paqad-ai 1.41.0 → 1.41.1

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # paqad-ai
 
+## 1.41.1
+
+### Patch Changes
+
+- 2137219: Rule-script whole-tree scan now respects `.gitignore`. Previously the scanner
+  enumerated the working tree with a fixed ignore list (`node_modules`, `dist`,
+  `.paqad`, `build`) and never consulted the project's `.gitignore`, so gitignored
+  build output, vendored dependencies, and generated code were still scanned —
+  producing `deterministic` findings on files the developer cannot hand-fix and
+  blocking the strict `rule_compliance` gate. The scan now drops git-ignored paths
+  via a batched `git check-ignore` (falling back to the static list when git is
+  unavailable), and adds `vendor/` to that fallback list.
+
 ## 1.41.0
 
 ### Minor Changes

package/dist/cli/index.js

@@ -26076,7 +26076,7 @@ init_cancelled_error();
 init_events();
 
 // src/index.ts
-var VERSION = "1.41.0";
+var VERSION = "1.41.1";
 
 // src/cli/commands/audit.ts
 init_esm_shims();

package/dist/index.js

@@ -22735,7 +22735,7 @@ var memoizedReport;
 function getEngineVersionReport() {
   if (memoizedReport === void 0) {
     memoizedReport = Object.freeze({
-      engineVersion: normalizeEngineVersion("1.41.0"),
+      engineVersion: normalizeEngineVersion("1.41.1"),
       minConsumerVersion: MIN_CONSUMER_VERSION,
       deprecatedAsOf: DEPRECATED_AS_OF
     });
@@ -39119,7 +39119,7 @@ function formatVerdictSummary(input2) {
 
 // src/verification/repository/run-repository-verification.ts
 function verifierVersion() {
-  return true ? "1.41.0" : "0.0.0-dev";
+  return true ? "1.41.1" : "0.0.0-dev";
 }
 function backstopGates() {
   return [
@@ -41853,7 +41853,7 @@ var WorkflowEngine = class {
 };
 
 // src/index.ts
-var VERSION = "1.41.0";
+var VERSION = "1.41.1";
 function getFrameworkName() {
   return "paqad-ai";
 }

package/dist/kernel/gate.js

@@ -5845,6 +5845,7 @@ function serializeRuleScriptMap(map) {
 }
 
 // src/rule-scripts/runner.ts
+import { execFileSync } from "child_process";
 import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync10, mkdirSync as mkdirSync9, readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
 import { dirname as dirname8, join as join14 } from "path";
@@ -6094,7 +6095,7 @@ function recordRuleFindings(projectRoot, evidence) {
 
 // src/rule-scripts/runner.ts
 var DEFAULT_GLOBS = ["**/*.{ts,tsx,js,jsx,mjs,cjs,vue,svelte}"];
-var IGNORE = ["**/node_modules/**", "**/dist/**", "**/.paqad/**", "**/build/**"];
+var IGNORE = ["**/node_modules/**", "**/dist/**", "**/.paqad/**", "**/build/**", "**/vendor/**"];
 function sha256(input) {
   return createHash3("sha256").update(input).digest("hex");
 }
@@ -6111,8 +6112,22 @@ function scriptFilesHash(projectRoot, map) {
   const paths = map.rules.flatMap((r) => r.scripts.map((s) => s.path)).sort();
   return hashFiles(projectRoot, paths);
 }
+function dropGitIgnored(projectRoot, files) {
+  try {
+    const out = execFileSync("git", ["check-ignore", "-z", "--stdin"], {
+      cwd: projectRoot,
+      input: files.join("\0"),
+      stdio: ["pipe", "pipe", "ignore"]
+    });
+    const ignored = new Set(out.toString("utf8").split("\0").filter(Boolean));
+    return files.filter((f) => !ignored.has(f));
+  } catch {
+    return files;
+  }
+}
 function wholeTree(projectRoot, globs) {
-  return fg.sync(globs, { cwd: projectRoot, ignore: IGNORE, onlyFiles: true }).sort();
+  const listed = fg.sync(globs, { cwd: projectRoot, ignore: IGNORE, onlyFiles: true });
+  return dropGitIgnored(projectRoot, listed).sort();
 }
 function targetsFor(script, opts, wholeTreeFiles) {
   if (script.scope === "changed-files" && opts.changedFiles) {