In `@cli.js`:
- Around line 13-18: The WASI instance currently preopens the entire host
filesystem via preopens: { "/": "/" } in the new WASI(...) call; change that to
only expose the current working directory by replacing the preopens mapping with
a single subtree like preopens: { ".": process.cwd() } (i.e., update the new
WASI(...) creation in cli.js so the WASI constructor maps only process.cwd()
instead of "/").

In `@index.js`:
- Around line 12-26: The function runRegula documents options.format but always
forces JSON; update argument construction in runRegula so args uses
options.format when provided (fall back to "json" if not), i.e., replace the
hardcoded ["run","--format","json"] with logic that sets "--format" to
options.format or "json" before pushing it into args; reference runRegula, the
args array, and options.format to locate and change the code.

In `@patches/coreos/go-systemd/journal/journal.go`:
- Around line 72-82: Enabled() currently calls net.Dial("unixgram",
journalSocket) but discards the resulting connection, leaking a file descriptor
on each probe; update Enabled() to capture the returned connection (e.g., conn,
err := net.Dial(...)), check err as now, and ensure the connection is closed
(conn.Close()) before returning (use a defer immediately after a successful dial
or an explicit Close prior to return) so repeated calls don't exhaust FDs; keep
the existing checks involving onceConn.Do(initConn) and unixConnPtr unchanged.
- Around line 120-137: The temp file fallback currently drops large journal
entries because the ancillary-FD send using conn.WriteMsgUnix is commented out;
replace that silent noop with a build-tagged helper (e.g., sendWithFD or sendFD)
and call it where the commented code is: create sendWithFD_unix.go (//go:build
!wasip1) that constructs syscall.UnixRights(int(file.Fd())) and calls
conn.WriteMsgUnix to send the FD and returns any error, and create
sendWithFD_wasip1.go (//go:build wasip1) that returns a clear "unsupported on
wasip1" error; update the code around tempFd/conn.WriteMsgUnix to call this
helper and propagate its error instead of returning nil so large entries are
either sent or fail explicitly.

In `@patches/fsnotify/fsnotify/backend_other.go`:
- Around line 22-69: The Close, Add and Remove methods on Watcher currently
return nil on unsupported platforms and should instead return the same
unsupported-backend error used by NewWatcher so misuse doesn't silently succeed;
update Watcher.Close, Watcher.Add and Watcher.Remove to return the identical
error value (the one NewWatcher returns when the backend is unsupported) rather
than nil, preserving signatures and without adding platform-specific behavior.

In `@patches/sirupsen/logrus/terminal_check_notappengine.go`:
- Around line 11-17: The call to isTerminal(int(v.Fd())) in checkIfTerminal is
undefined; add a concrete implementation or delegate to the standard term
package. Import "golang.org/x/term" (or "golang.org/x/crypto/ssh/terminal" if
you prefer) and replace/implement isTerminal to call term.IsTerminal(fd) (or add
a local isTerminal wrapper that calls term.IsTerminal) so checkIfTerminal
compiles; ensure the import is added and referenced functions are
checkIfTerminal and isTerminal (and types io.Writer/os.File) so the linker can
resolve the symbol.

In `@test/test-wasi.js`:
- Around line 178-187: The test named "Exit codes match for failures" currently
only compares failure detection; update it to also assert the exit codes from
runWasi and runBinary are equal and non-zero when failures are present: after
computing wasiHasFailures and binaryHasFailures, add assertions comparing
wasi.exitCode and binary.exitCode (e.g., assert.strictEqual(wasi.exitCode,
binary.exitCode)) and assert that when wasiHasFailures is true the exit code is
!== 0 (and similarly for binary) so both the equality and non-zero behavior are
checked for the wasi and binary results returned by runWasi and runBinary.
- Around line 36-49: runWasi and runBinary currently always resolve even when
the child process fails, so tests can pass by comparing stdout alone; update the
helpers or tests so failures are surfaced: modify runWasi and runBinary to
reject when the execFile callback reports an error (use error and error.code) so
callers receive a rejected promise on non-zero exit, or alternatively keep the
helpers but add explicit assertions in success tests (e.g., Test 10) to assert
result.exitCode === 0 before checking stdout/JSON; locate the functions runWasi
and runBinary and adjust their execFile callback behavior or add exitCode === 0
assertions in tests that expect success.

In `@README.md`:
- Around line 155-170: The fenced code block under the "Available Commands"
section (the block starting with "regula [command]") is missing a language tag
which markdownlint flags; update the opening triple-backticks to include a
language (e.g., change ``` to ```text) so the block becomes ```text followed by
the existing "regula [command]" content and the closing ```; no other content
change is needed.

In `@README.md`:
- Around line 1-27: Update the README's stated versions: change the OPA line
that currently reads "OPA upgraded from v0.45.1 to v1.12.2 (latest)" to "OPA
upgraded from v0.45.1 to v1.11.0" (remove the "(latest)" tag), and update the Go
line from "Go upgraded to 1.24.11 with stdlib CVE fixes" to "Go upgraded to
1.25.6 with stdlib CVE fixes" so the documentation matches the correct target
versions.