agent-roast 0.2.1 → 0.3.0

package/README.md

@@ -18,17 +18,23 @@
 
 </div>
 
-`agent-roast` scans recorded git diffs for shortcuts taken by AI coding assistants (Claude Code, Cursor, Codex, Antigravity, Aider). It checks for skipped tests, compiler type escapes (`as any`), swallowed errors, and panic revert loops, then outputs a discipline score and line proofs. 100% offline, zero API keys, zero telemetry.
+`agent-roast` scans recorded git diffs for shortcuts taken by AI coding assistants (Claude Code, Cursor, Codex, Antigravity, Aider). It checks for skipped tests, fake tautological assertions, abandoned stubs, compiler type escapes (`as any`), swallowed errors, and panic revert loops, then outputs a discipline score and line proofs. 100% offline, zero API keys, zero telemetry.
 
 ```bash
+# Initialize in your repository (creates .agentroastrc.json)
+npx agent-roast init
+npx agent-roast init --ci      # generate .github/workflows/agent-roast.yml
+npx agent-roast init --hook    # install .git/hooks/pre-commit
+
 # Audit repository history
 npx agent-roast            # scan AI-attributed commits (last 90 days)
 npx agent-roast --all      # scan entire repository history
 npx agent-roast --verbose  # show commit SHAs and line proofs
+npx agent-roast --fail-under 70 # exit code 1 if score is below 70
 
 # Audit pull request diffs (CI gate)
 npx agent-roast --base origin/main --head HEAD
-npx agent-roast --base origin/main --head HEAD --fail-on test-skip,swallowed-error --format github
+npx agent-roast --base origin/main --head HEAD --fail-on test-skip,trivial-assert,stub-abandonment --format github
 ```
 
 What a report looks like (a real repository audit, trimmed):
@@ -50,6 +56,12 @@ INFRACTIONS DETECTED (42)
   ● test-skip (6) — disabled or skipped test suites
       e.g. tests/test_outbound.py:18 — pytest.skip(...)
 
+  ● trivial-assert (2) — tautological assertions faking test coverage
+      e.g. tests/auth.test.ts:31 — expect(true).toBe(true)
+
+  ● stub-abandonment (1) — incomplete stubs left behind
+      e.g. src/payment.ts:18 — throw new Error("Not implemented")
+
   ● swallowed-error (2) — empty catch blocks or except: pass
 ```
 
@@ -59,12 +71,38 @@ INFRACTIONS DETECTED (42)
 
 ---
 
+### Configuration (`.agentroastrc.json`)
+
+Configure custom ignore paths, rule severities, and CI thresholds with a `.agentroastrc.json` file in your repository root:
+
+```json
+{
+  "$schema": "https://raw.githubusercontent.com/sidzuya/agent-roast/main/schema.json",
+  "ignorePaths": [
+    "**/*.min.js",
+    "**/vendor/**",
+    "**/dist/**",
+    "**/fixtures/**"
+  ],
+  "rules": {
+    "hallucinated-package": "error",
+    "empty-catch": "warn",
+    "trivial-assert": "warn",
+    "stub-abandonment": "warn",
+    "mock-leak": "warn"
+  },
+  "scoreThreshold": 70
+}
+```
+
+---
+
 ### GitHub Actions Integration
 
-Add `agent-roast` as a gate in your pull request workflow (`.github/workflows/audit.yml`):
+Add `agent-roast` as a gate in your pull request workflow (`.github/workflows/agent-roast.yml`):
 
 ```yaml
-name: Agent Audit
+name: Agent Roast
 on:
   pull_request:
     branches: [main]
@@ -83,7 +121,7 @@ jobs:
       - name: Run agent-roast audit
         uses: Nari-Ab/agent-roast@v1
         with:
-          fail-on: test-skip
+          fail-on: test-skip,trivial-assert,stub-abandonment
           format: github
 ```
 
@@ -96,6 +134,8 @@ jobs:
 Only **added lines** (`+`) in source code files are scanned — deleted lines, file moves, and comments never trigger false alarms.
 
 - **Skipped tests (`test-skip`):** `it.skip`, `describe.skip`, `xit`, `pytest.skip`, `test.todo` added to silence failing tests. (Default blocking gate).
+- **Trivial assertions (`trivial-assert`):** Tautological or dummy assertions added to fabricate test green checks (`expect(true).toBe(true)`, `expect(1).toBe(1)`, `assert True`, `self.assertTrue(True)`).
+- **Stub abandonment (`stub-abandonment`):** Dummy stubs left unimplemented in committed code (`throw new Error("Not implemented")`, `raise NotImplementedError`, Rust `todo!()` / `unimplemented!()`).
 - **Type escapes (`type-escape`):** `as any`, `as unknown as`, `as never`, `// @ts-ignore`, `// @ts-nocheck`, `// @ts-expect-error`, `# type: ignore`, `# noqa`, `eslint-disable`.
 - **Swallowed errors (`swallowed-error`):** Empty `catch {}` or `except: pass` blocks hiding runtime failures.
 - **Panic fix loops (`panic-loop`):** Heuristic chain analysis of rapid-fire fix/revert commits by the same author within 15 minutes touching overlapping files. *(Observational metric for repository audits; not a PR blocker)*.

package/dist/{chunk-XUNF5YCA.js → chunk-SMZZAGFS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import path from "path";
+import path3 from "path";
 
 // src/git.ts
 import { spawn, spawnSync } from "child_process";
@@ -136,12 +136,12 @@ async function parseGitLogStream(stream, onCommit) {
       { skippedLongLines, skippedUnknownFiles }
     );
   };
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let settled = false;
     const safeResolve = (val) => {
       if (!settled) {
         settled = true;
-        resolve(val);
+        resolve2(val);
       }
     };
     const safeReject = (err) => {
@@ -542,6 +542,90 @@ var GitResolutionError = class extends Error {
   }
 };
 
+// src/config.ts
+import * as fs from "fs";
+import * as path from "path";
+var DEFAULT_CONFIG = {
+  failOn: ["test-skip", "trivial-assert"],
+  ignorePaths: [
+    "**/fixtures/**",
+    "**/__fixtures__/**",
+    "**/testdata/**",
+    "**/mocks/**",
+    "**/test_data/**",
+    "**/__snapshots__/**",
+    "**/sample/**",
+    "**/samples/**"
+  ],
+  scoreThreshold: 70,
+  rules: {
+    "test-skip": "error",
+    "trivial-assert": "error",
+    "swallowed-error": "warn",
+    "stub-abandonment": "warn",
+    "type-escape": "warn"
+  }
+};
+var CONFIG_FILENAMES = [
+  ".agentroastrc.json",
+  ".agentroastrc",
+  "agent-roast.config.json"
+];
+function loadConfig(cwd = process.cwd()) {
+  for (const filename of CONFIG_FILENAMES) {
+    const filePath = path.join(cwd, filename);
+    if (fs.existsSync(filePath)) {
+      try {
+        const raw = fs.readFileSync(filePath, "utf8");
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === "object" && parsed !== null) {
+          return {
+            ...DEFAULT_CONFIG,
+            ...parsed,
+            failOn: Array.isArray(parsed.failOn) ? parsed.failOn : DEFAULT_CONFIG.failOn,
+            ignorePaths: Array.isArray(parsed.ignorePaths) ? Array.from(/* @__PURE__ */ new Set([...DEFAULT_CONFIG.ignorePaths || [], ...parsed.ignorePaths])) : DEFAULT_CONFIG.ignorePaths,
+            rules: {
+              ...DEFAULT_CONFIG.rules,
+              ...parsed.rules || {}
+            }
+          };
+        }
+      } catch (err) {
+        console.warn(`Warning: Failed to parse ${filename}: ${err.message}. Using default configuration.`);
+      }
+    }
+  }
+  return { ...DEFAULT_CONFIG };
+}
+function matchIgnorePath(filePath, ignorePatterns) {
+  if (!ignorePatterns || ignorePatterns.length === 0) {
+    return false;
+  }
+  const normalized = filePath.replace(/\\/g, "/");
+  for (const pattern of ignorePatterns) {
+    if (!pattern) continue;
+    const cleanPattern = pattern.replace(/\\/g, "/");
+    let regexPattern = cleanPattern.replace(/[.+^${}()|[\]]/g, "\\$&").replace(/\*\*\//g, "(?:^|.*?/)").replace(/\/\*\*/g, "(?:/.*)?").replace(/\*/g, "[^/]*");
+    if (!regexPattern.startsWith("^") && !regexPattern.startsWith("(?:^")) {
+      regexPattern = "(?:^|/)" + regexPattern;
+    }
+    if (!regexPattern.endsWith("$")) {
+      regexPattern = regexPattern + "(?:$|/)";
+    }
+    try {
+      const rx = new RegExp(regexPattern, "i");
+      if (rx.test(normalized)) {
+        return true;
+      }
+    } catch {
+      if (normalized.includes(cleanPattern.replace(/\*/g, ""))) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
 // src/metrics.ts
 var TEST_SKIP_PATTERNS = [
   { regex: /(?:it|test|describe)\.skip\b/, name: "skipped test (it.skip / describe.skip)" },
@@ -567,6 +651,21 @@ var SWALLOWED_ERROR_PATTERNS = [
   { regex: /catch\s*(?:\([^)]*\))?\s*\{\s*\}/, name: "empty catch block (catch {})" },
   { regex: /except(?:\s+[^:]*)?:\s*pass\b/, name: "silent python error swallow (except: pass)" }
 ];
+var TRIVIAL_ASSERT_PATTERNS = [
+  { regex: /expect\s*\(\s*(?:true|false|1|0|null|undefined)\s*\)\.toBe\s*\(\s*(?:true|false|1|0|null|undefined)\s*\)/, name: "trivial assertion (expect(val).toBe(val))" },
+  { regex: /expect\s*\(\s*(?:true|false|1|0|null|undefined)\s*\)\.toEqual\s*\(\s*(?:true|false|1|0|null|undefined)\s*\)/, name: "trivial assertion (expect(val).toEqual(val))" },
+  { regex: /\bassert\s+(?:True|False|1\s*==\s*1)\b/, name: "trivial python assert (assert True / 1 == 1)" },
+  { regex: /self\.assertTrue\s*\(\s*(?:True|1)\s*\)/, name: "trivial assert (self.assertTrue(True))" },
+  { regex: /self\.assertEqual\s*\(\s*(?:1\s*,\s*1|True\s*,\s*True)\s*\)/, name: "trivial assert (self.assertEqual(1, 1))" },
+  { regex: /assert\.(?:strictEqual|equal)\s*\(\s*(?:true\s*,\s*true|1\s*,\s*1)\s*\)/, name: "trivial assert (assert.equal(1, 1))" }
+];
+var STUB_ABANDONMENT_PATTERNS = [
+  { regex: /\bthrow\s+new\s+Error\s*\(\s*["'](?:TODO|Not implemented|to be implemented|stub|implement me)/i, name: "unimplemented stub (throw new Error('Not implemented'))" },
+  { regex: /\braise\s+NotImplementedError\b/, name: "unimplemented stub (raise NotImplementedError)" },
+  { regex: /\braise\s+NotImplemented\b/, name: "unimplemented stub (raise NotImplemented)" },
+  { regex: /\btodo!\s*\(\s*\)/, name: "unimplemented rust stub (todo!())" },
+  { regex: /\bunimplemented!\s*\(\s*\)/, name: "unimplemented rust stub (unimplemented!())" }
+];
 var CODE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".ts",
   ".tsx",
@@ -588,21 +687,28 @@ var CODE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".c"
 ]);
 var IGNORED_PATH_REGEX = /(?:^|\/)(?:fixtures|__fixtures__|testdata|mocks|test_data|__snapshots__|sample[s]?)\//i;
-function isCodeFile(filePath) {
+var TEST_PATH_REGEX = /(?:^|\/)(?:tests?|__tests__|specs?)\/|[._-](?:test|spec)\.[a-z0-9]+$/i;
+function isCodeFile(filePath, customIgnorePaths) {
   if (IGNORED_PATH_REGEX.test(filePath)) {
     return false;
   }
+  if (customIgnorePaths && matchIgnorePath(filePath, customIgnorePaths)) {
+    return false;
+  }
   const ext = filePath.slice(filePath.lastIndexOf(".")).toLowerCase();
   return CODE_EXTENSIONS.has(ext);
 }
-function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ */ new Date()).toISOString()) {
+function isTestFile(filePath) {
+  return TEST_PATH_REGEX.test(filePath);
+}
+function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ */ new Date()).toISOString(), options = {}) {
   const infractions = [];
   let hasSupportedChanges = false;
   let filesInspected = 0;
   let linesAdded = 0;
   for (const file of files) {
     if (file.deleted || file.path === "unknown") continue;
-    if (!isCodeFile(file.path)) continue;
+    if (!isCodeFile(file.path, options.ignorePaths)) continue;
     hasSupportedChanges = true;
     filesInspected++;
     linesAdded += file.addedLines.length;
@@ -675,6 +781,38 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
           }
         }
       }
+      if (!isComment && isTestFile(file.path)) {
+        for (const rule of TRIVIAL_ASSERT_PATTERNS) {
+          if (rule.regex.test(cleanedLine)) {
+            infractions.push({
+              type: "trivial-assert",
+              file: file.path,
+              lineNumber: added.lineNumber,
+              lineSnippet: rawLine.trim(),
+              commitHash,
+              commitDate,
+              reason: rule.name
+            });
+            break;
+          }
+        }
+      }
+      if (!isComment) {
+        for (const rule of STUB_ABANDONMENT_PATTERNS) {
+          if (rule.regex.test(rawLine)) {
+            infractions.push({
+              type: "stub-abandonment",
+              file: file.path,
+              lineNumber: added.lineNumber,
+              lineSnippet: rawLine.trim(),
+              commitHash,
+              commitDate,
+              reason: rule.name
+            });
+            break;
+          }
+        }
+      }
     }
   }
   return { infractions, hasSupportedChanges, filesInspected, linesAdded };
@@ -697,12 +835,16 @@ var MetricsCollector = class {
   typeEscapes = [];
   swallowedErrors = [];
   panicLoops = [];
+  trivialAsserts = [];
+  stubAbandonments = [];
   skippedLongLines = 0;
   skippedUnknownFiles = 0;
   activePanicChain = null;
   includeAll;
+  ignorePaths;
   constructor(options = {}) {
     this.includeAll = options.all ?? false;
+    this.ignorePaths = options.ignorePaths;
   }
   recordSkipped(stats) {
     if (stats.skippedLongLines) this.skippedLongLines += stats.skippedLongLines;
@@ -788,8 +930,10 @@ var MetricsCollector = class {
     let commitSkips = 0;
     let commitEscapes = 0;
     let commitSwallowed = 0;
+    let commitTrivial = 0;
+    let commitStubs = 0;
     for (const file of commit.files) {
-      if (!isCodeFile(file.path)) {
+      if (!isCodeFile(file.path, this.ignorePaths)) {
         continue;
       }
       for (const added of file.addedLines) {
@@ -865,6 +1009,40 @@ var MetricsCollector = class {
             }
           }
         }
+        if (!isComment && isTestFile(file.path) && commitTrivial < MAX_INFRACTIONS_PER_COMMIT) {
+          for (const rule of TRIVIAL_ASSERT_PATTERNS) {
+            if (rule.regex.test(cleanedLine)) {
+              this.trivialAsserts.push({
+                type: "trivial-assert",
+                file: file.path,
+                lineNumber: added.lineNumber,
+                lineSnippet: rawLine.trim(),
+                commitHash: commit.hash,
+                commitDate: commit.date,
+                reason: rule.name
+              });
+              commitTrivial++;
+              break;
+            }
+          }
+        }
+        if (!isComment && commitStubs < MAX_INFRACTIONS_PER_COMMIT) {
+          for (const rule of STUB_ABANDONMENT_PATTERNS) {
+            if (rule.regex.test(rawLine)) {
+              this.stubAbandonments.push({
+                type: "stub-abandonment",
+                file: file.path,
+                lineNumber: added.lineNumber,
+                lineSnippet: rawLine.trim(),
+                commitHash: commit.hash,
+                commitDate: commit.date,
+                reason: rule.name
+              });
+              commitStubs++;
+              break;
+            }
+          }
+        }
       }
     }
   }
@@ -872,7 +1050,7 @@ var MetricsCollector = class {
     this.flushPanicChain();
     const linesSample = this.includeAll ? this.totalLinesAdded : this.aiLinesAdded;
     const isSufficientData = linesSample >= MIN_SAMPLE_LOC;
-    const codeInfractionPoints = this.testSkips.length * 15 + this.swallowedErrors.length * 10 + this.typeEscapes.length * 3;
+    const codeInfractionPoints = this.testSkips.length * 15 + this.trivialAsserts.length * 15 + this.swallowedErrors.length * 10 + this.stubAbandonments.length * 8 + this.typeEscapes.length * 3;
     let panicInfractionPoints = 0;
     for (const loop of this.panicLoops) {
       const countMatch = loop.reason.match(/chain of (\d+) quick fixes/);
@@ -901,16 +1079,24 @@ var MetricsCollector = class {
         }
       } else {
         const testSkipPoints = this.testSkips.length * 15;
+        const trivialPoints = this.trivialAsserts.length * 15;
         const panicPoints = this.panicLoops.length * 8;
+        const stubPoints = this.stubAbandonments.length * 8;
         const escapePoints = this.typeEscapes.length * 3;
         const swallowPoints = this.swallowedErrors.length * 10;
-        const maxPoints = Math.max(testSkipPoints, panicPoints, escapePoints, swallowPoints);
+        const maxPoints = Math.max(testSkipPoints, trivialPoints, panicPoints, stubPoints, escapePoints, swallowPoints);
         if (maxPoints === panicPoints && this.panicLoops.length >= 2) {
           archetype = "The Panic Looper";
           archetypeDescription = "Prone to rapid-fire fix and revert thrashing cycles when wrestling stubborn bugs.";
         } else if (maxPoints === testSkipPoints && this.testSkips.length >= 3) {
           archetype = "The Silent Vandal";
           archetypeDescription = "When test suites push back, tends to disable or skip tests to keep pipelines green.";
+        } else if (maxPoints === trivialPoints && this.trivialAsserts.length >= 2) {
+          archetype = "The Fake Asserter";
+          archetypeDescription = "Masks broken tests by replacing real assertions with trivial expect(true).toBe(true) or assert True.";
+        } else if (maxPoints === stubPoints && this.stubAbandonments.length >= 2) {
+          archetype = "The Stub Abandoner";
+          archetypeDescription = "Rushes through implementations by leaving unimplemented placeholders and TODO throws.";
         } else if (maxPoints === escapePoints && this.typeEscapes.length >= 5) {
           archetype = "The Any Architect";
           archetypeDescription = "Leans on compiler bypasses (`as any`, `@ts-ignore`) rather than strict type modeling.";
@@ -936,6 +1122,8 @@ var MetricsCollector = class {
       typeEscapes: this.typeEscapes,
       swallowedErrors: this.swallowedErrors,
       panicLoops: this.panicLoops,
+      trivialAsserts: this.trivialAsserts,
+      stubAbandonments: this.stubAbandonments,
       rawScore: totalInfractionPoints,
       score,
       isSufficientData,
@@ -986,26 +1174,26 @@ function formatTerminalCard(summary, options) {
   );
   lines.push(`  ${pc.dim(summary.archetypeDescription)}`);
   lines.push("");
-  const totalInfractions = summary.testSkips.length + summary.typeEscapes.length + summary.swallowedErrors.length + summary.panicLoops.length;
+  const totalInfractions = (summary.testSkips?.length || 0) + (summary.typeEscapes?.length || 0) + (summary.swallowedErrors?.length || 0) + (summary.panicLoops?.length || 0) + (summary.trivialAsserts?.length || 0) + (summary.stubAbandonments?.length || 0);
   lines.push(pc.bold(`  INFRACTIONS (${totalInfractions})`));
   lines.push(pc.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  if (summary.panicLoops.length > 0) {
+  if (summary.panicLoops && summary.panicLoops.length > 0) {
     lines.push(
       `  ${pc.magenta("\u25CF")} ${pc.bold("panic-loop")} (${summary.panicLoops.length})  ${pc.dim("consecutive quick fixes < 15m apart")}`
     );
     const sample = summary.panicLoops[0];
     lines.push(`      ${pc.dim(sample.reason)}`);
   }
-  if (summary.typeEscapes.length > 0) {
+  if (summary.trivialAsserts && summary.trivialAsserts.length > 0) {
     lines.push(
-      `  ${pc.yellow("\u25CF")} ${pc.bold("type-escape")} (${summary.typeEscapes.length})  ${pc.dim("compiler bypasses (as any, @ts-ignore)")}`
+      `  ${pc.red("\u25CF")} ${pc.bold("trivial-assert")} (${summary.trivialAsserts.length})  ${pc.dim("vacuous test assertions (expect(true).toBe(true), assert True)")}`
     );
-    const sample = summary.typeEscapes[0];
+    const sample = summary.trivialAsserts[0];
     if (sample.file) {
       lines.push(`      ${pc.dim(`${sample.file}: ${sample.lineSnippet || ""}`)}`);
     }
   }
-  if (summary.testSkips.length > 0) {
+  if (summary.testSkips && summary.testSkips.length > 0) {
     lines.push(
       `  ${pc.red("\u25CF")} ${pc.bold("test-skip")} (${summary.testSkips.length})  ${pc.dim("skipped or disabled tests")}`
     );
@@ -1014,7 +1202,7 @@ function formatTerminalCard(summary, options) {
       lines.push(`      ${pc.dim(`${sample.file}: ${sample.lineSnippet || ""}`)}`);
     }
   }
-  if (summary.swallowedErrors.length > 0) {
+  if (summary.swallowedErrors && summary.swallowedErrors.length > 0) {
     lines.push(
       `  ${pc.red("\u25CF")} ${pc.bold("swallowed-error")} (${summary.swallowedErrors.length})  ${pc.dim("empty catch blocks or except: pass")}`
     );
@@ -1023,6 +1211,24 @@ function formatTerminalCard(summary, options) {
       lines.push(`      ${pc.dim(`${sample.file}: ${sample.lineSnippet || ""}`)}`);
     }
   }
+  if (summary.stubAbandonments && summary.stubAbandonments.length > 0) {
+    lines.push(
+      `  ${pc.yellow("\u25CF")} ${pc.bold("stub-abandonment")} (${summary.stubAbandonments.length})  ${pc.dim("unimplemented placeholders (throw new Error('TODO'), NotImplementedError)")}`
+    );
+    const sample = summary.stubAbandonments[0];
+    if (sample.file) {
+      lines.push(`      ${pc.dim(`${sample.file}: ${sample.lineSnippet || ""}`)}`);
+    }
+  }
+  if (summary.typeEscapes && summary.typeEscapes.length > 0) {
+    lines.push(
+      `  ${pc.yellow("\u25CF")} ${pc.bold("type-escape")} (${summary.typeEscapes.length})  ${pc.dim("compiler bypasses (as any, @ts-ignore)")}`
+    );
+    const sample = summary.typeEscapes[0];
+    if (sample.file) {
+      lines.push(`      ${pc.dim(`${sample.file}: ${sample.lineSnippet || ""}`)}`);
+    }
+  }
   if (totalInfractions === 0) {
     lines.push(`  ${pc.green("\u25CF")} ${pc.dim("zero infractions detected across all inspected lines.")}`);
   }
@@ -1040,10 +1246,12 @@ function formatTerminalCard(summary, options) {
       lines.push("");
     }
     const allInfractions = [
-      ...summary.testSkips,
-      ...summary.typeEscapes,
-      ...summary.swallowedErrors,
-      ...summary.panicLoops
+      ...summary.testSkips || [],
+      ...summary.trivialAsserts || [],
+      ...summary.swallowedErrors || [],
+      ...summary.stubAbandonments || [],
+      ...summary.typeEscapes || [],
+      ...summary.panicLoops || []
     ];
     if (allInfractions.length > 0) {
       lines.push(pc.bold("  EVIDENCE (First 10 occurrences):"));
@@ -1109,7 +1317,7 @@ function formatPrTerminalCard(result) {
 }
 function sortInfractionsDeterministic(infractions) {
   const getLevelRank = (type) => {
-    return type === "test-skip" || type === "swallowed-error" ? 0 : 1;
+    return type === "test-skip" || type === "trivial-assert" || type === "swallowed-error" ? 0 : 1;
   };
   return [...infractions].sort((a, b) => {
     const rankDiff = getLevelRank(a.type) - getLevelRank(b.type);
@@ -1129,7 +1337,7 @@ function formatGithubAnnotations(result) {
   let omittedCount = 0;
   for (const inf of sorted) {
     if (!inf.file || inf.file === "unknown") continue;
-    const isError = result.failedRules.includes(inf.type) || inf.type === "test-skip" || inf.type === "swallowed-error";
+    const isError = result.failedRules.includes(inf.type) || inf.type === "test-skip" || inf.type === "trivial-assert" || inf.type === "swallowed-error";
     const line = inf.lineNumber || 1;
     const title = inf.reason.replace(/[\r\n]/g, " ");
     const msg = (inf.lineSnippet || inf.reason).replace(/[\r\n]/g, " ");
@@ -1195,9 +1403,115 @@ var VALID_DETECTORS = [
   "test-skip",
   "type-escape",
   "swallowed-error",
-  "panic-loop"
+  "panic-loop",
+  "trivial-assert",
+  "stub-abandonment"
 ];
 
+// src/init.ts
+import * as fs2 from "fs";
+import * as path2 from "path";
+var DEFAULT_CONFIG_TEMPLATE = {
+  $schema: "https://raw.githubusercontent.com/sidzuya/agent-roast/main/schema.json",
+  ignorePaths: [
+    "**/*.min.js",
+    "**/vendor/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/fixtures/**"
+  ],
+  rules: {
+    "hallucinated-package": "error",
+    "empty-catch": "warn",
+    "trivial-assert": "warn",
+    "stub-abandonment": "warn",
+    "mock-leak": "warn"
+  },
+  scoreThreshold: 70
+};
+var GITHUB_WORKFLOW_TEMPLATE = `name: Agent Roast
+on:
+  pull_request:
+    branches: [main, master]
+  push:
+    branches: [main, master]
+
+jobs:
+  audit:
+    name: Audit AI Shortcuts
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Run agent-roast PR check
+        if: github.event_name == 'pull_request'
+        run: npx agent-roast --base \${{ github.event.pull_request.base.sha }} --head \${{ github.event.pull_request.head.sha }} --format github
+
+      - name: Run agent-roast repo audit
+        if: github.event_name != 'pull_request'
+        run: npx agent-roast --fail-under 70
+`;
+var PRE_COMMIT_HOOK_TEMPLATE = `#!/bin/sh
+# Run agent-roast pre-commit verification
+npx agent-roast --fail-under 70
+`;
+async function initProject(options = {}) {
+  const cwd = path2.resolve(options.cwd || process.cwd());
+  const created = [];
+  const skipped = [];
+  const configPath = path2.join(cwd, ".agentroastrc.json");
+  const altConfigPath = path2.join(cwd, "agent-roast.config.json");
+  if (fs2.existsSync(configPath) || fs2.existsSync(altConfigPath)) {
+    skipped.push(".agentroastrc.json");
+  } else {
+    fs2.writeFileSync(
+      configPath,
+      JSON.stringify(DEFAULT_CONFIG_TEMPLATE, null, 2) + "\n",
+      "utf-8"
+    );
+    created.push(".agentroastrc.json");
+  }
+  if (options.ci) {
+    const workflowDir = path2.join(cwd, ".github", "workflows");
+    const workflowPath = path2.join(workflowDir, "agent-roast.yml");
+    if (fs2.existsSync(workflowPath)) {
+      skipped.push(".github/workflows/agent-roast.yml");
+    } else {
+      fs2.mkdirSync(workflowDir, { recursive: true });
+      fs2.writeFileSync(workflowPath, GITHUB_WORKFLOW_TEMPLATE, "utf-8");
+      created.push(".github/workflows/agent-roast.yml");
+    }
+  }
+  if (options.hook) {
+    const gitDir = path2.join(cwd, ".git");
+    if (!fs2.existsSync(gitDir) || !fs2.statSync(gitDir).isDirectory()) {
+      skipped.push(".git/hooks/pre-commit (no .git directory found)");
+    } else {
+      const hooksDir = path2.join(gitDir, "hooks");
+      const hookPath = path2.join(hooksDir, "pre-commit");
+      if (fs2.existsSync(hookPath)) {
+        skipped.push(".git/hooks/pre-commit");
+      } else {
+        fs2.mkdirSync(hooksDir, { recursive: true });
+        fs2.writeFileSync(hookPath, PRE_COMMIT_HOOK_TEMPLATE, {
+          encoding: "utf-8",
+          mode: 493
+        });
+        created.push(".git/hooks/pre-commit");
+      }
+    }
+  }
+  return { created, skipped };
+}
+
 // src/index.ts
 var InvalidDetectorError = class extends Error {
   constructor(message) {
@@ -1206,10 +1520,10 @@ var InvalidDetectorError = class extends Error {
   }
 };
 async function roastRepository(options = {}) {
-  const cwd = path.resolve(options.cwd || process.cwd());
+  const cwd = path3.resolve(options.cwd || process.cwd());
   const since = options.since || "90 days ago";
-  const repoName = path.basename(cwd);
-  const collector = new MetricsCollector({ all: options.all });
+  const repoName = path3.basename(cwd);
+  const collector = new MetricsCollector({ all: options.all, ignorePaths: options.ignorePaths });
   const gitStream = streamGitLog(cwd, since);
   await parseGitLogStream(gitStream, (commit, stats) => {
     collector.processCommit(commit);
@@ -1223,7 +1537,7 @@ async function roastRepository(options = {}) {
   return { summary, output };
 }
 async function auditPullRequest(options) {
-  const cwd = path.resolve(options.cwd || process.cwd());
+  const cwd = path3.resolve(options.cwd || process.cwd());
   const format = options.format || "terminal";
   const failOn = (options.failOn || ["test-skip"]).map((s) => s.trim()).filter(Boolean);
   for (const det of failOn) {
@@ -1238,15 +1552,15 @@ async function auditPullRequest(options) {
   const mergeBaseSha = findMergeBase(cwd, baseSha, headSha);
   const diffStream = streamGitDiff(cwd, mergeBaseSha, headSha);
   let rawDiff = "";
-  await new Promise((resolve, reject) => {
+  await new Promise((resolve2, reject) => {
     diffStream.on("data", (chunk) => {
       rawDiff += chunk.toString();
     });
-    diffStream.on("end", () => resolve());
+    diffStream.on("end", () => resolve2());
     diffStream.on("error", reject);
   });
   const { files, skippedLongLines, skippedUnknownFiles } = parseDiff(rawDiff);
-  const audit = auditFileDiffs(files, headSha);
+  const audit = auditFileDiffs(files, headSha, (/* @__PURE__ */ new Date()).toISOString(), { ignorePaths: options.ignorePaths });
   const infractions = audit.infractions;
   const defectDensityPer100Lines = audit.linesAdded > 0 ? Math.round(infractions.length / audit.linesAdded * 100 * 100) / 100 : 0;
   const failedRules = [...new Set(
@@ -1296,7 +1610,11 @@ export {
   resolveCommitSha,
   findMergeBase,
   GitResolutionError,
+  DEFAULT_CONFIG,
+  loadConfig,
+  matchIgnorePath,
   isCodeFile,
+  isTestFile,
   auditFileDiffs,
   stripStringAndRegexLiterals,
   MetricsCollector,
@@ -1306,6 +1624,10 @@ export {
   formatGithubAnnotations,
   formatGithubStepSummary,
   VALID_DETECTORS,
+  DEFAULT_CONFIG_TEMPLATE,
+  GITHUB_WORKFLOW_TEMPLATE,
+  PRE_COMMIT_HOOK_TEMPLATE,
+  initProject,
   InvalidDetectorError,
   roastRepository,
   auditPullRequest

package/dist/cli.js

@@ -5,8 +5,10 @@ import {
   InvalidDetectorError,
   auditPullRequest,
   formatGithubStepSummary,
+  initProject,
+  loadConfig,
   roastRepository
-} from "./chunk-XUNF5YCA.js";
+} from "./chunk-SMZZAGFS.js";
 
 // src/cli.ts
 import { Command } from "commander";
@@ -15,15 +17,22 @@ import * as fs from "fs";
 var require2 = createRequire(import.meta.url);
 var pkg = require2("../package.json");
 var program = new Command();
-program.name("agent-roast").description("Audit your git history or PR diffs for AI coding shortcuts and panic loops").version(pkg.version || "0.2.0").argument("[path]", "Path to git repository (default: current directory)", ".").option("-a, --all", "Audit ALL commits regardless of AI attribution tags", false).option("-s, --since <time>", "Time window for git analysis", "90 days ago").option("-v, --verbose", "Show commit SHAs and line snippets for all infractions", false).option("--json", "Output results as raw JSON", false).option("--base <ref>", "Base git ref/branch for PR mode audit (e.g. origin/main)").option("--head <ref>", "Head git ref/SHA for PR mode audit (default: HEAD)", "HEAD").option("--fail-on <rules>", "Comma-separated detectors that trigger CI failure", "test-skip").option("--format <format>", "Output format: terminal, json, github", "terminal").option("--authors", "Display author names and emails in report", false).action(async (repoPath, options) => {
+program.name("agent-roast").description("Audit your git history or PR diffs for AI coding shortcuts and panic loops").version(pkg.version || "0.3.0").argument("[path]", "Path to git repository (default: current directory)", ".").option("-a, --all", "Audit ALL commits regardless of AI attribution tags", false).option("-s, --since <time>", "Time window for git analysis", "90 days ago").option("-v, --verbose", "Show commit SHAs and line snippets for all infractions", false).option("--json", "Output results as raw JSON", false).option("--base <ref>", "Base git ref/branch for PR mode audit (e.g. origin/main)").option("--head <ref>", "Head git ref/SHA for PR mode audit (default: HEAD)", "HEAD").option("--fail-on <rules>", "Comma-separated detectors that trigger CI failure").option("--fail-under <score>", "Fail CI if agent score is below threshold (0-100)").option("--format <format>", "Output format: terminal, json, github", "terminal").option("--authors", "Display author names and emails in report", false).action(async (repoPath, options) => {
   try {
     if (process.env.GITHUB_EVENT_NAME === "pull_request_target") {
       console.warn(
         "Warning: pull_request_target runs with elevated repository privileges. agent-roast recommends running on 'pull_request'."
       );
     }
+    const config = await loadConfig(repoPath);
     if (options.base) {
-      const failOnRules = options.failOn ? options.failOn.split(",").map((s) => s.trim()).filter(Boolean) : ["test-skip"];
+      let failOnRules;
+      if (options.failOn) {
+        failOnRules = options.failOn.split(",").map((s) => s.trim()).filter(Boolean);
+      } else {
+        const errorRules = Object.entries(config.rules || {}).filter(([_, level]) => level === "error").map(([rule]) => rule);
+        failOnRules = errorRules.length > 0 ? errorRules : ["test-skip"];
+      }
       const chosenFormat = options.json ? "json" : options.format || "terminal";
       const prResult = await auditPullRequest({
         cwd: repoPath,
@@ -32,7 +41,8 @@ program.name("agent-roast").description("Audit your git history or PR diffs for
         failOn: failOnRules,
         format: chosenFormat,
         verbose: options.verbose,
-        authors: options.authors
+        authors: options.authors,
+        ignorePaths: config.ignorePaths
       });
       if (process.env.GITHUB_STEP_SUMMARY) {
         try {
@@ -65,14 +75,20 @@ has-supported-changes=${prResult.hasSupportedChanges}
         since: options.since,
         all: options.all,
         verbose: options.verbose,
-        json: options.json
+        json: options.json,
+        ignorePaths: config.ignorePaths
       });
       if (options.json) {
         console.log(JSON.stringify(result.summary, null, 2));
       } else {
         console.log(result.output);
       }
-      process.exitCode = 0;
+      const scoreThreshold = options.failUnder !== void 0 ? Number(options.failUnder) : config.scoreThreshold;
+      if (scoreThreshold !== void 0 && !isNaN(scoreThreshold) && result.summary.score !== null && result.summary.score < scoreThreshold) {
+        process.exitCode = 1;
+      } else {
+        process.exitCode = 0;
+      }
     }
   } catch (err) {
     if (err instanceof GitResolutionError || err instanceof InvalidDetectorError || err instanceof GitError || err.name === "GitError") {
@@ -84,4 +100,31 @@ has-supported-changes=${prResult.hasSupportedChanges}
     }
   }
 });
+program.command("init").description("Initialize .agentroastrc.json and CI/hook configurations").argument("[dir]", "Directory to initialize", ".").option("-y, --yes", "Skip interactive prompts and use defaults", false).option("--ci", "Generate GitHub Actions workflow file", false).option("--hook", "Install Git pre-commit hook", false).action(async (targetDir, opts) => {
+  try {
+    const res = await initProject({
+      cwd: targetDir,
+      yes: opts.yes,
+      ci: opts.ci,
+      hook: opts.hook
+    });
+    if (res.created.length > 0) {
+      console.log(`Initialized agent-roast in ${targetDir}:`);
+      for (const file of res.created) {
+        console.log(`  + Created ${file}`);
+      }
+    }
+    if (res.skipped.length > 0) {
+      for (const file of res.skipped) {
+        console.log(`  - Skipped ${file} (already exists or not applicable)`);
+      }
+    }
+    if (res.created.length === 0 && res.skipped.length === 0) {
+      console.log("No files were created.");
+    }
+  } catch (err) {
+    console.error(`Failed to initialize agent-roast: ${err.message}`);
+    process.exitCode = 1;
+  }
+});
 program.parse(process.argv);

package/dist/index.d.ts

@@ -9,7 +9,7 @@ interface CommitInfo {
     isAiAttributed: boolean;
     aiSignatures: string[];
 }
-type DetectorType = "test-skip" | "type-escape" | "swallowed-error" | "panic-loop";
+type DetectorType = "test-skip" | "type-escape" | "swallowed-error" | "panic-loop" | "trivial-assert" | "stub-abandonment";
 declare const VALID_DETECTORS: readonly DetectorType[];
 interface Infraction {
     type: DetectorType;
@@ -30,6 +30,8 @@ interface MetricSummary {
     typeEscapes: Infraction[];
     swallowedErrors: Infraction[];
     panicLoops: Infraction[];
+    trivialAsserts: Infraction[];
+    stubAbandonments: Infraction[];
     rawScore: number;
     score: number | null;
     isSufficientData: boolean;
@@ -45,6 +47,8 @@ interface RoastOptions {
     verbose?: boolean;
     json?: boolean;
     authors?: boolean;
+    ignorePaths?: string[];
+    scoreThreshold?: number;
 }
 interface PrAuditOptions {
     cwd?: string;
@@ -54,6 +58,7 @@ interface PrAuditOptions {
     format?: "terminal" | "json" | "github";
     verbose?: boolean;
     authors?: boolean;
+    ignorePaths?: string[];
 }
 interface PrAuditResult {
     schemaVersion: string;
@@ -139,11 +144,14 @@ declare class GitResolutionError extends Error {
     constructor(message: string);
 }
 
-declare function isCodeFile(filePath: string): boolean;
+declare function isCodeFile(filePath: string, customIgnorePaths?: string[]): boolean;
+declare function isTestFile(filePath: string): boolean;
 /**
  * Audits a collection of file diffs (e.g. for PR mode) against detector rules.
  */
-declare function auditFileDiffs(files: ParsedFileDiff[], commitHash?: string, commitDate?: string): {
+declare function auditFileDiffs(files: ParsedFileDiff[], commitHash?: string, commitDate?: string, options?: {
+    ignorePaths?: string[];
+}): {
     infractions: Infraction[];
     hasSupportedChanges: boolean;
     filesInspected: number;
@@ -163,12 +171,16 @@ declare class MetricsCollector {
     private typeEscapes;
     private swallowedErrors;
     private panicLoops;
+    private trivialAsserts;
+    private stubAbandonments;
     private skippedLongLines;
     private skippedUnknownFiles;
     private activePanicChain;
     private includeAll;
+    private ignorePaths?;
     constructor(options?: {
         all?: boolean;
+        ignorePaths?: string[];
     });
     recordSkipped(stats: {
         skippedLongLines?: number;
@@ -195,6 +207,55 @@ declare function formatGithubAnnotations(result: PrAuditResult): string;
  */
 declare function formatGithubStepSummary(result: PrAuditResult): string;
 
+interface AgentRoastConfig {
+    /** Detector rules to fail CI on in PR mode */
+    failOn?: string[];
+    /** Glob patterns or prefixes to ignore from analysis */
+    ignorePaths?: string[];
+    /** Minimum passing score for full repository audits (0-100) */
+    scoreThreshold?: number;
+    /** Granular rule configuration (error | warn | off) */
+    rules?: Record<string, "error" | "warn" | "off">;
+    /** Maximum minutes between fix commits before flagging panic-loop */
+    panicLoopWindowMinutes?: number;
+}
+declare const DEFAULT_CONFIG: AgentRoastConfig;
+/**
+ * Discovers and parses repository configuration file.
+ * Returns DEFAULT_CONFIG if no configuration file is found or if parsing fails.
+ */
+declare function loadConfig(cwd?: string): AgentRoastConfig;
+/**
+ * Matches a relative or normalized file path against an array of glob ignore patterns.
+ */
+declare function matchIgnorePath(filePath: string, ignorePatterns?: string[]): boolean;
+
+interface InitOptions {
+    cwd?: string;
+    yes?: boolean;
+    ci?: boolean;
+    hook?: boolean;
+}
+interface InitResult {
+    created: string[];
+    skipped: string[];
+}
+declare const DEFAULT_CONFIG_TEMPLATE: {
+    $schema: string;
+    ignorePaths: string[];
+    rules: {
+        "hallucinated-package": string;
+        "empty-catch": string;
+        "trivial-assert": string;
+        "stub-abandonment": string;
+        "mock-leak": string;
+    };
+    scoreThreshold: number;
+};
+declare const GITHUB_WORKFLOW_TEMPLATE = "name: Agent Roast\non:\n  pull_request:\n    branches: [main, master]\n  push:\n    branches: [main, master]\n\njobs:\n  audit:\n    name: Audit AI Shortcuts\n    runs-on: ubuntu-latest\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@v4\n        with:\n          fetch-depth: 0\n\n      - name: Setup Node.js\n        uses: actions/setup-node@v4\n        with:\n          node-version: 20\n\n      - name: Run agent-roast PR check\n        if: github.event_name == 'pull_request'\n        run: npx agent-roast --base ${{ github.event.pull_request.base.sha }} --head ${{ github.event.pull_request.head.sha }} --format github\n\n      - name: Run agent-roast repo audit\n        if: github.event_name != 'pull_request'\n        run: npx agent-roast --fail-under 70\n";
+declare const PRE_COMMIT_HOOK_TEMPLATE = "#!/bin/sh\n# Run agent-roast pre-commit verification\nnpx agent-roast --fail-under 70\n";
+declare function initProject(options?: InitOptions): Promise<InitResult>;
+
 declare class InvalidDetectorError extends Error {
     constructor(message: string);
 }
@@ -204,4 +265,4 @@ declare function roastRepository(options?: RoastOptions): Promise<{
 }>;
 declare function auditPullRequest(options: PrAuditOptions): Promise<PrAuditResult>;
 
-export { type AiAttributionResult, type CommitInfo, type DetectorType, FIELD_SEPARATOR, GitError, GitResolutionError, HERMETIC_GIT_FLAGS, type Infraction, InvalidDetectorError, type MetricSummary, MetricsCollector, type ParseDiffResult, type ParsedCommit, type ParsedDiffLine, type ParsedFileDiff, type PrAuditOptions, type PrAuditResult, RECORD_SEPARATOR, type RoastOptions, VALID_DETECTORS, auditFileDiffs, auditPullRequest, detectAiAttribution, findMergeBase, formatGithubAnnotations, formatGithubStepSummary, formatPrTerminalCard, formatTerminalCard, generateShareUrl, getHermeticGitEnv, isCodeFile, parseDiff, parseGitLogStream, resolveCommitSha, roastRepository, streamGitDiff, streamGitLog, stripStringAndRegexLiterals, unquoteGitPath };
+export { type AgentRoastConfig, type AiAttributionResult, type CommitInfo, DEFAULT_CONFIG, DEFAULT_CONFIG_TEMPLATE, type DetectorType, FIELD_SEPARATOR, GITHUB_WORKFLOW_TEMPLATE, GitError, GitResolutionError, HERMETIC_GIT_FLAGS, type Infraction, type InitOptions, type InitResult, InvalidDetectorError, type MetricSummary, MetricsCollector, PRE_COMMIT_HOOK_TEMPLATE, type ParseDiffResult, type ParsedCommit, type ParsedDiffLine, type ParsedFileDiff, type PrAuditOptions, type PrAuditResult, RECORD_SEPARATOR, type RoastOptions, VALID_DETECTORS, auditFileDiffs, auditPullRequest, detectAiAttribution, findMergeBase, formatGithubAnnotations, formatGithubStepSummary, formatPrTerminalCard, formatTerminalCard, generateShareUrl, getHermeticGitEnv, initProject, isCodeFile, isTestFile, loadConfig, matchIgnorePath, parseDiff, parseGitLogStream, resolveCommitSha, roastRepository, streamGitDiff, streamGitLog, stripStringAndRegexLiterals, unquoteGitPath };

package/dist/index.js

@@ -1,11 +1,15 @@
 #!/usr/bin/env node
 import {
+  DEFAULT_CONFIG,
+  DEFAULT_CONFIG_TEMPLATE,
   FIELD_SEPARATOR,
+  GITHUB_WORKFLOW_TEMPLATE,
   GitError,
   GitResolutionError,
   HERMETIC_GIT_FLAGS,
   InvalidDetectorError,
   MetricsCollector,
+  PRE_COMMIT_HOOK_TEMPLATE,
   RECORD_SEPARATOR,
   VALID_DETECTORS,
   auditFileDiffs,
@@ -18,7 +22,11 @@ import {
   formatTerminalCard,
   generateShareUrl,
   getHermeticGitEnv,
+  initProject,
   isCodeFile,
+  isTestFile,
+  loadConfig,
+  matchIgnorePath,
   parseDiff,
   parseGitLogStream,
   resolveCommitSha,
@@ -27,14 +35,18 @@ import {
   streamGitLog,
   stripStringAndRegexLiterals,
   unquoteGitPath
-} from "./chunk-XUNF5YCA.js";
+} from "./chunk-SMZZAGFS.js";
 export {
+  DEFAULT_CONFIG,
+  DEFAULT_CONFIG_TEMPLATE,
   FIELD_SEPARATOR,
+  GITHUB_WORKFLOW_TEMPLATE,
   GitError,
   GitResolutionError,
   HERMETIC_GIT_FLAGS,
   InvalidDetectorError,
   MetricsCollector,
+  PRE_COMMIT_HOOK_TEMPLATE,
   RECORD_SEPARATOR,
   VALID_DETECTORS,
   auditFileDiffs,
@@ -47,7 +59,11 @@ export {
   formatTerminalCard,
   generateShareUrl,
   getHermeticGitEnv,
+  initProject,
   isCodeFile,
+  isTestFile,
+  loadConfig,
+  matchIgnorePath,
   parseDiff,
   parseGitLogStream,
   resolveCommitSha,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-roast",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Zero-telemetry CLI scorecard analyzing git history for AI coding agent infractions and panic loops",
   "type": "module",
   "main": "./dist/index.js",