eslint-plugin-ai-guard 1.2.2 → 1.2.4

package/dist/cli/index.js

@@ -201,14 +201,14 @@ __export(config_manager_exports, {
 });
 function backupConfig(configPath) {
   const backupPath = `${configPath}.bak`;
-  import_fs6.default.copyFileSync(configPath, backupPath);
+  import_fs7.default.copyFileSync(configPath, backupPath);
   return backupPath;
 }
 function readConfig(configPath) {
-  return import_fs6.default.readFileSync(configPath, "utf-8");
+  return import_fs7.default.readFileSync(configPath, "utf-8");
 }
 function writeConfig(configPath, content) {
-  import_fs6.default.writeFileSync(configPath, content, "utf-8");
+  import_fs7.default.writeFileSync(configPath, content, "utf-8");
 }
 function generateFlatConfig(preset) {
   return `import aiGuard from 'eslint-plugin-ai-guard';
@@ -461,11 +461,11 @@ function validateLegacyConfigText(content) {
   }
   return problems;
 }
-var import_fs6, import_path6, AI_GUARD_MARKER, DEFAULT_FLAT_IGNORES, DEFAULT_LEGACY_IGNORES;
+var import_fs7, import_path6, AI_GUARD_MARKER, DEFAULT_FLAT_IGNORES, DEFAULT_LEGACY_IGNORES;
 var init_config_manager = __esm({
   "cli/utils/config-manager.ts"() {
     "use strict";
-    import_fs6 = __toESM(require("fs"));
+    import_fs7 = __toESM(require("fs"));
     import_path6 = __toESM(require("path"));
     AI_GUARD_MARKER = "eslint-plugin-ai-guard";
     DEFAULT_FLAT_IGNORES = [
@@ -489,10 +489,11 @@ var init_config_manager = __esm({
 
 // cli/index.ts
 var import_commander = require("commander");
-var import_fs11 = __toESM(require("fs"));
+var import_fs12 = __toESM(require("fs"));
 var import_path14 = __toESM(require("path"));
 
 // cli/commands/run.ts
+var import_fs4 = __toESM(require("fs"));
 var import_ora = __toESM(require("ora"));
 var import_chalk3 = __toESM(require("chalk"));
 
@@ -1250,6 +1251,80 @@ var RULE_DOCS = {
   "ai-guard/no-dead-branch": { shortDesc: "Dead code branch that can never execute", tags: ["ai-patterns"] }
 };
 var BASE_DOCS_URL = "https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules";
+function sanitizeSarifTags(tags) {
+  return Array.from(
+    new Set(
+      tags.filter((t) => typeof t === "string" && t.trim().length > 0).map((t) => t.toLowerCase().trim().replace(/\s+/g, "-"))
+    )
+  );
+}
+function sanitizeSarifProperties(props) {
+  const confidence = props.confidence ?? "low";
+  return {
+    tags: sanitizeSarifTags(props.tags),
+    confidence,
+    category: props.category ?? "AI Patterns",
+    "security-severity": confidenceToSecuritySeverity(confidence),
+    precision: confidenceToPrecision(confidence)
+  };
+}
+function sanitizeSarifRule(rule) {
+  return {
+    ...rule,
+    shortDescription: {
+      text: rule.shortDescription.text || `ai-guard rule: ${rule.id}`
+    },
+    fullDescription: rule.fullDescription?.text ? rule.fullDescription : { text: rule.shortDescription.text || `ai-guard rule: ${rule.id}` },
+    properties: rule.properties ? {
+      ...rule.properties,
+      // Re-deduplicate tags at the rule level as a final safety net
+      tags: rule.properties.tags ? sanitizeSarifTags(rule.properties.tags) : []
+    } : void 0
+  };
+}
+function sanitizeSarifLog(log2) {
+  return {
+    ...log2,
+    runs: log2.runs.map((run) => ({
+      ...run,
+      tool: {
+        ...run.tool,
+        driver: {
+          ...run.tool.driver,
+          rules: run.tool.driver.rules.map(sanitizeSarifRule)
+        }
+      }
+    }))
+  };
+}
+function confidenceToSecuritySeverity(confidence) {
+  switch (confidence) {
+    case "high":
+      return "8.0";
+    case "medium":
+      return "5.0";
+    case "low":
+      return "3.0";
+    case "informational":
+      return "1.0";
+    default:
+      return "3.0";
+  }
+}
+function confidenceToPrecision(confidence) {
+  switch (confidence) {
+    case "high":
+      return "high";
+    case "medium":
+      return "medium";
+    case "low":
+      return "low";
+    case "informational":
+      return "low";
+    default:
+      return "low";
+  }
+}
 function confidenceToSarifLevel(confidence) {
   switch (confidence) {
     case "high":
@@ -1278,20 +1353,6 @@ function confidenceToRank(confidence) {
       return 30;
   }
 }
-function confidenceToGitHubSeverity(confidence) {
-  switch (confidence) {
-    case "high":
-      return "high";
-    case "medium":
-      return "medium";
-    case "low":
-      return "low";
-    case "informational":
-      return "recommendation";
-    default:
-      return "low";
-  }
-}
 function filePathToUri(filePath) {
   return filePath.replace(/\\/g, "/");
 }
@@ -1311,6 +1372,8 @@ function buildRuleDescriptors(ruleIds) {
     const confidence = ISSUE_CONFIDENCE[id];
     const category = ISSUE_CATEGORY[id] ?? "AI Patterns";
     const remediation = ISSUE_REMEDIATION[id];
+    const categorySlug = category.toLowerCase().replace(/\s+/g, "-");
+    const rawTags = [...meta?.tags ?? ["ai-guard"], categorySlug];
     const helpMarkdown = [
       `**${meta?.shortDesc ?? shortName}**`,
       "",
@@ -1318,7 +1381,7 @@ function buildRuleDescriptors(ruleIds) {
       "",
       `[View rule documentation](${BASE_DOCS_URL}/${shortName}.md)`
     ].filter(Boolean).join("\n");
-    return {
+    return sanitizeSarifRule({
       id,
       shortDescription: {
         text: meta?.shortDesc ?? `ai-guard rule: ${shortName}`
@@ -1334,13 +1397,12 @@ function buildRuleDescriptors(ruleIds) {
       defaultConfiguration: {
         level: confidenceToSarifLevel(confidence)
       },
-      properties: {
-        tags: [...meta?.tags ?? ["ai-guard"], category.toLowerCase().replace(/ /g, "-")],
-        confidence: confidence ?? "low",
-        category,
-        "problem.severity": confidenceToGitHubSeverity(confidence)
-      }
-    };
+      properties: sanitizeSarifProperties({
+        tags: rawTags,
+        confidence,
+        category
+      })
+    });
   });
 }
 function buildSarifResult(issue, file) {
@@ -1372,11 +1434,87 @@ function buildSarifResult(issue, file) {
     ],
     properties: {
       confidence: confidence ?? "low",
+      "security-severity": confidenceToSecuritySeverity(confidence),
+      precision: confidenceToPrecision(confidence),
       ...asyncRiskType && { asyncRiskType },
       ...category && { category }
     }
   };
 }
+function enhanceTagsWithGitHubSemantics(ruleId, baseTags) {
+  const category = ISSUE_CATEGORY[ruleId];
+  const tags = [...baseTags];
+  if (category === "Security" || ruleId.includes("secret") || ruleId.includes("eval") || ruleId.includes("sql") || ruleId.includes("deserialize") || ruleId.includes("auth")) {
+    tags.push("security", "correctness", "reliability");
+  } else {
+    tags.push("correctness", "reliability");
+  }
+  return sanitizeSarifTags(tags);
+}
+function normalizeSarifForGitHub(log2) {
+  const normalizedRuns = log2.runs.map((run) => {
+    const rules = run.tool.driver.rules.map((rule) => {
+      const confidence = ISSUE_CONFIDENCE[rule.id];
+      const properties = rule.properties || {};
+      properties["security-severity"] = confidenceToSecuritySeverity(confidence);
+      properties["precision"] = confidenceToPrecision(confidence);
+      const currentTags = properties.tags || [];
+      properties.tags = enhanceTagsWithGitHubSemantics(rule.id, currentTags);
+      delete properties["problem.severity"];
+      const defaultConfiguration = rule.defaultConfiguration || { level: "warning" };
+      let normalizedConfigLevel = defaultConfiguration.level;
+      if (!["error", "warning", "note", "none"].includes(normalizedConfigLevel)) {
+        normalizedConfigLevel = confidenceToSarifLevel(confidence);
+      }
+      if (normalizedConfigLevel === "none") {
+        normalizedConfigLevel = "note";
+      }
+      return {
+        ...rule,
+        defaultConfiguration: {
+          ...defaultConfiguration,
+          level: normalizedConfigLevel
+        },
+        properties
+      };
+    });
+    const results = run.results.map((result) => {
+      const confidence = ISSUE_CONFIDENCE[result.ruleId];
+      const properties = result.properties || {};
+      properties["security-severity"] = confidenceToSecuritySeverity(confidence);
+      properties["precision"] = confidenceToPrecision(confidence);
+      let normalizedLevel = result.level;
+      if (!["error", "warning", "note", "none"].includes(normalizedLevel)) {
+        normalizedLevel = confidenceToSarifLevel(confidence);
+      }
+      if (normalizedLevel === "none") {
+        normalizedLevel = "note";
+      }
+      const kind = confidence === "informational" ? "informational" : "fail";
+      return {
+        ...result,
+        level: normalizedLevel,
+        kind,
+        properties
+      };
+    });
+    return {
+      ...run,
+      tool: {
+        ...run.tool,
+        driver: {
+          ...run.tool.driver,
+          rules
+        }
+      },
+      results
+    };
+  });
+  return {
+    ...log2,
+    runs: normalizedRuns
+  };
+}
 function buildSarifLog(result, version = PKG_VERSION) {
   const usedRuleIds = collectUsedRuleIds(result);
   const rules = buildRuleDescriptors(usedRuleIds);
@@ -1386,7 +1524,7 @@ function buildSarifLog(result, version = PKG_VERSION) {
       sarifResults.push(buildSarifResult(issue, file));
     }
   }
-  return {
+  const log2 = {
     $schema: "https://json.schemastore.org/sarif-2.1.0.json",
     version: "2.1.0",
     runs: [
@@ -1410,10 +1548,54 @@ function buildSarifLog(result, version = PKG_VERSION) {
       }
     ]
   };
+  return normalizeSarifForGitHub(sanitizeSarifLog(log2));
 }
 function sarifToJson(log2) {
   return JSON.stringify(log2, null, 2);
 }
+function buildSarifDebugInfo(result) {
+  const usedRuleIds = collectUsedRuleIds(result);
+  const rulesEmitted = usedRuleIds.map((id) => {
+    const meta = RULE_DOCS[id];
+    const confidence = ISSUE_CONFIDENCE[id];
+    const category = ISSUE_CATEGORY[id] ?? "AI Patterns";
+    const categorySlug = category.toLowerCase().replace(/\s+/g, "-");
+    const rawTags = [...meta?.tags ?? ["ai-guard"], categorySlug];
+    const sanitizedTags = enhanceTagsWithGitHubSemantics(id, rawTags);
+    return {
+      id,
+      rawTags,
+      sanitizedTags,
+      hasDuplicatesInRaw: rawTags.length !== new Set(rawTags).size,
+      confidence: confidence ?? "low",
+      category,
+      level: confidenceToSarifLevel(confidence),
+      securitySeverity: confidenceToSecuritySeverity(confidence),
+      precision: confidenceToPrecision(confidence)
+    };
+  });
+  const resultsEmitted = [];
+  for (const file of result.files) {
+    for (const issue of file.issues) {
+      const confidence = ISSUE_CONFIDENCE[issue.ruleId];
+      resultsEmitted.push({
+        ruleId: issue.ruleId,
+        level: confidenceToSarifLevel(confidence),
+        kind: confidence === "informational" ? "informational" : "fail",
+        securitySeverity: confidenceToSecuritySeverity(confidence),
+        precision: confidenceToPrecision(confidence),
+        filePath: file.filePath,
+        line: issue.line
+      });
+    }
+  }
+  return {
+    rulesEmitted,
+    resultsEmitted,
+    totalResults: result.files.reduce((n, f) => n + f.issues.length, 0),
+    version: PKG_VERSION
+  };
+}
 
 // cli/utils/github-summary.ts
 var import_fs2 = __toESM(require("fs"));
@@ -1891,7 +2073,7 @@ function registerRunCommand(program2) {
     "--max-warnings <n>",
     "Fail with exit code 1 if warnings exceed this count",
     (value) => Number.parseInt(value, 10)
-  ).option("--verbose", "Show all issues \u2014 disable grouping of repeated warnings").option("--quiet", "Only show errors \u2014 suppress warnings and informational hints").option("--debug-timing", "Print per-phase timing diagnostics").action(async (opts) => {
+  ).option("--verbose", "Show all issues \u2014 disable grouping of repeated warnings").option("--quiet", "Only show errors \u2014 suppress warnings and informational hints").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-sarif", "Print SARIF tag normalization trace \u2014 diagnose duplicate-tag schema issues").option("--sarif-output <file>", "Write SARIF to this file instead of stdout").action(async (opts) => {
     if (opts.maxWarnings !== void 0 && (!Number.isInteger(opts.maxWarnings) || opts.maxWarnings < 0)) {
       log.blank();
       log.error("--max-warnings must be a non-negative integer.");
@@ -1943,9 +2125,62 @@ function registerRunCommand(program2) {
       writeGitHubSummary(result, { preset, scanMode: "full" });
       writeGitHubOutputs(result);
     }
-    if (opts.sarif) {
+    if (opts.sarif || opts.sarifOutput) {
       const sarifLog = buildSarifLog(result);
-      console.log(sarifToJson(sarifLog));
+      const sarifJson = sarifToJson(sarifLog);
+      if (opts.debugSarif) {
+        const debugInfo = buildSarifDebugInfo(result);
+        process.stderr.write("\n[debug-sarif] SARIF GitHub Compatibility Trace\n");
+        process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+        process.stderr.write("[debug-sarif] Rules Emitted:\n");
+        for (const r of debugInfo.rulesEmitted) {
+          process.stderr.write(`[debug-sarif]   - ${r.id}:
+`);
+          process.stderr.write(`[debug-sarif]     confidence:        ${r.confidence}
+`);
+          process.stderr.write(`[debug-sarif]     level:             ${r.level}
+`);
+          process.stderr.write(`[debug-sarif]     security-severity: ${r.securitySeverity}
+`);
+          process.stderr.write(`[debug-sarif]     precision:         ${r.precision}
+`);
+          process.stderr.write(`[debug-sarif]     raw tags:          ${JSON.stringify(r.rawTags)}
+`);
+          process.stderr.write(`[debug-sarif]     normalized tags:   ${JSON.stringify(r.sanitizedTags)}
+`);
+          if (r.hasDuplicatesInRaw) {
+            process.stderr.write(`[debug-sarif]     \u26A0 had duplicates \u2014 deduplicated
+`);
+          }
+        }
+        process.stderr.write("\n[debug-sarif] Results Emitted:\n");
+        if (debugInfo.resultsEmitted.length === 0) {
+          process.stderr.write("[debug-sarif]   (none)\n");
+        } else {
+          for (const res of debugInfo.resultsEmitted) {
+            process.stderr.write(`[debug-sarif]   - ${res.ruleId} (${res.filePath}:${res.line}):
+`);
+            process.stderr.write(`[debug-sarif]     level:             ${res.level}
+`);
+            process.stderr.write(`[debug-sarif]     kind:              ${res.kind}
+`);
+            process.stderr.write(`[debug-sarif]     security-severity: ${res.securitySeverity}
+`);
+            process.stderr.write(`[debug-sarif]     precision:         ${res.precision}
+`);
+          }
+        }
+        process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
+      }
+      if (opts.sarifOutput) {
+        import_fs4.default.writeFileSync(opts.sarifOutput, sarifJson, "utf-8");
+        if (opts.debugSarif) {
+          process.stderr.write(`[debug-sarif] SARIF written to: ${opts.sarifOutput}
+`);
+        }
+      } else {
+        console.log(sarifJson);
+      }
       process.exit(resolveExitCode(result, opts.failOn ?? "errors", opts.maxWarnings));
       return;
     }
@@ -2280,7 +2515,7 @@ function resolveExitCode(result, failOn, maxWarnings) {
 
 // cli/commands/changed.ts
 var import_path4 = __toESM(require("path"));
-var import_fs4 = __toESM(require("fs"));
+var import_fs5 = __toESM(require("fs"));
 var import_ora2 = __toESM(require("ora"));
 var import_chalk5 = __toESM(require("chalk"));
 function registerChangedCommand(program2) {
@@ -2288,7 +2523,7 @@ function registerChangedCommand(program2) {
     "--max-warnings <n>",
     "Fail if warnings exceed this count",
     (v) => Number.parseInt(v, 10)
-  ).option("--verbose", "Expand all findings (disable grouping)").option("--quiet", "Show errors only").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-git", "Print full git resolution trace (useful for diagnosing zero-file issues)").option("--debug-ci", "Print CI environment state (GITHUB_* vars, SARIF path, summary path)").action(async (opts) => {
+  ).option("--verbose", "Expand all findings (disable grouping)").option("--quiet", "Show errors only").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-git", "Print full git resolution trace (useful for diagnosing zero-file issues)").option("--debug-ci", "Print CI environment state (GITHUB_* vars, SARIF path, summary path)").option("--debug-sarif", "Print SARIF tag normalization trace \u2014 diagnose duplicate-tag schema issues").action(async (opts) => {
     const preset = opts.strict ? "strict" : opts.security ? "security" : "recommended";
     const inCI = isGitHubActions();
     const baseRef = opts.base ?? (opts.pr || inCI ? getGitHubBaseRef() : void 0);
@@ -2400,8 +2635,56 @@ function handleResults(result, opts, preset, scanMode, changedFilesCount, inCI,
   if (opts.sarif) {
     const sarifLog = buildSarifLog(result);
     const sarifJson = sarifToJson(sarifLog);
+    if (opts.debugSarif) {
+      const debugInfo = buildSarifDebugInfo(result);
+      process.stderr.write("\n[debug-sarif] SARIF GitHub Compatibility Trace\n");
+      process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+      process.stderr.write("[debug-sarif] Rules Emitted:\n");
+      for (const r of debugInfo.rulesEmitted) {
+        process.stderr.write(`[debug-sarif]   - ${r.id}:
+`);
+        process.stderr.write(`[debug-sarif]     confidence:        ${r.confidence}
+`);
+        process.stderr.write(`[debug-sarif]     level:             ${r.level}
+`);
+        process.stderr.write(`[debug-sarif]     security-severity: ${r.securitySeverity}
+`);
+        process.stderr.write(`[debug-sarif]     precision:         ${r.precision}
+`);
+        process.stderr.write(`[debug-sarif]     raw tags:          ${JSON.stringify(r.rawTags)}
+`);
+        process.stderr.write(`[debug-sarif]     normalized tags:   ${JSON.stringify(r.sanitizedTags)}
+`);
+        if (r.hasDuplicatesInRaw) {
+          process.stderr.write(`[debug-sarif]     \u26A0 had duplicates \u2014 deduplicated
+`);
+        }
+      }
+      process.stderr.write("\n[debug-sarif] Results Emitted:\n");
+      if (debugInfo.resultsEmitted.length === 0) {
+        process.stderr.write("[debug-sarif]   (none)\n");
+      } else {
+        for (const res of debugInfo.resultsEmitted) {
+          process.stderr.write(`[debug-sarif]   - ${res.ruleId} (${res.filePath}:${res.line}):
+`);
+          process.stderr.write(`[debug-sarif]     level:             ${res.level}
+`);
+          process.stderr.write(`[debug-sarif]     kind:              ${res.kind}
+`);
+          process.stderr.write(`[debug-sarif]     security-severity: ${res.securitySeverity}
+`);
+          process.stderr.write(`[debug-sarif]     precision:         ${res.precision}
+`);
+        }
+      }
+      process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
+    }
     if (resolvedSarifPath) {
-      import_fs4.default.writeFileSync(resolvedSarifPath, sarifJson, "utf-8");
+      import_fs5.default.writeFileSync(resolvedSarifPath, sarifJson, "utf-8");
+      if (opts.debugSarif) {
+        process.stderr.write(`[debug-sarif] SARIF written to: ${resolvedSarifPath}
+`);
+      }
     } else {
       console.log(sarifJson);
     }
@@ -2532,10 +2815,10 @@ function getFailOnExitCode(result, failOn, maxWarnings) {
 // cli/commands/init.ts
 var import_chalk6 = __toESM(require("chalk"));
 var import_path7 = __toESM(require("path"));
-var import_fs7 = __toESM(require("fs"));
+var import_fs8 = __toESM(require("fs"));
 
 // cli/utils/detector.ts
-var import_fs5 = __toESM(require("fs"));
+var import_fs6 = __toESM(require("fs"));
 var import_path5 = __toESM(require("path"));
 var import_module2 = require("module");
 var FLAT_CONFIG_FILES = [
@@ -2554,7 +2837,7 @@ var ALL_CONFIG_FILES = [...FLAT_CONFIG_FILES, ...LEGACY_CONFIG_FILES];
 function isPackageInstalled(pkgName, cwd = process.cwd()) {
   try {
     const pkgPath = import_path5.default.join(cwd, "node_modules", pkgName, "package.json");
-    if (import_fs5.default.existsSync(pkgPath)) {
+    if (import_fs6.default.existsSync(pkgPath)) {
       return true;
     }
     const req = (0, import_module2.createRequire)(import_path5.default.join(cwd, "package.json"));
@@ -2567,8 +2850,8 @@ function isPackageInstalled(pkgName, cwd = process.cwd()) {
 function getPackageVersion(pkgName, cwd = process.cwd()) {
   try {
     const pkgPath = import_path5.default.join(cwd, "node_modules", pkgName, "package.json");
-    const resolvedPath = import_fs5.default.existsSync(pkgPath) ? pkgPath : (0, import_module2.createRequire)(import_path5.default.join(cwd, "package.json")).resolve(`${pkgName}/package.json`);
-    const raw = import_fs5.default.readFileSync(resolvedPath, "utf-8");
+    const resolvedPath = import_fs6.default.existsSync(pkgPath) ? pkgPath : (0, import_module2.createRequire)(import_path5.default.join(cwd, "package.json")).resolve(`${pkgName}/package.json`);
+    const raw = import_fs6.default.readFileSync(resolvedPath, "utf-8");
     const json = JSON.parse(raw);
     return json.version ?? null;
   } catch {
@@ -2585,7 +2868,7 @@ function detectConfigType(cwd = process.cwd()) {
   let first = null;
   for (const { file, type } of ALL_CONFIG_FILES) {
     const fullPath = import_path5.default.join(cwd, file);
-    if (import_fs5.default.existsSync(fullPath)) {
+    if (import_fs6.default.existsSync(fullPath)) {
       found.push(fullPath);
       if (!first) first = { type, path: fullPath };
     }
@@ -2608,7 +2891,7 @@ function requiresFlatConfig(eslintMajor) {
 function detectNukeIgnore(configPath) {
   if (!configPath) return false;
   try {
-    const content = import_fs5.default.readFileSync(configPath, "utf-8");
+    const content = import_fs6.default.readFileSync(configPath, "utf-8");
     return content.includes('"**/*"') || content.includes("'**/*'");
   } catch {
     return false;
@@ -2843,10 +3126,10 @@ function registerInitCommand(program2) {
       const legacyConfigs = env.allConfigPaths.filter((p) => !p.includes("eslint.config."));
       let cleanedUp = false;
       for (const p of legacyConfigs) {
-        if (import_fs7.default.existsSync(p)) {
+        if (import_fs8.default.existsSync(p)) {
           if (!isDryRun) {
             try {
-              import_fs7.default.renameSync(p, `${p}.bak`);
+              import_fs8.default.renameSync(p, `${p}.bak`);
               cleanedUp = true;
             } catch (err) {
               const reason = err instanceof Error ? err.message : String(err);
@@ -2872,7 +3155,7 @@ function registerInitCommand(program2) {
     }
     log.blank();
     log.section("Validation");
-    if (!import_fs7.default.existsSync(finalConfigPath)) {
+    if (!import_fs8.default.existsSync(finalConfigPath)) {
       log.error(`Config file not found after write: ${import_path7.default.relative(cwd, finalConfigPath)}`);
       log.blank();
       log.print(`  ${import_chalk6.default.bold("Problem:")} File write may have failed.`);
@@ -2929,7 +3212,7 @@ function registerInitCommand(program2) {
     let cleanedUpInfo = false;
     if (eslintNeedsFlat) {
       const legacyConfigs = env.allConfigPaths.filter((p) => !p.includes("eslint.config."));
-      cleanedUpInfo = legacyConfigs.some((p) => import_fs7.default.existsSync(`${p}.bak`) && !import_fs7.default.existsSync(p));
+      cleanedUpInfo = legacyConfigs.some((p) => import_fs8.default.existsSync(`${p}.bak`) && !import_fs8.default.existsSync(p));
     }
     const lingeringConflicts = env.hasConflictingConfigs && !eslintNeedsFlat && !cleanedUpInfo;
     if (loadError === null && !lingeringConflicts) {
@@ -3319,7 +3602,7 @@ function registerIgnoreCommand(program2) {
 }
 
 // cli/commands/baseline.ts
-var import_fs8 = __toESM(require("fs"));
+var import_fs9 = __toESM(require("fs"));
 var import_path11 = __toESM(require("path"));
 var import_chalk10 = __toESM(require("chalk"));
 var import_ora3 = __toESM(require("ora"));
@@ -3342,14 +3625,14 @@ function saveBaseline(result, preset, mode, cwd) {
     entries
   };
   const baselinePath = import_path11.default.join(cwd, BASELINE_FILE);
-  import_fs8.default.writeFileSync(baselinePath, JSON.stringify(baseline, null, 2), "utf-8");
+  import_fs9.default.writeFileSync(baselinePath, JSON.stringify(baseline, null, 2), "utf-8");
   return baselinePath;
 }
 function loadBaseline(cwd) {
   const baselinePath = import_path11.default.join(cwd, BASELINE_FILE);
-  if (!import_fs8.default.existsSync(baselinePath)) return null;
+  if (!import_fs9.default.existsSync(baselinePath)) return null;
   try {
-    const raw = import_fs8.default.readFileSync(baselinePath, "utf-8");
+    const raw = import_fs9.default.readFileSync(baselinePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -3516,7 +3799,7 @@ function registerBaselineCommand(program2) {
 }
 
 // cli/commands/init-context.ts
-var import_fs9 = __toESM(require("fs"));
+var import_fs10 = __toESM(require("fs"));
 var import_path12 = __toESM(require("path"));
 var import_chalk11 = __toESM(require("chalk"));
 var import_prompts2 = require("@inquirer/prompts");
@@ -3888,16 +4171,16 @@ var AGENTS = [
 function getPackageVersion2(cwd) {
   try {
     const pkgPath = import_path12.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
-    if (import_fs9.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs9.default.readFileSync(pkgPath, "utf-8"));
+    if (import_fs10.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
     }
   } catch {
   }
   try {
     const pkgPath = import_path12.default.join(cwd, "package.json");
-    if (import_fs9.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs9.default.readFileSync(pkgPath, "utf-8"));
+    if (import_fs10.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
     }
   } catch {
@@ -3965,7 +4248,7 @@ function registerInitContextCommand(program2) {
     const results = [];
     for (const agent of selectedAgents) {
       const fullPath = import_path12.default.join(cwd, agent.filePath);
-      const exists = import_fs9.default.existsSync(fullPath);
+      const exists = import_fs10.default.existsSync(fullPath);
       if (exists && !isForce && !isDryRun) {
         const overwrite = await (0, import_prompts2.confirm)({
           message: `${agent.filePath} already exists. Overwrite?`,
@@ -3990,10 +4273,10 @@ function registerInitContextCommand(program2) {
         continue;
       }
       const parentDir = import_path12.default.dirname(fullPath);
-      if (!import_fs9.default.existsSync(parentDir)) {
-        import_fs9.default.mkdirSync(parentDir, { recursive: true });
+      if (!import_fs10.default.existsSync(parentDir)) {
+        import_fs10.default.mkdirSync(parentDir, { recursive: true });
       }
-      import_fs9.default.writeFileSync(fullPath, content, "utf-8");
+      import_fs10.default.writeFileSync(fullPath, content, "utf-8");
       results.push({ file: agent.filePath, status: "created" });
     }
     log.section("Summary");
@@ -4027,7 +4310,7 @@ function registerInitContextCommand(program2) {
 }
 
 // cli/commands/report.ts
-var import_fs10 = __toESM(require("fs"));
+var import_fs11 = __toESM(require("fs"));
 var import_path13 = __toESM(require("path"));
 var import_ora4 = __toESM(require("ora"));
 var RULE_META = {
@@ -4053,8 +4336,8 @@ var RULE_META = {
 function getProjectName(cwd) {
   try {
     const pkgPath = import_path13.default.join(cwd, "package.json");
-    if (import_fs10.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
+    if (import_fs11.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs11.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.name) return pkg.name;
     }
   } catch {
@@ -4064,16 +4347,16 @@ function getProjectName(cwd) {
 function getPluginVersion(cwd) {
   try {
     const pkgPath = import_path13.default.resolve(__dirname, "../../package.json");
-    if (import_fs10.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
+    if (import_fs11.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs11.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
     }
   } catch {
   }
   try {
     const pkgPath = import_path13.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
-    if (import_fs10.default.existsSync(pkgPath)) {
-      const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
+    if (import_fs11.default.existsSync(pkgPath)) {
+      const pkg = JSON.parse(import_fs11.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
     }
   } catch {
@@ -4451,7 +4734,7 @@ function registerReportCommand(program2) {
     log.blank();
     const html = generateHtml(reportData);
     const outputPath = import_path13.default.resolve(cwd, opts.output);
-    import_fs10.default.writeFileSync(outputPath, html, "utf-8");
+    import_fs11.default.writeFileSync(outputPath, html, "utf-8");
     log.success(`Report saved: ${opts.output}`);
     log.info(
       `Score: ${reportData.score}/100 \xB7 ${reportData.totalErrors} errors \xB7 ${reportData.totalWarnings} warnings`
@@ -4485,7 +4768,7 @@ function registerReportCommand(program2) {
 function getVersion() {
   try {
     const pkgPath = import_path14.default.resolve(__dirname, "../../package.json");
-    const raw = import_fs11.default.readFileSync(pkgPath, "utf-8");
+    const raw = import_fs12.default.readFileSync(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     return typeof pkg.version === "string" ? pkg.version : "0.0.0";
   } catch {