eslint-plugin-ai-guard 1.2.2 → 1.2.3

package/dist/cli/index.js

@@ -201,14 +201,14 @@ __export(config_manager_exports, {
 });
 function backupConfig(configPath) {
   const backupPath = `${configPath}.bak`;
-  import_fs6.default.copyFileSync(configPath, backupPath);
+  import_fs7.default.copyFileSync(configPath, backupPath);
   return backupPath;
 }
 function readConfig(configPath) {
-  return import_fs6.default.readFileSync(configPath, "utf-8");
+  return import_fs7.default.readFileSync(configPath, "utf-8");
 }
 function writeConfig(configPath, content) {
-  import_fs6.default.writeFileSync(configPath, content, "utf-8");
+  import_fs7.default.writeFileSync(configPath, content, "utf-8");
 }
 function generateFlatConfig(preset) {
   return `import aiGuard from 'eslint-plugin-ai-guard';
@@ -461,11 +461,11 @@ function validateLegacyConfigText(content) {
   }
   return problems;
 }
-var import_fs6, import_path6, AI_GUARD_MARKER, DEFAULT_FLAT_IGNORES, DEFAULT_LEGACY_IGNORES;
+var import_fs7, import_path6, AI_GUARD_MARKER, DEFAULT_FLAT_IGNORES, DEFAULT_LEGACY_IGNORES;
 var init_config_manager = __esm({
   "cli/utils/config-manager.ts"() {
     "use strict";
-    import_fs6 = __toESM(require("fs"));
+    import_fs7 = __toESM(require("fs"));
     import_path6 = __toESM(require("path"));
     AI_GUARD_MARKER = "eslint-plugin-ai-guard";
     DEFAULT_FLAT_IGNORES = [
@@ -489,10 +489,11 @@ var init_config_manager = __esm({
 
 // cli/index.ts
 var import_commander = require("commander");
-var import_fs11 = __toESM(require("fs"));
+var import_fs12 = __toESM(require("fs"));
 var import_path14 = __toESM(require("path"));
 
 // cli/commands/run.ts
+var import_fs4 = __toESM(require("fs"));
 var import_ora = __toESM(require("ora"));
 var import_chalk3 = __toESM(require("chalk"));
 
@@ -1250,6 +1251,50 @@ var RULE_DOCS = {
   "ai-guard/no-dead-branch": { shortDesc: "Dead code branch that can never execute", tags: ["ai-patterns"] }
 };
 var BASE_DOCS_URL = "https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules";
+function sanitizeSarifTags(tags) {
+  return Array.from(
+    new Set(
+      tags.filter((t) => typeof t === "string" && t.trim().length > 0).map((t) => t.toLowerCase().trim().replace(/\s+/g, "-"))
+    )
+  );
+}
+function sanitizeSarifProperties(props) {
+  return {
+    tags: sanitizeSarifTags(props.tags),
+    confidence: props.confidence ?? "low",
+    category: props.category ?? "AI Patterns",
+    "problem.severity": props.problemSeverity ?? "low"
+  };
+}
+function sanitizeSarifRule(rule) {
+  return {
+    ...rule,
+    shortDescription: {
+      text: rule.shortDescription.text || `ai-guard rule: ${rule.id}`
+    },
+    fullDescription: rule.fullDescription?.text ? rule.fullDescription : { text: rule.shortDescription.text || `ai-guard rule: ${rule.id}` },
+    properties: rule.properties ? {
+      ...rule.properties,
+      // Re-deduplicate tags at the rule level as a final safety net
+      tags: rule.properties.tags ? sanitizeSarifTags(rule.properties.tags) : []
+    } : void 0
+  };
+}
+function sanitizeSarifLog(log2) {
+  return {
+    ...log2,
+    runs: log2.runs.map((run) => ({
+      ...run,
+      tool: {
+        ...run.tool,
+        driver: {
+          ...run.tool.driver,
+          rules: run.tool.driver.rules.map(sanitizeSarifRule)
+        }
+      }
+    }))
+  };
+}
 function confidenceToSarifLevel(confidence) {
   switch (confidence) {
     case "high":
@@ -1311,6 +1356,8 @@ function buildRuleDescriptors(ruleIds) {
     const confidence = ISSUE_CONFIDENCE[id];
     const category = ISSUE_CATEGORY[id] ?? "AI Patterns";
     const remediation = ISSUE_REMEDIATION[id];
+    const categorySlug = category.toLowerCase().replace(/\s+/g, "-");
+    const rawTags = [...meta?.tags ?? ["ai-guard"], categorySlug];
     const helpMarkdown = [
       `**${meta?.shortDesc ?? shortName}**`,
       "",
@@ -1318,7 +1365,7 @@ function buildRuleDescriptors(ruleIds) {
       "",
       `[View rule documentation](${BASE_DOCS_URL}/${shortName}.md)`
     ].filter(Boolean).join("\n");
-    return {
+    return sanitizeSarifRule({
       id,
       shortDescription: {
         text: meta?.shortDesc ?? `ai-guard rule: ${shortName}`
@@ -1334,13 +1381,13 @@ function buildRuleDescriptors(ruleIds) {
       defaultConfiguration: {
         level: confidenceToSarifLevel(confidence)
       },
-      properties: {
-        tags: [...meta?.tags ?? ["ai-guard"], category.toLowerCase().replace(/ /g, "-")],
-        confidence: confidence ?? "low",
+      properties: sanitizeSarifProperties({
+        tags: rawTags,
+        confidence,
         category,
-        "problem.severity": confidenceToGitHubSeverity(confidence)
-      }
-    };
+        problemSeverity: confidenceToGitHubSeverity(confidence)
+      })
+    });
   });
 }
 function buildSarifResult(issue, file) {
@@ -1386,7 +1433,7 @@ function buildSarifLog(result, version = PKG_VERSION) {
       sarifResults.push(buildSarifResult(issue, file));
     }
   }
-  return {
+  const log2 = {
     $schema: "https://json.schemastore.org/sarif-2.1.0.json",
     version: "2.1.0",
     runs: [
@@ -1410,10 +1457,36 @@ function buildSarifLog(result, version = PKG_VERSION) {
       }
     ]
   };
+  return sanitizeSarifLog(log2);
 }
 function sarifToJson(log2) {
   return JSON.stringify(log2, null, 2);
 }
+function buildSarifDebugInfo(result) {
+  const usedRuleIds = collectUsedRuleIds(result);
+  const rulesEmitted = usedRuleIds.map((id) => {
+    const meta = RULE_DOCS[id];
+    const confidence = ISSUE_CONFIDENCE[id];
+    const category = ISSUE_CATEGORY[id] ?? "AI Patterns";
+    const categorySlug = category.toLowerCase().replace(/\s+/g, "-");
+    const rawTags = [...meta?.tags ?? ["ai-guard"], categorySlug];
+    const sanitizedTags = sanitizeSarifTags(rawTags);
+    return {
+      id,
+      rawTags,
+      sanitizedTags,
+      hasDuplicatesInRaw: rawTags.length !== new Set(rawTags).size,
+      confidence: confidence ?? "low",
+      category,
+      level: confidenceToSarifLevel(confidence)
+    };
+  });
+  return {
+    rulesEmitted,
+    totalResults: result.files.reduce((n, f) => n + f.issues.length, 0),
+    version: PKG_VERSION
+  };
+}
 
 // cli/utils/github-summary.ts
 var import_fs2 = __toESM(require("fs"));
@@ -1891,7 +1964,7 @@ function registerRunCommand(program2) {
     "--max-warnings <n>",
     "Fail with exit code 1 if warnings exceed this count",
     (value) => Number.parseInt(value, 10)
-  ).option("--verbose", "Show all issues \u2014 disable grouping of repeated warnings").option("--quiet", "Only show errors \u2014 suppress warnings and informational hints").option("--debug-timing", "Print per-phase timing diagnostics").action(async (opts) => {
+  ).option("--verbose", "Show all issues \u2014 disable grouping of repeated warnings").option("--quiet", "Only show errors \u2014 suppress warnings and informational hints").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-sarif", "Print SARIF tag normalization trace \u2014 diagnose duplicate-tag schema issues").option("--sarif-output <file>", "Write SARIF to this file instead of stdout").action(async (opts) => {
     if (opts.maxWarnings !== void 0 && (!Number.isInteger(opts.maxWarnings) || opts.maxWarnings < 0)) {
       log.blank();
       log.error("--max-warnings must be a non-negative integer.");
@@ -1943,9 +2016,36 @@ function registerRunCommand(program2) {
       writeGitHubSummary(result, { preset, scanMode: "full" });
       writeGitHubOutputs(result);
     }
-    if (opts.sarif) {
+    if (opts.sarif || opts.sarifOutput) {
       const sarifLog = buildSarifLog(result);
-      console.log(sarifToJson(sarifLog));
+      const sarifJson = sarifToJson(sarifLog);
+      if (opts.debugSarif) {
+        const debugInfo = buildSarifDebugInfo(result);
+        process.stderr.write("\n[debug-sarif] SARIF Tag Normalization Trace\n");
+        process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+        for (const r of debugInfo.rulesEmitted) {
+          process.stderr.write(`[debug-sarif] ${r.id}
+`);
+          process.stderr.write(`[debug-sarif]   raw:       ${JSON.stringify(r.rawTags)}
+`);
+          process.stderr.write(`[debug-sarif]   sanitized: ${JSON.stringify(r.sanitizedTags)}
+`);
+          if (r.hasDuplicatesInRaw) {
+            process.stderr.write(`[debug-sarif]   \u26A0 had duplicates \u2014 deduplicated
+`);
+          }
+        }
+        process.stderr.write("\n");
+      }
+      if (opts.sarifOutput) {
+        import_fs4.default.writeFileSync(opts.sarifOutput, sarifJson, "utf-8");
+        if (opts.debugSarif) {
+          process.stderr.write(`[debug-sarif] SARIF written to: ${opts.sarifOutput}
+`);
+        }
+      } else {
+        console.log(sarifJson);
+      }
       process.exit(resolveExitCode(result, opts.failOn ?? "errors", opts.maxWarnings));
       return;
     }
@@ -2280,7 +2380,7 @@ function resolveExitCode(result, failOn, maxWarnings) {
 
 // cli/commands/changed.ts
 var import_path4 = __toESM(require("path"));
-var import_fs4 = __toESM(require("fs"));
+var import_fs5 = __toESM(require("fs"));
 var import_ora2 = __toESM(require("ora"));
 var import_chalk5 = __toESM(require("chalk"));
 function registerChangedCommand(program2) {
@@ -2401,7 +2501,7 @@ function handleResults(result, opts, preset, scanMode, changedFilesCount, inCI,
     const sarifLog = buildSarifLog(result);
     const sarifJson = sarifToJson(sarifLog);
     if (resolvedSarifPath) {
-      import_fs4.default.writeFileSync(resolvedSarifPath, sarifJson, "utf-8");
+      import_fs5.default.writeFileSync(resolvedSarifPath, sarifJson, "utf-8");
     } else {
       console.log(sarifJson);
     }
@@ -2532,10 +2632,10 @@ function getFailOnExitCode(result, failOn, maxWarnings) {
 // cli/commands/init.ts
 var import_chalk6 = __toESM(require("chalk"));
 var import_path7 = __toESM(require("path"));
-var import_fs7 = __toESM(require("fs"));
+var import_fs8 = __toESM(require("fs"));
 
 // cli/utils/detector.ts
-var import_fs5 = __toESM(require("fs"));
+var import_fs6 = __toESM(require("fs"));
 var import_path5 = __toESM(require("path"));
 var import_module2 = require("module");
 var FLAT_CONFIG_FILES = [
@@ -2554,7 +2654,7 @@ var ALL_CONFIG_FILES = [...FLAT_CONFIG_FILES, ...LEGACY_CONFIG_FILES];
 function isPackageInstalled(pkgName, cwd = process.cwd()) {
   try {
     const pkgPath = import_path5.default.join(cwd, "node_modules", pkgName, "package.json");
-    if (import_fs5.default.existsSync(pkgPath)) {
+    if (import_fs6.default.existsSync(pkgPath)) {
       return true;
     }
     const req = (0, import_module2.createRequire)(import_path5.default.join(cwd, "package.json"));
@@ -2567,8 +2667,8 @@ function isPackageInstalled(pkgName, cwd = process.cwd()) {
 function getPackageVersion(pkgName, cwd = process.cwd()) {
   try {
     const pkgPath = import_path5.default.join(cwd, "node_modules", pkgName, "package.json");
-    const resolvedPath = import_fs5.default.existsSync(pkgPath) ? pkgPath : (0, import_module2.createRequire)(import_path5.default.join(cwd, "package.json")).resolve(`${pkgName}/package.json`);
-    const raw = import_fs5.default.readFileSync(resolvedPath, "utf-8");
+    const resolvedPath = import_fs6.default.existsSync(pkgPath) ? pkgPath : (0, import_module2.createRequire)(import_path5.default.join(cwd, "package.json")).resolve(`${pkgName}/package.json`);
+    const raw = import_fs6.default.readFileSync(resolvedPath, "utf-8");
     const json = JSON.parse(raw);
     return json.version ?? null;
   } catch {
@@ -2585,7 +2685,7 @@ function detectConfigType(cwd = process.cwd()) {
   let first = null;
   for (const { file, type } of ALL_CONFIG_FILES) {
     const fullPath = import_path5.default.join(cwd, file);
-    if (import_fs5.default.existsSync(fullPath)) {
+    if (import_fs6.default.existsSync(fullPath)) {
       found.push(fullPath);
       if (!first) first = { type, path: fullPath };
     }
@@ -2608,7 +2708,7 @@ function requiresFlatConfig(eslintMajor) {
 function detectNukeIgnore(configPath) {
   if (!configPath) return false;
   try {
-    const content = import_fs5.default.readFileSync(configPath, "utf-8");
+    const content = import_fs6.default.readFileSync(configPath, "utf-8");
     return content.includes('"**/*"') || content.includes("'**/*'");
   } catch {
     return false;
@@ -2843,10 +2943,10 @@ function registerInitCommand(program2) {
       const legacyConfigs = env.allConfigPaths.filter((p) => !p.includes("eslint.config."));
       let cleanedUp = false;
       for (const p of legacyConfigs) {
-        if (import_fs7.default.existsSync(p)) {
+        if (import_fs8.default.existsSync(p)) {
           if (!isDryRun) {
             try {
-              import_fs7.default.renameSync(p, `${p}.bak`);
+              import_fs8.default.renameSync(p, `${p}.bak`);
               cleanedUp = true;
             } catch (err) {
               const reason = err instanceof Error ? err.message : String(err);
@@ -2872,7 +2972,7 @@ function registerInitCommand(program2) {
     }
     log.blank();
     log.section("Validation");
-    if (!import_fs7.default.existsSync(finalConfigPath)) {
+    if (!import_fs8.default.existsSync(finalConfigPath)) {
       log.error(`Config file not found after write: ${import_path7.default.relative(cwd, finalConfigPath)}`);
       log.blank();
       log.print(`  ${import_chalk6.default.bold("Problem:")} File write may have failed.`);
@@ -2929,7 +3029,7 @@ function registerInitCommand(program2) {
     let cleanedUpInfo = false;
     if (eslintNeedsFlat) {
       const legacyConfigs = env.allConfigPaths.filter((p) => !p.includes("eslint.config."));
-      cleanedUpInfo = legacyConfigs.some((p) => import_fs7.default.existsSync(`${p}.bak`) && !import_fs7.default.existsSync(p));
+      cleanedUpInfo = legacyConfigs.some((p) => import_fs8.default.existsSync(`${p}.bak`) && !import_fs8.default.existsSync(p));
     }
     const lingeringConflicts = env.hasConflictingConfigs && !eslintNeedsFlat && !cleanedUpInfo;
     if (loadError === null && !lingeringConflicts) {
@@ -3319,7 +3419,7 @@ function registerIgnoreCommand(program2) {
 }
 
 // cli/commands/baseline.ts
-var import_fs8 = __toESM(require("fs"));
+var import_fs9 = __toESM(require("fs"));
 var import_path11 = __toESM(require("path"));
 var import_chalk10 = __toESM(require("chalk"));
 var import_ora3 = __toESM(require("ora"));
@@ -3342,14 +3442,14 @@ function saveBaseline(result, preset, mode, cwd) {
     entries
   };
   const baselinePath = import_path11.default.join(cwd, BASELINE_FILE);
-  import_fs8.default.writeFileSync(baselinePath, JSON.stringify(baseline, null, 2), "utf-8");
+  import_fs9.default.writeFileSync(baselinePath, JSON.stringify(baseline, null, 2), "utf-8");
   return baselinePath;
 }
 function loadBaseline(cwd) {
   const baselinePath = import_path11.default.join(cwd, BASELINE_FILE);
-  if (!import_fs8.default.existsSync(baselinePath)) return null;
+  if (!import_fs9.default.existsSync(baselinePath)) return null;
   try {
-    const raw = import_fs8.default.readFileSync(baselinePath, "utf-8");
+    const raw = import_fs9.default.readFileSync(baselinePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -3516,7 +3616,7 @@ function registerBaselineCommand(program2) {
 }
 
 // cli/commands/init-context.ts
-var import_fs9 = __toESM(require("fs"));
+var import_fs10 = __toESM(require("fs"));
 var import_path12 = __toESM(require("path"));
 var import_chalk11 = __toESM(require("chalk"));
 var import_prompts2 = require("@inquirer/prompts");
@@ -3888,16 +3988,16 @@ var AGENTS = [
 function getPackageVersion2(cwd) {
   try {
     const pkgPath = import_path12.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
-    if (import_fs9.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs9.default.readFileSync(pkgPath, "utf-8"));
+    if (import_fs10.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
     }
   } catch {
   }
   try {
     const pkgPath = import_path12.default.join(cwd, "package.json");
-    if (import_fs9.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs9.default.readFileSync(pkgPath, "utf-8"));
+    if (import_fs10.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
     }
   } catch {
@@ -3965,7 +4065,7 @@ function registerInitContextCommand(program2) {
     const results = [];
     for (const agent of selectedAgents) {
       const fullPath = import_path12.default.join(cwd, agent.filePath);
-      const exists = import_fs9.default.existsSync(fullPath);
+      const exists = import_fs10.default.existsSync(fullPath);
       if (exists && !isForce && !isDryRun) {
         const overwrite = await (0, import_prompts2.confirm)({
           message: `${agent.filePath} already exists. Overwrite?`,
@@ -3990,10 +4090,10 @@ function registerInitContextCommand(program2) {
         continue;
       }
       const parentDir = import_path12.default.dirname(fullPath);
-      if (!import_fs9.default.existsSync(parentDir)) {
-        import_fs9.default.mkdirSync(parentDir, { recursive: true });
+      if (!import_fs10.default.existsSync(parentDir)) {
+        import_fs10.default.mkdirSync(parentDir, { recursive: true });
       }
-      import_fs9.default.writeFileSync(fullPath, content, "utf-8");
+      import_fs10.default.writeFileSync(fullPath, content, "utf-8");
       results.push({ file: agent.filePath, status: "created" });
     }
     log.section("Summary");
@@ -4027,7 +4127,7 @@ function registerInitContextCommand(program2) {
 }
 
 // cli/commands/report.ts
-var import_fs10 = __toESM(require("fs"));
+var import_fs11 = __toESM(require("fs"));
 var import_path13 = __toESM(require("path"));
 var import_ora4 = __toESM(require("ora"));
 var RULE_META = {
@@ -4053,8 +4153,8 @@ var RULE_META = {
 function getProjectName(cwd) {
   try {
     const pkgPath = import_path13.default.join(cwd, "package.json");
-    if (import_fs10.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
+    if (import_fs11.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs11.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.name) return pkg.name;
     }
   } catch {
@@ -4064,16 +4164,16 @@ function getProjectName(cwd) {
 function getPluginVersion(cwd) {
   try {
     const pkgPath = import_path13.default.resolve(__dirname, "../../package.json");
-    if (import_fs10.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
+    if (import_fs11.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs11.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
     }
   } catch {
   }
   try {
     const pkgPath = import_path13.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
-    if (import_fs10.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
+    if (import_fs11.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs11.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
     }
   } catch {
@@ -4451,7 +4551,7 @@ function registerReportCommand(program2) {
     log.blank();
     const html = generateHtml(reportData);
     const outputPath = import_path13.default.resolve(cwd, opts.output);
-    import_fs10.default.writeFileSync(outputPath, html, "utf-8");
+    import_fs11.default.writeFileSync(outputPath, html, "utf-8");
     log.success(`Report saved: ${opts.output}`);
     log.info(
       `Score: ${reportData.score}/100 \xB7 ${reportData.totalErrors} errors \xB7 ${reportData.totalWarnings} warnings`
@@ -4485,7 +4585,7 @@ function registerReportCommand(program2) {
 function getVersion() {
   try {
     const pkgPath = import_path14.default.resolve(__dirname, "../../package.json");
-    const raw = import_fs11.default.readFileSync(pkgPath, "utf-8");
+    const raw = import_fs12.default.readFileSync(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     return typeof pkg.version === "string" ? pkg.version : "0.0.0";
   } catch {