@coldtea/abide 0.0.1

package/src/lib/git.ts

@@ -0,0 +1,206 @@
+import { spawnSync } from "node:child_process";
+import { copyFileSync, existsSync, mkdirSync } from "node:fs";
+import path from "node:path";
+import { parsePatch } from "diff";
+import { AbideError } from "@coldtea/abide-schema";
+import { GIT_TIMEOUT_MS, MAX_STATE_CHARS } from "./constants.js";
+import { renderHunks } from "./diff.js";
+import { isExcludedPath, SECRET_FILE_PATTERNS } from "./paths.js";
+
+/**
+ * One git call, killed outright at its timeout. A clean filter, LFS, or a slow
+ * disk can hold git for longer than a hook may live, and nothing on the main
+ * thread can interrupt a synchronous child. stderr is not ours to hold open:
+ * a filter that inherited it could keep us waiting after git itself is gone.
+ */
+const git = (
+  root: string,
+  args: string[],
+  timeoutMs = GIT_TIMEOUT_MS,
+  options: { env?: NodeJS.ProcessEnv; ok?: readonly number[] } = {},
+): string | undefined => {
+  const { env, ok = [0] } = options;
+  const result = spawnSync("git", args, {
+    cwd: root,
+    encoding: "utf8",
+    maxBuffer: 64 * 1024 * 1024,
+    timeout: Math.max(1, timeoutMs),
+    killSignal: "SIGKILL",
+    stdio: ["ignore", "pipe", "ignore"],
+    ...(env === undefined ? {} : { env }),
+  });
+  return result.status !== null && ok.includes(result.status) ? result.stdout : undefined;
+};
+
+export const isGitRepo = (root: string): boolean =>
+  git(root, ["rev-parse", "--is-inside-work-tree"], 2_000) !== undefined;
+
+const SKIP_FILE =
+  /(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?|Cargo\.lock|go\.sum)$|\.(min\.js|min\.css|map|svg|png|jpg|jpeg|gif|ico|woff2?|ttf|pdf|lock|snap)$/;
+
+export type FileDiff = { file: string; text: string };
+
+/** Splits a unified diff into per-file hunk text, dropping generated, binary and excluded files. */
+export const splitDiff = (patch: string): FileDiff[] => {
+  const out: FileDiff[] = [];
+  for (const file of parsePatch(patch)) {
+    // A deletion has no new name: its old one is the file the turn removed.
+    const named =
+      file.newFileName && file.newFileName !== "/dev/null" ? file.newFileName : file.oldFileName;
+    const name = (named ?? "").replace(/^[ab]\//, "");
+    if (name === "" || name === "/dev/null" || SKIP_FILE.test(name) || isExcludedPath(name)) {
+      continue;
+    }
+    if (file.hunks.length === 0) continue;
+    out.push({ file: name, text: renderHunks(file.hunks) });
+  }
+  return out;
+};
+
+export type HistoryHunk = { commit: string; subject: string; file: string; text: string };
+export type HistoryCommit = {
+  commit: string;
+  subject: string;
+  files: string[];
+  fileDiffs: FileDiff[];
+};
+
+/** Recent real changes from this repository's history, for calibration. */
+export const recentHistory = (
+  root: string,
+  wantHunks: number,
+  wantCommits: number,
+): { hunks: HistoryHunk[]; commits: HistoryCommit[] } => {
+  const list = git(root, ["log", "--no-merges", "-n", "60", "--format=%H%x1f%s", "HEAD"]);
+  if (list === undefined)
+    throw new AbideError("GIT_UNAVAILABLE", "git history is not readable here");
+  const hunks: HistoryHunk[] = [];
+  const commits: HistoryCommit[] = [];
+  const seenFiles = new Set<string>();
+  for (const line of list.split("\n")) {
+    if (line.trim() === "") continue;
+    const [commit, subject = ""] = line.split("\x1f");
+    if (commit === undefined) continue;
+    if (hunks.length >= wantHunks && commits.length >= wantCommits) break;
+    const patch = git(root, [
+      "show",
+      "--format=",
+      "--unified=3",
+      "--no-color",
+      "--diff-filter=AM",
+      commit,
+    ]);
+    if (patch === undefined || patch.trim() === "") continue;
+    const files = splitDiff(patch);
+    if (files.length === 0) continue;
+    if (commits.length < wantCommits) {
+      const size = files.reduce((sum, f) => sum + f.text.length, 0);
+      if (size >= 200 && size <= MAX_STATE_CHARS) {
+        commits.push({ commit, subject, files: files.map((f) => f.file), fileDiffs: files });
+      }
+    }
+    for (const f of files) {
+      if (hunks.length >= wantHunks) break;
+      const changed = f.text.split("\n").filter((l) => /^[+-](?![+-]{2})/.test(l)).length;
+      if (changed < 3 || f.text.length > 6000 || seenFiles.has(f.file)) continue;
+      seenFiles.add(f.file);
+      hunks.push({ commit, subject, file: f.file, text: f.text });
+    }
+  }
+  return { hunks, commits };
+};
+
+/** Uncommitted changes, including staged, as one patch. */
+export const workingTreeDiff = (root: string, paths: readonly string[]): string => {
+  const hasHead = git(root, ["rev-parse", "--verify", "HEAD"]) !== undefined;
+  const base = hasHead
+    ? ["diff", "HEAD", "--no-color", "--unified=3"]
+    : ["diff", "--cached", "--no-color", "--unified=3"];
+  const tracked = git(root, [...base, "--", ...paths]) ?? "";
+  const untracked = (
+    git(root, ["ls-files", "--others", "--exclude-standard", "--", ...paths]) ?? ""
+  )
+    .split("\n")
+    .filter((f) => f.trim() !== "");
+  // --no-index exits 1 when the sides differ.
+  const added = untracked
+    .map((f) =>
+      git(
+        root,
+        ["diff", "--no-color", "--no-index", "--unified=3", "--", "/dev/null", f],
+        GIT_TIMEOUT_MS,
+        { ok: [0, 1] },
+      ),
+    )
+    .filter((p): p is string => p !== undefined && p.trim() !== "");
+  return [tracked, ...added].join("\n");
+};
+
+const indexPath = (root: string): string | undefined => {
+  const out = git(root, ["rev-parse", "--git-path", "index"], 2_000);
+  if (out === undefined) return undefined;
+  const p = out.trim();
+  return path.isAbsolute(p) ? p : path.join(root, p);
+};
+
+// Never staged, so no snapshot writes a secret into the object store.
+const NOT_SECRETS = SECRET_FILE_PATTERNS.map((pattern) => `:(exclude,glob)**/${pattern}`);
+
+/**
+ * A tree object for the working tree as it stands now, untracked files
+ * included and ignored files excluded, without touching the real index. The
+ * real index is copied first so `add -A` only has to look at what changed.
+ */
+export const snapshotTree = (
+  root: string,
+  scratchIndex: string,
+  timeoutMs: number,
+): string | undefined => {
+  const deadline = performance.now() + timeoutMs;
+  const remaining = (): number => Math.floor(deadline - performance.now());
+  try {
+    mkdirSync(path.dirname(scratchIndex), { recursive: true });
+    const real = indexPath(root);
+    if (real !== undefined && existsSync(real)) copyFileSync(real, scratchIndex);
+  } catch {
+    return undefined;
+  }
+  const env = { ...process.env, GIT_INDEX_FILE: scratchIndex };
+  if (
+    remaining() <= 0 ||
+    git(root, ["add", "-A", "--", ".", ...NOT_SECRETS], remaining(), { env }) === undefined
+  )
+    return undefined;
+  if (remaining() <= 0) return undefined;
+  const hash = git(root, ["write-tree"], remaining(), { env })?.trim();
+  return hash !== undefined && /^[0-9a-f]{40,64}$/.test(hash) ? hash : undefined;
+};
+
+/** Blob id per file in a tree; absent files are left out, undefined if git did not answer in time. */
+export const blobIdsAt = (
+  root: string,
+  tree: string,
+  files: readonly string[],
+  timeoutMs: number,
+): Map<string, string> | undefined => {
+  if (files.length === 0) return new Map();
+  const out = git(root, ["ls-tree", "-r", "-z", tree, "--", ...files], timeoutMs);
+  if (out === undefined) return undefined;
+  const ids = new Map<string, string>();
+  for (const entry of out.split("\0")) {
+    const m = /^\d+ blob ([0-9a-f]{40,64})\t([^]+)$/.exec(entry);
+    if (m?.[1] !== undefined && m[2] !== undefined) ids.set(m[2], m[1]);
+  }
+  return ids;
+};
+
+/** Everything that changed between two snapshots, as one patch. */
+export const diffTrees = (
+  root: string,
+  base: string,
+  now: string,
+  timeoutMs: number,
+): string | undefined =>
+  base === now
+    ? ""
+    : git(root, ["diff-tree", "-p", "-M", "--no-color", "--unified=3", base, now], timeoutMs);

package/src/lib/hookRunner.ts

@@ -0,0 +1,55 @@
+import type { HookOutput } from "@coldtea/abide-schema";
+import { debug, emit } from "./output.js";
+import { readStdin } from "./stdin.js";
+
+export type HookName = "session-start" | "turn-start" | "post-tool-use" | "stop";
+
+const EVENT: Record<HookName, "SessionStart" | "UserPromptSubmit" | "PostToolUse" | "Stop"> = {
+  "session-start": "SessionStart",
+  "turn-start": "UserPromptSubmit",
+  "post-tool-use": "PostToolUse",
+  stop: "Stop",
+};
+
+/**
+ * Every hook goes through here: parse what we can, never throw, and leave
+ * within the budget whatever else is going on. The deadline exits the
+ * process rather than resolving a promise, because a promise cannot interrupt
+ * work that is still running, and an open handle would keep us alive after it.
+ */
+export const runHook = async (
+  name: HookName,
+  handler: (raw: unknown) => Promise<HookOutput>,
+  budgetMs: number,
+): Promise<void> => {
+  process.exitCode = 0;
+  let finished = false;
+  const finish = (output: HookOutput): void => {
+    if (finished) return;
+    finished = true;
+    try {
+      emit(output, EVENT[name], () => process.exit(0));
+    } catch {
+      process.exit(0);
+    }
+  };
+  const deadline = setTimeout(() => {
+    debug(`${name}: gave up after ${budgetMs}ms`);
+    finish({ kind: "silent" });
+  }, budgetMs);
+  try {
+    const text = await readStdin();
+    let raw: unknown = undefined;
+    try {
+      raw = text.trim() === "" ? undefined : JSON.parse(text);
+    } catch {
+      debug(`${name}: stdin was not JSON`);
+    }
+    finish(await handler(raw));
+  } catch (error) {
+    debug(`${name}: ${error instanceof Error ? error.message : String(error)}`);
+    finish({ kind: "silent" });
+  } finally {
+    clearTimeout(deadline);
+  }
+};

package/src/lib/hosts.ts

@@ -0,0 +1,112 @@
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { AbideError, assertNever, HOSTS, hostSchema, type Host } from "@coldtea/abide-schema";
+import { installOpencodePlugin, uninstallOpencodePlugin } from "./opencodePlugin.js";
+import { hookScriptPath } from "./packageRoot.js";
+import { homeDir } from "./paths.js";
+import { hookSpecs, installHooks, uninstallHooks } from "./settings.js";
+
+export const hostLabel = (host: Host): string => {
+  switch (host) {
+    case "claude":
+      return "Claude Code";
+    case "codex":
+      return "Codex";
+    case "opencode":
+      return "OpenCode";
+    default:
+      return assertNever(host);
+  }
+};
+
+export const parseHost = (name: string): Host => {
+  const parsed = hostSchema.safeParse(name.toLowerCase());
+  if (!parsed.success)
+    throw new AbideError("HOST_UNKNOWN", `"${name}" is not one of ${HOSTS.join(", ")}`);
+  return parsed.data;
+};
+
+const onPath = (bin: string): boolean =>
+  spawnSync("which", [bin], { encoding: "utf8" }).status === 0;
+
+export const hostPresent = (host: Host): boolean => {
+  switch (host) {
+    case "claude":
+      return existsSync(path.join(homeDir(), ".claude")) || onPath("claude");
+    case "codex":
+      return existsSync(path.join(homeDir(), ".codex")) || onPath("codex");
+    case "opencode":
+      return existsSync(path.join(homeDir(), ".config", "opencode")) || onPath("opencode");
+    default:
+      return assertNever(host);
+  }
+};
+
+export const detectHosts = (): Host[] => HOSTS.filter(hostPresent);
+
+/**
+ * Where abide's entries live for a host. Claude Code and Codex read the same
+ * hooks JSON shape from different files; OpenCode loads a plugin file from a
+ * directory it watches, so no config file is edited there.
+ */
+export const installTarget = (host: Host, root: string, project: boolean): string => {
+  switch (host) {
+    case "claude":
+      return project
+        ? path.join(root, ".claude", "settings.json")
+        : path.join(homeDir(), ".claude", "settings.json");
+    case "codex":
+      return project
+        ? path.join(root, ".codex", "hooks.json")
+        : path.join(homeDir(), ".codex", "hooks.json");
+    case "opencode":
+      return project
+        ? path.join(root, ".opencode", "plugins", "abide.js")
+        : path.join(homeDir(), ".config", "opencode", "plugins", "abide.js");
+    default:
+      return assertNever(host);
+  }
+};
+
+export type Installed = { host: Host; target: string; what: string; afterwards?: string };
+
+export const installHost = (host: Host, root: string, project: boolean): Installed => {
+  const target = installTarget(host, root, project);
+  switch (host) {
+    case "claude":
+      installHooks(target, hookSpecs(hookScriptPath()));
+      return {
+        host,
+        target,
+        what: "hooks written: SessionStart, UserPromptSubmit, PostToolUse, Stop",
+      };
+    case "codex":
+      installHooks(target, hookSpecs(hookScriptPath()));
+      return {
+        host,
+        target,
+        what: "hooks written: SessionStart, UserPromptSubmit, PostToolUse, Stop",
+        afterwards:
+          "Codex trusts new hooks once: start codex, type /hooks, accept the four abide entries.",
+      };
+    case "opencode":
+      installOpencodePlugin(target);
+      return { host, target, what: "plugin written; OpenCode loads it at the next start" };
+    default:
+      return assertNever(host);
+  }
+};
+
+export const uninstallHost = (host: Host, root: string, project: boolean): number => {
+  const target = installTarget(host, root, project);
+  switch (host) {
+    case "claude":
+    case "codex":
+      return uninstallHooks(target);
+    case "opencode":
+      return uninstallOpencodePlugin(target) ? 1 : 0;
+    default:
+      return assertNever(host);
+  }
+};

package/src/lib/jev.ts

@@ -0,0 +1,223 @@
+import { RetryError, type Experimental_EvaluationQuestion } from "ai";
+import {
+  AbideError,
+  assertNever,
+  type Question,
+  type Rule,
+  type Thresholds,
+  type Usage,
+  type Verdict,
+} from "@coldtea/abide-schema";
+import { bandFor, violationProbability, type ModelAnswer } from "./band.js";
+import {
+  GATEWAY_KEY_ENV,
+  GATEWAY_MODEL_ID,
+  JEV_USD_PER_INPUT_TOKEN,
+  TYPESAFE_MODEL_ID,
+} from "./constants.js";
+import { credentials, NO_KEY_HINT, type Credentials } from "./credentials.js";
+
+export type ModelRule = Rule & { check: { type: "model" } };
+
+export const isModelRule = (rule: Rule): rule is ModelRule => rule.check.type === "model";
+
+const toSdkQuestion = (q: Question): Experimental_EvaluationQuestion => {
+  switch (q.type) {
+    case "boolean":
+      return q.criteria
+        ? { type: "boolean", instructions: q.instructions, criteria: q.criteria }
+        : { type: "boolean", instructions: q.instructions };
+    case "choice":
+      return { type: "choice", instructions: q.instructions, criteria: q.criteria };
+    case "score":
+      return { type: "score", instructions: q.instructions, criteria: q.criteria };
+    default:
+      return assertNever(q);
+  }
+};
+
+export type CheckState = {
+  task?: string;
+  file?: string;
+  files?: string[];
+  diff: string;
+};
+
+export type ModelCheckResult = {
+  verdicts: Verdict[];
+  usage: Usage;
+  latencyMs: number;
+};
+
+const toAnswer = (value: unknown): ModelAnswer | undefined => {
+  if (typeof value !== "object" || value === null || !("type" in value)) return undefined;
+  const record: Record<string, unknown> = { ...value };
+  const probabilities =
+    typeof record.probabilities === "object" && record.probabilities !== null
+      ? Object.fromEntries(
+          Object.entries(record.probabilities).flatMap(([k, v]) =>
+            typeof v === "number" ? [[k, v] as const] : [],
+          ),
+        )
+      : undefined;
+  switch (record.type) {
+    case "boolean":
+      return typeof record.probability === "number"
+        ? { type: "boolean", probability: record.probability }
+        : undefined;
+    case "choice":
+      return typeof record.choice === "string"
+        ? { type: "choice", choice: record.choice, probabilities }
+        : undefined;
+    case "score":
+      return typeof record.score === "number"
+        ? { type: "score", score: record.score, probabilities }
+        : undefined;
+    default:
+      return undefined;
+  }
+};
+
+type GatewayFailure = { code: "CHECK_TIMEOUT" | "CHECK_FAILED"; message: string };
+
+const isAbort = (error: unknown): boolean =>
+  error instanceof Error &&
+  (error.name === "TimeoutError" ||
+    error.name === "AbortError" ||
+    error.message === "Delay was aborted");
+
+const statusOf = (error: unknown): number | undefined =>
+  typeof error === "object" &&
+  error !== null &&
+  "statusCode" in error &&
+  typeof error.statusCode === "number"
+    ? error.statusCode
+    : undefined;
+
+const bodyOf = (error: unknown): string | undefined => {
+  if (
+    typeof error !== "object" ||
+    error === null ||
+    !("responseBody" in error) ||
+    typeof error.responseBody !== "string"
+  )
+    return undefined;
+  try {
+    const parsed: unknown = JSON.parse(error.responseBody);
+    if (
+      typeof parsed === "object" &&
+      parsed !== null &&
+      "message" in parsed &&
+      typeof parsed.message === "string"
+    )
+      return parsed.message;
+  } catch {
+    // not JSON
+  }
+  return error.responseBody.slice(0, 160);
+};
+
+/**
+ * The gateway's own words, not the SDK's. A retry that ran out of time says
+ * "Delay was aborted"; what the person needs is the answer that made the SDK
+ * retry in the first place.
+ */
+const explain = (error: unknown): GatewayFailure => {
+  const attempts: unknown[] = RetryError.isInstance(error) ? error.errors : [error];
+  const answered = [...attempts].reverse().find((e) => statusOf(e) !== undefined);
+  if (answered !== undefined) {
+    const status = statusOf(answered);
+    const body = bodyOf(answered);
+    const tries = attempts.length > 1 ? ` after ${attempts.length} tries` : "";
+    return {
+      code: "CHECK_FAILED",
+      message: `the gateway answered ${status}${tries}${body ? `: ${body}` : ""}`,
+    };
+  }
+  if (attempts.some(isAbort))
+    return { code: "CHECK_TIMEOUT", message: "the gateway did not answer within the time allowed" };
+  const last = attempts.at(-1);
+  return { code: "CHECK_FAILED", message: last instanceof Error ? last.message : String(last) };
+};
+
+export const describeGatewayFailure = (error: unknown): AbideError => {
+  const failure = explain(error);
+  return new AbideError(failure.code, failure.message, { cause: error });
+};
+
+/**
+ * Direct calls carry the key explicitly. The gateway provider reads its key
+ * from the environment by the SDK's own convention, so a key found in a file
+ * is placed there for this process only.
+ */
+const evaluationModel = async (
+  creds: Exclude<Credentials, { kind: "none" }>,
+): Promise<Parameters<typeof import("ai").experimental_evaluate>[0]["model"]> => {
+  switch (creds.kind) {
+    case "typesafe": {
+      const { createTypeSafeAi } = await import("@ai-sdk/typesafe-ai");
+      return createTypeSafeAi({ apiKey: creds.key }).evaluationModel(TYPESAFE_MODEL_ID);
+    }
+    case "gateway":
+      process.env[GATEWAY_KEY_ENV] = creds.key;
+      return GATEWAY_MODEL_ID;
+    default:
+      return assertNever(creds);
+  }
+};
+
+/** One call carrying every rule. The state is only the rule set and the change. */
+export const checkWithModel = async (
+  rules: readonly ModelRule[],
+  state: CheckState,
+  thresholds: Thresholds,
+  timeoutMs: number,
+  /** Transient gateway failures to retry. Zero inside a hook, where the budget is the agent's time. */
+  retries = 0,
+): Promise<ModelCheckResult> => {
+  if (rules.length === 0) return { verdicts: [], usage: {}, latencyMs: 0 };
+  const creds = credentials();
+  if (creds.kind === "none") throw new AbideError("NO_API_KEY", NO_KEY_HINT);
+
+  const { experimental_evaluate: evaluate } = await import("ai");
+  const model = await evaluationModel(creds);
+  const questions: Record<string, Experimental_EvaluationQuestion> = {};
+  for (const rule of rules) questions[rule.id] = toSdkQuestion(rule.check.question);
+
+  const started = performance.now();
+  let result: Awaited<ReturnType<typeof evaluate>>;
+  try {
+    result = await evaluate({
+      model,
+      state,
+      questions,
+      maxRetries: retries,
+      abortSignal: AbortSignal.timeout(timeoutMs),
+      providerOptions: { gateway: { zeroDataRetention: true } },
+    });
+  } catch (error) {
+    throw describeGatewayFailure(error);
+  }
+  const latencyMs = Math.round(performance.now() - started);
+
+  const verdicts: Verdict[] = [];
+  for (const rule of rules) {
+    const answer = toAnswer(result.answers[rule.id]);
+    if (answer === undefined) continue;
+    const { probability, answer: picked } = violationProbability(rule.check.question, answer);
+    verdicts.push({
+      ruleId: rule.id,
+      probability,
+      band: bandFor(probability, thresholds),
+      ...(picked === undefined ? {} : { answer: picked }),
+    });
+  }
+
+  const inputTokens = result.usage.inputTokens;
+  const usage: Usage = {
+    inputTokens,
+    outputTokens: result.usage.outputTokens,
+    costUsd: inputTokens === undefined ? undefined : inputTokens * JEV_USD_PER_INPUT_TOKEN,
+  };
+  return { verdicts, usage, latencyMs };
+};

package/src/lib/lintConfig.ts

@@ -0,0 +1,53 @@
+import { existsSync, readdirSync, type Dirent } from "node:fs";
+import path from "node:path";
+import { relativeToRoot } from "./paths.js";
+
+const NAMES = [
+  "eslint.config.js",
+  "eslint.config.mjs",
+  "eslint.config.cjs",
+  "eslint.config.ts",
+  ".eslintrc",
+  ".eslintrc.js",
+  ".eslintrc.cjs",
+  ".eslintrc.json",
+  ".eslintrc.yml",
+  ".eslintrc.yaml",
+  "biome.json",
+  "biome.jsonc",
+  ".stylelintrc",
+  ".stylelintrc.json",
+  ".stylelintrc.js",
+  ".stylelintrc.cjs",
+  ".stylelintrc.yml",
+  "stylelint.config.js",
+  "stylelint.config.mjs",
+  "stylelint.config.cjs",
+  ".oxlintrc.json",
+];
+const SKIP = new Set(["node_modules", ".git", "dist", "build", ".next", "coverage", "vendor"]);
+
+/** Lint config files at the root and up to two directory levels down (workspaces). */
+export const findLintConfigs = (root: string): string[] => {
+  const found: string[] = [];
+  const visit = (dir: string, depth: number): void => {
+    for (const name of NAMES) {
+      const file = path.join(dir, name);
+      if (existsSync(file)) found.push(relativeToRoot(root, file));
+    }
+    if (depth >= 2) return;
+    let entries: Dirent[];
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory() && !SKIP.has(entry.name) && !entry.name.startsWith(".")) {
+        visit(path.join(dir, entry.name), depth + 1);
+      }
+    }
+  };
+  visit(root, 0);
+  return found;
+};

package/src/lib/loadRules.ts

@@ -0,0 +1,39 @@
+import { DEFAULT_THRESHOLDS, type Rubric, type Thresholds } from "@coldtea/abide-schema";
+import { globalRubricPath, rubricPath } from "./paths.js";
+import { mergeRules, readRubric, type MergedRule } from "./rubricFile.js";
+
+export type LoadedRules = {
+  project: Rubric | undefined;
+  global: Rubric | undefined;
+  rules: MergedRule[];
+  thresholds: Thresholds;
+  problems: string[];
+};
+
+/** Project rubric plus the global one, project winning on a clash. */
+export const loadRules = (root: string): LoadedRules => {
+  const problems: string[] = [];
+  const pick = (file: string): Rubric | undefined => {
+    const read = readRubric(file);
+    switch (read.kind) {
+      case "ok":
+        return read.rubric;
+      case "invalid":
+        problems.push(`${read.path}: ${read.issues[0] ?? "invalid"}`);
+        return undefined;
+      case "missing":
+        return undefined;
+      default:
+        return undefined;
+    }
+  };
+  const project = pick(rubricPath(root));
+  const global = pick(globalRubricPath());
+  return {
+    project,
+    global,
+    rules: mergeRules(project, global),
+    thresholds: project?.thresholds ?? global?.thresholds ?? DEFAULT_THRESHOLDS,
+    problems,
+  };
+};