIssues: result.totalIssues,
+      durationMs: result.durationMs,
+      signalSummary,
+      ruleBreakdown: Object.fromEntries(result.ruleBreakdown),
+      topFiles: result.topFiles,
+      files: result.files,
+      ecosystemIssues: result.ecosystemIssues,
+      parserErrors: result.parserErrors,
+      tsParserAvailable: result.tsParserAvailable
+    };
+    console.log(JSON.stringify(jsonOutput, null, 2));
+    process.exit(getFailOnExitCode(result, opts.failOn, opts.maxWarnings));
+    return;
+  }
+  const scanModeLabel = scanMode === "changed" ? "Changed files" : scanMode === "staged" ? "Staged files" : "Full scan";
+  const modeTag = changedFilesCount > 0 ? `${changedFilesCount} changed` : "";
+  log.summary(
+    result.filesScanned,
+    result.totalIssues,
+    result.files.filter((f) => f.issues.length > 0).length,
+    result.durationMs,
+    `${preset} \xB7 ${scanModeLabel}${modeTag ? ` (${modeTag})` : ""}`
+  );
+  if (result.totalIssues === 0) {
+    log.blank();
+    log.success(`No AI issues found \u2014 ${result.filesScanned} file${result.filesScanned !== 1 ? "s" : ""} scanned, all clean`);
+    log.blank();
+  } else {
+    const verbose = opts.verbose ?? false;
+    const quiet = opts.quiet ?? false;
+    const { actionableFiles, informationalFiles } = partitionByTier(result, quiet);
+    log.section("Summary by Category");
+    const categoryErrors = {};
+    const categoryWarnings = {};
+    for (const file of actionableFiles) {
+      for (const issue of file.issues) {
+        const cat = RULE_CATEGORY[issue.ruleId] ?? "Other";
+        if (issue.severity === 2) categoryErrors[cat] = (categoryErrors[cat] ?? 0) + 1;
+        else categoryWarnings[cat] = (categoryWarnings[cat] ?? 0) + 1;
+      }
+    }
+    const allCategories = /* @__PURE__ */ new Set([...CATEGORY_ORDER, ...Object.keys(categoryErrors), ...Object.keys(categoryWarnings)]);
+    const sortedCats = [...allCategories].filter((c) => (categoryErrors[c] ?? 0) + (categoryWarnings[c] ?? 0) > 0).sort((a, b) => {
+      const ai = CATEGORY_ORDER.indexOf(a), bi = CATEGORY_ORDER.indexOf(b);
+      if (ai !== -1 && bi !== -1) return ai - bi;
+      if (ai !== -1) return -1;
+      if (bi !== -1) return 1;
+      return a.localeCompare(b);
+    });
+    for (const cat of sortedCats) {
+      const icon = CATEGORY_ICONS[cat] ?? "\u26AA";
+      log.category(icon, cat, categoryErrors[cat] ?? 0, categoryWarnings[cat] ?? 0);
+    }
+    log.blank();
+    log.print(`  ${import_chalk5.default.bold("Total:")} ${formatIssueCount(result.totalErrors, result.totalWarnings)}`);
+    log.blank();
+    if (actionableFiles.length > 0) {
+      log.section("Issues by File");
+      log.blank();
+      renderIssuesByFile({ ...result, files: actionableFiles }, verbose, quiet);
+    }
+    const totalInfoCount = informationalFiles.reduce((n, f) => n + f.issues.length, 0);
+    if (totalInfoCount > 0 && !quiet) {
+      if (verbose) {
+        log.section("Informational Hints");
+        log.print(import_chalk5.default.dim("  Stylistic hints with higher false-positive rate \u2014 review before acting."));
+        log.blank();
+        renderIssuesByFile({ ...result, files: informationalFiles }, true, false);
+      } else {
+        log.blank();
+        log.print(`  ${import_chalk5.default.gray("\u25B8")}  ${import_chalk5.default.gray(`${totalInfoCount} informational hint${totalInfoCount !== 1 ? "s" : ""} \u2014 run with ${import_chalk5.default.cyan("--verbose")} to expand`)}`);
+      }
+    }
+  }
+  if (result.ecosystemIssues.length > 0) {
+    log.ecosystemSection("ESLint Config Issues");
+    log.print(import_chalk5.default.dim("  These issues come from your project's ESLint config, not from ai-guard."));
+    log.blank();
+    const seen = /* @__PURE__ */ new Map();
+    for (const issue of result.ecosystemIssues) {
+      const key = `${issue.ruleId ?? "null"}::${issue.message}`;
+      const existing = seen.get(key);
+      if (existing) {
+        existing.count++;
+      } else {
+        seen.set(key, { issue, count: 1 });
+      }
+    }
+    for (const { issue, count } of seen.values()) {
+      log.ecosystemIssue(issue, count);
+    }
+    log.blank();
+  }
+  log.divider();
+  log.blank();
+  log.section("Next Steps");
+  if (result.totalIssues > 0) {
+    log.info(`Run ${import_chalk5.default.cyan("ai-guard baseline")} to save these issues and track only new ones`);
+    log.info(`Run ${import_chalk5.default.cyan("ai-guard report")}   to generate a shareable HTML report`);
+  }
+  if (result.ecosystemIssues.length > 0) {
+    log.info(`Run ${import_chalk5.default.cyan("ai-guard doctor")}   to diagnose ESLint config issues`);
+  }
+  log.blank();
+  process.exit(getFailOnExitCode(result, opts.failOn, opts.maxWarnings));
+}
+function getFailOnExitCode(result, failOn, maxWarnings) {
+  return resolveExitCode(result, failOn, maxWarnings);
+}
+
+// cli/commands/init.ts
+var import_chalk6 = __toESM(require("chalk"));
+var import_path7 = __toESM(require("path"));
+var import_fs7 = __toESM(require("fs"));
 
 // cli/utils/detector.ts
-var import_fs2 = __toESM(require("fs"));
-var import_path2 = __toESM(require("path"));
-var import_module = require("module");
+var import_fs5 = __toESM(require("fs"));
+var import_path5 = __toESM(require("path"));
+var import_module2 = require("module");
 var FLAT_CONFIG_FILES = [
   { file: "eslint.config.js", type: "flat-js" },
   { file: "eslint.config.mjs", type: "flat-mjs" },
@@ -1211,11 +2553,11 @@ var LEGACY_CONFIG_FILES = [
 var ALL_CONFIG_FILES = [...FLAT_CONFIG_FILES, ...LEGACY_CONFIG_FILES];
 function isPackageInstalled(pkgName, cwd = process.cwd()) {
   try {
-    const pkgPath = import_path2.default.join(cwd, "node_modules", pkgName, "package.json");
-    if (import_fs2.default.existsSync(pkgPath)) {
+    const pkgPath = import_path5.default.join(cwd, "node_modules", pkgName, "package.json");
+    if (import_fs5.default.existsSync(pkgPath)) {
       return true;
     }
-    const req = (0, import_module.createRequire)(import_path2.default.join(cwd, "package.json"));
+    const req = (0, import_module2.createRequire)(import_path5.default.join(cwd, "package.json"));
     req.resolve(`${pkgName}/package.json`);
     return true;
   } catch {
@@ -1224,9 +2566,9 @@ function isPackageInstalled(pkgName, cwd = process.cwd()) {
 }
 function getPackageVersion(pkgName, cwd = process.cwd()) {
   try {
-    const pkgPath = import_path2.default.join(cwd, "node_modules", pkgName, "package.json");
-    const resolvedPath = import_fs2.default.existsSync(pkgPath) ? pkgPath : (0, import_module.createRequire)(import_path2.default.join(cwd, "package.json")).resolve(`${pkgName}/package.json`);
-    const raw = import_fs2.default.readFileSync(resolvedPath, "utf-8");
+    const pkgPath = import_path5.default.join(cwd, "node_modules", pkgName, "package.json");
+    const resolvedPath = import_fs5.default.existsSync(pkgPath) ? pkgPath : (0, import_module2.createRequire)(import_path5.default.join(cwd, "package.json")).resolve(`${pkgName}/package.json`);
+    const raw = import_fs5.default.readFileSync(resolvedPath, "utf-8");
     const json = JSON.parse(raw);
     return json.version ?? null;
   } catch {
@@ -1242,8 +2584,8 @@ function detectConfigType(cwd = process.cwd()) {
   const found = [];
   let first = null;
   for (const { file, type } of ALL_CONFIG_FILES) {
-    const fullPath = import_path2.default.join(cwd, file);
-    if (import_fs2.default.existsSync(fullPath)) {
+    const fullPath = import_path5.default.join(cwd, file);
+    if (import_fs5.default.existsSync(fullPath)) {
       found.push(fullPath);
       if (!first) first = { type, path: fullPath };
     }
@@ -1266,7 +2608,7 @@ function requiresFlatConfig(eslintMajor) {
 function detectNukeIgnore(configPath) {
   if (!configPath) return false;
   try {
-    const content = import_fs2.default.readFileSync(configPath, "utf-8");
+    const content = import_fs5.default.readFileSync(configPath, "utf-8");
     return content.includes('"**/*"') || content.includes("'**/*'");
   } catch {
     return false;
@@ -1322,7 +2664,7 @@ async function verifyConfigLoads(configPath, cwd) {
       overrideConfigFile: configPath
     });
     await eslint.lintText("", {
-      filePath: import_path4.default.join(cwd, "_ai_guard_probe_.js")
+      filePath: import_path7.default.join(cwd, "_ai_guard_probe_.js")
     });
     return null;
   } catch (err) {
@@ -1340,7 +2682,7 @@ function registerInitCommand(program2) {
     const isDryRun = opts.dryRun === true;
     log.banner("AI GUARD INIT");
     if (isDryRun) {
-      log.print(`  ${import_chalk3.default.yellow("\u2691  DRY RUN \u2014 no files will be written")}`);
+      log.print(`  ${import_chalk6.default.yellow("\u2691  DRY RUN \u2014 no files will be written")}`);
       log.blank();
     }
     log.info("Detecting your project setup\u2026");
@@ -1358,7 +2700,7 @@ function registerInitCommand(program2) {
       log.warn("eslint-plugin-ai-guard not found");
     }
     if (env.configType !== "none") {
-      log.success(`ESLint config found: ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath ?? env.configType))}`);
+      log.success(`ESLint config found: ${import_chalk6.default.white(import_path7.default.relative(cwd, env.configPath ?? env.configType))}`);
     } else {
       log.info("No ESLint config found \u2014 will generate one");
     }
@@ -1367,9 +2709,9 @@ function registerInitCommand(program2) {
       log.blank();
       log.warn("Conflicting configs detected:");
       for (const p of env.allConfigPaths) {
-        log.print(`    ${import_chalk3.default.yellow("\u2192")} ${import_chalk3.default.white(import_path4.default.relative(cwd, p))}`);
+        log.print(`    ${import_chalk6.default.yellow("\u2192")} ${import_chalk6.default.white(import_path7.default.relative(cwd, p))}`);
       }
-      log.print(`  ${import_chalk3.default.gray("Multiple config formats found \u2014 this can cause unpredictable behavior.")}`);
+      log.print(`  ${import_chalk6.default.gray("Multiple config formats found \u2014 this can cause unpredictable behavior.")}`);
     }
     log.blank();
     const toInstall = [];
@@ -1380,22 +2722,22 @@ function registerInitCommand(program2) {
       log.warn("The following packages are not installed:");
       log.blank();
       for (const pkg of toInstall) {
-        log.print(`    ${import_chalk3.default.yellow("\u2192")} ${import_chalk3.default.white(pkg)}`);
+        log.print(`    ${import_chalk6.default.yellow("\u2192")} ${import_chalk6.default.white(pkg)}`);
       }
       log.blank();
-      log.print(`  ${import_chalk3.default.bold("Run this first:")}`);
+      log.print(`  ${import_chalk6.default.bold("Run this first:")}`);
       log.blank();
-      log.print(`    ${import_chalk3.default.cyan(`npm install --save-dev ${toInstall.join(" ")}`)}`);
+      log.print(`    ${import_chalk6.default.cyan(`npm install --save-dev ${toInstall.join(" ")}`)}`);
       log.blank();
-      log.print(`  Then re-run ${import_chalk3.default.cyan("ai-guard init")} to complete setup.`);
+      log.print(`  Then re-run ${import_chalk6.default.cyan("ai-guard init")} to complete setup.`);
       log.blank();
       process.exit(1);
       return;
     }
     try {
-      const { createRequire: createRequire2 } = await import("module");
+      const { createRequire: createRequire3 } = await import("module");
       const { pathToFileURL: pathToFileURL2 } = await import("url");
-      const req = createRequire2(import_path4.default.join(cwd, "_probe.js"));
+      const req = createRequire3(import_path7.default.join(cwd, "_probe.js"));
       const resolvedPath = req.resolve("eslint-plugin-ai-guard");
       const aiGuard = await import(pathToFileURL2(resolvedPath).href);
       const plugin = aiGuard.default || aiGuard;
@@ -1414,9 +2756,9 @@ function registerInitCommand(program2) {
     if (eslintNeedsFlat && existingIsLegacy) {
       log.section("Config Migration Required");
       log.warn(`ESLint v${env.eslintMajor} requires flat config, but a legacy config was found:`);
-      log.print(`    ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath))}`);
+      log.print(`    ${import_chalk6.default.white(import_path7.default.relative(cwd, env.configPath))}`);
       log.blank();
-      log.print(`  ${import_chalk3.default.bold("ai-guard will create a new flat config.")}`);
+      log.print(`  ${import_chalk6.default.bold("ai-guard will create a new flat config.")}`);
       log.blank();
     }
     log.section(`Configuring ESLint${isDryRun ? " (dry run)" : ""}`);
@@ -1426,34 +2768,34 @@ function registerInitCommand(program2) {
       const raw = readConfig(env.configPath);
       const { content: fixed, changed } = removeNukeIgnore(raw);
       if (changed) {
-        log.warn(`Removed "**/*" ignore pattern from ${import_path4.default.relative(cwd, env.configPath)}`);
+        log.warn(`Removed "**/*" ignore pattern from ${import_path7.default.relative(cwd, env.configPath)}`);
         if (!isDryRun) {
           backupConfig(env.configPath);
           writeConfig(env.configPath, fixed);
           log.success("Ignore pattern fixed");
         } else {
-          log.print(`  ${import_chalk3.default.gray("[dry-run] would remove nuke-ignore from existing config")}`);
+          log.print(`  ${import_chalk6.default.gray("[dry-run] would remove nuke-ignore from existing config")}`);
         }
       }
     }
     if (env.configType === "none" || eslintNeedsFlat && existingIsLegacy) {
       const targetName = useFlat ? "eslint.config.mjs" : ".eslintrc.js";
-      finalConfigPath = import_path4.default.join(cwd, targetName);
+      finalConfigPath = import_path7.default.join(cwd, targetName);
       const content2 = useFlat ? generateFlatConfig(preset) : generateLegacyConfig(preset);
       if (isDryRun) {
-        log.print(`  ${import_chalk3.default.gray(`[dry-run] would create: ${targetName}`)}`);
+        log.print(`  ${import_chalk6.default.gray(`[dry-run] would create: ${targetName}`)}`);
         log.blank();
-        log.print(import_chalk3.default.gray("\u2500\u2500\u2500 Preview \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+        log.print(import_chalk6.default.gray("\u2500\u2500\u2500 Preview \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
         log.blank();
         for (const line of content2.split("\n")) {
-          log.print(import_chalk3.default.gray(`  ${line}`));
+          log.print(import_chalk6.default.gray(`  ${line}`));
         }
         log.blank();
       } else {
         writeConfig(finalConfigPath, content2);
-        log.success(`Created ${import_chalk3.default.white(targetName)}`);
-        log.info(`  Preset: ${import_chalk3.default.cyan(preset)}`);
-        log.info(`  Format: ${import_chalk3.default.cyan(useFlat ? "ESLint v9 flat config (eslint.config.mjs)" : "ESLint v8 legacy config (.eslintrc.js)")}`);
+        log.success(`Created ${import_chalk6.default.white(targetName)}`);
+        log.info(`  Preset: ${import_chalk6.default.cyan(preset)}`);
+        log.info(`  Format: ${import_chalk6.default.cyan(useFlat ? "ESLint v9 flat config (eslint.config.mjs)" : "ESLint v8 legacy config (.eslintrc.js)")}`);
         configWritten = true;
       }
     } else if (useFlat && existingIsFlat) {
@@ -1466,15 +2808,15 @@ function registerInitCommand(program2) {
         finalConfigPath = env.configPath;
       } else if (isDryRun) {
         finalConfigPath = env.configPath;
-        log.print(`  ${import_chalk3.default.gray(`[dry-run] would patch: ${import_path4.default.relative(cwd, env.configPath)}`)}`);
+        log.print(`  ${import_chalk6.default.gray(`[dry-run] would patch: ${import_path7.default.relative(cwd, env.configPath)}`)}`);
       } else {
         const bak = backupConfig(env.configPath);
-        log.info(`Backed up \u2192 ${import_chalk3.default.gray(import_path4.default.relative(cwd, bak))}`);
+        log.info(`Backed up \u2192 ${import_chalk6.default.gray(import_path7.default.relative(cwd, bak))}`);
         writeConfig(env.configPath, patched);
         if (isInvalid) {
-          log.success(`Detected invalid ai-guard config \u2014 repairing ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath))}`);
+          log.success(`Detected invalid ai-guard config \u2014 repairing ${import_chalk6.default.white(import_path7.default.relative(cwd, env.configPath))}`);
         } else {
-          log.success(`Patched ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath))}`);
+          log.success(`Patched ${import_chalk6.default.white(import_path7.default.relative(cwd, env.configPath))}`);
         }
         finalConfigPath = env.configPath;
         configWritten = true;
@@ -1487,12 +2829,12 @@ function registerInitCommand(program2) {
         finalConfigPath = env.configPath;
       } else if (isDryRun) {
         finalConfigPath = env.configPath;
-        log.print(`  ${import_chalk3.default.gray(`[dry-run] would patch: ${import_path4.default.relative(cwd, env.configPath)}`)}`);
+        log.print(`  ${import_chalk6.default.gray(`[dry-run] would patch: ${import_path7.default.relative(cwd, env.configPath)}`)}`);
       } else {
         const bak = backupConfig(env.configPath);
-        log.info(`Backed up \u2192 ${import_chalk3.default.gray(import_path4.default.relative(cwd, bak))}`);
+        log.info(`Backed up \u2192 ${import_chalk6.default.gray(import_path7.default.relative(cwd, bak))}`);
         writeConfig(env.configPath, patched);
-        log.success(`Patched ${import_chalk3.default.white(import_path4.default.relative(cwd, env.configPath))}`);
+        log.success(`Patched ${import_chalk6.default.white(import_path7.default.relative(cwd, env.configPath))}`);
         finalConfigPath = env.configPath;
         configWritten = true;
       }
@@ -1501,18 +2843,18 @@ function registerInitCommand(program2) {
       const legacyConfigs = env.allConfigPaths.filter((p) => !p.includes("eslint.config."));
       let cleanedUp = false;
       for (const p of legacyConfigs) {
-        if (import_fs4.default.existsSync(p)) {
+        if (import_fs7.default.existsSync(p)) {
           if (!isDryRun) {
             try {
-              import_fs4.default.renameSync(p, `${p}.bak`);
+              import_fs7.default.renameSync(p, `${p}.bak`);
               cleanedUp = true;
             } catch (err) {
               const reason = err instanceof Error ? err.message : String(err);
-              log.warn(`Could not back up ${import_path4.default.relative(cwd, p)}: ${reason}`);
+              log.warn(`Could not back up ${import_path7.default.relative(cwd, p)}: ${reason}`);
             }
           } else {
             cleanedUp = true;
-            log.print(`  ${import_chalk3.default.gray(`[dry-run] would rename ${import_path4.default.relative(cwd, p)} to ${import_path4.default.basename(p)}.bak`)}`);
+            log.print(`  ${import_chalk6.default.gray(`[dry-run] would rename ${import_path7.default.relative(cwd, p)} to ${import_path7.default.basename(p)}.bak`)}`);
           }
         }
       }
@@ -1522,19 +2864,19 @@ function registerInitCommand(program2) {
     }
     if (isDryRun) {
       log.blank();
-      log.print(`  ${import_chalk3.default.yellow("Dry run complete \u2014 no files written.")}`);
-      log.print(`  Re-run without ${import_chalk3.default.cyan("--dry-run")} to apply.`);
+      log.print(`  ${import_chalk6.default.yellow("Dry run complete \u2014 no files written.")}`);
+      log.print(`  Re-run without ${import_chalk6.default.cyan("--dry-run")} to apply.`);
       log.blank();
       process.exit(0);
       return;
     }
     log.blank();
     log.section("Validation");
-    if (!import_fs4.default.existsSync(finalConfigPath)) {
-      log.error(`Config file not found after write: ${import_path4.default.relative(cwd, finalConfigPath)}`);
+    if (!import_fs7.default.existsSync(finalConfigPath)) {
+      log.error(`Config file not found after write: ${import_path7.default.relative(cwd, finalConfigPath)}`);
       log.blank();
-      log.print(`  ${import_chalk3.default.bold("Problem:")} File write may have failed.`);
-      log.print(`  ${import_chalk3.default.bold("Fix:")} Check disk space and file permissions, then re-run.`);
+      log.print(`  ${import_chalk6.default.bold("Problem:")} File write may have failed.`);
+      log.print(`  ${import_chalk6.default.bold("Fix:")} Check disk space and file permissions, then re-run.`);
       log.blank();
       process.exit(1);
       return;
@@ -1544,36 +2886,36 @@ function registerInitCommand(program2) {
     if (validationErrors.length > 0) {
       log.warn("Config validation found issues:");
       for (const e of validationErrors) {
-        log.print(`    ${import_chalk3.default.red("\u2716")} ${e}`);
+        log.print(`    ${import_chalk6.default.red("\u2716")} ${e}`);
       }
     } else {
-      log.success(`Config structure valid: ${import_chalk3.default.white(import_path4.default.relative(cwd, finalConfigPath))}`);
+      log.success(`Config structure valid: ${import_chalk6.default.white(import_path7.default.relative(cwd, finalConfigPath))}`);
     }
     log.info("Verifying ESLint can load the config\u2026");
     const loadError = await verifyConfigLoads(finalConfigPath, cwd);
     if (loadError !== null) {
       log.blank();
       if (loadError.kind === "module-not-found") {
-        log.warn(`Could not verify: module not found: ${import_chalk3.default.yellow(loadError.pkg)}`);
+        log.warn(`Could not verify: module not found: ${import_chalk6.default.yellow(loadError.pkg)}`);
         log.blank();
-        log.print(`  ${import_chalk3.default.bold("Install the missing package:")}`);
-        log.print(`    ${import_chalk3.default.cyan(`npm install --save-dev ${loadError.pkg}`)}`);
-        log.print(`  Then run ${import_chalk3.default.cyan("ai-guard doctor")} to confirm.`);
+        log.print(`  ${import_chalk6.default.bold("Install the missing package:")}`);
+        log.print(`    ${import_chalk6.default.cyan(`npm install --save-dev ${loadError.pkg}`)}`);
+        log.print(`  Then run ${import_chalk6.default.cyan("ai-guard doctor")} to confirm.`);
         log.blank();
       } else {
         log.error("ESLint failed to load the generated config.");
         log.blank();
-        log.print(`  ${import_chalk3.default.bold("Problem:")}`);
-        log.print(`    ${import_chalk3.default.red(loadError.message)}`);
+        log.print(`  ${import_chalk6.default.bold("Problem:")}`);
+        log.print(`    ${import_chalk6.default.red(loadError.message)}`);
         if (loadError.kind === "unknown") {
           log.blank();
-          log.print(`    ${import_chalk3.default.yellow("Generated config may be using incorrect plugin structure.")}`);
+          log.print(`    ${import_chalk6.default.yellow("Generated config may be using incorrect plugin structure.")}`);
         }
         log.blank();
-        log.print(`  ${import_chalk3.default.bold("Fix:")}`);
-        log.print(`    1. Check the syntax in ${import_chalk3.default.cyan(import_path4.default.relative(cwd, finalConfigPath))}`);
-        log.print(`    2. Make sure ${import_chalk3.default.cyan("eslint-plugin-ai-guard")} is installed`);
-        log.print(`    3. Run ${import_chalk3.default.cyan("ai-guard doctor")} for full diagnostics`);
+        log.print(`  ${import_chalk6.default.bold("Fix:")}`);
+        log.print(`    1. Check the syntax in ${import_chalk6.default.cyan(import_path7.default.relative(cwd, finalConfigPath))}`);
+        log.print(`    2. Make sure ${import_chalk6.default.cyan("eslint-plugin-ai-guard")} is installed`);
+        log.print(`    3. Run ${import_chalk6.default.cyan("ai-guard doctor")} for full diagnostics`);
         log.blank();
         process.exit(1);
         return;
@@ -1587,34 +2929,34 @@ function registerInitCommand(program2) {
     let cleanedUpInfo = false;
     if (eslintNeedsFlat) {
       const legacyConfigs = env.allConfigPaths.filter((p) => !p.includes("eslint.config."));
-      cleanedUpInfo = legacyConfigs.some((p) => import_fs4.default.existsSync(`${p}.bak`) && !import_fs4.default.existsSync(p));
+      cleanedUpInfo = legacyConfigs.some((p) => import_fs7.default.existsSync(`${p}.bak`) && !import_fs7.default.existsSync(p));
     }
     const lingeringConflicts = env.hasConflictingConfigs && !eslintNeedsFlat && !cleanedUpInfo;
     if (loadError === null && !lingeringConflicts) {
-      log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold.green("Configuration validated successfully")}`);
+      log.print(`  ${import_chalk6.default.green("\u2714")}  ${import_chalk6.default.bold.green("Configuration validated successfully")}`);
     }
-    log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold("ESLint config:")} ${import_chalk3.default.cyan(import_path4.default.relative(cwd, finalConfigPath))}`);
-    log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold("Mode:")} ${import_chalk3.default.cyan(useFlat ? `Flat config (ESLint v${env.eslintMajor ?? 9})` : `Legacy config (ESLint v${env.eslintMajor ?? 8})`)}`);
-    log.print(`  ${import_chalk3.default.green("\u2714")}  ${import_chalk3.default.bold("Preset:")} ${import_chalk3.default.cyan(preset)}`);
+    log.print(`  ${import_chalk6.default.green("\u2714")}  ${import_chalk6.default.bold("ESLint config:")} ${import_chalk6.default.cyan(import_path7.default.relative(cwd, finalConfigPath))}`);
+    log.print(`  ${import_chalk6.default.green("\u2714")}  ${import_chalk6.default.bold("Mode:")} ${import_chalk6.default.cyan(useFlat ? `Flat config (ESLint v${env.eslintMajor ?? 9})` : `Legacy config (ESLint v${env.eslintMajor ?? 8})`)}`);
+    log.print(`  ${import_chalk6.default.green("\u2714")}  ${import_chalk6.default.bold("Preset:")} ${import_chalk6.default.cyan(preset)}`);
     log.blank();
-    log.info(`Run ${import_chalk3.default.cyan("npx eslint .")}         \u2192 lint with your editor integration`);
-    log.info(`Run ${import_chalk3.default.cyan("ai-guard run")}          \u2192 zero-config scan`);
-    log.info(`Run ${import_chalk3.default.cyan("ai-guard doctor")}       \u2192 verify the full setup`);
-    log.info(`Run ${import_chalk3.default.cyan("ai-guard baseline")}     \u2192 save baseline, track only new issues`);
+    log.info(`Run ${import_chalk6.default.cyan("npx eslint .")}         \u2192 lint with your editor integration`);
+    log.info(`Run ${import_chalk6.default.cyan("ai-guard run")}          \u2192 zero-config scan`);
+    log.info(`Run ${import_chalk6.default.cyan("ai-guard doctor")}       \u2192 verify the full setup`);
+    log.info(`Run ${import_chalk6.default.cyan("ai-guard baseline")}     \u2192 save baseline, track only new issues`);
     log.blank();
   });
 }
 
 // cli/commands/doctor.ts
-var import_chalk4 = __toESM(require("chalk"));
-var import_path5 = __toESM(require("path"));
+var import_chalk7 = __toESM(require("chalk"));
+var import_path8 = __toESM(require("path"));
 init_config_manager();
-var import_meta = {};
+var import_meta2 = {};
 async function probeConfigLoad(configPath, cwd) {
   try {
     const { ESLint } = await import("eslint");
     const eslint = new ESLint({ cwd, overrideConfigFile: configPath });
-    await eslint.lintText("", { filePath: import_path5.default.join(cwd, "_probe_.js") });
+    await eslint.lintText("", { filePath: import_path8.default.join(cwd, "_probe_.js") });
     return { ok: true, error: null };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -1649,7 +2991,7 @@ function registerDoctorCommand(program2) {
     checks.push({
       label: "ESLint config present",
       pass: hasConfig,
-      detail: hasConfig ? `${import_path5.default.relative(cwd, env.configPath ?? "")} (${env.configType})` : "No eslint.config.* or .eslintrc.* found",
+      detail: hasConfig ? `${import_path8.default.relative(cwd, env.configPath ?? "")} (${env.configType})` : "No eslint.config.* or .eslintrc.* found",
       fix: hasConfig ? void 0 : "ai-guard init",
       note: hasConfig ? void 0 : "This will generate the correct config format for your ESLint version"
     });
@@ -1681,7 +3023,7 @@ function registerDoctorCommand(program2) {
       checks.push({
         label: "Plugin wired in config",
         pass: pluginWired && !isInvalidConfig,
-        detail: readError ? `Could not read config: ${readError}` : isInvalidConfig ? "Invalid ai-guard config detected (wrong export usage)" : pluginWired ? "eslint-plugin-ai-guard referenced in config" : `Config exists but ai-guard plugin not found in ${import_path5.default.relative(cwd, env.configPath)}`,
+        detail: readError ? `Could not read config: ${readError}` : isInvalidConfig ? "Invalid ai-guard config detected (wrong export usage)" : pluginWired ? "eslint-plugin-ai-guard referenced in config" : `Config exists but ai-guard plugin not found in ${import_path8.default.relative(cwd, env.configPath)}`,
         fix: isInvalidConfig || !pluginWired && !readError ? "ai-guard init  (will patch/repair your existing config)" : void 0
       });
     }
@@ -1689,7 +3031,7 @@ function registerDoctorCommand(program2) {
       label: "No conflicting config files",
       pass: !env.hasConflictingConfigs,
       detail: env.hasConflictingConfigs ? `Conflicting config detected:
-${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}`).join("\n")}` : "Only one config format detected",
+${env.allConfigPaths.map((p) => `       ${import_path8.default.relative(cwd, p)}`).join("\n")}` : "Only one config format detected",
       fix: env.hasConflictingConfigs ? "Remove or backup legacy config" : void 0,
       note: env.hasConflictingConfigs ? "ESLint v9 silently ignores .eslintrc.* when a flat config exists. This can cause confusion." : void 0
     });
@@ -1716,7 +3058,7 @@ ${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}
         label: "ESLint config loads without errors",
         pass: probe.ok,
         detail: probe.ok ? "ESLint loaded config successfully" : probe.error ?? "Unknown error",
-        fix: probe.ok ? void 0 : `Check syntax in ${import_path5.default.relative(cwd, env.configPath)}`,
+        fix: probe.ok ? void 0 : `Check syntax in ${import_path8.default.relative(cwd, env.configPath)}`,
         note: probe.ok ? void 0 : "Run: ai-guard init --dry-run  to preview a fresh config"
       });
     }
@@ -1724,8 +3066,8 @@ ${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}
       let utilsOk = false;
       let utilsVersion = null;
       try {
-        const { createRequire: createRequire2 } = await import("module");
-        const req = createRequire2(import_path5.default.join(cwd, "package.json"));
+        const { createRequire: createRequire3 } = await import("module");
+        const req = createRequire3(import_path8.default.join(cwd, "package.json"));
         const pkgPath = req.resolve("@typescript-eslint/utils/package.json");
         const pkg = JSON.parse(
           (await import("fs")).readFileSync(pkgPath, "utf-8")
@@ -1736,10 +3078,10 @@ ${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}
       }
       if (!utilsOk) {
         try {
-          const selfDir = import_path5.default.dirname(
-            new URL(import_meta.url).pathname.replace(/^\/([A-Za-z]:)/, "$1")
+          const selfDir = import_path8.default.dirname(
+            new URL(import_meta2.url).pathname.replace(/^\/([A-Za-z]:)/, "$1")
           );
-          const pkgPath = import_path5.default.join(selfDir, "../../node_modules/@typescript-eslint/utils/package.json");
+          const pkgPath = import_path8.default.join(selfDir, "../../node_modules/@typescript-eslint/utils/package.json");
           if ((await import("fs")).existsSync(pkgPath)) {
             utilsOk = true;
           }
@@ -1758,8 +3100,8 @@ ${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}
       let parserOk = false;
       let parserVersion = null;
       try {
-        const { createRequire: createRequire2 } = await import("module");
-        const req = createRequire2(import_path5.default.join(cwd, "package.json"));
+        const { createRequire: createRequire3 } = await import("module");
+        const req = createRequire3(import_path8.default.join(cwd, "package.json"));
         const pkgPath = req.resolve("@typescript-eslint/parser/package.json");
         const pkg = JSON.parse(
           (await import("fs")).readFileSync(pkgPath, "utf-8")
@@ -1790,17 +3132,17 @@ ${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}
     log.section("Diagnostics");
     let allPassed = true;
     for (const check of checks) {
-      const icon = check.pass ? import_chalk4.default.green("\u2714") : import_chalk4.default.red("\u2716");
-      const label = check.pass ? import_chalk4.default.white(check.label) : import_chalk4.default.red.bold(check.label);
+      const icon = check.pass ? import_chalk7.default.green("\u2714") : import_chalk7.default.red("\u2716");
+      const label = check.pass ? import_chalk7.default.white(check.label) : import_chalk7.default.red.bold(check.label);
       log.print(`  ${icon}  ${label}`);
-      log.print(`       ${import_chalk4.default.gray(check.detail)}`);
+      log.print(`       ${import_chalk7.default.gray(check.detail)}`);
       if (!check.pass) {
         allPassed = false;
         if (check.fix) {
-          log.print(`       ${import_chalk4.default.cyan("\u2192 Fix:")} ${import_chalk4.default.yellow(check.fix)}`);
+          log.print(`       ${import_chalk7.default.cyan("\u2192 Fix:")} ${import_chalk7.default.yellow(check.fix)}`);
         }
         if (check.note) {
-          log.print(`       ${import_chalk4.default.gray(check.note)}`);
+          log.print(`       ${import_chalk7.default.gray(check.note)}`);
         }
       }
       log.blank();
@@ -1808,10 +3150,10 @@ ${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}
     log.divider();
     log.blank();
     if (allPassed) {
-      log.print(`  ${import_chalk4.default.green("\u2714")}  ${import_chalk4.default.bold.green("All checks passed! Your setup is correct.")}`);
+      log.print(`  ${import_chalk7.default.green("\u2714")}  ${import_chalk7.default.bold.green("All checks passed! Your setup is correct.")}`);
       log.blank();
-      log.info(`Run ${import_chalk4.default.cyan("ai-guard run")} to start scanning.`);
-      log.info(`Run ${import_chalk4.default.cyan("npx eslint .")} to lint with ESLint directly.`);
+      log.info(`Run ${import_chalk7.default.cyan("ai-guard run")} to start scanning.`);
+      log.info(`Run ${import_chalk7.default.cyan("npx eslint .")} to lint with ESLint directly.`);
     } else {
       log.error("Some checks failed. Follow the fixes above.");
       log.blank();
@@ -1826,15 +3168,15 @@ ${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}
       );
       if (pluginMissing) {
         log.print(
-          `  Install missing packages first, then re-run ${import_chalk4.default.cyan("ai-guard doctor")}.`
+          `  Install missing packages first, then re-run ${import_chalk7.default.cyan("ai-guard doctor")}.`
         );
       } else if (configMissing || configFormatMismatch) {
         log.print(
-          `  Run ${import_chalk4.default.cyan("ai-guard init")} to generate the correct config for your ESLint version.`
+          `  Run ${import_chalk7.default.cyan("ai-guard init")} to generate the correct config for your ESLint version.`
         );
       } else {
         log.print(
-          `  Run ${import_chalk4.default.cyan("ai-guard init --dry-run")} to preview what would change.`
+          `  Run ${import_chalk7.default.cyan("ai-guard init --dry-run")} to preview what would change.`
         );
       }
     }
@@ -1845,9 +3187,9 @@ ${env.allConfigPaths.map((p) => `       ${import_path5.default.relative(cwd, p)}
 
 // cli/commands/preset.ts
 var import_prompts = require("@inquirer/prompts");
-var import_chalk5 = __toESM(require("chalk"));
+var import_chalk8 = __toESM(require("chalk"));
 init_config_manager();
-var import_path6 = __toESM(require("path"));
+var import_path9 = __toESM(require("path"));
 function registerPresetCommand(program2) {
   program2.command("preset").description("Interactively select and apply an ai-guard preset to your ESLint config").action(async () => {
     const cwd = process.cwd();
@@ -1857,32 +3199,32 @@ function registerPresetCommand(program2) {
       message: "Choose a preset:",
       choices: [
         {
-          name: `${import_chalk5.default.green("recommended")} \u2014 balanced defaults, low noise. Best starting point.`,
+          name: `${import_chalk8.default.green("recommended")} \u2014 balanced defaults, low noise. Best starting point.`,
           value: "recommended"
         },
         {
-          name: `${import_chalk5.default.yellow("strict")}      \u2014 all rules at error. For mature codebases.`,
+          name: `${import_chalk8.default.yellow("strict")}      \u2014 all rules at error. For mature codebases.`,
           value: "strict"
         },
         {
-          name: `${import_chalk5.default.red("security")}   \u2014 security rules only. For AppSec teams.`,
+          name: `${import_chalk8.default.red("security")}   \u2014 security rules only. For AppSec teams.`,
           value: "security"
         }
       ]
     });
     log.blank();
-    log.info(`Applying preset: ${import_chalk5.default.cyan(preset)}`);
+    log.info(`Applying preset: ${import_chalk8.default.cyan(preset)}`);
     const env = detect(cwd);
     const useFlat = env.eslintMajor !== null && env.eslintMajor >= 9 || isFlat(env.configType);
     if (env.configType === "none") {
-      const configPath = useFlat ? import_path6.default.join(cwd, "eslint.config.mjs") : import_path6.default.join(cwd, ".eslintrc.js");
+      const configPath = useFlat ? import_path9.default.join(cwd, "eslint.config.mjs") : import_path9.default.join(cwd, ".eslintrc.js");
       const content = useFlat ? generateFlatConfig(preset) : generateLegacyConfig(preset);
       writeConfig(configPath, content);
-      log.success(`Created ${import_chalk5.default.white(import_path6.default.relative(cwd, configPath))} with ${import_chalk5.default.cyan(preset)} preset`);
+      log.success(`Created ${import_chalk8.default.white(import_path9.default.relative(cwd, configPath))} with ${import_chalk8.default.cyan(preset)} preset`);
     } else {
       const configPath = env.configPath;
       const backupPath = backupConfig(configPath);
-      log.info(`Backed up \u2192 ${import_chalk5.default.gray(import_path6.default.relative(cwd, backupPath))}`);
+      log.info(`Backed up \u2192 ${import_chalk8.default.gray(import_path9.default.relative(cwd, backupPath))}`);
       const existing = readConfig(configPath);
       const withPlugin = isFlat(env.configType) ? patchFlatConfig(existing, preset) : patchLegacyConfig(existing, preset);
       const patched = isFlat(env.configType) ? switchFlatPreset(withPlugin, preset) : switchLegacyPreset(withPlugin, preset);
@@ -1890,47 +3232,47 @@ function registerPresetCommand(program2) {
         log.warn("No preset changes needed. Config already matches selected preset.");
       } else {
         writeConfig(configPath, patched);
-        log.success(`Updated ${import_chalk5.default.white(import_path6.default.relative(cwd, configPath))} to ${import_chalk5.default.cyan(preset)} preset`);
+        log.success(`Updated ${import_chalk8.default.white(import_path9.default.relative(cwd, configPath))} to ${import_chalk8.default.cyan(preset)} preset`);
       }
     }
     log.blank();
     log.section("Preset Details");
     const presetDetails = {
       recommended: [
-        { rule: "no-empty-catch", level: import_chalk5.default.red("error") },
-        { rule: "no-floating-promise", level: import_chalk5.default.red("error") },
-        { rule: "no-hardcoded-secret", level: import_chalk5.default.red("error") },
-        { rule: "no-eval-dynamic", level: import_chalk5.default.red("error") },
-        { rule: "no-broad-exception", level: import_chalk5.default.yellow("warn") },
-        { rule: "no-async-array-callback", level: import_chalk5.default.yellow("warn") },
-        { rule: "no-await-in-loop", level: import_chalk5.default.yellow("warn") },
-        { rule: "+ 5 more\u2026", level: import_chalk5.default.gray("warn") }
+        { rule: "no-empty-catch", level: import_chalk8.default.red("error") },
+        { rule: "no-floating-promise", level: import_chalk8.default.red("error") },
+        { rule: "no-hardcoded-secret", level: import_chalk8.default.red("error") },
+        { rule: "no-eval-dynamic", level: import_chalk8.default.red("error") },
+        { rule: "no-broad-exception", level: import_chalk8.default.yellow("warn") },
+        { rule: "no-async-array-callback", level: import_chalk8.default.yellow("warn") },
+        { rule: "no-await-in-loop", level: import_chalk8.default.yellow("warn") },
+        { rule: "+ 5 more\u2026", level: import_chalk8.default.gray("warn") }
       ],
       strict: [
-        { rule: "All 17 rules", level: import_chalk5.default.red("error") }
+        { rule: "All 17 rules", level: import_chalk8.default.red("error") }
       ],
       security: [
-        { rule: "no-hardcoded-secret", level: import_chalk5.default.red("error") },
-        { rule: "no-eval-dynamic", level: import_chalk5.default.red("error") },
-        { rule: "no-sql-string-concat", level: import_chalk5.default.red("error") },
-        { rule: "no-unsafe-deserialize", level: import_chalk5.default.yellow("warn") },
-        { rule: "require-auth-middleware", level: import_chalk5.default.yellow("warn") },
-        { rule: "require-authz-check", level: import_chalk5.default.yellow("warn") }
+        { rule: "no-hardcoded-secret", level: import_chalk8.default.red("error") },
+        { rule: "no-eval-dynamic", level: import_chalk8.default.red("error") },
+        { rule: "no-sql-string-concat", level: import_chalk8.default.red("error") },
+        { rule: "no-unsafe-deserialize", level: import_chalk8.default.yellow("warn") },
+        { rule: "require-auth-middleware", level: import_chalk8.default.yellow("warn") },
+        { rule: "require-authz-check", level: import_chalk8.default.yellow("warn") }
       ]
     };
     for (const { rule, level } of presetDetails[preset]) {
-      log.print(`    ${import_chalk5.default.gray("\u2022")} ${import_chalk5.default.white(rule).padEnd(32)}${level}`);
+      log.print(`    ${import_chalk8.default.gray("\u2022")} ${import_chalk8.default.white(rule).padEnd(32)}${level}`);
     }
     log.blank();
-    log.info(`Run ${import_chalk5.default.cyan("ai-guard run")} to see results with the new preset.`);
+    log.info(`Run ${import_chalk8.default.cyan("ai-guard run")} to see results with the new preset.`);
     log.blank();
   });
 }
 
 // cli/commands/ignore.ts
-var import_chalk6 = __toESM(require("chalk"));
+var import_chalk9 = __toESM(require("chalk"));
 init_config_manager();
-var import_path7 = __toESM(require("path"));
+var import_path10 = __toESM(require("path"));
 var DEFAULT_IGNORES = [
   ".next/",
   "dist/",
@@ -1946,41 +3288,41 @@ function registerIgnoreCommand(program2) {
     log.blank();
     log.section("Default Ignores");
     for (const p of DEFAULT_IGNORES) {
-      log.print(`    ${import_chalk6.default.gray("\u2022")} ${import_chalk6.default.yellow(p)}`);
+      log.print(`    ${import_chalk9.default.gray("\u2022")} ${import_chalk9.default.yellow(p)}`);
     }
     log.blank();
     const env = detect(cwd);
     if (env.configType === "none") {
       const useFlat = env.eslintMajor !== null && env.eslintMajor >= 9;
-      const configPath = useFlat ? import_path7.default.join(cwd, "eslint.config.mjs") : import_path7.default.join(cwd, ".eslintrc.js");
+      const configPath = useFlat ? import_path10.default.join(cwd, "eslint.config.mjs") : import_path10.default.join(cwd, ".eslintrc.js");
       const content = useFlat ? generateFlatConfig("recommended") : generateLegacyConfig("recommended");
       writeConfig(configPath, content);
-      log.success(`No config found \u2014 generated ${import_chalk6.default.white(import_path7.default.relative(cwd, configPath))} with ignores included`);
+      log.success(`No config found \u2014 generated ${import_chalk9.default.white(import_path10.default.relative(cwd, configPath))} with ignores included`);
     } else {
       const configPath = env.configPath;
       const backupPath = backupConfig(configPath);
-      log.info(`Backed up \u2192 ${import_chalk6.default.gray(import_path7.default.relative(cwd, backupPath))}`);
+      log.info(`Backed up \u2192 ${import_chalk9.default.gray(import_path10.default.relative(cwd, backupPath))}`);
       const existing = readConfig(configPath);
       const patched = isFlat(env.configType) ? addIgnoresToFlatConfig(existing) : addIgnoresToLegacyConfig(existing);
       if (patched === existing) {
         log.warn("Ignore patterns already present in config \u2014 no changes made.");
       } else {
         writeConfig(configPath, patched);
-        log.success(`Patched ${import_chalk6.default.white(import_path7.default.relative(cwd, configPath))} with ignore patterns`);
+        log.success(`Patched ${import_chalk9.default.white(import_path10.default.relative(cwd, configPath))} with ignore patterns`);
       }
     }
     log.blank();
     log.info("Noisy directories will now be skipped in all future ESLint runs.");
-    log.info(`Run ${import_chalk6.default.cyan("ai-guard run")} to verify cleaner results.`);
+    log.info(`Run ${import_chalk9.default.cyan("ai-guard run")} to verify cleaner results.`);
     log.blank();
   });
 }
 
 // cli/commands/baseline.ts
-var import_fs5 = __toESM(require("fs"));
-var import_path8 = __toESM(require("path"));
-var import_chalk7 = __toESM(require("chalk"));
-var import_ora2 = __toESM(require("ora"));
+var import_fs8 = __toESM(require("fs"));
+var import_path11 = __toESM(require("path"));
+var import_chalk10 = __toESM(require("chalk"));
+var import_ora3 = __toESM(require("ora"));
 var BASELINE_FILE = ".ai-guard-baseline.json";
 function saveBaseline(result, preset, mode, cwd) {
   const entries = result.files.map((f) => ({
@@ -1999,15 +3341,15 @@ function saveBaseline(result, preset, mode, cwd) {
     totalIssues: result.totalIssues,
     entries
   };
-  const baselinePath = import_path8.default.join(cwd, BASELINE_FILE);
-  import_fs5.default.writeFileSync(baselinePath, JSON.stringify(baseline, null, 2), "utf-8");
+  const baselinePath = import_path11.default.join(cwd, BASELINE_FILE);
+  import_fs8.default.writeFileSync(baselinePath, JSON.stringify(baseline, null, 2), "utf-8");
   return baselinePath;
 }
 function loadBaseline(cwd) {
-  const baselinePath = import_path8.default.join(cwd, BASELINE_FILE);
-  if (!import_fs5.default.existsSync(baselinePath)) return null;
+  const baselinePath = import_path11.default.join(cwd, BASELINE_FILE);
+  if (!import_fs8.default.existsSync(baselinePath)) return null;
   try {
-    const raw = import_fs5.default.readFileSync(baselinePath, "utf-8");
+    const raw = import_fs8.default.readFileSync(baselinePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -2079,7 +3421,7 @@ function registerBaselineCommand(program2) {
     const doCheck = opts.check ?? (existingBaseline !== null && !opts.save);
     if (doSave) {
       log.info("Scanning project to save baseline\u2026");
-      const spinner = (0, import_ora2.default)({ text: "Running analysis\u2026", color: "cyan" }).start();
+      const spinner = (0, import_ora3.default)({ text: "Running analysis\u2026", color: "cyan" }).start();
       let result;
       try {
         result = await runEslint({ preset, targetPath: opts.path });
@@ -2091,30 +3433,30 @@ function registerBaselineCommand(program2) {
       }
       const baselinePath = saveBaseline(result, preset, mode, cwd);
       log.success(
-        `Baseline saved \u2192 ${import_chalk7.default.white(import_path8.default.relative(cwd, baselinePath))}`
+        `Baseline saved \u2192 ${import_chalk10.default.white(import_path11.default.relative(cwd, baselinePath))}`
       );
       log.info(`  ${result.totalIssues} issues recorded (${result.totalErrors} errors, ${result.totalWarnings} warnings)`);
-      log.info(`  Preset: ${import_chalk7.default.cyan(preset)}`);
-      log.info(`  Mode: ${import_chalk7.default.cyan(mode)}`);
+      log.info(`  Preset: ${import_chalk10.default.cyan(preset)}`);
+      log.info(`  Mode: ${import_chalk10.default.cyan(mode)}`);
       log.blank();
-      log.info("Future runs of " + import_chalk7.default.cyan("ai-guard baseline --check") + " will show only NEW issues.");
-      log.info("Add " + import_chalk7.default.white(BASELINE_FILE) + " to your git repository to share baseline with your team.");
+      log.info("Future runs of " + import_chalk10.default.cyan("ai-guard baseline --check") + " will show only NEW issues.");
+      log.info("Add " + import_chalk10.default.white(BASELINE_FILE) + " to your git repository to share baseline with your team.");
       log.blank();
       return;
     }
     if (doCheck) {
       if (!existingBaseline) {
-        log.error(`No baseline found at ${import_chalk7.default.white(BASELINE_FILE)}`);
-        log.info(`Run ${import_chalk7.default.cyan("ai-guard baseline --save")} first to create one.`);
+        log.error(`No baseline found at ${import_chalk10.default.white(BASELINE_FILE)}`);
+        log.info(`Run ${import_chalk10.default.cyan("ai-guard baseline --save")} first to create one.`);
         process.exit(1);
       }
       const baselineDate = new Date(existingBaseline.createdAt).toLocaleString();
-      log.info(`Baseline from: ${import_chalk7.default.gray(baselineDate)}`);
-      log.info(`Baseline preset: ${import_chalk7.default.cyan(existingBaseline.preset)}`);
-      log.info(`Baseline mode: ${import_chalk7.default.cyan(existingBaseline.mode ?? "strict")}`);
-      log.info(`Baseline issues: ${import_chalk7.default.gray(existingBaseline.totalIssues)}`);
+      log.info(`Baseline from: ${import_chalk10.default.gray(baselineDate)}`);
+      log.info(`Baseline preset: ${import_chalk10.default.cyan(existingBaseline.preset)}`);
+      log.info(`Baseline mode: ${import_chalk10.default.cyan(existingBaseline.mode ?? "strict")}`);
+      log.info(`Baseline issues: ${import_chalk10.default.gray(existingBaseline.totalIssues)}`);
       log.blank();
-      const spinner = (0, import_ora2.default)({ text: "Scanning for new issues\u2026", color: "cyan" }).start();
+      const spinner = (0, import_ora3.default)({ text: "Scanning for new issues\u2026", color: "cyan" }).start();
       let result;
       try {
         result = await runEslint({ preset, targetPath: opts.path });
@@ -2137,7 +3479,7 @@ function registerBaselineCommand(program2) {
         return;
       }
       log.print(
-        import_chalk7.default.bold.red(`  \u2716  ${newResult.totalIssues} new issue${newResult.totalIssues !== 1 ? "s" : ""} since baseline`)
+        import_chalk10.default.bold.red(`  \u2716  ${newResult.totalIssues} new issue${newResult.totalIssues !== 1 ? "s" : ""} since baseline`)
       );
       log.blank();
       if (newResult.ruleBreakdown.size > 0) {
@@ -2153,7 +3495,7 @@ function registerBaselineCommand(program2) {
         log.blank();
         for (const file of newResult.files) {
           log.print(
-            `  ${import_chalk7.default.bold.white(file.filePath)} ` + import_chalk7.default.gray(`(${file.issues.length} new)`)
+            `  ${import_chalk10.default.bold.white(file.filePath)} ` + import_chalk10.default.gray(`(${file.issues.length} new)`)
           );
           for (const issue of file.issues) {
             log.issue(issue.message, issue.severity, issue.line, issue.column);
@@ -2166,7 +3508,7 @@ function registerBaselineCommand(program2) {
       log.error(
         `${newResult.totalIssues} new issue${newResult.totalIssues !== 1 ? "s" : ""} introduced since baseline.`
       );
-      log.info(`Run ${import_chalk7.default.cyan("ai-guard baseline --save")} to update the baseline after fixing them.`);
+      log.info(`Run ${import_chalk10.default.cyan("ai-guard baseline --save")} to update the baseline after fixing them.`);
       log.blank();
       process.exit(1);
     }
@@ -2174,9 +3516,9 @@ function registerBaselineCommand(program2) {
 }
 
 // cli/commands/init-context.ts
-var import_fs6 = __toESM(require("fs"));
-var import_path9 = __toESM(require("path"));
-var import_chalk8 = __toESM(require("chalk"));
+var import_fs9 = __toESM(require("fs"));
+var import_path12 = __toESM(require("path"));
+var import_chalk11 = __toESM(require("chalk"));
 var import_prompts2 = require("@inquirer/prompts");
 var RULE_CATEGORIES = {
   "error-handling": [
@@ -2539,23 +3881,23 @@ var AGENTS = [
   {
     id: "copilot",
     label: "GitHub Copilot",
-    filePath: import_path9.default.join(".github", "copilot-instructions.md"),
+    filePath: import_path12.default.join(".github", "copilot-instructions.md"),
     generate: generateCopilotFile
   }
 ];
 function getPackageVersion2(cwd) {
   try {
-    const pkgPath = import_path9.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
-    if (import_fs6.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs6.default.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = import_path12.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
+    if (import_fs9.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs9.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
     }
   } catch {
   }
   try {
-    const pkgPath = import_path9.default.join(cwd, "package.json");
-    if (import_fs6.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs6.default.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = import_path12.default.join(cwd, "package.json");
+    if (import_fs9.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs9.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
     }
   } catch {
@@ -2584,7 +3926,7 @@ function registerInitContextCommand(program2) {
     const isForce = opts.force === true;
     log.banner("AI GUARD INIT-CONTEXT");
     if (isDryRun) {
-      log.print(`  ${import_chalk8.default.yellow("\u2691  DRY RUN \u2014 no files will be written")}`);
+      log.print(`  ${import_chalk11.default.yellow("\u2691  DRY RUN \u2014 no files will be written")}`);
       log.blank();
     }
     let selectedAgents;
@@ -2617,13 +3959,13 @@ function registerInitContextCommand(program2) {
         selectedAgents = AGENTS.filter((a) => selected.includes(a.id));
       }
     }
-    log.info(`Categories: ${import_chalk8.default.cyan(categories.join(", "))}`);
-    log.info(`Version: ${import_chalk8.default.cyan(version)}`);
+    log.info(`Categories: ${import_chalk11.default.cyan(categories.join(", "))}`);
+    log.info(`Version: ${import_chalk11.default.cyan(version)}`);
     log.blank();
     const results = [];
     for (const agent of selectedAgents) {
-      const fullPath = import_path9.default.join(cwd, agent.filePath);
-      const exists = import_fs6.default.existsSync(fullPath);
+      const fullPath = import_path12.default.join(cwd, agent.filePath);
+      const exists = import_fs9.default.existsSync(fullPath);
       if (exists && !isForce && !isDryRun) {
         const overwrite = await (0, import_prompts2.confirm)({
           message: `${agent.filePath} already exists. Overwrite?`,
@@ -2637,41 +3979,41 @@ function registerInitContextCommand(program2) {
       const content = agent.generate(version, categories);
       if (isDryRun) {
         log.section(`Preview: ${agent.filePath}`);
-        log.print(import_chalk8.default.gray("\u2500".repeat(60)));
+        log.print(import_chalk11.default.gray("\u2500".repeat(60)));
         for (const line of content.split("\n").slice(0, 20)) {
-          log.print(import_chalk8.default.gray(`  ${line}`));
+          log.print(import_chalk11.default.gray(`  ${line}`));
         }
-        log.print(import_chalk8.default.gray("  ... (truncated)"));
-        log.print(import_chalk8.default.gray("\u2500".repeat(60)));
+        log.print(import_chalk11.default.gray("  ... (truncated)"));
+        log.print(import_chalk11.default.gray("\u2500".repeat(60)));
         log.blank();
         results.push({ file: agent.filePath, status: "dry-run" });
         continue;
       }
-      const parentDir = import_path9.default.dirname(fullPath);
-      if (!import_fs6.default.existsSync(parentDir)) {
-        import_fs6.default.mkdirSync(parentDir, { recursive: true });
+      const parentDir = import_path12.default.dirname(fullPath);
+      if (!import_fs9.default.existsSync(parentDir)) {
+        import_fs9.default.mkdirSync(parentDir, { recursive: true });
       }
-      import_fs6.default.writeFileSync(fullPath, content, "utf-8");
+      import_fs9.default.writeFileSync(fullPath, content, "utf-8");
       results.push({ file: agent.filePath, status: "created" });
     }
     log.section("Summary");
     for (const result of results) {
       switch (result.status) {
         case "created":
-          log.print(`  ${import_chalk8.default.green("\u2705")} Created ${import_chalk8.default.white(result.file)}`);
+          log.print(`  ${import_chalk11.default.green("\u2705")} Created ${import_chalk11.default.white(result.file)}`);
           break;
         case "skipped":
-          log.print(`  ${import_chalk8.default.yellow("\u23ED")}  Skipped ${import_chalk8.default.white(result.file)} ${import_chalk8.default.gray("(already exists \u2014 use --force to overwrite)")}`);
+          log.print(`  ${import_chalk11.default.yellow("\u23ED")}  Skipped ${import_chalk11.default.white(result.file)} ${import_chalk11.default.gray("(already exists \u2014 use --force to overwrite)")}`);
           break;
         case "dry-run":
-          log.print(`  ${import_chalk8.default.cyan("\u{1F4DD}")} Would create ${import_chalk8.default.white(result.file)}`);
+          log.print(`  ${import_chalk11.default.cyan("\u{1F4DD}")} Would create ${import_chalk11.default.white(result.file)}`);
           break;
       }
     }
     log.blank();
     if (isDryRun) {
       log.info("Dry run complete \u2014 no files were written.");
-      log.info(`Re-run without ${import_chalk8.default.cyan("--dry-run")} to apply.`);
+      log.info(`Re-run without ${import_chalk11.default.cyan("--dry-run")} to apply.`);
     } else {
       const createdCount = results.filter((r) => r.status === "created").length;
       if (createdCount > 0) {
@@ -2685,9 +4027,9 @@ function registerInitContextCommand(program2) {
 }
 
 // cli/commands/report.ts
-var import_fs7 = __toESM(require("fs"));
-var import_path10 = __toESM(require("path"));
-var import_ora3 = __toESM(require("ora"));
+var import_fs10 = __toESM(require("fs"));
+var import_path13 = __toESM(require("path"));
+var import_ora4 = __toESM(require("ora"));
 var RULE_META = {
   "ai-guard/no-empty-catch": { description: "Empty catch blocks silently swallow errors", category: "Reliability" },
   "ai-guard/no-broad-exception": { description: "Catching all exceptions hides bugs", category: "Reliability" },
@@ -2710,28 +4052,28 @@ var RULE_META = {
 };
 function getProjectName(cwd) {
   try {
-    const pkgPath = import_path10.default.join(cwd, "package.json");
-    if (import_fs7.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs7.default.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = import_path13.default.join(cwd, "package.json");
+    if (import_fs10.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.name) return pkg.name;
     }
   } catch {
   }
-  return import_path10.default.basename(cwd);
+  return import_path13.default.basename(cwd);
 }
 function getPluginVersion(cwd) {
   try {
-    const pkgPath = import_path10.default.resolve(__dirname, "../../package.json");
-    if (import_fs7.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs7.default.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = import_path13.default.resolve(__dirname, "../../package.json");
+    if (import_fs10.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
     }
   } catch {
   }
   try {
-    const pkgPath = import_path10.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
-    if (import_fs7.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs7.default.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = import_path13.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
+    if (import_fs10.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
     }
   } catch {
@@ -3086,7 +4428,7 @@ function registerReportCommand(program2) {
     "Generate a beautiful HTML report of AI Guard scan results\nPerfect for sharing with your team or in Slack."
   ).option("--path <dir>", "Directory or file to scan", ".").option("--preset <preset>", "Rule preset: recommended | strict | security", "recommended").option("--html", "Generate HTML report (default behavior)").option("--json", "Output raw JSON to stdout instead of writing HTML").option("--output <filename>", "Output file name", "ai-guard-report.html").option("--no-open", "Do not open the report in the browser after generating").action(async (opts) => {
     const preset = ["recommended", "strict", "security"].includes(opts.preset) ? opts.preset : "recommended";
-    const spinner = opts.json ? null : (0, import_ora3.default)({ text: "Scanning\u2026", color: "cyan" }).start();
+    const spinner = opts.json ? null : (0, import_ora4.default)({ text: "Scanning\u2026", color: "cyan" }).start();
     let result;
     try {
       result = await runEslint({ preset, targetPath: opts.path });
@@ -3108,8 +4450,8 @@ function registerReportCommand(program2) {
     log.banner("AI GUARD REPORT");
     log.blank();
     const html = generateHtml(reportData);
-    const outputPath = import_path10.default.resolve(cwd, opts.output);
-    import_fs7.default.writeFileSync(outputPath, html, "utf-8");
+    const outputPath = import_path13.default.resolve(cwd, opts.output);
+    import_fs10.default.writeFileSync(outputPath, html, "utf-8");
     log.success(`Report saved: ${opts.output}`);
     log.info(
       `Score: ${reportData.score}/100 \xB7 ${reportData.totalErrors} errors \xB7 ${reportData.totalWarnings} warnings`
@@ -3124,9 +4466,9 @@ function registerReportCommand(program2) {
           await open(outputPath);
           log.info("Opened in your browser.");
         } else {
-          const { execSync } = await import("child_process");
+          const { execSync: execSync2 } = await import("child_process");
           const cmd = process.platform === "win32" ? `start "" "${outputPath}"` : process.platform === "darwin" ? `open "${outputPath}"` : `xdg-open "${outputPath}"`;
-          execSync(cmd);
+          execSync2(cmd);
           log.info("Opened in your browser.");
         }
       } catch {
@@ -3142,8 +4484,8 @@ function registerReportCommand(program2) {
 // cli/index.ts
 function getVersion() {
   try {
-    const pkgPath = import_path11.default.resolve(__dirname, "../../package.json");
-    const raw = import_fs8.default.readFileSync(pkgPath, "utf-8");
+    const pkgPath = import_path14.default.resolve(__dirname, "../../package.json");
+    const raw = import_fs11.default.readFileSync(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     return typeof pkg.version === "string" ? pkg.version : "0.0.0";
   } catch {
@@ -3152,9 +4494,10 @@ function getVersion() {
 }
 var program = new import_commander.Command();
 program.name("ai-guard").description(
-  "Production-grade CLI for eslint-plugin-ai-guard\nCatch AI-generated code issues instantly \u2014 no ESLint config required.\n\nQuick start:\n  npx ai-guard run          Scan current project\n  npx ai-guard init         Auto-configure ESLint\n  npx ai-guard init-context Generate AI agent rules\n  npx ai-guard report       Generate shareable HTML report\n  npx ai-guard doctor       Check your setup\n  npx ai-guard baseline     Save baseline, track new issues only"
+  "Production-grade CLI for eslint-plugin-ai-guard\nCatch AI-generated code issues instantly \u2014 no ESLint config required.\n\nQuick start:\n  npx ai-guard run          Scan current project\n  npx ai-guard changed      Scan only changed files (CI mode)\n  npx ai-guard init         Auto-configure ESLint\n  npx ai-guard init-context Generate AI agent rules\n  npx ai-guard report       Generate shareable HTML report\n  npx ai-guard doctor       Check your setup\n  npx ai-guard baseline     Save baseline, track new issues only"
 ).version(getVersion(), "-v, --version", "Print version number").helpOption("-h, --help", "Show help");
 registerRunCommand(program);
+registerChangedCommand(program);
 registerInitCommand(program);
 registerDoctorCommand(program);
 registerPresetCommand(program);