vigiles 13.0.0 → 14.1.0

package/dist/core/rule-catalog.js

@@ -0,0 +1,294 @@
+"use strict";
+/**
+ * vigiles rule-catalog — the DYNAMIC available-rule catalog.
+ *
+ * Enumerates every lint rule the repo's linter ACTUALLY has — core built-ins PLUS
+ * every installed plugin's rules — so prose can be matched against the LIVE
+ * catalog instead of a static hand-curated map. On this repo one ESLint API call
+ * yields ~702 available rules (292 core + 410 plugin: typescript-eslint / sonarjs
+ * / boundaries), of which ~140 are enabled — vs the old static map's ~23. That
+ * makes an architecture norm enforceable too (`boundaries/dependencies` is in the
+ * catalog), which a static map never captured. See
+ * `research/rule-compiler-multilang-design.md` §0 (the spike this productizes).
+ *
+ * SAFETY — this EXECUTES the linter. Loading ESLint resolves the repo's real
+ * config (which can run plugin/config code), so `enumerateEslintCatalog` is an
+ * OWN-REPO / consented capability, NOT the foreign-safe default. The deterministic
+ * default rule-compile tier stays purely TEXTUAL (it parses config, never loads
+ * it); reach for this only where executing the repo's toolchain is already
+ * consented (own repo, on the user's machine). Mirrors the subprocess pattern of
+ * `discoverEslintRules` in `src/core/generate-types.ts`: ESLint is loaded in a
+ * child `node -e` process at the repo's cwd so it stays out of our process.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseEslintCatalog = parseEslintCatalog;
+exports.parsePylintCatalog = parsePylintCatalog;
+exports.mergeCatalogs = mergeCatalogs;
+exports.enumerateEslintCatalog = enumerateEslintCatalog;
+exports.enumeratePylintCatalog = enumeratePylintCatalog;
+const node_path_1 = require("node:path");
+const node_child_process_1 = require("node:child_process");
+// ---------------------------------------------------------------------------
+// Pure parse: subprocess JSON → typed catalog (covered by the unit test)
+// ---------------------------------------------------------------------------
+function isStringArray(v) {
+    return Array.isArray(v) && v.every((x) => typeof x === "string");
+}
+function parsePlugins(v) {
+    if (typeof v !== "object" || v === null)
+        return {};
+    const out = {};
+    for (const [prefix, rules] of Object.entries(v)) {
+        if (isStringArray(rules))
+            out[prefix] = rules;
+    }
+    return out;
+}
+function buildRules(core, plugins, enabledSet) {
+    const rules = [];
+    for (const id of core) {
+        rules.push({
+            id,
+            linter: "eslint",
+            plugin: null,
+            enabled: enabledSet.has(id),
+        });
+    }
+    for (const [prefix, pluginRules] of Object.entries(plugins)) {
+        for (const rule of pluginRules) {
+            const id = `${prefix}/${rule}`;
+            rules.push({
+                id,
+                linter: "eslint",
+                plugin: prefix,
+                enabled: enabledSet.has(id),
+            });
+        }
+    }
+    return rules;
+}
+/**
+ * Parse the enumeration subprocess's JSON payload into a typed {@link RuleCatalog}.
+ *
+ * Payload shape: `{ core: string[]; enabled: string[]; plugins: Record<prefix, string[]> }`.
+ * Returns null on `"null"` / malformed input / an empty catalog (mirrors
+ * `discoverEslintRules` returning null when nothing is found).
+ */
+function parseEslintCatalog(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed === "null")
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return null;
+    const obj = parsed;
+    const core = isStringArray(obj.core) ? obj.core : [];
+    const enabledList = isStringArray(obj.enabled) ? obj.enabled : [];
+    const plugins = parsePlugins(obj.plugins);
+    const rules = buildRules(core, plugins, new Set(enabledList));
+    if (rules.length === 0)
+        return null;
+    const enabled = rules.reduce((n, r) => (r.enabled ? n + 1 : n), 0);
+    return { linter: "eslint", available: rules.length, enabled, rules };
+}
+// ---------------------------------------------------------------------------
+// Pure parse: pylint's text listings → typed catalog (covered by the unit test)
+// ---------------------------------------------------------------------------
+// A message line in `pylint --list-msgs`: `:invalid-name (C0103): *...*`
+// (leading colon, no indent). In `--list-msgs-enabled`: `  invalid-name (C0103)`
+// (indented, no colon). One regex captures the `name (CODE)` core of both.
+const PYLINT_MSG_RE = /^\s*:?([a-z][a-z0-9-]*)\s+\(([A-Z]\d+)\)/;
+/** Collect the symbol names under the `Enabled messages:` header ONLY.
+ *
+ * `--list-msgs-enabled` also prints `Disabled messages:` and `Non-emittable
+ * messages:` sections with the SAME `name (CODE)` line shape, so a naive
+ * line-shape parse would mislabel disabled rules as enabled. Track the current
+ * section: a non-indented line ending in `:` is a header; only lines while the
+ * "enabled" header is active count. */
+function parseEnabledSymbols(listEnabled) {
+    const enabled = new Set();
+    let inEnabled = false;
+    for (const line of listEnabled.split("\n")) {
+        // A section header is a flush-left line ending in a colon (e.g.
+        // "Enabled messages:", "Disabled messages:"). Indented message lines never
+        // start at column 0, so this never eats a rule.
+        if (/^\S.*:\s*$/.test(line)) {
+            inEnabled = /^enabled messages:/i.test(line.trim());
+            continue;
+        }
+        if (!inEnabled)
+            continue;
+        const m = PYLINT_MSG_RE.exec(line);
+        if (m)
+            enabled.add(m[1]);
+    }
+    return enabled;
+}
+/**
+ * Parse pylint's `--list-msgs` (available) + `--list-msgs-enabled` (enabled)
+ * text listings into a typed {@link RuleCatalog}.
+ *
+ * The available set is every emittable message (`:name (CODE):` lines); enabled
+ * is the section-scoped subset. Each rule is matchable by BOTH its symbolic name
+ * (`id`) and its numeric code (`code`), since a doc may name either. Returns null
+ * when no message parses (pylint absent, or malformed output).
+ */
+function parsePylintCatalog(listMsgs, listEnabled) {
+    const enabledSet = parseEnabledSymbols(listEnabled);
+    const rules = [];
+    const seen = new Set();
+    for (const line of listMsgs.split("\n")) {
+        // Available lines carry a leading colon; skip anything else (headers, the
+        // wrapped description lines, blank lines).
+        if (!line.startsWith(":"))
+            continue;
+        const m = PYLINT_MSG_RE.exec(line);
+        if (!m)
+            continue;
+        const [, name, code] = m;
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        rules.push({
+            id: name,
+            linter: "pylint",
+            plugin: null,
+            code,
+            enabled: enabledSet.has(name),
+        });
+    }
+    if (rules.length === 0)
+        return null;
+    const enabled = rules.reduce((n, r) => (r.enabled ? n + 1 : n), 0);
+    return { linter: "pylint", available: rules.length, enabled, rules };
+}
+// ---------------------------------------------------------------------------
+// Merge: a polyglot repo (JS + Python) yields two catalogs → one for routing
+// ---------------------------------------------------------------------------
+/**
+ * Merge the catalogs of every linter a repo has into ONE catalog for routing.
+ *
+ * KEEPS EVERY entry — a polyglot repo genuinely has a rule in each linter, so an
+ * id shared across ESLint and Pylint (`no-else-return`) is two real rules and
+ * both are retained (never dropped by id, the bug that let a Python doc inherit
+ * ESLint's state). Collision handling belongs at the ROUTING lookup, not here: a
+ * bare id that resolves to two hits is combined conservatively there, while a
+ * numeric code (unique to its linter) keeps its own hit — see `buildCatalogLookup`
+ * in rule-routing.ts. So the merge is a plain concatenation; each rule carries its
+ * own `linter`/`enabled`/`code` provenance. Returns undefined when nothing was
+ * enumerated (so a non-JS-non-Python repo is byte-identical to before this existed).
+ */
+function mergeCatalogs(...cats) {
+    const present = cats.filter((c) => c != null);
+    if (present.length === 0)
+        return undefined;
+    if (present.length === 1)
+        return present[0];
+    const rules = present.flatMap((c) => c.rules);
+    const enabled = rules.reduce((n, r) => (r.enabled ? n + 1 : n), 0);
+    return {
+        linter: present[0].linter,
+        available: rules.length,
+        enabled,
+        rules,
+    };
+}
+// ---------------------------------------------------------------------------
+// Real-IO seam: run ESLint in a child process at the repo's cwd
+// ---------------------------------------------------------------------------
+/* v8 ignore start -- spawns a `node -e` subprocess that LOADS ESLint in the
+   repo's cwd (the executes-the-linter seam); the pure JSON→typed parse is
+   parseEslintCatalog, covered by the unit test, and the gated integration test
+   drives this real path when eslint resolves. */
+/**
+ * Enumerate the repo's available ESLint rules (core + every installed plugin).
+ *
+ * EXECUTES the repo's ESLint in a child process — an own-repo / consented
+ * capability (see the file header). Returns null if ESLint isn't resolvable, no
+ * config applies, or the subprocess fails.
+ */
+function enumerateEslintCatalog(root) {
+    try {
+        // A `.ts` path under src/ so the repo's flat config applies its TypeScript +
+        // plugin blocks (typescript-eslint / sonarjs / boundaries all scope to
+        // `src/**/*.ts`); the path need not exist — calculateConfigForFile resolves
+        // the config, it does not read the file.
+        const probeFile = (0, node_path_1.resolve)(root, "src/index.ts");
+        const script = `
+      const { loadESLint } = require("eslint");
+      const { builtinRules } = require("eslint/use-at-your-own-risk");
+      (async () => {
+        try {
+          const ESLint = await loadESLint();
+          const eslint = new ESLint({ cwd: ${JSON.stringify(root)} });
+          const cfg = await eslint.calculateConfigForFile(${JSON.stringify(probeFile)});
+          const core = [...builtinRules.keys()];
+          const enabled = Object.entries(cfg.rules || {})
+            .filter(([, v]) => {
+              const sev = Array.isArray(v) ? v[0] : v;
+              return sev !== 0 && sev !== "off";
+            })
+            .map(([k]) => k);
+          const plugins = {};
+          for (const [prefix, plugin] of Object.entries(cfg.plugins || {})) {
+            plugins[prefix] = Object.keys((plugin && plugin.rules) || {});
+          }
+          console.log(JSON.stringify({ core, enabled, plugins }));
+        } catch (e) {
+          console.log("null");
+        }
+      })();
+    `;
+        const output = (0, node_child_process_1.execSync)(`node -e '${script.replace(/'/g, "'\\''")}'`, {
+            encoding: "utf-8",
+            cwd: root,
+            stdio: ["pipe", "pipe", "pipe"],
+            timeout: 15000,
+        });
+        return parseEslintCatalog(output);
+    }
+    catch {
+        return null;
+    }
+}
+/* v8 ignore stop */
+// ---------------------------------------------------------------------------
+// Real-IO seam: run pylint in a child process at the repo's cwd
+// ---------------------------------------------------------------------------
+/* v8 ignore start -- spawns the repo's `pylint` twice (the executes-the-linter
+   seam); the pure text→typed parse is parsePylintCatalog, covered by the unit
+   test, and the gated integration test drives this real path when pylint is on
+   PATH. */
+/**
+ * Enumerate the repo's available Pylint messages (core + every loaded plugin)
+ * and their enabled state, via `pylint --list-msgs` + `--list-msgs-enabled`.
+ *
+ * Run at the repo's cwd so its rcfile (`.pylintrc` / `pyproject.toml` /
+ * `setup.cfg`) and `load-plugins` apply — so the listing reflects the repo's
+ * REAL rule set, plugins included, with correct enabled state. Like the ESLint
+ * catalog this EXECUTES the linter (loading a pylint plugin imports its module),
+ * so it's an OWN-REPO / consented capability, NOT the foreign-safe default.
+ * Returns null when pylint isn't runnable or lists nothing.
+ */
+function enumeratePylintCatalog(root) {
+    const run = (args) => (0, node_child_process_1.execSync)(`pylint ${args}`, {
+        encoding: "utf-8",
+        cwd: root,
+        stdio: ["pipe", "pipe", "pipe"],
+        timeout: 15000,
+    });
+    try {
+        return parsePylintCatalog(run("--list-msgs"), run("--list-msgs-enabled"));
+    }
+    catch {
+        return null;
+    }
+}
+/* v8 ignore stop */
+//# sourceMappingURL=rule-catalog.js.map

package/dist/eval.d.ts

@@ -755,7 +755,19 @@ export interface EvalDriver {
      */
     readonly harness?: string;
 }
-/** The default (Claude Code) eval driver: real `claude` + stream-json parsing. */
+/**
+ * The default (Claude Code) eval driver: real `claude` + stream-json parsing.
+ *
+ * This lives at the COMPOSITION ROOT (`src/eval.ts`) on purpose, not in
+ * `src/adapters/claude-code/` — it is NOT a boundary leak. Claude Code is the
+ * wired DEFAULT (`measureTriggerRate`/`runEval` fall back to it), so `eval.ts`
+ * must reference it directly; wiring the default is precisely a composition
+ * root's job. `codexEvalDriver` lives in its adapter dir instead because Codex
+ * is caller-INJECTED (never a default), so `eval.ts` never imports it. Relocating
+ * this into the adapter would make `eval.ts → adapters/claude-code → eval.ts` a
+ * circular import (the shared `EvalDriver`/`ModelOutputParser` types live here).
+ * The asymmetry reflects default-vs-injected, not a hexagonal violation.
+ */
 export declare const claudeEvalDriver: EvalDriver;
 /**
  * Package loose `<skillsDir>/<name>/SKILL.md` skills into a throwaway plugin dir

package/dist/eval.js

@@ -1240,7 +1240,19 @@ function formatEvalReport(report) {
     }
     return lines.join("\n");
 }
-/** The default (Claude Code) eval driver: real `claude` + stream-json parsing. */
+/**
+ * The default (Claude Code) eval driver: real `claude` + stream-json parsing.
+ *
+ * This lives at the COMPOSITION ROOT (`src/eval.ts`) on purpose, not in
+ * `src/adapters/claude-code/` — it is NOT a boundary leak. Claude Code is the
+ * wired DEFAULT (`measureTriggerRate`/`runEval` fall back to it), so `eval.ts`
+ * must reference it directly; wiring the default is precisely a composition
+ * root's job. `codexEvalDriver` lives in its adapter dir instead because Codex
+ * is caller-INJECTED (never a default), so `eval.ts` never imports it. Relocating
+ * this into the adapter would make `eval.ts → adapters/claude-code → eval.ts` a
+ * circular import (the shared `EvalDriver`/`ModelOutputParser` types live here).
+ * The asymmetry reflects default-vs-injected, not a hexagonal violation.
+ */
 exports.claudeEvalDriver = {
     runner: spawnAgent,
     parse: parseClaudeRun,

package/dist/instruction-sources.d.ts

@@ -0,0 +1,39 @@
+/**
+ * instruction-sources.ts — the pure policy for WHICH instruction files the audit
+ * rule-routing preview reads.
+ *
+ * A repo's real subdirectory memory (`src/CLAUDE.md`, `research/CLAUDE.md`, a
+ * nested `AGENTS.md`) IS worth routing; a fixture/demo/build/test CLAUDE.md is
+ * NOISE that would flood the preview. `isFixturePath` is the precision-first
+ * discriminator (over-skip a legit `sample-service` before flooding with fixture
+ * rules). Pure + unit-tested; the fs discovery/glue lives in cli.ts
+ * (`gatherInstructionFiles`). See research/rule-compiler-multilang-design.md §0.
+ */
+/** One instruction file gathered from disk, with its canonical (symlink-resolved)
+ * path so a mirror can be detected. */
+export interface RawInstructionFile {
+    /** The repo-relative path (kept for provenance). */
+    readonly path: string;
+    /** The realpath (symlink-resolved) — a symlinked mirror shares this. */
+    readonly canonical: string;
+    readonly text: string;
+}
+/**
+ * Dedup instruction files so a `CLAUDE.md`⇄`AGENTS.md` MIRROR is routed ONCE, not
+ * double-counted (compose-with-sync-tools: a symlinked or byte-identical synced
+ * mirror is ONE logical artifact). Dedups by BOTH the canonical path (a symlink)
+ * AND the content hash (a byte-identical sync) — relative-path dedup alone caught
+ * neither. First occurrence wins (callers pass root files first). Pure.
+ */
+export declare function dedupeInstructionFiles(files: readonly RawInstructionFile[]): {
+    path: string;
+    text: string;
+}[];
+/**
+ * Is this (repo-relative) instruction-file path fixture/demo/build/test noise?
+ * True when any DIRECTORY segment (never the filename) is a build/deps/test dir
+ * OR starts with a demo/example/sample/fixture/bench/mock/scratch/tmp prefix.
+ * Conventional + general (not vigiles-specific), precision over recall.
+ */
+export declare function isFixturePath(relPath: string): boolean;
+//# sourceMappingURL=instruction-sources.d.ts.map

package/dist/instruction-sources.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * instruction-sources.ts — the pure policy for WHICH instruction files the audit
+ * rule-routing preview reads.
+ *
+ * A repo's real subdirectory memory (`src/CLAUDE.md`, `research/CLAUDE.md`, a
+ * nested `AGENTS.md`) IS worth routing; a fixture/demo/build/test CLAUDE.md is
+ * NOISE that would flood the preview. `isFixturePath` is the precision-first
+ * discriminator (over-skip a legit `sample-service` before flooding with fixture
+ * rules). Pure + unit-tested; the fs discovery/glue lives in cli.ts
+ * (`gatherInstructionFiles`). See research/rule-compiler-multilang-design.md §0.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dedupeInstructionFiles = dedupeInstructionFiles;
+exports.isFixturePath = isFixturePath;
+const hash_js_1 = require("./core/hash.js");
+/**
+ * Dedup instruction files so a `CLAUDE.md`⇄`AGENTS.md` MIRROR is routed ONCE, not
+ * double-counted (compose-with-sync-tools: a symlinked or byte-identical synced
+ * mirror is ONE logical artifact). Dedups by BOTH the canonical path (a symlink)
+ * AND the content hash (a byte-identical sync) — relative-path dedup alone caught
+ * neither. First occurrence wins (callers pass root files first). Pure.
+ */
+function dedupeInstructionFiles(files) {
+    const seenReal = new Set();
+    const seenHash = new Set();
+    const out = [];
+    for (const f of files) {
+        if (seenReal.has(f.canonical))
+            continue; // symlinked mirror
+        const hash = (0, hash_js_1.sha256short)(f.text);
+        if (seenHash.has(hash))
+            continue; // byte-identical synced mirror
+        seenReal.add(f.canonical);
+        seenHash.add(hash);
+        out.push({ path: f.path, text: f.text });
+    }
+    return out;
+}
+/** Directory segments that are unambiguously build / deps / test noise. */
+const FIXTURE_DIR_EXACT = new Set([
+    "node_modules",
+    "dist",
+    "build",
+    "out",
+    "coverage",
+    ".git",
+    ".next",
+    ".cache",
+    "test",
+    "tests",
+    "__tests__",
+    "__fixtures__",
+    "__mocks__",
+    "vendor",
+    "third_party",
+]);
+/** Directory-name PREFIXES that mark a fixture / demo / sample / scratch dir.
+ * Case-INSENSITIVE so `Examples/`, `Demo/` are skipped too. */
+const FIXTURE_DIR_PREFIX = /^(?:demo|example|sample|fixture|bench|benchmark|mock|stub|scratch|tmp|\.tmp)/i;
+/**
+ * Is this (repo-relative) instruction-file path fixture/demo/build/test noise?
+ * True when any DIRECTORY segment (never the filename) is a build/deps/test dir
+ * OR starts with a demo/example/sample/fixture/bench/mock/scratch/tmp prefix.
+ * Conventional + general (not vigiles-specific), precision over recall.
+ */
+function isFixturePath(relPath) {
+    const segs = relPath.split(/[/\\]/).slice(0, -1); // directories only
+    return segs.some((s) => FIXTURE_DIR_EXACT.has(s.toLowerCase()) || FIXTURE_DIR_PREFIX.test(s));
+}
+//# sourceMappingURL=instruction-sources.js.map

package/dist/rule-inventory.d.ts

@@ -84,6 +84,12 @@ export interface RuleInventoryOptions {
  * non-`[\w/@.-]` character on each side (so `no-console` matches in
  * `` `no-console` `` and `enforce no-console;` but `no-console-x` does not,
  * and prose containing the substring elsewhere never trips it).
+ *
+ * The TRAILING boundary is a lookahead, not a consuming class, so a keyword at
+ * SENTENCE END ("No wildcard imports.") matches: a `.` is allowed unless it
+ * CONTINUES a code token (`.log` in `console.log`), which still blocks a partial
+ * match. `(?![\w/@-])` rejects a word/`/`/`@`/`-` continuation; `(?!\.[\w/@-])`
+ * rejects a dotted continuation but permits a trailing sentence `.`.
  */
 export declare function matchesWholeToken(text: string, keyword: string): boolean;
 export declare function buildRuleInventory(instructionText: string, configText: string, options?: RuleInventoryOptions): RuleInventoryItem[];

package/dist/rule-inventory.js

@@ -37,6 +37,12 @@ exports.buildRuleInventory = buildRuleInventory;
  * ESLint-only today — Ruff/Clippy/Pylint/RuboCop/Stylelint entries append here
  * with their own `linter` + rule-name keywords, no code change.
  */
+// SCOPE (2026-07-14): this hand-curated list is a small high-precision FAST-PATH
+// (alias enrichment for the most common rules), NOT the strategy. The strategy is
+// the DYNAMIC available-rule catalog — enumerate the rules the repo's linter
+// ACTUALLY has (spike: 702 for this repo vs ~23 here) and match prose against
+// THAT, own-repo/consented since it executes the linter. Do NOT keep growing this
+// by hand. See research/rule-compiler-multilang-design.md §0.
 exports.INTENT_MAP = [
     {
         intent: "no console.log / use the logger",
@@ -196,6 +202,155 @@ exports.INTENT_MAP = [
         rule: "no-warning-comments",
         configFix: '"no-warning-comments": ["error", {"terms": ["todo", "fixme"], "location": "anywhere"}]',
     },
+    // Grounded in the OSS-corpus sweep — rules real AGENTS.md files actually NAME
+    // (cloudflare/workers-sdk names all three inline). Keyword set is rule-name /
+    // code-shaped only, so it fires when the doc names the rule, never on prose.
+    {
+        intent: "require curly braces for control flow",
+        linter: "eslint",
+        keywords: ["curly", "curly braces"],
+        rule: "curly",
+        configFix: '"curly": ["error", "all"]',
+    },
+    {
+        intent: "use import type for type-only imports",
+        linter: "eslint",
+        keywords: [
+            "consistent-type-imports",
+            "@typescript-eslint/consistent-type-imports",
+        ],
+        rule: "@typescript-eslint/consistent-type-imports",
+        configFix: '"@typescript-eslint/consistent-type-imports": "error"',
+    },
+    {
+        intent: "no focused / .only tests committed",
+        linter: "eslint",
+        keywords: [
+            "no-only-tests",
+            "no-focused-tests",
+            "describe.only",
+            "it.only",
+            "test.only",
+        ],
+        rule: "no-only-tests/no-only-tests",
+        configFix: '"no-only-tests/no-only-tests": "error"',
+    },
+    // --- Pylint (Python) — routing basics. These feed classify() (routing → reuse);
+    // buildRuleInventory is gated to eslint (see below) because pylint is
+    // ON-BY-DEFAULT (deny-list), so the eslint-shaped config-state check would
+    // MISLABEL it (a symbol in `disable=` reads as "in-config", an absent one as
+    // "enable it"). Accurate pylint enabled-state needs the inverted-polarity
+    // ConfigProbe (research/rule-compiler-multilang-design.md §3), deferred —
+    // classify() needs NO enabled-state, so pylint prose still routes honestly.
+    // Keywords are code-shaped symbols + Python-UNAMBIGUOUS compounds (singular AND
+    // plural, since matchesWholeToken is boundary-exact); bare ambiguous words
+    // (`snake_case` — Rust/Ruby too, `import *` — JS `import * as`, "unused imports"
+    // — collides with eslint) are deliberately EXCLUDED to avoid cross-language FPs.
+    {
+        intent: "no bare except (Python)",
+        linter: "pylint",
+        keywords: ["bare-except", "bare except", "W0702"],
+        rule: "bare-except",
+        configFix: "pylint enables bare-except (W0702) by default; keep it out of the disable list",
+    },
+    {
+        intent: "no broad exception catch (Python)",
+        linter: "pylint",
+        keywords: [
+            "broad-exception-caught",
+            "broad except",
+            "broad exception",
+            "W0718",
+        ],
+        rule: "broad-exception-caught",
+        configFix: "pylint enables broad-exception-caught (W0718) by default; keep it out of the disable list",
+    },
+    {
+        intent: "require docstrings (Python)",
+        linter: "pylint",
+        // Bare "docstring"/"docstrings" removed — it over-fires on docstring
+        // CONTENT/STYLE rules (the dogfood caught langchain's "docstring warnings" /
+        // "backticks in docstrings"). Presence ("add docstrings", "docstrings for
+        // each") is handled by the PATTERN_RULE_MAP docstring-presence pattern in
+        // rule-routing.ts; only the rule SYMBOL matches here.
+        keywords: ["missing-docstring", "missing-function-docstring", "C0116"],
+        rule: "missing-function-docstring",
+        configFix: "pylint enables missing-function-docstring (C0116) by default; keep it out of the disable list",
+    },
+    {
+        intent: "no mutable default arguments (Python)",
+        linter: "pylint",
+        keywords: [
+            "dangerous-default-value",
+            "mutable default",
+            "mutable default argument",
+            "mutable default arguments",
+            "W0102",
+        ],
+        rule: "dangerous-default-value",
+        configFix: "pylint enables dangerous-default-value (W0102) by default; keep it out of the disable list",
+    },
+    {
+        intent: "prefer f-strings (Python)",
+        linter: "pylint",
+        keywords: ["f-string", "f-strings", "consider-using-f-string", "C0209"],
+        rule: "consider-using-f-string",
+        configFix: "pylint enables consider-using-f-string (C0209) by default; keep it out of the disable list",
+    },
+    {
+        intent: "consistent naming (Python)",
+        linter: "pylint",
+        keywords: ["invalid-name", "C0103"],
+        rule: "invalid-name",
+        configFix: "pylint enables invalid-name (C0103) by default; set naming-style in [tool.pylint], keep it out of disable",
+    },
+    {
+        intent: "limit function arguments (Python)",
+        linter: "pylint",
+        keywords: ["too-many-arguments", "R0913"],
+        rule: "too-many-arguments",
+        configFix: "pylint enables too-many-arguments (R0913) by default; set max-args in [tool.pylint]",
+    },
+    {
+        intent: "limit function length (Python)",
+        linter: "pylint",
+        keywords: ["too-many-statements", "R0915"],
+        rule: "too-many-statements",
+        configFix: "pylint enables too-many-statements (R0915) by default; set max-statements in [tool.pylint]",
+    },
+    {
+        intent: "no wildcard imports (Python)",
+        linter: "pylint",
+        keywords: [
+            "wildcard-import",
+            "wildcard import",
+            "wildcard imports",
+            "W0401",
+        ],
+        rule: "wildcard-import",
+        configFix: "pylint enables wildcard-import (W0401) by default; keep it out of the disable list",
+    },
+    {
+        intent: "no global statement (Python)",
+        linter: "pylint",
+        keywords: ["global-statement", "global statement", "W0603"],
+        rule: "global-statement",
+        configFix: "pylint enables global-statement (W0603) by default; keep it out of the disable list",
+    },
+    {
+        intent: "max line length (Python)",
+        linter: "pylint",
+        keywords: ["line-too-long", "C0301"],
+        rule: "line-too-long",
+        configFix: "pylint enables line-too-long (C0301) by default; set max-line-length in [tool.pylint]",
+    },
+    {
+        intent: "no unused imports (Python)",
+        linter: "pylint",
+        keywords: ["unused-import", "W0611"],
+        rule: "unused-import",
+        configFix: "pylint enables unused-import (W0611) by default; keep it out of the disable list",
+    },
 ];
 /** Escape a keyword for use inside a RegExp. */
 function escapeRe(s) {
@@ -206,9 +361,15 @@ function escapeRe(s) {
  * non-`[\w/@.-]` character on each side (so `no-console` matches in
  * `` `no-console` `` and `enforce no-console;` but `no-console-x` does not,
  * and prose containing the substring elsewhere never trips it).
+ *
+ * The TRAILING boundary is a lookahead, not a consuming class, so a keyword at
+ * SENTENCE END ("No wildcard imports.") matches: a `.` is allowed unless it
+ * CONTINUES a code token (`.log` in `console.log`), which still blocks a partial
+ * match. `(?![\w/@-])` rejects a word/`/`/`@`/`-` continuation; `(?!\.[\w/@-])`
+ * rejects a dotted continuation but permits a trailing sentence `.`.
  */
 function matchesWholeToken(text, keyword) {
-    const re = new RegExp(`(^|[^\\w/@.-])${escapeRe(keyword)}([^\\w/@.-]|$)`, "i");
+    const re = new RegExp(`(^|[^\\w/@.-])${escapeRe(keyword)}(?![\\w/@-])(?!\\.[\\w/@-])`, "i");
     return re.test(text);
 }
 /**
@@ -292,6 +453,14 @@ function buildRuleInventory(instructionText, configText, options = {}) {
     for (const m of exports.INTENT_MAP) {
         if (linters && !linters.includes(m.linter))
             continue;
+        // ROUTE-ONLY for non-eslint linters: the config-state check below
+        // (ruleSetOff/ruleInConfig) is eslint-config-shaped and would MISLABEL a
+        // pylint rule, which is ON-BY-DEFAULT (a symbol in `disable=` reads as
+        // "in-config"; an absent one as "enable it" — both inverted). The routing
+        // preview (classify) still reuses these; accurate pylint enabled-state waits
+        // on the inverted-polarity ConfigProbe (design doc §3). Don't cry wolf.
+        if (m.linter !== "eslint")
+            continue;
         const matched = m.keywords.find((kw) => matchesWholeToken(instructionText, kw));
         if (!matched)
             continue;