agent-roast 0.10.1 → 0.12.0

package/dist/{chunk-FFKEBW6D.js → chunk-AP5Y4CH6.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import path7 from "path";
+import path11 from "path";
 
 // src/git.ts
 import { spawn, spawnSync } from "child_process";
@@ -847,12 +847,12 @@ var VALID_DETECTORS = [
 // src/file-read.ts
 import * as fs from "fs";
 function readRegularFile(filename, limit) {
-  const stat = fs.lstatSync(filename);
-  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > limit) throw new Error(`Expected a regular file no larger than ${limit} bytes.`);
+  const stat3 = fs.lstatSync(filename);
+  if (!stat3.isFile() || stat3.isSymbolicLink() || stat3.size > limit) throw new Error(`Expected a regular file no larger than ${limit} bytes.`);
   const fd = fs.openSync(filename, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0) | (fs.constants.O_NONBLOCK || 0));
   try {
     const opened = fs.fstatSync(fd);
-    if (!opened.isFile() || opened.ino !== stat.ino || opened.dev !== stat.dev) throw new Error("File changed while opening.");
+    if (!opened.isFile() || opened.ino !== stat3.ino || opened.dev !== stat3.dev) throw new Error("File changed while opening.");
     const buffer = Buffer.alloc(limit + 1);
     let size = 0;
     while (size < buffer.length) {
@@ -1161,11 +1161,149 @@ function matchIgnorePath(filePath, ignorePatterns) {
 // src/metrics.ts
 var PYTHON_TEST_SKIP_PATTERNS = [
   { regex: /@pytest\s*\.\s*mark\s*\.\s*skip\b/, name: "skipped pytest (@pytest.mark.skip)" },
-  { regex: /(?<![\w.])pytest\s*\.\s*skip\s*\(/, name: "imperative pytest skip (pytest.skip)" },
-  { regex: /@unittest\s*\.\s*skip\s*\(/, name: "skipped unittest (@unittest.skip)" },
-  { regex: /\bself\s*\.\s*skipTest\s*\(/, name: "imperative unittest skip (self.skipTest)" }
+  { regex: /(?<![\w.])pytest\s*\.\s*skip\s*\(/, name: "imperative pytest skip (pytest.skip)", imperative: true },
+  { regex: /@unittest\s*\.\s*skip\s*\(/, name: "skipped unittest (@unittest.skip)", imperative: false },
+  { regex: /\bself\s*\.\s*skipTest\s*\(/, name: "imperative unittest skip (self.skipTest)", imperative: true }
+];
+function isGuardedSkip(lines) {
+  const indentOf = (text) => text.length - text.trimStart().length;
+  const mentionsCi = (raw) => /\bCI\b|\bGITHUB_ACTIONS\b/.test(raw);
+  const own = lines[lines.length - 1];
+  if (/^\s*(?:if|elif|else)\b.*:\s*\S/.test(own.code)) return !mentionsCi(own.raw);
+  let limit = indentOf(own.code);
+  for (let i = lines.length - 2; i >= 0 && lines.length - 1 - i <= 200; i--) {
+    if (lines[i].number !== lines[i + 1].number - 1) return false;
+    const { code, raw } = lines[i];
+    if (!code.trim() || indentOf(code) >= limit) continue;
+    const keyword = /^\s*(async\s+def|def|class|if|elif|else|try|except|finally|with|for|while)\b/.exec(code)?.[1];
+    if (keyword === "def" || keyword === "async def") return !/^\s*(?:async\s+)?def\s+test/.test(code);
+    if (keyword === "class") return false;
+    if (keyword === "if" || keyword === "elif" || keyword === "else" || keyword === "try" || keyword === "except" || keyword === "finally") return !mentionsCi(raw);
+    limit = indentOf(code) + (keyword ? 0 : 1);
+  }
+  return false;
+}
+var GO_GUARD = {
+  conditional: /^\s*(?:\}\s*)?(?:if|else|switch|case|select|for)\b/,
+  test: /^\s*func\s+(?:\([^)]*\)\s*)?(?:Test|Benchmark|Fuzz|Example)\w*\s*\(|\.Run\s*\(|\bfunc\s*\(\s*\w+\s+\*testing\.[TB]\s*\)/,
+  helper: /^\s*func\s+(?:\([^)]*\)\s*)?\w+\s*\(/
+};
+var RUBY_GUARD = {
+  modifier: /^\s*(?:skip|pending)\b.*\b(?:if|unless)\b/,
+  conditional: /^\s*(?:if|unless|else|elsif|case|when|begin|rescue|ensure|while|until)\b/,
+  test: /^\s*(?:it|specify|example|scenario|test|before|after|around)\b|^\s*def\s+test_/,
+  helper: /^\s*def\s+\w+/
+};
+var PHP_GUARD = {
+  modifier: /\b(?:or|and)\b.*markTest|(?:&&|\|\||\?).*markTest/,
+  conditional: /^\s*(?:\}\s*)?(?:if|else|elseif|switch|case|foreach|for|while|try|catch)\b/,
+  test: /^\s*(?:(?:public|protected|private|static)\s+)*function\s+test\w*\s*\(/,
+  helper: /^\s*(?:(?:public|protected|private|static)\s+)*function\s+\w+\s*\(/
+};
+var SWIFT_GUARD = {
+  conditional: /^\s*(?:\}\s*)?(?:if|else|guard|switch|case|for|while|do|catch)\b/,
+  test: /^\s*(?:@\w+\s+)*(?:(?:private|fileprivate|static)\s+)*func\s+test\w*\s*\(/,
+  helper: /^\s*(?:@\w+\s+)*(?:(?:private|fileprivate|static)\s+)*func\s+\w+\s*\(/
+};
+var LANGUAGE_LINE_RULES = [
+  { files: /_test\.go$/i, rules: [
+    { type: "test-skip", regex: /\b(?:t|tb|b)\s*\.\s*(?:Skip|Skipf|SkipNow)\s*\(|\.T\(\)\s*\.\s*(?:Skip|Skipf|SkipNow)\s*\(/, name: "skipped Go test (t.Skip)", guard: GO_GUARD },
+    { type: "trivial-assert", regex: /\b(?:assert|require)\s*\.\s*True\s*\(\s*\w+\s*,\s*true\s*\)/, name: "trivial assert (assert.True(t, true))" },
+    { type: "trivial-assert", regex: /\b(?:assert|require)\s*\.\s*False\s*\(\s*\w+\s*,\s*false\s*\)/, name: "trivial assert (assert.False(t, false))" },
+    { type: "trivial-assert", regex: /\b(?:assert|require)\s*\.\s*Equal\s*\(\s*\w+\s*,\s*(\d+|true|false|nil)\s*,\s*\1\s*\)/, name: "trivial assert (assert.Equal(t, 1, 1))" }
+  ] },
+  { files: /\.rs$/i, rules: [
+    { type: "test-skip", regex: /^\s*#\[\s*ignore\b/, name: "ignored Rust test (#[ignore])" },
+    { type: "trivial-assert", regex: /(?<![\w!])assert!\s*\(\s*true\s*\)/, name: "trivial assert (assert!(true))" },
+    { type: "trivial-assert", regex: /(?<![\w!])assert_eq!\s*\(\s*(\d+|true|false)\s*,\s*\1\s*\)/, name: "trivial assert (assert_eq!(1, 1))" }
+  ] },
+  { files: /\.(?:java|kt)$/i, rules: [
+    { type: "test-skip", regex: /(?:^|\s)@(?:Ignore|Disabled)\b/, name: "ignored JUnit test (@Ignore / @Disabled)" },
+    { type: "test-skip", regex: /@Test\s*\([^)]*\benabled\s*=\s*false\b/, name: "disabled TestNG test (enabled = false)" },
+    { type: "trivial-assert", regex: /\bassertTrue\s*\(\s*true\s*\)/, name: "trivial assert (assertTrue(true))" },
+    { type: "trivial-assert", regex: /\bassertFalse\s*\(\s*false\s*\)/, name: "trivial assert (assertFalse(false))" },
+    { type: "trivial-assert", regex: /\bassertEquals\s*\(\s*(\d+|true|false|null)\s*,\s*\1\s*\)/, name: "trivial assert (assertEquals(1, 1))" },
+    { type: "trivial-assert", regex: /\bassertThat\s*\(\s*true\s*\)\s*\.\s*isTrue\s*\(/, name: "trivial assert (assertThat(true).isTrue())" }
+  ] },
+  { files: /\.cs$/i, rules: [
+    { type: "test-skip", regex: /\[\s*Ignore\b|\b(?:Fact|Theory)\s*\(\s*(?:[^)]*,\s*)?Skip\s*=/, name: "ignored .NET test ([Ignore] / Skip =)" },
+    { type: "trivial-assert", regex: /\bAssert\s*\.\s*(?:True|IsTrue)\s*\(\s*true\s*\)/, name: "trivial assert (Assert.True(true))" },
+    { type: "trivial-assert", regex: /\bAssert\s*\.\s*(?:False|IsFalse)\s*\(\s*false\s*\)/, name: "trivial assert (Assert.False(false))" },
+    { type: "trivial-assert", regex: /\bAssert\s*\.\s*(?:AreEqual|Equal)\s*\(\s*(\d+|true|false|null)\s*,\s*\1\s*\)/, name: "trivial assert (Assert.Equal(1, 1))" }
+  ] },
+  // Ruby has no file-name convention as strict as the others, and `skip`/`pending` are ordinary method names: only spec and test files.
+  { files: /(?:^|\/)(?:spec|test)\/.*\.rb$|_(?:spec|test)\.rb$/i, rules: [
+    { type: "test-focus", regex: /^\s*(?:fit|fdescribe|fcontext|fspecify|fexample|fscenario)\b/, name: "focused RSpec example (fit / fdescribe)" },
+    { type: "test-focus", regex: /\b(?:it|describe|context|specify|scenario)\b[^\n]*[,(]\s*(?::focus\b|focus:\s*true\b)/, name: "focused RSpec example (focus: true)" },
+    { type: "test-skip", regex: /^\s*(?:xit|xdescribe|xcontext|xspecify|xexample|xscenario|xfeature)\b/, name: "disabled RSpec example (xit / xdescribe)" },
+    { type: "test-skip", regex: /\b(?:it|describe|context|specify|scenario)\b[^\n]*[,(]\s*(?::skip\b|skip:\s*(?:true\b|["']))/, name: "disabled RSpec example (skip: true)" },
+    { type: "test-skip", regex: /^\s*skip(?:\s|\(|$)/, name: "skipped Ruby test (skip)", guard: RUBY_GUARD },
+    { type: "test-skip", regex: /^\s*pending(?:\s+["'(]|\s*$)/, name: "pending Ruby example (pending)", guard: RUBY_GUARD },
+    { type: "trivial-assert", regex: /\bexpect\s*\(\s*(true|false|1|0|nil)\s*\)\s*\.\s*to\s+(?:eq|eql|be|equal)\b\s*\(?\s*\1\b/, name: "trivial expectation (expect(true).to eq(true))" },
+    { type: "trivial-assert", regex: /^\s*assert\s*\(?\s*true\s*\)?\s*$/, name: "trivial assert (assert true)" },
+    { type: "trivial-assert", regex: /\bassert_equal\s*\(?\s*(\d+|true|false|nil)\s*,\s*\1\s*\)?\s*$/, name: "trivial assert (assert_equal 1, 1)" }
+  ] },
+  { files: /\.php$/i, rules: [
+    { type: "test-skip", regex: /\$this\s*->\s*markTest(?:Skipped|Incomplete)\s*\(/, name: "skipped PHPUnit test (markTestSkipped)", guard: PHP_GUARD },
+    { type: "trivial-assert", regex: /\$this\s*->\s*assertTrue\s*\(\s*true\s*\)/, name: "trivial assert ($this->assertTrue(true))" },
+    { type: "trivial-assert", regex: /\$this\s*->\s*assertFalse\s*\(\s*false\s*\)/, name: "trivial assert ($this->assertFalse(false))" },
+    { type: "trivial-assert", regex: /\$this\s*->\s*assert(?:Equals|Same)\s*\(\s*(\d+|true|false|null)\s*,\s*\1\s*\)/, name: "trivial assert ($this->assertEquals(1, 1))" }
+  ] },
+  { files: /\.swift$/i, rules: [
+    { type: "test-skip", regex: /\bthrow\s+XCTSkip\s*\(/, name: "skipped XCTest (XCTSkip)", guard: SWIFT_GUARD },
+    { type: "test-skip", regex: /@(?:Test|Suite)\s*\([^)]*\.disabled\b/, name: "disabled Swift Testing test (.disabled)" },
+    { type: "trivial-assert", regex: /\bXCTAssertTrue\s*\(\s*true\s*\)/, name: "trivial assert (XCTAssertTrue(true))" },
+    { type: "trivial-assert", regex: /\bXCTAssertFalse\s*\(\s*false\s*\)/, name: "trivial assert (XCTAssertFalse(false))" },
+    { type: "trivial-assert", regex: /\bXCTAssertEqual\s*\(\s*(\d+|true|false|nil)\s*,\s*\1\s*\)/, name: "trivial assert (XCTAssertEqual(1, 1))" },
+    { type: "trivial-assert", regex: /#expect\s*\(\s*true\s*\)/, name: "trivial expectation (#expect(true))" }
+  ] }
 ];
+function isGuardedBlockSkip(lines, profile) {
+  const indentOf = (text) => text.length - text.trimStart().length;
+  const mentionsCi = (raw) => /\bCI\b|\bGITHUB_ACTIONS\b/.test(raw);
+  const own = lines[lines.length - 1];
+  if (profile.modifier?.test(own.code) || profile.conditional.test(own.code)) return !mentionsCi(own.raw);
+  let limit = indentOf(own.code);
+  for (let i = lines.length - 2; i >= 0 && lines.length - 1 - i <= 200; i--) {
+    if (lines[i].number !== lines[i + 1].number - 1) return false;
+    const { code, raw } = lines[i];
+    if (!code.trim() || indentOf(code) >= limit) continue;
+    if (profile.conditional.test(code)) return !mentionsCi(raw);
+    if (profile.test.test(code)) return false;
+    if (profile.helper.test(code)) return true;
+    limit = indentOf(code);
+  }
+  return false;
+}
 var JS_TEST_API = /(?<![\w$.])(?:(?:it|test|describe|suite)(?:\s*\.\s*(?:concurrent|serial|parallel|describe|failing|sequential))*\s*\.\s*(skip|todo|only)|((?:xit|xtest|xdescribe|fit|fdescribe)))\b((?:\s*\.\s*(?:each|failing|concurrent|serial|parallel|sequential))*)\s*(?=\(|\u0001)/g;
+function isConditionalSkip(source, raw, open2) {
+  if (source[open2] !== "(") return false;
+  const args = [];
+  let depth = 0;
+  let start = open2 + 1;
+  for (let i = start; i < source.length && i - open2 <= 2e3; i++) {
+    const char = source[i];
+    if (char === "\0") return false;
+    if ("([{".includes(char)) depth++;
+    else if (")]}".includes(char)) {
+      if (depth) {
+        depth--;
+        continue;
+      }
+      if (char !== ")") return false;
+      args.push(raw.slice(start, i).trim());
+      while (args.length && !args.at(-1)) args.pop();
+      const isString = (arg) => /^(['"`])[\s\S]*\1$/.test(arg);
+      if (!args.length || isString(args[0]) || args[0] === "true") return false;
+      if (args.length > 1 && !isString(args.at(-1))) return false;
+      return !/\bCI\b|\bisCI\b|GITHUB_ACTIONS/.test(args[0]);
+    } else if (char === "," && !depth) {
+      args.push(raw.slice(start, i).trim());
+      start = i + 1;
+    }
+  }
+  return false;
+}
 var JS_COMMENT_DIRECTIVE_PATTERNS = [
   { regex: /^\s*\/\/\s*@ts-ignore\b/, name: "compiler ignore (@ts-ignore)" },
   { regex: /^\s*\/\/\s*@ts-expect-error\b/, name: "compiler suppression (@ts-expect-error)" },
@@ -1222,7 +1360,8 @@ var CODE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".rb",
   ".cs",
   ".cpp",
-  ".c"
+  ".c",
+  ".swift"
 ]);
 var IGNORED_PATH_REGEX = /(?:^|\/)(?:fixtures|__fixtures__|testdata|mocks|test_data|__snapshots__|sample[s]?)\//i;
 var TEST_PATH_REGEX = /(?:^|\/)test_[^/]+\.py$|(?:^|\/)(?:tests?|__tests__|specs?)\/|[._-](?:test|spec)\.[a-z0-9]+$/i;
@@ -1258,6 +1397,7 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
     const directives = javascript ? JS_COMMENT_DIRECTIVE_PATTERNS : python ? PYTHON_COMMENT_DIRECTIVE_PATTERNS : [];
     const stubs = javascript ? JS_STUB_PATTERNS : python ? PYTHON_STUB_PATTERNS : rust ? RUST_STUB_PATTERNS : [];
     const firstFinding = infractions.length;
+    const languageRules = LANGUAGE_LINE_RULES.find((entry) => entry.files.test(file.path))?.rules;
     const masker = new SourceMasker(file.path);
     const maskedLines = [];
     for (const added of file.addedLines) {
@@ -1271,6 +1411,7 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
       if (python && !isComment) {
         for (const rule of PYTHON_TEST_SKIP_PATTERNS) {
           if (rule.regex.test(cleanedLine)) {
+            if (rule.imperative && isGuardedSkip(maskedLines)) break;
             infractions.push({
               type: "test-skip",
               file: file.path,
@@ -1284,6 +1425,14 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
           }
         }
       }
+      if (languageRules && !isComment) {
+        for (const rule of languageRules) {
+          if (!rule.regex.test(cleanedLine)) continue;
+          if (rule.guard && isGuardedBlockSkip(maskedLines, rule.guard)) break;
+          infractions.push({ type: rule.type, file: file.path, lineNumber: added.lineNumber, lineSnippet: rawLine.trim(), commitHash, commitDate, reason: rule.name });
+          break;
+        }
+      }
       let foundEscape = false;
       for (const rule of directives) {
         if (rule.regex.test(masked.comments)) {
@@ -1376,6 +1525,7 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
         if (match[2] && !isTestFile(file.path)) continue;
         if (/\bfunction$/.test(source.slice(Math.max(0, previous - 8), previous + 1))) continue;
         if (source[match.index + match[0].length] === "
" && !/\.\s*each\s*$/.test(match[3])) continue;
+        if (match[1] === "skip" && !match[3] && isConditionalSkip(source, raw, match.index + match[0].length)) continue;
         const focus = match[1] === "only" || match[2] === "fit" || match[2] === "fdescribe";
         infractions.push({
           type: focus ? "test-focus" : "test-skip",
@@ -1887,6 +2037,9 @@ var RULE_PRIORITY = {
   "expectation-rewritten": 1,
   "test-removed": 1
 };
+function isCheckRule(type) {
+  return RULE_PRIORITY[type] !== void 0;
+}
 function findingRank(type, failedRules) {
   return failedRules.includes(type) ? -1 : RULE_PRIORITY[type] ?? 2;
 }
@@ -2095,12 +2248,15 @@ function formatCheckMarkdown(result) {
   for (const skipped of result.skippedFiles) lines.push("", `Not scanned: ${markdownCell(skipped.file)} \u2014 ${markdownCell(skipped.reason)}`);
   return lines.join("\n");
 }
+var REVIEW_TITLES = { commits: "context review", index: "staged context review", worktree: "working tree review" };
+var reviewTitle = (result) => REVIEW_TITLES[result.source ?? "commits"];
+var reviewHead = (result) => result.headSha.slice(0, (result.source ?? "commits") === "commits" ? 7 : 18);
 function formatReviewTerminal(result) {
   const status = !result.complete ? "INCOMPLETE" : result.passed ? "PASSED" : "BLOCKED";
   const lines = [
     "",
-    pc.bold(`agent-roast \u2014 ${result.source === "index" ? "staged context review" : "context review"}: ${status}`),
-    `  ${result.mergeBaseSha.slice(0, 7)} \u2192 ${result.headSha.slice(0, result.source === "index" ? 18 : 7)} \xB7 policy: ${result.policySha === "EMPTY" ? "built-in first-commit defaults" : "base " + result.policySha.slice(0, 7)}`,
+    pc.bold(`agent-roast \u2014 ${reviewTitle(result)}: ${status}`),
+    `  ${result.mergeBaseSha.slice(0, 7)} \u2192 ${reviewHead(result)} \xB7 policy: ${result.policySha === "EMPTY" ? "built-in first-commit defaults" : "base " + result.policySha.slice(0, 7)}`,
     `  ${result.filesInspected} changed files compared \xB7 ${result.linesInspected} source lines inspected across both versions`,
     `  ${result.infractions.length} new \xB7 ${result.unchangedCount} existing \xB7 ${result.removedFindings.length} no longer detected`
   ];
@@ -2108,25 +2264,26 @@ function formatReviewTerminal(result) {
   if (result.policyChanges.length) lines.push("  Candidate policy changes were ignored; adopt them separately after review.");
   if (result.excludedFiles || result.unsupportedFiles) lines.push(`  ${result.excludedFiles} excluded \xB7 ${result.unsupportedFiles} unsupported/non-source changes`);
   for (const finding2 of mostImportantFirst(result.infractions, result.failedRules).slice(0, 20)) {
+    const failing = result.failedRules.includes(finding2.type);
     lines.push(
       "",
-      `  ${result.failedRules.includes(finding2.type) ? "FAIL" : "WARN"} [${finding2.type}] ${terminalText(finding2.file || "unknown")}:${finding2.lineNumber}`,
+      (failing ? pc.red : pc.yellow)(`  ${failing ? "FAIL" : "WARN"} [${finding2.type}] ${terminalText(finding2.file || "unknown")}:${finding2.lineNumber}`),
       `    ${terminalText(finding2.lineSnippet || finding2.reason)}`,
-      `    Next: ${terminalText(finding2.suggestion || "Review this occurrence.")}`
+      pc.dim(`    Next: ${terminalText(finding2.suggestion || "Review this occurrence.")}`)
     );
   }
   if (result.infractions.length > 20) lines.push(`  ${result.infractions.length - 20} more new findings; use --format json for all results.`);
   for (const skipped of result.skippedFiles) lines.push(`  NOT COMPARED ${terminalText(skipped.file)}: ${terminalText(skipped.reason)}`);
-  lines.push("", !result.complete ? "  INCOMPLETE: some changed source was not compared (exit 2)." : result.passed ? "  PASSED: no new blocking findings." : `  BLOCKED: ${result.failedRules.join(", ")}.`, "");
+  lines.push("", !result.complete ? pc.red("  INCOMPLETE: some changed source was not compared (exit 2).") : result.passed ? pc.green("  PASSED: no new blocking findings.") : pc.red(`  BLOCKED: ${result.failedRules.join(", ")}.`), "");
   if (!result.filesInspected) lines.push("  No supported changed source files compared.", "");
   return lines.join("\n");
 }
 function formatReviewMarkdown(result) {
   const status = !result.complete ? "INCOMPLETE" : result.passed ? "PASSED" : "BLOCKED";
   const lines = [
-    `## agent-roast ${result.source === "index" ? "staged context review" : "context review"}: ${status}`,
+    `## agent-roast ${reviewTitle(result)}: ${status}`,
     "",
-    `Compared ${result.filesInspected} changed files at \`${result.mergeBaseSha.slice(0, 7)}\` \u2192 \`${result.headSha.slice(0, result.source === "index" ? 18 : 7)}\`. Policy: \`${result.policySha === "EMPTY" ? "built-in first-commit defaults" : result.policySha.slice(0, 7)}\`.`,
+    `Compared ${result.filesInspected} changed files at \`${result.mergeBaseSha.slice(0, 7)}\` \u2192 \`${reviewHead(result)}\`. Policy: \`${result.policySha === "EMPTY" ? "built-in first-commit defaults" : result.policySha.slice(0, 7)}\`.`,
     "",
     `**${result.infractions.length} new** \xB7 ${result.unchangedCount} existing \xB7 ${result.removedFindings.length} no longer detected.`,
     ""
@@ -2206,9 +2363,9 @@ function createNewFile(root, relative2, content, mode = 420) {
   let directory = root;
   for (const segment of path3.dirname(inside).split(path3.sep).filter((part) => part !== ".")) {
     directory = path3.join(directory, segment);
-    let stat;
+    let stat3;
     try {
-      stat = fs4.lstatSync(directory);
+      stat3 = fs4.lstatSync(directory);
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
       try {
@@ -2216,9 +2373,9 @@ function createNewFile(root, relative2, content, mode = 420) {
       } catch (mkdirError) {
         if (mkdirError.code !== "EEXIST") throw mkdirError;
       }
-      stat = fs4.lstatSync(directory);
+      stat3 = fs4.lstatSync(directory);
     }
-    if (!stat.isDirectory() || stat.isSymbolicLink()) throw new ConfigError("Initialization refuses symlinked or non-directory parent paths.");
+    if (!stat3.isDirectory() || stat3.isSymbolicLink()) throw new ConfigError("Initialization refuses symlinked or non-directory parent paths.");
   }
   const temporary = path3.join(directory, `.agent-roast-init-${randomUUID3()}.tmp`);
   let fd;
@@ -2471,14 +2628,15 @@ import { constants as constants2 } from "fs";
 import path5 from "path";
 
 // src/snapshot.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash2, randomBytes } from "crypto";
 import * as fs5 from "fs/promises";
+import { constants as fsConstants } from "fs";
 import path4 from "path";
 import { spawn as spawn2 } from "child_process";
 function assertNotAborted(signal) {
   if (signal?.aborted) throw new ConfigError("Review cancelled; no complete result was produced.");
 }
-async function readGit(cwd, args, signal, limit = 8 * 1024 * 1024, indexFile) {
+async function readGit(cwd, args, signal, limit = 8 * 1024 * 1024, indexFile, input) {
   assertNotAborted(signal);
   const env = getHermeticGitEnv({ GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1", GIT_TERMINAL_PROMPT: "0" });
   if (indexFile) env.GIT_INDEX_FILE = indexFile;
@@ -2486,9 +2644,12 @@ async function readGit(cwd, args, signal, limit = 8 * 1024 * 1024, indexFile) {
     const child = spawn2("git", [...HERMETIC_GIT_FLAGS, ...args], {
       cwd,
       env,
-      stdio: ["ignore", "pipe", "pipe"],
+      stdio: ["pipe", "pipe", "pipe"],
       windowsHide: true
     });
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(input);
     const chunks = [];
     let bytes = 0;
     let stderr = "";
@@ -2530,6 +2691,20 @@ async function requireLocalObjects2(cwd, signal) {
     if (!(error instanceof GitError && error.code === 1)) throw error;
   }
 }
+async function unresolvedRefHint(cwd, ref, signal) {
+  try {
+    const count = async (...args) => Number((await readGit(cwd, ["rev-list", "--count", ...args, "HEAD"], signal, 64)).toString().trim());
+    if ((await readGit(cwd, ["rev-parse", "--is-shallow-repository"], signal, 64)).toString().trim() === "true") {
+      return `This clone is shallow (commits available: ${await count()}), so the ref may lie outside it. Run 'git fetch --unshallow' (in GitHub Actions: actions/checkout with fetch-depth: 0) or check the name.`;
+    }
+    const back = /^HEAD~(\d+)$/.exec(ref);
+    const depth = back ? await count("--first-parent") : 0;
+    if (back && Number(back[1]) >= depth) return `HEAD has only ${depth} commit${depth === 1 ? "" : "s"} on its main line${depth > 1 ? `; try HEAD~${depth - 1}` : ""}.`;
+  } catch {
+    assertNotAborted(signal);
+  }
+  return "Check that it names a commit, branch or tag of this repository.";
+}
 async function reviewRefs(cwd, base, head, signal) {
   const resolve2 = async (ref) => {
     if (!ref.trim()) throw new ConfigError("Review refs must not be empty.");
@@ -2537,7 +2712,7 @@ async function reviewRefs(cwd, base, head, signal) {
       return (await readGit(cwd, ["rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`], signal, 1024)).toString().trim();
     } catch (error) {
       assertNotAborted(signal);
-      throw new ConfigError(`Cannot resolve review ref '${ref}'. Use valid commits and fetch complete history (actions/checkout fetch-depth: 0). ${error instanceof Error ? error.message : String(error)}`);
+      throw new ConfigError(`Cannot resolve review ref '${ref}'. ${await unresolvedRefHint(cwd, ref, signal)} ${error instanceof Error ? error.message : String(error)}`);
     }
   };
   await requireLocalObjects2(cwd, signal);
@@ -2594,35 +2769,36 @@ async function reviewPolicy(cwd, baseSha, signal) {
   }
   return { config: configFromText("{}", "default review policy"), filename: null };
 }
+async function resolveHead(cwd, signal) {
+  try {
+    return (await readGit(cwd, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"], signal, 1024)).toString().trim();
+  } catch (error) {
+    if (!(error instanceof GitError && error.code === 1)) throw error;
+    const ref = (await readGit(cwd, ["symbolic-ref", "--quiet", "HEAD"], signal, 1024)).toString().trim();
+    try {
+      await readGit(cwd, ["show-ref", "--verify", "--quiet", ref], signal, 1024);
+    } catch (missing) {
+      if (missing instanceof GitError && missing.code === 1) return "EMPTY";
+      throw missing;
+    }
+    throw new ConfigError("HEAD exists but cannot be resolved to a commit.");
+  }
+}
 async function stagedSnapshot(cwd, signal) {
   await requireLocalObjects2(cwd, signal);
   let indexFile;
   if (process.env.GIT_INDEX_FILE) {
-    const gitDirectory = await fs5.realpath(gitOutputPath((await readGit(cwd, ["rev-parse", "--absolute-git-dir"], signal, 8192)).toString()));
+    const gitDirectory2 = await fs5.realpath(gitOutputPath((await readGit(cwd, ["rev-parse", "--absolute-git-dir"], signal, 8192)).toString()));
     const requested = path4.resolve(cwd, process.env.GIT_INDEX_FILE);
-    const stat = await fs5.lstat(requested);
+    const stat3 = await fs5.lstat(requested);
     const resolved = await fs5.realpath(requested);
-    const relative2 = path4.relative(gitDirectory, resolved);
-    if (!stat.isFile() || stat.isSymbolicLink() || !relative2 || relative2 === ".." || relative2.startsWith(".." + path4.sep) || path4.isAbsolute(relative2)) {
+    const relative2 = path4.relative(gitDirectory2, resolved);
+    if (!stat3.isFile() || stat3.isSymbolicLink() || !relative2 || relative2 === ".." || relative2.startsWith(".." + path4.sep) || path4.isAbsolute(relative2)) {
       throw new ConfigError("GIT_INDEX_FILE must be a regular candidate index inside this repository's Git directory; refusing to review another index.");
     }
     indexFile = resolved;
   }
-  const head = async () => {
-    try {
-      return (await readGit(cwd, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"], signal, 1024)).toString().trim();
-    } catch (error) {
-      if (!(error instanceof GitError && error.code === 1)) throw error;
-      const ref = (await readGit(cwd, ["symbolic-ref", "--quiet", "HEAD"], signal, 1024)).toString().trim();
-      try {
-        await readGit(cwd, ["show-ref", "--verify", "--quiet", ref], signal, 1024);
-      } catch (missing) {
-        if (missing instanceof GitError && missing.code === 1) return "EMPTY";
-        throw missing;
-      }
-      throw new ConfigError("HEAD exists but cannot be resolved to a commit.");
-    }
-  };
+  const head = () => resolveHead(cwd, signal);
   const baseSha = await head();
   const inventory = () => readGit(cwd, [
     "diff",
@@ -2659,6 +2835,99 @@ async function stagedSnapshot(cwd, signal) {
     }
   };
 }
+var MAX_WORKTREE_FILE = 2 * 1024 * 1024;
+var outside = (relative2) => !relative2 || relative2 === ".." || relative2.startsWith(".." + path4.sep) || path4.isAbsolute(relative2);
+async function worktreeSnapshot(cwd, signal) {
+  await requireLocalObjects2(cwd, signal);
+  const text = async (...args) => gitOutputPath((await readGit(cwd, args, signal, 8192)).toString());
+  const [root, gitDirectory2, indexPath, baseSha] = await Promise.all([
+    text("rev-parse", "--show-toplevel").then((file) => fs5.realpath(file)),
+    text("rev-parse", "--absolute-git-dir").then((file) => fs5.realpath(file)),
+    text("rev-parse", "--git-path", "index"),
+    resolveHead(cwd, signal)
+  ]);
+  const realIndex = path4.resolve(cwd, indexPath);
+  const indexFile = path4.join(gitDirectory2, `agent-roast-${process.pid}-${randomBytes(6).toString("hex")}.index`);
+  const dispose = async () => {
+    await Promise.all([indexFile, indexFile + ".lock"].map((file) => fs5.rm(file, { force: true })));
+  };
+  try {
+    let restoreIndexTime = async () => {
+    };
+    try {
+      const original = await fs5.stat(realIndex);
+      await fs5.copyFile(realIndex, indexFile, fsConstants.COPYFILE_EXCL);
+      const seconds = Math.floor(original.mtimeMs) / 1e3;
+      restoreIndexTime = () => fs5.utimes(indexFile, seconds, seconds);
+      await restoreIndexTime();
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    const conflicts = await readGit(root, ["ls-files", "--unmerged", "-z", "--full-name"], signal, 8 * 1024 * 1024, indexFile);
+    if (conflicts.length) throw new ConfigError("Resolve unmerged index entries before reviewing the working tree.");
+    await readGit(root, ["update-index", "-q", "--refresh"], signal, 1024 * 1024, indexFile);
+    await restoreIndexTime();
+    await readGit(root, ["add", "--intent-to-add", "--", "."], signal, 1024 * 1024, indexFile);
+    await restoreIndexTime();
+    const tree = baseSha === "EMPTY" ? (await readGit(root, ["hash-object", "-t", "tree", "--stdin"], signal, 256, void 0, Buffer.alloc(0))).toString().trim() : baseSha;
+    const inventory = () => readGit(root, [
+      "diff-index",
+      "--raw",
+      "-z",
+      "--no-abbrev",
+      "--no-ext-diff",
+      "--no-textconv",
+      "--ignore-submodules=none",
+      "--find-renames=50%",
+      "-l1000",
+      "--end-of-options",
+      tree,
+      "--"
+    ], signal, 8 * 1024 * 1024, indexFile);
+    const pinned = await inventory();
+    const changes = parseTreeChanges(pinned);
+    const headSha = "WORKTREE:" + createHash2("sha256").update(baseSha).update(pinned).digest("hex");
+    const stamps = /* @__PURE__ */ new Map();
+    const stamp = (stat3) => `${stat3.size}:${stat3.mtimeMs}:${stat3.ino}`;
+    return {
+      baseSha,
+      headSha,
+      mergeBaseSha: baseSha,
+      changes,
+      readWorktree: async (relative2) => {
+        const filename = path4.resolve(root, relative2);
+        if (outside(path4.relative(root, filename))) throw new ConfigError("A changed path escapes the repository.");
+        let stat3;
+        try {
+          stat3 = await fs5.lstat(filename);
+        } catch (error) {
+          if (error.code === "ENOENT") throw new ConfigError("A changed file disappeared during the review; rerun it.");
+          throw error;
+        }
+        if (!stat3.isFile()) throw new ConfigError("Changed source is a symlink or special file; comparison is incomplete.");
+        if (stat3.size > MAX_WORKTREE_FILE) throw new ConfigError(`Source file exceeds the ${MAX_WORKTREE_FILE} byte limit.`);
+        if (outside(path4.relative(root, await fs5.realpath(filename)))) throw new ConfigError("A changed file resolves outside the repository.");
+        const content = readRegularFile(filename, MAX_WORKTREE_FILE);
+        stamps.set(filename, stamp(stat3));
+        return content;
+      },
+      verify: async () => {
+        assertNotAborted(signal);
+        if (await resolveHead(cwd, signal) !== baseSha || !(await inventory()).equals(pinned)) {
+          throw new ConfigError("HEAD or the working tree changed during review; rerun it. No complete result was produced.");
+        }
+        for (const [filename, before] of stamps) {
+          const now = await fs5.lstat(filename).catch(() => null);
+          if (!now || stamp(now) !== before) throw new ConfigError("A changed file was modified during review; rerun it. No complete result was produced.");
+        }
+      },
+      dispose
+    };
+  } catch (error) {
+    await dispose();
+    throw error;
+  }
+}
 
 // src/check.ts
 var MAX_FILE_BYTES = 2 * 1024 * 1024;
@@ -2677,21 +2946,21 @@ function insideRoot(root, filename) {
 async function readSource(root, file, signal) {
   const filename = path5.resolve(root, file);
   if (!insideRoot(root, filename)) throw new Error("File escapes the repository.");
-  let stat;
+  let stat3;
   try {
-    stat = await fs6.lstat(filename);
+    stat3 = await fs6.lstat(filename);
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
   }
-  if (!stat.isFile() || stat.isSymbolicLink()) throw new Error("Symlinks and special files are not scanned.");
+  if (!stat3.isFile() || stat3.isSymbolicLink()) throw new Error("Symlinks and special files are not scanned.");
   const real = await fs6.realpath(filename);
   if (!insideRoot(root, real)) throw new Error("File resolves outside the repository.");
-  if (stat.size > MAX_FILE_BYTES) throw new Error("File exceeds the 2 MiB scan limit.");
+  if (stat3.size > MAX_FILE_BYTES) throw new Error("File exceeds the 2 MiB scan limit.");
   const handle = await fs6.open(filename, constants2.O_RDONLY | (constants2.O_NOFOLLOW || 0) | (constants2.O_NONBLOCK || 0));
   try {
     const opened = await handle.stat();
-    if (opened.ino !== stat.ino || opened.dev !== stat.dev || !opened.isFile()) throw new Error("File changed while opening.");
+    if (opened.ino !== stat3.ino || opened.dev !== stat3.dev || !opened.isFile()) throw new Error("File changed while opening.");
     const chunks = [];
     let size = 0;
     while (true) {
@@ -3226,28 +3495,38 @@ function compareFindings(before, after, newPath) {
   return { introduced, removed: [...old.values()].flatMap((bucket) => bucket.findings.slice(bucket.matched)), unchanged };
 }
 function reviewChanges(options) {
-  return compareSourceChanges({ ...options, staged: false });
+  return compareSourceChanges({ ...options, source: "commits" });
 }
 function reviewStagedChanges(options = {}) {
-  return compareSourceChanges({ ...options, staged: true });
+  return compareSourceChanges({ ...options, source: "index" });
+}
+function reviewWorktreeChanges(options = {}) {
+  return compareSourceChanges({ ...options, source: "worktree" });
 }
 async function compareSourceChanges(options) {
   assertNotAborted(options.signal);
   const cwd = path6.resolve(options.cwd || process.cwd());
-  const staged = options.staged ? await stagedSnapshot(cwd, options.signal) : void 0;
-  const refs = options.staged ? { baseSha: staged.baseSha, headSha: staged.headSha, mergeBaseSha: staged.mergeBaseSha } : await reviewRefs(cwd, options.base, options.head ?? "HEAD", options.signal);
+  const snapshot = options.source === "index" ? await stagedSnapshot(cwd, options.signal) : options.source === "worktree" ? await worktreeSnapshot(cwd, options.signal) : void 0;
+  try {
+    return await compareSnapshot(options, cwd, snapshot);
+  } finally {
+    await snapshot?.dispose?.();
+  }
+}
+async function compareSnapshot(options, cwd, snapshot) {
+  const refs = options.source === "commits" ? await reviewRefs(cwd, options.base, options.head ?? "HEAD", options.signal) : { baseSha: snapshot.baseSha, headSha: snapshot.headSha, mergeBaseSha: snapshot.mergeBaseSha };
   const policy = refs.baseSha === "EMPTY" ? { config: configFromText("{}", "default first-commit policy"), filename: null } : await reviewPolicy(cwd, refs.baseSha, options.signal);
   const format = options.format ?? "terminal";
   if (!["terminal", "json", "github", "markdown", "sarif"].includes(format)) throw new ConfigError("Unsupported review format.");
   const failOn = options.failOn ?? policy.config.failOn ?? ["test-skip", "trivial-assert", "test-focus", "assertion-weakened", "guard-weakened"];
   for (const rule of failOn) if (!VALID_DETECTORS.includes(rule)) throw new ConfigError(`Unknown review rule '${rule}'.`);
-  const changes = staged?.changes ?? await changedTreeFiles(cwd, refs.mergeBaseSha, refs.headSha, options.signal);
+  const changes = snapshot?.changes ?? await changedTreeFiles(cwd, refs.mergeBaseSha, refs.headSha, options.signal);
   const policyChanges = changes.filter((change) => CONFIG_FILENAMES.includes(change.oldPath) || CONFIG_FILENAMES.includes(change.newPath)).map((change) => change.newPath);
   const ignores = [...GENERATED_PATHS2, ...policy.config.ignorePaths || []];
   const result = {
-    schemaVersion: "1.1.0",
+    schemaVersion: "1.2.0",
     mode: "review",
-    source: staged ? "index" : "commits",
+    source: options.source,
     ...refs,
     policySha: refs.baseSha,
     policyFile: policy.filename,
@@ -3275,15 +3554,26 @@ async function compareSourceChanges(options) {
   const guardFindings = [];
   const ciCounts = [];
   let productionChanged = false;
-  const readText = async (mode, oid) => {
-    if (mode === "000000") return null;
-    if (!["100644", "100755"].includes(mode)) throw new ConfigError("Changed source is a symlink, submodule or unsupported Git mode; comparison is incomplete.");
-    const content = await readBlob(cwd, oid, options.signal);
+  const decode = (content) => {
     totalBytes += content.length;
     if (totalBytes > MAX_SCAN_BYTES2) throw new ConfigError("Review exceeds the 50 MiB source comparison limit.");
     if (content.includes(0)) throw new ConfigError("Binary content in a source comparison.");
     return new TextDecoder("utf-8", { fatal: true }).decode(content);
   };
+  const regularMode = (mode) => {
+    if (!["100644", "100755"].includes(mode)) throw new ConfigError("Changed source is a symlink, submodule or unsupported Git mode; comparison is incomplete.");
+  };
+  const readText = async (mode, oid) => {
+    if (mode === "000000") return null;
+    regularMode(mode);
+    return decode(await readBlob(cwd, oid, options.signal));
+  };
+  const readNew = async (change) => {
+    if (options.source !== "worktree") return readText(change.newMode, change.newOid);
+    if (change.newMode === "000000") return null;
+    regularMode(change.newMode);
+    return decode(await snapshot.readWorktree(change.newPath));
+  };
   const existingCounts = /* @__PURE__ */ new Map();
   for (const change of changes) {
     assertNotAborted(options.signal);
@@ -3297,7 +3587,7 @@ async function compareSourceChanges(options) {
       }
       try {
         const oldText = await readText(change.oldMode, change.oldOid);
-        const newText = await readText(change.newMode, change.newOid);
+        const newText = await readNew(change);
         guardFindings.push(...analyzeGuardFile(change.newPath, oldText, newText, refs.headSha));
         const ci = ciTestSteps(change.newPath, oldText, newText);
         if (ci) ciCounts.push(ci);
@@ -3328,7 +3618,7 @@ async function compareSourceChanges(options) {
         throw new ConfigError("Source moved to an unsupported extension; cannot claim its findings were resolved.");
       }
       const oldText = await readText(change.oldMode, change.oldOid);
-      const newText = await readText(change.newMode, change.newOid);
+      const newText = await readNew(change);
       const before = scan(oldText, change.oldPath, refs.mergeBaseSha);
       const after = scan(newText, change.newPath, refs.headSha);
       if (isTestFile(change.oldPath) || isTestFile(change.newPath)) tamperingFiles.push(analyzeTestFile(change.oldPath, change.newPath, oldText, newText, refs.headSha));
@@ -3355,7 +3645,7 @@ async function compareSourceChanges(options) {
     }
   }
   assertNotAborted(options.signal);
-  await staged?.verify();
+  await snapshot?.verify();
   result.complete = result.skippedFiles.length === 0;
   const rules = policy.config.rules ?? {};
   result.infractions.push(...[...resolveTampering(tamperingFiles, productionChanged), ...guardFindings, ...resolveCiTestSteps(ciCounts, refs.headSha)].filter((finding2) => rules[finding2.type] !== "off"));
@@ -3374,6 +3664,528 @@ async function compareSourceChanges(options) {
   return result;
 }
 
+// src/replay.ts
+import path7 from "path";
+var MAX_COMMITS = 1e3;
+var CONCURRENCY = 4;
+var LISTED_COMMITS = 15;
+var LISTED_PER_RULE = 2;
+var plural = (count, word) => `${count} ${word}${count === 1 ? "" : "s"}`;
+function clipEvidence(text, limit = 200) {
+  if (text.length <= limit) return text;
+  const arrow = text.indexOf(" \u2192 ");
+  const clip2 = (part, size) => part.length > size ? `${part.slice(0, size - 1)}\u2026` : part;
+  if (arrow < 0) return clip2(text, limit);
+  const side = Math.floor((limit - 3) / 2);
+  return `${clip2(text.slice(0, arrow), side)} \u2192 ${clip2(text.slice(arrow + 3), side)}`;
+}
+async function replayHistory(options = {}) {
+  assertNotAborted(options.signal);
+  const cwd = path7.resolve(options.cwd || process.cwd());
+  const last = options.last ?? 50;
+  if (!Number.isInteger(last) || last < 1 || last > MAX_COMMITS) throw new ConfigError(`Replay needs a whole number of commits between 1 and ${MAX_COMMITS}.`);
+  const format = options.format ?? "terminal";
+  if (format !== "terminal" && format !== "json") throw new ConfigError("Replay supports the terminal and json formats.");
+  let log;
+  try {
+    log = (await readGit(cwd, ["log", "--first-parent", "-n", String(last), "--format=%H%x1f%P%x1f%cI%x1f%s"], options.signal)).toString("utf8");
+  } catch (error) {
+    assertNotAborted(options.signal);
+    throw new ConfigError(`Cannot read the commit history. ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const entries = log.split("\n").filter(Boolean).map((line) => {
+    const [sha, parents, date, ...subject] = line.split("");
+    return { sha, base: parents.split(" ")[0], date, subject: subject.join(" ") };
+  });
+  if (!entries.length) throw new ConfigError("The repository has no commits to replay.");
+  const reviewable = entries.filter((entry) => entry.base);
+  const commits = new Array(reviewable.length);
+  let next = 0;
+  let done = 0;
+  await Promise.all(Array.from({ length: Math.min(CONCURRENCY, reviewable.length) }, async () => {
+    while (next < reviewable.length) {
+      const index = next++;
+      commits[index] = await replayCommit(cwd, reviewable[index], options.signal);
+      options.onProgress?.(++done, reviewable.length);
+    }
+  }));
+  if (commits.length && commits.every((commit) => commit.status === "failed")) throw new ConfigError(`No commit could be reviewed. ${commits[0].error}`);
+  const summary = { commits: commits.length, blocked: 0, warned: 0, noted: 0, clean: 0, untouched: 0, incomplete: 0, failed: 0, findingsByRule: {} };
+  for (const commit of commits) {
+    summary[commit.status]++;
+    for (const finding2 of commit.findings) summary.findingsByRule[finding2.type] = (summary.findingsByRule[finding2.type] ?? 0) + 1;
+  }
+  const shallow = (await readGit(cwd, ["rev-parse", "--is-shallow-repository"], options.signal, 64).catch(() => Buffer.from(""))).toString().trim() === "true";
+  const result = { schemaVersion: "1.0.0", mode: "replay", head: entries[0].sha, requested: last, commitsWithoutParent: entries.length - reviewable.length, shallow, summary, commits, exitCode: 0, output: "" };
+  result.output = format === "json" ? JSON.stringify({ ...result, output: void 0 }, null, 2) : formatReplayTerminal(result, options.allRules);
+  return result;
+}
+async function replayCommit(cwd, entry, signal) {
+  const identity = { sha: entry.sha, date: entry.date, subject: entry.subject };
+  try {
+    const review = await reviewChanges({ cwd, base: entry.base, head: entry.sha, format: "json", signal });
+    const status = review.failedRules.length ? "blocked" : !review.complete ? "incomplete" : review.infractions.some((finding2) => isCheckRule(finding2.type)) ? "warned" : review.infractions.length ? "noted" : review.filesInspected ? "clean" : "untouched";
+    return { ...identity, status, failedRules: review.failedRules, findings: mostImportantFirst(review.infractions, review.failedRules), filesInspected: review.filesInspected, skipped: review.skippedFiles };
+  } catch (error) {
+    assertNotAborted(signal);
+    return { ...identity, status: "failed", failedRules: [], findings: [], filesInspected: 0, skipped: [], error: error instanceof Error ? error.message : String(error) };
+  }
+}
+function formatReplayTerminal(result, allRules = false) {
+  const { summary } = result;
+  const lines = [
+    "",
+    `agent-roast \u2014 replay of the last ${plural(summary.commits, "commit")} (up to ${result.head.slice(0, 7)})`,
+    "  Each commit is reviewed on its own against its parent, as a pull-request check would have seen it."
+  ];
+  const shallowHint = result.shallow ? ["  This clone is shallow, so only the commits it holds were replayed. Run 'git fetch --unshallow' to replay more."] : [];
+  if (!summary.commits) return [...lines, "  There is no earlier commit to compare with, so nothing was reviewed.", ...shallowHint, ""].join("\n");
+  lines.push(...shallowHint);
+  lines.push(
+    `  ${plural(summary.commits - summary.untouched - summary.failed, "commit")} changed source, tests or CI config \xB7 ${summary.untouched} did not`,
+    `  Would have blocked: ${plural(summary.blocked, "commit")} \xB7 warnings on ${summary.warned} \xB7 line patterns only on ${summary.noted} \xB7 nothing to report on ${summary.clean}`
+  );
+  if (summary.incomplete + summary.failed) lines.push(`  Not reviewed in full: ${plural(summary.incomplete + summary.failed, "commit")}`);
+  const listed = result.commits.filter((commit) => commit.status === "blocked" || commit.status === "warned" || allRules && commit.status === "noted");
+  const ordered = [...listed.filter((commit) => commit.status === "blocked"), ...listed.filter((commit) => commit.status !== "blocked")];
+  for (const commit of ordered.slice(0, LISTED_COMMITS)) {
+    lines.push("", `  ${commit.status === "blocked" ? "BLOCK" : "WARN "} ${commit.sha.slice(0, 7)} ${commit.date.slice(0, 10)} ${terminalText(commit.subject).slice(0, 80)}`);
+    const shown = commit.findings.filter((finding2) => allRules || isCheckRule(finding2.type));
+    for (const rule of new Set(shown.map((finding2) => finding2.type))) {
+      const group = shown.filter((finding2) => finding2.type === rule);
+      for (const finding2 of group.slice(0, LISTED_PER_RULE)) {
+        lines.push(
+          `    ${commit.failedRules.includes(rule) ? "FAIL" : "WARN"} [${rule}] ${terminalText(finding2.file || "unknown")}:${finding2.lineNumber}`,
+          `      ${clipEvidence(terminalText(finding2.lineSnippet || finding2.reason))}`
+        );
+      }
+      if (group.length > LISTED_PER_RULE) lines.push(`    \u2026 and ${group.length - LISTED_PER_RULE} more [${rule}] in this commit`);
+    }
+  }
+  if (ordered.length > LISTED_COMMITS) lines.push("", `  \u2026 ${plural(ordered.length - LISTED_COMMITS, "more commit")} with findings; use --json for all of them.`);
+  if (!ordered.length) lines.push("", "  Nothing to report on these commits.");
+  if (!allRules) {
+    const hidden = result.commits.flatMap((commit) => commit.findings.filter((finding2) => !isCheckRule(finding2.type)));
+    if (hidden.length) {
+      const byRule = Object.entries(hidden.reduce((counts, finding2) => ({ ...counts, [finding2.type]: (counts[finding2.type] ?? 0) + 1 }), {})).sort((a, b) => b[1] - a[1]);
+      lines.push("", `  Line patterns not listed: ${plural(hidden.length, "finding")} (${byRule.slice(0, 3).map(([rule, count]) => `${rule} ${count}`).join(", ")}). Add --all-rules to list them.`);
+    }
+  }
+  for (const commit of result.commits.filter((commit2) => commit2.status === "incomplete" || commit2.status === "failed").slice(0, 5)) {
+    lines.push(`  Not reviewed in full: ${commit.sha.slice(0, 7)} ${terminalText(commit.subject).slice(0, 60)} \u2014 ${terminalText(commit.error ?? `${plural(commit.skipped.length, "changed file")} could not be compared`)}`);
+  }
+  lines.push(
+    "",
+    "  Findings are review candidates, not verdicts: `agent-roast explain <rule>` says what a rule means.",
+    "  To run this on every pull request: `agent-roast init --ci`.",
+    ""
+  );
+  return lines.join("\n");
+}
+
+// src/hook.ts
+import path8 from "path";
+import * as fs7 from "fs/promises";
+var HOOK_AGENTS = ["claude", "codex", "cursor"];
+var DEFAULT_TIMEOUT_MS = 25e3;
+var PAUSE_FILE = "agent-roast-hook-paused";
+var LISTED = 6;
+var LISTED_WARNINGS = 3;
+function detectAgent(input) {
+  if ("workspace_roots" in input || "cursor_version" in input || "conversation_id" in input) return "cursor";
+  if ("turn_id" in input) return "codex";
+  return "claude";
+}
+function inputCwd(agent, input, env) {
+  const roots = input.workspace_roots;
+  if (agent === "cursor" && Array.isArray(roots) && typeof roots[0] === "string") return roots[0];
+  if (typeof input.cwd === "string" && input.cwd) return input.cwd;
+  return env.CLAUDE_PROJECT_DIR || env.CURSOR_PROJECT_DIR || process.cwd();
+}
+function clip(text, limit) {
+  const flat = terminalText(text).replace(/\s+/g, " ").trim();
+  return flat.length > limit ? `${flat.slice(0, limit - 1)}\u2026` : flat;
+}
+function describe(finding2, index) {
+  const where = finding2.file ? `${terminalText(finding2.file)}${finding2.lineNumber ? `:${finding2.lineNumber}` : ""}` : "unknown location";
+  const evidence = clip(finding2.lineSnippet || finding2.reason, 220);
+  return [`${index}. ${where} [${finding2.type}]`, `   ${evidence}`];
+}
+function formatAgentFeedback(result) {
+  const ranked = mostImportantFirst(result.infractions, result.failedRules);
+  const blocking = ranked.filter((finding2) => result.failedRules.includes(finding2.type));
+  const notes = ranked.filter((finding2) => !result.failedRules.includes(finding2.type) && isCheckRule(finding2.type));
+  const lines = ["agent-roast: the uncommitted changes make the checks easier to pass instead of making the code correct.", ""];
+  blocking.slice(0, LISTED).forEach((finding2, index) => lines.push(...describe(finding2, index + 1)));
+  if (blocking.length > LISTED) lines.push(`   \u2026 and ${blocking.length - LISTED} more.`);
+  if (notes.length) {
+    lines.push("", "Also worth a second look (these do not block):");
+    notes.slice(0, LISTED_WARNINGS).forEach((finding2) => lines.push(`- ${describe(finding2, 0)[0].slice(3)}: ${clip(finding2.lineSnippet || finding2.reason, 120)}`));
+    if (notes.length > LISTED_WARNINGS) lines.push(`- \u2026 and ${notes.length - LISTED_WARNINGS} more.`);
+  }
+  lines.push(
+    "",
+    "Make the original checks pass by fixing the code. Do not skip, delete, loosen or silence tests, assertions, coverage gates, type checks or CI steps to get a green run.",
+    "If a change to a check is really intended, stop and ask the user to approve it explicitly rather than keeping it quietly."
+  );
+  return lines.join("\n");
+}
+function formatUserWarning(result) {
+  const blocking = result.infractions.filter((finding2) => result.failedRules.includes(finding2.type));
+  const first = blocking[0];
+  return `agent-roast: the agent finished with ${blocking.length} change${blocking.length === 1 ? "" : "s"} that weaken${blocking.length === 1 ? "s" : ""} checks (${result.failedRules.join(", ")})${first ? `, for example ${terminalText(first.file ?? "unknown")}:${first.lineNumber ?? "?"}` : ""}. Review them before you commit: npx agent-roast review --worktree`;
+}
+async function gitDirectory(cwd, signal) {
+  return fs7.realpath(gitOutputPath((await readGit(cwd, ["rev-parse", "--absolute-git-dir"], signal, 8192)).toString()));
+}
+async function hookPausedUntil(cwd, now = /* @__PURE__ */ new Date()) {
+  try {
+    const file = path8.join(await gitDirectory(cwd), PAUSE_FILE);
+    const until = new Date((await fs7.readFile(file, "utf8")).trim());
+    if (!Number.isNaN(until.getTime()) && until > now) return until;
+    await fs7.rm(file, { force: true });
+  } catch {
+  }
+  return null;
+}
+async function pauseHook(cwd, until) {
+  const file = path8.join(await gitDirectory(cwd), PAUSE_FILE);
+  await fs7.writeFile(file, until.toISOString() + "\n");
+  return file;
+}
+async function resumeHook(cwd) {
+  const file = path8.join(await gitDirectory(cwd), PAUSE_FILE);
+  const existed = await fs7.stat(file).then(() => true, () => false);
+  await fs7.rm(file, { force: true });
+  return existed;
+}
+function parseDuration(text) {
+  const match = /^(\d+)\s*([mhd])$/i.exec(text.trim());
+  if (!match || Number(match[1]) < 1) throw new ConfigError("Use a duration such as 30m, 2h or 1d.");
+  return Number(match[1]) * { m: 6e4, h: 36e5, d: 864e5 }[match[2].toLowerCase()];
+}
+var outcome = (action, stdout = "", stderr = "", result) => ({ action, stdout, stderr, exitCode: 0, result });
+async function runHook(rawInput, options = {}) {
+  const env = options.env ?? process.env;
+  let input = {};
+  try {
+    const parsed = rawInput.trim() ? JSON.parse(rawInput) : {};
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) input = parsed;
+  } catch {
+    return outcome("skip", "", "agent-roast hook: input was not JSON; nothing was checked.\n");
+  }
+  if (["off", "0", "false"].includes((env.AGENT_ROAST_HOOK ?? "").toLowerCase())) return outcome("skip");
+  const agent = options.agent ?? detectAgent(input);
+  const event = String(input.hook_event_name ?? "Stop");
+  if (event.toLowerCase() !== "stop") return outcome("skip");
+  if (agent === "cursor" && typeof input.status === "string" && input.status !== "completed") return outcome("skip");
+  const cwd = options.cwd ?? inputCwd(agent, input, env);
+  if (await hookPausedUntil(cwd, options.now)) return outcome("skip");
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  let result;
+  try {
+    result = await reviewWorktreeChanges({ cwd, signal: controller.signal });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return outcome("skip", "", `agent-roast hook: could not check the working tree (${clip(reason, 200)}); the agent was allowed to finish.
+`);
+  } finally {
+    clearTimeout(timer);
+  }
+  if (!result.failedRules.length) return outcome("pass", agent === "cursor" ? "{}\n" : "", "", result);
+  const alreadyAsked = input.stop_hook_active === true || typeof input.loop_count === "number" && input.loop_count > 0;
+  if (alreadyAsked) {
+    return outcome("warn", agent === "cursor" ? "{}\n" : JSON.stringify({ systemMessage: formatUserWarning(result) }) + "\n", "", result);
+  }
+  const message = formatAgentFeedback(result);
+  return outcome("block", JSON.stringify(agent === "cursor" ? { followup_message: message } : { decision: "block", reason: message }) + "\n", "", result);
+}
+
+// src/hook-install.ts
+import * as fs8 from "fs";
+import os from "os";
+import path9 from "path";
+import { randomUUID as randomUUID4 } from "crypto";
+import { createRequire as createRequire2 } from "module";
+import { spawnSync as spawnSync3 } from "child_process";
+var AGENT_LABELS = { claude: "Claude Code", codex: "Codex", cursor: "Cursor" };
+var TIMEOUT_SECONDS = 60;
+function packageVersion() {
+  const require3 = createRequire2(import.meta.url);
+  return String(require3("../package.json").version);
+}
+function hookCommand(agent, command = `npx --yes agent-roast@${packageVersion()}`) {
+  return `${command.trim()} hook run --agent ${agent}`;
+}
+var isOurs = (command) => typeof command === "string" && /\bagent-roast\b.*\bhook\s+run\b/.test(command);
+function repositoryRoot(cwd) {
+  const absolute = fs8.realpathSync(path9.resolve(cwd));
+  const run = spawnSync3("git", [...HERMETIC_GIT_FLAGS, "rev-parse", "--show-toplevel"], {
+    cwd: absolute,
+    env: { ...getHermeticGitEnv(), LC_ALL: "C" },
+    encoding: "utf8",
+    timeout: 3e4,
+    maxBuffer: 8192,
+    windowsHide: true
+  });
+  return run.status === 0 ? fs8.realpathSync(gitOutputPath(run.stdout)) : absolute;
+}
+function hookConfigPath(agent, scope, root, home, env = process.env) {
+  if (scope === "local" && agent !== "claude") throw new ConfigError(`${AGENT_LABELS[agent]} has no hook file that stays out of the repository; use the project file or --global.`);
+  const claude = path9.join(scope === "global" ? home : root, ".claude");
+  if (agent === "claude") return path9.join(claude, scope === "local" ? "settings.local.json" : "settings.json");
+  if (agent === "cursor") return path9.join(scope === "global" ? home : root, ".cursor", "hooks.json");
+  return path9.join(scope === "global" ? env.CODEX_HOME || path9.join(home, ".codex") : path9.join(root, ".codex"), "hooks.json");
+}
+function readJsonFile(file) {
+  let raw;
+  let mode;
+  try {
+    mode = fs8.statSync(file).mode & 511;
+    raw = fs8.readFileSync(file, "utf8").replace(/^/, "");
+  } catch (error) {
+    if (error.code === "ENOENT") return { data: {}, indent: 2, mode: void 0, existed: false };
+    throw error;
+  }
+  if (!raw.trim()) return { data: {}, indent: 2, mode, existed: true };
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch {
+    throw new ConfigError(`${file} is not valid JSON, so it was left alone. Fix it, or add the hook by hand (see docs/integrations.md).`);
+  }
+  if (!data || typeof data !== "object" || Array.isArray(data)) throw new ConfigError(`${file} must contain a JSON object, so it was left alone.`);
+  const indent = /^([ \t]+)"/m.exec(raw)?.[1] ?? 2;
+  return { data, indent, mode, existed: true };
+}
+function writeJsonFile(link, json) {
+  const file = json.existed ? fs8.realpathSync(link) : link;
+  fs8.mkdirSync(path9.dirname(file), { recursive: true });
+  const temporary = path9.join(path9.dirname(file), `.agent-roast-${randomUUID4()}.tmp`);
+  try {
+    fs8.writeFileSync(temporary, JSON.stringify(json.data, null, json.indent) + "\n", { mode: json.mode ?? 420 });
+    fs8.renameSync(temporary, file);
+  } finally {
+    fs8.rmSync(temporary, { force: true });
+  }
+}
+var asArray = (value) => Array.isArray(value) ? value : [];
+function addStopHook(agent, data, command) {
+  const before = JSON.stringify(data);
+  data.hooks = data.hooks && typeof data.hooks === "object" && !Array.isArray(data.hooks) ? data.hooks : {};
+  if (agent === "cursor") {
+    data.version ??= 1;
+    const handlers = asArray(data.hooks.stop);
+    const ours = handlers.find((handler) => isOurs(handler?.command));
+    if (ours) ours.command = command;
+    else handlers.push({ command, timeout: TIMEOUT_SECONDS, loop_limit: 2 });
+    data.hooks.stop = handlers;
+  } else {
+    const groups = asArray(data.hooks.Stop);
+    const ours = groups.flatMap((group) => asArray(group?.hooks)).find((handler) => isOurs(handler?.command));
+    if (ours) ours.command = command;
+    else groups.push({ hooks: [{ type: "command", command, timeout: TIMEOUT_SECONDS }] });
+    data.hooks.Stop = groups;
+  }
+  return JSON.stringify(data) !== before;
+}
+function removeStopHook(agent, data) {
+  const before = JSON.stringify(data);
+  const hooks = data.hooks;
+  if (!hooks || typeof hooks !== "object") return false;
+  if (agent === "cursor") {
+    const kept = asArray(hooks.stop).filter((handler) => !isOurs(handler?.command));
+    if (kept.length) hooks.stop = kept;
+    else delete hooks.stop;
+  } else {
+    const groups = asArray(hooks.Stop).map((group) => ({ ...group, hooks: asArray(group?.hooks).filter((handler) => !isOurs(handler?.command)) }));
+    const kept = groups.filter((group) => group.hooks.length);
+    if (kept.length) hooks.Stop = kept;
+    else delete hooks.Stop;
+  }
+  if (!Object.keys(hooks).length) delete data.hooks;
+  return JSON.stringify(data) !== before;
+}
+function context(options) {
+  return { root: repositoryRoot(options.cwd ?? "."), scope: options.scope ?? "project", home: options.home ?? os.homedir(), env: options.env ?? process.env };
+}
+function installHooks(options) {
+  const { root, scope, home, env } = context(options);
+  return options.agents.map((agent) => {
+    const file = hookConfigPath(agent, scope, root, home, env);
+    const command = hookCommand(agent, options.command);
+    const json = readJsonFile(file);
+    const changed = addStopHook(agent, json.data, command);
+    if (changed && !options.dryRun) writeJsonFile(file, json);
+    return { agent, scope, file, command, action: !json.existed ? "created" : changed ? "updated" : "unchanged" };
+  });
+}
+function uninstallHooks(options) {
+  const { root, scope, home, env } = context(options);
+  return options.agents.map((agent) => {
+    const file = hookConfigPath(agent, scope, root, home, env);
+    const json = readJsonFile(file);
+    const removed = json.existed && removeStopHook(agent, json.data);
+    if (removed && !options.dryRun) writeJsonFile(file, json);
+    return { agent, scope, file, action: removed ? "removed" : "absent" };
+  });
+}
+function hookStatus(options) {
+  const { root, home, env } = context({ ...options, scope: "project" });
+  const rows = [];
+  for (const agent of ["claude", "codex", "cursor"]) {
+    for (const scope of ["project", "local", "global"]) {
+      if (scope === "local" && agent !== "claude") continue;
+      const file = hookConfigPath(agent, scope, root, home, env);
+      let command;
+      try {
+        const data = readJsonFile(file).data;
+        const handlers = agent === "cursor" ? asArray(data.hooks?.stop) : asArray(data.hooks?.Stop).flatMap((group) => asArray(group?.hooks));
+        command = handlers.map((handler) => handler?.command).find(isOurs);
+      } catch {
+      }
+      rows.push({ agent, scope, file, command, installed: Boolean(command), action: command ? "unchanged" : "absent" });
+    }
+  }
+  return rows;
+}
+var INSTRUCTIONS_START = "<!-- agent-roast:start -->";
+var INSTRUCTIONS_END = "<!-- agent-roast:end -->";
+var INSTRUCTIONS_BLOCK = `${INSTRUCTIONS_START}
+## Keep the checks honest
+
+When a test, type check, linter or CI step fails, fix the code. Do not make the build green by skipping or deleting tests,
+weakening assertions, lowering coverage thresholds, switching off \`strict\`, or letting a CI step fail. If you think a check
+is wrong, say so and ask before changing it. Before you finish, run \`npx agent-roast review --worktree\`: it lists uncommitted
+changes that weaken the checks.
+${INSTRUCTIONS_END}
+`;
+function installInstructions(options = {}) {
+  const root = repositoryRoot(options.cwd ?? ".");
+  const existing = ["AGENTS.md", "CLAUDE.md"].filter((name) => fs8.existsSync(path9.join(root, name)));
+  return (existing.length ? existing : ["AGENTS.md"]).map((name) => {
+    const file = path9.join(root, name);
+    const exists = fs8.existsSync(file);
+    const text = exists ? fs8.readFileSync(file, "utf8") : "";
+    const start = text.indexOf(INSTRUCTIONS_START);
+    const end = text.indexOf(INSTRUCTIONS_END);
+    let next;
+    if (start >= 0 && end > start) next = text.slice(0, start) + INSTRUCTIONS_BLOCK.trimEnd() + text.slice(end + INSTRUCTIONS_END.length);
+    else next = text + (text && !text.endsWith("\n\n") ? text.endsWith("\n") ? "\n" : "\n\n" : "") + INSTRUCTIONS_BLOCK;
+    if (next === text) return { file, action: "unchanged" };
+    if (!options.dryRun) fs8.writeFileSync(file, next);
+    return { file, action: exists ? "updated" : "created" };
+  });
+}
+
+// src/demo.ts
+import * as fs9 from "fs";
+import os2 from "os";
+import path10 from "path";
+import { spawnSync as spawnSync4 } from "child_process";
+import pc2 from "picocolors";
+var CART = `export function total(prices: number[], discount = 0): number {
+  const sum = prices.reduce((a, b) => a + b, 0);
+  return sum - sum * discount;
+}
+`;
+var CART_TEST = (weakened) => `import { total } from "./cart";
+
+describe("cart total", () => {
+  it("sums the prices", () => {
+    expect(total([10, 20, 12])).${weakened ? "toBeDefined()" : "toBe(42)"};
+  });
+
+  ${weakened ? "it.skip" : "it"}("applies a discount", () => {
+    expect(total([50, 50], 0.1)).toBe(90);
+  });
+
+  it("is zero for an empty cart", () => {
+    ${weakened ? "expect(true).toBe(true)" : "expect(total([])).toBe(0)"};
+  });
+});
+`;
+var VITEST_CONFIG = (lines, branches) => `import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: { coverage: { thresholds: { lines: ${lines}, branches: ${branches} } } },
+});
+`;
+var CI = (lenient) => `name: CI
+on: [push, pull_request]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm ci
+      - name: Run tests
+${lenient ? "        continue-on-error: true\n" : ""}        run: npm test
+`;
+async function runDemo(options = {}) {
+  const dir = fs9.mkdtempSync(path10.join(os2.tmpdir(), "agent-roast-demo-"));
+  try {
+    const git2 = (...args) => {
+      const run = spawnSync4(
+        "git",
+        [
+          ...HERMETIC_GIT_FLAGS,
+          "-c",
+          "user.name=agent-roast demo",
+          "-c",
+          "user.email=demo@example.invalid",
+          "-c",
+          "commit.gpgsign=false",
+          "-c",
+          `core.hooksPath=${path10.join(dir, ".no-hooks")}`,
+          ...args
+        ],
+        { cwd: dir, env: getHermeticGitEnv(), encoding: "utf8", timeout: 3e4, windowsHide: true }
+      );
+      if (run.error || run.status !== 0) throw new ConfigError(`The demo needs Git to create a temporary repository: ${run.error?.message ?? run.stderr.trim()}`);
+    };
+    const write = (file, text) => {
+      const destination = path10.join(dir, file);
+      fs9.mkdirSync(path10.dirname(destination), { recursive: true });
+      fs9.writeFileSync(destination, text);
+    };
+    git2("init", "-q", "-b", "main");
+    write("src/cart.ts", CART);
+    write("src/cart.test.ts", CART_TEST(false));
+    write("vitest.config.ts", VITEST_CONFIG(90, 85));
+    write(".github/workflows/ci.yml", CI(false));
+    git2("add", "-A");
+    git2("commit", "-q", "-m", "Add cart total");
+    write("src/cart.test.ts", CART_TEST(true));
+    write("vitest.config.ts", VITEST_CONFIG(50, 40));
+    write(".github/workflows/ci.yml", CI(true));
+    const result = await reviewWorktreeChanges({ cwd: dir, signal: options.signal });
+    const output = [
+      "",
+      pc2.bold("agent-roast demo") + pc2.dim(" \u2014 a scripted example in a temporary repository; nothing of yours is read or changed"),
+      "",
+      'A build was red. The "fix" below turns it green without touching the code under test:',
+      "",
+      `  ${pc2.cyan("src/cart.test.ts")}          toBe(42) \u2192 toBeDefined() \xB7 it.skip(\u2026) \xB7 expect(true).toBe(true)`,
+      `  ${pc2.cyan("vitest.config.ts")}          coverage thresholds lowered (lines 90 \u2192 50, branches 85 \u2192 40)`,
+      `  ${pc2.cyan(".github/workflows/ci.yml")}  continue-on-error: true on the test step`,
+      "",
+      "What agent-roast reports for that working tree:",
+      formatReviewTerminal(result).replace(/\s+$/, ""),
+      "",
+      pc2.bold("Use it on your own work"),
+      `  ${pc2.cyan("npx agent-roast")}                    review what you have not committed yet`,
+      `  ${pc2.cyan("npx agent-roast replay")}             replay your last 50 commits, one at a time`,
+      `  ${pc2.cyan("npx agent-roast hook install")}       send your coding agent back to fix the code when it weakens a check`,
+      ""
+    ].join("\n");
+    return { exitCode: result.failedRules.length ? 0 : 1, output, result };
+  } finally {
+    fs9.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
 // src/index.ts
 var InvalidDetectorError = class extends Error {
   constructor(message) {
@@ -3382,9 +4194,9 @@ var InvalidDetectorError = class extends Error {
   }
 };
 async function roastRepository(options = {}) {
-  const cwd = path7.resolve(options.cwd || process.cwd());
+  const cwd = path11.resolve(options.cwd || process.cwd());
   const since = options.since || "90 days ago";
-  const repoName = path7.basename(cwd);
+  const repoName = path11.basename(cwd);
   const collector = new MetricsCollector({ all: options.all, ignorePaths: options.ignorePaths, rules: options.rules, panicLoopWindowMinutes: options.panicLoopWindowMinutes });
   const gitStream = streamGitLog(cwd, since);
   await parseGitLogStream(gitStream, (commit, stats) => {
@@ -3399,7 +4211,7 @@ async function roastRepository(options = {}) {
   return { summary, output };
 }
 async function auditPullRequest(options) {
-  const cwd = path7.resolve(options.cwd || process.cwd());
+  const cwd = path11.resolve(options.cwd || process.cwd());
   const format = options.format || "terminal";
   const failOn = (options.failOn || ["test-skip"]).map((s) => s.trim()).filter(Boolean);
   for (const det of failOn) {
@@ -3522,6 +4334,8 @@ export {
   generateShareUrl,
   formatTerminalCard,
   formatPrTerminalCard,
+  isCheckRule,
+  mostImportantFirst,
   formatGithubAnnotations,
   formatGithubStepSummary,
   formatPrMarkdownComment,
@@ -3543,6 +4357,29 @@ export {
   compareFindings,
   reviewChanges,
   reviewStagedChanges,
+  reviewWorktreeChanges,
+  replayHistory,
+  formatReplayTerminal,
+  HOOK_AGENTS,
+  formatAgentFeedback,
+  hookPausedUntil,
+  pauseHook,
+  resumeHook,
+  parseDuration,
+  runHook,
+  AGENT_LABELS,
+  packageVersion,
+  hookCommand,
+  repositoryRoot,
+  hookConfigPath,
+  installHooks,
+  uninstallHooks,
+  hookStatus,
+  INSTRUCTIONS_START,
+  INSTRUCTIONS_END,
+  INSTRUCTIONS_BLOCK,
+  installInstructions,
+  runDemo,
   InvalidDetectorError,
   roastRepository,
   auditPullRequest