guardian-framework 0.1.98 → 0.1.100

package/dist/cli.js

@@ -3197,7 +3197,7 @@ __export(exports_package, {
   bin: () => bin,
   author: () => author
 });
-var name = "guardian-framework", version = "0.1.98", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
+var name = "guardian-framework", version = "0.1.100", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
 var init_package = __esm(() => {
   exports = {
     ".": {

package/dist/exports.js

@@ -1982,7 +1982,7 @@ __export(exports_package, {
   bin: () => bin,
   author: () => author
 });
-var name = "guardian-framework", version = "0.1.98", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
+var name = "guardian-framework", version = "0.1.100", description = "Token-optimized agentic framework scaffolder with pi-first architecture", type = "module", main = "dist/exports.js", exports, types = "dist/exports.d.ts", bin, files, engines, scripts, publishConfig, pi, repository, homepage = "https://github.com/arman-jalili/guardian-framework#readme", bugs, dependencies, devDependencies, keywords, author = "Arman Wolkensteiner-Jalili", license = "MIT", package_default;
 var init_package = __esm(() => {
   exports = {
     ".": {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "guardian-framework",
-	"version": "0.1.98",
+	"version": "0.1.100",
 	"description": "Token-optimized agentic framework scaffolder with pi-first architecture",
 	"type": "module",
 	"main": "dist/exports.js",

package/templates/pi/extensions/coordinator.ts

@@ -10,6 +10,7 @@
  */
 
 type ExtensionContext = {
+	cwd: string;
 	ui: { notify(message: string, level?: string): void };
 	shell: {
 		execute(
@@ -179,10 +180,19 @@ export default function (pi: ExtensionAPI) {
 
 				const scriptPath = VALIDATORS[validator];
 				try {
-					const result = await ctx.shell.execute(`bash ${scriptPath}`, { signal });
-					results[validator] = { passed: result.exitCode === 0, output: result.stdout };
+					const { execFileSync } = require("node:child_process");
+					const cwd = ctx.cwd || process.cwd();
+					const result = execFileSync("bash", [scriptPath], {
+						cwd,
+						timeout: 120_000,
+						encoding: "utf-8",
+						stdio: ["ignore", "pipe", "pipe"],
+					});
+					results[validator] = { passed: true, output: (result || "").trim() };
 				} catch (error) {
-					results[validator] = { passed: false, output: `Error: ${error}` };
+					const err = error as { stdout?: string | Buffer; stderr?: string | Buffer };
+					const stdout = (err.stdout || "").toString().slice(0, 500);
+					results[validator] = { passed: false, output: stdout || String(error) };
 				}
 			}
 

package/templates/pi/extensions/pipeline.ts

@@ -647,7 +647,7 @@ class PipelineManager {
 				const scriptPath = VALIDATOR_SCRIPTS[validator];
 				if (!scriptPath) { errors.push(`Unknown validator: ${validator}`); continue; }
 				try {
-					execFileSync("bash", ["-c", scriptPath], { cwd: this.cwd, timeout: 120_000, encoding: "utf-8" });
+					execFileSync("bash", [scriptPath], { cwd: this.cwd, timeout: 120_000, encoding: "utf-8" });
 				} catch (e: unknown) {
 					const err = e as { stdout?: string };
 					errors.push(`${validator}: ${(err.stdout || "").slice(0, 200)}`);
@@ -1344,7 +1344,7 @@ export default function (pi: ExtensionAPI) {
 					continue;
 				}
 				try {
-					execFileSync("bash", ["-c", scriptPath], {
+					execFileSync("bash", [scriptPath], {
 						cwd: ctx.cwd,
 						timeout: 120_000,
 						encoding: "utf-8",

package/templates/pi/preflight_report.json

@@ -1,5 +1,5 @@
 {
-  "timestamp": "2026-07-18T19:39:29Z",
+  "timestamp": "2026-07-19T05:59:04Z",
   "mode": "all",
   "stages_run": [],
   "summary": {

package/templates/pi/scripts/languages/go/validate-architecture.sh

@@ -54,7 +54,7 @@ echo "--- Domain Models ---"
 DOMAIN_FILES=0
 for dir in "internal/domain" "pkg/domain"; do
     if [ -d "$dir" ]; then
-        COUNT=$(grep -rlE 'type\s+\w+\s+struct' "$dir" --include="*.go" 2>/dev/null | wc -l | tr -d ' ')
+        COUNT=$(grep -rlE 'type\s+\w+\s+struct' "$dir" --include="*.go" 2>/dev/null | wc -l | tr -d ' ') || true
         DOMAIN_FILES=$((DOMAIN_FILES + COUNT))
     fi
 done
@@ -73,7 +73,7 @@ VIOLATIONS=0
 for dir in "internal/domain" "pkg/domain"; do
     if [ -d "$dir" ]; then
         # Domain should not import from infrastructure or cmd
-        VIOLATIONS=$((VIOLATIONS + $(grep -rlE 'import.*"(.*/infrastructure|/cmd)"' "$dir" --include="*.go" 2>/dev/null | wc -l | tr -d ' ')))
+        VIOLATIONS=$((VIOLATIONS + $(grep -rlE 'import.*"(.*/infrastructure|/cmd)"' "$dir" --include="*.go" 2>/dev/null | wc -l | tr -d ' '))) || true
     fi
 done
 if [ "$VIOLATIONS" -eq 0 ]; then
@@ -88,8 +88,8 @@ fi
 echo ""
 echo "--- Error Handling ---"
 if [ -f "go.mod" ]; then
-    ERROR_VARIABS=$(grep -rE 'var\s+Err\w+\s*=\s*(errors\.New|fmt\.Errorf)' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ')
-    ERROR_STRUCTS=$(grep -rE 'type\s+\w*Error\w*\s+struct' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ')
+    ERROR_VARIABS=$(grep -rE 'var\s+Err\w+\s*=\s*(errors\.New|fmt\.Errorf)' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ') || true
+    ERROR_STRUCTS=$(grep -rE 'type\s+\w*Error\w*\s+struct' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ') || true
     TOTAL=$((ERROR_VARIABS + ERROR_STRUCTS))
     if [ "$TOTAL" -gt 0 ]; then
         pass "Custom error types defined ($TOTAL definitions)"
@@ -106,7 +106,7 @@ fi
 echo ""
 echo "--- Interfaces ---"
 if [ -f "go.mod" ]; then
-    INTERFACE_COUNT=$(grep -rE 'type\s+\w+\s+interface' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ')
+    INTERFACE_COUNT=$(grep -rE 'type\s+\w+\s+interface' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$INTERFACE_COUNT" -gt 0 ]; then
         pass "Interface definitions found ($INTERFACE_COUNT interfaces)"
     else

package/templates/pi/scripts/languages/go/validate-canonical.sh

@@ -22,7 +22,7 @@ echo "--- Architecture Reference Tracing ---"
 if [ -f "go.mod" ]; then
     GO_FILES=$(find . -name "*.go" -not -path "./vendor/*" 2>/dev/null | wc -l | tr -d ' ')
     if [ "$GO_FILES" -gt 0 ]; then
-        CANONICAL_REFS=$(grep -rlE '//\s*(Canonical:|@canonical|Reference:|Canonical\s+ref)' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ')
+        CANONICAL_REFS=$(grep -rlE '//\s*(Canonical:|@canonical|Reference:|Canonical\s+ref)' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ') || true
         if [ "$CANONICAL_REFS" -gt 0 ]; then
             PCT=$((CANONICAL_REFS * 100 / GO_FILES))
             pass "Canonical references found in ${CANONICAL_REFS}/${GO_FILES} Go files (${PCT}%)"
@@ -74,7 +74,7 @@ fi
 echo ""
 echo "--- Package Documentation ---"
 if [ -f "go.mod" ]; then
-    PKG_FILES_WITH_DOC=$(grep -rlE '//\s*Package\s+\w+\s+(implements|provides|defines|is|contains)' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ')
+    PKG_FILES_WITH_DOC=$(grep -rlE '//\s*Package\s+\w+\s+(implements|provides|defines|is|contains)' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ') || true
     GO_PACKAGES=$(go list ./... 2>/dev/null | wc -l | tr -d ' ')
     if [ "$GO_PACKAGES" -gt 0 ] && [ "$PKG_FILES_WITH_DOC" -gt 0 ]; then
         pass "Package documentation found in $PKG_FILES_WITH_DOC files"
@@ -93,7 +93,7 @@ echo "--- ADR Linkage ---"
 if [ -d ".pi/architecture/decisions" ]; then
     ADR_COUNT=$(find .pi/architecture/decisions -name "*.md" 2>/dev/null | wc -l | tr -d ' ')
     if [ "$ADR_COUNT" -gt 0 ]; then
-        ADR_REFS=$(grep -rlE '//\s*ADR[-_]?\d+' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ')
+        ADR_REFS=$(grep -rlE '//\s*ADR[-_]?\d+' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ') || true
         if [ "$ADR_REFS" -gt 0 ]; then
             pass "ADR references found in $ADR_REFS Go files"
         else

package/templates/pi/scripts/languages/go/validate-integration.sh

@@ -123,7 +123,7 @@ fi
 echo ""
 echo "--- HTTP Integration ---"
 if [ -f "go.mod" ]; then
-    HTTPTEST_COUNT=$(grep -rl '"net/http/httptest"' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ')
+    HTTPTEST_COUNT=$(grep -rl '"net/http/httptest"' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$HTTPTEST_COUNT" -gt 0 ]; then
         pass "HTTP integration tests found (httptest in $HTTPTEST_COUNT files)"
     else

package/templates/pi/scripts/languages/go/validate-operations.sh

@@ -40,7 +40,7 @@ fi
 echo ""
 echo "--- Health Checks ---"
 if [ -f "go.mod" ]; then
-    HEALTH_ENDPOINTS=$(grep -rE '("/health|/healthz|/ready|/readiness)' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ')
+    HEALTH_ENDPOINTS=$(grep -rE '("/health|/healthz|/ready|/readiness)' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$HEALTH_ENDPOINTS" -gt 0 ]; then
         pass "Health/readiness endpoint handlers found ($HEALTH_ENDPOINTS references)"
     else
@@ -94,7 +94,7 @@ fi
 echo ""
 echo "--- Error Wrapping ---"
 if [ -f "go.mod" ]; then
-    WRAP_COUNT=$(grep -rE 'fmt\.Errorf\(.*%w' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ')
+    WRAP_COUNT=$(grep -rE 'fmt\.Errorf\(.*%w' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$WRAP_COUNT" -gt 0 ]; then
         pass "Error wrapping with %w found ($WRAP_COUNT usages)"
     else

package/templates/pi/scripts/languages/go/validate-security.sh

@@ -100,7 +100,7 @@ echo ""
 echo "--- Input Validation ---"
 if [ -f "go.mod" ]; then
     TEXT_TEMPLATE=$(grep -rl '"text/template"' . --include="*.go" 2>/dev/null | grep -v "_test.go" | wc -l | tr -d ' ')
-    HTML_TEMPLATE=$(grep -rl '"html/template"' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ')
+    HTML_TEMPLATE=$(grep -rl '"html/template"' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$TEXT_TEMPLATE" -eq 0 ]; then
         pass "No text/template usage in production code (html/template auto-escapes)"
     elif [ "$HTML_TEMPLATE" -gt 0 ]; then

package/templates/pi/scripts/languages/java/validate-integration.sh

@@ -24,12 +24,12 @@ TEST_DIR="${2:-src/test/java}"
 echo "--- Test Slice Correctness ---"
 if [ -d "$TEST_DIR" ]; then
     # Check for @SpringBootTest usage (no slice annotations)
-    FULL_CONTEXT_TESTS=$(grep -r "@SpringBootTest" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ')
+    FULL_CONTEXT_TESTS=$(grep -r "@SpringBootTest" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ') || true
     # Check for slice test annotations
-    WEB_MVC_TESTS=$(grep -r "@WebMvcTest" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ')
-    DATA_JPA_TESTS=$(grep -r "@DataJpaTest" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ')
-    JSON_TESTS=$(grep -r "@JsonTest" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ')
-    REST_CLIENT_TESTS=$(grep -r "@RestClientTest" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ')
+    WEB_MVC_TESTS=$(grep -r "@WebMvcTest" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ') || true
+    DATA_JPA_TESTS=$(grep -r "@DataJpaTest" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ') || true
+    JSON_TESTS=$(grep -r "@JsonTest" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ') || true
+    REST_CLIENT_TESTS=$(grep -r "@RestClientTest" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ') || true
 
     TOTAL_SLICE_TESTS=$((WEB_MVC_TESTS + DATA_JPA_TESTS + JSON_TESTS + REST_CLIENT_TESTS))
 
@@ -52,7 +52,7 @@ fi
 echo ""
 echo "--- Context Caching ---"
 if [ -d "$TEST_DIR" ]; then
-    DIRTY_CONTEXT=$(grep -r "@DirtiesContext" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ')
+    DIRTY_CONTEXT=$(grep -r "@DirtiesContext" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$DIRTY_CONTEXT" -gt 0 ]; then
         warn "$DIRTY_CONTEXT @DirtiesContext annotations found — these disable context caching and slow tests"
     else
@@ -74,7 +74,7 @@ if [ -d "$TEST_DIR" ]; then
         TRANSACTIONAL_TESTS=$(echo "$DATA_JPA_CLASSES" | wc -l | tr -d ' ')
     fi
 
-    ROLLBACK_COUNT=$(grep -r "@Rollback" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ')
+    ROLLBACK_COUNT=$(grep -r "@Rollback" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ') || true
 
     if [ "$TRANSACTIONAL_TESTS" -gt 0 ] || [ "$ROLLBACK_COUNT" -gt 0 ]; then
         pass "Database state management found (@DataJpaTest: $TRANSACTIONAL_TESTS, @Rollback: $ROLLBACK_COUNT)"
@@ -103,7 +103,7 @@ fi
 echo ""
 echo "--- Mockito Usage ---"
 if [ -d "$TEST_DIR" ]; then
-    MOCKITO_ANNOTATIONS=$(grep -r "@Mock\|@InjectMocks\|@MockBean\|@SpyBean" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ')
+    MOCKITO_ANNOTATIONS=$(grep -r "@Mock\|@InjectMocks\|@MockBean\|@SpyBean" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$MOCKITO_ANNOTATIONS" -gt 0 ]; then
         pass "Mockito usage detected ($MOCKITO_ANNOTATIONS annotations)"
     else
@@ -117,8 +117,8 @@ fi
 echo ""
 echo "--- Assertions ---"
 if [ -d "$TEST_DIR" ]; then
-    ASSERTJ=$(grep -r "assertThat\|Assertions.assertThat" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ')
-    JUNIT_ASSERT=$(grep -r "assertEquals\|assertTrue\|assertNotNull\|assertThrows" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ')
+    ASSERTJ=$(grep -r "assertThat\|Assertions.assertThat" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ') || true
+    JUNIT_ASSERT=$(grep -r "assertEquals\|assertTrue\|assertNotNull\|assertThrows" "$TEST_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$ASSERTJ" -gt 0 ] || [ "$JUNIT_ASSERT" -gt 0 ]; then
         pass "Assertions found (AssertJ: $ASSERTJ, JUnit: $JUNIT_ASSERT)"
     else

package/templates/pi/scripts/languages/java/validate-operations.sh

@@ -44,10 +44,10 @@ fi
 echo ""
 echo "--- @Scheduled Tasks ---"
 if [ -d "$SRC_DIR" ]; then
-    SCHEDULED_COUNT=$(grep -r "@Scheduled" "$SRC_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ')
+    SCHEDULED_COUNT=$(grep -r "@Scheduled" "$SRC_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$SCHEDULED_COUNT" -gt 0 ]; then
         # Check if @EnableScheduling is present
-        ENABLED_SCHEDULING=$(grep -r "@EnableScheduling" "$SRC_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ')
+        ENABLED_SCHEDULING=$(grep -r "@EnableScheduling" "$SRC_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ') || true
         if [ "$ENABLED_SCHEDULING" -gt 0 ]; then
             pass "$SCHEDULED_COUNT @Scheduled tasks found with @EnableScheduling"
         else
@@ -64,9 +64,9 @@ fi
 echo ""
 echo "--- @Async Tasks ---"
 if [ -d "$SRC_DIR" ]; then
-    ASYNC_COUNT=$(grep -r "@Async" "$SRC_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ')
+    ASYNC_COUNT=$(grep -r "@Async" "$SRC_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$ASYNC_COUNT" -gt 0 ]; then
-        ENABLED_ASYNC=$(grep -r "@EnableAsync" "$SRC_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ')
+        ENABLED_ASYNC=$(grep -r "@EnableAsync" "$SRC_DIR" --include="*.java" 2>/dev/null | wc -l | tr -d ' ') || true
         if [ "$ENABLED_ASYNC" -gt 0 ]; then
             pass "$ASYNC_COUNT @Async methods found with @EnableAsync"
         else

package/templates/pi/scripts/languages/python/validate-architecture.sh

@@ -60,7 +60,7 @@ fi
 # Dependency direction
 echo ""
 echo "--- Dependency Direction ---"
-DOMAIN_INFRA_IMPORTS=$(find "$SRC_DIR" -path "*/domain/*.py" -exec grep -l "from.*infrastructure" {} + 2>/dev/null | wc -l | tr -d ' ')
+DOMAIN_INFRA_IMPORTS=$(find "$SRC_DIR" -path "*/domain/*.py" -exec grep -l "from.*infrastructure" {} + 2>/dev/null | wc -l | tr -d ' ') || true
 if [ "$DOMAIN_INFRA_IMPORTS" -eq 0 ]; then
     pass "Domain layer has no infrastructure dependencies (clean architecture)"
 else
@@ -70,7 +70,7 @@ fi
 # Error handling
 echo ""
 echo "--- Error Handling ---"
-ERROR_COUNT=$(grep -r "class.*Error" "$SRC_DIR" 2>/dev/null | wc -l | tr -d ' ')
+ERROR_COUNT=$(grep -r "class.*Error" "$SRC_DIR" 2>/dev/null | wc -l | tr -d ' ') || true
 if [ "$ERROR_COUNT" -gt 0 ]; then
     pass "Custom exception classes defined ($ERROR_COUNT found)"
 else
@@ -80,7 +80,7 @@ fi
 # Typed models
 echo ""
 echo "--- Typed Models ---"
-MODEL_COUNT=$(grep -r "@dataclass" "$SRC_DIR" 2>/dev/null | wc -l | tr -d ' ')
+MODEL_COUNT=$(grep -r "@dataclass" "$SRC_DIR" 2>/dev/null | wc -l | tr -d ' ') || true
 if [ "$MODEL_COUNT" -gt 0 ]; then
     pass "Typed dataclass models found ($MODEL_COUNT definitions)"
 else

package/templates/pi/scripts/languages/python/validate-canonical.sh

@@ -28,7 +28,7 @@ SRC_DIR="${1:-src}"
 echo "--- Architecture Reference Tracing ---"
 TOTAL_PY_FILES=$(find "$SRC_DIR" -name "*.py" 2>/dev/null | wc -l | tr -d ' ')
 if [ "$TOTAL_PY_FILES" -gt 0 ]; then
-    FILES_WITH_REFS=$(grep -rlE "(Canonical:|@canonical|Reference:.*\.pi/architecture)" "$SRC_DIR" --include="*.py" 2>/dev/null | wc -l | tr -d ' ')
+    FILES_WITH_REFS=$(grep -rlE "(Canonical:|@canonical|Reference:.*\.pi/architecture)" "$SRC_DIR" --include="*.py" 2>/dev/null | wc -l | tr -d ' ') || true
     PCT=$((FILES_WITH_REFS * 100 / TOTAL_PY_FILES))
     if [ "$FILES_WITH_REFS" -gt 0 ]; then
         pass "Canonical references detected in $FILES_WITH_REFS/$TOTAL_PY_FILES files (${PCT}%)"
@@ -93,7 +93,7 @@ echo ""
 echo "--- ADR Linkage ---"
 if [ -d ".pi/architecture/decisions" ]; then
     ADR_COUNT=$(find .pi/architecture/decisions -name "ADR-*.md" 2>/dev/null | wc -l | tr -d ' ')
-    ADR_REFS=$(grep -rlE "ADR-[0-9]+" "$SRC_DIR" --include="*.py" 2>/dev/null | wc -l | tr -d ' ')
+    ADR_REFS=$(grep -rlE "ADR-[0-9]+" "$SRC_DIR" --include="*.py" 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$ADR_REFS" -gt 0 ]; then
         pass "ADR references found in $ADR_REFS source files ($ADR_COUNT ADRs exist)"
     else

package/templates/pi/scripts/languages/python/validate-integration.sh

@@ -75,7 +75,7 @@ fi
 # ── Database Integration Tests ──
 echo ""
 echo "--- Database Integration Tests ---"
-DB_TEST_COUNT=$(grep -rlE "(pytest.*db|session_scope|test_db|database_url|SQLALCHEMY)" tests/ --include="*.py" 2>/dev/null | wc -l | tr -d ' ')
+DB_TEST_COUNT=$(grep -rlE "(pytest.*db|session_scope|test_db|database_url|SQLALCHEMY)" tests/ --include="*.py" 2>/dev/null | wc -l | tr -d ' ') || true
 if [ "$DB_TEST_COUNT" -gt 0 ]; then
     pass "Database integration tests found ($DB_TEST_COUNT files)"
 else

package/templates/pi/scripts/languages/python/validate-security.sh

@@ -33,7 +33,7 @@ fi
 # SQL injection
 echo ""
 echo "--- Injection Patterns ---"
-INJECT_COUNT=$(grep -rE "(execute|cursor\.execute)\s*\(\s*['\"]" "$SRC_DIR" --include="*.py" 2>/dev/null | wc -l | tr -d ' ')
+INJECT_COUNT=$(grep -rE "(execute|cursor\.execute)\s*\(\s*['\"]" "$SRC_DIR" --include="*.py" 2>/dev/null | wc -l | tr -d ' ') || true
 if [ "$INJECT_COUNT" -eq 0 ]; then
     pass "No obvious injection patterns"
 else

package/templates/pi/scripts/languages/rust/validate-architecture.sh

@@ -82,7 +82,7 @@ echo "--- Domain Models ---"
 DOMAIN_MODELS=0
 for dir in src/domain src/models; do
     if [ -d "$dir" ]; then
-        MODELS=$(grep -rlE '^\s*(pub\s+)?struct\s' "$dir" 2>/dev/null | wc -l | tr -d ' ')
+        MODELS=$(grep -rlE '^\s*(pub\s+)?struct\s' "$dir" 2>/dev/null | wc -l | tr -d ' ') || true
         DOMAIN_MODELS=$((DOMAIN_MODELS + MODELS))
     fi
 done
@@ -90,7 +90,7 @@ if [ "$DOMAIN_MODELS" -gt 0 ]; then
     pass "Domain models found ($DOMAIN_MODELS files with struct definitions)"
 else
     # Check all of src as fallback
-    ALL_MODELS=$(grep -rlE '^\s*(pub\s+)?struct\s' src/ 2>/dev/null | wc -l | tr -d ' ')
+    ALL_MODELS=$(grep -rlE '^\s*(pub\s+)?struct\s' src/ 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$ALL_MODELS" -gt 0 ]; then
         pass "Struct definitions found in src/ ($ALL_MODELS files)"
     else
@@ -104,7 +104,7 @@ fi
 echo ""
 echo "--- Dependency Direction ---"
 if [ -d "src/domain" ]; then
-    DOMAIN_DEPS=$(grep -rE 'use\s+crate::infrastructure' src/domain/ 2>/dev/null | wc -l | tr -d ' ')
+    DOMAIN_DEPS=$(grep -rE 'use\s+crate::infrastructure' src/domain/ 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$DOMAIN_DEPS" -eq 0 ]; then
         pass "Domain layer does not depend on infrastructure"
     else
@@ -127,7 +127,7 @@ if command -v cargo &>/dev/null; then
     fi
 fi
 # Also check for custom error enum definitions
-CUSTOM_ERRORS=$(grep -rE 'enum\s+\w*Error' src/ 2>/dev/null | wc -l | tr -d ' ')
+CUSTOM_ERRORS=$(grep -rE 'enum\s+\w*Error' src/ 2>/dev/null | wc -l | tr -d ' ') || true
 if [ "$HAS_ERROR_TYPES" -eq 1 ] || [ "$CUSTOM_ERRORS" -gt 0 ]; then
     pass "Custom error handling detected"
 else
@@ -139,7 +139,7 @@ fi
 # ---------------------------------------------------------------------------
 echo ""
 echo "--- Trait Definitions ---"
-TRAITS=$(grep -rE '^\s*(pub\s+)?trait\s+' src/ 2>/dev/null | wc -l | tr -d ' ')
+TRAITS=$(grep -rE '^\s*(pub\s+)?trait\s+' src/ 2>/dev/null | wc -l | tr -d ' ') || true
 if [ "$TRAITS" -gt 0 ]; then
     pass "Trait definitions found ($TRAITS interfaces)"
 else

package/templates/pi/scripts/languages/rust/validate-canonical.sh

@@ -46,7 +46,7 @@ TOTAL_RS=0
 TOTAL_RS=$(find src -name "*.rs" 2>/dev/null | wc -l | tr -d ' ')
 if [ "$TOTAL_RS" -gt 0 ]; then
     # Look for canonical reference patterns in doc comments
-    CANONICAL_REFS=$(grep -rE '(///\s*Canonical:|//!\s*@canonical|///\s*Reference:)' src/ 2>/dev/null | wc -l | tr -d ' ')
+    CANONICAL_REFS=$(grep -rE '(///\s*Canonical:|//!\s*@canonical|///\s*Reference:)' src/ 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$CANONICAL_REFS" -gt 0 ]; then
         PCT=$((CANONICAL_REFS * 100 / TOTAL_RS))
         pass "Canonical references found: ${CANONICAL_REFS} files (${PCT}% of ${TOTAL_RS} Rust files)"
@@ -91,7 +91,7 @@ fi
 echo ""
 echo "--- Module Documentation ---"
 if [ "$TOTAL_RS" -gt 0 ]; then
-    MOD_DOCS=$(grep -rlE '^//!\s' src/ 2>/dev/null | wc -l | tr -d ' ')
+    MOD_DOCS=$(grep -rlE '^//!\s' src/ 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$MOD_DOCS" -gt 0 ]; then
         PCT=$((MOD_DOCS * 100 / TOTAL_RS))
         pass "Module documentation found in ${MOD_DOCS}/${TOTAL_RS} files (${PCT}%)"
@@ -110,7 +110,7 @@ echo "--- ADR Linkage ---"
 if [ -d ".pi/architecture/decisions" ]; then
     ADR_FILES=$(find .pi/architecture/decisions -name "*.md" 2>/dev/null | wc -l | tr -d ' ')
     if [ "$ADR_FILES" -gt 0 ]; then
-        ADR_REFS=$(grep -rE '///\s*ADR-' src/ 2>/dev/null | wc -l | tr -d ' ')
+        ADR_REFS=$(grep -rE '///\s*ADR-' src/ 2>/dev/null | wc -l | tr -d ' ') || true
         if [ "$ADR_REFS" -gt 0 ]; then
             pass "ADR references found in code ($ADR_REFS references)"
         else

package/templates/pi/scripts/languages/rust/validate-security.sh

@@ -59,7 +59,7 @@ echo "--- SQL Injection ---"
 SQL_INJECT=0
 if grep -qE 'sqlx' Cargo.toml 2>/dev/null; then
     # Check for unsafe query patterns: format! inside query! or query()
-    SQL_INJECT=$(grep -rE 'query\s*\(\s*(format!|format_args!)' src/ --include="*.rs" 2>/dev/null | wc -l | tr -d ' ')
+    SQL_INJECT=$(grep -rE 'query\s*\(\s*(format!|format_args!)' src/ --include="*.rs" 2>/dev/null | wc -l | tr -d ' ') || true
 fi
 if [ "$SQL_INJECT" -gt 0 ]; then
     fail "Potential SQL injection patterns found ($SQL_INJECT occurrences — avoid format! inside query)"
@@ -94,7 +94,7 @@ fi
 # ---------------------------------------------------------------------------
 echo ""
 echo "--- Unsafe Code ---"
-UNSAFE_BLOCKS=$(grep -rE 'unsafe\s*\{' --include="*.rs" src/ 2>/dev/null | wc -l | tr -d ' ')
+UNSAFE_BLOCKS=$(grep -rE 'unsafe\s*\{' --include="*.rs" src/ 2>/dev/null | wc -l | tr -d ' ') || true
 if [ "$UNSAFE_BLOCKS" -gt 0 ]; then
     warn "Unsafe code blocks found ($UNSAFE_BLOCKS occurrences — recommend manual audit)"
 else

package/templates/pi/scripts/languages/rust/validate-tests.sh

@@ -88,7 +88,7 @@ echo "--- Doctests ---"
 if cargo test --doc --quiet 2>/dev/null; then
     pass "Doctests passed"
 else
-    DOCS=$(grep -rl '//!\|///' src/ 2>/dev/null | wc -l | tr -d ' ')
+    DOCS=$(grep -rl '//!\|///' src/ 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$DOCS" -eq 0 ]; then
         pass "No doc comments found (no doctests to run)"
     else

package/templates/pi/scripts/languages/typescript/validate-architecture.sh

@@ -56,7 +56,7 @@ fi
 echo ""
 echo "--- Domain Models ---"
 if [ -d "$SRC_DIR/domain" ]; then
-    DOMAIN_MODELS=$(find "$SRC_DIR/domain" -name "*.ts" -o -name "*.tsx" 2>/dev/null | xargs grep -lE '\b(interface|type|class)\b' 2>/dev/null | wc -l | tr -d ' ')
+    DOMAIN_MODELS=$(find "$SRC_DIR/domain" -name "*.ts" -o -name "*.tsx" 2>/dev/null | xargs grep -lE '\b(interface|type|class)\b' 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$DOMAIN_MODELS" -gt 0 ]; then
         pass "Domain model definitions found ($DOMAIN_MODELS files with interface/type/class)"
     else
@@ -93,7 +93,7 @@ fi
 echo ""
 echo "--- Error Handling ---"
 if [ -d "$SRC_DIR" ]; then
-    ERROR_CLASSES=$(grep -rE "class\s+\w+Error.*extends\s+(Error|AppError)" "$SRC_DIR" 2>/dev/null | wc -l | tr -d ' ')
+    ERROR_CLASSES=$(grep -rE "class\s+\w+Error.*extends\s+(Error|AppError)" "$SRC_DIR" 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$ERROR_CLASSES" -gt 0 ]; then
         pass "Custom error classes defined ($ERROR_CLASSES found)"
     else
@@ -109,7 +109,7 @@ fi
 echo ""
 echo "--- Interfaces / Contracts ---"
 if [ -d "$SRC_DIR" ]; then
-    INTERFACE_COUNT=$(grep -rE "^\s*(export\s+)?interface\s+" "$SRC_DIR" --include="*.ts" --include="*.tsx" 2>/dev/null | wc -l | tr -d ' ')
+    INTERFACE_COUNT=$(grep -rE "^\s*(export\s+)?interface\s+" "$SRC_DIR" --include="*.ts" --include="*.tsx" 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$INTERFACE_COUNT" -gt 0 ]; then
         pass "Interface contracts defined ($INTERFACE_COUNT found)"
     else

package/templates/pi/scripts/languages/typescript/validate-canonical.sh

@@ -25,7 +25,7 @@ CANONICAL_REFS=0
 TOTAL_TS_FILES=0
 if [ -d "$SRC_DIR" ]; then
     TOTAL_TS_FILES=$(find "$SRC_DIR" -name "*.ts" -o -name "*.tsx" 2>/dev/null | wc -l | tr -d ' ')
-    CANONICAL_REFS=$(find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) -exec grep -lE '(// Canonical:|@canonical).*\.pi/architecture/' {} + 2>/dev/null | wc -l | tr -d ' ')
+    CANONICAL_REFS=$(find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) -exec grep -lE '(// Canonical:|@canonical).*\.pi/architecture/' {} + 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$TOTAL_TS_FILES" -gt 0 ] && [ "$CANONICAL_REFS" -gt 0 ]; then
         PCT=$((CANONICAL_REFS * 100 / TOTAL_TS_FILES))
         pass "Canonical references found: $CANONICAL_REFS / $TOTAL_TS_FILES files ($PCT%)"
@@ -77,7 +77,7 @@ if [ -d "$SRC_DIR" ]; then
     EXPORT_WITH_DOCS=0
     EXPORTS_TOTAL=0
     # Check for documented exports: JSDoc comment (/** ... */) immediately before export
-    EXPORTS_TOTAL=$(grep -rE "^\s*(export\s+(const|function|class|interface|type|default))" "$SRC_DIR" --include="*.ts" --include="*.tsx" 2>/dev/null | wc -l | tr -d ' ')
+    EXPORTS_TOTAL=$(grep -rE "^\s*(export\s+(const|function|class|interface|type|default))" "$SRC_DIR" --include="*.ts" --include="*.tsx" 2>/dev/null | wc -l | tr -d ' ') || true
     EXPORT_WITH_DOCS=$(grep -B1 -rE "^\s*(export\s+(const|function|class|interface|type|default))" "$SRC_DIR" --include="*.ts" --include="*.tsx" 2>/dev/null | grep -c '\*/' 2>/dev/null || echo "0")
     if [ "$EXPORTS_TOTAL" -gt 0 ]; then
         if [ "$EXPORT_WITH_DOCS" -gt 0 ]; then
@@ -100,7 +100,7 @@ echo ""
 echo "--- ADR Linkage ---"
 if [ -d ".pi/architecture/decisions" ]; then
     ADR_FILES=$(find .pi/architecture/decisions -name "*.md" 2>/dev/null | wc -l | tr -d ' ')
-    ADR_REFS=$(find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) -exec grep -rlE '(@adr|ADR-)' {} + 2>/dev/null | wc -l | tr -d ' ')
+    ADR_REFS=$(find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) -exec grep -rlE '(@adr|ADR-)' {} + 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$ADR_FILES" -gt 0 ] && [ "$ADR_REFS" -gt 0 ]; then
         pass "ADR references found: $ADR_REFS files link to $ADR_FILES decisions"
     elif [ "$ADR_FILES" -gt 0 ]; then

package/templates/pi/scripts/languages/typescript/validate-integration.sh

@@ -99,7 +99,7 @@ echo "--- Mock/Stub Detection ---"
 MOCK_USAGE=0
 for ext in ts tsx; do
     COUNT=$(find . -name "*.$ext" -not -path "./node_modules/*" -not -path "./dist/*" \
-        -exec grep -lE "(vitest\.mock|jest\.mock|from\s+['\"]msw['\"]|from\s+['\"]@testing-library)" {} + 2>/dev/null | wc -l | tr -d ' ')
+        -exec grep -lE "(vitest\.mock|jest\.mock|from\s+['\"]msw['\"]|from\s+['\"]@testing-library)" {} + 2>/dev/null | wc -l | tr -d ' ') || true
     MOCK_USAGE=$((MOCK_USAGE + COUNT))
 done
 if [ "$MOCK_USAGE" -gt 0 ]; then
@@ -134,7 +134,7 @@ echo "--- HTTP Integration ---"
 HTTP_LIBS=0
 for ext in ts tsx; do
     COUNT=$(find . -name "*.$ext" -not -path "./node_modules/*" -not -path "./dist/*" \
-        -exec grep -lE "(supertest|msw|@testing-library)" {} + 2>/dev/null | wc -l | tr -d ' ')
+        -exec grep -lE "(supertest|msw|@testing-library)" {} + 2>/dev/null | wc -l | tr -d ' ') || true
     HTTP_LIBS=$((HTTP_LIBS + COUNT))
 done
 if [ "$HTTP_LIBS" -gt 0 ]; then

package/templates/pi/scripts/languages/typescript/validate-operations.sh

@@ -32,7 +32,7 @@ if [ -d "$SRC_DIR" ] || [ -d "." ]; then
     for dir in $SEARCH_DIRS; do
         [ -d "$dir" ] || continue
         FOUND=$(find "$dir" -type f \( -name "*.ts" -o -name "*.tsx" \) -not -path "*/node_modules/*" \
-            -exec grep -lE "(winston|pino|bunyan|console\.(log|info|warn|error))" {} + 2>/dev/null | wc -l | tr -d ' ')
+            -exec grep -lE "(winston|pino|bunyan|console\.(log|info|warn|error))" {} + 2>/dev/null | wc -l | tr -d ' ') || true
         LOGGING_LIBS=$((LOGGING_LIBS + FOUND))
     done
     if [ "$LOGGING_LIBS" -gt 0 ]; then
@@ -52,7 +52,7 @@ echo "--- Health Checks ---"
 HEALTH_ROUTES=0
 if [ -d "$SRC_DIR" ]; then
     HEALTH_ROUTES=$(find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) -not -path "*/node_modules/*" \
-        -exec grep -lE "(/health[^/]?|/healthz|/ready|/readiness)" {} + 2>/dev/null | wc -l | tr -d ' ')
+        -exec grep -lE "(/health[^/]?|/healthz|/ready|/readiness)" {} + 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$HEALTH_ROUTES" -gt 0 ]; then
         pass "Health check endpoints found ($HEALTH_ROUTES files)"
     else
@@ -70,7 +70,7 @@ echo "--- Graceful Shutdown ---"
 SHUTDOWN_HANDLERS=0
 if [ -d "$SRC_DIR" ]; then
     SHUTDOWN_HANDLERS=$(find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) -not -path "*/node_modules/*" \
-        -exec grep -lE "process\.on\(['\"]SIG(TERM|INT)['\"]" {} + 2>/dev/null | wc -l | tr -d ' ')
+        -exec grep -lE "process\.on\(['\"]SIG(TERM|INT)['\"]" {} + 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$SHUTDOWN_HANDLERS" -gt 0 ]; then
         pass "Graceful shutdown handlers found ($SHUTDOWN_HANDLERS files)"
     else
@@ -88,7 +88,7 @@ echo "--- Metrics ---"
 METRICS_LIBS=0
 if [ -d "$SRC_DIR" ]; then
     METRICS_LIBS=$(find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) -not -path "*/node_modules/*" \
-        -exec grep -lE "(prom-client|@opentelemetry|statsd|hot-shots|dd-trace)" {} + 2>/dev/null | wc -l | tr -d ' ')
+        -exec grep -lE "(prom-client|@opentelemetry|statsd|hot-shots|dd-trace)" {} + 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$METRICS_LIBS" -gt 0 ]; then
         pass "Metrics/observability libraries detected ($METRICS_LIBS files)"
     else
@@ -107,10 +107,10 @@ ERROR_PATTERNS=0
 if [ -d "$SRC_DIR" ]; then
     # Check for try/catch blocks
     TRY_CATCH=$(find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) -not -path "*/node_modules/*" \
-        -exec grep -lE "try\s*\{" {} + 2>/dev/null | wc -l | tr -d ' ')
+        -exec grep -lE "try\s*\{" {} + 2>/dev/null | wc -l | tr -d ' ') || true
     # Check for error middleware (Express-style)
     ERROR_MIDDLEWARE=$(find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) -not -path "*/node_modules/*" \
-        -exec grep -lE "error.*:.*Error.*req.*res" {} + 2>/dev/null | wc -l | tr -d ' ')
+        -exec grep -lE "error.*:.*Error.*req.*res" {} + 2>/dev/null | wc -l | tr -d ' ') || true
     ERROR_PATTERNS=$((TRY_CATCH + ERROR_MIDDLEWARE))
     if [ "$ERROR_PATTERNS" -gt 0 ]; then
         pass "Error handling patterns found ($ERROR_PATTERNS files with try/catch or error middleware)"
@@ -129,7 +129,7 @@ echo "--- Configuration ---"
 CONFIG_FOUND=0
 if [ -d "$SRC_DIR" ]; then
     CONFIG_FOUND=$(find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) -not -path "*/node_modules/*" \
-        -exec grep -lE "(dotenv|require\(['\"]config['\"]\)|process\.env)" {} + 2>/dev/null | wc -l | tr -d ' ')
+        -exec grep -lE "(dotenv|require\(['\"]config['\"]\)|process\.env)" {} + 2>/dev/null | wc -l | tr -d ' ') || true
     if [ "$CONFIG_FOUND" -gt 0 ]; then
         pass "Configuration management detected ($CONFIG_FOUND files with dotenv/config/process.env)"
     else

package/templates/pi/scripts/languages/typescript/validate-security.sh

@@ -32,7 +32,7 @@ echo "--- Hardcoded Secrets ---"
 SECRET_COUNT=0
 for ext in ts tsx; do
     COUNT=$(find . -name "*.$ext" -not -path "./node_modules/*" -not -path "./.next/*" -not -path "./dist/*" \
-        -exec grep -E "(apiKey|api_key|apiKey|secret|password|token|privateKey)\s*[:=]\s*['\"][^'\"]{8,}['\"]" {} + 2>/dev/null | wc -l | tr -d ' ')
+        -exec grep -E "(apiKey|api_key|apiKey|secret|password|token|privateKey)\s*[:=]\s*['\"][^'\"]{8,}['\"]" {} + 2>/dev/null | wc -l | tr -d ' ') || true
     SECRET_COUNT=$((SECRET_COUNT + COUNT))
 done
 if [ "$SECRET_COUNT" -eq 0 ]; then
@@ -50,7 +50,7 @@ INJECTION_PATTERNS=0
 for ext in ts tsx; do
     # Template literals used with query/exec calls
     COUNT=$(find . -name "*.$ext" -not -path "./node_modules/*" -not -path "./.next/*" -not -path "./dist/*" \
-        -exec grep -E "\.(query|exec)\(\s*\`" {} + 2>/dev/null | wc -l | tr -d ' ')
+        -exec grep -E "\.(query|exec)\(\s*\`" {} + 2>/dev/null | wc -l | tr -d ' ') || true
     INJECTION_PATTERNS=$((INJECTION_PATTERNS + COUNT))
 done
 if [ "$INJECTION_PATTERNS" -eq 0 ]; then
@@ -97,7 +97,7 @@ echo "--- eval / Dangerous Patterns ---"
 DANGEROUS_COUNT=0
 for ext in ts tsx; do
     COUNT=$(find . -name "*.$ext" -not -path "./node_modules/*" -not -path "./.next/*" -not -path "./dist/*" \
-        -exec grep -E "(eval\(|innerHTML\s*=|dangerouslySetInnerHTML)" {} + 2>/dev/null | wc -l | tr -d ' ')
+        -exec grep -E "(eval\(|innerHTML\s*=|dangerouslySetInnerHTML)" {} + 2>/dev/null | wc -l | tr -d ' ') || true
     DANGEROUS_COUNT=$((DANGEROUS_COUNT + COUNT))
 done
 if [ "$DANGEROUS_COUNT" -eq 0 ]; then
@@ -114,7 +114,7 @@ echo "--- XSS Prevention ---"
 SANITIZE_LIBS=0
 for ext in ts tsx; do
     COUNT=$(find . -name "*.$ext" -not -path "./node_modules/*" -not -path "./.next/*" -not -path "./dist/*" \
-        -exec grep -lE "(DOMPurify|sanitize-html|xss|sanitize)" {} + 2>/dev/null | wc -l | tr -d ' ')
+        -exec grep -lE "(DOMPurify|sanitize-html|xss|sanitize)" {} + 2>/dev/null | wc -l | tr -d ' ') || true
     SANITIZE_LIBS=$((SANITIZE_LIBS + COUNT))
 done
 if [ "$SANITIZE_LIBS" -gt 0 ]; then