eslint-plugin-ai-guard 1.2.3 → 1.2.6

package/dist/cli/index.js

@@ -414,19 +414,19 @@ function addIgnoresToLegacyConfig(existing) {
 function getConfigFilePath(configType, cwd = process.cwd()) {
   switch (configType) {
     case "flat-js":
-      return import_path6.default.join(cwd, "eslint.config.js");
+      return import_path7.default.join(cwd, "eslint.config.js");
     case "flat-mjs":
-      return import_path6.default.join(cwd, "eslint.config.mjs");
+      return import_path7.default.join(cwd, "eslint.config.mjs");
     case "flat-cjs":
-      return import_path6.default.join(cwd, "eslint.config.cjs");
+      return import_path7.default.join(cwd, "eslint.config.cjs");
     case "eslintrc-js":
-      return import_path6.default.join(cwd, ".eslintrc.js");
+      return import_path7.default.join(cwd, ".eslintrc.js");
     case "eslintrc-cjs":
-      return import_path6.default.join(cwd, ".eslintrc.cjs");
+      return import_path7.default.join(cwd, ".eslintrc.cjs");
     case "eslintrc-json":
-      return import_path6.default.join(cwd, ".eslintrc.json");
+      return import_path7.default.join(cwd, ".eslintrc.json");
     default:
-      return import_path6.default.join(cwd, ".eslintrc.js");
+      return import_path7.default.join(cwd, ".eslintrc.js");
   }
 }
 function validateFlatConfigText(content) {
@@ -461,12 +461,12 @@ function validateLegacyConfigText(content) {
   }
   return problems;
 }
-var import_fs7, import_path6, AI_GUARD_MARKER, DEFAULT_FLAT_IGNORES, DEFAULT_LEGACY_IGNORES;
+var import_fs7, import_path7, AI_GUARD_MARKER, DEFAULT_FLAT_IGNORES, DEFAULT_LEGACY_IGNORES;
 var init_config_manager = __esm({
   "cli/utils/config-manager.ts"() {
     "use strict";
     import_fs7 = __toESM(require("fs"));
-    import_path6 = __toESM(require("path"));
+    import_path7 = __toESM(require("path"));
     AI_GUARD_MARKER = "eslint-plugin-ai-guard";
     DEFAULT_FLAT_IGNORES = [
       "node_modules/**",
@@ -490,7 +490,7 @@ var init_config_manager = __esm({
 // cli/index.ts
 var import_commander = require("commander");
 var import_fs12 = __toESM(require("fs"));
-var import_path14 = __toESM(require("path"));
+var import_path15 = __toESM(require("path"));
 
 // cli/commands/run.ts
 var import_fs4 = __toESM(require("fs"));
@@ -1205,6 +1205,9 @@ async function runEslint(options) {
   };
 }
 
+// cli/utils/sarif.ts
+var import_path3 = __toESM(require("path"));
+
 // cli/utils/version.ts
 var import_module = require("module");
 var import_url2 = require("url");
@@ -1259,11 +1262,13 @@ function sanitizeSarifTags(tags) {
   );
 }
 function sanitizeSarifProperties(props) {
+  const confidence = props.confidence ?? "low";
   return {
     tags: sanitizeSarifTags(props.tags),
-    confidence: props.confidence ?? "low",
+    confidence,
     category: props.category ?? "AI Patterns",
-    "problem.severity": props.problemSeverity ?? "low"
+    "security-severity": confidenceToSecuritySeverity(confidence),
+    precision: confidenceToPrecision(confidence)
   };
 }
 function sanitizeSarifRule(rule) {
@@ -1295,6 +1300,34 @@ function sanitizeSarifLog(log2) {
     }))
   };
 }
+function confidenceToSecuritySeverity(confidence) {
+  switch (confidence) {
+    case "high":
+      return "8.0";
+    case "medium":
+      return "5.0";
+    case "low":
+      return "3.0";
+    case "informational":
+      return "1.0";
+    default:
+      return "3.0";
+  }
+}
+function confidenceToPrecision(confidence) {
+  switch (confidence) {
+    case "high":
+      return "high";
+    case "medium":
+      return "medium";
+    case "low":
+      return "low";
+    case "informational":
+      return "low";
+    default:
+      return "low";
+  }
+}
 function confidenceToSarifLevel(confidence) {
   switch (confidence) {
     case "high":
@@ -1323,22 +1356,24 @@ function confidenceToRank(confidence) {
       return 30;
   }
 }
-function confidenceToGitHubSeverity(confidence) {
-  switch (confidence) {
-    case "high":
-      return "high";
-    case "medium":
-      return "medium";
-    case "low":
-      return "low";
-    case "informational":
-      return "recommendation";
-    default:
-      return "low";
+function normalizeSarifPath(filePath, repoRoot) {
+  let normalized = filePath;
+  normalized = normalized.replace(/\\/g, "/");
+  normalized = normalized.replace(/^[A-Za-z]:\//, "/");
+  if (repoRoot && import_path3.default.isAbsolute(filePath)) {
+    const posixRoot = repoRoot.replace(/\\/g, "/").replace(/^[A-Za-z]:\//, "/").replace(/\/$/, "");
+    if (normalized.startsWith(posixRoot + "/")) {
+      normalized = normalized.slice(posixRoot.length + 1);
+    } else if (normalized.startsWith(posixRoot)) {
+      normalized = normalized.slice(posixRoot.length);
+    }
   }
-}
-function filePathToUri(filePath) {
-  return filePath.replace(/\\/g, "/");
+  normalized = normalized.replace(/^\/+/, "");
+  normalized = normalized.replace(/^\.\//, "");
+  if (!normalized || normalized === ".") {
+    normalized = filePath.replace(/\\/g, "/");
+  }
+  return normalized;
 }
 function collectUsedRuleIds(result) {
   const ids = /* @__PURE__ */ new Set();
@@ -1384,16 +1419,16 @@ function buildRuleDescriptors(ruleIds) {
       properties: sanitizeSarifProperties({
         tags: rawTags,
         confidence,
-        category,
-        problemSeverity: confidenceToGitHubSeverity(confidence)
+        category
       })
     });
   });
 }
-function buildSarifResult(issue, file) {
+function buildSarifResult(issue, file, repoRoot) {
   const confidence = ISSUE_CONFIDENCE[issue.ruleId];
   const asyncRiskType = ISSUE_ASYNC_RISK_TYPE[issue.ruleId];
   const category = ISSUE_CATEGORY[issue.ruleId];
+  const sarifUri = normalizeSarifPath(file.filePath, repoRoot);
   return {
     ruleId: issue.ruleId,
     level: confidenceToSarifLevel(confidence),
@@ -1404,8 +1439,8 @@ function buildSarifResult(issue, file) {
       {
         physicalLocation: {
           artifactLocation: {
-            uri: filePathToUri(file.filePath),
-            uriBaseId: "%SRCROOT%"
+            // Repository-relative POSIX path — no uriBaseId
+            uri: sarifUri
           },
           region: {
             startLine: Math.max(1, issue.line),
@@ -1419,18 +1454,94 @@ function buildSarifResult(issue, file) {
     ],
     properties: {
       confidence: confidence ?? "low",
+      "security-severity": confidenceToSecuritySeverity(confidence),
+      precision: confidenceToPrecision(confidence),
       ...asyncRiskType && { asyncRiskType },
       ...category && { category }
     }
   };
 }
-function buildSarifLog(result, version = PKG_VERSION) {
+function enhanceTagsWithGitHubSemantics(ruleId, baseTags) {
+  const category = ISSUE_CATEGORY[ruleId];
+  const tags = [...baseTags];
+  if (category === "Security" || ruleId.includes("secret") || ruleId.includes("eval") || ruleId.includes("sql") || ruleId.includes("deserialize") || ruleId.includes("auth")) {
+    tags.push("security", "correctness", "reliability");
+  } else {
+    tags.push("correctness", "reliability");
+  }
+  return sanitizeSarifTags(tags);
+}
+function normalizeSarifForGitHub(log2) {
+  const normalizedRuns = log2.runs.map((run) => {
+    const rules = run.tool.driver.rules.map((rule) => {
+      const confidence = ISSUE_CONFIDENCE[rule.id];
+      const properties = rule.properties || {};
+      properties["security-severity"] = confidenceToSecuritySeverity(confidence);
+      properties["precision"] = confidenceToPrecision(confidence);
+      const currentTags = properties.tags || [];
+      properties.tags = enhanceTagsWithGitHubSemantics(rule.id, currentTags);
+      delete properties["problem.severity"];
+      const defaultConfiguration = rule.defaultConfiguration || { level: "warning" };
+      let normalizedConfigLevel = defaultConfiguration.level;
+      if (!["error", "warning", "note", "none"].includes(normalizedConfigLevel)) {
+        normalizedConfigLevel = confidenceToSarifLevel(confidence);
+      }
+      if (normalizedConfigLevel === "none") {
+        normalizedConfigLevel = "note";
+      }
+      return {
+        ...rule,
+        defaultConfiguration: {
+          ...defaultConfiguration,
+          level: normalizedConfigLevel
+        },
+        properties
+      };
+    });
+    const results = run.results.map((result) => {
+      const confidence = ISSUE_CONFIDENCE[result.ruleId];
+      const properties = result.properties || {};
+      properties["security-severity"] = confidenceToSecuritySeverity(confidence);
+      properties["precision"] = confidenceToPrecision(confidence);
+      let normalizedLevel = result.level;
+      if (!["error", "warning", "note", "none"].includes(normalizedLevel)) {
+        normalizedLevel = confidenceToSarifLevel(confidence);
+      }
+      if (normalizedLevel === "none") {
+        normalizedLevel = "note";
+      }
+      const kind = confidence === "informational" ? "informational" : "fail";
+      return {
+        ...result,
+        level: normalizedLevel,
+        kind,
+        properties
+      };
+    });
+    return {
+      ...run,
+      tool: {
+        ...run.tool,
+        driver: {
+          ...run.tool.driver,
+          rules
+        }
+      },
+      results
+    };
+  });
+  return {
+    ...log2,
+    runs: normalizedRuns
+  };
+}
+function buildSarifLog(result, version = PKG_VERSION, repoRoot) {
   const usedRuleIds = collectUsedRuleIds(result);
   const rules = buildRuleDescriptors(usedRuleIds);
   const sarifResults = [];
   for (const file of result.files) {
     for (const issue of file.issues) {
-      sarifResults.push(buildSarifResult(issue, file));
+      sarifResults.push(buildSarifResult(issue, file, repoRoot));
     }
   }
   const log2 = {
@@ -1457,12 +1568,24 @@ function buildSarifLog(result, version = PKG_VERSION) {
       }
     ]
   };
-  return sanitizeSarifLog(log2);
+  return normalizeSarifForGitHub(sanitizeSarifLog(log2));
 }
 function sarifToJson(log2) {
   return JSON.stringify(log2, null, 2);
 }
-function buildSarifDebugInfo(result) {
+function debugSarifPath(filePath, repoRoot) {
+  const normalizedUri = normalizeSarifPath(filePath, repoRoot);
+  return {
+    originalPath: filePath,
+    normalizedUri,
+    isRepositoryRelative: !import_path3.default.isAbsolute(normalizedUri) && !normalizedUri.startsWith("/"),
+    hasLeadingSlash: normalizedUri.startsWith("/"),
+    hasDriveLetter: /^[A-Za-z]:/.test(normalizedUri),
+    hasBackslashes: normalizedUri.includes("\\"),
+    hasLeadingDotSlash: normalizedUri.startsWith("./")
+  };
+}
+function buildSarifDebugInfo(result, repoRoot) {
   const usedRuleIds = collectUsedRuleIds(result);
   const rulesEmitted = usedRuleIds.map((id) => {
     const meta = RULE_DOCS[id];
@@ -1470,7 +1593,7 @@ function buildSarifDebugInfo(result) {
     const category = ISSUE_CATEGORY[id] ?? "AI Patterns";
     const categorySlug = category.toLowerCase().replace(/\s+/g, "-");
     const rawTags = [...meta?.tags ?? ["ai-guard"], categorySlug];
-    const sanitizedTags = sanitizeSarifTags(rawTags);
+    const sanitizedTags = enhanceTagsWithGitHubSemantics(id, rawTags);
     return {
       id,
       rawTags,
@@ -1478,11 +1601,37 @@ function buildSarifDebugInfo(result) {
       hasDuplicatesInRaw: rawTags.length !== new Set(rawTags).size,
       confidence: confidence ?? "low",
       category,
-      level: confidenceToSarifLevel(confidence)
+      level: confidenceToSarifLevel(confidence),
+      securitySeverity: confidenceToSecuritySeverity(confidence),
+      precision: confidenceToPrecision(confidence)
     };
   });
+  const resultsEmitted = [];
+  const pathsDebug = [];
+  const seenPaths = /* @__PURE__ */ new Set();
+  for (const file of result.files) {
+    if (!seenPaths.has(file.filePath)) {
+      seenPaths.add(file.filePath);
+      pathsDebug.push(debugSarifPath(file.filePath, repoRoot));
+    }
+    for (const issue of file.issues) {
+      const confidence = ISSUE_CONFIDENCE[issue.ruleId];
+      resultsEmitted.push({
+        ruleId: issue.ruleId,
+        level: confidenceToSarifLevel(confidence),
+        kind: confidence === "informational" ? "informational" : "fail",
+        securitySeverity: confidenceToSecuritySeverity(confidence),
+        precision: confidenceToPrecision(confidence),
+        filePath: file.filePath,
+        normalizedUri: normalizeSarifPath(file.filePath, repoRoot),
+        line: issue.line
+      });
+    }
+  }
   return {
     rulesEmitted,
+    resultsEmitted,
+    pathsDebug,
     totalResults: result.files.reduce((n, f) => n + f.issues.length, 0),
     version: PKG_VERSION
   };
@@ -1715,7 +1864,7 @@ function writeGitHubOutputs(result, sarifPath) {
 
 // cli/utils/git-diff.ts
 var import_child_process = require("child_process");
-var import_path3 = __toESM(require("path"));
+var import_path4 = __toESM(require("path"));
 var import_fs3 = __toESM(require("fs"));
 var DEFAULT_EXTENSIONS = [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".mts", ".cts"];
 var IGNORE_PREFIXES = [
@@ -1825,7 +1974,7 @@ function filterFiles(rawFiles, extensions, workingDirectory, cwd, debugInfo) {
   for (const rel of rawFiles) {
     const normalized = rel.replace(/\\/g, "/").trim();
     if (!normalized) continue;
-    const ext = import_path3.default.extname(normalized).toLowerCase();
+    const ext = import_path4.default.extname(normalized).toLowerCase();
     if (!extensions.includes(ext)) {
       debugInfo.droppedByExtension++;
       continue;
@@ -1841,7 +1990,7 @@ function filterFiles(rawFiles, extensions, workingDirectory, cwd, debugInfo) {
         continue;
       }
     }
-    const abs = import_path3.default.resolve(cwd, normalized);
+    const abs = import_path4.default.resolve(cwd, normalized);
     if (!import_fs3.default.existsSync(abs)) {
       debugInfo.droppedMissing++;
       continue;
@@ -1964,7 +2113,7 @@ function registerRunCommand(program2) {
     "--max-warnings <n>",
     "Fail with exit code 1 if warnings exceed this count",
     (value) => Number.parseInt(value, 10)
-  ).option("--verbose", "Show all issues \u2014 disable grouping of repeated warnings").option("--quiet", "Only show errors \u2014 suppress warnings and informational hints").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-sarif", "Print SARIF tag normalization trace \u2014 diagnose duplicate-tag schema issues").option("--sarif-output <file>", "Write SARIF to this file instead of stdout").action(async (opts) => {
+  ).option("--verbose", "Show all issues \u2014 disable grouping of repeated warnings").option("--quiet", "Only show errors \u2014 suppress warnings and informational hints").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-sarif", "Print SARIF tag/level normalization trace \u2014 diagnose schema issues").option("--debug-sarif-paths", "Print path normalization trace \u2014 diagnose GitHub Code Scanning path resolution").option("--sarif-output <file>", "Write SARIF to this file instead of stdout").action(async (opts) => {
     if (opts.maxWarnings !== void 0 && (!Number.isInteger(opts.maxWarnings) || opts.maxWarnings < 0)) {
       log.blank();
       log.error("--max-warnings must be a non-negative integer.");
@@ -2017,25 +2166,80 @@ function registerRunCommand(program2) {
       writeGitHubOutputs(result);
     }
     if (opts.sarif || opts.sarifOutput) {
-      const sarifLog = buildSarifLog(result);
+      const repoRoot = process.env.GITHUB_WORKSPACE ?? void 0;
+      const sarifLog = buildSarifLog(result, void 0, repoRoot);
       const sarifJson = sarifToJson(sarifLog);
       if (opts.debugSarif) {
-        const debugInfo = buildSarifDebugInfo(result);
-        process.stderr.write("\n[debug-sarif] SARIF Tag Normalization Trace\n");
+        const debugInfo = buildSarifDebugInfo(result, repoRoot);
+        process.stderr.write("\n[debug-sarif] SARIF GitHub Compatibility Trace\n");
         process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+        process.stderr.write("[debug-sarif] Rules Emitted:\n");
         for (const r of debugInfo.rulesEmitted) {
-          process.stderr.write(`[debug-sarif] ${r.id}
+          process.stderr.write(`[debug-sarif]   - ${r.id}:
+`);
+          process.stderr.write(`[debug-sarif]     confidence:        ${r.confidence}
+`);
+          process.stderr.write(`[debug-sarif]     level:             ${r.level}
+`);
+          process.stderr.write(`[debug-sarif]     security-severity: ${r.securitySeverity}
 `);
-          process.stderr.write(`[debug-sarif]   raw:       ${JSON.stringify(r.rawTags)}
+          process.stderr.write(`[debug-sarif]     precision:         ${r.precision}
 `);
-          process.stderr.write(`[debug-sarif]   sanitized: ${JSON.stringify(r.sanitizedTags)}
+          process.stderr.write(`[debug-sarif]     raw tags:          ${JSON.stringify(r.rawTags)}
+`);
+          process.stderr.write(`[debug-sarif]     normalized tags:   ${JSON.stringify(r.sanitizedTags)}
 `);
           if (r.hasDuplicatesInRaw) {
-            process.stderr.write(`[debug-sarif]   \u26A0 had duplicates \u2014 deduplicated
+            process.stderr.write(`[debug-sarif]     \u26A0 had duplicates \u2014 deduplicated
+`);
+          }
+        }
+        process.stderr.write("\n[debug-sarif] Results Emitted:\n");
+        if (debugInfo.resultsEmitted.length === 0) {
+          process.stderr.write("[debug-sarif]   (none)\n");
+        } else {
+          for (const res of debugInfo.resultsEmitted) {
+            process.stderr.write(`[debug-sarif]   - ${res.ruleId} (${res.filePath}:${res.line}):
+`);
+            process.stderr.write(`[debug-sarif]     level:             ${res.level}
+`);
+            process.stderr.write(`[debug-sarif]     kind:              ${res.kind}
+`);
+            process.stderr.write(`[debug-sarif]     security-severity: ${res.securitySeverity}
+`);
+            process.stderr.write(`[debug-sarif]     precision:         ${res.precision}
+`);
+            process.stderr.write(`[debug-sarif]     artifact uri:      ${res.normalizedUri}
+`);
+          }
+        }
+        process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
+      }
+      if (opts.debugSarifPaths) {
+        const debugInfo = buildSarifDebugInfo(result, repoRoot);
+        process.stderr.write("\n[debug-sarif-paths] Path Normalization Trace\n");
+        process.stderr.write("[debug-sarif-paths] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+        process.stderr.write(`[debug-sarif-paths] GITHUB_WORKSPACE: ${repoRoot ?? "(not set \u2014 local run)"}
+
+`);
+        if (debugInfo.pathsDebug.length === 0) {
+          process.stderr.write("[debug-sarif-paths]   (no files in results)\n");
+        } else {
+          for (const p of debugInfo.pathsDebug) {
+            process.stderr.write(`[debug-sarif-paths]   original path:   ${p.originalPath}
+`);
+            process.stderr.write(`[debug-sarif-paths]   artifact uri:    ${p.normalizedUri}
+`);
+            process.stderr.write(`[debug-sarif-paths]   repo-relative:   ${p.isRepositoryRelative ? "\u2705 yes" : "\u274C NO (GitHub may miss this)"}
 `);
+            if (p.hasBackslashes) process.stderr.write("[debug-sarif-paths]   \u26A0 had backslashes \u2014 converted\n");
+            if (p.hasDriveLetter) process.stderr.write("[debug-sarif-paths]   \u26A0 had drive letter \u2014 stripped\n");
+            if (p.hasLeadingSlash) process.stderr.write("[debug-sarif-paths]   \u26A0 had leading slash \u2014 stripped\n");
+            if (p.hasLeadingDotSlash) process.stderr.write("[debug-sarif-paths]   \u26A0 had leading ./ \u2014 stripped\n");
+            process.stderr.write("\n");
           }
         }
-        process.stderr.write("\n");
+        process.stderr.write("[debug-sarif-paths] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
       }
       if (opts.sarifOutput) {
         import_fs4.default.writeFileSync(opts.sarifOutput, sarifJson, "utf-8");
@@ -2379,7 +2583,7 @@ function resolveExitCode(result, failOn, maxWarnings) {
 }
 
 // cli/commands/changed.ts
-var import_path4 = __toESM(require("path"));
+var import_path5 = __toESM(require("path"));
 var import_fs5 = __toESM(require("fs"));
 var import_ora2 = __toESM(require("ora"));
 var import_chalk5 = __toESM(require("chalk"));
@@ -2388,7 +2592,7 @@ function registerChangedCommand(program2) {
     "--max-warnings <n>",
     "Fail if warnings exceed this count",
     (v) => Number.parseInt(v, 10)
-  ).option("--verbose", "Expand all findings (disable grouping)").option("--quiet", "Show errors only").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-git", "Print full git resolution trace (useful for diagnosing zero-file issues)").option("--debug-ci", "Print CI environment state (GITHUB_* vars, SARIF path, summary path)").action(async (opts) => {
+  ).option("--verbose", "Expand all findings (disable grouping)").option("--quiet", "Show errors only").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-git", "Print full git resolution trace (useful for diagnosing zero-file issues)").option("--debug-ci", "Print CI environment state (GITHUB_* vars, SARIF path, summary path)").option("--debug-sarif", "Print SARIF tag/level normalization trace \u2014 diagnose schema issues").option("--debug-sarif-paths", "Print path normalization trace \u2014 diagnose GitHub Code Scanning path resolution").action(async (opts) => {
     const preset = opts.strict ? "strict" : opts.security ? "security" : "recommended";
     const inCI = isGitHubActions();
     const baseRef = opts.base ?? (opts.pr || inCI ? getGitHubBaseRef() : void 0);
@@ -2417,7 +2621,7 @@ function registerChangedCommand(program2) {
       });
     }
     const cwd = process.cwd();
-    const resolvedPath = import_path4.default.resolve(opts.path);
+    const resolvedPath = import_path5.default.resolve(opts.path);
     const workingDirectory = opts.path !== "." ? opts.path : void 0;
     const spinner = opts.json || opts.sarif ? null : (0, import_ora2.default)({ text: import_chalk5.default.dim("Detecting changed files\u2026"), color: "cyan" }).start();
     const changedResult = getChangedFiles({
@@ -2498,10 +2702,87 @@ function handleResults(result, opts, preset, scanMode, changedFilesCount, inCI,
     emitGitHubAnnotations(result);
   }
   if (opts.sarif) {
-    const sarifLog = buildSarifLog(result);
+    const repoRoot = process.env.GITHUB_WORKSPACE ?? void 0;
+    const sarifLog = buildSarifLog(result, void 0, repoRoot);
     const sarifJson = sarifToJson(sarifLog);
+    if (opts.debugSarif) {
+      const debugInfo = buildSarifDebugInfo(result, repoRoot);
+      process.stderr.write("\n[debug-sarif] SARIF GitHub Compatibility Trace\n");
+      process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+      process.stderr.write("[debug-sarif] Rules Emitted:\n");
+      for (const r of debugInfo.rulesEmitted) {
+        process.stderr.write(`[debug-sarif]   - ${r.id}:
+`);
+        process.stderr.write(`[debug-sarif]     confidence:        ${r.confidence}
+`);
+        process.stderr.write(`[debug-sarif]     level:             ${r.level}
+`);
+        process.stderr.write(`[debug-sarif]     security-severity: ${r.securitySeverity}
+`);
+        process.stderr.write(`[debug-sarif]     precision:         ${r.precision}
+`);
+        process.stderr.write(`[debug-sarif]     raw tags:          ${JSON.stringify(r.rawTags)}
+`);
+        process.stderr.write(`[debug-sarif]     normalized tags:   ${JSON.stringify(r.sanitizedTags)}
+`);
+        if (r.hasDuplicatesInRaw) {
+          process.stderr.write(`[debug-sarif]     \u26A0 had duplicates \u2014 deduplicated
+`);
+        }
+      }
+      process.stderr.write("\n[debug-sarif] Results Emitted:\n");
+      if (debugInfo.resultsEmitted.length === 0) {
+        process.stderr.write("[debug-sarif]   (none)\n");
+      } else {
+        for (const res of debugInfo.resultsEmitted) {
+          process.stderr.write(`[debug-sarif]   - ${res.ruleId} (${res.filePath}:${res.line}):
+`);
+          process.stderr.write(`[debug-sarif]     level:             ${res.level}
+`);
+          process.stderr.write(`[debug-sarif]     kind:              ${res.kind}
+`);
+          process.stderr.write(`[debug-sarif]     security-severity: ${res.securitySeverity}
+`);
+          process.stderr.write(`[debug-sarif]     precision:         ${res.precision}
+`);
+          process.stderr.write(`[debug-sarif]     artifact uri:      ${res.normalizedUri}
+`);
+        }
+      }
+      process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
+    }
+    if (opts.debugSarifPaths) {
+      const debugInfo = buildSarifDebugInfo(result, repoRoot);
+      process.stderr.write("\n[debug-sarif-paths] Path Normalization Trace\n");
+      process.stderr.write("[debug-sarif-paths] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+      process.stderr.write(`[debug-sarif-paths] GITHUB_WORKSPACE: ${repoRoot ?? "(not set \u2014 local run)"}
+
+`);
+      if (debugInfo.pathsDebug.length === 0) {
+        process.stderr.write("[debug-sarif-paths]   (no files in results)\n");
+      } else {
+        for (const p of debugInfo.pathsDebug) {
+          process.stderr.write(`[debug-sarif-paths]   original path:   ${p.originalPath}
+`);
+          process.stderr.write(`[debug-sarif-paths]   artifact uri:    ${p.normalizedUri}
+`);
+          process.stderr.write(`[debug-sarif-paths]   repo-relative:   ${p.isRepositoryRelative ? "\u2705 yes" : "\u274C NO (GitHub may miss this)"}
+`);
+          if (p.hasBackslashes) process.stderr.write("[debug-sarif-paths]   \u26A0 had backslashes \u2014 converted\n");
+          if (p.hasDriveLetter) process.stderr.write("[debug-sarif-paths]   \u26A0 had drive letter \u2014 stripped\n");
+          if (p.hasLeadingSlash) process.stderr.write("[debug-sarif-paths]   \u26A0 had leading slash \u2014 stripped\n");
+          if (p.hasLeadingDotSlash) process.stderr.write("[debug-sarif-paths]   \u26A0 had leading ./ \u2014 stripped\n");
+          process.stderr.write("\n");
+        }
+      }
+      process.stderr.write("[debug-sarif-paths] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
+    }
     if (resolvedSarifPath) {
       import_fs5.default.writeFileSync(resolvedSarifPath, sarifJson, "utf-8");
+      if (opts.debugSarif) {
+        process.stderr.write(`[debug-sarif] SARIF written to: ${resolvedSarifPath}
+`);
+      }
     } else {
       console.log(sarifJson);
     }
@@ -2631,12 +2912,12 @@ function getFailOnExitCode(result, failOn, maxWarnings) {
 
 // cli/commands/init.ts
 var import_chalk6 = __toESM(require("chalk"));
-var import_path7 = __toESM(require("path"));
+var import_path8 = __toESM(require("path"));
 var import_fs8 = __toESM(require("fs"));
 
 // cli/utils/detector.ts
 var import_fs6 = __toESM(require("fs"));
-var import_path5 = __toESM(require("path"));
+var import_path6 = __toESM(require("path"));
 var import_module2 = require("module");
 var FLAT_CONFIG_FILES = [
   { file: "eslint.config.js", type: "flat-js" },
@@ -2653,11 +2934,11 @@ var LEGACY_CONFIG_FILES = [
 var ALL_CONFIG_FILES = [...FLAT_CONFIG_FILES, ...LEGACY_CONFIG_FILES];
 function isPackageInstalled(pkgName, cwd = process.cwd()) {
   try {
-    const pkgPath = import_path5.default.join(cwd, "node_modules", pkgName, "package.json");
+    const pkgPath = import_path6.default.join(cwd, "node_modules", pkgName, "package.json");
     if (import_fs6.default.existsSync(pkgPath)) {
       return true;
     }
-    const req = (0, import_module2.createRequire)(import_path5.default.join(cwd, "package.json"));
+    const req = (0, import_module2.createRequire)(import_path6.default.join(cwd, "package.json"));
     req.resolve(`${pkgName}/package.json`);
     return true;
   } catch {
@@ -2666,8 +2947,8 @@ function isPackageInstalled(pkgName, cwd = process.cwd()) {
 }
 function getPackageVersion(pkgName, cwd = process.cwd()) {
   try {
-    const pkgPath = import_path5.default.join(cwd, "node_modules", pkgName, "package.json");
-    const resolvedPath = import_fs6.default.existsSync(pkgPath) ? pkgPath : (0, import_module2.createRequire)(import_path5.default.join(cwd, "package.json")).resolve(`${pkgName}/package.json`);
+    const pkgPath = import_path6.default.join(cwd, "node_modules", pkgName, "package.json");
+    const resolvedPath = import_fs6.default.existsSync(pkgPath) ? pkgPath : (0, import_module2.createRequire)(import_path6.default.join(cwd, "package.json")).resolve(`${pkgName}/package.json`);
     const raw = import_fs6.default.readFileSync(resolvedPath, "utf-8");
     const json = JSON.parse(raw);
     return json.version ?? null;
@@ -2684,7 +2965,7 @@ function detectConfigType(cwd = process.cwd()) {
   const found = [];
   let first = null;
   for (const { file, type } of ALL_CONFIG_FILES) {
-    const fullPath = import_path5.default.join(cwd, file);
+    const fullPath = import_path6.default.join(cwd, file);
     if (import_fs6.default.existsSync(fullPath)) {
       found.push(fullPath);
       if (!first) first = { type, path: fullPath };
@@ -2764,7 +3045,7 @@ async function verifyConfigLoads(configPath, cwd) {
       overrideConfigFile: configPath
     });
     await eslint.lintText("", {
-      filePath: import_path7.default.join(cwd, "_ai_guard_probe_.js")
+      filePath: import_path8.default.join(cwd, "_ai_guard_probe_.js")
     });
     return null;
   } catch (err) {
@@ -2800,7 +3081,7 @@ function registerInitCommand(program2) {
       log.warn("eslint-plugin-ai-guard not found");
     }
     if (env.configType !== "none") {
-      log.success(`ESLint config found: ${import_chalk6.default.white(import_path7.default.relative(cwd, env.configPath ?? env.configType))}`);
+      log.success(`ESLint config found: ${import_chalk6.default.white(import_path8.default.relative(cwd, env.configPath ?? env.configType))}`);
     } else {
       log.info("No ESLint config found \u2014 will generate one");
     }
@@ -2809,7 +3090,7 @@ function registerInitCommand(program2) {
       log.blank();
       log.warn("Conflicting configs detected:");
       for (const p of env.allConfigPaths) {
-        log.print(`    ${import_chalk6.default.yellow("\u2192")} ${import_chalk6.default.white(import_path7.default.relative(cwd, p))}`);
+        log.print(`    ${import_chalk6.default.yellow("\u2192")} ${import_chalk6.default.white(import_path8.default.relative(cwd, p))}`);
       }
       log.print(`  ${import_chalk6.default.gray("Multiple config formats found \u2014 this can cause unpredictable behavior.")}`);
     }
@@ -2837,7 +3118,7 @@ function registerInitCommand(program2) {
     try {
       const { createRequire: createRequire3 } = await import("module");
       const { pathToFileURL: pathToFileURL2 } = await import("url");
-      const req = createRequire3(import_path7.default.join(cwd, "_probe.js"));
+      const req = createRequire3(import_path8.default.join(cwd, "_probe.js"));
       const resolvedPath = req.resolve("eslint-plugin-ai-guard");
       const aiGuard = await import(pathToFileURL2(resolvedPath).href);
       const plugin = aiGuard.default || aiGuard;
@@ -2856,7 +3137,7 @@ function registerInitCommand(program2) {
     if (eslintNeedsFlat && existingIsLegacy) {
       log.section("Config Migration Required");
       log.warn(`ESLint v${env.eslintMajor} requires flat config, but a legacy config was found:`);
-      log.print(`    ${import_chalk6.default.white(import_path7.default.relative(cwd, env.configPath))}`);
+      log.print(`    ${import_chalk6.default.white(import_path8.default.relative(cwd, env.configPath))}`);
       log.blank();
       log.print(`  ${import_chalk6.default.bold("ai-guard will create a new flat config.")}`);
       log.blank();
@@ -2868,7 +3149,7 @@ function registerInitCommand(program2) {
       const raw = readConfig(env.configPath);
       const { content: fixed, changed } = removeNukeIgnore(raw);
       if (changed) {
-        log.warn(`Removed "**/*" ignore pattern from ${import_path7.default.relative(cwd, env.configPath)}`);
+        log.warn(`Removed "**/*" ignore pattern from ${import_path8.default.relative(cwd, env.configPath)}`);
         if (!isDryRun) {
           backupConfig(env.configPath);
           writeConfig(env.configPath, fixed);
@@ -2880,7 +3161,7 @@ function registerInitCommand(program2) {
     }
     if (env.configType === "none" || eslintNeedsFlat && existingIsLegacy) {
       const targetName = useFlat ? "eslint.config.mjs" : ".eslintrc.js";
-      finalConfigPath = import_path7.default.join(cwd, targetName);
+      finalConfigPath = import_path8.default.join(cwd, targetName);
       const content2 = useFlat ? generateFlatConfig(preset) : generateLegacyConfig(preset);
       if (isDryRun) {
         log.print(`  ${import_chalk6.default.gray(`[dry-run] would create: ${targetName}`)}`);
@@ -2908,15 +3189,15 @@ function registerInitCommand(program2) {
         finalConfigPath = env.configPath;
       } else if (isDryRun) {
         finalConfigPath = env.configPath;
-        log.print(`  ${import_chalk6.default.gray(`[dry-run] would patch: ${import_path7.default.relative(cwd, env.configPath)}`)}`);
+        log.print(`  ${import_chalk6.default.gray(`[dry-run] would patch: ${import_path8.default.relative(cwd, env.configPath)}`)}`);
       } else {
         const bak = backupConfig(env.configPath);
-        log.info(`Backed up \u2192 ${import_chalk6.default.gray(import_path7.default.relative(cwd, bak))}`);
+        log.info(`Backed up \u2192 ${import_chalk6.default.gray(import_path8.default.relative(cwd, bak))}`);
         writeConfig(env.configPath, patched);
         if (isInvalid) {
-          log.success(`Detected invalid ai-guard config \u2014 repairing ${import_chalk6.default.white(import_path7.default.relative(cwd, env.configPath))}`);
+          log.success(`Detected invalid ai-guard config \u2014 repairing ${import_chalk6.default.white(import_path8.default.relative(cwd, env.configPath))}`);
         } else {
-          log.success(`Patched ${import_chalk6.default.white(import_path7.default.relative(cwd, env.configPath))}`);
+          log.success(`Patched ${import_chalk6.default.white(import_path8.default.relative(cwd, env.configPath))}`);
         }
         finalConfigPath = env.configPath;
         configWritten = true;
@@ -2929,12 +3210,12 @@ function registerInitCommand(program2) {
         finalConfigPath = env.configPath;
       } else if (isDryRun) {
         finalConfigPath = env.configPath;
-        log.print(`  ${import_chalk6.default.gray(`[dry-run] would patch: ${import_path7.default.relative(cwd, env.configPath)}`)}`);
+        log.print(`  ${import_chalk6.default.gray(`[dry-run] would patch: ${import_path8.default.relative(cwd, env.configPath)}`)}`);
       } else {
         const bak = backupConfig(env.configPath);
-        log.info(`Backed up \u2192 ${import_chalk6.default.gray(import_path7.default.relative(cwd, bak))}`);
+        log.info(`Backed up \u2192 ${import_chalk6.default.gray(import_path8.default.relative(cwd, bak))}`);
         writeConfig(env.configPath, patched);
-        log.success(`Patched ${import_chalk6.default.white(import_path7.default.relative(cwd, env.configPath))}`);
+        log.success(`Patched ${import_chalk6.default.white(import_path8.default.relative(cwd, env.configPath))}`);
         finalConfigPath = env.configPath;
         configWritten = true;
       }
@@ -2950,11 +3231,11 @@ function registerInitCommand(program2) {
               cleanedUp = true;
             } catch (err) {
               const reason = err instanceof Error ? err.message : String(err);
-              log.warn(`Could not back up ${import_path7.default.relative(cwd, p)}: ${reason}`);
+              log.warn(`Could not back up ${import_path8.default.relative(cwd, p)}: ${reason}`);
             }
           } else {
             cleanedUp = true;
-            log.print(`  ${import_chalk6.default.gray(`[dry-run] would rename ${import_path7.default.relative(cwd, p)} to ${import_path7.default.basename(p)}.bak`)}`);
+            log.print(`  ${import_chalk6.default.gray(`[dry-run] would rename ${import_path8.default.relative(cwd, p)} to ${import_path8.default.basename(p)}.bak`)}`);
           }
         }
       }
@@ -2973,7 +3254,7 @@ function registerInitCommand(program2) {
     log.blank();
     log.section("Validation");
     if (!import_fs8.default.existsSync(finalConfigPath)) {
-      log.error(`Config file not found after write: ${import_path7.default.relative(cwd, finalConfigPath)}`);
+      log.error(`Config file not found after write: ${import_path8.default.relative(cwd, finalConfigPath)}`);
       log.blank();
       log.print(`  ${import_chalk6.default.bold("Problem:")} File write may have failed.`);
       log.print(`  ${import_chalk6.default.bold("Fix:")} Check disk space and file permissions, then re-run.`);
@@ -2989,7 +3270,7 @@ function registerInitCommand(program2) {
         log.print(`    ${import_chalk6.default.red("\u2716")} ${e}`);
       }
     } else {
-      log.success(`Config structure valid: ${import_chalk6.default.white(import_path7.default.relative(cwd, finalConfigPath))}`);
+      log.success(`Config structure valid: ${import_chalk6.default.white(import_path8.default.relative(cwd, finalConfigPath))}`);
     }
     log.info("Verifying ESLint can load the config\u2026");
     const loadError = await verifyConfigLoads(finalConfigPath, cwd);
@@ -3013,7 +3294,7 @@ function registerInitCommand(program2) {
         }
         log.blank();
         log.print(`  ${import_chalk6.default.bold("Fix:")}`);
-        log.print(`    1. Check the syntax in ${import_chalk6.default.cyan(import_path7.default.relative(cwd, finalConfigPath))}`);
+        log.print(`    1. Check the syntax in ${import_chalk6.default.cyan(import_path8.default.relative(cwd, finalConfigPath))}`);
         log.print(`    2. Make sure ${import_chalk6.default.cyan("eslint-plugin-ai-guard")} is installed`);
         log.print(`    3. Run ${import_chalk6.default.cyan("ai-guard doctor")} for full diagnostics`);
         log.blank();
@@ -3035,7 +3316,7 @@ function registerInitCommand(program2) {
     if (loadError === null && !lingeringConflicts) {
       log.print(`  ${import_chalk6.default.green("\u2714")}  ${import_chalk6.default.bold.green("Configuration validated successfully")}`);
     }
-    log.print(`  ${import_chalk6.default.green("\u2714")}  ${import_chalk6.default.bold("ESLint config:")} ${import_chalk6.default.cyan(import_path7.default.relative(cwd, finalConfigPath))}`);
+    log.print(`  ${import_chalk6.default.green("\u2714")}  ${import_chalk6.default.bold("ESLint config:")} ${import_chalk6.default.cyan(import_path8.default.relative(cwd, finalConfigPath))}`);
     log.print(`  ${import_chalk6.default.green("\u2714")}  ${import_chalk6.default.bold("Mode:")} ${import_chalk6.default.cyan(useFlat ? `Flat config (ESLint v${env.eslintMajor ?? 9})` : `Legacy config (ESLint v${env.eslintMajor ?? 8})`)}`);
     log.print(`  ${import_chalk6.default.green("\u2714")}  ${import_chalk6.default.bold("Preset:")} ${import_chalk6.default.cyan(preset)}`);
     log.blank();
@@ -3049,14 +3330,14 @@ function registerInitCommand(program2) {
 
 // cli/commands/doctor.ts
 var import_chalk7 = __toESM(require("chalk"));
-var import_path8 = __toESM(require("path"));
+var import_path9 = __toESM(require("path"));
 init_config_manager();
 var import_meta2 = {};
 async function probeConfigLoad(configPath, cwd) {
   try {
     const { ESLint } = await import("eslint");
     const eslint = new ESLint({ cwd, overrideConfigFile: configPath });
-    await eslint.lintText("", { filePath: import_path8.default.join(cwd, "_probe_.js") });
+    await eslint.lintText("", { filePath: import_path9.default.join(cwd, "_probe_.js") });
     return { ok: true, error: null };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -3091,7 +3372,7 @@ function registerDoctorCommand(program2) {
     checks.push({
       label: "ESLint config present",
       pass: hasConfig,
-      detail: hasConfig ? `${import_path8.default.relative(cwd, env.configPath ?? "")} (${env.configType})` : "No eslint.config.* or .eslintrc.* found",
+      detail: hasConfig ? `${import_path9.default.relative(cwd, env.configPath ?? "")} (${env.configType})` : "No eslint.config.* or .eslintrc.* found",
       fix: hasConfig ? void 0 : "ai-guard init",
       note: hasConfig ? void 0 : "This will generate the correct config format for your ESLint version"
     });
@@ -3123,7 +3404,7 @@ function registerDoctorCommand(program2) {
       checks.push({
         label: "Plugin wired in config",
         pass: pluginWired && !isInvalidConfig,
-        detail: readError ? `Could not read config: ${readError}` : isInvalidConfig ? "Invalid ai-guard config detected (wrong export usage)" : pluginWired ? "eslint-plugin-ai-guard referenced in config" : `Config exists but ai-guard plugin not found in ${import_path8.default.relative(cwd, env.configPath)}`,
+        detail: readError ? `Could not read config: ${readError}` : isInvalidConfig ? "Invalid ai-guard config detected (wrong export usage)" : pluginWired ? "eslint-plugin-ai-guard referenced in config" : `Config exists but ai-guard plugin not found in ${import_path9.default.relative(cwd, env.configPath)}`,
         fix: isInvalidConfig || !pluginWired && !readError ? "ai-guard init  (will patch/repair your existing config)" : void 0
       });
     }
@@ -3131,7 +3412,7 @@ function registerDoctorCommand(program2) {
       label: "No conflicting config files",
       pass: !env.hasConflictingConfigs,
       detail: env.hasConflictingConfigs ? `Conflicting config detected:
-${env.allConfigPaths.map((p) => `       ${import_path8.default.relative(cwd, p)}`).join("\n")}` : "Only one config format detected",
+${env.allConfigPaths.map((p) => `       ${import_path9.default.relative(cwd, p)}`).join("\n")}` : "Only one config format detected",
       fix: env.hasConflictingConfigs ? "Remove or backup legacy config" : void 0,
       note: env.hasConflictingConfigs ? "ESLint v9 silently ignores .eslintrc.* when a flat config exists. This can cause confusion." : void 0
     });
@@ -3158,7 +3439,7 @@ ${env.allConfigPaths.map((p) => `       ${import_path8.default.relative(cwd, p)}
         label: "ESLint config loads without errors",
         pass: probe.ok,
         detail: probe.ok ? "ESLint loaded config successfully" : probe.error ?? "Unknown error",
-        fix: probe.ok ? void 0 : `Check syntax in ${import_path8.default.relative(cwd, env.configPath)}`,
+        fix: probe.ok ? void 0 : `Check syntax in ${import_path9.default.relative(cwd, env.configPath)}`,
         note: probe.ok ? void 0 : "Run: ai-guard init --dry-run  to preview a fresh config"
       });
     }
@@ -3167,7 +3448,7 @@ ${env.allConfigPaths.map((p) => `       ${import_path8.default.relative(cwd, p)}
       let utilsVersion = null;
       try {
         const { createRequire: createRequire3 } = await import("module");
-        const req = createRequire3(import_path8.default.join(cwd, "package.json"));
+        const req = createRequire3(import_path9.default.join(cwd, "package.json"));
         const pkgPath = req.resolve("@typescript-eslint/utils/package.json");
         const pkg = JSON.parse(
           (await import("fs")).readFileSync(pkgPath, "utf-8")
@@ -3178,10 +3459,10 @@ ${env.allConfigPaths.map((p) => `       ${import_path8.default.relative(cwd, p)}
       }
       if (!utilsOk) {
         try {
-          const selfDir = import_path8.default.dirname(
+          const selfDir = import_path9.default.dirname(
             new URL(import_meta2.url).pathname.replace(/^\/([A-Za-z]:)/, "$1")
           );
-          const pkgPath = import_path8.default.join(selfDir, "../../node_modules/@typescript-eslint/utils/package.json");
+          const pkgPath = import_path9.default.join(selfDir, "../../node_modules/@typescript-eslint/utils/package.json");
           if ((await import("fs")).existsSync(pkgPath)) {
             utilsOk = true;
           }
@@ -3201,7 +3482,7 @@ ${env.allConfigPaths.map((p) => `       ${import_path8.default.relative(cwd, p)}
       let parserVersion = null;
       try {
         const { createRequire: createRequire3 } = await import("module");
-        const req = createRequire3(import_path8.default.join(cwd, "package.json"));
+        const req = createRequire3(import_path9.default.join(cwd, "package.json"));
         const pkgPath = req.resolve("@typescript-eslint/parser/package.json");
         const pkg = JSON.parse(
           (await import("fs")).readFileSync(pkgPath, "utf-8")
@@ -3289,7 +3570,7 @@ ${env.allConfigPaths.map((p) => `       ${import_path8.default.relative(cwd, p)}
 var import_prompts = require("@inquirer/prompts");
 var import_chalk8 = __toESM(require("chalk"));
 init_config_manager();
-var import_path9 = __toESM(require("path"));
+var import_path10 = __toESM(require("path"));
 function registerPresetCommand(program2) {
   program2.command("preset").description("Interactively select and apply an ai-guard preset to your ESLint config").action(async () => {
     const cwd = process.cwd();
@@ -3317,14 +3598,14 @@ function registerPresetCommand(program2) {
     const env = detect(cwd);
     const useFlat = env.eslintMajor !== null && env.eslintMajor >= 9 || isFlat(env.configType);
     if (env.configType === "none") {
-      const configPath = useFlat ? import_path9.default.join(cwd, "eslint.config.mjs") : import_path9.default.join(cwd, ".eslintrc.js");
+      const configPath = useFlat ? import_path10.default.join(cwd, "eslint.config.mjs") : import_path10.default.join(cwd, ".eslintrc.js");
       const content = useFlat ? generateFlatConfig(preset) : generateLegacyConfig(preset);
       writeConfig(configPath, content);
-      log.success(`Created ${import_chalk8.default.white(import_path9.default.relative(cwd, configPath))} with ${import_chalk8.default.cyan(preset)} preset`);
+      log.success(`Created ${import_chalk8.default.white(import_path10.default.relative(cwd, configPath))} with ${import_chalk8.default.cyan(preset)} preset`);
     } else {
       const configPath = env.configPath;
       const backupPath = backupConfig(configPath);
-      log.info(`Backed up \u2192 ${import_chalk8.default.gray(import_path9.default.relative(cwd, backupPath))}`);
+      log.info(`Backed up \u2192 ${import_chalk8.default.gray(import_path10.default.relative(cwd, backupPath))}`);
       const existing = readConfig(configPath);
       const withPlugin = isFlat(env.configType) ? patchFlatConfig(existing, preset) : patchLegacyConfig(existing, preset);
       const patched = isFlat(env.configType) ? switchFlatPreset(withPlugin, preset) : switchLegacyPreset(withPlugin, preset);
@@ -3332,7 +3613,7 @@ function registerPresetCommand(program2) {
         log.warn("No preset changes needed. Config already matches selected preset.");
       } else {
         writeConfig(configPath, patched);
-        log.success(`Updated ${import_chalk8.default.white(import_path9.default.relative(cwd, configPath))} to ${import_chalk8.default.cyan(preset)} preset`);
+        log.success(`Updated ${import_chalk8.default.white(import_path10.default.relative(cwd, configPath))} to ${import_chalk8.default.cyan(preset)} preset`);
       }
     }
     log.blank();
@@ -3372,7 +3653,7 @@ function registerPresetCommand(program2) {
 // cli/commands/ignore.ts
 var import_chalk9 = __toESM(require("chalk"));
 init_config_manager();
-var import_path10 = __toESM(require("path"));
+var import_path11 = __toESM(require("path"));
 var DEFAULT_IGNORES = [
   ".next/",
   "dist/",
@@ -3394,21 +3675,21 @@ function registerIgnoreCommand(program2) {
     const env = detect(cwd);
     if (env.configType === "none") {
       const useFlat = env.eslintMajor !== null && env.eslintMajor >= 9;
-      const configPath = useFlat ? import_path10.default.join(cwd, "eslint.config.mjs") : import_path10.default.join(cwd, ".eslintrc.js");
+      const configPath = useFlat ? import_path11.default.join(cwd, "eslint.config.mjs") : import_path11.default.join(cwd, ".eslintrc.js");
       const content = useFlat ? generateFlatConfig("recommended") : generateLegacyConfig("recommended");
       writeConfig(configPath, content);
-      log.success(`No config found \u2014 generated ${import_chalk9.default.white(import_path10.default.relative(cwd, configPath))} with ignores included`);
+      log.success(`No config found \u2014 generated ${import_chalk9.default.white(import_path11.default.relative(cwd, configPath))} with ignores included`);
     } else {
       const configPath = env.configPath;
       const backupPath = backupConfig(configPath);
-      log.info(`Backed up \u2192 ${import_chalk9.default.gray(import_path10.default.relative(cwd, backupPath))}`);
+      log.info(`Backed up \u2192 ${import_chalk9.default.gray(import_path11.default.relative(cwd, backupPath))}`);
       const existing = readConfig(configPath);
       const patched = isFlat(env.configType) ? addIgnoresToFlatConfig(existing) : addIgnoresToLegacyConfig(existing);
       if (patched === existing) {
         log.warn("Ignore patterns already present in config \u2014 no changes made.");
       } else {
         writeConfig(configPath, patched);
-        log.success(`Patched ${import_chalk9.default.white(import_path10.default.relative(cwd, configPath))} with ignore patterns`);
+        log.success(`Patched ${import_chalk9.default.white(import_path11.default.relative(cwd, configPath))} with ignore patterns`);
       }
     }
     log.blank();
@@ -3420,7 +3701,7 @@ function registerIgnoreCommand(program2) {
 
 // cli/commands/baseline.ts
 var import_fs9 = __toESM(require("fs"));
-var import_path11 = __toESM(require("path"));
+var import_path12 = __toESM(require("path"));
 var import_chalk10 = __toESM(require("chalk"));
 var import_ora3 = __toESM(require("ora"));
 var BASELINE_FILE = ".ai-guard-baseline.json";
@@ -3441,12 +3722,12 @@ function saveBaseline(result, preset, mode, cwd) {
     totalIssues: result.totalIssues,
     entries
   };
-  const baselinePath = import_path11.default.join(cwd, BASELINE_FILE);
+  const baselinePath = import_path12.default.join(cwd, BASELINE_FILE);
   import_fs9.default.writeFileSync(baselinePath, JSON.stringify(baseline, null, 2), "utf-8");
   return baselinePath;
 }
 function loadBaseline(cwd) {
-  const baselinePath = import_path11.default.join(cwd, BASELINE_FILE);
+  const baselinePath = import_path12.default.join(cwd, BASELINE_FILE);
   if (!import_fs9.default.existsSync(baselinePath)) return null;
   try {
     const raw = import_fs9.default.readFileSync(baselinePath, "utf-8");
@@ -3533,7 +3814,7 @@ function registerBaselineCommand(program2) {
       }
       const baselinePath = saveBaseline(result, preset, mode, cwd);
       log.success(
-        `Baseline saved \u2192 ${import_chalk10.default.white(import_path11.default.relative(cwd, baselinePath))}`
+        `Baseline saved \u2192 ${import_chalk10.default.white(import_path12.default.relative(cwd, baselinePath))}`
       );
       log.info(`  ${result.totalIssues} issues recorded (${result.totalErrors} errors, ${result.totalWarnings} warnings)`);
       log.info(`  Preset: ${import_chalk10.default.cyan(preset)}`);
@@ -3617,7 +3898,7 @@ function registerBaselineCommand(program2) {
 
 // cli/commands/init-context.ts
 var import_fs10 = __toESM(require("fs"));
-var import_path12 = __toESM(require("path"));
+var import_path13 = __toESM(require("path"));
 var import_chalk11 = __toESM(require("chalk"));
 var import_prompts2 = require("@inquirer/prompts");
 var RULE_CATEGORIES = {
@@ -3981,13 +4262,13 @@ var AGENTS = [
   {
     id: "copilot",
     label: "GitHub Copilot",
-    filePath: import_path12.default.join(".github", "copilot-instructions.md"),
+    filePath: import_path13.default.join(".github", "copilot-instructions.md"),
     generate: generateCopilotFile
   }
 ];
 function getPackageVersion2(cwd) {
   try {
-    const pkgPath = import_path12.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
+    const pkgPath = import_path13.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
     if (import_fs10.default.existsSync(pkgPath)) {
       const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
@@ -3995,7 +4276,7 @@ function getPackageVersion2(cwd) {
   } catch {
   }
   try {
-    const pkgPath = import_path12.default.join(cwd, "package.json");
+    const pkgPath = import_path13.default.join(cwd, "package.json");
     if (import_fs10.default.existsSync(pkgPath)) {
       const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
@@ -4064,7 +4345,7 @@ function registerInitContextCommand(program2) {
     log.blank();
     const results = [];
     for (const agent of selectedAgents) {
-      const fullPath = import_path12.default.join(cwd, agent.filePath);
+      const fullPath = import_path13.default.join(cwd, agent.filePath);
       const exists = import_fs10.default.existsSync(fullPath);
       if (exists && !isForce && !isDryRun) {
         const overwrite = await (0, import_prompts2.confirm)({
@@ -4089,7 +4370,7 @@ function registerInitContextCommand(program2) {
         results.push({ file: agent.filePath, status: "dry-run" });
         continue;
       }
-      const parentDir = import_path12.default.dirname(fullPath);
+      const parentDir = import_path13.default.dirname(fullPath);
       if (!import_fs10.default.existsSync(parentDir)) {
         import_fs10.default.mkdirSync(parentDir, { recursive: true });
       }
@@ -4128,7 +4409,7 @@ function registerInitContextCommand(program2) {
 
 // cli/commands/report.ts
 var import_fs11 = __toESM(require("fs"));
-var import_path13 = __toESM(require("path"));
+var import_path14 = __toESM(require("path"));
 var import_ora4 = __toESM(require("ora"));
 var RULE_META = {
   "ai-guard/no-empty-catch": { description: "Empty catch blocks silently swallow errors", category: "Reliability" },
@@ -4152,18 +4433,18 @@ var RULE_META = {
 };
 function getProjectName(cwd) {
   try {
-    const pkgPath = import_path13.default.join(cwd, "package.json");
+    const pkgPath = import_path14.default.join(cwd, "package.json");
     if (import_fs11.default.existsSync(pkgPath)) {
       const pkg = JSON.parse(import_fs11.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.name) return pkg.name;
     }
   } catch {
   }
-  return import_path13.default.basename(cwd);
+  return import_path14.default.basename(cwd);
 }
 function getPluginVersion(cwd) {
   try {
-    const pkgPath = import_path13.default.resolve(__dirname, "../../package.json");
+    const pkgPath = import_path14.default.resolve(__dirname, "../../package.json");
     if (import_fs11.default.existsSync(pkgPath)) {
       const pkg = JSON.parse(import_fs11.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
@@ -4171,7 +4452,7 @@ function getPluginVersion(cwd) {
   } catch {
   }
   try {
-    const pkgPath = import_path13.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
+    const pkgPath = import_path14.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
     if (import_fs11.default.existsSync(pkgPath)) {
       const pkg = JSON.parse(import_fs11.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
@@ -4550,7 +4831,7 @@ function registerReportCommand(program2) {
     log.banner("AI GUARD REPORT");
     log.blank();
     const html = generateHtml(reportData);
-    const outputPath = import_path13.default.resolve(cwd, opts.output);
+    const outputPath = import_path14.default.resolve(cwd, opts.output);
     import_fs11.default.writeFileSync(outputPath, html, "utf-8");
     log.success(`Report saved: ${opts.output}`);
     log.info(
@@ -4584,7 +4865,7 @@ function registerReportCommand(program2) {
 // cli/index.ts
 function getVersion() {
   try {
-    const pkgPath = import_path14.default.resolve(__dirname, "../../package.json");
+    const pkgPath = import_path15.default.resolve(__dirname, "../../package.json");
     const raw = import_fs12.default.readFileSync(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     return typeof pkg.version === "string" ? pkg.version : "0.0.0";