mjolnir-qa 2.1.0 → 3.0.0

package/dist/{scan-pipeline-MQGUSey3.mjs → scan-pipeline-CAH9_Qgh.mjs}

@@ -1,9 +1,9 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { createRequire } from "node:module";
-import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import * as ts$2 from "ts-morph";
 import ts, { Project, SyntaxKind, ts as ts$1 } from "ts-morph";
 import { Language, Parser } from "web-tree-sitter";
@@ -97,6 +97,38 @@ const DEDUCTIONS = {
 	info: 1
 };
 //#endregion
+//#region src/engine/completion.ts
+function deriveCompletion(input) {
+	const truncationReasons = [...new Set(input.truncationReasons)].sort();
+	const reasons = /* @__PURE__ */ new Set();
+	if (input.discoveryTruncated) reasons.add("discovery-truncated");
+	if (input.rulesPartial) reasons.add("rules-partial");
+	if (input.skippedFiles > 0) reasons.add(`skipped-files:${input.skippedFiles}`);
+	if (input.rulesCrashed > 0) reasons.add(`rules-crashed:${input.rulesCrashed}`);
+	if (input.scopeIgnored > 0) reasons.add(`scope-ignored:${input.scopeIgnored}`);
+	if (input.scopeUnrecognized > 0) reasons.add(`scope-unrecognized:${input.scopeUnrecognized}`);
+	if (input.parseFailed > 0) reasons.add(`parse-failed:${input.parseFailed}`);
+	if (input.parseFallbacks && input.parseFallbacks > 0) reasons.add(`parse-fallbacks:${input.parseFallbacks}`);
+	if (input.scopeDegraded) reasons.add(`scope-degraded:${input.scopeDegraded}`);
+	if (input.runtimeIncomplete) reasons.add("runtime-incomplete");
+	if (input.identityIncomplete) reasons.add("identity-incomplete");
+	for (const reason of truncationReasons) reasons.add(`truncated:${reason}`);
+	const discoveryPartial = input.discoveryTruncated || input.scopeIgnored > 0 || input.scopeUnrecognized > 0 || input.scopeDegraded !== void 0;
+	const rulesPartial = input.rulesPartial || input.rulesCrashed > 0 || input.parseFailed > 0;
+	return {
+		partial: discoveryPartial || rulesPartial || input.skippedFiles > 0 || input.runtimeIncomplete === true || input.identityIncomplete === true || truncationReasons.length > 0,
+		analysisStatus: {
+			discovery: discoveryPartial ? "partial" : "complete",
+			rules: rulesPartial ? "partial" : "complete",
+			skippedFiles: input.skippedFiles,
+			rulesCrashed: input.rulesCrashed,
+			parseFallbacks: input.parseFallbacks ?? 0,
+			...truncationReasons.length > 0 ? { truncationReasons } : {},
+			reasons: [...reasons].sort()
+		}
+	};
+}
+//#endregion
 //#region src/engine/runtime-corroboration.ts
 /**
 * Stamp runtime corroboration + trust levels onto findings (mutates in
@@ -863,7 +895,10 @@ function sha256$1(text) {
 	return createHash("sha256").update(text).digest("hex");
 }
 function canonical(value) {
-	return JSON.stringify(value);
+	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+	if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+	const record = value;
+	return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonical(record[key])}`).join(",")}}`;
 }
 function buildRunIdentity(input) {
 	const inputFingerprint = sha256$1([...input.files].map((f) => f.hash ? `${f.path}:${f.hash}` : `${f.path}:${f.size}`).sort().join("\n"));
@@ -945,7 +980,7 @@ function buildEvidenceGraph(parts) {
 * scripts/sync-sarif-version.cjs and guarded by the version-consistency
 * spec. cli.ts re-exports this as CLI_VERSION.
 */
-const ENGINE_VERSION = "2.1.0";
+const ENGINE_VERSION = "3.0.0";
 //#endregion
 //#region src/engine/contract-versions.ts
 /**
@@ -1106,7 +1141,9 @@ function basename$1(p) {
 * Internal files (cache, hashes) use `isRecord`; user-facing files
 * (config, plugins) use stricter checks that throw descriptive errors.
 */
+const MAX_JSON_BYTES = 16777216;
 function parseJsonFile(text, source, validate) {
+	if (Buffer.byteLength(text, "utf8") > MAX_JSON_BYTES) throw new Error(`JSON source exceeds the ${MAX_JSON_BYTES}-byte limit: ${source}`);
 	let parsed;
 	try {
 		parsed = JSON.parse(text);
@@ -1125,6 +1162,59 @@ function isRecord(v) {
 	return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 //#endregion
+//#region src/lib/fs-bounded.ts
+function closeQuiet(fd) {
+	try {
+		closeSync(fd);
+	} catch {
+		return;
+	}
+}
+function readFileBounded(path, maxBytes) {
+	let fd;
+	try {
+		const pathStat = lstatSync(path);
+		if (pathStat.isSymbolicLink()) return {
+			ok: false,
+			reason: "symlink"
+		};
+		if (!pathStat.isFile()) return {
+			ok: false,
+			reason: "unreadable"
+		};
+		fd = openSync(path, 0);
+		const fdStat = fstatSync(fd);
+		if (!fdStat.isFile() || fdStat.size > maxBytes) return {
+			ok: false,
+			reason: fdStat.size > maxBytes ? "too-large" : "unreadable"
+		};
+		const chunks = [];
+		let total = 0;
+		const buffer = Buffer.allocUnsafe(Math.min(65536, maxBytes));
+		while (true) {
+			const read = readSync(fd, buffer, 0, buffer.length, null);
+			if (read === 0) break;
+			total += read;
+			if (total > maxBytes) return {
+				ok: false,
+				reason: "too-large"
+			};
+			chunks.push(Buffer.from(buffer.subarray(0, read)));
+		}
+		return {
+			ok: true,
+			data: Buffer.concat(chunks)
+		};
+	} catch {
+		return {
+			ok: false,
+			reason: "unreadable"
+		};
+	} finally {
+		if (fd !== void 0) closeQuiet(fd);
+	}
+}
+//#endregion
 //#region src/config/config-schema.ts
 const VALID_GATES = /* @__PURE__ */ new Set([
 	"advisory",
@@ -1223,7 +1313,11 @@ const CONFIG_NAMES = ["mjolnir.config.json", ".mjolnir.json"];
 function findConfigPath(root) {
 	for (const name of CONFIG_NAMES) {
 		const p = join(root, name);
-		if (existsSync(p)) return p;
+		try {
+			if (existsSync(p) && !lstatSync(p).isSymbolicLink()) return p;
+		} catch {
+			continue;
+		}
 	}
 	return null;
 }
@@ -1243,7 +1337,10 @@ function loadConfig(root, options = {}) {
 		const p = join(root, name);
 		if (!existsSync(p)) continue;
 		try {
-			const parsed = parseJsonFile(readFileSync(p, "utf8"), p, (v) => isRecord(v));
+			if (!existsSync(p) || lstatSync(p).isSymbolicLink()) continue;
+			const read = readFileBounded(p, 1048576);
+			if (!read.ok) throw new Error("config source could not be read safely");
+			const parsed = parseJsonFile(read.data.toString("utf8"), p, (v) => isRecord(v));
 			return {
 				config: parsed,
 				path: p,
@@ -1542,8 +1639,9 @@ function sharedWalk(options) {
 			}
 			const full = join(dir, entry.name);
 			const rel = relative(options.root, full).replaceAll("\\", "/");
+			if (entry.isDirectory() && options.skipDirs.includes(entry.name)) continue;
 			if (options.ignoreMatcher.isIgnored(rel)) {
-				options.onIgnored?.();
+				if (!rel.startsWith(".mjolnir/")) options.onIgnored?.(rel);
 				continue;
 			}
 			if (entry.isSymbolicLink()) {
@@ -1551,7 +1649,6 @@ function sharedWalk(options) {
 				continue;
 			}
 			if (entry.isDirectory()) {
-				if (options.skipDirs.includes(entry.name)) continue;
 				if (rel.split("/").length > LIMITS$1.maxDepth) {
 					options.onSkipped("max-depth");
 					continue;
@@ -1569,7 +1666,7 @@ function sharedWalk(options) {
 			} catch {
 				options.onSkipped("stat-failed");
 			}
-			else if (entry.isFile()) options.onUnrecognized?.();
+			else if (entry.isFile()) options.onUnrecognized?.(rel);
 		}
 	};
 	walk(options.root);
@@ -3671,7 +3768,7 @@ const SCAN_ADAPTERS = [
 * the adapter that claims it; per-adapter caps still apply.
 */
 function discoverAllTestFiles(ctx, languageAdapters, buckets, fixtureDirMemo) {
-	const walkSkips = languageAdapters.reduce((common, a) => common.filter((name) => a.dirSkips.includes(name)), languageAdapters[0]?.dirSkips ?? []);
+	const walkSkips = [.../* @__PURE__ */ new Set([...languageAdapters.reduce((common, a) => common.filter((name) => a.dirSkips.includes(name)), languageAdapters[0]?.dirSkips ?? []), ".mjolnir"])];
 	sharedWalk({
 		root: ctx.workspace.root,
 		deadline: ctx.deadline,
@@ -3697,10 +3794,35 @@ function discoverAllTestFiles(ctx, languageAdapters, buckets, fixtureDirMemo) {
 		},
 		isFull: () => languageAdapters.every((a) => (buckets.get(a.id)?.length ?? 0) >= ctx.maxFiles),
 		fixtureDirMemo,
-		onIgnored: ctx.onIgnored,
-		onUnrecognized: ctx.onUnrecognized
+		onIgnored: (path) => {
+			if (isScopeRelevantIgnored(path)) ctx.onIgnored?.(path);
+		},
+		onUnrecognized: (path) => {
+			if (typeof path === "string" && isUnrecognizedSourceCandidate(path)) ctx.onUnrecognized?.(path);
+		}
 	});
 }
+function isScopeRelevantIgnored(path) {
+	const name = path.replaceAll("\\", "/").split("/").pop() ?? path;
+	return /\.(?:[cm]?[jt]sx?|py|java|cs|ya?ml|min\.js)$/i.test(name);
+}
+function isUnrecognizedSourceCandidate(path) {
+	const normalized = path.replaceAll("\\", "/");
+	const name = normalized.split("/").pop() ?? normalized;
+	if (normalized.includes(".github/workflows/") || name === "azure-pipelines.yml" || name === "Jenkinsfile") return false;
+	const extensionIndex = name.lastIndexOf(".");
+	const stem = extensionIndex > 0 ? name.slice(0, extensionIndex) : name;
+	if (name === "mjolnir.config.json" || name === ".mjolnir.json" || name === "package.json" || name === "package-lock.json" || name === "pnpm-lock.yaml" || name === "yarn.lock" || [
+		"playwright",
+		"vitest",
+		"vite",
+		"eslint",
+		"tsconfig",
+		"jsconfig"
+	].some((prefix) => stem === prefix || stem.startsWith(`${prefix}.`))) return false;
+	const testLike = /(?:^|\/)__tests__\//i.test(normalized) || /\.(?:spec|test)\.[cm]?[jt]sx?$/i.test(name);
+	return /\.(?:[cm]?[jt]sx?|py|java|cs|ya?ml)$/i.test(name) && testLike;
+}
 /** Whether ANY shipped adapter would discover this path as a test file. */
 function isKnownTestFile(path) {
 	return SCAN_ADAPTERS.some((a) => a.isTestFile(path));
@@ -3764,17 +3886,14 @@ const SEARCHED_FOR = [
 * The fix: resolve git ONCE per process to an ABSOLUTE path by walking
 * the PATH directly (never consulting the CWD), verify the candidate is
 * an existing file, and pass that path to execFileSync. Resolution is
-* memoized; a failure to find a real git anywhere on PATH degrades to
-* the plain name (previous behavior) with the resolution error recorded
-* — degraded git data already means full-file attribution, never a
-* crash.
+* memoized; a failure to find a real git anywhere on PATH is recorded
+* and callers degrade without invoking a bare name.
 */
 let resolvedGit = void 0;
 /**
 * The absolute path of the git binary Mjölnir will invoke, or null when
-* PATH carries no executable `git` at all (S1 degradation: callers fall
-* back to the bare name and their own try/catch — same honest degrade
-* as before, minus the CWD-hijack surface).
+* PATH carries no executable `git` at all. Callers must degrade without
+* invoking a bare name.
 */
 function resolveGitPath() {
 	if (resolvedGit !== void 0) return resolvedGit;
@@ -3807,7 +3926,8 @@ function resolveGitPath() {
 * the previous inline `git()` helpers, with the hijack surface closed.
 */
 function runGit(root, args) {
-	const exe = resolveGitPath() ?? "git";
+	const exe = resolveGitPath();
+	if (!exe) return null;
 	try {
 		return execFileSync(exe, [
 			"-C",
@@ -3943,7 +4063,7 @@ function computeChangedScope(root, baseBranch) {
 				"--",
 				...chunk
 			]);
-			if (output === null) continue;
+			if (output === null) return null;
 			const sections = output.split("\ndiff --git ");
 			for (const section of sections) {
 				const body = section.startsWith("diff --git ") ? section : `diff --git ${section}`;
@@ -3971,6 +4091,11 @@ function computeChangedScope(root, baseBranch) {
 		"--unified=0",
 		"HEAD"
 	], changedFiles);
+	if (committedDiffs === null || workingDiffs === null) return {
+		changed: {},
+		degraded: true,
+		reason: "diff-failed"
+	};
 	for (const file of changedFiles) {
 		const committedDiff = committedDiffs.get(file);
 		const workingDiff = workingDiffs.get(file);
@@ -3996,8 +4121,11 @@ const LIMITS_MAX_LINES = 1e6;
 function allLinesOf(root, file) {
 	const full = join(root, file);
 	try {
-		if (statSync(full).size > LIMITS$1.maxFileBytes) return null;
-		const lineCount = readFileSync(full, "utf8").split("\n").length;
+		const stat = lstatSync(full);
+		if (stat.isSymbolicLink() || !stat.isFile()) return null;
+		const read = readFileBounded(full, LIMITS$1.maxFileBytes);
+		if (!read.ok) return null;
+		const lineCount = read.data.toString("utf8").split("\n").length;
 		return Array.from({ length: lineCount }, (_, i) => i + 1);
 	} catch {
 		return null;
@@ -12107,6 +12235,122 @@ function configurableAggregation(results, config) {
 	};
 }
 //#endregion
+//#region src/lib/fs-atomic.ts
+/**
+* Atomic file writes (audit S9).
+*
+* Every durability-critical write in Mjölnir (baseline, stats, badge,
+* TRIAGE.md, scaffolded rule files) used to hand-roll
+* `writeFileSync(path, data)` — a crash mid-write left a TRUNCATED file
+* at the real path, and a subsequent read (diff, badge endpoint) served
+* confident nonsense from it.
+*
+* `writeFileAtomic` writes to a temp sibling, then RENAMES. On the same
+* volume rename is atomic: readers see either the complete old file or
+* the complete new file, never a half-written one. The temp name is
+* created with `wx` (exclusive) so concurrent writers cannot interleave,
+* stale temps are cleaned up on failure, and on Windows the rename is
+* retried briefly because a concurrent reader can hold the destination
+* open (EBUSY/EPERM).
+*/
+function atomicTempPath(path) {
+	return `${path}.mjolnir-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}.tmp`;
+}
+/**
+* Atomically replace `path` with `data`.
+*/
+function writeFileAtomic(path, data, opts = {}) {
+	const dir = dirname(path);
+	if (opts.mkdirs !== false && !existsSync(dir)) mkdirSync(dir, { recursive: true });
+	const tmp = atomicTempPath(path);
+	let fd;
+	try {
+		fd = openSync(tmp, "wx", opts.mode ?? 420);
+		writeSync(fd, data, null, opts.encoding ?? "utf8");
+	} finally {
+		if (fd !== void 0) closeSync(fd);
+	}
+	try {
+		renameWithWindowsRetry(tmp, path);
+	} catch (err) {
+		try {
+			if (existsSync(tmp)) unlinkSync(tmp);
+		} catch {}
+		throw err;
+	}
+}
+/**
+* renameSync retry loop for Windows: a concurrent reader (another scan,
+* a badge endpoint, an editor) holding the destination open makes
+* rename fail with EBUSY/EPERM. A short bounded retry closes the race
+* without turning an atomic swap into a partial write.
+*
+* Internal contract test hook: the platform check keeps this loop off
+* the POSIX hot path; on win32 the EBUSY/EPERM arms are exercised by
+* the fs-atomic-retry spec (mocked renameSync).
+*/
+const RENAME_RETRIES = 8;
+const RENAME_RETRY_DELAY_MS = 25;
+/** Synchronous sleep that does not spin the CPU. */
+function sleepSync(ms) {
+	try {
+		Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+	} catch {
+		const until = Date.now() + ms;
+		while (Date.now() < until);
+	}
+}
+function renameWithWindowsRetry(from, to) {
+	for (let attempt = 0;; attempt++) try {
+		renameSync(from, to);
+		return;
+	} catch (err) {
+		const code = err?.code;
+		if (process.platform === "win32" && (code === "EBUSY" || code === "EPERM") && attempt < RENAME_RETRIES) {
+			sleepSync(RENAME_RETRY_DELAY_MS);
+			continue;
+		}
+		throw err;
+	}
+}
+const STALE_TEMP_AGE_MS = 864e5;
+const TEMP_PID_RE = /^.+\.mjolnir-([1-9]\d{0,9})-(\d{13})-[0-9a-f]{8}\.tmp$/;
+function sweepStaleTempFiles(dir) {
+	let swept = 0;
+	let entries;
+	try {
+		entries = readdirSync(dir);
+	} catch {
+		return 0;
+	}
+	const cutoff = Date.now() - STALE_TEMP_AGE_MS;
+	for (const entry of entries) {
+		const match = TEMP_PID_RE.exec(entry);
+		if (!match || Number(match[2]) > cutoff) continue;
+		const path = join(dir, entry);
+		try {
+			const stat = lstatSync(path);
+			if (!stat.isFile() || stat.mtimeMs > cutoff) continue;
+			if (pidAlive(Number(match[1]))) continue;
+			unlinkSync(path);
+			swept++;
+		} catch {
+			continue;
+		}
+	}
+	return swept;
+}
+function pidAlive(pid) {
+	if (!Number.isSafeInteger(pid) || pid <= 0 || pid > 2147483647) return true;
+	if (pid === process.pid) return true;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (err) {
+		return err?.code !== "ESRCH";
+	}
+}
+//#endregion
 //#region src/engine/scan-cache.ts
 /**
 * Local incremental scan cache (Beta-to-Stable 1.0 plan, M5.2 / A-2).
@@ -12142,6 +12386,17 @@ const MAX_ENTRIES$1 = 4096;
 * serialized size; the newest entries win (real LRU-by-use).
 */
 const MAX_TOTAL_BYTES = 33554432;
+const MAX_FINDINGS_PER_ENTRY = 1e4;
+function isCachedFinding(value) {
+	if (!isRecord(value)) return false;
+	return typeof value["ruleId"] === "string" && typeof value["category"] === "string" && typeof value["severity"] === "string" && typeof value["confidence"] === "string" && typeof value["findingType"] === "string" && typeof value["file"] === "string" && Number.isSafeInteger(value["line"]) && Number.isSafeInteger(value["column"]) && typeof value["message"] === "string" && typeof value["why"] === "string" && typeof value["fix"] === "string";
+}
+function isCacheFile(value) {
+	if (!isRecord(value) || value["version"] !== CACHE_VERSION) return false;
+	const entries = value["entries"];
+	if (!isRecord(entries) || Object.keys(entries).length > MAX_ENTRIES$1) return false;
+	return Object.values(entries).every((entry) => isRecord(entry) && Array.isArray(entry["findings"]) && entry["findings"].length <= MAX_FINDINGS_PER_ENTRY && entry["findings"].every(isCachedFinding));
+}
 /** sha256 hex of a string — the only hash this module needs. */
 function sha256(text) {
 	return createHash("sha256").update(text).digest("hex");
@@ -12240,12 +12495,15 @@ function createScanCache(root) {
 	let totalBytes = 0;
 	try {
 		if (existsSync(file)) {
-			entries = parseJsonFile(readFileSync(file, "utf8"), file, (v) => isRecord(v) && v["version"] === CACHE_VERSION && isRecord(v["entries"])).entries;
+			const stat = lstatSync(file);
+			if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_TOTAL_BYTES) throw new Error("invalid cache file");
+			entries = parseJsonFile(readFileSync(file, "utf8"), file, isCacheFile).entries;
 			for (const [k, v] of Object.entries(entries)) {
-				const size = JSON.stringify(v).length + k.length + 4;
+				const size = Buffer.byteLength(JSON.stringify(v), "utf8") + k.length + 4;
 				entryBytes.set(k, size);
 				totalBytes += size;
 			}
+			if (totalBytes > MAX_TOTAL_BYTES) throw new Error("cache byte budget exceeded");
 		}
 	} catch {
 		entries = {};
@@ -12271,11 +12529,13 @@ function createScanCache(root) {
 		},
 		store(key, findings, fileBudgetExceeded) {
 			if (fileBudgetExceeded) return;
+			if (findings.length > MAX_FINDINGS_PER_ENTRY) return;
+			const entryJson = JSON.stringify(findings);
+			const newBytes = Buffer.byteLength(entryJson, "utf8") + key.length + 4;
+			if (newBytes > MAX_TOTAL_BYTES) return;
 			const replacedBytes = entryBytes.get(key) ?? 0;
 			delete entries[key];
-			const entryJson = JSON.stringify(findings);
 			entries[key] = { findings: structuredClone(findings) };
-			const newBytes = entryJson.length + key.length + 4;
 			entryBytes.set(key, newBytes);
 			totalBytes = totalBytes - replacedBytes + newBytes;
 			let count = Object.keys(entries).length;
@@ -12292,10 +12552,10 @@ function createScanCache(root) {
 			if (!dirty) return;
 			try {
 				mkdirSync(dir, { recursive: true });
-				writeFileSync(file, JSON.stringify({
+				writeFileAtomic(file, JSON.stringify({
 					version: CACHE_VERSION,
 					entries
-				}), "utf8");
+				}), { encoding: "utf8" });
 			} catch {}
 		}
 	};
@@ -14276,6 +14536,31 @@ function loadPlugins(root, gateOpen = false) {
 * next catalog render (locked by tests/local-rules.spec.ts).
 */
 const LOCAL_RULES_DIR = "mjolnir-rules";
+const MAX_EXTERNAL_RULES = 1e3;
+const MAX_RULE_FILE_BYTES = 1048576;
+const MAX_PATTERNS_PER_RULE = 100;
+function hasNestedQuantifier(pattern) {
+	for (let i = 0; i < pattern.length; i++) {
+		if (pattern.charAt(i) !== "(") continue;
+		let bodyHasQuantifier = false;
+		let j = i + 1;
+		for (; j < pattern.length && pattern.charAt(j) !== ")"; j++) {
+			const bodyChar = pattern.charAt(j);
+			if (bodyChar === "+" || bodyChar === "*" || bodyChar === "?") {
+				bodyHasQuantifier = true;
+				break;
+			}
+		}
+		if (bodyHasQuantifier) {
+			while (j < pattern.length && pattern.charAt(j) !== ")") j++;
+			if (j + 1 < pattern.length) {
+				const next = pattern.charAt(j + 1);
+				if (next === "+" || next === "*" || next === "{") return true;
+			}
+		}
+	}
+	return false;
+}
 const ALLOWED_CATEGORIES = /* @__PURE__ */ new Set([
 	"QA-TEST",
 	"QA-TQUAL",
@@ -14305,7 +14590,7 @@ const ALLOWED_QA_IMPACTS = /* @__PURE__ */ new Set([
 * Missing directory → empty result (not an error — most workspaces
 * carry none).
 */
-async function loadLocalRules(root, gateOpen = true) {
+async function loadLocalRules(root, gateOpen = false) {
 	const result = {
 		rules: [],
 		errors: [],
@@ -14313,6 +14598,15 @@ async function loadLocalRules(root, gateOpen = true) {
 	};
 	const dir = join(root, LOCAL_RULES_DIR);
 	if (!existsSync(dir)) return result;
+	try {
+		if (lstatSync(dir).isSymbolicLink()) {
+			result.errors.push(`external rules directory "${LOCAL_RULES_DIR}/" is a symlink — skipped`);
+			return result;
+		}
+	} catch (err) {
+		result.errors.push(`external rules directory "${LOCAL_RULES_DIR}/" could not be inspected: ${err instanceof Error ? err.message : String(err)}`);
+		return result;
+	}
 	let entries;
 	try {
 		entries = readdirSync(dir);
@@ -14321,7 +14615,20 @@ async function loadLocalRules(root, gateOpen = true) {
 		return result;
 	}
 	for (const entry of entries.sort()) {
+		if (result.rules.length >= MAX_EXTERNAL_RULES) {
+			result.errors.push(`external rule budget exceeded (${MAX_EXTERNAL_RULES})`);
+			break;
+		}
 		const path = join(dir, entry);
+		try {
+			if (lstatSync(path).isSymbolicLink()) {
+				result.errors.push(`external rule "${LOCAL_RULES_DIR}/${entry}" is a symlink — skipped`);
+				continue;
+			}
+		} catch (err) {
+			result.errors.push(`external rule "${LOCAL_RULES_DIR}/${entry}" could not be inspected: ${err instanceof Error ? err.message : String(err)}`);
+			continue;
+		}
 		if (entry.endsWith(".json")) loadJsonRule(path, result);
 		else if (entry.endsWith(".mjs") || entry.endsWith(".js")) {
 			if (!gateOpen) result.skipped.push(`${LOCAL_RULES_DIR}/${entry}`);
@@ -14334,6 +14641,10 @@ function loadJsonRule(path, result) {
 	const name = `${LOCAL_RULES_DIR}/${path.split(/[\\/]/).pop()}`;
 	let raw;
 	try {
+		if (lstatSync(path).size > MAX_RULE_FILE_BYTES) {
+			result.errors.push(`external rule "${name}" exceeds the file size budget`);
+			return;
+		}
 		raw = JSON.parse(readFileSync(path, "utf8"));
 	} catch (err) {
 		result.errors.push(`external rule "${name}" is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
@@ -14354,7 +14665,7 @@ function loadJsonRule(path, result) {
 		return;
 	}
 	const patterns = decl["patterns"];
-	if (!Array.isArray(patterns) || patterns.length === 0 || !patterns.every((p) => typeof p === "string" && p.length > 0)) {
+	if (!Array.isArray(patterns) || patterns.length === 0 || patterns.length > MAX_PATTERNS_PER_RULE || !patterns.every((p) => typeof p === "string" && p.length > 0)) {
 		result.errors.push(`external rule ${id} must declare a non-empty "patterns" array of regex source strings.`);
 		return;
 	}
@@ -14370,6 +14681,10 @@ function loadJsonRule(path, result) {
 			result.errors.push(`external rule ${id} has a pattern longer than 512 chars — likely a copy-paste error.`);
 			return;
 		}
+		if (hasNestedQuantifier(p)) {
+			result.errors.push(`external rule ${id} has a nested quantifier that may cause catastrophic backtracking`);
+			return;
+		}
 		const quantifiers = p.match(/[+*?]|\{\d/g);
 		if (quantifiers && quantifiers.length > 64) {
 			result.errors.push(`external rule ${id} has a pattern with more than 64 quantifier/wildcard tokens — likely catastrophic backtracking.`);
@@ -14567,6 +14882,8 @@ var scan_pipeline_exports = /* @__PURE__ */ __exportAll({
 	summarizeForensicVerdicts: () => summarizeForensicVerdicts
 });
 const UNIVERSAL_RULES = RULES.map(asUniversal);
+const DEFAULT_MAX_DURATION_MS = 6e5;
+const MAX_DURATION_MS = 36e5;
 /** Registered rule IDs — used to warn on unknown severityOverrides keys (M4). */
 const KNOWN_RULE_IDS = new Set(RULES.map((r) => r.id));
 /**
@@ -14783,7 +15100,9 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 	let testDeclarationCount = 0;
 	let rulesPartial = false;
 	let parseFailed = 0;
+	let parseFallbacks = 0;
 	let scanned = 0;
+	let analyzed = 0;
 	for (const path of testFiles) {
 		if (Date.now() > deadline) {
 			rulesPartial = true;
@@ -14797,7 +15116,12 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 		if (!isCiAdapter) testFileCount++;
 		let text;
 		try {
-			text = readFileSync(path, "utf8").replace(/^\uFEFF/, "").replace(/\r\n?/g, "\n");
+			const readResult = readFileBounded(path, LIMITS$1.maxFileBytes);
+			if (!readResult.ok) {
+				skippedFiles++;
+				continue;
+			}
+			text = readResult.data.toString("utf8").replace(/^\uFEFF/, "").replace(/\r\n?/g, "\n");
 		} catch {
 			skippedFiles++;
 			continue;
@@ -14831,6 +15155,7 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 		const cachedFindings = cache.lookup(cacheKey);
 		if (cachedFindings) {
 			for (const f of cachedFindings) findings.push(f);
+			analyzed++;
 			continue;
 		}
 		hooks.onProgress?.({
@@ -14857,10 +15182,12 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 			}
 			const actualMode = parsed ? "ast" : "regex";
 			if (wantsAst && actualMode === "regex") {
+				parseFallbacks++;
 				cacheKey = fileCacheKey(rulesDigest, text, identity(actualMode));
 				const fallbackFindings = cache.lookup(cacheKey);
 				if (fallbackFindings) {
 					for (const f of fallbackFindings) findings.push(f);
+					analyzed++;
 					continue;
 				}
 			}
@@ -14891,8 +15218,10 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 					fileBudgetExceeded = true;
 				}
 			});
+			if (!fileRuleFailed && !fileBudgetExceeded) analyzed++;
 			if (!fileRuleFailed) cache.store(cacheKey, findings.slice(findingsStart), fileBudgetExceeded);
 		} catch {
+			if (wantsAst) parseFallbacks++;
 			skippedFiles++;
 			parseFailed++;
 		} finally {
@@ -14905,7 +15234,9 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 		testDeclarationCount,
 		rulesPartial,
 		parseFailed,
-		scanned
+		parseFallbacks,
+		scanned,
+		analyzed
 	};
 }
 /**
@@ -14983,6 +15314,7 @@ function applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, dec
 	for (const f of findings) f.fixGroupId = f.ruleId;
 	const discoveredReport = discoverAndParseRuntimeReport(scanRoot.root);
 	const runtimeReportPath = discoveredReport?.path;
+	const runtimeIncomplete = discoveredReport !== void 0 && discoveredReport.report.analysisComplete !== true;
 	let forensicVerdicts;
 	if (discoveredReport && discoveredReport.report.analysisComplete === true) try {
 		buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
@@ -14995,6 +15327,7 @@ function applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, dec
 		suppressionCount,
 		frameworks,
 		runtimeReportPath,
+		runtimeIncomplete,
 		forensicVerdicts,
 		config
 	};
@@ -15063,10 +15396,13 @@ function assembleScanResult(o) {
 	if (o.scopeIgnored > 0) scopeReasons.push(`ignored:${o.scopeIgnored}`);
 	if (o.scopeUnrecognized > 0) scopeReasons.push(`unrecognized:${o.scopeUnrecognized}`);
 	if (o.parseFailed > 0) scopeReasons.push(`parseFailed:${o.parseFailed}`);
+	if (o.skippedFiles > 0) scopeReasons.push(`skipped:${o.skippedFiles}`);
+	if (o.scopeInfo.degraded) scopeReasons.push(`degraded:${o.scopeInfo.degraded}`);
+	if (o.runtimeIncomplete) scopeReasons.push("runtime-incomplete");
 	for (const reason of o.truncationReasons) scopeReasons.push(`truncated:${reason}`);
 	const scopeIntegrity = {
 		discovered: o.testFiles.length,
-		analyzed: Math.max(0, o.scanned),
+		analyzed: Math.max(0, o.analyzed ?? o.scanned),
 		ignored: o.scopeIgnored,
 		unrecognized: o.scopeUnrecognized,
 		parseFailed: o.parseFailed,
@@ -15075,28 +15411,59 @@ function assembleScanResult(o) {
 		...scopeReasons.length > 0 ? { reasons: scopeReasons } : {}
 	};
 	const scopeAdjustedTotal = scopeReasons.length > 0 && total >= 100 ? 99 : total;
+	let identityIncomplete = false;
 	const inputSnapshot = o.testFiles.map((p) => {
 		const relPath = relative(o.workspace.root, p).replaceAll("\\", "/");
 		try {
-			const content = readFileSync(p);
-			const hash = createHash("sha256").update(content).digest("hex").slice(0, 16);
+			const read = readFileBounded(resolve(o.workspace.root, p), LIMITS$1.maxFileBytes);
+			if (!read.ok) {
+				if (existsSync(o.workspace.root)) identityIncomplete = true;
+				return {
+					path: relPath,
+					size: 0,
+					hash: "UNAVAILABLE"
+				};
+			}
+			const hash = createHash("sha256").update(read.data).digest("hex");
 			return {
 				path: relPath,
-				size: content.length,
+				size: read.data.length,
 				hash
 			};
 		} catch {
+			if (existsSync(o.workspace.root)) identityIncomplete = true;
 			return {
 				path: relPath,
-				size: 0
+				size: 0,
+				hash: "UNAVAILABLE"
 			};
 		}
 	});
 	let reportDigest;
 	if (o.runtimeReportPath) try {
-		const reportBytes = readFileSync(o.runtimeReportPath);
-		reportDigest = createHash("sha256").update(reportBytes).digest("hex").slice(0, 16);
-	} catch {}
+		const reportPath = resolve(o.workspace.root, o.runtimeReportPath);
+		if (lstatSync(reportPath).isFile()) {
+			const read = readFileBounded(reportPath, LIMITS$1.maxFileBytes);
+			if (!read.ok) identityIncomplete = true;
+			else reportDigest = createHash("sha256").update(read.data).digest("hex");
+		}
+	} catch {
+		identityIncomplete = true;
+	}
+	const completion = deriveCompletion({
+		discoveryTruncated: o.discoveryTruncated,
+		rulesPartial: o.rulesPartial,
+		skippedFiles: o.skippedFiles,
+		rulesCrashed: o.rulesCrashed,
+		truncationReasons: o.truncationReasons,
+		scopeIgnored: o.scopeIgnored,
+		scopeUnrecognized: o.scopeUnrecognized,
+		parseFailed: o.parseFailed,
+		parseFallbacks: o.parseFallbacks ?? 0,
+		...o.scopeInfo.degraded !== void 0 ? { scopeDegraded: o.scopeInfo.degraded } : {},
+		...o.runtimeIncomplete !== void 0 ? { runtimeIncomplete: o.runtimeIncomplete } : {},
+		identityIncomplete
+	});
 	const runIdentity = buildRunIdentity({
 		files: inputSnapshot,
 		rules: [...o.REVISION_BY_RULE_ID.entries()].map(([id, detectorRevision]) => ({
@@ -15114,13 +15481,14 @@ function assembleScanResult(o) {
 	const evidenceGraph = buildEvidenceGraph({ runId: runIdentity });
 	const hasTests = o.testFileCount > 0 && o.testDeclarationCount > 0;
 	const suiteInvalidatedBy = [...new Set(o.findings.filter((f) => SUITE_INVALIDATING_RULE_IDS.has(f.ruleId)).map((f) => f.ruleId))].sort();
+	const finalScore = hasTests ? completion.partial && scopeAdjustedTotal >= 100 ? 99 : scopeAdjustedTotal : null;
 	const result = {
 		schemaVersion: 1,
-		partial: o.discoveryTruncated || o.rulesPartial || o.skippedFiles > 0 || o.rulesCrashed > 0 || o.scopeInfo.degraded !== void 0,
+		partial: completion.partial,
 		scopeIntegrity,
 		runIdentity,
 		evidenceGraph,
-		score: hasTests ? scopeAdjustedTotal : null,
+		score: finalScore,
 		...hasTests ? {} : { reason: "no-tests-found" },
 		frameworks: o.frameworks.frameworks,
 		frameworkDetectionUnknown: o.frameworks.unknown,
@@ -15146,12 +15514,8 @@ function assembleScanResult(o) {
 			file: o.cache.stats.file
 		} } : {},
 		analysisStatus: {
-			discovery: o.discoveryTruncated ? "partial" : "complete",
-			rules: o.rulesPartial ? "partial" : "complete",
-			skippedFiles: o.skippedFiles,
-			durationMs: elapsed,
-			rulesCrashed: o.rulesCrashed,
-			...o.truncationReasons.size > 0 ? { truncationReasons: [...o.truncationReasons].sort() } : {}
+			...completion.analysisStatus,
+			durationMs: elapsed
 		},
 		scoringModelVersion: SCORING_MODEL_VERSION
 	};
@@ -15199,7 +15563,8 @@ function assembleScanResult(o) {
 */
 async function runScan(args, hooks = {}) {
 	const started = Date.now();
-	const deadline = started + args.maxDurationMs;
+	const requestedDuration = Number.isFinite(args.maxDurationMs) ? args.maxDurationMs : DEFAULT_MAX_DURATION_MS;
+	const deadline = started + Math.min(Math.max(1, requestedDuration), MAX_DURATION_MS);
 	const discovered = discoverWorkspace(args.target);
 	const targetAbs = resolve(args.target);
 	const scanRoot = discovered && discovered.root !== targetAbs && targetAbs.startsWith(discovered.root + sep) ? {
@@ -15288,7 +15653,9 @@ async function runScan(args, hooks = {}) {
 	testDeclarationCount = analysis.testDeclarationCount;
 	rulesPartial = analysis.rulesPartial;
 	parseFailed = analysis.parseFailed;
+	const parseFallbacks = analysis.parseFallbacks;
 	const scanned = analysis.scanned;
+	const analyzed = analysis.analyzed;
 	const postScan = applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, declarationsByFile, testDeclarationCount, tierByRuleId, REVISION_BY_RULE_ID);
 	testDeclarationCount = postScan.testDeclarationCount;
 	const result = assembleScanResult({
@@ -15304,7 +15671,9 @@ async function runScan(args, hooks = {}) {
 		scopeIgnored,
 		scopeUnrecognized,
 		parseFailed,
+		parseFallbacks,
 		scanned,
+		analyzed,
 		testFiles,
 		workspace,
 		scanRoot,
@@ -15317,6 +15686,7 @@ async function runScan(args, hooks = {}) {
 		suppressionCount: postScan.suppressionCount,
 		frameworks: postScan.frameworks,
 		runtimeReportPath: postScan.runtimeReportPath,
+		runtimeIncomplete: postScan.runtimeIncomplete,
 		forensicVerdicts: postScan.forensicVerdicts,
 		config: postScan.config,
 		fileProvenance,
@@ -15329,4 +15699,4 @@ async function runScan(args, hooks = {}) {
 	return result;
 }
 //#endregion
-export { massCeiling as $, box as A, isAdvisoryFinding as At, headlineFor as B, buildFooter as C, buildEvidenceGraph as Ct, plainContext as D, RULE_CATEGORIES as Dt, panel as E, QA_IMPACT_LABELS as Et, scoreGauge as F, buildDependencyGraph as G, EVIDENCE as H, shouldColorize as I, classifyProvenance as J, getReachableFiles as K, shouldUseAscii as L, padTo as M, palette as N, sectionHeader as O, SEVERITY_ORDER as Ot, sanitizeData as P, deductionFor as Q, wrapText as R, FLAKE_GLYPH as S, ENGINE_VERSION as St, okIcon as T, DEDUCTIONS as Tt, TINT as U, BADGE_BAND as V, TRUST as W, capForTier as X, computeAgenticProfile as Y, computeDimensions as Z, summarizeForensicVerdicts as _, ConfigValidationError as _t, applyPostScanProcessing as a, SEARCHED_FOR as at, renderSuppressions as b, isRecord as bt, discoverAndParseRuntimeReport as c, parseWorkflow as ct, isValidFindingRecord as d, parseTsFile as dt, RETIRED_RULE_IDS as et, pathMatchesGlob as f, detectFrameworks as ft, selectAdapter as g, isLintFixtureDir as gt, scan_pipeline_exports as h, globToRegExp as ht, SUITE_INVALIDATING_RULE_IDS as i, SCAN_ADAPTERS as it, measure as j, isValidCategory as jt, severityIcon as k, deriveEvidenceLevel as kt, discoverTestFilesPhase as l, parseYamlGuarded as lt, runScan as m, createIgnoreMatcher as mt, KNOWN_RULE_IDS as n, getRule as nt, assembleScanResult as o, isAzurePipelineFixture as ot, runFileAnalysisPhase as p, DEFAULT_IGNORE_MATCHER as pt, correlateFindings as q, OVERLAP_META_BY_RULE_ID as r, resolveGitPath as rt, buildUniversalRules as s, parseAzurePipeline as st, EVIDENCE_OVERRIDES as t, RULES as tt, fallbackWorkspace as u, computeCodeText as ut, loadLocalRules as v, isSuppressionActive as vt, nextStep as w, MEASURED_FP as wt, runForensics as x, parseJsonFile as xt, loadSuppressions as y, loadConfig as yt, deriveScoreState as z };
+export { correlateFindings as $, plainContext as A, parseJsonFile as At, shouldUseAscii as B, isValidCategory as Bt, runForensics as C, globToRegExp as Ct, nextStep as D, loadConfig as Dt, buildFooter as E, isSuppressionActive as Et, padTo as F, QA_IMPACT_LABELS as Ft, EVIDENCE as G, deriveScoreState as H, palette as I, RULE_CATEGORIES as It, atomicTempPath as J, TINT as K, sanitizeData as L, SEVERITY_ORDER as Lt, severityIcon as M, buildEvidenceGraph as Mt, box as N, MEASURED_FP as Nt, okIcon as O, readFileBounded as Ot, measure as P, DEDUCTIONS as Pt, getReachableFiles as Q, scoreGauge as R, deriveEvidenceLevel as Rt, renderSuppressions as S, createIgnoreMatcher as St, FLAKE_GLYPH as T, ConfigValidationError as Tt, headlineFor as U, wrapText as V, BADGE_BAND as W, writeFileAtomic as X, sweepStaleTempFiles as Y, buildDependencyGraph as Z, summarizeForensicVerdicts as _, computeCodeText as _t, applyPostScanProcessing as a, massCeiling as at, loadLocalRules as b, DEFAULT_IGNORE_MATCHER as bt, discoverAndParseRuntimeReport as c, getRule as ct, isValidFindingRecord as d, SCAN_ADAPTERS as dt, classifyProvenance as et, pathMatchesGlob as f, SEARCHED_FOR as ft, selectAdapter as g, parseYamlGuarded as gt, scan_pipeline_exports as h, parseWorkflow as ht, SUITE_INVALIDATING_RULE_IDS as i, deductionFor as it, sectionHeader as j, ENGINE_VERSION as jt, panel as k, isRecord as kt, discoverTestFilesPhase as l, resolveGitPath as lt, runScan as m, parseAzurePipeline as mt, KNOWN_RULE_IDS as n, capForTier as nt, assembleScanResult as o, RETIRED_RULE_IDS as ot, runFileAnalysisPhase as p, isAzurePipelineFixture as pt, TRUST as q, OVERLAP_META_BY_RULE_ID as r, computeDimensions as rt, buildUniversalRules as s, RULES as st, EVIDENCE_OVERRIDES as t, computeAgenticProfile as tt, fallbackWorkspace as u, runGit as ut, pluginsGateOpen as v, parseTsFile as vt, sanitizeErrorText as w, isLintFixtureDir as wt, loadSuppressions as x, LIMITS$1 as xt, renderGateNotice as y, detectFrameworks as yt, shouldColorize as z, isAdvisoryFinding as zt };