eslint-plugin-ai-guard 1.2.4 → 1.2.7

package/dist/cli/index.js

@@ -414,19 +414,19 @@ function addIgnoresToLegacyConfig(existing) {
 function getConfigFilePath(configType, cwd = process.cwd()) {
   switch (configType) {
     case "flat-js":
-      return import_path6.default.join(cwd, "eslint.config.js");
+      return import_path7.default.join(cwd, "eslint.config.js");
     case "flat-mjs":
-      return import_path6.default.join(cwd, "eslint.config.mjs");
+      return import_path7.default.join(cwd, "eslint.config.mjs");
     case "flat-cjs":
-      return import_path6.default.join(cwd, "eslint.config.cjs");
+      return import_path7.default.join(cwd, "eslint.config.cjs");
     case "eslintrc-js":
-      return import_path6.default.join(cwd, ".eslintrc.js");
+      return import_path7.default.join(cwd, ".eslintrc.js");
     case "eslintrc-cjs":
-      return import_path6.default.join(cwd, ".eslintrc.cjs");
+      return import_path7.default.join(cwd, ".eslintrc.cjs");
     case "eslintrc-json":
-      return import_path6.default.join(cwd, ".eslintrc.json");
+      return import_path7.default.join(cwd, ".eslintrc.json");
     default:
-      return import_path6.default.join(cwd, ".eslintrc.js");
+      return import_path7.default.join(cwd, ".eslintrc.js");
   }
 }
 function validateFlatConfigText(content) {
@@ -461,12 +461,12 @@ function validateLegacyConfigText(content) {
   }
   return problems;
 }
-var import_fs7, import_path6, AI_GUARD_MARKER, DEFAULT_FLAT_IGNORES, DEFAULT_LEGACY_IGNORES;
+var import_fs7, import_path7, AI_GUARD_MARKER, DEFAULT_FLAT_IGNORES, DEFAULT_LEGACY_IGNORES;
 var init_config_manager = __esm({
   "cli/utils/config-manager.ts"() {
     "use strict";
     import_fs7 = __toESM(require("fs"));
-    import_path6 = __toESM(require("path"));
+    import_path7 = __toESM(require("path"));
     AI_GUARD_MARKER = "eslint-plugin-ai-guard";
     DEFAULT_FLAT_IGNORES = [
       "node_modules/**",
@@ -490,7 +490,7 @@ var init_config_manager = __esm({
 // cli/index.ts
 var import_commander = require("commander");
 var import_fs12 = __toESM(require("fs"));
-var import_path14 = __toESM(require("path"));
+var import_path15 = __toESM(require("path"));
 
 // cli/commands/run.ts
 var import_fs4 = __toESM(require("fs"));
@@ -1205,6 +1205,10 @@ async function runEslint(options) {
   };
 }
 
+// cli/utils/sarif.ts
+var import_crypto = require("crypto");
+var import_path3 = __toESM(require("path"));
+
 // cli/utils/version.ts
 var import_module = require("module");
 var import_url2 = require("url");
@@ -1230,6 +1234,8 @@ function readVersion() {
 var PKG_VERSION = _version ?? (_version = readVersion());
 
 // cli/utils/sarif.ts
+var SARIF_AUTOMATION_ID = "ai-guard";
+var FINGERPRINT_KEY = "ai-guard/v1";
 var RULE_DOCS = {
   "ai-guard/no-empty-catch": { shortDesc: "Empty catch block silently swallows errors", tags: ["reliability"] },
   "ai-guard/no-broad-exception": { shortDesc: "Catching broad Exception/Error masks specific failures", tags: ["reliability"] },
@@ -1353,8 +1359,34 @@ function confidenceToRank(confidence) {
       return 30;
   }
 }
-function filePathToUri(filePath) {
-  return filePath.replace(/\\/g, "/");
+function normalizeSarifPath(filePath, repoRoot) {
+  let normalized = filePath;
+  normalized = normalized.replace(/\\/g, "/");
+  normalized = normalized.replace(/^[A-Za-z]:\//, "/");
+  if (repoRoot && import_path3.default.isAbsolute(filePath)) {
+    const posixRoot = repoRoot.replace(/\\/g, "/").replace(/^[A-Za-z]:\//, "/").replace(/\/$/, "");
+    if (normalized.startsWith(posixRoot + "/")) {
+      normalized = normalized.slice(posixRoot.length + 1);
+    } else if (normalized.startsWith(posixRoot)) {
+      normalized = normalized.slice(posixRoot.length);
+    }
+  }
+  normalized = normalized.replace(/^\/+/, "");
+  normalized = normalized.replace(/^\.\//, "");
+  if (!normalized || normalized === ".") {
+    normalized = filePath.replace(/\\/g, "/");
+  }
+  return normalized;
+}
+function generateStableFingerprint(normalizedUri, ruleId, startLine, message) {
+  const normalizedMessage = message.trim().toLowerCase().replace(/\s+/g, " ");
+  const input = [
+    ruleId,
+    normalizedUri.toLowerCase(),
+    String(startLine),
+    normalizedMessage
+  ].join(":");
+  return (0, import_crypto.createHash)("sha256").update(input, "utf8").digest("hex");
 }
 function collectUsedRuleIds(result) {
   const ids = /* @__PURE__ */ new Set();
@@ -1405,22 +1437,34 @@ function buildRuleDescriptors(ruleIds) {
     });
   });
 }
-function buildSarifResult(issue, file) {
+function buildSarifResult(issue, file, repoRoot) {
   const confidence = ISSUE_CONFIDENCE[issue.ruleId];
   const asyncRiskType = ISSUE_ASYNC_RISK_TYPE[issue.ruleId];
   const category = ISSUE_CATEGORY[issue.ruleId];
+  const sarifUri = normalizeSarifPath(file.filePath, repoRoot);
+  const fingerprint = generateStableFingerprint(
+    sarifUri,
+    issue.ruleId,
+    Math.max(1, issue.line),
+    issue.message
+  );
   return {
     ruleId: issue.ruleId,
     level: confidenceToSarifLevel(confidence),
     kind: confidence === "informational" ? "informational" : "fail",
     rank: confidenceToRank(confidence),
     message: { text: issue.message },
+    // partialFingerprints: per-result hash for GitHub alert deduplication.
+    // Without this, GitHub closes and reopens every alert on every scan run.
+    partialFingerprints: {
+      [FINGERPRINT_KEY]: fingerprint
+    },
     locations: [
       {
         physicalLocation: {
           artifactLocation: {
-            uri: filePathToUri(file.filePath),
-            uriBaseId: "%SRCROOT%"
+            // Repository-relative POSIX path — no uriBaseId
+            uri: sarifUri
           },
           region: {
             startLine: Math.max(1, issue.line),
@@ -1515,13 +1559,13 @@ function normalizeSarifForGitHub(log2) {
     runs: normalizedRuns
   };
 }
-function buildSarifLog(result, version = PKG_VERSION) {
+function buildSarifLog(result, version = PKG_VERSION, repoRoot) {
   const usedRuleIds = collectUsedRuleIds(result);
   const rules = buildRuleDescriptors(usedRuleIds);
   const sarifResults = [];
   for (const file of result.files) {
     for (const issue of file.issues) {
-      sarifResults.push(buildSarifResult(issue, file));
+      sarifResults.push(buildSarifResult(issue, file, repoRoot));
     }
   }
   const log2 = {
@@ -1537,6 +1581,12 @@ function buildSarifLog(result, version = PKG_VERSION) {
             rules
           }
         },
+        // automationDetails.id: stable tool identifier for GitHub Code Scanning.
+        // Groups all ai-guard scan runs into one persistent analysis slot.
+        // MUST remain "ai-guard" forever — changing this orphans all existing alerts.
+        automationDetails: {
+          id: SARIF_AUTOMATION_ID
+        },
         results: sarifResults,
         properties: {
           preset: "recommended",
@@ -1553,7 +1603,19 @@ function buildSarifLog(result, version = PKG_VERSION) {
 function sarifToJson(log2) {
   return JSON.stringify(log2, null, 2);
 }
-function buildSarifDebugInfo(result) {
+function debugSarifPath(filePath, repoRoot) {
+  const normalizedUri = normalizeSarifPath(filePath, repoRoot);
+  return {
+    originalPath: filePath,
+    normalizedUri,
+    isRepositoryRelative: !import_path3.default.isAbsolute(normalizedUri) && !normalizedUri.startsWith("/"),
+    hasLeadingSlash: normalizedUri.startsWith("/"),
+    hasDriveLetter: /^[A-Za-z]:/.test(normalizedUri),
+    hasBackslashes: normalizedUri.includes("\\"),
+    hasLeadingDotSlash: normalizedUri.startsWith("./")
+  };
+}
+function buildSarifDebugInfo(result, repoRoot) {
   const usedRuleIds = collectUsedRuleIds(result);
   const rulesEmitted = usedRuleIds.map((id) => {
     const meta = RULE_DOCS[id];
@@ -1575,9 +1637,22 @@ function buildSarifDebugInfo(result) {
     };
   });
   const resultsEmitted = [];
+  const pathsDebug = [];
+  const seenPaths = /* @__PURE__ */ new Set();
   for (const file of result.files) {
+    if (!seenPaths.has(file.filePath)) {
+      seenPaths.add(file.filePath);
+      pathsDebug.push(debugSarifPath(file.filePath, repoRoot));
+    }
     for (const issue of file.issues) {
       const confidence = ISSUE_CONFIDENCE[issue.ruleId];
+      const normalizedUri = normalizeSarifPath(file.filePath, repoRoot);
+      const fingerprint = generateStableFingerprint(
+        normalizedUri,
+        issue.ruleId,
+        Math.max(1, issue.line),
+        issue.message
+      );
       resultsEmitted.push({
         ruleId: issue.ruleId,
         level: confidenceToSarifLevel(confidence),
@@ -1585,13 +1660,18 @@ function buildSarifDebugInfo(result) {
         securitySeverity: confidenceToSecuritySeverity(confidence),
         precision: confidenceToPrecision(confidence),
         filePath: file.filePath,
-        line: issue.line
+        normalizedUri,
+        line: issue.line,
+        fingerprint
       });
     }
   }
   return {
+    automationId: SARIF_AUTOMATION_ID,
+    fingerprintKey: FINGERPRINT_KEY,
     rulesEmitted,
     resultsEmitted,
+    pathsDebug,
     totalResults: result.files.reduce((n, f) => n + f.issues.length, 0),
     version: PKG_VERSION
   };
@@ -1824,7 +1904,7 @@ function writeGitHubOutputs(result, sarifPath) {
 
 // cli/utils/git-diff.ts
 var import_child_process = require("child_process");
-var import_path3 = __toESM(require("path"));
+var import_path4 = __toESM(require("path"));
 var import_fs3 = __toESM(require("fs"));
 var DEFAULT_EXTENSIONS = [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".mts", ".cts"];
 var IGNORE_PREFIXES = [
@@ -1934,7 +2014,7 @@ function filterFiles(rawFiles, extensions, workingDirectory, cwd, debugInfo) {
   for (const rel of rawFiles) {
     const normalized = rel.replace(/\\/g, "/").trim();
     if (!normalized) continue;
-    const ext = import_path3.default.extname(normalized).toLowerCase();
+    const ext = import_path4.default.extname(normalized).toLowerCase();
     if (!extensions.includes(ext)) {
       debugInfo.droppedByExtension++;
       continue;
@@ -1950,7 +2030,7 @@ function filterFiles(rawFiles, extensions, workingDirectory, cwd, debugInfo) {
         continue;
       }
     }
-    const abs = import_path3.default.resolve(cwd, normalized);
+    const abs = import_path4.default.resolve(cwd, normalized);
     if (!import_fs3.default.existsSync(abs)) {
       debugInfo.droppedMissing++;
       continue;
@@ -2073,7 +2153,7 @@ function registerRunCommand(program2) {
     "--max-warnings <n>",
     "Fail with exit code 1 if warnings exceed this count",
     (value) => Number.parseInt(value, 10)
-  ).option("--verbose", "Show all issues \u2014 disable grouping of repeated warnings").option("--quiet", "Only show errors \u2014 suppress warnings and informational hints").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-sarif", "Print SARIF tag normalization trace \u2014 diagnose duplicate-tag schema issues").option("--sarif-output <file>", "Write SARIF to this file instead of stdout").action(async (opts) => {
+  ).option("--verbose", "Show all issues \u2014 disable grouping of repeated warnings").option("--quiet", "Only show errors \u2014 suppress warnings and informational hints").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-sarif", "Print SARIF tag/level normalization trace \u2014 diagnose schema issues").option("--debug-sarif-paths", "Print path normalization trace \u2014 diagnose GitHub Code Scanning path resolution").option("--debug-sarif-persistence", "Print persistence identity trace \u2014 fingerprints, automationDetails, category").option("--sarif-output <file>", "Write SARIF to this file instead of stdout").action(async (opts) => {
     if (opts.maxWarnings !== void 0 && (!Number.isInteger(opts.maxWarnings) || opts.maxWarnings < 0)) {
       log.blank();
       log.error("--max-warnings must be a non-negative integer.");
@@ -2126,10 +2206,11 @@ function registerRunCommand(program2) {
       writeGitHubOutputs(result);
     }
     if (opts.sarif || opts.sarifOutput) {
-      const sarifLog = buildSarifLog(result);
+      const repoRoot = process.env.GITHUB_WORKSPACE ?? void 0;
+      const sarifLog = buildSarifLog(result, void 0, repoRoot);
       const sarifJson = sarifToJson(sarifLog);
       if (opts.debugSarif) {
-        const debugInfo = buildSarifDebugInfo(result);
+        const debugInfo = buildSarifDebugInfo(result, repoRoot);
         process.stderr.write("\n[debug-sarif] SARIF GitHub Compatibility Trace\n");
         process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
         process.stderr.write("[debug-sarif] Rules Emitted:\n");
@@ -2167,11 +2248,67 @@ function registerRunCommand(program2) {
             process.stderr.write(`[debug-sarif]     security-severity: ${res.securitySeverity}
 `);
             process.stderr.write(`[debug-sarif]     precision:         ${res.precision}
+`);
+            process.stderr.write(`[debug-sarif]     artifact uri:      ${res.normalizedUri}
 `);
           }
         }
         process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
       }
+      if (opts.debugSarifPaths) {
+        const debugInfo = buildSarifDebugInfo(result, repoRoot);
+        process.stderr.write("\n[debug-sarif-paths] Path Normalization Trace\n");
+        process.stderr.write("[debug-sarif-paths] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+        process.stderr.write(`[debug-sarif-paths] GITHUB_WORKSPACE: ${repoRoot ?? "(not set \u2014 local run)"}
+
+`);
+        if (debugInfo.pathsDebug.length === 0) {
+          process.stderr.write("[debug-sarif-paths]   (no files in results)\n");
+        } else {
+          for (const p of debugInfo.pathsDebug) {
+            process.stderr.write(`[debug-sarif-paths]   original path:   ${p.originalPath}
+`);
+            process.stderr.write(`[debug-sarif-paths]   artifact uri:    ${p.normalizedUri}
+`);
+            process.stderr.write(`[debug-sarif-paths]   repo-relative:   ${p.isRepositoryRelative ? "\u2705 yes" : "\u274C NO (GitHub may miss this)"}
+`);
+            if (p.hasBackslashes) process.stderr.write("[debug-sarif-paths]   \u26A0 had backslashes \u2014 converted\n");
+            if (p.hasDriveLetter) process.stderr.write("[debug-sarif-paths]   \u26A0 had drive letter \u2014 stripped\n");
+            if (p.hasLeadingSlash) process.stderr.write("[debug-sarif-paths]   \u26A0 had leading slash \u2014 stripped\n");
+            if (p.hasLeadingDotSlash) process.stderr.write("[debug-sarif-paths]   \u26A0 had leading ./ \u2014 stripped\n");
+            process.stderr.write("\n");
+          }
+        }
+        process.stderr.write("[debug-sarif-paths] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
+      }
+      if (opts.debugSarifPersistence) {
+        const debugInfo = buildSarifDebugInfo(result, repoRoot);
+        process.stderr.write("\n[debug-sarif-persistence] GitHub Persistence Identity Trace\n");
+        process.stderr.write("[debug-sarif-persistence] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+        process.stderr.write(`[debug-sarif-persistence] automationDetails.id: ${debugInfo.automationId}
+`);
+        process.stderr.write(`[debug-sarif-persistence] fingerprintKey:        ${debugInfo.fingerprintKey}
+`);
+        process.stderr.write(`[debug-sarif-persistence] GITHUB_WORKSPACE:      ${repoRoot ?? "(not set)"}
+`);
+        process.stderr.write(`[debug-sarif-persistence] totalResults:          ${debugInfo.totalResults}
+
+`);
+        if (debugInfo.resultsEmitted.length === 0) {
+          process.stderr.write("[debug-sarif-persistence]   (no findings \u2014 no fingerprints to show)\n");
+        } else {
+          process.stderr.write("[debug-sarif-persistence] Fingerprints (stable identity per finding):\n");
+          for (const res of debugInfo.resultsEmitted) {
+            process.stderr.write(`[debug-sarif-persistence]   \u2500 ${res.ruleId}
+`);
+            process.stderr.write(`[debug-sarif-persistence]     file:        ${res.normalizedUri}:${res.line}
+`);
+            process.stderr.write(`[debug-sarif-persistence]     fingerprint: ${res.fingerprint}
+`);
+          }
+        }
+        process.stderr.write("[debug-sarif-persistence] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
+      }
       if (opts.sarifOutput) {
         import_fs4.default.writeFileSync(opts.sarifOutput, sarifJson, "utf-8");
         if (opts.debugSarif) {
@@ -2514,7 +2651,7 @@ function resolveExitCode(result, failOn, maxWarnings) {
 }
 
 // cli/commands/changed.ts
-var import_path4 = __toESM(require("path"));
+var import_path5 = __toESM(require("path"));
 var import_fs5 = __toESM(require("fs"));
 var import_ora2 = __toESM(require("ora"));
 var import_chalk5 = __toESM(require("chalk"));
@@ -2523,7 +2660,7 @@ function registerChangedCommand(program2) {
     "--max-warnings <n>",
     "Fail if warnings exceed this count",
     (v) => Number.parseInt(v, 10)
-  ).option("--verbose", "Expand all findings (disable grouping)").option("--quiet", "Show errors only").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-git", "Print full git resolution trace (useful for diagnosing zero-file issues)").option("--debug-ci", "Print CI environment state (GITHUB_* vars, SARIF path, summary path)").option("--debug-sarif", "Print SARIF tag normalization trace \u2014 diagnose duplicate-tag schema issues").action(async (opts) => {
+  ).option("--verbose", "Expand all findings (disable grouping)").option("--quiet", "Show errors only").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-git", "Print full git resolution trace (useful for diagnosing zero-file issues)").option("--debug-ci", "Print CI environment state (GITHUB_* vars, SARIF path, summary path)").option("--debug-sarif", "Print SARIF tag/level normalization trace \u2014 diagnose schema issues").option("--debug-sarif-paths", "Print path normalization trace \u2014 diagnose GitHub Code Scanning path resolution").option("--debug-sarif-persistence", "Print persistence identity trace \u2014 fingerprints, automationDetails, category").action(async (opts) => {
     const preset = opts.strict ? "strict" : opts.security ? "security" : "recommended";
     const inCI = isGitHubActions();
     const baseRef = opts.base ?? (opts.pr || inCI ? getGitHubBaseRef() : void 0);
@@ -2552,7 +2689,7 @@ function registerChangedCommand(program2) {
       });
     }
     const cwd = process.cwd();
-    const resolvedPath = import_path4.default.resolve(opts.path);
+    const resolvedPath = import_path5.default.resolve(opts.path);
     const workingDirectory = opts.path !== "." ? opts.path : void 0;
     const spinner = opts.json || opts.sarif ? null : (0, import_ora2.default)({ text: import_chalk5.default.dim("Detecting changed files\u2026"), color: "cyan" }).start();
     const changedResult = getChangedFiles({
@@ -2633,10 +2770,11 @@ function handleResults(result, opts, preset, scanMode, changedFilesCount, inCI,
     emitGitHubAnnotations(result);
   }
   if (opts.sarif) {
-    const sarifLog = buildSarifLog(result);
+    const repoRoot = process.env.GITHUB_WORKSPACE ?? void 0;
+    const sarifLog = buildSarifLog(result, void 0, repoRoot);
     const sarifJson = sarifToJson(sarifLog);
     if (opts.debugSarif) {
-      const debugInfo = buildSarifDebugInfo(result);
+      const debugInfo = buildSarifDebugInfo(result, repoRoot);
       process.stderr.write("\n[debug-sarif] SARIF GitHub Compatibility Trace\n");
       process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
       process.stderr.write("[debug-sarif] Rules Emitted:\n");
@@ -2674,11 +2812,67 @@ function handleResults(result, opts, preset, scanMode, changedFilesCount, inCI,
           process.stderr.write(`[debug-sarif]     security-severity: ${res.securitySeverity}
 `);
           process.stderr.write(`[debug-sarif]     precision:         ${res.precision}
+`);
+          process.stderr.write(`[debug-sarif]     artifact uri:      ${res.normalizedUri}
 `);
         }
       }
       process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
     }
+    if (opts.debugSarifPaths) {
+      const debugInfo = buildSarifDebugInfo(result, repoRoot);
+      process.stderr.write("\n[debug-sarif-paths] Path Normalization Trace\n");
+      process.stderr.write("[debug-sarif-paths] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+      process.stderr.write(`[debug-sarif-paths] GITHUB_WORKSPACE: ${repoRoot ?? "(not set \u2014 local run)"}
+
+`);
+      if (debugInfo.pathsDebug.length === 0) {
+        process.stderr.write("[debug-sarif-paths]   (no files in results)\n");
+      } else {
+        for (const p of debugInfo.pathsDebug) {
+          process.stderr.write(`[debug-sarif-paths]   original path:   ${p.originalPath}
+`);
+          process.stderr.write(`[debug-sarif-paths]   artifact uri:    ${p.normalizedUri}
+`);
+          process.stderr.write(`[debug-sarif-paths]   repo-relative:   ${p.isRepositoryRelative ? "\u2705 yes" : "\u274C NO (GitHub may miss this)"}
+`);
+          if (p.hasBackslashes) process.stderr.write("[debug-sarif-paths]   \u26A0 had backslashes \u2014 converted\n");
+          if (p.hasDriveLetter) process.stderr.write("[debug-sarif-paths]   \u26A0 had drive letter \u2014 stripped\n");
+          if (p.hasLeadingSlash) process.stderr.write("[debug-sarif-paths]   \u26A0 had leading slash \u2014 stripped\n");
+          if (p.hasLeadingDotSlash) process.stderr.write("[debug-sarif-paths]   \u26A0 had leading ./ \u2014 stripped\n");
+          process.stderr.write("\n");
+        }
+      }
+      process.stderr.write("[debug-sarif-paths] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
+    }
+    if (opts.debugSarifPersistence) {
+      const debugInfo = buildSarifDebugInfo(result, repoRoot);
+      process.stderr.write("\n[debug-sarif-persistence] GitHub Persistence Identity Trace\n");
+      process.stderr.write("[debug-sarif-persistence] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+      process.stderr.write(`[debug-sarif-persistence] automationDetails.id: ${debugInfo.automationId}
+`);
+      process.stderr.write(`[debug-sarif-persistence] fingerprintKey:        ${debugInfo.fingerprintKey}
+`);
+      process.stderr.write(`[debug-sarif-persistence] GITHUB_WORKSPACE:      ${repoRoot ?? "(not set)"}
+`);
+      process.stderr.write(`[debug-sarif-persistence] totalResults:          ${debugInfo.totalResults}
+
+`);
+      if (debugInfo.resultsEmitted.length === 0) {
+        process.stderr.write("[debug-sarif-persistence]   (no findings \u2014 no fingerprints to show)\n");
+      } else {
+        process.stderr.write("[debug-sarif-persistence] Fingerprints (stable identity per finding):\n");
+        for (const res of debugInfo.resultsEmitted) {
+          process.stderr.write(`[debug-sarif-persistence]   \u2500 ${res.ruleId}
+`);
+          process.stderr.write(`[debug-sarif-persistence]     file:        ${res.normalizedUri}:${res.line}
+`);
+          process.stderr.write(`[debug-sarif-persistence]     fingerprint: ${res.fingerprint}
+`);
+        }
+      }
+      process.stderr.write("[debug-sarif-persistence] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
+    }
     if (resolvedSarifPath) {
       import_fs5.default.writeFileSync(resolvedSarifPath, sarifJson, "utf-8");
       if (opts.debugSarif) {
@@ -2814,12 +3008,12 @@ function getFailOnExitCode(result, failOn, maxWarnings) {
 
 // cli/commands/init.ts
 var import_chalk6 = __toESM(require("chalk"));
-var import_path7 = __toESM(require("path"));
+var import_path8 = __toESM(require("path"));
 var import_fs8 = __toESM(require("fs"));
 
 // cli/utils/detector.ts
 var import_fs6 = __toESM(require("fs"));
-var import_path5 = __toESM(require("path"));
+var import_path6 = __toESM(require("path"));
 var import_module2 = require("module");
 var FLAT_CONFIG_FILES = [
   { file: "eslint.config.js", type: "flat-js" },
@@ -2836,11 +3030,11 @@ var LEGACY_CONFIG_FILES = [
 var ALL_CONFIG_FILES = [...FLAT_CONFIG_FILES, ...LEGACY_CONFIG_FILES];
 function isPackageInstalled(pkgName, cwd = process.cwd()) {
   try {
-    const pkgPath = import_path5.default.join(cwd, "node_modules", pkgName, "package.json");
+    const pkgPath = import_path6.default.join(cwd, "node_modules", pkgName, "package.json");
     if (import_fs6.default.existsSync(pkgPath)) {
       return true;
     }
-    const req = (0, import_module2.createRequire)(import_path5.default.join(cwd, "package.json"));
+    const req = (0, import_module2.createRequire)(import_path6.default.join(cwd, "package.json"));
     req.resolve(`${pkgName}/package.json`);
     return true;
   } catch {
@@ -2849,8 +3043,8 @@ function isPackageInstalled(pkgName, cwd = process.cwd()) {
 }
 function getPackageVersion(pkgName, cwd = process.cwd()) {
   try {
-    const pkgPath = import_path5.default.join(cwd, "node_modules", pkgName, "package.json");
-    const resolvedPath = import_fs6.default.existsSync(pkgPath) ? pkgPath : (0, import_module2.createRequire)(import_path5.default.join(cwd, "package.json")).resolve(`${pkgName}/package.json`);
+    const pkgPath = import_path6.default.join(cwd, "node_modules", pkgName, "package.json");
+    const resolvedPath = import_fs6.default.existsSync(pkgPath) ? pkgPath : (0, import_module2.createRequire)(import_path6.default.join(cwd, "package.json")).resolve(`${pkgName}/package.json`);
     const raw = import_fs6.default.readFileSync(resolvedPath, "utf-8");
     const json = JSON.parse(raw);
     return json.version ?? null;
@@ -2867,7 +3061,7 @@ function detectConfigType(cwd = process.cwd()) {
   const found = [];
   let first = null;
   for (const { file, type } of ALL_CONFIG_FILES) {
-    const fullPath = import_path5.default.join(cwd, file);
+    const fullPath = import_path6.default.join(cwd, file);
     if (import_fs6.default.existsSync(fullPath)) {
       found.push(fullPath);
       if (!first) first = { type, path: fullPath };
@@ -2947,7 +3141,7 @@ async function verifyConfigLoads(configPath, cwd) {
       overrideConfigFile: configPath
     });
     await eslint.lintText("", {
-      filePath: import_path7.default.join(cwd, "_ai_guard_probe_.js")
+      filePath: import_path8.default.join(cwd, "_ai_guard_probe_.js")
     });
     return null;
   } catch (err) {
@@ -2983,7 +3177,7 @@ function registerInitCommand(program2) {
       log.warn("eslint-plugin-ai-guard not found");
     }
     if (env.configType !== "none") {
-      log.success(`ESLint config found: ${import_chalk6.default.white(import_path7.default.relative(cwd, env.configPath ?? env.configType))}`);
+      log.success(`ESLint config found: ${import_chalk6.default.white(import_path8.default.relative(cwd, env.configPath ?? env.configType))}`);
     } else {
       log.info("No ESLint config found \u2014 will generate one");
     }
@@ -2992,7 +3186,7 @@ function registerInitCommand(program2) {
       log.blank();
       log.warn("Conflicting configs detected:");
       for (const p of env.allConfigPaths) {
-        log.print(`    ${import_chalk6.default.yellow("\u2192")} ${import_chalk6.default.white(import_path7.default.relative(cwd, p))}`);
+        log.print(`    ${import_chalk6.default.yellow("\u2192")} ${import_chalk6.default.white(import_path8.default.relative(cwd, p))}`);
       }
       log.print(`  ${import_chalk6.default.gray("Multiple config formats found \u2014 this can cause unpredictable behavior.")}`);
     }
@@ -3020,7 +3214,7 @@ function registerInitCommand(program2) {
     try {
       const { createRequire: createRequire3 } = await import("module");
       const { pathToFileURL: pathToFileURL2 } = await import("url");
-      const req = createRequire3(import_path7.default.join(cwd, "_probe.js"));
+      const req = createRequire3(import_path8.default.join(cwd, "_probe.js"));
       const resolvedPath = req.resolve("eslint-plugin-ai-guard");
       const aiGuard = await import(pathToFileURL2(resolvedPath).href);
       const plugin = aiGuard.default || aiGuard;
@@ -3039,7 +3233,7 @@ function registerInitCommand(program2) {
     if (eslintNeedsFlat && existingIsLegacy) {
       log.section("Config Migration Required");
       log.warn(`ESLint v${env.eslintMajor} requires flat config, but a legacy config was found:`);
-      log.print(`    ${import_chalk6.default.white(import_path7.default.relative(cwd, env.configPath))}`);
+      log.print(`    ${import_chalk6.default.white(import_path8.default.relative(cwd, env.configPath))}`);
       log.blank();
       log.print(`  ${import_chalk6.default.bold("ai-guard will create a new flat config.")}`);
       log.blank();
@@ -3051,7 +3245,7 @@ function registerInitCommand(program2) {
       const raw = readConfig(env.configPath);
       const { content: fixed, changed } = removeNukeIgnore(raw);
       if (changed) {
-        log.warn(`Removed "**/*" ignore pattern from ${import_path7.default.relative(cwd, env.configPath)}`);
+        log.warn(`Removed "**/*" ignore pattern from ${import_path8.default.relative(cwd, env.configPath)}`);
         if (!isDryRun) {
           backupConfig(env.configPath);
           writeConfig(env.configPath, fixed);
@@ -3063,7 +3257,7 @@ function registerInitCommand(program2) {
     }
     if (env.configType === "none" || eslintNeedsFlat && existingIsLegacy) {
       const targetName = useFlat ? "eslint.config.mjs" : ".eslintrc.js";
-      finalConfigPath = import_path7.default.join(cwd, targetName);
+      finalConfigPath = import_path8.default.join(cwd, targetName);
       const content2 = useFlat ? generateFlatConfig(preset) : generateLegacyConfig(preset);
       if (isDryRun) {
         log.print(`  ${import_chalk6.default.gray(`[dry-run] would create: ${targetName}`)}`);
@@ -3091,15 +3285,15 @@ function registerInitCommand(program2) {
         finalConfigPath = env.configPath;
       } else if (isDryRun) {
         finalConfigPath = env.configPath;
-        log.print(`  ${import_chalk6.default.gray(`[dry-run] would patch: ${import_path7.default.relative(cwd, env.configPath)}`)}`);
+        log.print(`  ${import_chalk6.default.gray(`[dry-run] would patch: ${import_path8.default.relative(cwd, env.configPath)}`)}`);
       } else {
         const bak = backupConfig(env.configPath);
-        log.info(`Backed up \u2192 ${import_chalk6.default.gray(import_path7.default.relative(cwd, bak))}`);
+        log.info(`Backed up \u2192 ${import_chalk6.default.gray(import_path8.default.relative(cwd, bak))}`);
         writeConfig(env.configPath, patched);
         if (isInvalid) {
-          log.success(`Detected invalid ai-guard config \u2014 repairing ${import_chalk6.default.white(import_path7.default.relative(cwd, env.configPath))}`);
+          log.success(`Detected invalid ai-guard config \u2014 repairing ${import_chalk6.default.white(import_path8.default.relative(cwd, env.configPath))}`);
         } else {
-          log.success(`Patched ${import_chalk6.default.white(import_path7.default.relative(cwd, env.configPath))}`);
+          log.success(`Patched ${import_chalk6.default.white(import_path8.default.relative(cwd, env.configPath))}`);
         }
         finalConfigPath = env.configPath;
         configWritten = true;
@@ -3112,12 +3306,12 @@ function registerInitCommand(program2) {
         finalConfigPath = env.configPath;
       } else if (isDryRun) {
         finalConfigPath = env.configPath;
-        log.print(`  ${import_chalk6.default.gray(`[dry-run] would patch: ${import_path7.default.relative(cwd, env.configPath)}`)}`);
+        log.print(`  ${import_chalk6.default.gray(`[dry-run] would patch: ${import_path8.default.relative(cwd, env.configPath)}`)}`);
       } else {
         const bak = backupConfig(env.configPath);
-        log.info(`Backed up \u2192 ${import_chalk6.default.gray(import_path7.default.relative(cwd, bak))}`);
+        log.info(`Backed up \u2192 ${import_chalk6.default.gray(import_path8.default.relative(cwd, bak))}`);
         writeConfig(env.configPath, patched);
-        log.success(`Patched ${import_chalk6.default.white(import_path7.default.relative(cwd, env.configPath))}`);
+        log.success(`Patched ${import_chalk6.default.white(import_path8.default.relative(cwd, env.configPath))}`);
         finalConfigPath = env.configPath;
         configWritten = true;
       }
@@ -3133,11 +3327,11 @@ function registerInitCommand(program2) {
               cleanedUp = true;
             } catch (err) {
               const reason = err instanceof Error ? err.message : String(err);
-              log.warn(`Could not back up ${import_path7.default.relative(cwd, p)}: ${reason}`);
+              log.warn(`Could not back up ${import_path8.default.relative(cwd, p)}: ${reason}`);
             }
           } else {
             cleanedUp = true;
-            log.print(`  ${import_chalk6.default.gray(`[dry-run] would rename ${import_path7.default.relative(cwd, p)} to ${import_path7.default.basename(p)}.bak`)}`);
+            log.print(`  ${import_chalk6.default.gray(`[dry-run] would rename ${import_path8.default.relative(cwd, p)} to ${import_path8.default.basename(p)}.bak`)}`);
           }
         }
       }
@@ -3156,7 +3350,7 @@ function registerInitCommand(program2) {
     log.blank();
     log.section("Validation");
     if (!import_fs8.default.existsSync(finalConfigPath)) {
-      log.error(`Config file not found after write: ${import_path7.default.relative(cwd, finalConfigPath)}`);
+      log.error(`Config file not found after write: ${import_path8.default.relative(cwd, finalConfigPath)}`);
       log.blank();
       log.print(`  ${import_chalk6.default.bold("Problem:")} File write may have failed.`);
       log.print(`  ${import_chalk6.default.bold("Fix:")} Check disk space and file permissions, then re-run.`);
@@ -3172,7 +3366,7 @@ function registerInitCommand(program2) {
         log.print(`    ${import_chalk6.default.red("\u2716")} ${e}`);
       }
     } else {
-      log.success(`Config structure valid: ${import_chalk6.default.white(import_path7.default.relative(cwd, finalConfigPath))}`);
+      log.success(`Config structure valid: ${import_chalk6.default.white(import_path8.default.relative(cwd, finalConfigPath))}`);
     }
     log.info("Verifying ESLint can load the config\u2026");
     const loadError = await verifyConfigLoads(finalConfigPath, cwd);
@@ -3196,7 +3390,7 @@ function registerInitCommand(program2) {
         }
         log.blank();
         log.print(`  ${import_chalk6.default.bold("Fix:")}`);
-        log.print(`    1. Check the syntax in ${import_chalk6.default.cyan(import_path7.default.relative(cwd, finalConfigPath))}`);
+        log.print(`    1. Check the syntax in ${import_chalk6.default.cyan(import_path8.default.relative(cwd, finalConfigPath))}`);
         log.print(`    2. Make sure ${import_chalk6.default.cyan("eslint-plugin-ai-guard")} is installed`);
         log.print(`    3. Run ${import_chalk6.default.cyan("ai-guard doctor")} for full diagnostics`);
         log.blank();
@@ -3218,7 +3412,7 @@ function registerInitCommand(program2) {
     if (loadError === null && !lingeringConflicts) {
       log.print(`  ${import_chalk6.default.green("\u2714")}  ${import_chalk6.default.bold.green("Configuration validated successfully")}`);
     }
-    log.print(`  ${import_chalk6.default.green("\u2714")}  ${import_chalk6.default.bold("ESLint config:")} ${import_chalk6.default.cyan(import_path7.default.relative(cwd, finalConfigPath))}`);
+    log.print(`  ${import_chalk6.default.green("\u2714")}  ${import_chalk6.default.bold("ESLint config:")} ${import_chalk6.default.cyan(import_path8.default.relative(cwd, finalConfigPath))}`);
     log.print(`  ${import_chalk6.default.green("\u2714")}  ${import_chalk6.default.bold("Mode:")} ${import_chalk6.default.cyan(useFlat ? `Flat config (ESLint v${env.eslintMajor ?? 9})` : `Legacy config (ESLint v${env.eslintMajor ?? 8})`)}`);
     log.print(`  ${import_chalk6.default.green("\u2714")}  ${import_chalk6.default.bold("Preset:")} ${import_chalk6.default.cyan(preset)}`);
     log.blank();
@@ -3232,14 +3426,14 @@ function registerInitCommand(program2) {
 
 // cli/commands/doctor.ts
 var import_chalk7 = __toESM(require("chalk"));
-var import_path8 = __toESM(require("path"));
+var import_path9 = __toESM(require("path"));
 init_config_manager();
 var import_meta2 = {};
 async function probeConfigLoad(configPath, cwd) {
   try {
     const { ESLint } = await import("eslint");
     const eslint = new ESLint({ cwd, overrideConfigFile: configPath });
-    await eslint.lintText("", { filePath: import_path8.default.join(cwd, "_probe_.js") });
+    await eslint.lintText("", { filePath: import_path9.default.join(cwd, "_probe_.js") });
     return { ok: true, error: null };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -3274,7 +3468,7 @@ function registerDoctorCommand(program2) {
     checks.push({
       label: "ESLint config present",
       pass: hasConfig,
-      detail: hasConfig ? `${import_path8.default.relative(cwd, env.configPath ?? "")} (${env.configType})` : "No eslint.config.* or .eslintrc.* found",
+      detail: hasConfig ? `${import_path9.default.relative(cwd, env.configPath ?? "")} (${env.configType})` : "No eslint.config.* or .eslintrc.* found",
       fix: hasConfig ? void 0 : "ai-guard init",
       note: hasConfig ? void 0 : "This will generate the correct config format for your ESLint version"
     });
@@ -3306,7 +3500,7 @@ function registerDoctorCommand(program2) {
       checks.push({
         label: "Plugin wired in config",
         pass: pluginWired && !isInvalidConfig,
-        detail: readError ? `Could not read config: ${readError}` : isInvalidConfig ? "Invalid ai-guard config detected (wrong export usage)" : pluginWired ? "eslint-plugin-ai-guard referenced in config" : `Config exists but ai-guard plugin not found in ${import_path8.default.relative(cwd, env.configPath)}`,
+        detail: readError ? `Could not read config: ${readError}` : isInvalidConfig ? "Invalid ai-guard config detected (wrong export usage)" : pluginWired ? "eslint-plugin-ai-guard referenced in config" : `Config exists but ai-guard plugin not found in ${import_path9.default.relative(cwd, env.configPath)}`,
         fix: isInvalidConfig || !pluginWired && !readError ? "ai-guard init  (will patch/repair your existing config)" : void 0
       });
     }
@@ -3314,7 +3508,7 @@ function registerDoctorCommand(program2) {
       label: "No conflicting config files",
       pass: !env.hasConflictingConfigs,
       detail: env.hasConflictingConfigs ? `Conflicting config detected:
-${env.allConfigPaths.map((p) => `       ${import_path8.default.relative(cwd, p)}`).join("\n")}` : "Only one config format detected",
+${env.allConfigPaths.map((p) => `       ${import_path9.default.relative(cwd, p)}`).join("\n")}` : "Only one config format detected",
       fix: env.hasConflictingConfigs ? "Remove or backup legacy config" : void 0,
       note: env.hasConflictingConfigs ? "ESLint v9 silently ignores .eslintrc.* when a flat config exists. This can cause confusion." : void 0
     });
@@ -3341,7 +3535,7 @@ ${env.allConfigPaths.map((p) => `       ${import_path8.default.relative(cwd, p)}
         label: "ESLint config loads without errors",
         pass: probe.ok,
         detail: probe.ok ? "ESLint loaded config successfully" : probe.error ?? "Unknown error",
-        fix: probe.ok ? void 0 : `Check syntax in ${import_path8.default.relative(cwd, env.configPath)}`,
+        fix: probe.ok ? void 0 : `Check syntax in ${import_path9.default.relative(cwd, env.configPath)}`,
         note: probe.ok ? void 0 : "Run: ai-guard init --dry-run  to preview a fresh config"
       });
     }
@@ -3350,7 +3544,7 @@ ${env.allConfigPaths.map((p) => `       ${import_path8.default.relative(cwd, p)}
       let utilsVersion = null;
       try {
         const { createRequire: createRequire3 } = await import("module");
-        const req = createRequire3(import_path8.default.join(cwd, "package.json"));
+        const req = createRequire3(import_path9.default.join(cwd, "package.json"));
         const pkgPath = req.resolve("@typescript-eslint/utils/package.json");
         const pkg = JSON.parse(
           (await import("fs")).readFileSync(pkgPath, "utf-8")
@@ -3361,10 +3555,10 @@ ${env.allConfigPaths.map((p) => `       ${import_path8.default.relative(cwd, p)}
       }
       if (!utilsOk) {
         try {
-          const selfDir = import_path8.default.dirname(
+          const selfDir = import_path9.default.dirname(
             new URL(import_meta2.url).pathname.replace(/^\/([A-Za-z]:)/, "$1")
           );
-          const pkgPath = import_path8.default.join(selfDir, "../../node_modules/@typescript-eslint/utils/package.json");
+          const pkgPath = import_path9.default.join(selfDir, "../../node_modules/@typescript-eslint/utils/package.json");
           if ((await import("fs")).existsSync(pkgPath)) {
             utilsOk = true;
           }
@@ -3384,7 +3578,7 @@ ${env.allConfigPaths.map((p) => `       ${import_path8.default.relative(cwd, p)}
       let parserVersion = null;
       try {
         const { createRequire: createRequire3 } = await import("module");
-        const req = createRequire3(import_path8.default.join(cwd, "package.json"));
+        const req = createRequire3(import_path9.default.join(cwd, "package.json"));
         const pkgPath = req.resolve("@typescript-eslint/parser/package.json");
         const pkg = JSON.parse(
           (await import("fs")).readFileSync(pkgPath, "utf-8")
@@ -3472,7 +3666,7 @@ ${env.allConfigPaths.map((p) => `       ${import_path8.default.relative(cwd, p)}
 var import_prompts = require("@inquirer/prompts");
 var import_chalk8 = __toESM(require("chalk"));
 init_config_manager();
-var import_path9 = __toESM(require("path"));
+var import_path10 = __toESM(require("path"));
 function registerPresetCommand(program2) {
   program2.command("preset").description("Interactively select and apply an ai-guard preset to your ESLint config").action(async () => {
     const cwd = process.cwd();
@@ -3500,14 +3694,14 @@ function registerPresetCommand(program2) {
     const env = detect(cwd);
     const useFlat = env.eslintMajor !== null && env.eslintMajor >= 9 || isFlat(env.configType);
     if (env.configType === "none") {
-      const configPath = useFlat ? import_path9.default.join(cwd, "eslint.config.mjs") : import_path9.default.join(cwd, ".eslintrc.js");
+      const configPath = useFlat ? import_path10.default.join(cwd, "eslint.config.mjs") : import_path10.default.join(cwd, ".eslintrc.js");
       const content = useFlat ? generateFlatConfig(preset) : generateLegacyConfig(preset);
       writeConfig(configPath, content);
-      log.success(`Created ${import_chalk8.default.white(import_path9.default.relative(cwd, configPath))} with ${import_chalk8.default.cyan(preset)} preset`);
+      log.success(`Created ${import_chalk8.default.white(import_path10.default.relative(cwd, configPath))} with ${import_chalk8.default.cyan(preset)} preset`);
     } else {
       const configPath = env.configPath;
       const backupPath = backupConfig(configPath);
-      log.info(`Backed up \u2192 ${import_chalk8.default.gray(import_path9.default.relative(cwd, backupPath))}`);
+      log.info(`Backed up \u2192 ${import_chalk8.default.gray(import_path10.default.relative(cwd, backupPath))}`);
       const existing = readConfig(configPath);
       const withPlugin = isFlat(env.configType) ? patchFlatConfig(existing, preset) : patchLegacyConfig(existing, preset);
       const patched = isFlat(env.configType) ? switchFlatPreset(withPlugin, preset) : switchLegacyPreset(withPlugin, preset);
@@ -3515,7 +3709,7 @@ function registerPresetCommand(program2) {
         log.warn("No preset changes needed. Config already matches selected preset.");
       } else {
         writeConfig(configPath, patched);
-        log.success(`Updated ${import_chalk8.default.white(import_path9.default.relative(cwd, configPath))} to ${import_chalk8.default.cyan(preset)} preset`);
+        log.success(`Updated ${import_chalk8.default.white(import_path10.default.relative(cwd, configPath))} to ${import_chalk8.default.cyan(preset)} preset`);
       }
     }
     log.blank();
@@ -3555,7 +3749,7 @@ function registerPresetCommand(program2) {
 // cli/commands/ignore.ts
 var import_chalk9 = __toESM(require("chalk"));
 init_config_manager();
-var import_path10 = __toESM(require("path"));
+var import_path11 = __toESM(require("path"));
 var DEFAULT_IGNORES = [
   ".next/",
   "dist/",
@@ -3577,21 +3771,21 @@ function registerIgnoreCommand(program2) {
     const env = detect(cwd);
     if (env.configType === "none") {
       const useFlat = env.eslintMajor !== null && env.eslintMajor >= 9;
-      const configPath = useFlat ? import_path10.default.join(cwd, "eslint.config.mjs") : import_path10.default.join(cwd, ".eslintrc.js");
+      const configPath = useFlat ? import_path11.default.join(cwd, "eslint.config.mjs") : import_path11.default.join(cwd, ".eslintrc.js");
       const content = useFlat ? generateFlatConfig("recommended") : generateLegacyConfig("recommended");
       writeConfig(configPath, content);
-      log.success(`No config found \u2014 generated ${import_chalk9.default.white(import_path10.default.relative(cwd, configPath))} with ignores included`);
+      log.success(`No config found \u2014 generated ${import_chalk9.default.white(import_path11.default.relative(cwd, configPath))} with ignores included`);
     } else {
       const configPath = env.configPath;
       const backupPath = backupConfig(configPath);
-      log.info(`Backed up \u2192 ${import_chalk9.default.gray(import_path10.default.relative(cwd, backupPath))}`);
+      log.info(`Backed up \u2192 ${import_chalk9.default.gray(import_path11.default.relative(cwd, backupPath))}`);
       const existing = readConfig(configPath);
       const patched = isFlat(env.configType) ? addIgnoresToFlatConfig(existing) : addIgnoresToLegacyConfig(existing);
       if (patched === existing) {
         log.warn("Ignore patterns already present in config \u2014 no changes made.");
       } else {
         writeConfig(configPath, patched);
-        log.success(`Patched ${import_chalk9.default.white(import_path10.default.relative(cwd, configPath))} with ignore patterns`);
+        log.success(`Patched ${import_chalk9.default.white(import_path11.default.relative(cwd, configPath))} with ignore patterns`);
       }
     }
     log.blank();
@@ -3603,7 +3797,7 @@ function registerIgnoreCommand(program2) {
 
 // cli/commands/baseline.ts
 var import_fs9 = __toESM(require("fs"));
-var import_path11 = __toESM(require("path"));
+var import_path12 = __toESM(require("path"));
 var import_chalk10 = __toESM(require("chalk"));
 var import_ora3 = __toESM(require("ora"));
 var BASELINE_FILE = ".ai-guard-baseline.json";
@@ -3624,12 +3818,12 @@ function saveBaseline(result, preset, mode, cwd) {
     totalIssues: result.totalIssues,
     entries
   };
-  const baselinePath = import_path11.default.join(cwd, BASELINE_FILE);
+  const baselinePath = import_path12.default.join(cwd, BASELINE_FILE);
   import_fs9.default.writeFileSync(baselinePath, JSON.stringify(baseline, null, 2), "utf-8");
   return baselinePath;
 }
 function loadBaseline(cwd) {
-  const baselinePath = import_path11.default.join(cwd, BASELINE_FILE);
+  const baselinePath = import_path12.default.join(cwd, BASELINE_FILE);
   if (!import_fs9.default.existsSync(baselinePath)) return null;
   try {
     const raw = import_fs9.default.readFileSync(baselinePath, "utf-8");
@@ -3716,7 +3910,7 @@ function registerBaselineCommand(program2) {
       }
       const baselinePath = saveBaseline(result, preset, mode, cwd);
       log.success(
-        `Baseline saved \u2192 ${import_chalk10.default.white(import_path11.default.relative(cwd, baselinePath))}`
+        `Baseline saved \u2192 ${import_chalk10.default.white(import_path12.default.relative(cwd, baselinePath))}`
       );
       log.info(`  ${result.totalIssues} issues recorded (${result.totalErrors} errors, ${result.totalWarnings} warnings)`);
       log.info(`  Preset: ${import_chalk10.default.cyan(preset)}`);
@@ -3800,7 +3994,7 @@ function registerBaselineCommand(program2) {
 
 // cli/commands/init-context.ts
 var import_fs10 = __toESM(require("fs"));
-var import_path12 = __toESM(require("path"));
+var import_path13 = __toESM(require("path"));
 var import_chalk11 = __toESM(require("chalk"));
 var import_prompts2 = require("@inquirer/prompts");
 var RULE_CATEGORIES = {
@@ -4164,13 +4358,13 @@ var AGENTS = [
   {
     id: "copilot",
     label: "GitHub Copilot",
-    filePath: import_path12.default.join(".github", "copilot-instructions.md"),
+    filePath: import_path13.default.join(".github", "copilot-instructions.md"),
     generate: generateCopilotFile
   }
 ];
 function getPackageVersion2(cwd) {
   try {
-    const pkgPath = import_path12.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
+    const pkgPath = import_path13.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
     if (import_fs10.default.existsSync(pkgPath)) {
       const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
@@ -4178,7 +4372,7 @@ function getPackageVersion2(cwd) {
   } catch {
   }
   try {
-    const pkgPath = import_path12.default.join(cwd, "package.json");
+    const pkgPath = import_path13.default.join(cwd, "package.json");
     if (import_fs10.default.existsSync(pkgPath)) {
       const pkg = JSON.parse(import_fs10.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
@@ -4247,7 +4441,7 @@ function registerInitContextCommand(program2) {
     log.blank();
     const results = [];
     for (const agent of selectedAgents) {
-      const fullPath = import_path12.default.join(cwd, agent.filePath);
+      const fullPath = import_path13.default.join(cwd, agent.filePath);
       const exists = import_fs10.default.existsSync(fullPath);
       if (exists && !isForce && !isDryRun) {
         const overwrite = await (0, import_prompts2.confirm)({
@@ -4272,7 +4466,7 @@ function registerInitContextCommand(program2) {
         results.push({ file: agent.filePath, status: "dry-run" });
         continue;
       }
-      const parentDir = import_path12.default.dirname(fullPath);
+      const parentDir = import_path13.default.dirname(fullPath);
       if (!import_fs10.default.existsSync(parentDir)) {
         import_fs10.default.mkdirSync(parentDir, { recursive: true });
       }
@@ -4311,7 +4505,7 @@ function registerInitContextCommand(program2) {
 
 // cli/commands/report.ts
 var import_fs11 = __toESM(require("fs"));
-var import_path13 = __toESM(require("path"));
+var import_path14 = __toESM(require("path"));
 var import_ora4 = __toESM(require("ora"));
 var RULE_META = {
   "ai-guard/no-empty-catch": { description: "Empty catch blocks silently swallow errors", category: "Reliability" },
@@ -4335,18 +4529,18 @@ var RULE_META = {
 };
 function getProjectName(cwd) {
   try {
-    const pkgPath = import_path13.default.join(cwd, "package.json");
+    const pkgPath = import_path14.default.join(cwd, "package.json");
     if (import_fs11.default.existsSync(pkgPath)) {
       const pkg = JSON.parse(import_fs11.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.name) return pkg.name;
     }
   } catch {
   }
-  return import_path13.default.basename(cwd);
+  return import_path14.default.basename(cwd);
 }
 function getPluginVersion(cwd) {
   try {
-    const pkgPath = import_path13.default.resolve(__dirname, "../../package.json");
+    const pkgPath = import_path14.default.resolve(__dirname, "../../package.json");
     if (import_fs11.default.existsSync(pkgPath)) {
       const pkg = JSON.parse(import_fs11.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
@@ -4354,7 +4548,7 @@ function getPluginVersion(cwd) {
   } catch {
   }
   try {
-    const pkgPath = import_path13.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
+    const pkgPath = import_path14.default.join(cwd, "node_modules", "eslint-plugin-ai-guard", "package.json");
     if (import_fs11.default.existsSync(pkgPath)) {
       const pkg = JSON.parse(import_fs11.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.version) return pkg.version;
@@ -4733,7 +4927,7 @@ function registerReportCommand(program2) {
     log.banner("AI GUARD REPORT");
     log.blank();
     const html = generateHtml(reportData);
-    const outputPath = import_path13.default.resolve(cwd, opts.output);
+    const outputPath = import_path14.default.resolve(cwd, opts.output);
     import_fs11.default.writeFileSync(outputPath, html, "utf-8");
     log.success(`Report saved: ${opts.output}`);
     log.info(
@@ -4767,7 +4961,7 @@ function registerReportCommand(program2) {
 // cli/index.ts
 function getVersion() {
   try {
-    const pkgPath = import_path14.default.resolve(__dirname, "../../package.json");
+    const pkgPath = import_path15.default.resolve(__dirname, "../../package.json");
     const raw = import_fs12.default.readFileSync(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     return typeof pkg.version === "string" ? pkg.version : "0.0.0";