fix: resolve all P0/P1/P2 issues from tech debt review

P0: Generated ESLint configs are invalid
- Flat config: rule entries use object property syntax with quoted
  severity strings; plugin keys with special chars are quoted;
  plugins registered in plugins object
- Legacy config: output is valid JSON via JSON.stringify(); unmappable
  rules appear as comment block after JSON
- Added tests that parse generated configs and validate syntax

P0: Unsupported parser rules become false passes
- All CATEGORY_MAP entries set to null; unmatched categories go to
  unparseable instead of creating generic rules
- Verifiers return {passed: false, skipped: true} for unsupported
  pattern types instead of silently passing
- Added skipped field to RuleResult type

P0: Drift and extract async config parsing
- parseEslintConfigAsync() supports .js, .mjs, .cjs, .ts files
- drift.ts and extract.ts now use async parser
- Synchronous parser throws for JS/TS files with actionable message
- Added resolveSafePath() to lint-config, drift, and extract commands

P0: GitHub Action drift mode broken
- Added RULEPROBE_BIN env var for resolved CLI path
- Made findEslintFileInWorkspace() async with proper await
- Both drift and verify steps in action.yml set RULEPROBE_BIN

P1: ESLint rule mapping accuracy
- no-wildcard-exports: import/no-namespace -> import/no-anonymous-default-export
- no-namespace-imports: @typescript-eslint/consistent-type-imports -> import/no-namespace
- no-unused-exports: no-unused-vars -> import/no-unused-modules
- no-implicit-any: @typescript-eslint/no-implicit-any -> @typescript-eslint/no-explicit-any
- no-deep-relative-imports: now includes maxDepth in options

P1: Package output contains stale build artifacts
- Added prebuild script (rm -rf dist) to clean before every build
- Added files allowlist to package.json

P1: README and reference docs stale
- Updated README format descriptions and verify format list
- Removed removed commands (compare, tasks, task, run) from cli-reference.md
- Added lint-config, drift, extract command docs
- Updated matchers.md to reflect 34 mappable matchers across 7 categories

P2: Path boundary and config validation
- resolveSafePath() applied to lint-config, drift, and extract
- Config validation now rejects unknown categories and verifiers
- verify command accepts all valid report formats (summary, detailed, ci added)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: moonrunnerkc

.gitignore

@@ -31,3 +31,6 @@ test-treesitter*.mjs
 .github/ruleprobe-e2e-verification-guide.md
 docs/ruleprobe-build-guide.md
 .ruleprobe-semantic/
+.codex
+.codex-tmp/
+.ruleprobe-semantic/

README.md

@@ -65,15 +65,15 @@ ruleprobe parse CLAUDE.md
 ruleprobe parse AGENTS.md --show-unparseable
 ```
 
-**Verify agent output** against extracted rules (legacy mode):
+**Verify agent output** against extracted rules (legacy mode). Valid formats: `text`, `json`, `markdown`, `rdjson`, `summary`, `detailed`, `ci`.
 
 ```bash
 ruleprobe verify CLAUDE.md ./agent-output --format text
 ```
 
 ## What It Does
 
-**Translate.** Reads 7 instruction file formats (CLAUDE.md, AGENTS.md, .cursorrules, copilot-instructions.md, GEMINI.md, .windsurfrules, .rules) and emits an ESLint config. Each extractable rule maps to an ESLint rule with appropriate severity and options. Rules that have no ESLint equivalent appear as comments in the output so you know what wasn't covered.
+**Translate.** Reads 7 instruction file formats (CLAUDE.md, AGENTS.md, .cursorrules, copilot-instructions.md, GEMINI.md, .windsurfrules, .rules) and emits an ESLint config. Flat config is the default; pass `--format legacy` for `.eslintrc.json` output. Each extractable rule maps to an ESLint rule with appropriate severity and options. Rules that have no ESLint equivalent appear as comments in the output so you know what wasn't covered.
 
 **Detect drift.** Compares parsed rules against an existing ESLint config. Reports rules in the instruction file but missing from ESLint (you're not enforcing what you said), rules in ESLint but not in the instructions (you're enforcing what you never stated), severity mismatches, and argument differences. Use `--format markdown` for PR-ready output.
 
@@ -133,7 +133,7 @@ Six commands: `parse`, `verify`, `analyze`, `lint-config`, `drift`, `extract`.
 
 ```bash
 ruleprobe parse CLAUDE.md --show-unparseable
-ruleprobe verify AGENTS.md ./src --format summary --threshold 0.9
+ruleprobe verify AGENTS.md ./src --format detailed --threshold 0.9
 ruleprobe lint-config CLAUDE.md --format flat --output eslint.config.js
 ruleprobe drift CLAUDE.md .eslintrc.json --format markdown
 ruleprobe extract .eslintrc.json --output rules-section.md
@@ -247,12 +247,12 @@ The mapper translates extractable rules into ESLint rule entries. The drift dete
 | Category | Count | Verifier | Examples |
 |----------|------:|----------|----------|
 | naming | 5 | AST, Filesystem | camelCase variables, PascalCase types, kebab-case files, UPPER_CASE constants |
-| forbidden-pattern | 5 | AST, Regex | no `any`, no `console.log`, no `var`, no `TODO` comments |
-| structure | 5 | AST, Filesystem | named exports, JSDoc required, max file length, max line length, no unused exports |
+| forbidden-pattern | 5 | AST, Regex | no `any`, no `console.log`, no `var`, max line length, no `TODO` comments |
+| structure | 4 | AST, Filesystem | named exports, JSDoc required, max file length, no unused exports |
 | import-pattern | 4 | AST | no path aliases, no deep relative imports, no namespace imports, no wildcard exports |
 | error-handling | 2 | AST | no empty catch, throw Error only |
 | type-safety | 5 | AST, Regex | no enums, no type assertions, no non-null assertions, no implicit any, no ts directives |
-| code-style | 8 | AST, Regex | no var, prefer const, no else after return, no nested ternary, no magic numbers, semicolons, quotes, max function length, max params |
+| code-style | 9 | AST, Regex | prefer const, no else after return, no nested ternary, no magic numbers, semicolons, quotes, max function length, max params, no TODO comments |
 
 Rules that can't map to ESLint (test file requirements, project config, git conventions) are reported as unmappable so you can enforce them through other tooling.
 

action.yml

@@ -120,6 +120,7 @@ runs:
         GITHUB_EVENT_NAME: ${{ github.event_name }}
         GITHUB_WORKSPACE: ${{ github.workspace }}
         GITHUB_OUTPUT: ${{ github.output_file }}
+        RULEPROBE_BIN: ${{ github.action_path }}/dist/cli.js
       run: node "${{ github.action_path }}/dist/action/main.js"
 
     - name: Run ruleprobe verify

docs/cli-reference.md

@@ -85,65 +85,49 @@ Checks for `CLAUDE.md`, `AGENTS.md`, `.cursorrules`, `.github/copilot-instructio
 
 ---
 
-## `ruleprobe compare <instruction-file> <dirs...>`
+## `ruleprobe lint-config <instruction-file>`
 
-Run verification against multiple agent outputs and produce a comparison.
+Parse an instruction file and emit an ESLint config. Flat config is the default; use `--format legacy` for `.eslintrc.json` output.
 
 ```bash
-ruleprobe compare AGENTS.md ./claude-output ./copilot-output --agents claude,copilot --format markdown
+ruleprobe lint-config CLAUDE.md
+ruleprobe lint-config CLAUDE.md --format legacy --output .eslintrc.json
+ruleprobe lint-config AGENTS.md --format flat --output eslint.config.js
 ```
 
 | Option | Default | Description |
 |--------|---------|-------------|
-| `--agents <names>` | none | Comma-separated labels for each directory |
-| `--format <format>` | `markdown` | Report format: `text`, `json`, or `markdown` |
-| `--output <path>` | stdout | Write report to file |
-| `--allow-symlinks` | `false` | Follow symlinks outside the working directory |
-| `--config <path>` | auto-discovered | Path to config file |
+| `--format <format>` | `flat` | Output format: `flat` (ESLint flat config) or `legacy` (`.eslintrc.json`) |
+| `--output <path>` | stdout | Write config to file |
 
 ---
 
-## `ruleprobe tasks`
+## `ruleprobe drift <md-file> <eslint-file>`
 
-List available task templates and their descriptions.
+Detect drift between an instruction file and an ESLint config. Reports rules present in only one side, severity mismatches, and argument differences.
 
 ```bash
-ruleprobe tasks
+ruleprobe drift CLAUDE.md .eslintrc.json
+ruleprobe drift CLAUDE.md eslint.config.js --format markdown
+ruleprobe drift AGENTS.md .eslintrc.json --format json --output drift-report.json
 ```
 
----
-
-## `ruleprobe task <template-id>`
-
-Output the full task prompt for a given template. Three templates ship: `rest-endpoint`, `utility-module`, `react-component`.
-
-```bash
-ruleprobe task rest-endpoint
-```
+| Option | Default | Description |
+|--------|---------|-------------|
+| `--format <format>` | `text` | Output format: `text`, `json`, or `markdown` |
+| `--output <path>` | stdout | Write report to file |
 
 ---
 
-## `ruleprobe run <instruction-file>`
+## `ruleprobe extract <eslint-file>`
 
-Invoke an AI agent on a task template, then verify its output. Requires `@anthropic-ai/claude-agent-sdk` and `ANTHROPIC_API_KEY` for SDK mode. Alternatively, use `--watch` to point at a directory where an agent will write output.
+Parse an ESLint config and emit a markdown rules section suitable for pasting into an instruction file. Stylistic rules are reported but excluded from the output by default.
 
 ```bash
-# SDK mode: invoke Claude, verify, report
-ruleprobe run CLAUDE.md --task rest-endpoint --agent claude-code --model sonnet --format text
-
-# Watch mode: wait for output in a directory, then verify
-ruleprobe run CLAUDE.md --watch ./agent-output --timeout 300 --format json
+ruleprobe extract .eslintrc.json
+ruleprobe extract eslint.config.js --output rules-section.md
 ```
 
 | Option | Default | Description |
 |--------|---------|-------------|
-| `--task <template-id>` | `rest-endpoint` | Task template to give the agent |
-| `--agent <name>` | `claude-code` | Agent identifier |
-| `--model <name>` | `sonnet` | Model to use for the agent |
-| `--format <format>` | `text` | Report format: `text`, `json`, `markdown`, or `rdjson` |
-| `--output-dir <path>` | none | Directory to persist agent output |
-| `--watch <dir>` | none | Watch a directory for agent output instead of invoking |
-| `--timeout <seconds>` | `300` | Watch mode timeout in seconds |
-| `--allow-symlinks` | `false` | Follow symlinks outside the working directory |
-| `--config <path>` | auto-discovered | Path to config file |
-| `--project <tsconfig>` | none | tsconfig.json path for type-aware checks |
+| `--output <path>` | stdout | Write output to file |