minovative-mind-cli 2.14.2 → 2.14.3

package/dist/utils/antiCheatingGuard.js

@@ -0,0 +1,554 @@
+import path from 'node:path';
+/**
+ * List of critical root configuration files, lockfiles, and manifests that the agent
+ * is strictly forbidden from deleting or renaming as an error-bypassing evasion strategy.
+ */
+const CRITICAL_CONFIG_FILES = new Set([
+    // Node / JavaScript / TypeScript
+    'package.json',
+    'package-lock.json',
+    'pnpm-lock.yaml',
+    'yarn.lock',
+    'bun.lockb',
+    'bun.lock',
+    'tsconfig.json',
+    'tsconfig.base.json',
+    'tsconfig.build.json',
+    'tsconfig.app.json',
+    'tsconfig.node.json',
+    'jsconfig.json',
+    'next.config.js',
+    'next.config.ts',
+    'next.config.mjs',
+    'next.config.cjs',
+    'vite.config.js',
+    'vite.config.ts',
+    'vite.config.mjs',
+    'vite.config.cjs',
+    'webpack.config.js',
+    'webpack.config.ts',
+    'webpack.config.mjs',
+    'rollup.config.js',
+    'rollup.config.ts',
+    'rollup.config.mjs',
+    'babel.config.js',
+    'babel.config.json',
+    '.babelrc',
+    'svelte.config.js',
+    'astro.config.mjs',
+    'nuxt.config.ts',
+    'remix.config.js',
+    'angular.json',
+    'vitest.config.ts',
+    'vitest.config.js',
+    'jest.config.js',
+    'jest.config.ts',
+    '.eslintrc',
+    '.eslintrc.js',
+    '.eslintrc.json',
+    '.eslintrc.yaml',
+    '.eslintrc.yml',
+    'eslint.config.js',
+    'eslint.config.mjs',
+    'eslint.config.ts',
+    // Rust
+    'cargo.toml',
+    'cargo.lock',
+    // Go
+    'go.mod',
+    'go.sum',
+    // Python
+    'pyproject.toml',
+    'setup.py',
+    'setup.cfg',
+    'requirements.txt',
+    'pipfile',
+    'pipfile.lock',
+    'poetry.lock',
+    'mypy.ini',
+    // Java / Kotlin
+    'pom.xml',
+    'build.gradle',
+    'build.gradle.kts',
+    'settings.gradle',
+    'settings.gradle.kts',
+    // C / C++
+    'cmakelists.txt',
+    'makefile',
+    'meson.build',
+    // Ruby
+    'gemfile',
+    'gemfile.lock',
+    // PHP
+    'composer.json',
+    'composer.lock',
+    // Swift & Dart
+    'package.swift',
+    'pubspec.yaml',
+    'pubspec.lock',
+]);
+/**
+ * Determines whether a given file path represents a critical project configuration
+ * file or root manifest that should never be deleted or renamed by the agent.
+ *
+ * @param filePath - Relative or absolute path to check
+ * @returns True if the file is a protected critical config file
+ */
+export function isCriticalConfigFile(filePath) {
+    const base = path.basename(filePath).toLowerCase();
+    return CRITICAL_CONFIG_FILES.has(base);
+}
+/**
+ * Checks if a Next.js configuration contains error-ignoring flags.
+ * Handles variations like:
+ *   typescript: { ignoreBuildErrors: true }
+ *   eslint: { ignoreDuringBuilds: true }
+ */
+function hasNextConfigCheats(content) {
+    // Check typescript.ignoreBuildErrors
+    if (/\bignoreBuildErrors\s*:\s*(?:true|1|Boolean\s*\(\s*true\s*\))/i.test(content)) {
+        return {
+            cheat: true,
+            reason: 'Attempted to set "ignoreBuildErrors: true" in Next.js configuration to bypass type checking.',
+        };
+    }
+    // Check eslint.ignoreDuringBuilds
+    if (/\bignoreDuringBuilds\s*:\s*(?:true|1|Boolean\s*\(\s*true\s*\))/i.test(content)) {
+        return {
+            cheat: true,
+            reason: 'Attempted to set "ignoreDuringBuilds: true" in Next.js configuration to bypass ESLint checks.',
+        };
+    }
+    return { cheat: false };
+}
+/**
+ * Checks if a TypeScript configuration (tsconfig*.json) was downgraded to disable type safety.
+ */
+function hasTsConfigCheats(content, existingContent) {
+    // Check for strict: false replacing strict: true or being newly introduced
+    if (/"strict"\s*:\s*false/i.test(content)) {
+        if (!existingContent || !/"strict"\s*:\s*false/i.test(existingContent)) {
+            return {
+                cheat: true,
+                reason: 'Attempted to disable TypeScript strict mode ("strict": false) in tsconfig.',
+            };
+        }
+    }
+    // Check for suppressImplicitAnyIndexErrors
+    if (/"suppressImplicitAnyIndexErrors"\s*:\s*true/i.test(content)) {
+        if (!existingContent || !/"suppressImplicitAnyIndexErrors"\s*:\s*true/i.test(existingContent)) {
+            return {
+                cheat: true,
+                reason: 'Attempted to enable "suppressImplicitAnyIndexErrors: true" in tsconfig.',
+            };
+        }
+    }
+    // Check for noCheck: true
+    if (/"noCheck"\s*:\s*true/i.test(content)) {
+        if (!existingContent || !/"noCheck"\s*:\s*true/i.test(existingContent)) {
+            return {
+                cheat: true,
+                reason: 'Attempted to set "noCheck: true" in tsconfig.',
+            };
+        }
+    }
+    // Check for noEmitOnError: false being added when previously true or not false
+    if (/"noEmitOnError"\s*:\s*false/i.test(content)) {
+        if (!existingContent || !/"noEmitOnError"\s*:\s*false/i.test(existingContent)) {
+            return {
+                cheat: true,
+                reason: 'Attempted to set "noEmitOnError: false" in tsconfig to emit outputs despite compilation errors.',
+            };
+        }
+    }
+    return { cheat: false };
+}
+/**
+ * Checks if package.json scripts were modified to swallow errors (e.g. appending "|| true", "|| exit 0")
+ * or stripping type check commands (e.g. removing "tsc" from build).
+ */
+function hasPackageJsonCheats(content, existingContent) {
+    // Check for script swallowing failures: "|| true", "|| exit 0", "; exit 0" inside scripts
+    const swallowMatch = /"(?:build|typecheck|test|lint|check)"\s*:\s*"[^"]*(?:\|\|\s*true|\|\|\s*exit\s+0|;\s*exit\s+0)/i.test(content);
+    if (swallowMatch) {
+        if (!existingContent || !/"(?:build|typecheck|test|lint|check)"\s*:\s*"[^"]*(?:\|\|\s*true|\|\|\s*exit\s+0|;\s*exit\s+0)/i.test(existingContent)) {
+            return {
+                cheat: true,
+                reason: 'Attempted to append error-swallowing directives ("|| true" or "|| exit 0") to package.json scripts.',
+            };
+        }
+    }
+    // Check if existing package.json had a build script with tsc / typecheck, and the new one removed it
+    if (existingContent) {
+        try {
+            const oldPkg = JSON.parse(existingContent);
+            const newPkg = JSON.parse(content);
+            const oldBuild = oldPkg?.scripts?.build;
+            const newBuild = newPkg?.scripts?.build;
+            if (typeof oldBuild === 'string' && typeof newBuild === 'string') {
+                const hadTsc = /\btsc\b/i.test(oldBuild);
+                const hasTsc = /\btsc\b/i.test(newBuild);
+                if (hadTsc && !hasTsc) {
+                    return {
+                        cheat: true,
+                        reason: 'Attempted to strip "tsc" type checking from the "build" script in package.json to bypass errors.',
+                    };
+                }
+            }
+        }
+        catch {
+            // Ignore JSON parse errors in partial content
+        }
+    }
+    return { cheat: false };
+}
+/**
+ * Checks ESLint configuration files (eslint.config.*, .eslintrc*) for attempts to
+ * disable all rules or ignore all files.
+ */
+function hasLinterConfigCheats(content, existingContent) {
+    // Check for blanket ignores in flat config: ignores: ['**/*', '**', 'src/**']
+    if (/\bignores\s*:\s*\[\s*['"`](?:\*\*|\*\*\/\*|\*|src\/\*\*)['"`]\s*\]/i.test(content)) {
+        if (!existingContent || !/\bignores\s*:\s*\[\s*['"`](?:\*\*|\*\*\/\*|\*|src\/\*\*)['"`]\s*\]/i.test(existingContent)) {
+            return {
+                cheat: true,
+                reason: 'Attempted to ignore all source files in ESLint configuration.',
+            };
+        }
+    }
+    // Check for ignorePatterns in legacy .eslintrc: ignorePatterns: ["**/*", "*"]
+    if (/"ignorePatterns"\s*:\s*\[\s*["'](?:\*\*|\*\*\/\*|\*|src\/\*\*)["']\s*\]/i.test(content)) {
+        if (!existingContent || !/"ignorePatterns"\s*:\s*\[\s*["'](?:\*\*|\*\*\/\*|\*|src\/\*\*)["']\s*\]/i.test(existingContent)) {
+            return {
+                cheat: true,
+                reason: 'Attempted to add blanket ignorePatterns in ESLint configuration.',
+            };
+        }
+    }
+    return { cheat: false };
+}
+/**
+ * Checks linter and build ignore files (.eslintignore, .prettierignore) for blanket wildcard exclusions.
+ */
+function hasIgnoreFileCheats(filePath, content, existingContent) {
+    const base = path.basename(filePath).toLowerCase();
+    if (base === '.eslintignore' || base === '.prettierignore') {
+        const lines = content.split('\n').map((l) => l.trim()).filter((l) => l && !l.startsWith('#'));
+        const oldLines = existingContent ? existingContent.split('\n').map((l) => l.trim()).filter((l) => l && !l.startsWith('#')) : [];
+        for (const line of lines) {
+            if (['*', '**', '**/*', 'src', 'src/*', 'src/**'].includes(line)) {
+                if (!oldLines.includes(line)) {
+                    return {
+                        cheat: true,
+                        reason: `Attempted to add wildcard exclusion "${line}" to ${base} to silence verification.`,
+                    };
+                }
+            }
+        }
+    }
+    return { cheat: false };
+}
+/**
+ * Checks environment files (.env, .env.local, .env.development, .env.production) for bypass variables.
+ */
+function hasEnvFileCheats(filePath, content, existingContent) {
+    const base = path.basename(filePath).toLowerCase();
+    if (base === '.env' || base.startsWith('.env.')) {
+        const bypassVars = [
+            'NEXT_DISABLE_ESLINT',
+            'TSC_COMPILE_ON_ERROR',
+            'ESLINT_NO_DEV_ERRORS',
+        ];
+        for (const v of bypassVars) {
+            const regex = new RegExp(`^\\s*${v}\\s*=\\s*(?:1|true)`, 'im');
+            if (regex.test(content)) {
+                if (!existingContent || !regex.test(existingContent)) {
+                    return {
+                        cheat: true,
+                        reason: `Attempted to set bypass environment variable "${v}" in ${base}.`,
+                    };
+                }
+            }
+        }
+    }
+    return { cheat: false };
+}
+/**
+ * Checks build tools and test runners (Vite, Vitest, Webpack, Jest) for error suppressions.
+ */
+function hasBundlerOrRunnerCheats(content, existingContent) {
+    // Check for passWithNoTests: true or bail: false in Jest/Vitest configs to mask missing tests
+    if (/\bpassWithNoTests\s*:\s*true/i.test(content)) {
+        if (!existingContent || !/\bpassWithNoTests\s*:\s*true/i.test(existingContent)) {
+            return {
+                cheat: true,
+                reason: 'Attempted to enable "passWithNoTests: true" in test runner configuration.',
+            };
+        }
+    }
+    return { cheat: false };
+}
+/**
+ * Checks for blanket error suppressions in source code:
+ * - Newly introduced //@ts-nocheck
+ * - Unscoped /* eslint-disable *\/ at the file header
+ * - Go //go:build ignore
+ * - Rust #![allow(warnings)]
+ * - Python file-wide # flake8: noqa
+ */
+function hasSourceCodeCheats(content, existingContent) {
+    // 1. Check for @ts-nocheck
+    if (/\/\/\s*@ts-nocheck\b/i.test(content) || /\/\*\s*@ts-nocheck\s*\*\//i.test(content)) {
+        if (!existingContent || (!/\/\/\s*@ts-nocheck\b/i.test(existingContent) && !/\/\*\s*@ts-nocheck\s*\*\//i.test(existingContent))) {
+            return {
+                cheat: true,
+                reason: 'Attempted to add "@ts-nocheck" to disable TypeScript type checking for this file.',
+            };
+        }
+    }
+    // 2. Check for unscoped /* eslint-disable */ (blanket disable without specific rule names)
+    if (/\/\*\s*eslint-disable\s*\*\//i.test(content)) {
+        if (!existingContent || !/\/\*\s*eslint-disable\s*\*\//i.test(existingContent)) {
+            return {
+                cheat: true,
+                reason: 'Attempted to add blanket "/* eslint-disable */" to silence all linter rules for this file.',
+            };
+        }
+    }
+    // 3. Rust crate-level #![allow(warnings)]
+    if (/#!\s*\[\s*allow\s*\(\s*warnings\s*\)\s*\]/i.test(content)) {
+        if (!existingContent || !/#!\s*\[\s*allow\s*\(\s*warnings\s*\)\s*\]/i.test(existingContent)) {
+            return {
+                cheat: true,
+                reason: 'Attempted to add "#![allow(warnings)]" to silence all Rust compiler warnings.',
+            };
+        }
+    }
+    // 4. Go //go:build ignore on existing source files
+    if (/\/\/\s*go:build\s+ignore\b/i.test(content)) {
+        if (!existingContent || !/\/\/\s*go:build\s+ignore\b/i.test(existingContent)) {
+            return {
+                cheat: true,
+                reason: 'Attempted to add "//go:build ignore" to exclude this Go file from compilation.',
+            };
+        }
+    }
+    // 5. Python # flake8: noqa file-wide disable
+    if (/#\s*flake8:\s*noqa\b/i.test(content)) {
+        if (!existingContent || !/#\s*flake8:\s*noqa\b/i.test(existingContent)) {
+            return {
+                cheat: true,
+                reason: 'Attempted to add "# flake8: noqa" to disable lint checking for this Python file.',
+            };
+        }
+    }
+    return { cheat: false };
+}
+/**
+ * Checks if a test file had its test assertions neutered or skipped (e.g. newly introduced it.skip/test.skip,
+ * or commenting out assertions).
+ */
+function hasTestCheats(filePath, content, existingContent) {
+    const isTestFile = /\.(?:test|spec)\.[a-z0-9]+$/i.test(filePath) || filePath.includes('/__tests__/');
+    if (!isTestFile)
+        return { cheat: false };
+    // 1. Count newly introduced .skip calls
+    const oldSkipCount = existingContent ? (existingContent.match(/\b(?:it|test|describe)\.skip\b/g) || []).length : 0;
+    const newSkipCount = (content.match(/\b(?:it|test|describe)\.skip\b/g) || []).length;
+    if (newSkipCount > oldSkipCount) {
+        return {
+            cheat: true,
+            reason: `Attempted to skip failing test cases (${newSkipCount - oldSkipCount} newly added .skip calls) instead of fixing the implementation.`,
+        };
+    }
+    // 2. Detect commenting out assertions (e.g. converting `expect(...)` or `assert(...)` into `// expect(...)`)
+    if (existingContent) {
+        const oldExpectCount = (existingContent.match(/(?<!\/\/.*|\/\*.*)\b(?:expect|assert)\s*\(/g) || []).length;
+        const newExpectCount = (content.match(/(?<!\/\/.*|\/\*.*)\b(?:expect|assert)\s*\(/g) || []).length;
+        // If more than 50% of assertions were commented out/deleted while test cases remained
+        const oldTestCount = (existingContent.match(/\b(?:it|test)\s*\(/g) || []).length;
+        const newTestCount = (content.match(/\b(?:it|test)\s*\(/g) || []).length;
+        if (oldTestCount > 0 && newTestCount >= oldTestCount && oldExpectCount >= 2 && newExpectCount < Math.floor(oldExpectCount / 2)) {
+            return {
+                cheat: true,
+                reason: `Attempted to neuter test assertions (${oldExpectCount} assertions reduced to ${newExpectCount}) instead of fixing broken code.`,
+            };
+        }
+    }
+    return { cheat: false };
+}
+/**
+ * Checks Python configuration files (mypy.ini, pyproject.toml, setup.cfg) for type checking disables.
+ */
+function hasPythonCheats(content, existingContent) {
+    // Check for mypy ignore_errors = true
+    if (/\bignore_errors\s*=\s*(?:true|1)\b/i.test(content)) {
+        if (!existingContent || !/\bignore_errors\s*=\s*(?:true|1)\b/i.test(existingContent)) {
+            return {
+                cheat: true,
+                reason: 'Attempted to set "ignore_errors = True" in Python typing configuration.',
+            };
+        }
+    }
+    // Check for ruff ignore all rules: ignore = ["ALL"] or select = []
+    if (/\bignore\s*=\s*\[\s*["']ALL["']\s*\]/i.test(content)) {
+        if (!existingContent || !/\bignore\s*=\s*\[\s*["']ALL["']\s*\]/i.test(existingContent)) {
+            return {
+                cheat: true,
+                reason: 'Attempted to set `ignore = ["ALL"]` in Python Ruff linter configuration.',
+            };
+        }
+    }
+    return { cheat: false };
+}
+/**
+ * Checks compiled and native build configurations (CMakeLists.txt, Makefile, Gradle, Maven)
+ * for error suppression flags.
+ */
+function hasCompiledSystemsCheats(filePath, content, existingContent) {
+    const base = path.basename(filePath).toLowerCase();
+    // CMake: adding -w to CMAKE_C_FLAGS or CMAKE_CXX_FLAGS
+    if (base === 'cmakelists.txt') {
+        if (/(?:CMAKE_C_FLAGS|CMAKE_CXX_FLAGS)\s+[^)]*-w\b/i.test(content)) {
+            if (!existingContent || !/(?:CMAKE_C_FLAGS|CMAKE_CXX_FLAGS)\s+[^)]*-w\b/i.test(existingContent)) {
+                return {
+                    cheat: true,
+                    reason: 'Attempted to add "-w" warning suppression flag in CMakeLists.txt.',
+                };
+            }
+        }
+    }
+    // Gradle: test.ignoreFailures = true or ignoreFailures = true
+    if (base === 'build.gradle' || base === 'build.gradle.kts') {
+        if (/\bignoreFailures\s*=\s*true/i.test(content)) {
+            if (!existingContent || !/\bignoreFailures\s*=\s*true/i.test(existingContent)) {
+                return {
+                    cheat: true,
+                    reason: 'Attempted to set "ignoreFailures = true" in Gradle build script.',
+                };
+            }
+        }
+    }
+    // Maven: <testFailureIgnore>true</testFailureIgnore>
+    if (base === 'pom.xml') {
+        if (/<testFailureIgnore>\s*true\s*<\/testFailureIgnore>/i.test(content)) {
+            if (!existingContent || !/<testFailureIgnore>\s*true\s*<\/testFailureIgnore>/i.test(existingContent)) {
+                return {
+                    cheat: true,
+                    reason: 'Attempted to set "<testFailureIgnore>true</testFailureIgnore>" in Maven pom.xml.',
+                };
+            }
+        }
+    }
+    return { cheat: false };
+}
+/**
+ * Evaluates whether a proposed file modification or write introduces anti-cheating violations
+ * by attempting to silence, ignore, or bypass build, compiler, type, or lint errors.
+ *
+ * This function is strictly diff-aware: if the existing file already had an error-ignoring flag,
+ * modifying unrelated sections of the file will not trigger a false positive.
+ *
+ * @param filePath - Path to the file being created or modified
+ * @param newContent - The proposed new content of the file
+ * @param existingContent - The previous content of the file (if it already existed on disk)
+ * @returns An error message string if an anti-cheating violation is detected, or null if clean.
+ */
+export function detectAntiCheatingViolations(filePath, newContent, existingContent) {
+    const base = path.basename(filePath).toLowerCase();
+    // 1. Next.js configuration files
+    if (base.startsWith('next.config.')) {
+        const nextCheck = hasNextConfigCheats(newContent);
+        if (nextCheck.cheat) {
+            if (!existingContent || !hasNextConfigCheats(existingContent).cheat) {
+                return (`Anti-cheating violation: ${nextCheck.reason}\n` +
+                    `You are strictly forbidden from modifying build configuration files to ignore or bypass errors.\n` +
+                    `Actionable guidance: You must fix all build, compiler, type, and lint errors head-on in the application source code.`);
+            }
+        }
+    }
+    // 2. TypeScript configuration files (tsconfig.json, tsconfig.*.json, jsconfig.json)
+    if (base === 'tsconfig.json' || base === 'jsconfig.json' || (base.startsWith('tsconfig.') && base.endsWith('.json'))) {
+        const tsCheck = hasTsConfigCheats(newContent, existingContent);
+        if (tsCheck.cheat) {
+            return (`Anti-cheating violation: ${tsCheck.reason}\n` +
+                `You are strictly forbidden from downgrading TypeScript configuration to bypass errors.\n` +
+                `Actionable guidance: Fix the type errors directly in the TypeScript source files.`);
+        }
+    }
+    // 3. package.json scripts
+    if (base === 'package.json') {
+        const pkgCheck = hasPackageJsonCheats(newContent, existingContent);
+        if (pkgCheck.cheat) {
+            return (`Anti-cheating violation: ${pkgCheck.reason}\n` +
+                `You are strictly forbidden from altering build scripts to swallow or skip verification failures.\n` +
+                `Actionable guidance: Ensure build scripts run proper verification and resolve the underlying code errors.`);
+        }
+    }
+    // 4. ESLint configuration files (eslint.config.*, .eslintrc*)
+    if (base.startsWith('eslint.config.') || base === '.eslintrc' || base.startsWith('.eslintrc.')) {
+        const linterCheck = hasLinterConfigCheats(newContent, existingContent);
+        if (linterCheck.cheat) {
+            return (`Anti-cheating violation: ${linterCheck.reason}\n` +
+                `You are strictly forbidden from disabling linter rules in ESLint configuration.\n` +
+                `Actionable guidance: Fix the code to conform to linting standards.`);
+        }
+    }
+    // 5. Ignore files (.eslintignore, .prettierignore)
+    const ignoreCheck = hasIgnoreFileCheats(filePath, newContent, existingContent);
+    if (ignoreCheck.cheat) {
+        return (`Anti-cheating violation: ${ignoreCheck.reason}\n` +
+            `You are strictly forbidden from adding wildcard ignore patterns to bypass verification.\n` +
+            `Actionable guidance: Fix the source code rather than excluding it from checks.`);
+    }
+    // 6. Environment files (.env, .env.*)
+    const envCheck = hasEnvFileCheats(filePath, newContent, existingContent);
+    if (envCheck.cheat) {
+        return (`Anti-cheating violation: ${envCheck.reason}\n` +
+            `You are strictly forbidden from setting bypass environment variables.\n` +
+            `Actionable guidance: Fix the underlying errors in your code.`);
+    }
+    // 7. Bundlers & test runners (vite.config.*, vitest.config.*, jest.config.*)
+    if (base.startsWith('vite.config.') || base.startsWith('vitest.config.') || base.startsWith('jest.config.')) {
+        const bundlerCheck = hasBundlerOrRunnerCheats(newContent, existingContent);
+        if (bundlerCheck.cheat) {
+            return (`Anti-cheating violation: ${bundlerCheck.reason}\n` +
+                `You are strictly forbidden from configuring test runners or bundlers to bypass checks.\n` +
+                `Actionable guidance: Address the root cause in the application or test code.`);
+        }
+    }
+    // 8. Python typing configs (mypy.ini, pyproject.toml, setup.cfg)
+    if (base === 'mypy.ini' || base === 'pyproject.toml' || base === 'setup.cfg') {
+        const pyCheck = hasPythonCheats(newContent, existingContent);
+        if (pyCheck.cheat) {
+            return (`Anti-cheating violation: ${pyCheck.reason}\n` +
+                `You are strictly forbidden from disabling Python type checking or linting.\n` +
+                `Actionable guidance: Resolve typing errors in the Python source code.`);
+        }
+    }
+    // 9. Compiled build systems (CMakeLists.txt, Makefile, build.gradle, pom.xml)
+    const compiledCheck = hasCompiledSystemsCheats(filePath, newContent, existingContent);
+    if (compiledCheck.cheat) {
+        return (`Anti-cheating violation: ${compiledCheck.reason}\n` +
+            `You are strictly forbidden from suppressing compilation warnings or test failures.\n` +
+            `Actionable guidance: Resolve compiler warnings and test failures in your code.`);
+    }
+    // 10. Source code file blanket suppressions (@ts-nocheck, /* eslint-disable */, #![allow(warnings)], etc.)
+    const ext = path.extname(filePath).toLowerCase();
+    if (['.ts', '.tsx', '.js', '.jsx', '.mts', '.cts', '.rs', '.go', '.py'].includes(ext)) {
+        const srcCheck = hasSourceCodeCheats(newContent, existingContent);
+        if (srcCheck.cheat) {
+            return (`Anti-cheating violation: ${srcCheck.reason}\n` +
+                `You are strictly forbidden from adding blanket error suppressions to silence errors.\n` +
+                `Actionable guidance: Fix the underlying type, syntax, and lint issues directly.`);
+        }
+        // 11. Test assertion neutering and skipping
+        const testCheck = hasTestCheats(filePath, newContent, existingContent);
+        if (testCheck.cheat) {
+            return (`Anti-cheating violation: ${testCheck.reason}\n` +
+                `You are strictly forbidden from skipping test cases or removing assertions to pass verification.\n` +
+                `Actionable guidance: Fix the application code so that the tests pass cleanly.`);
+        }
+    }
+    return null;
+}

package/dist/utils/dependencyTracer.d.ts

@@ -1,3 +1,12 @@
+export declare function invalidateDependencyGraph(workspaceRoot?: string): void;
+export declare function clearDependencyGraphCache(): void;
+export declare function getDependencyGraphCacheStats(): Readonly<{
+    hits: number;
+    misses: number;
+    invalidations: number;
+    cachedWorkspaces: number;
+}>;
+export declare function resetDependencyGraphCacheStats(): void;
 export interface DependencyNode {
     /** Files this file directly imports (forward/downstream) */
     imports: Set<string>;
@@ -35,9 +44,13 @@ export interface DependencyGraph {
  *
  * Performance: This is pure regex + filesystem walking — no AST parsing.
  * For a typical project (<5,000 source files), this completes in <1s.
- * The graph is ephemeral: built once per `gatherContext` call and discarded.
+ * The graph is cached in-memory per workspaceRoot and automatically reused across
+ * subsequent queries until invalidated by file modifications.
+ *
+ * @param workspaceRoot - Root directory of the target project workspace
+ * @param forceRebuild - If true, bypasses the in-memory cache and forces a full rescan
  */
-export declare function buildDependencyGraph(workspaceRoot: string): Promise<DependencyGraph>;
+export declare function buildDependencyGraph(workspaceRoot: string, forceRebuild?: boolean): Promise<DependencyGraph>;
 export interface FindDependenciesResult {
     filePath: string;
     forwardDeps: string[];

package/dist/utils/dependencyTracer.js

@@ -1,6 +1,47 @@
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { EXCLUDED_EXTENSIONS } from './excludedExtensions.js';
+import { debugLog } from './logger.js';
+// ─── Dependency Graph Cache ──────────────────────────────────────────
+const dependencyGraphCache = new Map();
+const dependencyGraphCacheStats = {
+    hits: 0,
+    misses: 0,
+    invalidations: 0,
+};
+function normalizeWorkspaceKey(workspaceRoot) {
+    const resolved = path.resolve(workspaceRoot).replace(/\\/g, '/');
+    return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+export function invalidateDependencyGraph(workspaceRoot) {
+    if (workspaceRoot) {
+        const key = normalizeWorkspaceKey(workspaceRoot);
+        if (dependencyGraphCache.delete(key)) {
+            dependencyGraphCacheStats.invalidations++;
+            debugLog(`[DependencyTracer] Invalidated graph cache for workspace: ${workspaceRoot}`);
+        }
+    }
+    else {
+        const count = dependencyGraphCache.size;
+        dependencyGraphCache.clear();
+        dependencyGraphCacheStats.invalidations += count;
+        debugLog(`[DependencyTracer] Cleared graph cache for all workspaces (${count})`);
+    }
+}
+export function clearDependencyGraphCache() {
+    invalidateDependencyGraph();
+}
+export function getDependencyGraphCacheStats() {
+    return {
+        ...dependencyGraphCacheStats,
+        cachedWorkspaces: dependencyGraphCache.size,
+    };
+}
+export function resetDependencyGraphCacheStats() {
+    dependencyGraphCacheStats.hits = 0;
+    dependencyGraphCacheStats.misses = 0;
+    dependencyGraphCacheStats.invalidations = 0;
+}
 // ─── Language Profile Registry ───────────────────────────────────────
 //
 // Each profile defines regex patterns that extract import specifiers for
@@ -503,9 +544,24 @@ async function walkWorkspace(workspaceRoot) {
  *
  * Performance: This is pure regex + filesystem walking — no AST parsing.
  * For a typical project (<5,000 source files), this completes in <1s.
- * The graph is ephemeral: built once per `gatherContext` call and discarded.
+ * The graph is cached in-memory per workspaceRoot and automatically reused across
+ * subsequent queries until invalidated by file modifications.
+ *
+ * @param workspaceRoot - Root directory of the target project workspace
+ * @param forceRebuild - If true, bypasses the in-memory cache and forces a full rescan
  */
-export async function buildDependencyGraph(workspaceRoot) {
+export async function buildDependencyGraph(workspaceRoot, forceRebuild = false) {
+    const key = normalizeWorkspaceKey(workspaceRoot);
+    if (!forceRebuild) {
+        const cached = dependencyGraphCache.get(key);
+        if (cached) {
+            dependencyGraphCacheStats.hits++;
+            debugLog(`[DependencyTracer] Graph cache HIT for ${workspaceRoot} (${cached.graph.nodes.size} nodes)`);
+            return cached.graph;
+        }
+    }
+    dependencyGraphCacheStats.misses++;
+    debugLog(`[DependencyTracer] Graph cache MISS, building graph for ${workspaceRoot}`);
     const nodes = new Map();
     function getOrCreate(filePath) {
         let node = nodes.get(filePath);
@@ -540,7 +596,7 @@ export async function buildDependencyGraph(workspaceRoot) {
         }
     }));
     // 3. Return the graph with query methods
-    return {
+    const graph = {
         nodes,
         getImports(filePath) {
             return Array.from(nodes.get(filePath)?.imports || []);
@@ -566,6 +622,8 @@ export async function buildDependencyGraph(workspaceRoot) {
             return computeGraphCentrality(nodes);
         },
     };
+    dependencyGraphCache.set(key, { graph, timestamp: Date.now() });
+    return graph;
 }
 /**
  * BFS traversal of the dependency graph in a given direction.