@dansyuqri/spark-joy 0.2.1 → 0.3.0

package/dist/app/assets/index-pgxDJMuQ.css

@@ -0,0 +1 @@
+:root{--bg:#fbfaf8;--panel:#fff;--ink:#1d1d1f;--muted:#6b6b72;--line:#e4e2dd;--accent:#c2410c;--accent-ink:#fff;--add-bg:#e9f8ec;--add-ink:#116329;--del-bg:#fdeceb;--del-ink:#a40e26;--hunk-bg:#f1f0fb;--note-bg:#fff8e5;--done:#15803d;--partial:#b45309;--todo:#9ca3af;--mono:ui-monospace, "SF Mono", Menlo, Consolas, monospace;--lightningcss-light:initial;--lightningcss-dark: ;color-scheme:light dark}@media (prefers-color-scheme:dark){:root{--lightningcss-light: ;--lightningcss-dark:initial;--bg:#151518;--panel:#1c1c20;--ink:#ececef;--muted:#9a9aa3;--line:#2e2e34;--accent:#fb923c;--accent-ink:#1a1a1a;--add-bg:#12301c;--add-ink:#7ee2a0;--del-bg:#3a1619;--del-ink:#ff9aa5;--hunk-bg:#23233a;--note-bg:#2f2a18;--done:#4ade80;--partial:#fbbf24;--todo:#6b7280}}*{box-sizing:border-box}body{background:var(--bg);color:var(--ink);margin:0;font:14px/1.5 system-ui,-apple-system,Segoe UI,sans-serif}a{color:var(--accent);text-decoration:none}a:hover{text-decoration:underline}code,kbd{font-family:var(--mono);font-size:.92em}kbd{border:1px solid var(--line);border-radius:4px;padding:0 4px}button{font:inherit;border:1px solid var(--line);background:var(--panel);color:var(--ink);cursor:pointer;border-radius:6px;padding:6px 12px}button:hover:not(:disabled){border-color:var(--muted)}button:disabled{opacity:.4;cursor:default}button.primary{background:var(--accent);border-color:var(--accent);color:var(--accent-ink);font-weight:600}textarea{font:inherit;border:1px solid var(--line);background:var(--panel);width:100%;min-height:70px;color:var(--ink);resize:vertical;border-radius:6px;padding:8px}.muted{color:var(--muted)}.small{font-size:12px}.warn{color:var(--partial)}.pre{white-space:pre-wrap}.empty{max-width:640px;margin:80px auto;padding:0 16px}.topbar{z-index:10;background:var(--panel);border-bottom:1px solid var(--line);align-items:center;gap:20px;padding:10px 20px;display:flex;position:sticky;top:0}.brand{white-space:nowrap;font-weight:700}.spark{color:var(--accent)}.run{white-space:nowrap;text-overflow:ellipsis;flex:1;min-width:0;overflow:hidden}.tabs{gap:4px;display:flex}.tabs a{color:var(--muted);border-radius:6px;padding:4px 10px}.tabs a.on{background:var(--hunk-bg);color:var(--ink);font-weight:600}.progress{font-variant-numeric:tabular-nums;align-items:center;gap:8px;display:flex}.progress .bar{background:var(--line);border-radius:3px;width:120px;height:6px;overflow:hidden}.progress .bar div{background:var(--done);height:100%;transition:width .2s}.saving{width:70px;color:var(--muted);font-size:12px}.saving.error{color:var(--del-ink)}.status{vertical-align:-2px;justify-content:center;align-self:center;width:1.2em;display:inline-flex}.status.done{color:var(--done)}.status.partial{color:var(--partial)}.status.todo{color:var(--todo)}.badge{border:1px solid var(--line);color:var(--muted);white-space:nowrap;border-radius:10px;margin-left:6px;padding:0 6px;font-size:11px;display:inline-block}.risk{vertical-align:middle;color:#fff;white-space:nowrap;border-radius:9px;margin-left:8px;padding:0 6px;font-size:11px;font-weight:600;line-height:17px;display:inline-block}.risk-high{background:var(--del-ink)}.risk-med{background:var(--partial)}.issues{border:1px solid var(--line);background:var(--panel);border-radius:8px;margin:12px 0;padding:8px 12px}.issues.has-errors{border-color:var(--del-ink)}.issues li.error{color:var(--del-ink)}.issues li.warning{color:var(--partial)}.page{max-width:1200px;padding:24px 32px 80px}.overview{max-width:800px;font-size:15px}.strategies{grid-template-columns:repeat(auto-fit,minmax(340px,1fr));gap:16px;display:grid}.strategy{background:var(--panel);border:1px solid var(--line);border-radius:10px;flex-direction:column;padding:16px;display:flex}.strategy.on{border-color:var(--accent);box-shadow:0 0 0 1px var(--accent)}.strategy h3{margin:0 0 4px}.strategy .stats{color:var(--muted);font-size:12px}.chunk-list{flex:1;padding-left:0;list-style:none}.chunk-list .n{min-width:1.6em;color:var(--muted);font-variant-numeric:tabular-nums}.chunk-list li{align-items:center;gap:4px;padding:3px 0;display:flex}.chunk-list li .title{flex:1}.chunk-list .branch{color:var(--muted);font-size:11px;display:block}.strategy .hint{color:var(--muted);margin:10px 0 0;font-size:12px}.size{font-variant-numeric:tabular-nums;color:var(--muted);margin-left:6px;font-size:12px}.features li{margin-bottom:6px}.review{grid-template-columns:300px 1fr;align-items:start;display:grid}.sidebar{border-right:1px solid var(--line);max-height:calc(100vh - 53px);padding:16px 8px 16px 16px;position:sticky;top:53px;overflow:auto}.sidebar ol{margin:8px 0;padding:0;list-style:none}.sidebar li a{color:var(--ink);border-radius:6px;align-items:baseline;gap:6px;padding:5px 8px;display:flex}.sidebar li a:hover{background:var(--hunk-bg);text-decoration:none}.sidebar li.on a{background:var(--hunk-bg);font-weight:600}.sidebar li.skim{border-top:1px dashed var(--line);margin-top:8px;padding-top:8px}.sidebar .n{color:var(--muted);font-variant-numeric:tabular-nums;min-width:1.4em}.sidebar .title{flex:1}.chunk-head h1{margin:0 0 2px;font-size:20px}.chunk-head .intent{max-width:820px;margin:6px 0 0;font-size:15px}.focus{max-width:820px;color:var(--muted);margin:6px 0 0;padding-left:18px}.diff{margin-top:16px}.file{background:var(--panel);border:1px solid var(--line);border-radius:8px;margin-bottom:14px;overflow:hidden}.file>summary{cursor:pointer;border-bottom:1px solid var(--line);align-items:center;gap:4px;padding:8px 12px;display:flex}.file:not([open])>summary{border-bottom:none}.file .path{font-family:var(--mono);font-weight:600}.file .counts{font-family:var(--mono);margin-left:auto;font-size:12px}.add{color:var(--add-ink)}.del{color:var(--del-ink)}.file table{border-collapse:collapse;width:100%;font-family:var(--mono);table-layout:fixed;font-size:12.5px}.file col.no-col{width:52px}.file td.no{text-align:right;color:var(--muted);-webkit-user-select:none;user-select:none;cursor:pointer;vertical-align:top;padding:0 8px}.file td.no:hover{color:var(--accent)}.file td.code{white-space:pre-wrap;word-break:break-all;padding:0 8px}.sign{width:1.2em;color:var(--muted);-webkit-user-select:none;user-select:none;display:inline-block}tr.add td{background:var(--add-bg)}tr.del td{background:var(--del-bg)}tr.meta td{color:var(--muted);font-style:italic}tr.hunk-header td{background:var(--hunk-bg);color:var(--muted);padding:3px 8px}.hid{color:var(--ink);font-weight:700}tr.placeholder td{color:var(--muted);padding:8px;font-family:system-ui,sans-serif}tr.note-row td{background:var(--bg);padding:6px 12px 6px 112px}.line-note{background:var(--note-bg);border:1px solid var(--line);border-radius:6px;padding:8px 10px;font-family:system-ui,sans-serif;font-size:13px}.line-note .text{white-space:pre-wrap;cursor:text}.line-note .actions{gap:6px;margin-top:6px;display:flex}.line-note .actions button{padding:2px 8px;font-size:12px}.chunk-foot{background:var(--bg);border-top:1px solid var(--line);align-items:flex-end;gap:8px;padding:10px 0;display:flex;position:sticky;bottom:0}.chunk-foot textarea{flex:1;height:34px;min-height:34px;padding:6px 8px;transition:height .1s}.chunk-foot textarea:focus,.chunk-foot textarea:not(:placeholder-shown){height:80px}.totals{margin:0 0 8px;font-size:18px}.chunk-refs a{font-variant-numeric:tabular-nums;margin-left:8px;font-size:12px}.features{padding:0;list-style:none}.note-group{background:var(--panel);border:1px solid var(--line);border-radius:8px;margin-bottom:10px;padding:10px 16px}.note-group p{margin:6px 0}.export textarea{min-height:300px;font-family:var(--mono);font-size:12px}@media (width<=900px){.review{grid-template-columns:1fr}.sidebar{border-right:none;border-bottom:1px solid var(--line);max-height:none;position:static}.page{padding:16px}.run{display:none}}.file{scroll-margin-top:64px}.map-page{flex-direction:column;height:calc(100vh - 53px);display:flex}.crumbs{color:var(--muted);padding:10px 20px;font-size:13px}.map-canvas{cursor:grab;touch-action:none;-webkit-user-select:none;user-select:none;flex:1;position:relative;overflow:hidden}.map-canvas:active{cursor:grabbing}.empty-map{padding:20px}.zoom-in{transform-box:fill-box;animation:.22s ease-out zoom-in}@keyframes zoom-in{0%{opacity:0}}.node{cursor:pointer}.node rect{fill:var(--panel);stroke:var(--line);stroke-width:1.2px}.node:hover rect{stroke:var(--accent)}.node.neighbour rect{fill:var(--bg);stroke-dasharray:4 3}.node.neighbour text{opacity:.7}.node text{fill:var(--ink);font-size:13px}.node .title{font-weight:600}.node.file .title{font-family:var(--mono);font-size:12.5px}.node .n{fill:var(--muted);font-weight:400}.node .meta{fill:var(--muted);font-size:11px}.node .status.done{color:var(--done)}.node .status.partial{color:var(--partial)}.node .status.todo{color:var(--todo)}.node .risk-high{fill:var(--del-ink)}.node .risk-med{fill:var(--partial)}.edge path{fill:none;stroke:var(--muted);opacity:.7;transition:opacity .15s}.edge.link path{stroke-dasharray:5 4}.edge.faded{opacity:.15}.arrowhead{fill:var(--muted)}.edge-label rect{fill:var(--bg);stroke:var(--line)}.edge-label text{fill:var(--ink);font-size:11px}tr.gap-row td,tr.foreign-row td{background:var(--hunk-bg);color:var(--muted);padding:2px 8px;font-size:12px}tr.gap-row button{margin-right:6px;padding:1px 8px;font-size:12px}tr.line.expanded td.code,tr.line.expanded td.no{opacity:.75}tr.line.expanded td.no{cursor:default}.file summary .view-file{margin-left:8px;padding:1px 8px;font-size:12px}.risk-reason{border-left:3px solid var(--partial);margin:4px 0 0;padding-left:8px;font-size:13px}.risk-reason-high{border-left-color:var(--del-ink)}.rubric{color:var(--muted);margin:0 0 12px;font-size:13px}.rubric p{margin:4px 0}.rubric .risk{margin:0 6px 0 0}

package/dist/app/index.html

@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>spark-joy review</title>
     <link rel="icon" href="./favicon.svg" type="image/svg+xml" />
-    <script type="module" crossorigin src="/assets/index-_XxERk0m.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-ChCdW9F8.css">
+    <script type="module" crossorigin src="/assets/index-CDcwMAja.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-pgxDJMuQ.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/cli.js

@@ -1,7 +1,7 @@
 // cli/index.ts
-import { copyFile, mkdir as mkdir3, mkdtemp, readFile as readFile4, rm as rm2, writeFile as writeFile3 } from "fs/promises";
+import { copyFile, mkdir as mkdir3, mkdtemp, readFile as readFile6, rm as rm2, writeFile as writeFile3 } from "fs/promises";
 import { homedir, tmpdir } from "os";
-import { join as join4, relative } from "path";
+import { join as join6, relative } from "path";
 import { fileURLToPath } from "url";
 import { parseArgs } from "util";
 
@@ -66,6 +66,8 @@ var Chunk = z.object({
   dependsOn: z.array(z.string()).default([]),
   reviewFocus: z.array(z.string()).default([]),
   risk: Risk.default("low"),
+  // Why this chunk is med or high risk, against the agreed rubric.
+  riskReason: z.string().min(1).optional(),
   // Split mode: the branch this chunk becomes.
   branch: z.string().min(1).optional()
 });
@@ -119,6 +121,23 @@ var ReviewState = z.object({
   updatedAt: z.string().optional()
 });
 var emptyState = () => ReviewState.parse({});
+var RUBRIC_FILE = ".spark-joy.md";
+function parseRubric(text) {
+  const rubric = { high: [], med: [] };
+  let inRisk = false;
+  for (const line of text.split(/\r?\n/)) {
+    const heading = /^#{1,6}\s+(.*)$/.exec(line);
+    if (heading) {
+      inRisk = /^risk$/i.test(heading[1].trim());
+      continue;
+    }
+    const m = inRisk && /^\s*[-*]\s*(high|med|medium)\s*:\s*(.+)$/i.exec(line);
+    if (!m) continue;
+    const items = m[2].split(",").map((s) => s.trim()).filter(Boolean);
+    rubric[m[1].toLowerCase() === "high" ? "high" : "med"].push(...items);
+  }
+  return rubric.high.length || rubric.med.length ? rubric : void 0;
+}
 
 // shared/derive.ts
 var isIgnorable = (h) => h.flags.some((f) => IGNORABLE_FLAGS.includes(f));
@@ -188,7 +207,8 @@ var BUDGET = {
   focusWords: 8,
   featureTitle: 4,
   featureDescription: 8,
-  linkLabel: 3
+  linkLabel: 3,
+  riskReason: 8
 };
 var PADDING = [
   [/,\s*not\b|\bnot just\b|\brather than\b|\binstead of\b/i, "drop the contrast; say only what it does"],
@@ -264,6 +284,10 @@ function validatePlan(raw, hunks, budget = CHUNK_LINE_BUDGET) {
       if (c.hunks.length === 0) error(cw, "chunk has no hunks");
       tooLong(cw, "title", c.title, BUDGET.chunkTitle);
       tooLong(cw, "intent", c.intent, BUDGET.intent);
+      if (c.risk === "low") {
+        if (c.riskReason) warn(cw, "riskReason on a low-risk chunk; drop it");
+      } else if (!c.riskReason) error(cw, `${c.risk} risk needs a riskReason: which rubric item, and where`);
+      else tooLong(cw, "riskReason", c.riskReason, BUDGET.riskReason);
       if (c.reviewFocus.length > BUDGET.focusItems)
         error(cw, `${c.reviewFocus.length} reviewFocus items; max ${BUDGET.focusItems}`);
       c.reviewFocus.forEach((q, n) => tooLong(cw, `reviewFocus ${n + 1}`, q, BUDGET.focusWords));
@@ -667,6 +691,8 @@ function computeLinks(hunks) {
 
 // cli/lib/git.ts
 import { execFile } from "child_process";
+import { lstat, readFile } from "fs/promises";
+import { join } from "path";
 import { promisify } from "util";
 var exec = promisify(execFile);
 async function git(cwd, args, input, env) {
@@ -734,31 +760,39 @@ async function generatedByAttr(cwd, files) {
   }
   return result;
 }
+async function fileText(root, meta, path) {
+  const source = meta.source ?? (meta.working ? "working" : "pr");
+  if (source === "working" || source === "uncommitted") {
+    if ((await lstat(join(root, path))).isSymbolicLink()) throw new Error(`${path} is a symlink`);
+    return readFile(join(root, path), "utf8");
+  }
+  return git(root, ["show", `${source === "staged" ? "" : meta.headSha}:${path}`]);
+}
 
 // cli/lib/runs.ts
-import { mkdir, readFile, readdir, rename, stat, writeFile } from "fs/promises";
-import { join } from "path";
+import { mkdir, readFile as readFile2, readdir, rename, stat, writeFile } from "fs/promises";
+import { join as join2 } from "path";
 import { z as z2 } from "zod";
 var RUNS_DIR = ".spark-joy";
 var slug = (s) => s.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "run";
 function runPaths(root, name) {
-  const dir = join(root, RUNS_DIR, name);
+  const dir = join2(root, RUNS_DIR, name);
   return {
     name,
     dir,
-    hunks: join(dir, "hunks.json"),
-    meta: join(dir, "meta.json"),
-    plan: join(dir, "plan.json"),
-    state: join(dir, "review-state.json"),
-    review: join(dir, "review.md"),
-    links: join(dir, "links.json"),
-    prs: join(dir, "prs.md")
+    hunks: join2(dir, "hunks.json"),
+    meta: join2(dir, "meta.json"),
+    plan: join2(dir, "plan.json"),
+    state: join2(dir, "review-state.json"),
+    review: join2(dir, "review.md"),
+    links: join2(dir, "links.json"),
+    prs: join2(dir, "prs.md")
   };
 }
 async function ensureRunsDir(root) {
-  const dir = join(root, RUNS_DIR);
+  const dir = join2(root, RUNS_DIR);
   await mkdir(dir, { recursive: true });
-  await writeFile(join(dir, ".gitignore"), "*\n");
+  await writeFile(join2(dir, ".gitignore"), "*\n");
 }
 var exists = (p) => stat(p).then(() => true, () => false);
 async function resolveRun(root, name, branch) {
@@ -774,11 +808,11 @@ async function resolveRun(root, name, branch) {
   return runPaths(root, runs[0].name);
 }
 async function listRuns(root) {
-  const dir = join(root, RUNS_DIR);
+  const dir = join2(root, RUNS_DIR);
   const names = await readdir(dir).catch(() => []);
   const runs = [];
   for (const name of names) {
-    const s = await stat(join(dir, name, "hunks.json")).catch(() => void 0);
+    const s = await stat(join2(dir, name, "hunks.json")).catch(() => void 0);
     if (s) runs.push({ name, mtime: s.mtimeMs });
   }
   return runs.sort((a, b) => b.mtime - a.mtime);
@@ -789,7 +823,7 @@ async function writeJson(path, data) {
   await rename(tmp, path);
 }
 async function readJson(path) {
-  return JSON.parse(await readFile(path, "utf8"));
+  return JSON.parse(await readFile2(path, "utf8"));
 }
 var readHunks = async (p) => z2.array(Hunk).parse(await readJson(p.hunks));
 var readMeta = async (p) => Meta.parse(await readJson(p.meta));
@@ -938,7 +972,8 @@ function exportMarkdown(meta, hunks, plan, state) {
   for (const c of view.chunks) {
     const status = hunkStatus(c.hunks, reviewed);
     const changed = status === "partial" ? " \xB7 changed since review" : "";
-    out.push(`- ${MARK[status]} ${c.index + 1}. ${c.chunk.title} (${c.size})${changed}`);
+    const risk = c.chunk.risk !== "low" ? ` \xB7 ${c.chunk.risk}: ${c.chunk.riskReason ?? "unexplained"}` : "";
+    out.push(`- ${MARK[status]} ${c.index + 1}. ${c.chunk.title} (${c.size})${risk}${changed}`);
     const note = state.chunkNotes[chunkNoteKey(view.strategy.id, c.chunk.id)]?.trim();
     if (note) out.push(...note.split("\n").map((l) => `  > ${l}`));
     for (const n of notesInHunks(c.hunks, state.lineNotes))
@@ -1038,10 +1073,19 @@ function formatLinks(hunks, links) {
   return [...pairs].sort(([a], [b]) => a.localeCompare(b)).map(([pair, items]) => [pair, ...items.map((i) => `    ${i}`)].join("\n")).join("\n");
 }
 
+// cli/lib/rubric.ts
+import { readFile as readFile3 } from "fs/promises";
+import { join as join3 } from "path";
+async function readRubric(root) {
+  const text = await readFile3(join3(root, RUBRIC_FILE), "utf8").catch(() => void 0);
+  return text === void 0 ? void 0 : parseRubric(text);
+}
+var formatRubric = (r) => [r.high.length ? `high: ${r.high.join(", ")}` : "", r.med.length ? `med: ${r.med.join(", ")}` : ""].filter(Boolean).join("\n");
+
 // cli/lib/server.ts
 import { createServer } from "http";
-import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import { extname as extname2, join as join2, normalize, sep } from "path";
+import { readFile as readFile4, writeFile as writeFile2 } from "fs/promises";
+import { extname as extname2, join as join4, normalize, sep } from "path";
 var TYPES = {
   ".html": "text/html; charset=utf-8",
   ".js": "text/javascript; charset=utf-8",
@@ -1051,6 +1095,7 @@ var TYPES = {
   ".map": "application/json"
 };
 var MAX_BODY = 20 * 1024 * 1024;
+var MAX_FILE = 2 * 1024 * 1024;
 async function body(req) {
   const chunks = [];
   let size = 0;
@@ -1073,6 +1118,7 @@ async function loadRun(paths) {
     readState(paths),
     readLinks(paths)
   ]);
+  const rubric = await readRubric(meta.repoRoot);
   const validation = raw === void 0 ? void 0 : validatePlan(raw, hunks);
   return {
     meta,
@@ -1081,7 +1127,8 @@ async function loadRun(paths) {
     issues: validation?.issues ?? [],
     hasPlan: raw !== void 0,
     links,
-    state
+    state,
+    rubric
   };
 }
 async function serve(opts) {
@@ -1097,6 +1144,19 @@ async function serve(opts) {
         return send(res, 403, { error: "cross-origin request refused" });
       }
       if (url.pathname === "/api/run" && req.method === "GET") return send(res, 200, await loadRun(paths));
+      if (url.pathname === "/api/file" && req.method === "GET") {
+        const path = url.searchParams.get("path") ?? "";
+        const [meta, hunks] = await Promise.all([readMeta(paths), readHunks(paths)]);
+        const hs = hunks.filter((h) => h.file === path);
+        if (!hs.length || hs[0].status === "deleted" || hs.some((h) => h.flags.includes("binary")))
+          return send(res, 404, { error: "no text for that file" });
+        const text = await fileText(meta.repoRoot, meta, path).catch(() => void 0);
+        if (text === void 0) return send(res, 404, { error: "no text for that file" });
+        if (text.length > MAX_FILE || text.includes("\0")) return send(res, 404, { error: "file too large or binary" });
+        const lines = text.split("\n");
+        if (lines.at(-1) === "") lines.pop();
+        return send(res, 200, { lines: lines.map((l) => l.replace(/\r$/, "")) });
+      }
       if (url.pathname === "/api/state" && req.method === "PUT") {
         const state = ReviewState.parse(await body(req));
         state.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -1113,14 +1173,14 @@ async function serve(opts) {
       if (url.pathname.startsWith("/api/")) return send(res, 404, { error: "not found" });
       if (req.method !== "GET") return send(res, 405, { error: "method not allowed" });
       const rel = normalize(decodeURIComponent(url.pathname)).replace(/^([/\\])+/, "");
-      let file = join2(appDir, rel);
+      let file = join4(appDir, rel);
       if (!file.startsWith(appDir + sep) && file !== appDir) return send(res, 403, { error: "forbidden" });
       let data;
       try {
-        data = await readFile2(file);
+        data = await readFile4(file);
       } catch {
-        file = join2(appDir, "index.html");
-        data = await readFile2(file);
+        file = join4(appDir, "index.html");
+        data = await readFile4(file);
       }
       res.writeHead(200, { "content-type": TYPES[extname2(file)] ?? "application/octet-stream" });
       res.end(data);
@@ -1153,8 +1213,8 @@ async function serve(opts) {
 
 // cli/lib/stack.ts
 import { execFile as execFile2 } from "child_process";
-import { lstat, readFile as readFile3, readlink, rm } from "fs/promises";
-import { join as join3 } from "path";
+import { lstat as lstat2, readFile as readFile5, readlink, rm } from "fs/promises";
+import { join as join5 } from "path";
 import { promisify as promisify2 } from "util";
 var execP = promisify2(execFile2);
 var ZERO = "0".repeat(40);
@@ -1222,9 +1282,9 @@ async function targetEntry(root, meta, path) {
     const m = /^(\d+) ([0-9a-f]+) 0\t/.exec(await git(root, ["ls-files", "-s", "-z", "--", path]));
     if (m) e = { mode: m[1], sha: m[2] };
   } else {
-    const full = join3(root, path);
-    const st = await lstat(full);
-    const content = st.isSymbolicLink() ? await readlink(full) : await readFile3(full);
+    const full = join5(root, path);
+    const st = await lstat2(full);
+    const content = st.isSymbolicLink() ? await readlink(full) : await readFile5(full);
     const mode = st.isSymbolicLink() ? "120000" : st.mode & 73 ? "100755" : "100644";
     const sha = st.isSymbolicLink() ? (await git(root, ["hash-object", "-w", "--stdin"], content)).trim() : (await git(root, ["hash-object", "-w", "--", path])).trim();
     e = { mode, sha };
@@ -1330,7 +1390,7 @@ async function createBranches(root, stack, force) {
 async function checkStack(root, stack, cmd, tmp) {
   const results = [];
   for (const pr of stack.prs) {
-    const dir = join3(tmp, `pr-${pr.n}`);
+    const dir = join5(tmp, `pr-${pr.n}`);
     await git(root, ["worktree", "add", "--detach", "--quiet", dir, pr.commit]);
     try {
       const r = await execP(cmd, { cwd: dir, shell: true, maxBuffer: 64 * 1024 * 1024 }).then(
@@ -1352,6 +1412,7 @@ function prsMarkdown(meta, stack) {
     out.push(`## ${pr.n}. ${c.title}`, "");
     out.push(`\`${pr.branch}\` \u2192 \`${i === 0 ? target : stack.prs[i - 1].branch}\` \xB7 ${pr.lines} lines`, "");
     out.push(c.intent, "");
+    if (c.risk !== "low") out.push(`**${c.risk === "high" ? "High" : "Medium"} risk:** ${c.riskReason ?? "unexplained"}`, "");
     for (const q of c.reviewFocus) out.push(`- ${q}`);
     if (c.reviewFocus.length) out.push("");
     const deps = c.dependsOn.map((d) => stack.prs.find((p) => p.chunk.id === d)?.n).filter((n) => n && n < pr.n - 1);
@@ -1376,6 +1437,7 @@ Commands:
   show <ids...>         Print hunks in full; accepts h003, h003..h010, or a parent id like h012
       --file <path>     Print every hunk of a file
   links                 Cross-file links: which hunk uses a name another hunk defines
+  rubric                Print the agreed risk rubric (.spark-joy.md at the repo root)
   validate              Check plan.json against the hunks
       --json            Machine-readable output
   serve                 Open the review app
@@ -1430,7 +1492,7 @@ async function main(argv, cwd = process.cwd()) {
   });
   const [cmd, ...rest] = positionals;
   if (values.version) {
-    const pkg = JSON.parse(await readFile4(join4(PKG_ROOT, "package.json"), "utf8"));
+    const pkg = JSON.parse(await readFile6(join6(PKG_ROOT, "package.json"), "utf8"));
     console.log(pkg.version);
     return 0;
   }
@@ -1451,6 +1513,7 @@ async function main(argv, cwd = process.cwd()) {
       if (r.untracked.length)
         console.log(`note: ${r.untracked.length} untracked file(s) are not included; \`git add -N <file>\` to include them`);
       if (await readPlanRaw(r.paths)) console.log("note: plan.json already exists and may be stale; run `spark-joy validate`");
+      console.log(await readRubric(r.meta.repoRoot) ? `risk rubric: ${RUBRIC_FILE}` : "no risk rubric yet");
       return 0;
     }
     case "outline": {
@@ -1471,11 +1534,19 @@ async function main(argv, cwd = process.cwd()) {
       console.log(formatLinks(await readHunks(p), await readLinks(p)));
       return 0;
     }
+    case "rubric": {
+      const rubric = await readRubric(await repoRoot(cwd));
+      console.log(rubric ? formatRubric(rubric) : `no risk rubric yet; agree one with the user and write ${RUBRIC_FILE}`);
+      return 0;
+    }
     case "validate": {
       const p = await run(cwd, values.run);
       const raw = await readPlanRaw(p);
       if (raw === void 0) throw new Error(`no plan yet; write ${p.plan}`);
       const result = validatePlan(raw, await readHunks(p));
+      const risky = result.plan?.strategies.some((s) => s.chunks.some((c) => c.risk !== "low"));
+      if (risky && !await readRubric(await repoRoot(cwd)))
+        result.issues.push({ level: "warning", where: "risk", message: `no risk rubric; agree one with the user and write ${RUBRIC_FILE}` });
       if (values.json) {
         console.log(JSON.stringify({ ok: result.ok, issues: result.issues }, null, 2));
       } else {
@@ -1489,7 +1560,7 @@ async function main(argv, cwd = process.cwd()) {
     case "serve": {
       const p = await run(cwd, values.run);
       const port = values.port ? Number(values.port) : 4848;
-      const s = await serve({ paths: p, appDir: join4(PKG_ROOT, "dist", "app"), port });
+      const s = await serve({ paths: p, appDir: join6(PKG_ROOT, "dist", "app"), port });
       console.log(`spark-joy reviewing ${p.name} at ${s.url}  (Ctrl+C to stop)`);
       await new Promise((resolve) => process.once("SIGINT", resolve));
       await s.close();
@@ -1524,13 +1595,13 @@ async function main(argv, cwd = process.cwd()) {
         hunks,
         plan: result.plan,
         prefix,
-        indexFile: join4(p.dir, "split.index")
+        indexFile: join6(p.dir, "split.index")
       });
       for (const pr of stack.prs)
         console.log(`${String(pr.n).padStart(2)}  ${pr.branch}  ${pr.lines} lines, ${pr.files} files  ${pr.chunk.title}`);
       console.log(`${stack.prs.length} PRs; the last one matches your changes exactly`);
       if (values.check !== void 0) {
-        const tmp = await mkdtemp(join4(tmpdir(), "spark-joy-check-"));
+        const tmp = await mkdtemp(join6(tmpdir(), "spark-joy-check-"));
         try {
           const results = await checkStack(meta.repoRoot, stack, values.check, tmp);
           for (const r of results) {
@@ -1555,9 +1626,9 @@ nothing created; add --apply to create the branches`);
       return 0;
     }
     case "install-skill": {
-      const skill = join4(PKG_ROOT, "plugin", "skills", "spark-joy", "SKILL.md");
+      const skill = join6(PKG_ROOT, "plugin", "skills", "spark-joy", "SKILL.md");
       if (values.print) {
-        process.stdout.write(await readFile4(skill, "utf8"));
+        process.stdout.write(await readFile6(skill, "utf8"));
         return 0;
       }
       const homes = { claude: ".claude", agents: ".agents" };
@@ -1566,9 +1637,9 @@ nothing created; add --apply to create the branches`);
       if (bad) throw new Error(`unknown agent ${bad}; use claude or agents`);
       const root = values.project ? await repoRoot(cwd) : homedir();
       for (const a of agents) {
-        const dir = join4(root, homes[a], "skills", "spark-joy");
+        const dir = join6(root, homes[a], "skills", "spark-joy");
         await mkdir3(dir, { recursive: true });
-        await copyFile(skill, join4(dir, "SKILL.md"));
+        await copyFile(skill, join6(dir, "SKILL.md"));
         console.log(`installed skill to ${dir}`);
       }
       console.log('ask your agent to "review this PR in chunks" or "split my changes into PRs"');