@tested/cli 0.1.0

package/dist/tested.js

@@ -0,0 +1,2579 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { Command as Command10 } from "commander";
+
+// src/commands/init.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs";
+import { join } from "path";
+import "commander";
+import { simpleGit } from "simple-git";
+
+// src/output/ui.ts
+import pc from "picocolors";
+
+// src/token-help.ts
+var INGEST_TOKEN_ENV_NAMES = [
+  "TESTED_TOKEN",
+  "TESTED_TOKEN_FILE",
+  "TESTED_INGEST_TOKEN"
+];
+var INGEST_TOKEN_SETTINGS_URL_SHAPE = "https://app.tested.dev/repos/{owner}/{name}/settings";
+var GITHUB_NAME_RE = /^[\w.-]+$/;
+function ingestTokenSettingsUrl(owner, name) {
+  if (owner && name && GITHUB_NAME_RE.test(owner) && GITHUB_NAME_RE.test(name)) {
+    return `https://app.tested.dev/repos/${owner}/${name}/settings`;
+  }
+  return INGEST_TOKEN_SETTINGS_URL_SHAPE;
+}
+function tokenMintGuidance(opts) {
+  return [
+    `Mint: ${ingestTokenSettingsUrl(opts?.owner, opts?.name)}`,
+    `Set ${INGEST_TOKEN_ENV_NAMES.join(" / ")}`
+  ];
+}
+
+// src/output/ui.ts
+function badge(kind) {
+  switch (kind) {
+    case "pass":
+      return pc.green("[PASS]");
+    case "fail":
+      return pc.red("[FAIL]");
+    case "warn":
+      return pc.yellow("[WARN]");
+    case "info":
+      return pc.cyan("[INFO]");
+  }
+}
+function metricBar(pct3, width = 10) {
+  const clamped = Math.max(0, Math.min(100, pct3));
+  const filled = Math.round(clamped / 100 * width);
+  const bar = "#".repeat(filled) + ".".repeat(width - filled);
+  return `[${bar}]`;
+}
+function heading(text) {
+  return pc.bold(text);
+}
+function dim(text) {
+  return pc.dim(text);
+}
+function errorBlock(title, lines = []) {
+  const out = [`${pc.red("error")}: ${title}`];
+  if (lines.length > 0) {
+    out.push("");
+    for (const line of lines) {
+      out.push(line === "" ? "" : `  ${line}`);
+    }
+  }
+  return out.join("\n") + "\n";
+}
+function successLine(text) {
+  return `${pc.green("\u2713")} ${text}`;
+}
+function nextSteps(steps) {
+  if (steps.length === 0) return "";
+  const lines = [heading("Next steps:")];
+  steps.forEach((step, i) => {
+    const body = /^\d+\./.test(step.trim()) ? step.trim() : `${i + 1}. ${step}`;
+    lines.push(`  ${body}`);
+  });
+  return lines.join("\n");
+}
+function tip(text) {
+  return pc.dim(`\u2192 ${text}`);
+}
+function colorPct(pct3, digits = 1) {
+  const str = `${pct3.toFixed(digits)}%`;
+  if (pct3 >= 80) return pc.green(str);
+  if (pct3 >= 50) return pc.yellow(str);
+  return pc.red(str);
+}
+function shareUrl(url) {
+  return pc.bold(pc.cyan(url));
+}
+function progress(text) {
+  return pc.dim(text);
+}
+function formatCliError(message) {
+  const m = message.trim();
+  if (/coverage-final\.json not found/i.test(m)) {
+    const pathMatch = m.match(/at (.+?)\. Run/i);
+    const path = pathMatch?.[1]?.trim();
+    return errorBlock("coverage file missing", [
+      path ? `Expected: ${path}` : "Expected: coverage/coverage-final.json",
+      "",
+      "Run:  tested run",
+      "Then: tested diff"
+    ]);
+  }
+  if (/missing ingest token/i.test(m)) {
+    return errorBlock("missing ingest token", [
+      ...tokenMintGuidance(),
+      "or pass --token <token> (avoid on shared hosts: visible in ps)"
+    ]);
+  }
+  if (/invalid PR number/i.test(m)) {
+    return errorBlock("invalid PR number", [
+      m.replace(/^invalid PR number\s*/i, "").replace(/^—\s*/, "") || m,
+      "",
+      "Pass --pr <n> or set GITHUB_PR_NUMBER"
+    ]);
+  }
+  if (m.startsWith("error:") || m.includes("\n")) {
+    return m.endsWith("\n") ? m : `${m}
+`;
+  }
+  return `${pc.red("error")}: ${m}
+`;
+}
+
+// src/commands/init.ts
+import pc2 from "picocolors";
+var INIT_YAML_HEADER = "# Config schema \u2014 see https://tested.dev/docs/config\n";
+var DEFAULT_INIT_IGNORES = [
+  "**/*.test.ts",
+  "**/*.spec.ts",
+  "**/node_modules/**",
+  "**/dist/**",
+  "**/coverage/**"
+];
+function detectTestRunner(cwd) {
+  const vitestCandidates = ["vitest.config.ts", "vitest.config.js", "vitest.config.mjs", "vitest.config.cjs"];
+  for (const f of vitestCandidates) {
+    if (existsSync(join(cwd, f))) return "vitest";
+  }
+  const jestCandidates = ["jest.config.ts", "jest.config.js", "jest.config.mjs", "jest.config.cjs", "jest.config.json"];
+  for (const f of jestCandidates) {
+    if (existsSync(join(cwd, f))) return "jest";
+  }
+  if (existsSync(join(cwd, "pyproject.toml"))) return "pytest";
+  return null;
+}
+async function detectDefaultBranch(cwd) {
+  try {
+    const git = simpleGit({ baseDir: cwd });
+    const isRepo = await git.checkIsRepo();
+    if (!isRepo) return "main";
+    try {
+      const ref = (await git.raw(["symbolic-ref", "refs/remotes/origin/HEAD"])).trim();
+      const branch = ref.replace(/^refs\/remotes\/origin\//, "");
+      if (branch) return branch;
+    } catch {
+    }
+    return "main";
+  } catch {
+    return "main";
+  }
+}
+async function detectProject(cwd) {
+  const hasPackageJson = existsSync(join(cwd, "package.json"));
+  const testRunner = detectTestRunner(cwd);
+  const defaultBranch = await detectDefaultBranch(cwd);
+  return { hasPackageJson, testRunner, defaultBranch };
+}
+function buildInitYaml(args) {
+  const lines = [];
+  lines.push(INIT_YAML_HEADER.trimEnd());
+  lines.push(`base: ${args.base}`);
+  if (args.testRunner) {
+    lines.push(`testRunner: ${args.testRunner}`);
+  }
+  lines.push("thresholds:");
+  lines.push("  patch: 80");
+  lines.push("  project: 60");
+  lines.push("ignores:");
+  for (const pattern of DEFAULT_INIT_IGNORES) {
+    lines.push(`  - "${pattern}"`);
+  }
+  return lines.join("\n") + "\n";
+}
+function hasHuskyDevDep(pkgJsonPath) {
+  try {
+    const raw = readFileSync(pkgJsonPath, "utf8");
+    const pkg = JSON.parse(raw);
+    return Boolean(pkg.devDependencies?.husky || pkg.dependencies?.husky);
+  } catch {
+    return false;
+  }
+}
+var PRE_PUSH_HOOK_BODY = `#!/usr/bin/env sh
+# Installed by \`tested init\`. Skip with \`git push --no-verify\`.
+tested diff
+`;
+async function runInit(opts) {
+  const { cwd, force, hooks } = opts;
+  const pkgJsonPath = join(cwd, "package.json");
+  if (!existsSync(pkgJsonPath)) {
+    throw new Error(
+      `No package.json found at ${cwd}. Run \`tested init\` from the root of a Node.js project.`
+    );
+  }
+  const configPath = join(cwd, ".tested.yaml");
+  if (existsSync(configPath) && !force) {
+    throw new Error(
+      `.tested.yaml already exists at ${configPath}. Pass --force to overwrite.`
+    );
+  }
+  const detected = await detectProject(cwd);
+  const yamlText = buildInitYaml({ base: detected.defaultBranch, testRunner: detected.testRunner });
+  writeFileSync(configPath, yamlText, "utf8");
+  const warnings = [];
+  let hookInstalled = false;
+  let hookPath = null;
+  if (hooks) {
+    if (!hasHuskyDevDep(pkgJsonPath)) {
+      warnings.push("husky is not a devDependency; skipped pre-push hook install. Run `pnpm add -D husky` then re-run `tested init --force`.");
+    } else {
+      const huskyDir = join(cwd, ".husky");
+      const huskyHook = join(huskyDir, "pre-push");
+      if (existsSync(huskyHook)) {
+        warnings.push(`.husky/pre-push already exists; left untouched. Add \`tested diff\` to it manually if desired.`);
+      } else {
+        if (!existsSync(huskyDir)) mkdirSync(huskyDir, { recursive: true });
+        writeFileSync(huskyHook, PRE_PUSH_HOOK_BODY, "utf8");
+        try {
+          chmodSync(huskyHook, 493);
+        } catch {
+        }
+        hookInstalled = true;
+        hookPath = huskyHook;
+      }
+    }
+  }
+  const nextStepsList = [
+    "1. tested run",
+    "2. tested diff",
+    "3. tested push --pr <n>   (needs TESTED_TOKEN)",
+    "4. optional: wire CI (GitHub Actions / husky pre-push)"
+  ];
+  return {
+    configPath,
+    configWritten: true,
+    hookInstalled,
+    hookPath,
+    detected,
+    nextSteps: nextStepsList,
+    warnings
+  };
+}
+function buildInitJsonOutput(result) {
+  return { schemaVersion: 1, ...result };
+}
+function formatInitResultHuman(result) {
+  const lines = [];
+  lines.push(heading("tested.dev \u2014 init"));
+  lines.push("");
+  if (result.configWritten) {
+    lines.push(successLine(`wrote ${pc2.cyan(result.configPath)}`));
+  }
+  const runnerLabel = result.detected.testRunner ?? "none detected";
+  lines.push(dim(`  test runner: ${runnerLabel}`));
+  lines.push(dim(`  base branch: ${result.detected.defaultBranch}`));
+  if (result.hookInstalled && result.hookPath) {
+    lines.push(successLine(`installed pre-push hook at ${pc2.cyan(result.hookPath)}`));
+  }
+  if (result.warnings.length > 0) {
+    lines.push("");
+    for (const w of result.warnings) {
+      lines.push(`${pc2.yellow("!")} ${w}`);
+    }
+  }
+  if (result.nextSteps.length > 0) {
+    lines.push("");
+    lines.push(nextSteps(result.nextSteps));
+  }
+  return lines.join("\n");
+}
+function registerInitCommand(program2) {
+  program2.command("init").description("Initialize tested.dev in the current project (writes .tested.yaml)").option("--force", "Overwrite an existing .tested.yaml", false).option("--no-hooks", "Skip installing the husky pre-push hook").option("--json", "Emit JSON instead of human text", false).action(async (opts) => {
+    try {
+      if (opts.hooks && !process.stdin.isTTY && !opts.force) {
+        process.stderr.write(
+          errorBlock(
+            "--hooks in a non-TTY environment requires --force to confirm",
+            ["Would install a git hook unattended."]
+          )
+        );
+        process.exit(1);
+      }
+      const result = await runInit({
+        cwd: process.cwd(),
+        force: opts.force,
+        hooks: opts.hooks
+      });
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(buildInitJsonOutput(result), null, 2) + "\n");
+      } else {
+        process.stdout.write(formatInitResultHuman(result) + "\n");
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (opts.json) {
+        process.stderr.write(
+          JSON.stringify({ schemaVersion: 1, error: message }, null, 2) + "\n"
+        );
+      } else {
+        process.stderr.write(errorBlock(message));
+      }
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/setup.ts
+import { existsSync as existsSync4 } from "fs";
+import { join as join5 } from "path";
+import "commander";
+
+// src/commands/doctor.ts
+import { existsSync as existsSync3, accessSync, constants as fsConstants } from "fs";
+import { basename, isAbsolute as isAbsolute2, join as join4, resolve as resolve4 } from "path";
+import "commander";
+import { simpleGit as simpleGit3 } from "simple-git";
+
+// src/config.ts
+import { readFile } from "fs/promises";
+import { join as join2 } from "path";
+import { parse as parseYaml } from "yaml";
+
+// src/schemas.ts
+import { z as z2 } from "zod";
+
+// src/core/junit.ts
+import { z } from "zod";
+function testCaseKey(classname, name) {
+  return `${classname ?? ""}\0${name}`;
+}
+var TestCaseRefSchema = z.object({
+  name: z.string().min(1),
+  classname: z.string().optional(),
+  file: z.string().optional(),
+  durationMs: z.number().nonnegative()
+});
+var TestReportSchema = z.object({
+  schemaVersion: z.literal(1),
+  source: z.literal("junit"),
+  totals: z.object({
+    tests: z.number().int().nonnegative(),
+    passed: z.number().int().nonnegative(),
+    failed: z.number().int().nonnegative(),
+    skipped: z.number().int().nonnegative(),
+    errors: z.number().int().nonnegative(),
+    flaky: z.number().int().nonnegative(),
+    durationMs: z.number().nonnegative()
+  }),
+  /** Final failures (did not pass on last attempt). */
+  failures: z.array(
+    TestCaseRefSchema.extend({
+      message: z.string().optional()
+    })
+  ).max(50),
+  /** Failed at least once and passed at least once in the same report. */
+  flakes: z.array(
+    TestCaseRefSchema.extend({
+      attempts: z.number().int().positive()
+    })
+  ).max(50),
+  slowest: z.array(TestCaseRefSchema).max(15)
+});
+function decodeXmlEntities(s) {
+  return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
+function attr(tag, name) {
+  const re = new RegExp(`\\b${name}\\s*=\\s*("([^"]*)"|'([^']*)')`, "i");
+  const m = tag.match(re);
+  if (!m) return void 0;
+  return decodeXmlEntities(m[2] ?? m[3] ?? "");
+}
+function parseJunitXml(xml) {
+  const cases = [];
+  const re = /<testcase\b([^>]*?)\s*\/>|<testcase\b([^>]*)>([\s\S]*?)<\/testcase>/gi;
+  let m;
+  while ((m = re.exec(xml)) !== null) {
+    const openAttrs = (m[1] ?? m[2] ?? "").trim();
+    const body = m[3] ?? "";
+    const name = attr(openAttrs, "name")?.trim();
+    if (!name) continue;
+    const classname = attr(openAttrs, "classname")?.trim() || void 0;
+    const file = attr(openAttrs, "file")?.trim() || void 0;
+    const timeRaw = attr(openAttrs, "time");
+    const timeSec = timeRaw != null && timeRaw !== "" ? Number(timeRaw) : 0;
+    const flakyAttr = (attr(openAttrs, "flaky") ?? "").toLowerCase() === "true" || (attr(openAttrs, "flaky") ?? "") === "1";
+    let status = "passed";
+    let message;
+    if (/<skipped\b/i.test(body)) {
+      status = "skipped";
+      message = attr(body.match(/<skipped\b[^>]*>/i)?.[0] ?? "", "message");
+    } else if (/<failure\b/i.test(body)) {
+      status = "failed";
+      const fm = body.match(/<failure\b([^>]*)\/?>/i);
+      message = fm ? attr(fm[1] ?? "", "message") : void 0;
+      if (!message) {
+        const inner = body.match(/<failure\b[^>]*>([\s\S]*?)<\/failure>/i);
+        if (inner?.[1]?.trim()) message = decodeXmlEntities(inner[1].trim()).slice(0, 500);
+      }
+    } else if (/<error\b/i.test(body)) {
+      status = "error";
+      const em = body.match(/<error\b([^>]*)\/?>/i);
+      message = em ? attr(em[1] ?? "", "message") : void 0;
+    }
+    cases.push({
+      name,
+      ...classname ? { classname } : {},
+      ...file ? { file } : {},
+      timeSec: Number.isFinite(timeSec) && timeSec >= 0 ? timeSec : 0,
+      status,
+      ...message ? { message: message.slice(0, 500) } : {},
+      flakyAttr
+    });
+  }
+  return cases;
+}
+function buildTestReportFromCases(raw) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const c of raw) {
+    const k = testCaseKey(c.classname, c.name);
+    const list = groups.get(k) ?? [];
+    list.push(c);
+    groups.set(k, list);
+  }
+  let passed = 0;
+  let failed = 0;
+  let skipped = 0;
+  let errors = 0;
+  let flaky = 0;
+  let durationMs = 0;
+  const failures = [];
+  const flakes = [];
+  const durationByKey = [];
+  for (const [, attempts] of groups) {
+    const totalTime = attempts.reduce((s, a) => s + a.timeSec, 0);
+    const durationCaseMs = Math.round(totalTime * 1e3);
+    durationMs += durationCaseMs;
+    const last = attempts[attempts.length - 1];
+    const hadFail = attempts.some((a) => a.status === "failed" || a.status === "error");
+    const hadPass = attempts.some((a) => a.status === "passed");
+    const isFlaky = Boolean(attempts.some((a) => a.flakyAttr) || hadFail && hadPass);
+    const ref = {
+      name: last.name,
+      ...last.classname ? { classname: last.classname } : {},
+      ...last.file ? { file: last.file } : {},
+      durationMs: durationCaseMs
+    };
+    durationByKey.push(ref);
+    if (isFlaky) {
+      flaky += 1;
+      if (flakes.length < 50) {
+        flakes.push({ ...ref, attempts: attempts.length });
+      }
+    }
+    const final = [...attempts].reverse().find((a) => a.status !== "skipped") ?? last;
+    if (final.status === "skipped") {
+      skipped += 1;
+    } else if (final.status === "passed") {
+      passed += 1;
+    } else if (final.status === "error") {
+      errors += 1;
+      if (!isFlaky && failures.length < 50) {
+        failures.push({
+          ...ref,
+          ...final.message ? { message: final.message } : {}
+        });
+      }
+    } else if (final.status === "failed") {
+      failed += 1;
+      if (!isFlaky && failures.length < 50) {
+        failures.push({
+          ...ref,
+          ...final.message ? { message: final.message } : {}
+        });
+      }
+    }
+  }
+  const slowest = [...durationByKey].sort((a, b) => b.durationMs - a.durationMs).slice(0, 10);
+  return {
+    schemaVersion: 1,
+    source: "junit",
+    totals: {
+      tests: groups.size,
+      passed,
+      failed,
+      skipped,
+      errors,
+      flaky,
+      durationMs
+    },
+    failures,
+    flakes,
+    slowest
+  };
+}
+function parseJunitToTestReport(xml) {
+  return buildTestReportFromCases(parseJunitXml(xml));
+}
+
+// src/schemas.ts
+var TestedConfigSchema = z2.object({
+  ignores: z2.array(z2.string()).default([]),
+  coverage: z2.object({
+    format: z2.literal("istanbul-json").default("istanbul-json"),
+    path: z2.string().default("coverage/coverage-final.json")
+  }).prefault({}),
+  base: z2.string().default("origin/main"),
+  testRunner: z2.enum(["vitest", "jest", "pytest"]).nullable().default(null),
+  // Patch / project coverage gates. `tested init` writes these so users can
+  // tune what counts as "passing" — schema MUST accept them so loadConfig
+  // doesn't silently drop the field. Enforcement in `diff` lands in a
+  // follow-up; today we just round-trip the values cleanly.
+  thresholds: z2.object({
+    patch: z2.number().min(0).max(100),
+    project: z2.number().min(0).max(100)
+  }).optional()
+});
+var UncoveredRangeSchema = z2.object({
+  start: z2.number().int().positive(),
+  end: z2.number().int().positive(),
+  kind: z2.enum(["line", "branch", "function"])
+});
+var FileCoverageSchema = z2.object({
+  path: z2.string(),
+  patchCoverage: z2.number().nullable(),
+  projectCoverage: z2.number(),
+  uncoveredRanges: z2.array(UncoveredRangeSchema)
+});
+var CoverageTotalsSchema = z2.object({
+  executable: z2.number().int().nonnegative(),
+  covered: z2.number().int().nonnegative(),
+  pct: z2.number().min(0).max(100)
+});
+var ProjectTotalsSchema = CoverageTotalsSchema.extend({
+  delta: z2.number().nullable()
+});
+var DiffOutputSchema = z2.object({
+  schemaVersion: z2.literal(1),
+  base: z2.string(),
+  head: z2.string(),
+  patch: CoverageTotalsSchema,
+  project: ProjectTotalsSchema,
+  files: z2.array(FileCoverageSchema),
+  ignored: z2.array(z2.string())
+});
+
+// src/config.ts
+var DEFAULT_IGNORES = [
+  "migrations/**",
+  "seeds/**",
+  "tests/**",
+  "test/**",
+  "**/*.test.*",
+  "**/*.spec.*",
+  "mocks/**",
+  "__mocks__/**",
+  "vitest.setup.*",
+  "cypress/**",
+  "scripts/**",
+  "storybook/**",
+  ".storybook/**",
+  "**/*.d.ts",
+  "stubs/**"
+];
+async function loadConfig(opts) {
+  const file = join2(opts.cwd, ".tested.yaml");
+  let raw = {};
+  try {
+    const text = await readFile(file, "utf8");
+    raw = parseYaml(text) ?? {};
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+  const parsed = TestedConfigSchema.parse(raw);
+  const merged = /* @__PURE__ */ new Set([...DEFAULT_IGNORES, ...parsed.ignores]);
+  return { ...parsed, ignores: [...merged] };
+}
+
+// src/commands/push.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, statSync } from "fs";
+import { join as join3 } from "path";
+import "commander";
+
+// src/core/computeDiff.ts
+import { resolve as resolve3 } from "path";
+
+// src/git.ts
+import { simpleGit as simpleGit2 } from "simple-git";
+async function openRepo(cwd) {
+  const git = simpleGit2({ baseDir: cwd });
+  const repoRoot = (await git.revparse(["--show-toplevel"])).trim();
+  return { git, repoRoot };
+}
+async function resolveBase(ctx, base) {
+  return (await ctx.git.revparse([base])).trim();
+}
+async function headSha(ctx) {
+  return (await ctx.git.revparse(["HEAD"])).trim();
+}
+async function unifiedDiff(ctx, base) {
+  return ctx.git.diff([`${base}...HEAD`]);
+}
+async function remoteUrl(ctx, remote = "origin") {
+  return (await ctx.git.raw(["remote", "get-url", remote])).trim();
+}
+async function currentBranch(ctx) {
+  try {
+    const name = (await ctx.git.revparse(["--abbrev-ref", "HEAD"])).trim();
+    return name === "HEAD" ? "" : name;
+  } catch {
+    return "";
+  }
+}
+async function gitUserName(ctx) {
+  try {
+    const name = (await ctx.git.raw(["config", "user.name"])).trim();
+    return name || null;
+  } catch {
+    return null;
+  }
+}
+
+// src/git-ref.ts
+var SAFE_GIT_REF_RE = /^[A-Za-z0-9_./@~^-]{1,256}$/;
+function assertSafeGitRef(ref) {
+  if (!ref) {
+    throw new Error("git ref must not be empty");
+  }
+  if (ref.startsWith("-")) {
+    throw new Error(`git ref must not start with '-': ${ref}`);
+  }
+  if (!SAFE_GIT_REF_RE.test(ref)) {
+    throw new Error(
+      `git ref contains invalid characters or is too long (max 256): ${ref}`
+    );
+  }
+  return ref;
+}
+
+// src/core/istanbul.ts
+import { readFile as readFile2 } from "fs/promises";
+import { isAbsolute, relative, resolve } from "path";
+function isCoveragePathInsideRoot(repoRoot, entryPath) {
+  const root = resolve(repoRoot);
+  const absPath = resolve(entryPath);
+  const relPath = relative(root, absPath).split("\\").join("/");
+  if (!relPath || relPath === "") return true;
+  if (isAbsolute(relPath)) return false;
+  if (relPath === ".." || relPath.startsWith("../")) return false;
+  return true;
+}
+async function parseIstanbul(opts) {
+  let raw;
+  try {
+    raw = await readFile2(opts.path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      throw new Error(
+        `coverage-final.json not found at ${opts.path}. Run \`tested run\` first.`
+      );
+    }
+    throw err;
+  }
+  const data = JSON.parse(raw);
+  const root = resolve(opts.repoRoot);
+  const out = [];
+  for (const entry of Object.values(data)) {
+    if (!isCoveragePathInsideRoot(root, entry.path)) {
+      continue;
+    }
+    const absPath = resolve(entry.path);
+    const relPath = relative(root, absPath).split("\\").join("/");
+    const statements = Object.entries(entry.statementMap).map(([id, loc]) => ({
+      id,
+      startLine: loc.start.line,
+      endLine: loc.end.line,
+      hits: entry.s[id] ?? 0
+    }));
+    out.push({ path: relPath, absPath, statements });
+  }
+  return out;
+}
+
+// src/core/diff.ts
+var FILE_HEADER = /^diff --git a\/(.+?) b\/(.+?)$/;
+var HUNK_HEADER = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/;
+function parseUnifiedDiff(text) {
+  const result = /* @__PURE__ */ new Map();
+  const lines = text.split("\n");
+  let currentFile = null;
+  let currentLine = 0;
+  let inHunk = false;
+  for (const line of lines) {
+    const fileMatch = line.match(FILE_HEADER);
+    if (fileMatch) {
+      currentFile = fileMatch[2] ?? null;
+      inHunk = false;
+      continue;
+    }
+    if (!currentFile) continue;
+    const hunkMatch = line.match(HUNK_HEADER);
+    if (hunkMatch) {
+      currentLine = Number(hunkMatch[1]);
+      inHunk = true;
+      continue;
+    }
+    if (!inHunk) continue;
+    if (line.startsWith("+") && !line.startsWith("+++")) {
+      if (!result.has(currentFile)) result.set(currentFile, /* @__PURE__ */ new Set());
+      result.get(currentFile).add(currentLine);
+      currentLine += 1;
+    } else if (line.startsWith("-") && !line.startsWith("---")) {
+    } else if (line.startsWith(" ") || line === "") {
+      currentLine += 1;
+    }
+  }
+  return result;
+}
+
+// src/core/ignores.ts
+import { minimatch } from "minimatch";
+function isIgnored(path, patterns) {
+  return patterns.some((p) => {
+    return minimatch(path, p, { dot: true, matchBase: true }) || minimatch(path, `**/${p}`, { dot: true, matchBase: true });
+  });
+}
+function splitByIgnore(paths, patterns) {
+  const kept = [];
+  const ignored = [];
+  for (const p of paths) {
+    if (isIgnored(p, patterns)) ignored.push(p);
+    else kept.push(p);
+  }
+  return { kept, ignored };
+}
+
+// src/core/assert-within-root.ts
+import { resolve as resolve2, sep } from "path";
+function assertWithinRoot(root, resolvedPath) {
+  const safeRoot = resolve2(root) + sep;
+  const safePath = resolve2(resolvedPath);
+  if (!safePath.startsWith(safeRoot)) {
+    throw new Error(
+      `Path traversal rejected: ${safePath} is outside repository root ${safeRoot}`
+    );
+  }
+}
+
+// src/core/patch.ts
+function pct(covered, executable) {
+  if (executable === 0) return 0;
+  return Math.round(covered / executable * 1e3) / 10;
+}
+function computePatchCoverage(files, addedByFile) {
+  const byFile = /* @__PURE__ */ new Map();
+  let execTotal = 0;
+  let covTotal = 0;
+  for (const file of files) {
+    const added = addedByFile.get(file.path);
+    if (!added || added.size === 0) continue;
+    let exec = 0;
+    let cov = 0;
+    for (const stmt of file.statements) {
+      const touched = lineRangeOverlaps(stmt.startLine, stmt.endLine, added);
+      if (!touched) continue;
+      exec += 1;
+      if (stmt.hits > 0) cov += 1;
+    }
+    if (exec === 0) continue;
+    byFile.set(file.path, { executable: exec, covered: cov, pct: pct(cov, exec) });
+    execTotal += exec;
+    covTotal += cov;
+  }
+  return {
+    totals: { executable: execTotal, covered: covTotal, pct: pct(covTotal, execTotal) },
+    byFile
+  };
+}
+function lineRangeOverlaps(start, end, added) {
+  for (let line = start; line <= end; line += 1) {
+    if (added.has(line)) return true;
+  }
+  return false;
+}
+
+// src/core/project.ts
+function pct2(covered, executable) {
+  if (executable === 0) return 0;
+  return Math.round(covered / executable * 1e3) / 10;
+}
+function computeProjectCoverage(files) {
+  const byFile = /* @__PURE__ */ new Map();
+  let execTotal = 0;
+  let covTotal = 0;
+  for (const file of files) {
+    let exec = 0;
+    let cov = 0;
+    for (const stmt of file.statements) {
+      exec += 1;
+      if (stmt.hits > 0) cov += 1;
+    }
+    byFile.set(file.path, { executable: exec, covered: cov, pct: pct2(cov, exec) });
+    execTotal += exec;
+    covTotal += cov;
+  }
+  return {
+    totals: { executable: execTotal, covered: covTotal, pct: pct2(covTotal, execTotal) },
+    byFile
+  };
+}
+
+// src/core/uncovered.ts
+function uncoveredRanges(file) {
+  const lines = /* @__PURE__ */ new Set();
+  for (const stmt of file.statements) {
+    if (stmt.hits > 0) continue;
+    for (let line = stmt.startLine; line <= stmt.endLine; line += 1) {
+      lines.add(line);
+    }
+  }
+  const sorted = [...lines].sort((a, b) => a - b);
+  const ranges = [];
+  let start = null;
+  let prev = null;
+  for (const line of sorted) {
+    if (start === null) {
+      start = line;
+      prev = line;
+      continue;
+    }
+    if (prev !== null && line === prev + 1) {
+      prev = line;
+      continue;
+    }
+    ranges.push({ start, end: prev, kind: "line" });
+    start = line;
+    prev = line;
+  }
+  if (start !== null && prev !== null) {
+    ranges.push({ start, end: prev, kind: "line" });
+  }
+  return ranges;
+}
+
+// src/output/json.ts
+function buildDiffOutput(args) {
+  const patch = computePatchCoverage(args.files, args.addedByFile);
+  const project = computeProjectCoverage(args.files);
+  const fileNames = /* @__PURE__ */ new Set([
+    ...patch.byFile.keys(),
+    ...project.byFile.keys()
+  ]);
+  const files = [];
+  for (const name of fileNames) {
+    const file = args.files.find((f) => f.path === name);
+    if (!file) continue;
+    files.push({
+      path: name,
+      patchCoverage: patch.byFile.get(name)?.pct ?? null,
+      projectCoverage: project.byFile.get(name)?.pct ?? 0,
+      uncoveredRanges: uncoveredRanges(file)
+    });
+  }
+  files.sort((a, b) => a.path.localeCompare(b.path));
+  return {
+    schemaVersion: 1,
+    base: args.base,
+    head: args.head,
+    patch: patch.totals,
+    project: { ...project.totals, delta: args.projectDelta ?? null },
+    files,
+    ignored: [...args.ignored]
+  };
+}
+
+// src/core/computeDiff.ts
+async function computeDiff(opts) {
+  const { cwd, config } = opts;
+  const ctx = opts.ctx ?? await openRepo(cwd);
+  const baseRef = assertSafeGitRef(opts.baseRef ?? config.base);
+  const base = await resolveBase(ctx, baseRef);
+  const head = await headSha(ctx);
+  const diffText = await unifiedDiff(ctx, base);
+  const addedByFile = parseUnifiedDiff(diffText);
+  const coveragePath = resolve3(cwd, config.coverage.path);
+  assertWithinRoot(ctx.repoRoot, coveragePath);
+  const allFiles = await parseIstanbul({ path: coveragePath, repoRoot: ctx.repoRoot });
+  const { kept, ignored } = splitByIgnore(
+    allFiles.map((f) => f.path),
+    config.ignores
+  );
+  const keptSet = new Set(kept);
+  const files = allFiles.filter((f) => keptSet.has(f.path));
+  let projectDelta = null;
+  if (opts.withBaseCoverage) {
+    const baseCoveragePath = resolve3(cwd, opts.withBaseCoverage);
+    assertWithinRoot(ctx.repoRoot, baseCoveragePath);
+    const baseFiles = await parseIstanbul({
+      path: baseCoveragePath,
+      repoRoot: ctx.repoRoot
+    });
+    const baseKept = baseFiles.filter((f) => !ignored.includes(f.path));
+    const baseExec = baseKept.reduce((n, f) => n + f.statements.length, 0);
+    const baseCov = baseKept.reduce(
+      (n, f) => n + f.statements.filter((s) => s.hits > 0).length,
+      0
+    );
+    const basePct = baseExec === 0 ? 0 : Math.round(baseCov / baseExec * 1e3) / 10;
+    const headPct = (() => {
+      const exec = files.reduce((n, f) => n + f.statements.length, 0);
+      const cov = files.reduce(
+        (n, f) => n + f.statements.filter((s) => s.hits > 0).length,
+        0
+      );
+      return exec === 0 ? 0 : Math.round(cov / exec * 1e3) / 10;
+    })();
+    projectDelta = Math.round((headPct - basePct) * 10) / 10;
+  }
+  return buildDiffOutput({
+    base: baseRef,
+    head,
+    files,
+    addedByFile,
+    ignored,
+    projectDelta
+  });
+}
+
+// src/commands/push.ts
+var DEFAULT_API_BASE = "https://app.tested.dev";
+var LOCAL_HTTP_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+var tokenArgvWarned = false;
+function readTokenFile(filePath, opts) {
+  const read = opts?.readFileSyncFn ?? readFileSync2;
+  const stat = opts?.statSyncFn ?? statSync;
+  let mode;
+  try {
+    const st = stat(filePath);
+    mode = st.mode;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`could not stat TESTED_TOKEN_FILE "${filePath}": ${message}`);
+  }
+  if (typeof mode === "number" && (mode & 4) !== 0) {
+    throw new Error(
+      `TESTED_TOKEN_FILE "${filePath}" is world-readable; chmod 600 the file or move the token to TESTED_TOKEN`
+    );
+  }
+  let raw;
+  try {
+    raw = read(filePath, "utf8");
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`could not read TESTED_TOKEN_FILE "${filePath}": ${message}`);
+  }
+  const token = raw.trim();
+  if (!token) {
+    throw new Error(`TESTED_TOKEN_FILE "${filePath}" is empty`);
+  }
+  return token;
+}
+function resolveToken(opts) {
+  const env = opts.env ?? process.env;
+  const isTTY = opts.isTTY ?? Boolean(process.stderr.isTTY);
+  const warn = opts.warn ?? ((msg) => {
+    process.stderr.write(msg);
+  });
+  if (opts.flag !== void 0 && opts.flag !== "") {
+    if (isTTY && !tokenArgvWarned) {
+      tokenArgvWarned = true;
+      warn(
+        "warning: --token exposes the secret on process argv (visible to `ps` and audit agents). Prefer TESTED_TOKEN, TESTED_INGEST_TOKEN, or TESTED_TOKEN_FILE.\n"
+      );
+    }
+    return opts.flag;
+  }
+  const fromEnv = env.TESTED_TOKEN ?? env.TESTED_INGEST_TOKEN;
+  if (fromEnv !== void 0 && fromEnv !== "") return fromEnv;
+  const tokenFile = env.TESTED_TOKEN_FILE;
+  if (tokenFile) {
+    return readTokenFile(tokenFile, {
+      ...opts.readFileSyncFn ? { readFileSyncFn: opts.readFileSyncFn } : {},
+      ...opts.statSyncFn ? { statSyncFn: opts.statSyncFn } : {}
+    });
+  }
+  return null;
+}
+function assertSafeApiBase(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) {
+    throw new Error("API URL must not be empty");
+  }
+  let u;
+  try {
+    u = new URL(trimmed);
+  } catch {
+    throw new Error(
+      `invalid API URL "${trimmed}" \u2014 expected an absolute URL (e.g. https://app.tested.dev)`
+    );
+  }
+  if (u.username || u.password) {
+    throw new Error("API URL must not embed credentials");
+  }
+  const host = u.hostname.toLowerCase();
+  const isLocalHttpHost = LOCAL_HTTP_HOSTS.has(host) || host.endsWith(".localhost");
+  if (u.protocol === "https:") {
+  } else if (u.protocol === "http:" && isLocalHttpHost) {
+  } else {
+    throw new Error(
+      `API URL must use https:// (http:// allowed only for localhost). Got ${u.protocol}//${u.host}`
+    );
+  }
+  const path = u.pathname.replace(/\/+$/, "");
+  const pathPart = !path || path === "/" ? "" : path;
+  return `${u.origin}${pathPart}`;
+}
+function resolveApiBase(opts) {
+  const env = opts.env ?? process.env;
+  const raw = opts.flag ?? env.TESTED_API_URL ?? DEFAULT_API_BASE;
+  return assertSafeApiBase(raw);
+}
+function redactGitRemote(url) {
+  const scrubbed = url.replace(/\/\/([^/@\s]+)@/g, "//***@");
+  return scrubbed;
+}
+function resolvePrNumber(opts) {
+  const env = opts.env ?? process.env;
+  const raw = opts.flag ?? env.GITHUB_PR_NUMBER ?? env.PR_NUMBER;
+  if (raw === void 0 || raw === "") return null;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n <= 0) {
+    throw new Error(
+      `invalid PR number "${raw}" \u2014 expected a positive integer (via --pr or GITHUB_PR_NUMBER)`
+    );
+  }
+  return n;
+}
+function parseGitHubRemote(url) {
+  const trimmed = url.trim();
+  if (!trimmed) return null;
+  const scp = trimmed.match(/^git@[^:]+:([^/]+)\/([^/]+?)(?:\.git)?$/i);
+  if (scp) return { owner: scp[1], name: scp[2] };
+  try {
+    const normalized = trimmed.replace(/^git\+/, "");
+    const withProto = /^[a-z][a-z0-9+.-]*:\/\//i.test(normalized) ? normalized : `https://${normalized}`;
+    const u = new URL(withProto);
+    const parts = u.pathname.replace(/^\//, "").replace(/\.git$/i, "").split("/");
+    if (parts.length >= 2 && parts[0] && parts[1]) {
+      return { owner: parts[0], name: parts[1] };
+    }
+  } catch {
+  }
+  return null;
+}
+function sanitizeAuthor(name) {
+  const slug = name.trim().toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
+  return slug || "unknown";
+}
+function toBranchName(ref) {
+  return ref.replace(/^refs\/heads\//, "").replace(/^refs\/remotes\//, "").replace(/^origin\//, "");
+}
+function buildIngestBody(input) {
+  const baseRefName = toBranchName(input.baseRef);
+  return {
+    repo: {
+      owner: input.owner,
+      name: input.name,
+      defaultBranch: baseRefName
+    },
+    pr: {
+      number: input.prNumber,
+      title: input.prTitle,
+      authorLogin: input.author,
+      baseRef: baseRefName,
+      headRef: input.headRef,
+      headSha: input.headSha,
+      state: "open"
+    },
+    runUrl: input.runUrl,
+    diff: input.diff,
+    ...input.testReport ? { testReport: input.testReport } : {}
+  };
+}
+function buildMainlineIngestBody(input) {
+  return {
+    repo: {
+      owner: input.owner,
+      name: input.name,
+      defaultBranch: input.defaultBranch
+    },
+    runUrl: input.runUrl,
+    diff: input.diff,
+    ref: input.ref,
+    isDefaultBranch: true,
+    headSha: input.headSha,
+    ...input.testReport ? { testReport: input.testReport } : {}
+  };
+}
+var DEFAULT_JUNIT_CANDIDATES = [
+  "junit.xml",
+  "test-results/junit.xml",
+  "coverage/junit.xml",
+  "reports/junit.xml"
+];
+function resolveJunitPath(opts) {
+  const env = opts.env ?? process.env;
+  const exists = opts.existsSyncFn ?? existsSync2;
+  if (opts.flag && opts.flag.trim()) {
+    const p = opts.flag.trim();
+    const abs = p.startsWith("/") ? p : join3(opts.cwd, p);
+    if (!exists(abs)) {
+      throw new Error(`JUnit file not found: ${p}`);
+    }
+    return abs;
+  }
+  const fromEnv = env.TESTED_JUNIT?.trim();
+  if (fromEnv) {
+    const abs = fromEnv.startsWith("/") ? fromEnv : join3(opts.cwd, fromEnv);
+    if (!exists(abs)) {
+      throw new Error(`TESTED_JUNIT file not found: ${fromEnv}`);
+    }
+    return abs;
+  }
+  for (const rel of DEFAULT_JUNIT_CANDIDATES) {
+    const abs = join3(opts.cwd, rel);
+    if (exists(abs)) return abs;
+  }
+  return null;
+}
+function loadTestReportFromJunit(path, readFn = readFileSync2) {
+  const xml = readFn(path, "utf8");
+  return parseJunitToTestReport(xml);
+}
+async function postIngest(opts) {
+  const fetchFn = opts.fetchFn ?? globalThis.fetch;
+  const url = `${opts.apiBase}/api/ingest`;
+  let res;
+  try {
+    res = await fetchFn(url, {
+      method: "POST",
+      // Do not follow redirects: a 3xx to another origin could exfiltrate the
+      // Bearer token depending on the fetch implementation.
+      redirect: "manual",
+      headers: {
+        Authorization: `Bearer ${opts.token}`,
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      body: JSON.stringify(opts.body)
+    });
+  } catch (err) {
+    const message2 = err instanceof Error ? err.message : String(err);
+    return { ok: false, status: 0, message: `network error: ${message2}` };
+  }
+  if (res.status >= 300 && res.status < 400) {
+    return {
+      ok: false,
+      status: res.status,
+      message: `ingest redirected (${res.status}); refusing to follow redirects with Bearer token`
+    };
+  }
+  const text = await res.text();
+  let parsed = null;
+  if (text) {
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      parsed = null;
+    }
+  }
+  if (res.status === 200) {
+    const data = parsed;
+    if (!data) {
+      return {
+        ok: false,
+        status: res.status,
+        message: "ingest succeeded but response was empty"
+      };
+    }
+    if (data.mainline === true) {
+      return {
+        ok: true,
+        status: res.status,
+        data: {
+          mainline: true,
+          ...typeof data.date === "string" ? { date: data.date } : {},
+          ...typeof data.projectPct === "number" ? { projectPct: data.projectPct } : {}
+        }
+      };
+    }
+    if (typeof data.shareUrl !== "string" || !data.shareUrl) {
+      return {
+        ok: false,
+        status: res.status,
+        message: "ingest succeeded but response missing shareUrl"
+      };
+    }
+    return {
+      ok: true,
+      status: res.status,
+      data: {
+        shareUrl: data.shareUrl,
+        ...typeof data.expiresAt === "string" ? { expiresAt: data.expiresAt } : {}
+      }
+    };
+  }
+  let message = text || res.statusText || "unknown error";
+  let code;
+  if (parsed && typeof parsed === "object") {
+    const obj = parsed;
+    if (typeof obj.message === "string") message = obj.message;
+    else if (typeof obj.error === "string") message = obj.error;
+    if (typeof obj.code === "string") code = obj.code;
+    else if (typeof obj.error === "string" && /^[a-z0-9_]+$/i.test(obj.error)) {
+      code = obj.error;
+    }
+  }
+  return { ok: false, status: res.status, message, ...code ? { code } : {} };
+}
+function formatPushSuccess(data, json) {
+  if (json) {
+    const payload = {};
+    if (data.shareUrl) payload.shareUrl = data.shareUrl;
+    if (data.expiresAt) payload.expiresAt = data.expiresAt;
+    if (data.mainline) payload.mainline = true;
+    if (data.date) payload.date = data.date;
+    if (typeof data.projectPct === "number") payload.projectPct = data.projectPct;
+    return { stdout: JSON.stringify(payload) + "\n", stderr: "" };
+  }
+  const lines = [];
+  if (data.mainline) {
+    lines.push(
+      successLine(
+        `mainline coverage recorded` + (typeof data.projectPct === "number" ? `  ${data.projectPct.toFixed(1)}%` : "") + (data.date ? `  ${data.date}` : "")
+      )
+    );
+    return { stdout: lines.join("\n") + "\n", stderr: "" };
+  }
+  if (!data.shareUrl) {
+    return { stdout: successLine("uploaded") + "\n", stderr: "" };
+  }
+  lines.push(successLine(`shared  ${shareUrl(data.shareUrl)}`));
+  if (data.expiresAt) {
+    lines.push(dim(`  expires ${data.expiresAt}`));
+  }
+  return { stdout: lines.join("\n") + "\n", stderr: "" };
+}
+function formatMissingTokenError(opts) {
+  return errorBlock("missing ingest token", [
+    ...tokenMintGuidance(opts),
+    "or pass --token <token> (avoid on shared hosts: visible in ps)"
+  ]);
+}
+function formatPushError(status, message, code) {
+  if (status === 0) {
+    return errorBlock(message);
+  }
+  const normalized = (code ?? message).toLowerCase();
+  if (normalized.includes("token_required") || normalized.includes("invalid token") || normalized.includes("unauthorized") || status === 401) {
+    return errorBlock("ingest auth failed", [
+      message,
+      "",
+      ...tokenMintGuidance(),
+      "or --token"
+    ]);
+  }
+  if (normalized.includes("repo_not_found") || status === 404 && /repo/i.test(message)) {
+    return errorBlock("repo not found", [
+      message,
+      "",
+      "Check --owner / --name (or that the git remote origin is correct)",
+      "and that this repo exists on app.tested.dev"
+    ]);
+  }
+  if (status === 403) {
+    return errorBlock(`ingest failed (${status})`, [
+      message,
+      "",
+      "Token may lack permission for this repo."
+    ]);
+  }
+  return errorBlock(`ingest failed (${status})`, [message]);
+}
+async function executePush(cli, deps) {
+  const env = deps.env ?? process.env;
+  const computeDiffFn = deps.computeDiffFn ?? computeDiff;
+  const fetchFn = deps.fetchFn ?? globalThis.fetch;
+  const openRepoFn = deps.openRepoFn ?? openRepo;
+  const loadConfigFn = deps.loadConfigFn ?? loadConfig;
+  const onProgress = deps.onProgress ?? ((msg) => {
+    process.stderr.write(progress(msg) + "\n");
+  });
+  const token = resolveToken({
+    ...cli.token !== void 0 ? { flag: cli.token } : {},
+    env
+  });
+  if (!token) {
+    let owner2 = cli.owner ?? null;
+    let name2 = cli.name ?? null;
+    if (!owner2 || !name2) {
+      try {
+        const ctx2 = await openRepoFn(deps.cwd);
+        const origin = await remoteUrl(ctx2, "origin");
+        const parsed = parseGitHubRemote(origin);
+        if (parsed) {
+          owner2 = owner2 ?? parsed.owner;
+          name2 = name2 ?? parsed.name;
+        }
+      } catch {
+      }
+    }
+    return {
+      exitCode: 1,
+      stdout: "",
+      stderr: formatMissingTokenError({ owner: owner2, name: name2 })
+    };
+  }
+  let prNumber;
+  try {
+    prNumber = resolvePrNumber({
+      ...cli.pr !== void 0 ? { flag: cli.pr } : {},
+      env
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { exitCode: 1, stdout: "", stderr: errorBlock(message) };
+  }
+  const mainline = Boolean(cli.mainline);
+  if (prNumber === null && !mainline) {
+    return {
+      exitCode: 1,
+      stdout: "",
+      stderr: errorBlock("PR number required", [
+        "Pass --pr <number>",
+        "or set GITHUB_PR_NUMBER (CI) / PR_NUMBER",
+        "or pass --mainline for default-branch coverage (no share URL)"
+      ])
+    };
+  }
+  let apiBase;
+  try {
+    apiBase = resolveApiBase({
+      ...cli.url !== void 0 ? { flag: cli.url } : {},
+      env
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { exitCode: 1, stdout: "", stderr: errorBlock(message) };
+  }
+  const config = await loadConfigFn({ cwd: deps.cwd });
+  const ctx = await openRepoFn(deps.cwd);
+  onProgress("computing diff\u2026");
+  let diff;
+  try {
+    diff = await computeDiffFn({
+      cwd: deps.cwd,
+      config,
+      ...cli.base !== void 0 ? { baseRef: cli.base } : {},
+      ctx
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { exitCode: 1, stdout: "", stderr: errorBlock(message) };
+  }
+  let owner = cli.owner;
+  let name = cli.name;
+  if (!owner || !name) {
+    let origin;
+    try {
+      origin = await remoteUrl(ctx, "origin");
+    } catch {
+      return {
+        exitCode: 1,
+        stdout: "",
+        stderr: errorBlock("could not read git remote origin", [
+          "Pass --owner and --name explicitly."
+        ])
+      };
+    }
+    const parsed = parseGitHubRemote(origin);
+    if (!parsed) {
+      return {
+        exitCode: 1,
+        stdout: "",
+        stderr: errorBlock(
+          `could not parse owner/name from remote "${redactGitRemote(origin)}"`,
+          ["Pass --owner and --name."]
+        )
+      };
+    }
+    owner = owner ?? parsed.owner;
+    name = name ?? parsed.name;
+  }
+  const sha = await headSha(ctx);
+  const branch = await currentBranch(ctx) || "coverage push";
+  const baseRef = cli.baseRef ?? (toBranchName(config.base) || "main");
+  const headRef = cli.headRef ?? branch;
+  const prTitle = cli.prTitle ?? (branch !== "coverage push" ? branch : "coverage push");
+  let author = cli.author;
+  if (!author) {
+    const gitName = await gitUserName(ctx);
+    author = sanitizeAuthor(gitName ?? env.USER ?? env.USERNAME ?? "unknown");
+  }
+  let testReport;
+  try {
+    const junitPath = resolveJunitPath({
+      ...cli.junit !== void 0 ? { flag: cli.junit } : {},
+      cwd: deps.cwd,
+      env
+    });
+    if (junitPath) {
+      onProgress("parsing JUnit\u2026");
+      testReport = loadTestReportFromJunit(junitPath);
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { exitCode: 1, stdout: "", stderr: errorBlock(message) };
+  }
+  const body = mainline ? buildMainlineIngestBody({
+    owner,
+    name,
+    defaultBranch: baseRef,
+    headSha: sha,
+    ref: `refs/heads/${baseRef}`,
+    runUrl: cli.runUrl ?? null,
+    diff,
+    ...testReport ? { testReport } : {}
+  }) : buildIngestBody({
+    owner,
+    name,
+    baseRef,
+    prNumber,
+    prTitle,
+    author,
+    headRef,
+    headSha: sha,
+    runUrl: cli.runUrl ?? null,
+    diff,
+    ...testReport ? { testReport } : {}
+  });
+  onProgress(mainline ? "uploading mainline coverage\u2026" : "uploading\u2026");
+  const result = await postIngest({ apiBase, token, body, fetchFn });
+  if (!result.ok) {
+    return {
+      exitCode: 1,
+      stdout: "",
+      stderr: formatPushError(result.status, result.message, result.code)
+    };
+  }
+  const formatted = formatPushSuccess(result.data, cli.json);
+  return {
+    exitCode: 0,
+    stdout: formatted.stdout,
+    stderr: formatted.stderr,
+    ...result.data.shareUrl !== void 0 ? { shareUrl: result.data.shareUrl } : {},
+    ...result.data.expiresAt !== void 0 ? { expiresAt: result.data.expiresAt } : {}
+  };
+}
+function registerPushCommand(program2) {
+  program2.command("push").description("Push local coverage to tested.dev and get a share URL").option(
+    "--token <token>",
+    "Ingest token (prefer env TESTED_TOKEN / TESTED_INGEST_TOKEN / TESTED_TOKEN_FILE)"
+  ).option(
+    "--url <url>",
+    `API base URL (default ${DEFAULT_API_BASE}, or env TESTED_API_URL)`
+  ).option("--owner <owner>", "Repo owner (default: detect from git remote origin)").option("--name <name>", "Repo name (default: detect from git remote origin)").option("--pr <number>", "PR number (or env GITHUB_PR_NUMBER / PR_NUMBER)").option(
+    "--mainline",
+    "Upload default-branch project coverage only (no PR / no share URL)",
+    false
+  ).option("--pr-title <title>", 'PR title (default: current branch or "coverage push")').option(
+    "--author <login>",
+    "PR author login (default: git user.name sanitized or $USER)"
+  ).option(
+    "--base-ref <ref>",
+    "Base branch name sent to the API (default: .tested.yaml base or main)"
+  ).option("--head-ref <ref>", "Head branch name (default: current branch)").option("--run-url <url>", "Optional CI run URL attached to the ingest").option("--base <ref>", "Git base ref to diff against (same as `tested diff --base`)").option(
+    "--junit <path>",
+    "JUnit XML for test analytics (flakes / slowest). Also TESTED_JUNIT or junit.xml"
+  ).option("--json", "Emit machine-readable JSON instead of the share URL only", false).action(async (opts) => {
+    try {
+      const result = await executePush(opts, { cwd: process.cwd() });
+      if (result.stderr) process.stderr.write(result.stderr);
+      if (result.stdout) process.stdout.write(result.stdout);
+      process.exitCode = result.exitCode;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(errorBlock(message));
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/commands/doctor.ts
+var TESTED_BIN_BASENAME_RE = /^tested(\.js)?$/;
+function statusBadge(status) {
+  const kind = status === "pass" ? "pass" : status === "fail" ? "fail" : status === "warn" ? "warn" : "info";
+  return badge(kind);
+}
+function formatCheckLine(check) {
+  const pad = check.label.padEnd(18);
+  return `  ${pad}  ${statusBadge(check.status)}  ${dim(check.detail)}`;
+}
+function formatDoctorHuman(result) {
+  const lines = [];
+  lines.push(
+    `${heading("tested.dev \u2014 doctor")}  ${result.ok ? badge("pass") : badge("fail")}`
+  );
+  lines.push("");
+  for (const c of result.checks) {
+    lines.push(formatCheckLine(c));
+  }
+  lines.push("");
+  if (result.ok) {
+    lines.push(dim("environment looks ready"));
+  } else {
+    lines.push(tip("fix FAIL items, then re-run: tested doctor"));
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+function buildDoctorJson(result) {
+  return {
+    schemaVersion: 1,
+    ok: result.ok,
+    checks: result.checks.map((c) => ({
+      id: c.id,
+      label: c.label,
+      status: c.status,
+      detail: c.detail,
+      ...c.optional ? { optional: true } : {}
+    }))
+  };
+}
+function parseNodeMajor(version) {
+  const m = version.replace(/^v/, "").match(/^(\d+)/);
+  if (!m) return null;
+  return Number(m[1]);
+}
+function isReadableFile(path, exists) {
+  if (!exists(path)) return false;
+  try {
+    accessSync(path, fsConstants.R_OK);
+    return true;
+  } catch {
+    return exists(path);
+  }
+}
+async function runDoctor(deps) {
+  const cwd = deps.cwd;
+  const env = deps.env ?? process.env;
+  const exists = deps.existsSyncFn ?? existsSync3;
+  const gitFactory = deps.gitFactory ?? simpleGit3;
+  const loadConfigFn = deps.loadConfigFn ?? loadConfig;
+  const resolveTokenFn = deps.resolveTokenFn ?? resolveToken;
+  const assertSafe = deps.assertSafeApiBaseFn ?? assertSafeApiBase;
+  const nodeVersion = deps.nodeVersion ?? process.version;
+  const json = deps.json ?? false;
+  const checks = [];
+  const major = parseNodeMajor(nodeVersion);
+  const nodeDisplay = nodeVersion.replace(/^v/, "v");
+  if (major !== null && major >= 22) {
+    checks.push({
+      id: "node",
+      label: "Node.js",
+      status: "pass",
+      detail: `${nodeDisplay} (>= 20.19; 22+ recommended)`
+    });
+  } else {
+    checks.push({
+      id: "node",
+      label: "Node.js",
+      status: "warn",
+      detail: `${nodeDisplay} runs this CLI. Node >= 22 recommended.`,
+      optional: true
+    });
+  }
+  let isRepo = false;
+  try {
+    const git = gitFactory({ baseDir: cwd });
+    isRepo = await git.checkIsRepo();
+  } catch {
+    isRepo = false;
+  }
+  if (isRepo) {
+    checks.push({
+      id: "git",
+      label: "Git repo",
+      status: "pass",
+      detail: cwd
+    });
+  } else {
+    checks.push({
+      id: "git",
+      label: "Git repo",
+      status: "fail",
+      detail: "not a git repository \u2014 run from a repo root"
+    });
+  }
+  const configPath = join4(cwd, ".tested.yaml");
+  const hasConfig = exists(configPath);
+  if (hasConfig) {
+    checks.push({
+      id: "config",
+      label: ".tested.yaml",
+      status: "pass",
+      detail: configPath
+    });
+  } else {
+    checks.push({
+      id: "config",
+      label: ".tested.yaml",
+      status: "fail",
+      detail: "missing \u2014 run: tested setup  (or tested init)"
+    });
+  }
+  let coverageRel = "coverage/coverage-final.json";
+  if (hasConfig) {
+    try {
+      const config = await loadConfigFn({ cwd });
+      coverageRel = config.coverage.path;
+    } catch {
+    }
+  }
+  const coverageAbs = resolve4(cwd, coverageRel);
+  if (isReadableFile(coverageAbs, exists)) {
+    checks.push({
+      id: "coverage",
+      label: "Coverage file",
+      status: "pass",
+      detail: coverageRel,
+      optional: true
+    });
+  } else {
+    checks.push({
+      id: "coverage",
+      label: "Coverage file",
+      status: "warn",
+      detail: `missing ${coverageRel} \u2014 run: tested run`,
+      optional: true
+    });
+  }
+  let originOwner = null;
+  let originName = null;
+  if (isRepo) {
+    try {
+      const git = gitFactory({ baseDir: cwd });
+      const url = (await git.raw(["remote", "get-url", "origin"])).trim();
+      if (url) {
+        const parsed = parseGitHubRemote(url);
+        if (parsed) {
+          originOwner = parsed.owner;
+          originName = parsed.name;
+        }
+        const safe = url.replace(/\/\/([^/@\s]+)@/g, "//***@");
+        checks.push({
+          id: "origin",
+          label: "origin remote",
+          status: "pass",
+          detail: safe
+        });
+      } else {
+        checks.push({
+          id: "origin",
+          label: "origin remote",
+          status: "fail",
+          detail: "origin remote URL is empty"
+        });
+      }
+    } catch {
+      checks.push({
+        id: "origin",
+        label: "origin remote",
+        status: "fail",
+        detail: "no origin remote \u2014 git remote add origin <url>"
+      });
+    }
+  } else {
+    checks.push({
+      id: "origin",
+      label: "origin remote",
+      status: "skip",
+      detail: "skipped (not a git repo)"
+    });
+  }
+  let tokenPresent = false;
+  let tokenSource = null;
+  try {
+    const token = resolveTokenFn({ env, isTTY: false, warn: () => {
+    } });
+    if (token) {
+      tokenPresent = true;
+      if (env.TESTED_TOKEN) tokenSource = "TESTED_TOKEN";
+      else if (env.TESTED_INGEST_TOKEN) tokenSource = "TESTED_INGEST_TOKEN";
+      else if (env.TESTED_TOKEN_FILE) tokenSource = "TESTED_TOKEN_FILE";
+      else tokenSource = "token";
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    checks.push({
+      id: "token",
+      label: "Ingest token",
+      status: "fail",
+      detail: message.replace(/["'].{8,}["']/g, '"\u2026"'),
+      optional: true
+    });
+    tokenPresent = false;
+    tokenSource = null;
+  }
+  if (!checks.some((c) => c.id === "token")) {
+    if (tokenPresent) {
+      checks.push({
+        id: "token",
+        label: "Ingest token",
+        status: "pass",
+        detail: `set via ${tokenSource} (value not shown)`,
+        optional: true
+      });
+    } else {
+      checks.push({
+        id: "token",
+        label: "Ingest token",
+        status: "warn",
+        detail: `not set. ${tokenMintGuidance({ owner: originOwner, name: originName }).join(". ")}`,
+        optional: true
+      });
+    }
+  }
+  const rawApi = env.TESTED_API_URL;
+  if (rawApi !== void 0 && rawApi !== "") {
+    try {
+      const normalized = assertSafe(rawApi);
+      checks.push({
+        id: "api_url",
+        label: "API URL",
+        status: "pass",
+        detail: normalized,
+        optional: true
+      });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      checks.push({
+        id: "api_url",
+        label: "API URL",
+        status: "fail",
+        detail: message,
+        optional: true
+      });
+    }
+  } else {
+    checks.push({
+      id: "api_url",
+      label: "API URL",
+      status: "pass",
+      detail: `default ${DEFAULT_API_BASE} (unset TESTED_API_URL)`,
+      optional: true
+    });
+  }
+  const testedBin = env.TESTED_BIN;
+  if (testedBin !== void 0 && testedBin !== "") {
+    const base = basename(testedBin);
+    const okName = TESTED_BIN_BASENAME_RE.test(base);
+    if (!okName) {
+      checks.push({
+        id: "tested_bin",
+        label: "TESTED_BIN",
+        status: "fail",
+        detail: `basename "${base}" must match /^tested(\\.js)?$/`,
+        optional: true
+      });
+    } else if (!isAbsolute2(testedBin)) {
+      checks.push({
+        id: "tested_bin",
+        label: "TESTED_BIN",
+        status: "warn",
+        detail: "relative path \u2014 prefer an absolute path to tested.js",
+        optional: true
+      });
+    } else {
+      checks.push({
+        id: "tested_bin",
+        label: "TESTED_BIN",
+        status: "pass",
+        detail: `basename ${base}`,
+        optional: true
+      });
+    }
+  } else {
+    checks.push({
+      id: "tested_bin",
+      label: "TESTED_BIN",
+      status: "skip",
+      detail: "unset (optional; used by MCP hosts)",
+      optional: true
+    });
+  }
+  const hardFailIds = /* @__PURE__ */ new Set(["git", "config", "origin"]);
+  const safetyFailIds = /* @__PURE__ */ new Set(["api_url", "tested_bin", "token"]);
+  const hasHardFail = checks.some(
+    (c) => c.status === "fail" && hardFailIds.has(c.id)
+  );
+  const hasSafetyFail = checks.some(
+    (c) => c.status === "fail" && safetyFailIds.has(c.id) && // token missing is warn; only real resolve errors are fail
+    !(c.id === "token" && /not set/i.test(c.detail))
+  );
+  const ok = !hasHardFail && !hasSafetyFail;
+  const exitCode = ok ? 0 : 1;
+  const summary = { checks, ok, exitCode };
+  if (json) {
+    return {
+      ...summary,
+      stdout: JSON.stringify(buildDoctorJson(summary), null, 2) + "\n",
+      stderr: ""
+    };
+  }
+  return {
+    ...summary,
+    stdout: formatDoctorHuman(summary),
+    stderr: ""
+  };
+}
+function registerDoctorCommand(program2) {
+  program2.command("doctor").description("Diagnose local environment for the tested.dev agent loop").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+    try {
+      const result = await runDoctor({
+        cwd: process.cwd(),
+        json: opts.json
+      });
+      if (result.stderr) process.stderr.write(result.stderr);
+      if (result.stdout) process.stdout.write(result.stdout);
+      process.exitCode = result.exitCode;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(formatCliError(message));
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/commands/setup.ts
+import pc3 from "picocolors";
+var PINNED_CLI = "@tested/cli";
+function buildCiSnippet() {
+  return [
+    "# .github/workflows/tested.yml",
+    "name: tested",
+    "on: [pull_request]",
+    "jobs:",
+    "  coverage:",
+    "    runs-on: ubuntu-latest",
+    "    steps:",
+    "      - uses: actions/checkout@v4",
+    "        with:",
+    "          fetch-depth: 0",
+    "      - uses: tested-hq/cli/action@main",
+    "        with:",
+    "          # pin ref for reproducible installs (do not use floating tags in prod)",
+    "          cli-ref: main",
+    "          push: true",
+    "          pr-number: ${{ github.event.pull_request.number }}",
+    "          token: ${{ secrets.TESTED_TOKEN }}"
+  ].join("\n");
+}
+function buildTokenInstructions() {
+  return [
+    "Ingest token (for tested push):",
+    `  Mint: ${INGEST_TOKEN_SETTINGS_URL_SHAPE}`,
+    `  Then set ${INGEST_TOKEN_ENV_NAMES.join(" / ")}`,
+    "  Never commit the token. Prefer env / file over --token (visible in ps)."
+  ].join("\n");
+}
+function buildInstallInstructions() {
+  return [
+    "Install CLI:",
+    `  pnpm add -D ${PINNED_CLI}`,
+    `  # or: npx ${PINNED_CLI}`,
+    "",
+    "  CI: uses: tested-hq/cli/action@main  (secrets.TESTED_TOKEN)",
+    "",
+    "  # monorepo / local path:",
+    "  pnpm install && pnpm build   # from a clone of tested-hq/cli"
+  ].join("\n");
+}
+function formatSetupHuman(opts) {
+  const lines = [];
+  lines.push(heading("tested.dev \u2014 setup"));
+  lines.push("");
+  if (opts.initRan && opts.initResult) {
+    lines.push(formatInitResultHuman(opts.initResult));
+    lines.push("");
+  } else if (!opts.initRan) {
+    lines.push(dim("  .tested.yaml already present \u2014 skipped init"));
+    lines.push("");
+  }
+  lines.push(opts.doctor.stdout.trimEnd());
+  lines.push("");
+  lines.push(heading("CI snippet"));
+  lines.push(pc3.dim(buildCiSnippet()));
+  lines.push("");
+  lines.push(heading("Token"));
+  for (const line of buildTokenInstructions().split("\n")) {
+    lines.push(dim(`  ${line}`));
+  }
+  lines.push("");
+  lines.push(heading("Install"));
+  for (const line of buildInstallInstructions().split("\n")) {
+    lines.push(dim(`  ${line}`));
+  }
+  lines.push("");
+  lines.push(
+    nextSteps([
+      "1. tested run",
+      "2. tested diff",
+      "3. tested check",
+      "4. tested push --pr <n>   (needs TESTED_TOKEN)"
+    ])
+  );
+  lines.push("");
+  lines.push(tip("re-check anytime: tested doctor"));
+  lines.push("");
+  return lines.join("\n");
+}
+async function runSetup(deps) {
+  const cwd = deps.cwd;
+  const env = deps.env ?? process.env;
+  const exists = deps.existsSyncFn ?? existsSync4;
+  const runInitFn = deps.runInitFn ?? runInit;
+  const runDoctorFn = deps.runDoctorFn ?? runDoctor;
+  const force = deps.force ?? false;
+  const hooks = deps.hooks ?? false;
+  const json = deps.json ?? false;
+  const configPath = join5(cwd, ".tested.yaml");
+  let initRan = false;
+  let initResult = null;
+  if (!exists(configPath) || force) {
+    initResult = await runInitFn({
+      cwd,
+      force: force || exists(configPath),
+      hooks
+    });
+    initRan = true;
+  }
+  const doctor = await runDoctorFn({
+    cwd,
+    env,
+    json: false
+    // always compute structured; re-encode below if needed
+  });
+  if (json) {
+    const payload = {
+      schemaVersion: 1,
+      initRan,
+      init: initResult,
+      doctor: {
+        ok: doctor.ok,
+        exitCode: doctor.exitCode,
+        checks: doctor.checks
+      },
+      ciSnippet: buildCiSnippet(),
+      tokenInstructions: buildTokenInstructions(),
+      install: buildInstallInstructions(),
+      pinnedCli: PINNED_CLI
+    };
+    return {
+      initRan,
+      initResult,
+      doctor,
+      exitCode: doctor.exitCode,
+      stdout: JSON.stringify(payload, null, 2) + "\n",
+      stderr: ""
+    };
+  }
+  const stdout = formatSetupHuman({ initRan, initResult, doctor });
+  return {
+    initRan,
+    initResult,
+    doctor,
+    exitCode: doctor.exitCode,
+    stdout,
+    stderr: ""
+  };
+}
+function registerSetupCommand(program2) {
+  program2.command("setup").description(
+    "First-run setup: init if needed, doctor, CI snippet, token instructions"
+  ).option("--force", "Re-run init and overwrite .tested.yaml", false).option("--hooks", "Install husky pre-push hook during init", false).option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+    try {
+      if (opts.hooks && !process.stdin.isTTY && !opts.force) {
+        process.stderr.write(
+          errorBlock(
+            "--hooks in a non-TTY environment requires --force to confirm",
+            ["Would install a git hook unattended."]
+          )
+        );
+        process.exitCode = 1;
+        return;
+      }
+      const result = await runSetup({
+        cwd: process.cwd(),
+        force: opts.force,
+        hooks: opts.hooks,
+        json: opts.json
+      });
+      if (result.stderr) process.stderr.write(result.stderr);
+      if (result.stdout) process.stdout.write(result.stdout);
+      process.exitCode = result.exitCode;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(formatCliError(message));
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/commands/run.ts
+import { existsSync as existsSync5 } from "fs";
+import { isAbsolute as isAbsolute3, resolve as resolve5, sep as sep2 } from "path";
+import { spawn } from "child_process";
+import "commander";
+function resolveRunCommand(opts) {
+  const runner = opts.runner ?? "vitest";
+  switch (runner) {
+    case "vitest":
+      return {
+        command: "npx",
+        args: [
+          "vitest",
+          "run",
+          "--coverage",
+          "--coverage.reportOnFailure",
+          ...opts.extraArgs
+        ]
+      };
+    case "jest":
+      return {
+        command: "npx",
+        args: ["jest", "--coverage", ...opts.extraArgs]
+      };
+    case "pytest":
+      return {
+        command: "python",
+        args: ["-m", "pytest", "--cov", ...opts.extraArgs]
+      };
+    default: {
+      const _exhaustive = runner;
+      void _exhaustive;
+      throw new Error(
+        `Unsupported runner: ${String(runner)}. Supported: vitest, jest, pytest`
+      );
+    }
+  }
+}
+function shouldEnforceSafeRun(opts) {
+  const env = opts?.env ?? process.env;
+  const safe = env.TESTED_SAFE_RUN;
+  if (safe === "1" || safe === "true") return true;
+  if (safe === "0" || safe === "false") {
+  }
+  const ci = env.CI;
+  if (ci === "1" || ci === "true") return true;
+  if (env.GITHUB_ACTIONS === "true" || env.GITLAB_CI === "true") return true;
+  const isTTY = opts?.isTTY ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  if (!isTTY) return true;
+  return false;
+}
+function configPathEscapesRoot(configPath, repoRoot) {
+  const root = resolve5(repoRoot);
+  const abs = isAbsolute3(configPath) ? resolve5(configPath) : resolve5(repoRoot, configPath);
+  const safeRoot = root.endsWith(sep2) ? root : root + sep2;
+  return !(abs === root || abs.startsWith(safeRoot));
+}
+function assertSafeRunArgs(extraArgs, repoRoot) {
+  for (let i = 0; i < extraArgs.length; i++) {
+    const a = extraArgs[i];
+    if (a === "--watch" || a === "--watchAll" || a === "-w" || a.startsWith("--watch=") || a.startsWith("--watchAll=")) {
+      throw new Error(
+        `unsafe run arg rejected in non-interactive/CI mode: ${a} (watch mode can hang pipelines; unset TESTED_SAFE_RUN only in interactive use)`
+      );
+    }
+    let configPath;
+    if (a === "--config" || a === "-c") {
+      configPath = extraArgs[i + 1];
+    } else if (a.startsWith("--config=")) {
+      configPath = a.slice("--config=".length);
+    }
+    if (configPath !== void 0) {
+      if (!configPath || configPath.startsWith("-")) {
+        throw new Error(
+          `unsafe run arg rejected: --config requires a path under the repository root`
+        );
+      }
+      if (configPathEscapesRoot(configPath, repoRoot)) {
+        throw new Error(
+          `unsafe run arg rejected: --config path escapes repository root: ${configPath}`
+        );
+      }
+    }
+  }
+}
+function registerRunCommand(program2) {
+  program2.command("run").description(
+    "Run the user's test suite with coverage enabled (runner read from .tested.yaml; defaults to vitest)"
+  ).allowUnknownOption(true).argument("[args...]", "Extra arguments forwarded to the runner").action(async (extraArgs) => {
+    const cwd = process.cwd();
+    try {
+      if (shouldEnforceSafeRun()) {
+        assertSafeRunArgs(extraArgs, cwd);
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(errorBlock(message));
+      process.exitCode = 1;
+      return;
+    }
+    const config = await loadConfig({ cwd });
+    const coveragePath = resolve5(cwd, config.coverage.path);
+    const { command, args } = resolveRunCommand({
+      runner: config.testRunner,
+      extraArgs
+    });
+    process.stderr.write(heading("tested.dev \u2014 running tests with coverage") + "\n");
+    process.stderr.write(dim(`${command} ${args.join(" ")}`) + "\n\n");
+    const child = spawn(command, args, { stdio: "inherit" });
+    child.on("exit", (code) => {
+      const exit = code ?? 1;
+      const coverageWritten = existsSync5(coveragePath);
+      if (exit === 0) {
+        process.stderr.write("\n");
+        process.stderr.write(tip("tested diff") + "\n");
+        process.stderr.write(tip("tested check") + "\n");
+      } else {
+        process.stderr.write("\n");
+        process.stderr.write(
+          dim(
+            coverageWritten ? `tests failed (exit ${exit}); coverage still written to ${config.coverage.path}` : `tests failed (exit ${exit}); no coverage file at ${config.coverage.path}`
+          ) + "\n"
+        );
+      }
+      process.exit(exit);
+    });
+  });
+}
+
+// src/commands/diff.ts
+import "commander";
+
+// src/output/human.ts
+function formatRange(r) {
+  return r.start === r.end ? `${r.start}` : `${r.start}-${r.end}`;
+}
+function formatRangeList(ranges, maxWidth = 56) {
+  if (ranges.length === 0) return "";
+  const parts = ranges.map(formatRange);
+  const lines = [];
+  let current = "";
+  for (const part of parts) {
+    if (!current) {
+      current = part;
+      continue;
+    }
+    if (current.length + 2 + part.length > maxWidth) {
+      lines.push(current);
+      current = part;
+    } else {
+      current += `, ${part}`;
+    }
+  }
+  if (current) lines.push(current);
+  return lines.join(",\n" + " ".repeat(13));
+}
+function formatDelta(delta) {
+  if (delta === null) return "";
+  const sign = delta > 0 ? "+" : "";
+  return dim(`  delta ${sign}${delta.toFixed(1)}%`);
+}
+function coloredPctCell(pct3, width = 6) {
+  const plain = `${pct3.toFixed(1)}%`;
+  const pad = Math.max(0, width - plain.length);
+  return colorPct(pct3) + " ".repeat(pad);
+}
+function formatMetricRow(label, pct3, covered, executable, emptyNote) {
+  const labelPad = label.padEnd(8);
+  if (executable === 0) {
+    const note = emptyNote ?? "no executable lines";
+    return `  ${labelPad}  ${dim("-".padEnd(6))}  ${dim(note)}`;
+  }
+  const pctStr = coloredPctCell(pct3);
+  const bar = metricBar(pct3);
+  const counts = dim(`${covered}/${executable}`);
+  return `  ${labelPad}  ${pctStr}  ${bar}  ${counts}`;
+}
+function formatHuman(out, opts = {}) {
+  const tips = opts.tips !== false;
+  const lines = [];
+  lines.push(heading("tested.dev \u2014 coverage report"));
+  lines.push(dim(`Base: ${out.base}  Head: ${out.head.slice(0, 7)}`));
+  lines.push("");
+  lines.push(
+    formatMetricRow(
+      "Patch",
+      out.patch.pct,
+      out.patch.covered,
+      out.patch.executable,
+      "no executable lines in patch"
+    )
+  );
+  const projectRow = formatMetricRow(
+    "Project",
+    out.project.pct,
+    out.project.covered,
+    out.project.executable
+  );
+  lines.push(projectRow + formatDelta(out.project.delta));
+  if (opts.thresholds) {
+    const patchPass = out.patch.pct >= opts.thresholds.patch;
+    const projectPass = out.project.pct >= opts.thresholds.project;
+    const patchOk = out.patch.executable === 0 ? true : patchPass;
+    const overall = patchOk && projectPass;
+    const details = [];
+    if (!patchOk) {
+      details.push(`patch ${out.patch.pct.toFixed(1)}% < ${opts.thresholds.patch}%`);
+    }
+    if (!projectPass) {
+      details.push(
+        `project ${out.project.pct.toFixed(1)}% < ${opts.thresholds.project}%`
+      );
+    }
+    const detail = details.length > 0 ? dim(`  ${details.join("; ")}`) : "";
+    lines.push(
+      `  ${"Gate".padEnd(8)}  ${overall ? badge("pass") : badge("fail")}${detail}`
+    );
+    if (!overall) {
+      lines.push("");
+      lines.push(
+        tip(
+          `tested check would FAIL (${details.join("; ")}). Diff exits 0; check is the gate.`
+        )
+      );
+    }
+  }
+  if (out.files.length > 0) {
+    lines.push("");
+    lines.push(heading("Files in diff:"));
+    const anyPatch = out.files.some((f) => f.patchCoverage !== null);
+    if (!anyPatch) {
+      lines.push(dim("  (project coverage \u2014 no executable lines in patch)"));
+    }
+    for (const f of out.files) {
+      const hasPatch = f.patchCoverage !== null;
+      const pctPart = hasPatch ? coloredPctCell(f.patchCoverage) : coloredPctCell(f.projectCoverage);
+      lines.push(`  ${pctPart}  ${f.path}`);
+      if (f.uncoveredRanges.length > 0) {
+        const ranges = formatRangeList(f.uncoveredRanges);
+        lines.push(dim(`             uncovered: ${ranges}`));
+      } else if (hasPatch) {
+        lines.push(dim("             fully covered in patch"));
+      }
+    }
+  }
+  if (out.ignored.length > 0) {
+    lines.push("");
+    lines.push(dim(`Ignored: ${out.ignored.length} patterns`));
+  }
+  if (tips) {
+    lines.push("");
+    if (!opts.thresholds) {
+      lines.push(tip("tested check   (enforce thresholds)"));
+    }
+    lines.push(tip("tested push --pr <n>   (share on tested.dev)"));
+  }
+  return lines.join("\n");
+}
+
+// src/commands/diff.ts
+function registerDiffCommand(program2) {
+  program2.command("diff").description("Compute patch + project coverage against a base ref").option("--base <ref>", "Git base ref to diff against", void 0).option("--with-base-coverage <path>", "Compare project coverage against a baseline JSON", void 0).option("--json", "Emit schema-v1 JSON instead of human text", false).action(async (opts) => {
+    try {
+      const cwd = process.cwd();
+      const config = await loadConfig({ cwd });
+      const output = await computeDiff({
+        cwd,
+        config,
+        ...opts.base !== void 0 ? { baseRef: opts.base } : {},
+        ...opts.withBaseCoverage !== void 0 ? { withBaseCoverage: opts.withBaseCoverage } : {}
+      });
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(output, null, 2) + "\n");
+      } else {
+        process.stdout.write(
+          formatHuman(output, {
+            ...config.thresholds ? { thresholds: config.thresholds } : {},
+            tips: true
+          }) + "\n"
+        );
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(formatCliError(message));
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/commands/check.ts
+import "commander";
+function formatMetricLine(label, pct3, threshold, pass) {
+  const pctStr = pct3.toFixed(1);
+  const status = pass ? badge("pass") : badge("fail");
+  return `  ${label.padEnd(8)}  ${pctStr}%  (threshold ${threshold})  ${status}`;
+}
+function runCheck(input) {
+  const { config, diff, json } = input;
+  if (!config.thresholds) {
+    return {
+      skipped: true,
+      patchPass: true,
+      projectPass: true,
+      overall: "pass",
+      stdout: "",
+      stderr: `${dim("tested.dev \u2014 coverage gate")}  ${badge("info")}
+
+${dim("  no thresholds in .tested.yaml \u2014 gate skipped")}
+${tip("add thresholds.patch / thresholds.project to enforce")}
+`,
+      exitCode: 0
+    };
+  }
+  const patchPct = diff.patch.pct;
+  const projectPct = diff.project.pct;
+  const patchThreshold = config.thresholds.patch;
+  const projectThreshold = config.thresholds.project;
+  const patchSkipped = diff.patch.executable === 0;
+  const patchPass = patchSkipped ? true : patchPct >= patchThreshold;
+  const projectPass = projectPct >= projectThreshold;
+  const overall = patchPass && projectPass ? "pass" : "fail";
+  const exitCode = overall === "pass" ? 0 : 1;
+  if (json) {
+    const payload = {
+      patch: {
+        pct: patchPct,
+        threshold: patchThreshold,
+        pass: patchPass,
+        ...patchSkipped ? { skipped: true } : {}
+      },
+      project: { pct: projectPct, threshold: projectThreshold, pass: projectPass },
+      overall
+    };
+    return {
+      skipped: false,
+      patchPass,
+      projectPass,
+      overall,
+      stdout: JSON.stringify(payload) + "\n",
+      stderr: "",
+      exitCode
+    };
+  }
+  const lines = [];
+  lines.push(
+    `${heading("tested.dev \u2014 coverage gate")}  ${overall === "pass" ? badge("pass") : badge("fail")}`
+  );
+  lines.push("");
+  if (patchSkipped) {
+    lines.push(
+      `  ${"Patch".padEnd(8)}  ${dim("-")}  ${dim("(no executable lines \u2014 skipped)")}  ${badge("info")}`
+    );
+  } else {
+    lines.push(formatMetricLine("Patch", patchPct, patchThreshold, patchPass));
+  }
+  lines.push(formatMetricLine("Project", projectPct, projectThreshold, projectPass));
+  if (overall === "fail") {
+    lines.push("");
+    lines.push(tip("add tests for uncovered ranges: tested diff"));
+  } else {
+    lines.push("");
+    lines.push(dim(patchSkipped ? "project thresholds met (patch skipped)" : "thresholds met"));
+  }
+  lines.push("");
+  return {
+    skipped: false,
+    patchPass,
+    projectPass,
+    overall,
+    stdout: lines.join("\n"),
+    stderr: "",
+    exitCode
+  };
+}
+function registerCheckCommand(program2) {
+  program2.command("check").description(
+    "Exit non-zero if patch or project coverage falls below configured thresholds."
+  ).option("--json", "Emit machine-readable JSON to stdout (exit code unchanged).", false).option("--base <ref>", "Git base ref to diff against", void 0).action(async (opts) => {
+    try {
+      const cwd = process.cwd();
+      const config = await loadConfig({ cwd });
+      if (!config.thresholds) {
+        const result2 = runCheck({
+          config,
+          // diff value is unused in the skip path; pass a stub.
+          diff: {
+            schemaVersion: 1,
+            base: "",
+            head: "",
+            patch: { executable: 0, covered: 0, pct: 0 },
+            project: { executable: 0, covered: 0, pct: 0, delta: null },
+            files: [],
+            ignored: []
+          },
+          json: opts.json
+        });
+        if (result2.stderr) process.stderr.write(result2.stderr);
+        if (result2.stdout) process.stdout.write(result2.stdout);
+        process.exitCode = result2.exitCode;
+        return;
+      }
+      const diff = await computeDiff({
+        cwd,
+        config,
+        ...opts.base !== void 0 ? { baseRef: opts.base } : {}
+      });
+      const result = runCheck({ config, diff, json: opts.json });
+      if (result.stderr) process.stderr.write(result.stderr);
+      if (result.stdout) process.stdout.write(result.stdout);
+      process.exitCode = result.exitCode;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(formatCliError(message));
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/commands/explain.ts
+import { readFile as readFile3 } from "fs/promises";
+import { resolve as resolve6 } from "path";
+import "commander";
+function parseLocation(input) {
+  const idx = input.lastIndexOf(":");
+  if (idx < 0) throw new Error(`expected <file>:<line>, got ${input}`);
+  const path = input.slice(0, idx);
+  const line = Number(input.slice(idx + 1));
+  if (!Number.isInteger(line) || line <= 0) {
+    throw new Error(`expected <file>:<line>, got ${input}`);
+  }
+  return { path, line };
+}
+function explainAt(file, line, sourceLines) {
+  const stmt = file.statements.find((s) => line >= s.startLine && line <= s.endLine);
+  const excerptStart = Math.max(1, line - 2);
+  const excerptEnd = Math.min(sourceLines.length, line + 2);
+  const excerpt = sourceLines.slice(excerptStart - 1, excerptEnd + 1).map((text, i) => `${excerptStart + i}  ${text}`).join("\n");
+  if (!stmt) {
+    return {
+      path: file.path,
+      line,
+      uncovered: false,
+      reason: `no executable statement on line ${line}`,
+      codeExcerpt: excerpt
+    };
+  }
+  if (stmt.hits === 0) {
+    return {
+      path: file.path,
+      line,
+      uncovered: true,
+      reason: `no test exercises line ${line}`,
+      codeExcerpt: excerpt
+    };
+  }
+  return {
+    path: file.path,
+    line,
+    uncovered: false,
+    reason: `hit ${stmt.hits} time${stmt.hits === 1 ? "" : "s"}`,
+    codeExcerpt: excerpt
+  };
+}
+function formatExplainHuman(result) {
+  const status = result.uncovered ? badge("fail") : badge("pass");
+  const statusLabel = result.uncovered ? "UNCOVERED" : "covered";
+  const lines = [];
+  lines.push(heading("tested.dev \u2014 explain"));
+  lines.push(`${result.path}:${result.line}  ${status}  ${statusLabel}`);
+  lines.push(dim(result.reason));
+  lines.push("");
+  lines.push(result.codeExcerpt);
+  return lines.join("\n");
+}
+function registerExplainCommand(program2) {
+  program2.command("explain").description("Explain coverage at <file>:<line>").argument("<location>", "Location in the form path/to/file.ts:42").option("--json", "Emit JSON instead of human text", false).action(async (location, opts) => {
+    try {
+      const cwd = process.cwd();
+      const { path: relPath, line } = parseLocation(location);
+      const config = await loadConfig({ cwd });
+      const ctx = await openRepo(cwd);
+      const coveragePath = resolve6(cwd, config.coverage.path);
+      assertWithinRoot(ctx.repoRoot, coveragePath);
+      const files = await parseIstanbul({ path: coveragePath, repoRoot: ctx.repoRoot });
+      const file = files.find((f) => f.path === relPath);
+      if (!file) {
+        process.stderr.write(`error: no coverage data for ${relPath}
+`);
+        process.exitCode = 2;
+        return;
+      }
+      const resolvedSource = resolve6(ctx.repoRoot, relPath);
+      assertWithinRoot(ctx.repoRoot, resolvedSource);
+      const source = await readFile3(resolvedSource, "utf8");
+      const sourceLines = source.split("\n");
+      const result = explainAt(file, line, sourceLines);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+      } else {
+        process.stdout.write(formatExplainHuman(result) + "\n");
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`error: ${message}
+`);
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/commands/ignores.ts
+import "commander";
+function formatIgnoresList(patterns, asJson) {
+  if (asJson) return JSON.stringify({ ignores: [...patterns] });
+  return patterns.join("\n");
+}
+function registerIgnoresCommand(program2) {
+  const cmd = program2.command("ignores").description("Inspect the canonical ignore list");
+  cmd.command("list").description("Print all ignore patterns (defaults + user)").option("--json", "Emit JSON", false).action(async (opts) => {
+    const config = await loadConfig({ cwd: process.cwd() });
+    process.stdout.write(formatIgnoresList(config.ignores, opts.json) + "\n");
+  });
+}
+
+// src/cli.ts
+function createProgram() {
+  const program2 = new Command10();
+  program2.name("tested").description(
+    [
+      "Coverage your agent can use.",
+      "",
+      "Agent loop:",
+      "  tested setup \u2192 tested run \u2192 tested diff \u2192 tested check \u2192 tested push --pr <n>"
+    ].join("\n")
+  ).version("0.1.0");
+  registerSetupCommand(program2);
+  registerDoctorCommand(program2);
+  registerInitCommand(program2);
+  registerRunCommand(program2);
+  registerDiffCommand(program2);
+  registerCheckCommand(program2);
+  registerPushCommand(program2);
+  registerExplainCommand(program2);
+  registerIgnoresCommand(program2);
+  return program2;
+}
+
+// bin/tested.ts
+var program = createProgram();
+await program.parseAsync(process.argv);