@pablozrrrr/jevguard 0.2.0 → 0.2.3

package/cli/main.js

@@ -388,7 +388,7 @@ function buildReviewContext(turn, rule, scopedPaths) {
 var DEFAULT_MAX_DIFF_LENGTH = 1e5;
 var DEFAULT_EVIDENCE_POLICY = {
   maxDiffLength: DEFAULT_MAX_DIFF_LENGTH,
-  allowedExtensions: [
+  codeExtensions: [
     ".ts",
     ".tsx",
     ".mts",
@@ -399,9 +399,6 @@ var DEFAULT_EVIDENCE_POLICY = {
     ".cjs",
     ".json",
     ".jsonc",
-    ".md",
-    ".mdx",
-    ".txt",
     ".yaml",
     ".yml",
     ".toml",
@@ -457,6 +454,7 @@ var DEFAULT_EVIDENCE_POLICY = {
     ".diff",
     ".patch"
   ],
+  docsExtensions: [".md", ".mdx", ".txt"],
   deniedFileNames: [
     ".env",
     ".envrc",
@@ -531,18 +529,26 @@ function checkFilePath(path, policy) {
   if (policy.deniedExtensions.includes(extension)) {
     return DENIED_SENSITIVE;
   }
-  if (!policy.allowedExtensions.includes(extension)) {
+  if (!isAllowlistedExtension(extension, policy)) {
     return DENIED_EXTENSION;
   }
   return { allowed: true };
 }
+function isAllowlistedExtension(extension, policy) {
+  return policy.codeExtensions.includes(extension) || policy.docsExtensions.includes(extension);
+}
 function matchesDeniedFileName(basename, policy) {
   return policy.deniedFileNames.some((name) => name.startsWith(".") ? basename === name || basename.startsWith(`${name}.`) : basename === name);
 }
 
 // packages/core/src/evidence/scope.ts
-function matchesScope(path, scope) {
-  return globToRegExp(scope).test(normalizePath(path));
+function matchesRuleScope(path, scope) {
+  const normalized = normalizePath(path);
+  const included = scope.include.some((pattern) => globToRegExp(pattern).test(normalized));
+  if (!included) {
+    return false;
+  }
+  return !scope.exclude.some((pattern) => globToRegExp(pattern).test(normalized));
 }
 function globToRegExp(glob) {
   const source = glob.replace(/\\/g, "/");
@@ -569,16 +575,6 @@ function globToRegExp(glob) {
 }
 
 // packages/core/src/evidence/select-evidence.ts
-function selectRuleEvidence(turn, rule, policy = DEFAULT_EVIDENCE_POLICY) {
-  if (hasNoAttributedPatch(turn)) {
-    return { status: "SKIPPED", reason: "NO_ATTRIBUTED_PATCH" };
-  }
-  const applicableFiles = selectApplicableFiles(turn.files, rule.scope);
-  if (applicableFiles.length === 0) {
-    return { status: "SKIPPED", reason: "NO_SCOPE_MATCH" };
-  }
-  return mountEvidence(applicableFiles, policy);
-}
 function selectTurnEvidence(turn, policy = DEFAULT_EVIDENCE_POLICY) {
   if (hasNoAttributedPatch(turn)) {
     return { status: "SKIPPED", reason: "NO_ATTRIBUTED_PATCH" };
@@ -605,11 +601,21 @@ function mountEvidence(files, policy) {
 function hasNoAttributedPatch(turn) {
   return turn.files.every((file) => file.patch.trim() === "");
 }
-function selectApplicableFiles(files, scope) {
-  if (scope === null) {
-    return files;
+function selectApplicableFiles(files, scope, evidenceClass, policy) {
+  const scoped = scope === null ? files : files.filter((file) => matchesRuleScope(file.path, scope));
+  return scoped.filter((file) => isInEvidenceClass(file.path, evidenceClass, policy));
+}
+function isInEvidenceClass(path, evidenceClass, policy) {
+  if (evidenceClass === "any") {
+    return true;
+  }
+  const safety = checkFilePath(path, policy);
+  if (!safety.allowed && safety.reason === "DENIED_SENSITIVE_PATH") {
+    return true;
   }
-  return files.filter((file) => matchesScope(file.path, scope));
+  const extension = fileExtension(path);
+  const otherClass = evidenceClass === "code" ? policy.docsExtensions : policy.codeExtensions;
+  return !otherClass.includes(extension);
 }
 function assembleDiff(files) {
   return files.map((file) => file.patch).join(`
@@ -650,14 +656,20 @@ function evaluateWarningGate(probability, thresholds) {
 }
 
 // packages/core/src/evaluation/evaluate-with-port.ts
-async function evaluateWithPort(port, request) {
+async function evaluateRuleBatchWithPort(port, requests) {
   try {
-    const result = await port.evaluate(request);
-    return result.kind === "RULE" ? result : { kind: "RULE", status: "FAILED", reason: "INVALID_RESPONSE" };
+    const results = await port.evaluateRuleBatch(requests);
+    if (results.length !== requests.length) {
+      return requests.map(() => ruleFailure("INVALID_RESPONSE"));
+    }
+    return results.map((result) => result.kind === "RULE" ? result : ruleFailure("INVALID_RESPONSE"));
   } catch {
-    return { kind: "RULE", status: "FAILED", reason: "API_ERROR" };
+    return requests.map(() => ruleFailure("API_ERROR"));
   }
 }
+function ruleFailure(reason) {
+  return { kind: "RULE", status: "FAILED", reason };
+}
 async function evaluateBuiltInBatchWithPort(port, request) {
   try {
     const result = await port.evaluate(request);
@@ -666,27 +678,118 @@ async function evaluateBuiltInBatchWithPort(port, request) {
     return { kind: "BUILT_IN_BATCH", status: "FAILED", reason: "API_ERROR" };
   }
 }
-
-// packages/core/src/evaluation/evaluate-rule.ts
-async function evaluateRule(input, dependencies) {
-  const selection = selectRuleEvidence(input.turn, input.rule, input.evidencePolicy);
-  if (selection.status === "SKIPPED") {
-    const context = buildReviewContext(input.turn, input.rule, []);
-    return { ...context, outcome: "SKIPPED", reason: selection.reason };
+// packages/core/src/evidence/plan-slices.ts
+var HUNK_MARKER = /^@@ [^\n]*@@/gm;
+function planRuleEvidence(turn, rule, policy = DEFAULT_EVIDENCE_POLICY) {
+  if (hasNoAttributedPatch(turn)) {
+    return { status: "SKIPPED", reason: "NO_ATTRIBUTED_PATCH" };
   }
-  if (selection.status === "UNAVAILABLE") {
-    const context = buildReviewContext(input.turn, input.rule, []);
-    return { ...context, outcome: "UNAVAILABLE", reason: selection.reason };
+  const applicableFiles = selectApplicableFiles(turn.files, rule.scope, rule.evidence, policy);
+  if (applicableFiles.length === 0) {
+    return { status: "SKIPPED", reason: "NO_SCOPE_MATCH" };
   }
-  const context = buildReviewContext(input.turn, input.rule, selection.evidence.files);
-  const request = buildJevRequest(input.turn.task, input.rule, selection.evidence);
-  const evaluation = await evaluateWithPort(dependencies.jev, request);
-  if (evaluation.status === "FAILED") {
-    return { ...context, outcome: "UNAVAILABLE", reason: "JEV_FAILURE" };
+  const diff = assembleDiff(applicableFiles);
+  if (diff.trim() === "") {
+    return { status: "SKIPPED", reason: "NO_ATTRIBUTED_PATCH" };
+  }
+  if (applicableFiles.some((file) => !checkFilePath(file.path, policy).allowed)) {
+    return { status: "UNAVAILABLE", reason: "BLOCKED_EVIDENCE" };
+  }
+  if (diff.length <= policy.maxDiffLength) {
+    return { status: "PLANNED", slices: [wholeSlice(applicableFiles, diff)] };
   }
-  const gate = evaluateGate(input.rule.severity, evaluation.noul.violationProbability, input.gateConfig);
-  return { ...context, ...gate };
+  return sliceByFile(applicableFiles, policy);
 }
+function wholeSlice(files, diff) {
+  const paths = files.map((file) => file.path);
+  return {
+    index: 0,
+    kind: "WHOLE",
+    path: paths.length === 1 ? paths[0] ?? null : null,
+    hunkOrdinal: null,
+    files: paths,
+    diff
+  };
+}
+function sliceByFile(files, policy) {
+  const slices = [];
+  for (const file of files) {
+    if (file.patch.length <= policy.maxDiffLength) {
+      slices.push(fileSlice(slices.length, file));
+      continue;
+    }
+    const hunks = sliceHunks(slices.length, file, policy);
+    if (hunks === null) {
+      return { status: "UNAVAILABLE", reason: "OVERSIZED_DIFF" };
+    }
+    slices.push(...hunks);
+  }
+  return { status: "PLANNED", slices };
+}
+function fileSlice(index, file) {
+  return {
+    index,
+    kind: "FILE",
+    path: file.path,
+    hunkOrdinal: null,
+    files: [file.path],
+    diff: file.patch
+  };
+}
+function sliceHunks(startIndex, file, policy) {
+  const starts = hunkStarts(file.patch);
+  if (starts.length === 0) {
+    return null;
+  }
+  const firstStart = starts[0];
+  if (firstStart === undefined) {
+    return null;
+  }
+  const preamble = file.patch.slice(0, firstStart);
+  const slices = [];
+  for (let ordinal = 0;ordinal < starts.length; ordinal += 1) {
+    const start = starts[ordinal];
+    if (start === undefined) {
+      return null;
+    }
+    const end = starts[ordinal + 1] ?? file.patch.length;
+    const rendered = preamble + file.patch.slice(start, end);
+    if (rendered.length > policy.maxDiffLength) {
+      return null;
+    }
+    slices.push({
+      index: startIndex + ordinal,
+      kind: "HUNK",
+      path: file.path,
+      hunkOrdinal: ordinal,
+      files: [file.path],
+      diff: rendered
+    });
+  }
+  return slices;
+}
+function hunkStarts(patch) {
+  return Array.from(patch.matchAll(HUNK_MARKER), (match) => match.index ?? 0);
+}
+
+// packages/core/src/evidence/slice-budget.ts
+var MAX_SLICES_PER_RULE = 16;
+var MAX_EXTRA_RULE_CALLS_PER_TURN = 32;
+function planTurnRuleSlices(plans) {
+  let remainingExtraCalls = MAX_EXTRA_RULE_CALLS_PER_TURN;
+  return plans.map((plan) => {
+    if (plan.status !== "PLANNED") {
+      return plan;
+    }
+    const extraCalls = plan.slices.length - 1;
+    if (plan.slices.length > MAX_SLICES_PER_RULE || extraCalls > remainingExtraCalls) {
+      return { status: "SLICE_LIMIT_EXCEEDED", slices: plan.slices };
+    }
+    remainingExtraCalls -= extraCalls;
+    return plan;
+  });
+}
+
 // packages/core/src/review/aggregate.ts
 var VERDICT_RANK = { PASS: 0, WARN: 1, FAIL: 2 };
 function aggregateReview(turnId, results) {
@@ -740,28 +843,204 @@ function isSemanticVerdict(outcome) {
   return outcome === "PASS" || outcome === "WARN" || outcome === "FAIL";
 }
 
-// packages/core/src/evaluation/evaluate-rules.ts
-async function evaluateRules(input, dependencies) {
-  const results = [];
-  for (const rule of input.rules) {
-    results.push(await evaluateRuleResult(input, rule, dependencies));
+// packages/core/src/evaluation/assemble-rule.ts
+var VERDICT_RANK2 = { PASS: 0, WARN: 1, FAIL: 2 };
+function assembleSlicedRuleResult(rule, context, slices, evaluations, gateConfig) {
+  if (slices.length === 0) {
+    return { ...context, outcome: "SKIPPED", reason: "NO_SCOPE_MATCH" };
+  }
+  const summaries = slices.map(sliceSummary);
+  const mode = evidenceMode(slices.length);
+  const gates = [];
+  const judgments = [];
+  let failureIndex = null;
+  for (let index = 0;index < slices.length; index += 1) {
+    const slice = slices[index];
+    const evaluation = evaluations[index];
+    if (slice === undefined || evaluation === undefined || evaluation.status === "FAILED") {
+      failureIndex = index;
+      break;
+    }
+    const gate = evaluateGate(rule.severity, evaluation.noul.violationProbability, gateConfig);
+    if (gate.outcome === "UNAVAILABLE") {
+      failureIndex = index;
+      break;
+    }
+    gates.push(gate);
+    judgments.push({
+      index: slice.index,
+      probability: gate.violationProbability,
+      outcome: gate.outcome
+    });
   }
-  return aggregateReview(input.turn.id, results);
+  if (failureIndex !== null) {
+    return {
+      ...context,
+      outcome: "UNAVAILABLE",
+      reason: "JEV_FAILURE",
+      evidence: failedMetadata(mode, summaries, failureIndex)
+    };
+  }
+  return {
+    ...context,
+    outcome: mergeVerdict(gates),
+    violationProbability: maxProbability(gates),
+    evidence: completeMetadata(mode, summaries, judgments)
+  };
+}
+function overBudgetMetadata(slices) {
+  const summaries = slices.map(sliceSummary);
+  return {
+    mode: "SLICED",
+    plannedSliceCount: summaries.length,
+    evaluatedSliceCount: 0,
+    failedSliceCount: 0,
+    notEvaluatedSliceCount: summaries.length,
+    slices: summaries,
+    sliceJudgments: [],
+    failingSliceIndex: null,
+    failureReason: "SLICE_LIMIT_EXCEEDED"
+  };
+}
+function sliceSummary(slice) {
+  return {
+    index: slice.index,
+    path: slice.path,
+    kind: slice.kind,
+    hunkOrdinal: slice.hunkOrdinal
+  };
 }
-async function evaluateRuleResult(input, rule, dependencies) {
-  if (rule.status === "INVALID") {
-    return invalidRuleResult(input.turn.id, rule);
+function evidenceMode(sliceCount) {
+  return sliceCount === 1 ? "WHOLE" : "SLICED";
+}
+function mergeVerdict(gates) {
+  let verdict = "PASS";
+  for (const gate of gates) {
+    if (VERDICT_RANK2[gate.outcome] > VERDICT_RANK2[verdict]) {
+      verdict = gate.outcome;
+    }
   }
+  return verdict;
+}
+function maxProbability(gates) {
+  return gates.reduce((highest, gate) => Math.max(highest, gate.violationProbability), Number.NEGATIVE_INFINITY);
+}
+function completeMetadata(mode, summaries, judgments) {
+  return {
+    mode,
+    plannedSliceCount: summaries.length,
+    evaluatedSliceCount: summaries.length,
+    failedSliceCount: 0,
+    notEvaluatedSliceCount: 0,
+    slices: summaries,
+    sliceJudgments: judgments,
+    failingSliceIndex: null,
+    failureReason: null
+  };
+}
+function failedMetadata(mode, summaries, failingIndex) {
+  return {
+    mode,
+    plannedSliceCount: summaries.length,
+    evaluatedSliceCount: failingIndex,
+    failedSliceCount: 1,
+    notEvaluatedSliceCount: summaries.length - failingIndex - 1,
+    slices: summaries,
+    sliceJudgments: [],
+    failingSliceIndex: failingIndex,
+    failureReason: "JEV_FAILURE"
+  };
+}
+
+// packages/core/src/evaluation/evaluate-rules.ts
+async function evaluateRules(input, dependencies) {
   if (input.gateConfig.status === "INVALID") {
-    return invalidConfigResult(input.turn, rule.rule);
+    const results = input.rules.map((candidate) => candidate.status === "INVALID" ? invalidRuleResult(input.turn.id, candidate) : invalidConfigResult(input.turn, candidate.rule));
+    return aggregateReview(input.turn.id, results);
+  }
+  const gateConfig = input.gateConfig.config;
+  const slots = resolveSlots(input);
+  const requests = collectRequests(input.turn.task, slots);
+  const evaluations = requests.length === 0 ? [] : await evaluateRuleBatchWithPort(dependencies.jev, requests);
+  return aggregateReview(input.turn.id, assembleResults(input, slots, evaluations, gateConfig));
+}
+function resolveSlots(input) {
+  const planned = input.rules.map((candidate) => candidate.status === "INVALID" ? { kind: "RESULT", result: invalidRuleResult(input.turn.id, candidate) } : {
+    kind: "PLAN",
+    rule: candidate.rule,
+    plan: planRuleEvidence(input.turn, candidate.rule, input.evidencePolicy)
+  });
+  const budgeted = planTurnRuleSlices(planned.flatMap((slot) => slot.kind === "PLAN" ? [slot.plan] : []));
+  let cursor = 0;
+  return planned.map((slot) => {
+    if (slot.kind === "RESULT") {
+      return slot;
+    }
+    const plan = budgeted[cursor];
+    cursor += 1;
+    return plan === undefined ? slot : { kind: "PLAN", rule: slot.rule, plan };
+  });
+}
+function collectRequests(task, slots) {
+  const requests = [];
+  for (const slot of slots) {
+    if (slot.kind !== "PLAN" || slot.plan.status !== "PLANNED") {
+      continue;
+    }
+    for (const slice of slot.plan.slices) {
+      requests.push(buildJevRequest(task, slot.rule, { files: slice.files, diff: slice.diff }));
+    }
   }
-  const ruleInput = {
-    turn: input.turn,
-    rule: rule.rule,
-    gateConfig: input.gateConfig.config,
-    evidencePolicy: input.evidencePolicy
-  };
-  return evaluateRule(ruleInput, dependencies);
+  return requests;
+}
+function assembleResults(input, slots, evaluations, gateConfig) {
+  const results = [];
+  let evaluationCursor = 0;
+  for (const slot of slots) {
+    if (slot.kind === "RESULT") {
+      results.push(slot.result);
+      continue;
+    }
+    const plan = slot.plan;
+    if (plan.status === "SKIPPED") {
+      results.push(skippedResult(input.turn, slot.rule, plan.reason));
+      continue;
+    }
+    if (plan.status === "UNAVAILABLE") {
+      results.push(unavailableResult(input.turn, slot.rule, plan.reason));
+      continue;
+    }
+    if (plan.status === "SLICE_LIMIT_EXCEEDED") {
+      results.push({
+        ...buildReviewContext(input.turn, slot.rule, collectSlicePaths(plan.slices)),
+        outcome: "UNAVAILABLE",
+        reason: "SLICE_LIMIT_EXCEEDED",
+        evidence: overBudgetMetadata(plan.slices)
+      });
+      continue;
+    }
+    const sliceEvaluations = evaluations.slice(evaluationCursor, evaluationCursor + plan.slices.length);
+    evaluationCursor += plan.slices.length;
+    results.push(assembleSlicedRuleResult(slot.rule, buildReviewContext(input.turn, slot.rule, collectSlicePaths(plan.slices)), plan.slices, sliceEvaluations, gateConfig));
+  }
+  return results;
+}
+function collectSlicePaths(slices) {
+  const paths = [];
+  for (const slice of slices) {
+    for (const path of slice.files) {
+      if (!paths.includes(path)) {
+        paths.push(path);
+      }
+    }
+  }
+  return paths;
+}
+function skippedResult(turn, rule, reason) {
+  return { ...buildReviewContext(turn, rule, []), outcome: "SKIPPED", reason };
+}
+function unavailableResult(turn, rule, reason) {
+  return { ...buildReviewContext(turn, rule, []), outcome: "UNAVAILABLE", reason };
 }
 function invalidRuleResult(turnId, failure) {
   return {
@@ -803,13 +1082,29 @@ function matchSectionHeading(line) {
 var METADATA_ENTRY = /^([A-Za-z][A-Za-z0-9_-]*)\s*:\s*(.*)$/;
 function parseRuleMetadata(lines) {
   let severity = null;
-  let scope = null;
+  let evidence = null;
+  let scopeDeclared = false;
+  const includePatterns = [];
+  const excludePatterns = [];
   const seenKeys = new Set;
   for (const line of collectMetadataLines(lines)) {
     const entry = parseMetadataEntry(line);
     if (entry === null) {
       return { ok: false, code: "MALFORMED_METADATA" };
     }
+    if (entry.key === "scope") {
+      const pattern = parseScopePattern(entry.value);
+      if (pattern === null) {
+        return { ok: false, code: "MALFORMED_METADATA" };
+      }
+      scopeDeclared = true;
+      if (pattern.exclude) {
+        excludePatterns.push(pattern.pattern);
+      } else {
+        includePatterns.push(pattern.pattern);
+      }
+      continue;
+    }
     if (seenKeys.has(entry.key)) {
       return { ok: false, code: "DUPLICATE_METADATA" };
     }
@@ -822,11 +1117,12 @@ function parseRuleMetadata(lines) {
       severity = parsed;
       continue;
     }
-    if (entry.key === "scope") {
-      if (entry.value === "") {
+    if (entry.key === "evidence") {
+      const parsed = parseEvidenceClass(entry.value);
+      if (parsed === null) {
         return { ok: false, code: "MALFORMED_METADATA" };
       }
-      scope = entry.value;
+      evidence = parsed;
       continue;
     }
     return { ok: false, code: "MALFORMED_METADATA" };
@@ -834,7 +1130,11 @@ function parseRuleMetadata(lines) {
   if (severity === null) {
     return { ok: false, code: "MISSING_SEVERITY" };
   }
-  return { ok: true, value: { severity, scope } };
+  if (scopeDeclared && includePatterns.length === 0) {
+    return { ok: false, code: "MALFORMED_METADATA" };
+  }
+  const scope = scopeDeclared ? { include: includePatterns, exclude: excludePatterns } : null;
+  return { ok: true, value: { severity, scope, evidence: evidence ?? "code" } };
 }
 function collectMetadataLines(lines) {
   const collected = [];
@@ -864,6 +1164,26 @@ function parseSeverity(value) {
       return null;
   }
 }
+function parseEvidenceClass(value) {
+  switch (value) {
+    case "code":
+    case "docs":
+    case "any":
+      return value;
+    default:
+      return null;
+  }
+}
+function parseScopePattern(value) {
+  if (value === "") {
+    return null;
+  }
+  if (value.startsWith("!")) {
+    const pattern = value.slice(1).trim();
+    return pattern === "" ? null : { pattern, exclude: true };
+  }
+  return { pattern: value, exclude: false };
+}
 
 // packages/core/src/rules/sections.ts
 var SECTION_NAMES = ["Rule", "Violation", "Allowed"];
@@ -986,6 +1306,7 @@ function buildParsedRule(id, metadata, sections) {
     id,
     severity: metadata.severity,
     scope: metadata.scope,
+    evidence: metadata.evidence,
     description: sections.rule,
     violation: sections.violation,
     allowed: sections.allowed
@@ -1016,6 +1337,130 @@ function findDuplicateIds(ids) {
   }
   return duplicates;
 }
+// packages/core/src/report/aggregate.ts
+function aggregateReviewHistory(records, skippedLineCount) {
+  const outcomes = emptyAccumulator();
+  const unavailableReasons = new Map;
+  const skippedReasons = new Map;
+  const builtIns = new Map;
+  const rules = new Map;
+  const evaluation = { wholeEvaluations: 0, slicedEvaluations: 0, totalSliceJudgments: 0 };
+  let firstTimestamp = null;
+  let lastTimestamp = null;
+  for (const record of records) {
+    firstTimestamp = earlier(firstTimestamp, record.timestamp);
+    lastTimestamp = later(lastTimestamp, record.timestamp);
+    for (const result of record.results) {
+      countOutcome(outcomes, result.outcome);
+      if (result.outcome === "UNAVAILABLE") {
+        bump(unavailableReasons, result.reason);
+      }
+      if (result.outcome === "SKIPPED") {
+        bump(skippedReasons, result.reason);
+      }
+      if (result.kind === "BUILT_IN") {
+        bump(builtIns, result.checkId);
+      }
+      if (result.kind === "RULE" && result.ruleId !== null) {
+        countRule(rules, result.ruleId, result.outcome, result.evidence);
+      }
+      if (result.kind === "RULE" && result.evidence !== undefined) {
+        countEvidence(evaluation, result.evidence.mode, result.evidence.sliceJudgments.length);
+      }
+    }
+  }
+  return {
+    entryCount: records.length,
+    skippedLineCount,
+    firstTimestamp,
+    lastTimestamp,
+    outcomes: finalizeAccumulator(outcomes),
+    unavailableReasons: sortedReasons(unavailableReasons),
+    skippedReasons: sortedReasons(skippedReasons),
+    builtIns: sortedBuiltIns(builtIns),
+    rules: sortedRules(rules),
+    evaluation: finalizeEvaluation(evaluation)
+  };
+}
+function emptyAccumulator() {
+  return { pass: 0, warn: 0, fail: 0, unavailable: 0, skipped: 0 };
+}
+function countOutcome(counts, outcome) {
+  switch (outcome) {
+    case "PASS":
+      counts.pass += 1;
+      return;
+    case "WARN":
+      counts.warn += 1;
+      return;
+    case "FAIL":
+      counts.fail += 1;
+      return;
+    case "UNAVAILABLE":
+      counts.unavailable += 1;
+      return;
+    case "SKIPPED":
+      counts.skipped += 1;
+      return;
+  }
+}
+function countRule(rules, ruleId, outcome, evidence) {
+  const accumulator = rules.get(ruleId) ?? { counts: emptyAccumulator(), sliced: 0 };
+  countOutcome(accumulator.counts, outcome);
+  if (evidence?.mode === "SLICED") {
+    accumulator.sliced += 1;
+  }
+  rules.set(ruleId, accumulator);
+}
+function countEvidence(coverage, mode, sliceJudgmentCount) {
+  if (mode === "WHOLE") {
+    coverage.wholeEvaluations += 1;
+    return;
+  }
+  coverage.slicedEvaluations += 1;
+  coverage.totalSliceJudgments += sliceJudgmentCount;
+}
+function finalizeAccumulator(counts) {
+  return {
+    pass: counts.pass,
+    warn: counts.warn,
+    fail: counts.fail,
+    unavailable: counts.unavailable,
+    skipped: counts.skipped,
+    total: counts.pass + counts.warn + counts.fail + counts.unavailable + counts.skipped
+  };
+}
+function finalizeEvaluation(coverage) {
+  return { ...coverage };
+}
+function bump(map, key) {
+  map.set(key, (map.get(key) ?? 0) + 1);
+}
+function sortedReasons(map) {
+  return [...map.entries()].map(([reason, count]) => ({ reason, count })).sort((left, right) => compareStrings(left.reason, right.reason));
+}
+function sortedBuiltIns(map) {
+  return [...map.entries()].map(([checkId, count]) => ({ checkId, count })).sort((left, right) => compareStrings(left.checkId, right.checkId));
+}
+function sortedRules(map) {
+  return [...map.entries()].map(([ruleId, accumulator]) => ({
+    ruleId,
+    counts: finalizeAccumulator(accumulator.counts),
+    slicedRuleCount: accumulator.sliced
+  })).sort((left, right) => compareStrings(left.ruleId, right.ruleId));
+}
+function earlier(current, candidate) {
+  return current === null || candidate < current ? candidate : current;
+}
+function later(current, candidate) {
+  return current === null || candidate > current ? candidate : current;
+}
+function compareStrings(left, right) {
+  if (left < right) {
+    return -1;
+  }
+  return left > right ? 1 : 0;
+}
 // packages/core/src/builtins/complexity.ts
 var COMPLEXITY_CHECK_ID = "COMPLEXITY";
 var COMPLEXITY_GATE_CONFIG = {
@@ -1183,6 +1628,18 @@ function createFifoJevPort(port, config) {
     }
   }
   function start(pending) {
+    if (pending.kind === "BATCH") {
+      Promise.resolve().then(() => port.evaluateRuleBatch(pending.requests)).then((results) => {
+        active -= 1;
+        pending.settle(results);
+        drain();
+      }, (error) => {
+        active -= 1;
+        pending.fail(error);
+        drain();
+      });
+      return;
+    }
     Promise.resolve().then(() => port.evaluate(pending.request)).then((result) => {
       active -= 1;
       pending.settle(result);
@@ -1196,7 +1653,13 @@ function createFifoJevPort(port, config) {
   return {
     evaluate(request) {
       return new Promise((settle, fail) => {
-        queue.push({ request, settle, fail });
+        queue.push({ kind: "SINGLE", request, settle, fail });
+        drain();
+      });
+    },
+    evaluateRuleBatch(requests) {
+      return new Promise((settle, fail) => {
+        queue.push({ kind: "BATCH", requests, settle, fail });
         drain();
       });
     }
@@ -1259,7 +1722,7 @@ var REMEDIATION_MAX_TASK_LENGTH = 16384;
 var DEFAULT_REMEDIATION_CONFIG = {
   autoPropose: true,
   proposeOn: ["FAIL"],
-  model: "opencode/gpt-5.6-luna"
+  model: null
 };
 
 // packages/core/src/remediation/request.ts
@@ -1349,6 +1812,7 @@ function snapshotRule(rule) {
 // packages/core/src/remediation/config.ts
 var MODEL_PATTERN = /^[^\s/]+\/[^\s/]+$/;
 var KNOWN_KEYS = new Set(["auto_propose", "propose_on", "model"]);
+var INVALID_MODEL = Symbol("invalid-model");
 function resolveRemediationConfig(value) {
   if (value === null || value === undefined) {
     return valid(DEFAULT_REMEDIATION_CONFIG);
@@ -1371,8 +1835,8 @@ function resolveRemediationConfig(value) {
   if (proposeOn === null) {
     return invalid2();
   }
-  const model = remediation.model ?? DEFAULT_REMEDIATION_CONFIG.model;
-  if (typeof model !== "string" || !MODEL_PATTERN.test(model)) {
+  const model = resolveModel(remediation.model);
+  if (model === INVALID_MODEL) {
     return invalid2();
   }
   return valid({ autoPropose, proposeOn, model });
@@ -1387,6 +1851,15 @@ function parseModelSpecifier(model) {
     modelID: model.slice(separator + 1)
   };
 }
+function resolveModel(value) {
+  if (value === undefined) {
+    return null;
+  }
+  if (typeof value !== "string" || !MODEL_PATTERN.test(value)) {
+    return INVALID_MODEL;
+  }
+  return value;
+}
 function readProposeOn(value) {
   if (value === undefined) {
     return DEFAULT_REMEDIATION_CONFIG.proposeOn;
@@ -1512,6 +1985,7 @@ var JEV_MODEL = "jev-latest";
 
 // packages/opencode-adapter/src/jev/transport.ts
 var DEFAULT_ALLOWED_CRITERION = "The change does not violate the rule's Violation.";
+var RULE_BATCH_CONCURRENCY = 4;
 function buildTypeSafeClientConfig(apiKey) {
   return { apiKey, defaultModel: JEV_MODEL, logLevel: "off" };
 }
@@ -1529,9 +2003,48 @@ function createJevTransport(dependencies) {
         return failedFor(request, "API_ERROR");
       }
       return evaluateWithClient(client, request);
+    },
+    async evaluateRuleBatch(requests) {
+      if (requests.length === 0) {
+        return [];
+      }
+      const credential = await resolveCredential(dependencies.credentials);
+      if (credential.status === "UNAVAILABLE") {
+        const reason = toFailureReason(credential.reason);
+        return requests.map(() => ruleFailed(reason));
+      }
+      let client;
+      try {
+        client = dependencies.createClient(credential.apiKey);
+      } catch {
+        return requests.map(() => ruleFailed("API_ERROR"));
+      }
+      return runWithConcurrency(requests, RULE_BATCH_CONCURRENCY, (request) => evaluateRuleWithClient(client, request));
     }
   };
 }
+async function runWithConcurrency(items, cap, worker) {
+  const results = new Array(items.length);
+  let cursor = 0;
+  async function run() {
+    while (true) {
+      const index = cursor;
+      cursor += 1;
+      if (index >= items.length) {
+        return;
+      }
+      const item = items[index];
+      if (item === undefined) {
+        continue;
+      }
+      results[index] = await worker(item);
+    }
+  }
+  const workerCount = Math.min(cap, items.length);
+  const workers = Array.from({ length: workerCount }, () => run());
+  await Promise.all(workers);
+  return results;
+}
 function createTypeSafeJevTransport(credentials) {
   return createJevTransport({ credentials, createClient: createTypeSafeSystemOneClient });
 }
@@ -1695,6 +2208,217 @@ function batchFailed(reason) {
 function failedFor(request, reason) {
   return request.kind === "RULE" ? ruleFailed(reason) : batchFailed(reason);
 }
+// packages/opencode-adapter/src/opencode-config/confirmation.ts
+import { createInterface } from "readline/promises";
+function createConfirmationPrompt() {
+  return {
+    confirm: askForConfirmation
+  };
+}
+async function askForConfirmation(message) {
+  if (process.stdin.isTTY !== true) {
+    return { status: "FAILED", reason: "NOT_A_TTY" };
+  }
+  try {
+    const readline = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+      const answer = await readline.question(`${message} [y/N] `);
+      return isAffirmative(answer) ? { status: "CONFIRMED" } : { status: "DECLINED" };
+    } finally {
+      readline.close();
+    }
+  } catch {
+    return { status: "DECLINED" };
+  }
+}
+function isAffirmative(answer) {
+  const normalized = answer.trim().toLowerCase();
+  return normalized === "y" || normalized === "yes";
+}
+// packages/opencode-adapter/src/opencode-config/entry.ts
+var JEVGUARD_PLUGIN_ENTRY = "@pablozrrrr/jevguard";
+var CONFIG_SCHEMA_URL = "https://opencode.ai/config.json";
+function createDefaultConfigDocument() {
+  return { $schema: CONFIG_SCHEMA_URL };
+}
+function addPluginEntry(document, entry) {
+  if (!isPlainObject(document)) {
+    return { status: "INVALID_SHAPE" };
+  }
+  const existing = document.plugin;
+  if (existing === undefined) {
+    return { status: "ADDED", document: { ...document, plugin: [entry] } };
+  }
+  if (!isStringArray(existing)) {
+    return { status: "INVALID_SHAPE" };
+  }
+  if (existing.some((value) => isPluginEntryFor(value, entry))) {
+    return { status: "PRESENT" };
+  }
+  return { status: "ADDED", document: { ...document, plugin: [...existing, entry] } };
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function isPluginEntryFor(value, entry) {
+  return value === entry || value.startsWith(`${entry}@`);
+}
+// packages/opencode-adapter/src/opencode-config/file-system.ts
+import { randomUUID } from "crypto";
+import { access, mkdir, readFile, rename, rm, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+function createNodeConfigFileSystem() {
+  return {
+    readFile: readOptionalFile,
+    fileExists,
+    writeFile: writeConfigFile,
+    ensureParentDirectory
+  };
+}
+async function readOptionalFile(path) {
+  try {
+    return await readFile(path, "utf8");
+  } catch (error) {
+    if (isMissingFileError(error)) {
+      return null;
+    }
+    throw error;
+  }
+}
+async function fileExists(path) {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function writeConfigFile(path, contents) {
+  const temporaryPath = join(dirname(path), `.opencode.json.jevguard-tmp-${randomUUID()}`);
+  try {
+    await writeFile(temporaryPath, contents, "utf8");
+    await rename(temporaryPath, path);
+  } catch (error) {
+    await rm(temporaryPath, { force: true }).catch(() => {
+      return;
+    });
+    throw error;
+  }
+}
+async function ensureParentDirectory(path) {
+  await mkdir(dirname(path), { recursive: true });
+}
+function isMissingFileError(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+// packages/opencode-adapter/src/opencode-config/install.ts
+import { dirname as dirname2, join as join3 } from "path";
+
+// packages/opencode-adapter/src/opencode-config/paths.ts
+import { isAbsolute, join as join2 } from "path";
+var PROJECT_CONFIG_FILENAME = "opencode.json";
+function resolveConfigPath(target, context) {
+  if (target === "project") {
+    return join2(context.cwd, PROJECT_CONFIG_FILENAME);
+  }
+  return join2(resolveConfigHome(context), "opencode", PROJECT_CONFIG_FILENAME);
+}
+function resolveConfigHome(context) {
+  const configured = context.environment.XDG_CONFIG_HOME;
+  if (configured !== undefined && configured !== "" && isAbsolute(configured)) {
+    return configured;
+  }
+  return join2(context.homedir, ".config");
+}
+
+// packages/opencode-adapter/src/opencode-config/install.ts
+var CONFIRMATION_MESSAGE = "Add JevGuard to the opencode.json plugin list?";
+async function install(dependencies) {
+  const path = resolveConfigPath(dependencies.target, dependencies);
+  const read = await readConfigDocument(dependencies.fileSystem, path);
+  if (read.status === "FAILED") {
+    return failed(dependencies.target, path, read.reason);
+  }
+  const mutation = addPluginEntry(read.document, JEVGUARD_PLUGIN_ENTRY);
+  if (mutation.status === "INVALID_SHAPE") {
+    return failed(dependencies.target, path, "INVALID_CONFIG_SHAPE");
+  }
+  if (mutation.status === "PRESENT") {
+    return { status: "ALREADY_INSTALLED", target: dependencies.target, path };
+  }
+  const confirmation = await requestConfirmation(dependencies.confirmation);
+  if (confirmation.status === "FAILED") {
+    return failed(dependencies.target, path, confirmation.reason);
+  }
+  if (confirmation.status === "DECLINED") {
+    return { status: "ABORTED", target: dependencies.target, path };
+  }
+  const written = await writeConfigDocument(dependencies.fileSystem, path, mutation.document);
+  if (!written) {
+    return failed(dependencies.target, path, "WRITE_FAILURE");
+  }
+  return { status: "INSTALLED", target: dependencies.target, path };
+}
+async function readConfigDocument(fileSystem, path) {
+  const contents = await readOptionalContents(fileSystem, path);
+  if (contents.status === "FAILED") {
+    return contents;
+  }
+  if (contents.value === null) {
+    return readMissingConfigDocument(fileSystem, path);
+  }
+  try {
+    return { status: "READ", document: JSON.parse(contents.value) };
+  } catch {
+    return { status: "FAILED", reason: "INVALID_JSON" };
+  }
+}
+async function readOptionalContents(fileSystem, path) {
+  try {
+    return { status: "READ", value: await fileSystem.readFile(path) };
+  } catch {
+    return { status: "FAILED", reason: "READ_FAILURE" };
+  }
+}
+async function readMissingConfigDocument(fileSystem, path) {
+  try {
+    const hasJsonc = await fileSystem.fileExists(join3(dirname2(path), "opencode.jsonc"));
+    if (hasJsonc) {
+      return { status: "FAILED", reason: "UNSUPPORTED_JSONC" };
+    }
+    return { status: "READ", document: createDefaultConfigDocument() };
+  } catch {
+    return { status: "FAILED", reason: "READ_FAILURE" };
+  }
+}
+async function requestConfirmation(confirmation) {
+  try {
+    const result = await confirmation.confirm(CONFIRMATION_MESSAGE);
+    if (result.status === "FAILED") {
+      return { status: "FAILED", reason: result.reason };
+    }
+    return { status: result.status };
+  } catch {
+    return { status: "FAILED", reason: "NOT_A_TTY" };
+  }
+}
+async function writeConfigDocument(fileSystem, path, document) {
+  const serialized = `${JSON.stringify(document, null, 2)}
+`;
+  try {
+    await fileSystem.ensureParentDirectory(path);
+    await fileSystem.writeFile(path, serialized);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function failed(target, path, reason) {
+  return { status: "FAILED", target, path, reason };
+}
 // packages/opencode-adapter/src/policy/config-yaml.ts
 import { parseDocument, visit } from "yaml";
 function parsePolicyConfig(text) {
@@ -1731,16 +2455,16 @@ function invalid3() {
   return { status: "INVALID", reason: "INVALID_CONFIG" };
 }
 // packages/opencode-adapter/src/policy/file-source.ts
-import { readFile } from "fs/promises";
-import { join } from "path";
+import { readFile as readFile2 } from "fs/promises";
+import { join as join4 } from "path";
 function createPolicyFileLoader(dependencies) {
   return {
     async load() {
-      const rules = await readOptionalFile(dependencies.fileSystem, join(dependencies.root, ".jev", "rules.md"));
+      const rules = await readOptionalFile2(dependencies.fileSystem, join4(dependencies.root, ".jev", "rules.md"));
       if (rules.status === "FAILED") {
         return { status: "FAILED", reason: "RULES_READ_FAILURE" };
       }
-      const config = await readOptionalFile(dependencies.fileSystem, join(dependencies.root, ".jev", "config.yaml"));
+      const config = await readOptionalFile2(dependencies.fileSystem, join4(dependencies.root, ".jev", "config.yaml"));
       if (config.status === "FAILED") {
         return { status: "FAILED", reason: "CONFIG_READ_FAILURE" };
       }
@@ -1753,22 +2477,277 @@ function createPolicyFileLoader(dependencies) {
 }
 function createNodePolicyFileSystem() {
   return {
-    readFile: (path) => readFile(path, "utf8")
+    readFile: (path) => readFile2(path, "utf8")
   };
 }
-async function readOptionalFile(fileSystem, path) {
+async function readOptionalFile2(fileSystem, path) {
   try {
     return { status: "READ", value: await fileSystem.readFile(path) };
   } catch (error) {
-    if (isMissingFileError(error)) {
+    if (isMissingFileError2(error)) {
       return { status: "READ", value: null };
     }
     return { status: "FAILED" };
   }
 }
-function isMissingFileError(error) {
+function isMissingFileError2(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
+// packages/opencode-adapter/src/history/local.ts
+import { isAbsolute as isAbsolute2, join as join5 } from "path";
+var DATA_DIRECTORY = "jevguard";
+var HISTORY_FILENAME = "reviews.jsonl";
+var DEFAULT_HISTORY_MAX_BYTES = 5 * 1024 * 1024;
+var DEFAULT_HISTORY_MAX_RECORDS = 2000;
+function createLocalReviewHistory(dependencies) {
+  const filePath = resolveHistoryFilePath(dependencies.context);
+  const maxBytes = dependencies.maxBytes ?? DEFAULT_HISTORY_MAX_BYTES;
+  const maxRecords = dependencies.maxRecords ?? DEFAULT_HISTORY_MAX_RECORDS;
+  let tail = Promise.resolve();
+  async function append(entry) {
+    try {
+      const record = {
+        ...entry,
+        timestamp: dependencies.now().toISOString()
+      };
+      await dependencies.fileSystem.ensureParentDirectory(filePath);
+      await dependencies.fileSystem.appendFile(filePath, `${JSON.stringify(record)}
+`);
+      await boundGrowth();
+    } catch {
+      return;
+    }
+  }
+  async function boundGrowth() {
+    try {
+      const size = await dependencies.fileSystem.sizeOf(filePath);
+      if (size === null || size <= maxBytes) {
+        return;
+      }
+      const contents = await dependencies.fileSystem.readFile(filePath);
+      if (contents === null) {
+        return;
+      }
+      const lines = contents.split(`
+`).filter((line) => line.trim() !== "");
+      const kept = lines.slice(Math.max(0, lines.length - maxRecords));
+      const rewritten = kept.length === 0 ? "" : `${kept.join(`
+`)}
+`;
+      await dependencies.fileSystem.writeFileAtomic(filePath, rewritten);
+    } catch {
+      return;
+    }
+  }
+  async function read() {
+    try {
+      const contents = await dependencies.fileSystem.readFile(filePath);
+      if (contents === null) {
+        return { records: [], skippedLineCount: 0 };
+      }
+      return parseRecords(contents);
+    } catch {
+      return { records: [], skippedLineCount: 0 };
+    }
+  }
+  return {
+    append: (entry) => {
+      const run = tail.then(() => append(entry));
+      tail = run.then(ignore, ignore);
+      return run;
+    },
+    read
+  };
+}
+function resolveHistoryFilePath(context) {
+  return join5(resolveDataHome(context), DATA_DIRECTORY, HISTORY_FILENAME);
+}
+function resolveDataHome(context) {
+  const configured = context.environment.get("XDG_DATA_HOME");
+  if (configured !== undefined && configured !== "" && isAbsolute2(configured)) {
+    return configured;
+  }
+  return join5(context.homedir, ".local", "share");
+}
+function parseRecords(contents) {
+  const records = [];
+  let skippedLineCount = 0;
+  for (const line of contents.split(`
+`)) {
+    if (line.trim() === "") {
+      continue;
+    }
+    const parsed = parseRecord(line);
+    if (parsed === null) {
+      skippedLineCount += 1;
+      continue;
+    }
+    records.push(parsed);
+  }
+  return { records, skippedLineCount };
+}
+function parseRecord(line) {
+  try {
+    const value = JSON.parse(line);
+    return isReviewHistoryRecord(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function isReviewHistoryRecord(value) {
+  if (!isObject(value)) {
+    return false;
+  }
+  if (typeof value.timestamp !== "string" || typeof value.turnId !== "string") {
+    return false;
+  }
+  if (!isObject(value.summary) || !Array.isArray(value.results)) {
+    return false;
+  }
+  return value.results.every(isHistoryResult);
+}
+function isHistoryResult(value) {
+  if (!isObject(value)) {
+    return false;
+  }
+  if (value.kind !== "RULE" && value.kind !== "BUILT_IN" && value.kind !== "REVIEW") {
+    return false;
+  }
+  if (!isReviewOutcome(value.outcome)) {
+    return false;
+  }
+  if (value.outcome === "UNAVAILABLE" || value.outcome === "SKIPPED") {
+    return typeof value.reason === "string" && hasValidEvidence(value);
+  }
+  if (typeof value.violationProbability !== "number") {
+    return false;
+  }
+  if (value.kind === "BUILT_IN") {
+    return typeof value.checkId === "string" && hasValidEvidence(value);
+  }
+  if (value.kind === "RULE") {
+    return (value.ruleId === null || typeof value.ruleId === "string") && hasValidEvidence(value);
+  }
+  return true;
+}
+function hasValidEvidence(value) {
+  const evidence = value.evidence;
+  if (evidence === undefined) {
+    return true;
+  }
+  if (!isObject(evidence)) {
+    return false;
+  }
+  if (evidence.mode !== "WHOLE" && evidence.mode !== "SLICED") {
+    return false;
+  }
+  return Array.isArray(evidence.sliceJudgments);
+}
+function isReviewOutcome(value) {
+  return value === "PASS" || value === "WARN" || value === "FAIL" || value === "UNAVAILABLE" || value === "SKIPPED";
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null;
+}
+function ignore() {
+  return;
+}
+// packages/opencode-adapter/src/history/mirrored-sink.ts
+function createMirroredReviewLogSink(hostSink, history) {
+  return {
+    async write(entry) {
+      const [hostStatus] = await Promise.all([
+        writeHost(hostSink, entry),
+        appendHistory(history, entry)
+      ]);
+      return hostStatus;
+    }
+  };
+}
+async function writeHost(sink, entry) {
+  try {
+    return await sink.write(entry);
+  } catch {
+    return "FAILED";
+  }
+}
+async function appendHistory(history, entry) {
+  try {
+    await history.append(entry);
+  } catch {
+    return;
+  }
+}
+// packages/opencode-adapter/src/history/node-file-system.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { appendFile, mkdir as mkdir2, readFile as readFile3, rename as rename2, rm as rm2, stat, writeFile as writeFile2 } from "fs/promises";
+import { basename, dirname as dirname3, join as join6 } from "path";
+function createNodeReviewHistoryFileSystem() {
+  return {
+    readFile: readOptionalFile3,
+    appendFile: appendHistoryFile,
+    sizeOf: sizeOfOptionalFile,
+    writeFileAtomic,
+    ensureParentDirectory: async (path) => {
+      await mkdir2(dirname3(path), { recursive: true });
+    }
+  };
+}
+async function readOptionalFile3(path) {
+  try {
+    return await readFile3(path, "utf8");
+  } catch (error) {
+    if (isMissingFileError3(error)) {
+      return null;
+    }
+    throw error;
+  }
+}
+async function appendHistoryFile(path, data) {
+  await appendFile(path, data, "utf8");
+}
+async function sizeOfOptionalFile(path) {
+  try {
+    const info = await stat(path);
+    return info.size;
+  } catch (error) {
+    if (isMissingFileError3(error)) {
+      return null;
+    }
+    throw error;
+  }
+}
+async function writeFileAtomic(path, data) {
+  const temporaryPath = join6(dirname3(path), `.${basename(path)}.jevguard-tmp-${randomUUID2()}`);
+  try {
+    await writeFile2(temporaryPath, data, "utf8");
+    await rename2(temporaryPath, path);
+  } catch (error) {
+    await rm2(temporaryPath, { force: true }).catch(() => {
+      return;
+    });
+    throw error;
+  }
+}
+function isMissingFileError3(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+// packages/opencode-adapter/src/history/process-context.ts
+import { homedir } from "os";
+function createProcessReviewHistoryContext() {
+  return {
+    cwd: process.cwd(),
+    environment: processEnvironment(),
+    homedir: homedir()
+  };
+}
+function processEnvironment() {
+  return {
+    get(name) {
+      return process.env[name];
+    }
+  };
+}
 // packages/opencode-adapter/src/presentation/display.ts
 function displayOutcome(counts) {
   if (counts.fail > 0) {
@@ -1823,12 +2802,35 @@ function logLevelFor(outcome) {
 function reviewLogMessage(entry) {
   return `JevGuard ${displayOutcome(entry.summary.counts)} for turn ${entry.turnId}`;
 }
+function projectEvidence(evidence) {
+  return {
+    mode: evidence.mode,
+    plannedSliceCount: evidence.plannedSliceCount,
+    evaluatedSliceCount: evidence.evaluatedSliceCount,
+    failedSliceCount: evidence.failedSliceCount,
+    notEvaluatedSliceCount: evidence.notEvaluatedSliceCount,
+    slices: evidence.slices.map((slice) => ({
+      index: slice.index,
+      path: slice.path,
+      kind: slice.kind,
+      hunkOrdinal: slice.hunkOrdinal
+    })),
+    sliceJudgments: evidence.sliceJudgments.map((judgment) => ({
+      index: judgment.index,
+      probability: judgment.probability,
+      outcome: judgment.outcome
+    })),
+    failingSliceIndex: evidence.failingSliceIndex,
+    failureReason: evidence.failureReason
+  };
+}
 function ruleLogResult(result) {
   const identity = {
     kind: "RULE",
     ruleId: result.ruleId,
     severity: result.severity,
-    scopedPaths: [...result.scopedPaths]
+    scopedPaths: [...result.scopedPaths],
+    ...result.evidence === undefined ? {} : { evidence: projectEvidence(result.evidence) }
   };
   switch (result.outcome) {
     case "PASS":
@@ -1874,10 +2876,28 @@ function toReviewToast(review) {
   const outcome = displayOutcome(review.summary.counts);
   return {
     title: `JevGuard ${outcome}`,
-    message: countSummary(review.summary.counts),
+    message: `${countSummary(review.summary.counts)}${slicedSummary(review.results)}`,
     variant: toastVariantFor(outcome)
   };
 }
+function slicedSummary(results) {
+  let slicedRules = 0;
+  let sliceJudgments = 0;
+  for (const result of results) {
+    if (result.kind !== "RULE" || result.evidence === undefined) {
+      continue;
+    }
+    if (result.evidence.mode !== "SLICED") {
+      continue;
+    }
+    slicedRules += 1;
+    sliceJudgments += result.evidence.evaluatedSliceCount;
+  }
+  if (slicedRules === 0 && sliceJudgments === 0) {
+    return "";
+  }
+  return ` \xB7 sliced ${slicedRules} rules \xB7 slices ${sliceJudgments}`;
+}
 function toastVariantFor(outcome) {
   switch (outcome) {
     case "PASS":
@@ -1996,25 +3016,50 @@ function toOutcomeExtra(result) {
 }
 // packages/opencode-adapter/src/presentation/remediation.ts
 var TITLE = "JevGuard";
+var SERVICE_NAME2 = "jevguard";
 var PREPARING_MESSAGE = "JevGuard is preparing a remediation proposal in the child session.";
 var READY_MESSAGE = "JevGuard remediation proposal ready.";
+var FAILED_MESSAGE = "JevGuard could not prepare a remediation proposal.";
+var FAILURE_LOG_MESSAGE = "JevGuard remediation proposal failed";
 function createRemediationNotifier(toast) {
   return {
     async proposalPreparing() {
-      return showRemediationToast(toast, PREPARING_MESSAGE);
+      return showRemediationToast(toast, PREPARING_MESSAGE, "info");
     },
     async proposalReady() {
-      return showRemediationToast(toast, READY_MESSAGE);
+      return showRemediationToast(toast, READY_MESSAGE, "info");
+    },
+    async proposalFailed() {
+      return showRemediationToast(toast, FAILED_MESSAGE, "error");
     }
   };
 }
-async function showRemediationToast(toast, message) {
+async function showRemediationToast(toast, message, variant) {
   try {
-    return await toast.show({ title: TITLE, message, variant: "info" });
+    return await toast.show({ title: TITLE, message, variant });
   } catch {
     return "FAILED";
   }
 }
+function createRemediationFailureLogSink(client) {
+  return {
+    async write(reason) {
+      try {
+        const result = await client.app.log({
+          body: {
+            service: SERVICE_NAME2,
+            level: "error",
+            message: FAILURE_LOG_MESSAGE,
+            extra: { reason }
+          }
+        });
+        return result.error === undefined ? "DELIVERED" : "FAILED";
+      } catch {
+        return "FAILED";
+      }
+    }
+  };
+}
 function createOpenCodeSessionNavigator(client) {
   return {
     async navigate(sessionID) {
@@ -2065,11 +3110,12 @@ function createOpenCodeProposalSessionFacade(client) {
       return result.data.id;
     },
     async prompt(input) {
+      const model = input.model;
       const result = await client.session.prompt({
         path: { id: input.sessionID },
         body: {
           agent: input.agent,
-          model: { providerID: input.model.providerID, modelID: input.model.modelID },
+          ...model === null ? {} : { model: { providerID: model.providerID, modelID: model.modelID } },
           system: input.system,
           tools: { ...input.tools },
           parts: [{ type: "text", text: input.text }]
@@ -2081,15 +3127,51 @@ function createOpenCodeProposalSessionFacade(client) {
     }
   };
 }
+// packages/plugin/src/cli/install.ts
+import { homedir as homedir2 } from "os";
+function performInstall(target) {
+  return install({
+    confirmation: createConfirmationPrompt(),
+    fileSystem: createNodeConfigFileSystem(),
+    target,
+    cwd: process.cwd(),
+    environment: process.env,
+    homedir: homedir2()
+  });
+}
+
 // packages/plugin/src/cli/login.ts
 function performLogin() {
   return login({ prompt: createSecretPrompt(), store: createKeyringCredentialStore() });
 }
 
+// packages/plugin/src/cli/report.ts
+async function performReport() {
+  const history = createLocalReviewHistory({
+    context: createProcessReviewHistoryContext(),
+    fileSystem: createNodeReviewHistoryFileSystem(),
+    now: () => new Date
+  });
+  const { records, skippedLineCount } = await history.read();
+  return aggregateReviewHistory(records, skippedLineCount);
+}
+
 // packages/plugin/src/cli/messages.ts
-var USAGE = "Usage: jevguard login";
+var USAGE = [
+  "Usage: jevguard login",
+  "       jevguard install [--project]",
+  "       jevguard report [--json]",
+  "",
+  "`jev-init` and `jevguard-rules` are OpenCode skills, not CLI commands. Register",
+  "the plugin in opencode.json (or run `jevguard install`) and invoke them from",
+  "OpenCode."
+].join(`
+`);
+var EMPTY_HISTORY_MESSAGE = "No review history yet.";
+var REPORT_READ_FAILURE_MESSAGE = "Could not read the review history.";
 var LOGIN_SAVED_MESSAGE = "Credential saved to the OS credential store.";
 var LOGIN_ABORTED_MESSAGE = "Login cancelled. No credential was saved.";
+var MANUAL_INSTALL_SNIPPET = `{ "plugin": ["${JEVGUARD_PLUGIN_ENTRY}"] }`;
 function describeLoginFailure(reason) {
   switch (reason) {
     case "NOT_A_TTY":
@@ -2102,13 +3184,108 @@ function describeLoginFailure(reason) {
       return "Could not save the credential to the OS credential store. Check that a credential store is available and try again.";
   }
 }
+function describeInstallInstalled(target, path) {
+  return `Registered JevGuard for the ${target} target in ${path}. Restart OpenCode to load it.`;
+}
+function describeInstallAlreadyInstalled(target, path) {
+  return `JevGuard is already registered for the ${target} target in ${path}.`;
+}
+function describeInstallAborted(path) {
+  return `Install cancelled. ${path} was not changed.`;
+}
+function describeInstallFailure(reason, path) {
+  switch (reason) {
+    case "NOT_A_TTY":
+      return manualSnippetFailure(`${path} cannot be confirmed without an interactive terminal.`);
+    case "UNSUPPORTED_JSONC":
+      return manualSnippetFailure(`${path} is absent, but a sibling opencode.jsonc exists. JevGuard never edits .jsonc files.`);
+    case "INVALID_JSON":
+      return manualSnippetFailure(`Could not parse ${path} as JSON.`);
+    case "INVALID_CONFIG_SHAPE":
+      return manualSnippetFailure(`The plugin entry in ${path} is not an array of strings, so JevGuard did not change it.`);
+    case "READ_FAILURE":
+      return `Could not read ${path}. Check the file permissions and try again.`;
+    case "WRITE_FAILURE":
+      return `Could not write ${path}. Check the file permissions and try again.`;
+  }
+}
+function manualSnippetFailure(message) {
+  return [message, "Add this to the plugin array manually:", MANUAL_INSTALL_SNIPPET].join(`
+`);
+}
+function serializeReport(report) {
+  return JSON.stringify(report, null, 2);
+}
+function describeReport(report) {
+  if (report.entryCount === 0) {
+    return EMPTY_HISTORY_MESSAGE;
+  }
+  return [
+    "JevGuard review history",
+    `Turns: ${report.entryCount} \xB7 skipped malformed lines: ${report.skippedLineCount}`,
+    `First: ${report.firstTimestamp ?? "unknown"}`,
+    `Last: ${report.lastTimestamp ?? "unknown"}`,
+    `Outcomes: ${describeTotals(report.outcomes)}`,
+    "",
+    "UNAVAILABLE reasons:",
+    ...describeReasons(report.unavailableReasons),
+    "",
+    "SKIPPED reasons:",
+    ...describeReasons(report.skippedReasons),
+    "",
+    "Built-ins:",
+    ...describeBuiltIns(report.builtIns),
+    "",
+    "Rules:",
+    ...describeRules(report.rules),
+    "",
+    `Evaluation: whole ${report.evaluation.wholeEvaluations} \xB7 sliced ${report.evaluation.slicedEvaluations} \xB7 slice judgments ${report.evaluation.totalSliceJudgments}`
+  ].join(`
+`);
+}
+function describeTotals(totals) {
+  return `pass ${totals.pass} \xB7 warn ${totals.warn} \xB7 fail ${totals.fail} \xB7 unavailable ${totals.unavailable} \xB7 skipped ${totals.skipped}`;
+}
+function describeReasons(reasons) {
+  if (reasons.length === 0) {
+    return ["  (none)"];
+  }
+  return reasons.map((entry) => `  ${entry.reason}: ${entry.count}`);
+}
+function describeBuiltIns(checks) {
+  if (checks.length === 0) {
+    return ["  (none)"];
+  }
+  return checks.map((entry) => `  ${entry.checkId}: ${entry.count}`);
+}
+function describeRules(rules) {
+  if (rules.length === 0) {
+    return ["  (none)"];
+  }
+  return rules.map((entry) => `  ${entry.ruleId}: ${describeTotals(entry.counts)} \xB7 sliced ${entry.slicedRuleCount}`);
+}
 
 // packages/plugin/src/cli/run-cli.ts
 async function runCli(argv, io, dependencies) {
-  if (argv.length !== 1 || argv[0] !== "login") {
-    io.writeErr(USAGE);
-    return 1;
+  if (argv.length === 1 && argv[0] === "login") {
+    return runLogin(io, dependencies);
   }
+  if (argv.length === 1 && argv[0] === "install") {
+    return runInstall(io, dependencies, "global");
+  }
+  if (argv.length === 2 && argv[0] === "install" && argv[1] === "--project") {
+    return runInstall(io, dependencies, "project");
+  }
+  if (argv.length === 1 && argv[0] === "report") {
+    return runReport(io, dependencies, false);
+  }
+  if (argv.length === 2 && argv[0] === "report" && argv[1] === "--json") {
+    return runReport(io, dependencies, true);
+  }
+  io.writeErr(USAGE);
+  return 1;
+}
+async function runLogin(io, dependencies) {
   const outcome = await dependencies.login();
   if (outcome.status === "SAVED") {
     io.writeOut(LOGIN_SAVED_MESSAGE);
@@ -2121,6 +3298,36 @@ async function runCli(argv, io, dependencies) {
   io.writeErr(describeLoginFailure(outcome.reason));
   return 1;
 }
+async function runInstall(io, dependencies, target) {
+  const outcome = await dependencies.install(target);
+  return reportInstall(io, outcome);
+}
+function reportInstall(io, outcome) {
+  if (outcome.status === "INSTALLED") {
+    io.writeOut(describeInstallInstalled(outcome.target, outcome.path));
+    return 0;
+  }
+  if (outcome.status === "ALREADY_INSTALLED") {
+    io.writeOut(describeInstallAlreadyInstalled(outcome.target, outcome.path));
+    return 0;
+  }
+  if (outcome.status === "ABORTED") {
+    io.writeErr(describeInstallAborted(outcome.path));
+    return 1;
+  }
+  io.writeErr(describeInstallFailure(outcome.reason, outcome.path));
+  return 1;
+}
+async function runReport(io, dependencies, json) {
+  try {
+    const report = await dependencies.report();
+    io.writeOut(json ? serializeReport(report) : describeReport(report));
+    return 0;
+  } catch {
+    io.writeErr(REPORT_READ_FAILURE_MESSAGE);
+    return 1;
+  }
+}
 
 // packages/plugin/src/cli/main.ts
 var io = {
@@ -2129,5 +3336,9 @@ var io = {
   writeErr: (message) => process.stderr.write(`${message}
 `)
 };
-var exitCode = await runCli(process.argv.slice(2), io, { login: performLogin });
+var exitCode = await runCli(process.argv.slice(2), io, {
+  login: performLogin,
+  install: performInstall,
+  report: performReport
+});
 process.exitCode = exitCode;