agent-roast 0.11.0 → 0.12.0

package/dist/{chunk-WMHB65AL.js → chunk-AP5Y4CH6.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import path8 from "path";
+import path11 from "path";
 
 // src/git.ts
 import { spawn, spawnSync } from "child_process";
@@ -847,12 +847,12 @@ var VALID_DETECTORS = [
 // src/file-read.ts
 import * as fs from "fs";
 function readRegularFile(filename, limit) {
-  const stat = fs.lstatSync(filename);
-  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > limit) throw new Error(`Expected a regular file no larger than ${limit} bytes.`);
+  const stat3 = fs.lstatSync(filename);
+  if (!stat3.isFile() || stat3.isSymbolicLink() || stat3.size > limit) throw new Error(`Expected a regular file no larger than ${limit} bytes.`);
   const fd = fs.openSync(filename, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0) | (fs.constants.O_NONBLOCK || 0));
   try {
     const opened = fs.fstatSync(fd);
-    if (!opened.isFile() || opened.ino !== stat.ino || opened.dev !== stat.dev) throw new Error("File changed while opening.");
+    if (!opened.isFile() || opened.ino !== stat3.ino || opened.dev !== stat3.dev) throw new Error("File changed while opening.");
     const buffer = Buffer.alloc(limit + 1);
     let size = 0;
     while (size < buffer.length) {
@@ -1183,6 +1183,98 @@ function isGuardedSkip(lines) {
   }
   return false;
 }
+var GO_GUARD = {
+  conditional: /^\s*(?:\}\s*)?(?:if|else|switch|case|select|for)\b/,
+  test: /^\s*func\s+(?:\([^)]*\)\s*)?(?:Test|Benchmark|Fuzz|Example)\w*\s*\(|\.Run\s*\(|\bfunc\s*\(\s*\w+\s+\*testing\.[TB]\s*\)/,
+  helper: /^\s*func\s+(?:\([^)]*\)\s*)?\w+\s*\(/
+};
+var RUBY_GUARD = {
+  modifier: /^\s*(?:skip|pending)\b.*\b(?:if|unless)\b/,
+  conditional: /^\s*(?:if|unless|else|elsif|case|when|begin|rescue|ensure|while|until)\b/,
+  test: /^\s*(?:it|specify|example|scenario|test|before|after|around)\b|^\s*def\s+test_/,
+  helper: /^\s*def\s+\w+/
+};
+var PHP_GUARD = {
+  modifier: /\b(?:or|and)\b.*markTest|(?:&&|\|\||\?).*markTest/,
+  conditional: /^\s*(?:\}\s*)?(?:if|else|elseif|switch|case|foreach|for|while|try|catch)\b/,
+  test: /^\s*(?:(?:public|protected|private|static)\s+)*function\s+test\w*\s*\(/,
+  helper: /^\s*(?:(?:public|protected|private|static)\s+)*function\s+\w+\s*\(/
+};
+var SWIFT_GUARD = {
+  conditional: /^\s*(?:\}\s*)?(?:if|else|guard|switch|case|for|while|do|catch)\b/,
+  test: /^\s*(?:@\w+\s+)*(?:(?:private|fileprivate|static)\s+)*func\s+test\w*\s*\(/,
+  helper: /^\s*(?:@\w+\s+)*(?:(?:private|fileprivate|static)\s+)*func\s+\w+\s*\(/
+};
+var LANGUAGE_LINE_RULES = [
+  { files: /_test\.go$/i, rules: [
+    { type: "test-skip", regex: /\b(?:t|tb|b)\s*\.\s*(?:Skip|Skipf|SkipNow)\s*\(|\.T\(\)\s*\.\s*(?:Skip|Skipf|SkipNow)\s*\(/, name: "skipped Go test (t.Skip)", guard: GO_GUARD },
+    { type: "trivial-assert", regex: /\b(?:assert|require)\s*\.\s*True\s*\(\s*\w+\s*,\s*true\s*\)/, name: "trivial assert (assert.True(t, true))" },
+    { type: "trivial-assert", regex: /\b(?:assert|require)\s*\.\s*False\s*\(\s*\w+\s*,\s*false\s*\)/, name: "trivial assert (assert.False(t, false))" },
+    { type: "trivial-assert", regex: /\b(?:assert|require)\s*\.\s*Equal\s*\(\s*\w+\s*,\s*(\d+|true|false|nil)\s*,\s*\1\s*\)/, name: "trivial assert (assert.Equal(t, 1, 1))" }
+  ] },
+  { files: /\.rs$/i, rules: [
+    { type: "test-skip", regex: /^\s*#\[\s*ignore\b/, name: "ignored Rust test (#[ignore])" },
+    { type: "trivial-assert", regex: /(?<![\w!])assert!\s*\(\s*true\s*\)/, name: "trivial assert (assert!(true))" },
+    { type: "trivial-assert", regex: /(?<![\w!])assert_eq!\s*\(\s*(\d+|true|false)\s*,\s*\1\s*\)/, name: "trivial assert (assert_eq!(1, 1))" }
+  ] },
+  { files: /\.(?:java|kt)$/i, rules: [
+    { type: "test-skip", regex: /(?:^|\s)@(?:Ignore|Disabled)\b/, name: "ignored JUnit test (@Ignore / @Disabled)" },
+    { type: "test-skip", regex: /@Test\s*\([^)]*\benabled\s*=\s*false\b/, name: "disabled TestNG test (enabled = false)" },
+    { type: "trivial-assert", regex: /\bassertTrue\s*\(\s*true\s*\)/, name: "trivial assert (assertTrue(true))" },
+    { type: "trivial-assert", regex: /\bassertFalse\s*\(\s*false\s*\)/, name: "trivial assert (assertFalse(false))" },
+    { type: "trivial-assert", regex: /\bassertEquals\s*\(\s*(\d+|true|false|null)\s*,\s*\1\s*\)/, name: "trivial assert (assertEquals(1, 1))" },
+    { type: "trivial-assert", regex: /\bassertThat\s*\(\s*true\s*\)\s*\.\s*isTrue\s*\(/, name: "trivial assert (assertThat(true).isTrue())" }
+  ] },
+  { files: /\.cs$/i, rules: [
+    { type: "test-skip", regex: /\[\s*Ignore\b|\b(?:Fact|Theory)\s*\(\s*(?:[^)]*,\s*)?Skip\s*=/, name: "ignored .NET test ([Ignore] / Skip =)" },
+    { type: "trivial-assert", regex: /\bAssert\s*\.\s*(?:True|IsTrue)\s*\(\s*true\s*\)/, name: "trivial assert (Assert.True(true))" },
+    { type: "trivial-assert", regex: /\bAssert\s*\.\s*(?:False|IsFalse)\s*\(\s*false\s*\)/, name: "trivial assert (Assert.False(false))" },
+    { type: "trivial-assert", regex: /\bAssert\s*\.\s*(?:AreEqual|Equal)\s*\(\s*(\d+|true|false|null)\s*,\s*\1\s*\)/, name: "trivial assert (Assert.Equal(1, 1))" }
+  ] },
+  // Ruby has no file-name convention as strict as the others, and `skip`/`pending` are ordinary method names: only spec and test files.
+  { files: /(?:^|\/)(?:spec|test)\/.*\.rb$|_(?:spec|test)\.rb$/i, rules: [
+    { type: "test-focus", regex: /^\s*(?:fit|fdescribe|fcontext|fspecify|fexample|fscenario)\b/, name: "focused RSpec example (fit / fdescribe)" },
+    { type: "test-focus", regex: /\b(?:it|describe|context|specify|scenario)\b[^\n]*[,(]\s*(?::focus\b|focus:\s*true\b)/, name: "focused RSpec example (focus: true)" },
+    { type: "test-skip", regex: /^\s*(?:xit|xdescribe|xcontext|xspecify|xexample|xscenario|xfeature)\b/, name: "disabled RSpec example (xit / xdescribe)" },
+    { type: "test-skip", regex: /\b(?:it|describe|context|specify|scenario)\b[^\n]*[,(]\s*(?::skip\b|skip:\s*(?:true\b|["']))/, name: "disabled RSpec example (skip: true)" },
+    { type: "test-skip", regex: /^\s*skip(?:\s|\(|$)/, name: "skipped Ruby test (skip)", guard: RUBY_GUARD },
+    { type: "test-skip", regex: /^\s*pending(?:\s+["'(]|\s*$)/, name: "pending Ruby example (pending)", guard: RUBY_GUARD },
+    { type: "trivial-assert", regex: /\bexpect\s*\(\s*(true|false|1|0|nil)\s*\)\s*\.\s*to\s+(?:eq|eql|be|equal)\b\s*\(?\s*\1\b/, name: "trivial expectation (expect(true).to eq(true))" },
+    { type: "trivial-assert", regex: /^\s*assert\s*\(?\s*true\s*\)?\s*$/, name: "trivial assert (assert true)" },
+    { type: "trivial-assert", regex: /\bassert_equal\s*\(?\s*(\d+|true|false|nil)\s*,\s*\1\s*\)?\s*$/, name: "trivial assert (assert_equal 1, 1)" }
+  ] },
+  { files: /\.php$/i, rules: [
+    { type: "test-skip", regex: /\$this\s*->\s*markTest(?:Skipped|Incomplete)\s*\(/, name: "skipped PHPUnit test (markTestSkipped)", guard: PHP_GUARD },
+    { type: "trivial-assert", regex: /\$this\s*->\s*assertTrue\s*\(\s*true\s*\)/, name: "trivial assert ($this->assertTrue(true))" },
+    { type: "trivial-assert", regex: /\$this\s*->\s*assertFalse\s*\(\s*false\s*\)/, name: "trivial assert ($this->assertFalse(false))" },
+    { type: "trivial-assert", regex: /\$this\s*->\s*assert(?:Equals|Same)\s*\(\s*(\d+|true|false|null)\s*,\s*\1\s*\)/, name: "trivial assert ($this->assertEquals(1, 1))" }
+  ] },
+  { files: /\.swift$/i, rules: [
+    { type: "test-skip", regex: /\bthrow\s+XCTSkip\s*\(/, name: "skipped XCTest (XCTSkip)", guard: SWIFT_GUARD },
+    { type: "test-skip", regex: /@(?:Test|Suite)\s*\([^)]*\.disabled\b/, name: "disabled Swift Testing test (.disabled)" },
+    { type: "trivial-assert", regex: /\bXCTAssertTrue\s*\(\s*true\s*\)/, name: "trivial assert (XCTAssertTrue(true))" },
+    { type: "trivial-assert", regex: /\bXCTAssertFalse\s*\(\s*false\s*\)/, name: "trivial assert (XCTAssertFalse(false))" },
+    { type: "trivial-assert", regex: /\bXCTAssertEqual\s*\(\s*(\d+|true|false|nil)\s*,\s*\1\s*\)/, name: "trivial assert (XCTAssertEqual(1, 1))" },
+    { type: "trivial-assert", regex: /#expect\s*\(\s*true\s*\)/, name: "trivial expectation (#expect(true))" }
+  ] }
+];
+function isGuardedBlockSkip(lines, profile) {
+  const indentOf = (text) => text.length - text.trimStart().length;
+  const mentionsCi = (raw) => /\bCI\b|\bGITHUB_ACTIONS\b/.test(raw);
+  const own = lines[lines.length - 1];
+  if (profile.modifier?.test(own.code) || profile.conditional.test(own.code)) return !mentionsCi(own.raw);
+  let limit = indentOf(own.code);
+  for (let i = lines.length - 2; i >= 0 && lines.length - 1 - i <= 200; i--) {
+    if (lines[i].number !== lines[i + 1].number - 1) return false;
+    const { code, raw } = lines[i];
+    if (!code.trim() || indentOf(code) >= limit) continue;
+    if (profile.conditional.test(code)) return !mentionsCi(raw);
+    if (profile.test.test(code)) return false;
+    if (profile.helper.test(code)) return true;
+    limit = indentOf(code);
+  }
+  return false;
+}
 var JS_TEST_API = /(?<![\w$.])(?:(?:it|test|describe|suite)(?:\s*\.\s*(?:concurrent|serial|parallel|describe|failing|sequential))*\s*\.\s*(skip|todo|only)|((?:xit|xtest|xdescribe|fit|fdescribe)))\b((?:\s*\.\s*(?:each|failing|concurrent|serial|parallel|sequential))*)\s*(?=\(|\u0001)/g;
 function isConditionalSkip(source, raw, open2) {
   if (source[open2] !== "(") return false;
@@ -1268,7 +1360,8 @@ var CODE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".rb",
   ".cs",
   ".cpp",
-  ".c"
+  ".c",
+  ".swift"
 ]);
 var IGNORED_PATH_REGEX = /(?:^|\/)(?:fixtures|__fixtures__|testdata|mocks|test_data|__snapshots__|sample[s]?)\//i;
 var TEST_PATH_REGEX = /(?:^|\/)test_[^/]+\.py$|(?:^|\/)(?:tests?|__tests__|specs?)\/|[._-](?:test|spec)\.[a-z0-9]+$/i;
@@ -1304,6 +1397,7 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
     const directives = javascript ? JS_COMMENT_DIRECTIVE_PATTERNS : python ? PYTHON_COMMENT_DIRECTIVE_PATTERNS : [];
     const stubs = javascript ? JS_STUB_PATTERNS : python ? PYTHON_STUB_PATTERNS : rust ? RUST_STUB_PATTERNS : [];
     const firstFinding = infractions.length;
+    const languageRules = LANGUAGE_LINE_RULES.find((entry) => entry.files.test(file.path))?.rules;
     const masker = new SourceMasker(file.path);
     const maskedLines = [];
     for (const added of file.addedLines) {
@@ -1331,6 +1425,14 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
           }
         }
       }
+      if (languageRules && !isComment) {
+        for (const rule of languageRules) {
+          if (!rule.regex.test(cleanedLine)) continue;
+          if (rule.guard && isGuardedBlockSkip(maskedLines, rule.guard)) break;
+          infractions.push({ type: rule.type, file: file.path, lineNumber: added.lineNumber, lineSnippet: rawLine.trim(), commitHash, commitDate, reason: rule.name });
+          break;
+        }
+      }
       let foundEscape = false;
       for (const rule of directives) {
         if (rule.regex.test(masked.comments)) {
@@ -2146,12 +2248,15 @@ function formatCheckMarkdown(result) {
   for (const skipped of result.skippedFiles) lines.push("", `Not scanned: ${markdownCell(skipped.file)} \u2014 ${markdownCell(skipped.reason)}`);
   return lines.join("\n");
 }
+var REVIEW_TITLES = { commits: "context review", index: "staged context review", worktree: "working tree review" };
+var reviewTitle = (result) => REVIEW_TITLES[result.source ?? "commits"];
+var reviewHead = (result) => result.headSha.slice(0, (result.source ?? "commits") === "commits" ? 7 : 18);
 function formatReviewTerminal(result) {
   const status = !result.complete ? "INCOMPLETE" : result.passed ? "PASSED" : "BLOCKED";
   const lines = [
     "",
-    pc.bold(`agent-roast \u2014 ${result.source === "index" ? "staged context review" : "context review"}: ${status}`),
-    `  ${result.mergeBaseSha.slice(0, 7)} \u2192 ${result.headSha.slice(0, result.source === "index" ? 18 : 7)} \xB7 policy: ${result.policySha === "EMPTY" ? "built-in first-commit defaults" : "base " + result.policySha.slice(0, 7)}`,
+    pc.bold(`agent-roast \u2014 ${reviewTitle(result)}: ${status}`),
+    `  ${result.mergeBaseSha.slice(0, 7)} \u2192 ${reviewHead(result)} \xB7 policy: ${result.policySha === "EMPTY" ? "built-in first-commit defaults" : "base " + result.policySha.slice(0, 7)}`,
     `  ${result.filesInspected} changed files compared \xB7 ${result.linesInspected} source lines inspected across both versions`,
     `  ${result.infractions.length} new \xB7 ${result.unchangedCount} existing \xB7 ${result.removedFindings.length} no longer detected`
   ];
@@ -2159,25 +2264,26 @@ function formatReviewTerminal(result) {
   if (result.policyChanges.length) lines.push("  Candidate policy changes were ignored; adopt them separately after review.");
   if (result.excludedFiles || result.unsupportedFiles) lines.push(`  ${result.excludedFiles} excluded \xB7 ${result.unsupportedFiles} unsupported/non-source changes`);
   for (const finding2 of mostImportantFirst(result.infractions, result.failedRules).slice(0, 20)) {
+    const failing = result.failedRules.includes(finding2.type);
     lines.push(
       "",
-      `  ${result.failedRules.includes(finding2.type) ? "FAIL" : "WARN"} [${finding2.type}] ${terminalText(finding2.file || "unknown")}:${finding2.lineNumber}`,
+      (failing ? pc.red : pc.yellow)(`  ${failing ? "FAIL" : "WARN"} [${finding2.type}] ${terminalText(finding2.file || "unknown")}:${finding2.lineNumber}`),
       `    ${terminalText(finding2.lineSnippet || finding2.reason)}`,
-      `    Next: ${terminalText(finding2.suggestion || "Review this occurrence.")}`
+      pc.dim(`    Next: ${terminalText(finding2.suggestion || "Review this occurrence.")}`)
     );
   }
   if (result.infractions.length > 20) lines.push(`  ${result.infractions.length - 20} more new findings; use --format json for all results.`);
   for (const skipped of result.skippedFiles) lines.push(`  NOT COMPARED ${terminalText(skipped.file)}: ${terminalText(skipped.reason)}`);
-  lines.push("", !result.complete ? "  INCOMPLETE: some changed source was not compared (exit 2)." : result.passed ? "  PASSED: no new blocking findings." : `  BLOCKED: ${result.failedRules.join(", ")}.`, "");
+  lines.push("", !result.complete ? pc.red("  INCOMPLETE: some changed source was not compared (exit 2).") : result.passed ? pc.green("  PASSED: no new blocking findings.") : pc.red(`  BLOCKED: ${result.failedRules.join(", ")}.`), "");
   if (!result.filesInspected) lines.push("  No supported changed source files compared.", "");
   return lines.join("\n");
 }
 function formatReviewMarkdown(result) {
   const status = !result.complete ? "INCOMPLETE" : result.passed ? "PASSED" : "BLOCKED";
   const lines = [
-    `## agent-roast ${result.source === "index" ? "staged context review" : "context review"}: ${status}`,
+    `## agent-roast ${reviewTitle(result)}: ${status}`,
     "",
-    `Compared ${result.filesInspected} changed files at \`${result.mergeBaseSha.slice(0, 7)}\` \u2192 \`${result.headSha.slice(0, result.source === "index" ? 18 : 7)}\`. Policy: \`${result.policySha === "EMPTY" ? "built-in first-commit defaults" : result.policySha.slice(0, 7)}\`.`,
+    `Compared ${result.filesInspected} changed files at \`${result.mergeBaseSha.slice(0, 7)}\` \u2192 \`${reviewHead(result)}\`. Policy: \`${result.policySha === "EMPTY" ? "built-in first-commit defaults" : result.policySha.slice(0, 7)}\`.`,
     "",
     `**${result.infractions.length} new** \xB7 ${result.unchangedCount} existing \xB7 ${result.removedFindings.length} no longer detected.`,
     ""
@@ -2257,9 +2363,9 @@ function createNewFile(root, relative2, content, mode = 420) {
   let directory = root;
   for (const segment of path3.dirname(inside).split(path3.sep).filter((part) => part !== ".")) {
     directory = path3.join(directory, segment);
-    let stat;
+    let stat3;
     try {
-      stat = fs4.lstatSync(directory);
+      stat3 = fs4.lstatSync(directory);
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
       try {
@@ -2267,9 +2373,9 @@ function createNewFile(root, relative2, content, mode = 420) {
       } catch (mkdirError) {
         if (mkdirError.code !== "EEXIST") throw mkdirError;
       }
-      stat = fs4.lstatSync(directory);
+      stat3 = fs4.lstatSync(directory);
     }
-    if (!stat.isDirectory() || stat.isSymbolicLink()) throw new ConfigError("Initialization refuses symlinked or non-directory parent paths.");
+    if (!stat3.isDirectory() || stat3.isSymbolicLink()) throw new ConfigError("Initialization refuses symlinked or non-directory parent paths.");
   }
   const temporary = path3.join(directory, `.agent-roast-init-${randomUUID3()}.tmp`);
   let fd;
@@ -2522,14 +2628,15 @@ import { constants as constants2 } from "fs";
 import path5 from "path";
 
 // src/snapshot.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash2, randomBytes } from "crypto";
 import * as fs5 from "fs/promises";
+import { constants as fsConstants } from "fs";
 import path4 from "path";
 import { spawn as spawn2 } from "child_process";
 function assertNotAborted(signal) {
   if (signal?.aborted) throw new ConfigError("Review cancelled; no complete result was produced.");
 }
-async function readGit(cwd, args, signal, limit = 8 * 1024 * 1024, indexFile) {
+async function readGit(cwd, args, signal, limit = 8 * 1024 * 1024, indexFile, input) {
   assertNotAborted(signal);
   const env = getHermeticGitEnv({ GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1", GIT_TERMINAL_PROMPT: "0" });
   if (indexFile) env.GIT_INDEX_FILE = indexFile;
@@ -2537,9 +2644,12 @@ async function readGit(cwd, args, signal, limit = 8 * 1024 * 1024, indexFile) {
     const child = spawn2("git", [...HERMETIC_GIT_FLAGS, ...args], {
       cwd,
       env,
-      stdio: ["ignore", "pipe", "pipe"],
+      stdio: ["pipe", "pipe", "pipe"],
       windowsHide: true
     });
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(input);
     const chunks = [];
     let bytes = 0;
     let stderr = "";
@@ -2659,35 +2769,36 @@ async function reviewPolicy(cwd, baseSha, signal) {
   }
   return { config: configFromText("{}", "default review policy"), filename: null };
 }
+async function resolveHead(cwd, signal) {
+  try {
+    return (await readGit(cwd, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"], signal, 1024)).toString().trim();
+  } catch (error) {
+    if (!(error instanceof GitError && error.code === 1)) throw error;
+    const ref = (await readGit(cwd, ["symbolic-ref", "--quiet", "HEAD"], signal, 1024)).toString().trim();
+    try {
+      await readGit(cwd, ["show-ref", "--verify", "--quiet", ref], signal, 1024);
+    } catch (missing) {
+      if (missing instanceof GitError && missing.code === 1) return "EMPTY";
+      throw missing;
+    }
+    throw new ConfigError("HEAD exists but cannot be resolved to a commit.");
+  }
+}
 async function stagedSnapshot(cwd, signal) {
   await requireLocalObjects2(cwd, signal);
   let indexFile;
   if (process.env.GIT_INDEX_FILE) {
-    const gitDirectory = await fs5.realpath(gitOutputPath((await readGit(cwd, ["rev-parse", "--absolute-git-dir"], signal, 8192)).toString()));
+    const gitDirectory2 = await fs5.realpath(gitOutputPath((await readGit(cwd, ["rev-parse", "--absolute-git-dir"], signal, 8192)).toString()));
     const requested = path4.resolve(cwd, process.env.GIT_INDEX_FILE);
-    const stat = await fs5.lstat(requested);
+    const stat3 = await fs5.lstat(requested);
     const resolved = await fs5.realpath(requested);
-    const relative2 = path4.relative(gitDirectory, resolved);
-    if (!stat.isFile() || stat.isSymbolicLink() || !relative2 || relative2 === ".." || relative2.startsWith(".." + path4.sep) || path4.isAbsolute(relative2)) {
+    const relative2 = path4.relative(gitDirectory2, resolved);
+    if (!stat3.isFile() || stat3.isSymbolicLink() || !relative2 || relative2 === ".." || relative2.startsWith(".." + path4.sep) || path4.isAbsolute(relative2)) {
       throw new ConfigError("GIT_INDEX_FILE must be a regular candidate index inside this repository's Git directory; refusing to review another index.");
     }
     indexFile = resolved;
   }
-  const head = async () => {
-    try {
-      return (await readGit(cwd, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"], signal, 1024)).toString().trim();
-    } catch (error) {
-      if (!(error instanceof GitError && error.code === 1)) throw error;
-      const ref = (await readGit(cwd, ["symbolic-ref", "--quiet", "HEAD"], signal, 1024)).toString().trim();
-      try {
-        await readGit(cwd, ["show-ref", "--verify", "--quiet", ref], signal, 1024);
-      } catch (missing) {
-        if (missing instanceof GitError && missing.code === 1) return "EMPTY";
-        throw missing;
-      }
-      throw new ConfigError("HEAD exists but cannot be resolved to a commit.");
-    }
-  };
+  const head = () => resolveHead(cwd, signal);
   const baseSha = await head();
   const inventory = () => readGit(cwd, [
     "diff",
@@ -2724,6 +2835,99 @@ async function stagedSnapshot(cwd, signal) {
     }
   };
 }
+var MAX_WORKTREE_FILE = 2 * 1024 * 1024;
+var outside = (relative2) => !relative2 || relative2 === ".." || relative2.startsWith(".." + path4.sep) || path4.isAbsolute(relative2);
+async function worktreeSnapshot(cwd, signal) {
+  await requireLocalObjects2(cwd, signal);
+  const text = async (...args) => gitOutputPath((await readGit(cwd, args, signal, 8192)).toString());
+  const [root, gitDirectory2, indexPath, baseSha] = await Promise.all([
+    text("rev-parse", "--show-toplevel").then((file) => fs5.realpath(file)),
+    text("rev-parse", "--absolute-git-dir").then((file) => fs5.realpath(file)),
+    text("rev-parse", "--git-path", "index"),
+    resolveHead(cwd, signal)
+  ]);
+  const realIndex = path4.resolve(cwd, indexPath);
+  const indexFile = path4.join(gitDirectory2, `agent-roast-${process.pid}-${randomBytes(6).toString("hex")}.index`);
+  const dispose = async () => {
+    await Promise.all([indexFile, indexFile + ".lock"].map((file) => fs5.rm(file, { force: true })));
+  };
+  try {
+    let restoreIndexTime = async () => {
+    };
+    try {
+      const original = await fs5.stat(realIndex);
+      await fs5.copyFile(realIndex, indexFile, fsConstants.COPYFILE_EXCL);
+      const seconds = Math.floor(original.mtimeMs) / 1e3;
+      restoreIndexTime = () => fs5.utimes(indexFile, seconds, seconds);
+      await restoreIndexTime();
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    const conflicts = await readGit(root, ["ls-files", "--unmerged", "-z", "--full-name"], signal, 8 * 1024 * 1024, indexFile);
+    if (conflicts.length) throw new ConfigError("Resolve unmerged index entries before reviewing the working tree.");
+    await readGit(root, ["update-index", "-q", "--refresh"], signal, 1024 * 1024, indexFile);
+    await restoreIndexTime();
+    await readGit(root, ["add", "--intent-to-add", "--", "."], signal, 1024 * 1024, indexFile);
+    await restoreIndexTime();
+    const tree = baseSha === "EMPTY" ? (await readGit(root, ["hash-object", "-t", "tree", "--stdin"], signal, 256, void 0, Buffer.alloc(0))).toString().trim() : baseSha;
+    const inventory = () => readGit(root, [
+      "diff-index",
+      "--raw",
+      "-z",
+      "--no-abbrev",
+      "--no-ext-diff",
+      "--no-textconv",
+      "--ignore-submodules=none",
+      "--find-renames=50%",
+      "-l1000",
+      "--end-of-options",
+      tree,
+      "--"
+    ], signal, 8 * 1024 * 1024, indexFile);
+    const pinned = await inventory();
+    const changes = parseTreeChanges(pinned);
+    const headSha = "WORKTREE:" + createHash2("sha256").update(baseSha).update(pinned).digest("hex");
+    const stamps = /* @__PURE__ */ new Map();
+    const stamp = (stat3) => `${stat3.size}:${stat3.mtimeMs}:${stat3.ino}`;
+    return {
+      baseSha,
+      headSha,
+      mergeBaseSha: baseSha,
+      changes,
+      readWorktree: async (relative2) => {
+        const filename = path4.resolve(root, relative2);
+        if (outside(path4.relative(root, filename))) throw new ConfigError("A changed path escapes the repository.");
+        let stat3;
+        try {
+          stat3 = await fs5.lstat(filename);
+        } catch (error) {
+          if (error.code === "ENOENT") throw new ConfigError("A changed file disappeared during the review; rerun it.");
+          throw error;
+        }
+        if (!stat3.isFile()) throw new ConfigError("Changed source is a symlink or special file; comparison is incomplete.");
+        if (stat3.size > MAX_WORKTREE_FILE) throw new ConfigError(`Source file exceeds the ${MAX_WORKTREE_FILE} byte limit.`);
+        if (outside(path4.relative(root, await fs5.realpath(filename)))) throw new ConfigError("A changed file resolves outside the repository.");
+        const content = readRegularFile(filename, MAX_WORKTREE_FILE);
+        stamps.set(filename, stamp(stat3));
+        return content;
+      },
+      verify: async () => {
+        assertNotAborted(signal);
+        if (await resolveHead(cwd, signal) !== baseSha || !(await inventory()).equals(pinned)) {
+          throw new ConfigError("HEAD or the working tree changed during review; rerun it. No complete result was produced.");
+        }
+        for (const [filename, before] of stamps) {
+          const now = await fs5.lstat(filename).catch(() => null);
+          if (!now || stamp(now) !== before) throw new ConfigError("A changed file was modified during review; rerun it. No complete result was produced.");
+        }
+      },
+      dispose
+    };
+  } catch (error) {
+    await dispose();
+    throw error;
+  }
+}
 
 // src/check.ts
 var MAX_FILE_BYTES = 2 * 1024 * 1024;
@@ -2742,21 +2946,21 @@ function insideRoot(root, filename) {
 async function readSource(root, file, signal) {
   const filename = path5.resolve(root, file);
   if (!insideRoot(root, filename)) throw new Error("File escapes the repository.");
-  let stat;
+  let stat3;
   try {
-    stat = await fs6.lstat(filename);
+    stat3 = await fs6.lstat(filename);
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
   }
-  if (!stat.isFile() || stat.isSymbolicLink()) throw new Error("Symlinks and special files are not scanned.");
+  if (!stat3.isFile() || stat3.isSymbolicLink()) throw new Error("Symlinks and special files are not scanned.");
   const real = await fs6.realpath(filename);
   if (!insideRoot(root, real)) throw new Error("File resolves outside the repository.");
-  if (stat.size > MAX_FILE_BYTES) throw new Error("File exceeds the 2 MiB scan limit.");
+  if (stat3.size > MAX_FILE_BYTES) throw new Error("File exceeds the 2 MiB scan limit.");
   const handle = await fs6.open(filename, constants2.O_RDONLY | (constants2.O_NOFOLLOW || 0) | (constants2.O_NONBLOCK || 0));
   try {
     const opened = await handle.stat();
-    if (opened.ino !== stat.ino || opened.dev !== stat.dev || !opened.isFile()) throw new Error("File changed while opening.");
+    if (opened.ino !== stat3.ino || opened.dev !== stat3.dev || !opened.isFile()) throw new Error("File changed while opening.");
     const chunks = [];
     let size = 0;
     while (true) {
@@ -3291,28 +3495,38 @@ function compareFindings(before, after, newPath) {
   return { introduced, removed: [...old.values()].flatMap((bucket) => bucket.findings.slice(bucket.matched)), unchanged };
 }
 function reviewChanges(options) {
-  return compareSourceChanges({ ...options, staged: false });
+  return compareSourceChanges({ ...options, source: "commits" });
 }
 function reviewStagedChanges(options = {}) {
-  return compareSourceChanges({ ...options, staged: true });
+  return compareSourceChanges({ ...options, source: "index" });
+}
+function reviewWorktreeChanges(options = {}) {
+  return compareSourceChanges({ ...options, source: "worktree" });
 }
 async function compareSourceChanges(options) {
   assertNotAborted(options.signal);
   const cwd = path6.resolve(options.cwd || process.cwd());
-  const staged = options.staged ? await stagedSnapshot(cwd, options.signal) : void 0;
-  const refs = options.staged ? { baseSha: staged.baseSha, headSha: staged.headSha, mergeBaseSha: staged.mergeBaseSha } : await reviewRefs(cwd, options.base, options.head ?? "HEAD", options.signal);
+  const snapshot = options.source === "index" ? await stagedSnapshot(cwd, options.signal) : options.source === "worktree" ? await worktreeSnapshot(cwd, options.signal) : void 0;
+  try {
+    return await compareSnapshot(options, cwd, snapshot);
+  } finally {
+    await snapshot?.dispose?.();
+  }
+}
+async function compareSnapshot(options, cwd, snapshot) {
+  const refs = options.source === "commits" ? await reviewRefs(cwd, options.base, options.head ?? "HEAD", options.signal) : { baseSha: snapshot.baseSha, headSha: snapshot.headSha, mergeBaseSha: snapshot.mergeBaseSha };
   const policy = refs.baseSha === "EMPTY" ? { config: configFromText("{}", "default first-commit policy"), filename: null } : await reviewPolicy(cwd, refs.baseSha, options.signal);
   const format = options.format ?? "terminal";
   if (!["terminal", "json", "github", "markdown", "sarif"].includes(format)) throw new ConfigError("Unsupported review format.");
   const failOn = options.failOn ?? policy.config.failOn ?? ["test-skip", "trivial-assert", "test-focus", "assertion-weakened", "guard-weakened"];
   for (const rule of failOn) if (!VALID_DETECTORS.includes(rule)) throw new ConfigError(`Unknown review rule '${rule}'.`);
-  const changes = staged?.changes ?? await changedTreeFiles(cwd, refs.mergeBaseSha, refs.headSha, options.signal);
+  const changes = snapshot?.changes ?? await changedTreeFiles(cwd, refs.mergeBaseSha, refs.headSha, options.signal);
   const policyChanges = changes.filter((change) => CONFIG_FILENAMES.includes(change.oldPath) || CONFIG_FILENAMES.includes(change.newPath)).map((change) => change.newPath);
   const ignores = [...GENERATED_PATHS2, ...policy.config.ignorePaths || []];
   const result = {
-    schemaVersion: "1.1.0",
+    schemaVersion: "1.2.0",
     mode: "review",
-    source: staged ? "index" : "commits",
+    source: options.source,
     ...refs,
     policySha: refs.baseSha,
     policyFile: policy.filename,
@@ -3340,15 +3554,26 @@ async function compareSourceChanges(options) {
   const guardFindings = [];
   const ciCounts = [];
   let productionChanged = false;
-  const readText = async (mode, oid) => {
-    if (mode === "000000") return null;
-    if (!["100644", "100755"].includes(mode)) throw new ConfigError("Changed source is a symlink, submodule or unsupported Git mode; comparison is incomplete.");
-    const content = await readBlob(cwd, oid, options.signal);
+  const decode = (content) => {
     totalBytes += content.length;
     if (totalBytes > MAX_SCAN_BYTES2) throw new ConfigError("Review exceeds the 50 MiB source comparison limit.");
     if (content.includes(0)) throw new ConfigError("Binary content in a source comparison.");
     return new TextDecoder("utf-8", { fatal: true }).decode(content);
   };
+  const regularMode = (mode) => {
+    if (!["100644", "100755"].includes(mode)) throw new ConfigError("Changed source is a symlink, submodule or unsupported Git mode; comparison is incomplete.");
+  };
+  const readText = async (mode, oid) => {
+    if (mode === "000000") return null;
+    regularMode(mode);
+    return decode(await readBlob(cwd, oid, options.signal));
+  };
+  const readNew = async (change) => {
+    if (options.source !== "worktree") return readText(change.newMode, change.newOid);
+    if (change.newMode === "000000") return null;
+    regularMode(change.newMode);
+    return decode(await snapshot.readWorktree(change.newPath));
+  };
   const existingCounts = /* @__PURE__ */ new Map();
   for (const change of changes) {
     assertNotAborted(options.signal);
@@ -3362,7 +3587,7 @@ async function compareSourceChanges(options) {
       }
       try {
         const oldText = await readText(change.oldMode, change.oldOid);
-        const newText = await readText(change.newMode, change.newOid);
+        const newText = await readNew(change);
         guardFindings.push(...analyzeGuardFile(change.newPath, oldText, newText, refs.headSha));
         const ci = ciTestSteps(change.newPath, oldText, newText);
         if (ci) ciCounts.push(ci);
@@ -3393,7 +3618,7 @@ async function compareSourceChanges(options) {
         throw new ConfigError("Source moved to an unsupported extension; cannot claim its findings were resolved.");
       }
       const oldText = await readText(change.oldMode, change.oldOid);
-      const newText = await readText(change.newMode, change.newOid);
+      const newText = await readNew(change);
       const before = scan(oldText, change.oldPath, refs.mergeBaseSha);
       const after = scan(newText, change.newPath, refs.headSha);
       if (isTestFile(change.oldPath) || isTestFile(change.newPath)) tamperingFiles.push(analyzeTestFile(change.oldPath, change.newPath, oldText, newText, refs.headSha));
@@ -3420,7 +3645,7 @@ async function compareSourceChanges(options) {
     }
   }
   assertNotAborted(options.signal);
-  await staged?.verify();
+  await snapshot?.verify();
   result.complete = result.skippedFiles.length === 0;
   const rules = policy.config.rules ?? {};
   result.infractions.push(...[...resolveTampering(tamperingFiles, productionChanged), ...guardFindings, ...resolveCiTestSteps(ciCounts, refs.headSha)].filter((finding2) => rules[finding2.type] !== "off"));
@@ -3449,10 +3674,10 @@ var plural = (count, word) => `${count} ${word}${count === 1 ? "" : "s"}`;
 function clipEvidence(text, limit = 200) {
   if (text.length <= limit) return text;
   const arrow = text.indexOf(" \u2192 ");
-  const clip = (part, size) => part.length > size ? `${part.slice(0, size - 1)}\u2026` : part;
-  if (arrow < 0) return clip(text, limit);
+  const clip2 = (part, size) => part.length > size ? `${part.slice(0, size - 1)}\u2026` : part;
+  if (arrow < 0) return clip2(text, limit);
   const side = Math.floor((limit - 3) / 2);
-  return `${clip(text.slice(0, arrow), side)} \u2192 ${clip(text.slice(arrow + 3), side)}`;
+  return `${clip2(text.slice(0, arrow), side)} \u2192 ${clip2(text.slice(arrow + 3), side)}`;
 }
 async function replayHistory(options = {}) {
   assertNotAborted(options.signal);
@@ -3558,6 +3783,409 @@ function formatReplayTerminal(result, allRules = false) {
   return lines.join("\n");
 }
 
+// src/hook.ts
+import path8 from "path";
+import * as fs7 from "fs/promises";
+var HOOK_AGENTS = ["claude", "codex", "cursor"];
+var DEFAULT_TIMEOUT_MS = 25e3;
+var PAUSE_FILE = "agent-roast-hook-paused";
+var LISTED = 6;
+var LISTED_WARNINGS = 3;
+function detectAgent(input) {
+  if ("workspace_roots" in input || "cursor_version" in input || "conversation_id" in input) return "cursor";
+  if ("turn_id" in input) return "codex";
+  return "claude";
+}
+function inputCwd(agent, input, env) {
+  const roots = input.workspace_roots;
+  if (agent === "cursor" && Array.isArray(roots) && typeof roots[0] === "string") return roots[0];
+  if (typeof input.cwd === "string" && input.cwd) return input.cwd;
+  return env.CLAUDE_PROJECT_DIR || env.CURSOR_PROJECT_DIR || process.cwd();
+}
+function clip(text, limit) {
+  const flat = terminalText(text).replace(/\s+/g, " ").trim();
+  return flat.length > limit ? `${flat.slice(0, limit - 1)}\u2026` : flat;
+}
+function describe(finding2, index) {
+  const where = finding2.file ? `${terminalText(finding2.file)}${finding2.lineNumber ? `:${finding2.lineNumber}` : ""}` : "unknown location";
+  const evidence = clip(finding2.lineSnippet || finding2.reason, 220);
+  return [`${index}. ${where} [${finding2.type}]`, `   ${evidence}`];
+}
+function formatAgentFeedback(result) {
+  const ranked = mostImportantFirst(result.infractions, result.failedRules);
+  const blocking = ranked.filter((finding2) => result.failedRules.includes(finding2.type));
+  const notes = ranked.filter((finding2) => !result.failedRules.includes(finding2.type) && isCheckRule(finding2.type));
+  const lines = ["agent-roast: the uncommitted changes make the checks easier to pass instead of making the code correct.", ""];
+  blocking.slice(0, LISTED).forEach((finding2, index) => lines.push(...describe(finding2, index + 1)));
+  if (blocking.length > LISTED) lines.push(`   \u2026 and ${blocking.length - LISTED} more.`);
+  if (notes.length) {
+    lines.push("", "Also worth a second look (these do not block):");
+    notes.slice(0, LISTED_WARNINGS).forEach((finding2) => lines.push(`- ${describe(finding2, 0)[0].slice(3)}: ${clip(finding2.lineSnippet || finding2.reason, 120)}`));
+    if (notes.length > LISTED_WARNINGS) lines.push(`- \u2026 and ${notes.length - LISTED_WARNINGS} more.`);
+  }
+  lines.push(
+    "",
+    "Make the original checks pass by fixing the code. Do not skip, delete, loosen or silence tests, assertions, coverage gates, type checks or CI steps to get a green run.",
+    "If a change to a check is really intended, stop and ask the user to approve it explicitly rather than keeping it quietly."
+  );
+  return lines.join("\n");
+}
+function formatUserWarning(result) {
+  const blocking = result.infractions.filter((finding2) => result.failedRules.includes(finding2.type));
+  const first = blocking[0];
+  return `agent-roast: the agent finished with ${blocking.length} change${blocking.length === 1 ? "" : "s"} that weaken${blocking.length === 1 ? "s" : ""} checks (${result.failedRules.join(", ")})${first ? `, for example ${terminalText(first.file ?? "unknown")}:${first.lineNumber ?? "?"}` : ""}. Review them before you commit: npx agent-roast review --worktree`;
+}
+async function gitDirectory(cwd, signal) {
+  return fs7.realpath(gitOutputPath((await readGit(cwd, ["rev-parse", "--absolute-git-dir"], signal, 8192)).toString()));
+}
+async function hookPausedUntil(cwd, now = /* @__PURE__ */ new Date()) {
+  try {
+    const file = path8.join(await gitDirectory(cwd), PAUSE_FILE);
+    const until = new Date((await fs7.readFile(file, "utf8")).trim());
+    if (!Number.isNaN(until.getTime()) && until > now) return until;
+    await fs7.rm(file, { force: true });
+  } catch {
+  }
+  return null;
+}
+async function pauseHook(cwd, until) {
+  const file = path8.join(await gitDirectory(cwd), PAUSE_FILE);
+  await fs7.writeFile(file, until.toISOString() + "\n");
+  return file;
+}
+async function resumeHook(cwd) {
+  const file = path8.join(await gitDirectory(cwd), PAUSE_FILE);
+  const existed = await fs7.stat(file).then(() => true, () => false);
+  await fs7.rm(file, { force: true });
+  return existed;
+}
+function parseDuration(text) {
+  const match = /^(\d+)\s*([mhd])$/i.exec(text.trim());
+  if (!match || Number(match[1]) < 1) throw new ConfigError("Use a duration such as 30m, 2h or 1d.");
+  return Number(match[1]) * { m: 6e4, h: 36e5, d: 864e5 }[match[2].toLowerCase()];
+}
+var outcome = (action, stdout = "", stderr = "", result) => ({ action, stdout, stderr, exitCode: 0, result });
+async function runHook(rawInput, options = {}) {
+  const env = options.env ?? process.env;
+  let input = {};
+  try {
+    const parsed = rawInput.trim() ? JSON.parse(rawInput) : {};
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) input = parsed;
+  } catch {
+    return outcome("skip", "", "agent-roast hook: input was not JSON; nothing was checked.\n");
+  }
+  if (["off", "0", "false"].includes((env.AGENT_ROAST_HOOK ?? "").toLowerCase())) return outcome("skip");
+  const agent = options.agent ?? detectAgent(input);
+  const event = String(input.hook_event_name ?? "Stop");
+  if (event.toLowerCase() !== "stop") return outcome("skip");
+  if (agent === "cursor" && typeof input.status === "string" && input.status !== "completed") return outcome("skip");
+  const cwd = options.cwd ?? inputCwd(agent, input, env);
+  if (await hookPausedUntil(cwd, options.now)) return outcome("skip");
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  let result;
+  try {
+    result = await reviewWorktreeChanges({ cwd, signal: controller.signal });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return outcome("skip", "", `agent-roast hook: could not check the working tree (${clip(reason, 200)}); the agent was allowed to finish.
+`);
+  } finally {
+    clearTimeout(timer);
+  }
+  if (!result.failedRules.length) return outcome("pass", agent === "cursor" ? "{}\n" : "", "", result);
+  const alreadyAsked = input.stop_hook_active === true || typeof input.loop_count === "number" && input.loop_count > 0;
+  if (alreadyAsked) {
+    return outcome("warn", agent === "cursor" ? "{}\n" : JSON.stringify({ systemMessage: formatUserWarning(result) }) + "\n", "", result);
+  }
+  const message = formatAgentFeedback(result);
+  return outcome("block", JSON.stringify(agent === "cursor" ? { followup_message: message } : { decision: "block", reason: message }) + "\n", "", result);
+}
+
+// src/hook-install.ts
+import * as fs8 from "fs";
+import os from "os";
+import path9 from "path";
+import { randomUUID as randomUUID4 } from "crypto";
+import { createRequire as createRequire2 } from "module";
+import { spawnSync as spawnSync3 } from "child_process";
+var AGENT_LABELS = { claude: "Claude Code", codex: "Codex", cursor: "Cursor" };
+var TIMEOUT_SECONDS = 60;
+function packageVersion() {
+  const require3 = createRequire2(import.meta.url);
+  return String(require3("../package.json").version);
+}
+function hookCommand(agent, command = `npx --yes agent-roast@${packageVersion()}`) {
+  return `${command.trim()} hook run --agent ${agent}`;
+}
+var isOurs = (command) => typeof command === "string" && /\bagent-roast\b.*\bhook\s+run\b/.test(command);
+function repositoryRoot(cwd) {
+  const absolute = fs8.realpathSync(path9.resolve(cwd));
+  const run = spawnSync3("git", [...HERMETIC_GIT_FLAGS, "rev-parse", "--show-toplevel"], {
+    cwd: absolute,
+    env: { ...getHermeticGitEnv(), LC_ALL: "C" },
+    encoding: "utf8",
+    timeout: 3e4,
+    maxBuffer: 8192,
+    windowsHide: true
+  });
+  return run.status === 0 ? fs8.realpathSync(gitOutputPath(run.stdout)) : absolute;
+}
+function hookConfigPath(agent, scope, root, home, env = process.env) {
+  if (scope === "local" && agent !== "claude") throw new ConfigError(`${AGENT_LABELS[agent]} has no hook file that stays out of the repository; use the project file or --global.`);
+  const claude = path9.join(scope === "global" ? home : root, ".claude");
+  if (agent === "claude") return path9.join(claude, scope === "local" ? "settings.local.json" : "settings.json");
+  if (agent === "cursor") return path9.join(scope === "global" ? home : root, ".cursor", "hooks.json");
+  return path9.join(scope === "global" ? env.CODEX_HOME || path9.join(home, ".codex") : path9.join(root, ".codex"), "hooks.json");
+}
+function readJsonFile(file) {
+  let raw;
+  let mode;
+  try {
+    mode = fs8.statSync(file).mode & 511;
+    raw = fs8.readFileSync(file, "utf8").replace(/^/, "");
+  } catch (error) {
+    if (error.code === "ENOENT") return { data: {}, indent: 2, mode: void 0, existed: false };
+    throw error;
+  }
+  if (!raw.trim()) return { data: {}, indent: 2, mode, existed: true };
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch {
+    throw new ConfigError(`${file} is not valid JSON, so it was left alone. Fix it, or add the hook by hand (see docs/integrations.md).`);
+  }
+  if (!data || typeof data !== "object" || Array.isArray(data)) throw new ConfigError(`${file} must contain a JSON object, so it was left alone.`);
+  const indent = /^([ \t]+)"/m.exec(raw)?.[1] ?? 2;
+  return { data, indent, mode, existed: true };
+}
+function writeJsonFile(link, json) {
+  const file = json.existed ? fs8.realpathSync(link) : link;
+  fs8.mkdirSync(path9.dirname(file), { recursive: true });
+  const temporary = path9.join(path9.dirname(file), `.agent-roast-${randomUUID4()}.tmp`);
+  try {
+    fs8.writeFileSync(temporary, JSON.stringify(json.data, null, json.indent) + "\n", { mode: json.mode ?? 420 });
+    fs8.renameSync(temporary, file);
+  } finally {
+    fs8.rmSync(temporary, { force: true });
+  }
+}
+var asArray = (value) => Array.isArray(value) ? value : [];
+function addStopHook(agent, data, command) {
+  const before = JSON.stringify(data);
+  data.hooks = data.hooks && typeof data.hooks === "object" && !Array.isArray(data.hooks) ? data.hooks : {};
+  if (agent === "cursor") {
+    data.version ??= 1;
+    const handlers = asArray(data.hooks.stop);
+    const ours = handlers.find((handler) => isOurs(handler?.command));
+    if (ours) ours.command = command;
+    else handlers.push({ command, timeout: TIMEOUT_SECONDS, loop_limit: 2 });
+    data.hooks.stop = handlers;
+  } else {
+    const groups = asArray(data.hooks.Stop);
+    const ours = groups.flatMap((group) => asArray(group?.hooks)).find((handler) => isOurs(handler?.command));
+    if (ours) ours.command = command;
+    else groups.push({ hooks: [{ type: "command", command, timeout: TIMEOUT_SECONDS }] });
+    data.hooks.Stop = groups;
+  }
+  return JSON.stringify(data) !== before;
+}
+function removeStopHook(agent, data) {
+  const before = JSON.stringify(data);
+  const hooks = data.hooks;
+  if (!hooks || typeof hooks !== "object") return false;
+  if (agent === "cursor") {
+    const kept = asArray(hooks.stop).filter((handler) => !isOurs(handler?.command));
+    if (kept.length) hooks.stop = kept;
+    else delete hooks.stop;
+  } else {
+    const groups = asArray(hooks.Stop).map((group) => ({ ...group, hooks: asArray(group?.hooks).filter((handler) => !isOurs(handler?.command)) }));
+    const kept = groups.filter((group) => group.hooks.length);
+    if (kept.length) hooks.Stop = kept;
+    else delete hooks.Stop;
+  }
+  if (!Object.keys(hooks).length) delete data.hooks;
+  return JSON.stringify(data) !== before;
+}
+function context(options) {
+  return { root: repositoryRoot(options.cwd ?? "."), scope: options.scope ?? "project", home: options.home ?? os.homedir(), env: options.env ?? process.env };
+}
+function installHooks(options) {
+  const { root, scope, home, env } = context(options);
+  return options.agents.map((agent) => {
+    const file = hookConfigPath(agent, scope, root, home, env);
+    const command = hookCommand(agent, options.command);
+    const json = readJsonFile(file);
+    const changed = addStopHook(agent, json.data, command);
+    if (changed && !options.dryRun) writeJsonFile(file, json);
+    return { agent, scope, file, command, action: !json.existed ? "created" : changed ? "updated" : "unchanged" };
+  });
+}
+function uninstallHooks(options) {
+  const { root, scope, home, env } = context(options);
+  return options.agents.map((agent) => {
+    const file = hookConfigPath(agent, scope, root, home, env);
+    const json = readJsonFile(file);
+    const removed = json.existed && removeStopHook(agent, json.data);
+    if (removed && !options.dryRun) writeJsonFile(file, json);
+    return { agent, scope, file, action: removed ? "removed" : "absent" };
+  });
+}
+function hookStatus(options) {
+  const { root, home, env } = context({ ...options, scope: "project" });
+  const rows = [];
+  for (const agent of ["claude", "codex", "cursor"]) {
+    for (const scope of ["project", "local", "global"]) {
+      if (scope === "local" && agent !== "claude") continue;
+      const file = hookConfigPath(agent, scope, root, home, env);
+      let command;
+      try {
+        const data = readJsonFile(file).data;
+        const handlers = agent === "cursor" ? asArray(data.hooks?.stop) : asArray(data.hooks?.Stop).flatMap((group) => asArray(group?.hooks));
+        command = handlers.map((handler) => handler?.command).find(isOurs);
+      } catch {
+      }
+      rows.push({ agent, scope, file, command, installed: Boolean(command), action: command ? "unchanged" : "absent" });
+    }
+  }
+  return rows;
+}
+var INSTRUCTIONS_START = "<!-- agent-roast:start -->";
+var INSTRUCTIONS_END = "<!-- agent-roast:end -->";
+var INSTRUCTIONS_BLOCK = `${INSTRUCTIONS_START}
+## Keep the checks honest
+
+When a test, type check, linter or CI step fails, fix the code. Do not make the build green by skipping or deleting tests,
+weakening assertions, lowering coverage thresholds, switching off \`strict\`, or letting a CI step fail. If you think a check
+is wrong, say so and ask before changing it. Before you finish, run \`npx agent-roast review --worktree\`: it lists uncommitted
+changes that weaken the checks.
+${INSTRUCTIONS_END}
+`;
+function installInstructions(options = {}) {
+  const root = repositoryRoot(options.cwd ?? ".");
+  const existing = ["AGENTS.md", "CLAUDE.md"].filter((name) => fs8.existsSync(path9.join(root, name)));
+  return (existing.length ? existing : ["AGENTS.md"]).map((name) => {
+    const file = path9.join(root, name);
+    const exists = fs8.existsSync(file);
+    const text = exists ? fs8.readFileSync(file, "utf8") : "";
+    const start = text.indexOf(INSTRUCTIONS_START);
+    const end = text.indexOf(INSTRUCTIONS_END);
+    let next;
+    if (start >= 0 && end > start) next = text.slice(0, start) + INSTRUCTIONS_BLOCK.trimEnd() + text.slice(end + INSTRUCTIONS_END.length);
+    else next = text + (text && !text.endsWith("\n\n") ? text.endsWith("\n") ? "\n" : "\n\n" : "") + INSTRUCTIONS_BLOCK;
+    if (next === text) return { file, action: "unchanged" };
+    if (!options.dryRun) fs8.writeFileSync(file, next);
+    return { file, action: exists ? "updated" : "created" };
+  });
+}
+
+// src/demo.ts
+import * as fs9 from "fs";
+import os2 from "os";
+import path10 from "path";
+import { spawnSync as spawnSync4 } from "child_process";
+import pc2 from "picocolors";
+var CART = `export function total(prices: number[], discount = 0): number {
+  const sum = prices.reduce((a, b) => a + b, 0);
+  return sum - sum * discount;
+}
+`;
+var CART_TEST = (weakened) => `import { total } from "./cart";
+
+describe("cart total", () => {
+  it("sums the prices", () => {
+    expect(total([10, 20, 12])).${weakened ? "toBeDefined()" : "toBe(42)"};
+  });
+
+  ${weakened ? "it.skip" : "it"}("applies a discount", () => {
+    expect(total([50, 50], 0.1)).toBe(90);
+  });
+
+  it("is zero for an empty cart", () => {
+    ${weakened ? "expect(true).toBe(true)" : "expect(total([])).toBe(0)"};
+  });
+});
+`;
+var VITEST_CONFIG = (lines, branches) => `import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: { coverage: { thresholds: { lines: ${lines}, branches: ${branches} } } },
+});
+`;
+var CI = (lenient) => `name: CI
+on: [push, pull_request]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm ci
+      - name: Run tests
+${lenient ? "        continue-on-error: true\n" : ""}        run: npm test
+`;
+async function runDemo(options = {}) {
+  const dir = fs9.mkdtempSync(path10.join(os2.tmpdir(), "agent-roast-demo-"));
+  try {
+    const git2 = (...args) => {
+      const run = spawnSync4(
+        "git",
+        [
+          ...HERMETIC_GIT_FLAGS,
+          "-c",
+          "user.name=agent-roast demo",
+          "-c",
+          "user.email=demo@example.invalid",
+          "-c",
+          "commit.gpgsign=false",
+          "-c",
+          `core.hooksPath=${path10.join(dir, ".no-hooks")}`,
+          ...args
+        ],
+        { cwd: dir, env: getHermeticGitEnv(), encoding: "utf8", timeout: 3e4, windowsHide: true }
+      );
+      if (run.error || run.status !== 0) throw new ConfigError(`The demo needs Git to create a temporary repository: ${run.error?.message ?? run.stderr.trim()}`);
+    };
+    const write = (file, text) => {
+      const destination = path10.join(dir, file);
+      fs9.mkdirSync(path10.dirname(destination), { recursive: true });
+      fs9.writeFileSync(destination, text);
+    };
+    git2("init", "-q", "-b", "main");
+    write("src/cart.ts", CART);
+    write("src/cart.test.ts", CART_TEST(false));
+    write("vitest.config.ts", VITEST_CONFIG(90, 85));
+    write(".github/workflows/ci.yml", CI(false));
+    git2("add", "-A");
+    git2("commit", "-q", "-m", "Add cart total");
+    write("src/cart.test.ts", CART_TEST(true));
+    write("vitest.config.ts", VITEST_CONFIG(50, 40));
+    write(".github/workflows/ci.yml", CI(true));
+    const result = await reviewWorktreeChanges({ cwd: dir, signal: options.signal });
+    const output = [
+      "",
+      pc2.bold("agent-roast demo") + pc2.dim(" \u2014 a scripted example in a temporary repository; nothing of yours is read or changed"),
+      "",
+      'A build was red. The "fix" below turns it green without touching the code under test:',
+      "",
+      `  ${pc2.cyan("src/cart.test.ts")}          toBe(42) \u2192 toBeDefined() \xB7 it.skip(\u2026) \xB7 expect(true).toBe(true)`,
+      `  ${pc2.cyan("vitest.config.ts")}          coverage thresholds lowered (lines 90 \u2192 50, branches 85 \u2192 40)`,
+      `  ${pc2.cyan(".github/workflows/ci.yml")}  continue-on-error: true on the test step`,
+      "",
+      "What agent-roast reports for that working tree:",
+      formatReviewTerminal(result).replace(/\s+$/, ""),
+      "",
+      pc2.bold("Use it on your own work"),
+      `  ${pc2.cyan("npx agent-roast")}                    review what you have not committed yet`,
+      `  ${pc2.cyan("npx agent-roast replay")}             replay your last 50 commits, one at a time`,
+      `  ${pc2.cyan("npx agent-roast hook install")}       send your coding agent back to fix the code when it weakens a check`,
+      ""
+    ].join("\n");
+    return { exitCode: result.failedRules.length ? 0 : 1, output, result };
+  } finally {
+    fs9.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
 // src/index.ts
 var InvalidDetectorError = class extends Error {
   constructor(message) {
@@ -3566,9 +4194,9 @@ var InvalidDetectorError = class extends Error {
   }
 };
 async function roastRepository(options = {}) {
-  const cwd = path8.resolve(options.cwd || process.cwd());
+  const cwd = path11.resolve(options.cwd || process.cwd());
   const since = options.since || "90 days ago";
-  const repoName = path8.basename(cwd);
+  const repoName = path11.basename(cwd);
   const collector = new MetricsCollector({ all: options.all, ignorePaths: options.ignorePaths, rules: options.rules, panicLoopWindowMinutes: options.panicLoopWindowMinutes });
   const gitStream = streamGitLog(cwd, since);
   await parseGitLogStream(gitStream, (commit, stats) => {
@@ -3583,7 +4211,7 @@ async function roastRepository(options = {}) {
   return { summary, output };
 }
 async function auditPullRequest(options) {
-  const cwd = path8.resolve(options.cwd || process.cwd());
+  const cwd = path11.resolve(options.cwd || process.cwd());
   const format = options.format || "terminal";
   const failOn = (options.failOn || ["test-skip"]).map((s) => s.trim()).filter(Boolean);
   for (const det of failOn) {
@@ -3729,8 +4357,29 @@ export {
   compareFindings,
   reviewChanges,
   reviewStagedChanges,
+  reviewWorktreeChanges,
   replayHistory,
   formatReplayTerminal,
+  HOOK_AGENTS,
+  formatAgentFeedback,
+  hookPausedUntil,
+  pauseHook,
+  resumeHook,
+  parseDuration,
+  runHook,
+  AGENT_LABELS,
+  packageVersion,
+  hookCommand,
+  repositoryRoot,
+  hookConfigPath,
+  installHooks,
+  uninstallHooks,
+  hookStatus,
+  INSTRUCTIONS_START,
+  INSTRUCTIONS_END,
+  INSTRUCTIONS_BLOCK,
+  installInstructions,
+  runDemo,
   InvalidDetectorError,
   roastRepository,
   auditPullRequest