agent-roast 0.4.0 → 0.5.0

package/dist/{chunk-O4SB2FCT.js → chunk-FUAUIURY.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import path3 from "path";
+import path5 from "path";
 
 // src/git.ts
 import { spawn, spawnSync } from "child_process";
@@ -84,6 +84,8 @@ var HERMETIC_GIT_FLAGS = [
   "-c",
   "core.quotepath=false",
   "-c",
+  "core.fsmonitor=false",
+  "-c",
   "diff.noprefix=false",
   "-c",
   "diff.mnemonicPrefix=false",
@@ -433,7 +435,7 @@ function streamGitLog(cwd = process.cwd(), since = "90 days ago") {
   });
   return output;
 }
-function streamGitDiff(cwd, baseSha, headSha) {
+function streamGitDiff(cwd, baseSha, headSha, staged = false) {
   const gitArgs = [
     ...HERMETIC_GIT_FLAGS,
     "diff",
@@ -443,9 +445,9 @@ function streamGitDiff(cwd, baseSha, headSha) {
     "--no-textconv",
     "--src-prefix=a/",
     "--dst-prefix=b/",
+    ...staged ? ["--cached"] : [],
     "--end-of-options",
-    baseSha,
-    headSha,
+    ...staged ? [] : [baseSha, headSha],
     ...COMMON_EXCLUDE_SPECS
   ];
   const output = new PassThrough();
@@ -542,9 +544,155 @@ var GitResolutionError = class extends Error {
   }
 };
 
+// src/source.ts
+var SourceMasker = class {
+  blockComment = false;
+  quote = "";
+  triple = false;
+  previousLine = 0;
+  python;
+  javascript;
+  hashComments;
+  backticks;
+  constructor(filename) {
+    this.python = filename.endsWith(".py");
+    this.hashComments = this.python || filename.endsWith(".rb");
+    this.backticks = /\.(?:go|[cm]?[jt]sx?|vue|svelte)$/.test(filename);
+    this.javascript = /\.(?:[cm]?[jt]sx?|vue|svelte)$/.test(filename);
+  }
+  mask(line, number) {
+    if (number !== this.previousLine + 1) {
+      this.blockComment = false;
+      this.quote = "";
+      this.triple = false;
+    }
+    this.previousLine = number;
+    const code = Array(line.length).fill(" ");
+    const comments = Array(line.length).fill(" ");
+    let i = 0;
+    let prefix = "";
+    while (i < line.length) {
+      if (this.blockComment) {
+        if (line.startsWith("*/", i)) {
+          this.blockComment = false;
+          i += 2;
+        } else i++;
+        continue;
+      }
+      if (this.quote) {
+        if (line[i] === "\\") {
+          i += 2;
+          continue;
+        }
+        const delimiter = this.triple ? this.quote.repeat(3) : this.quote;
+        if (line.startsWith(delimiter, i)) {
+          i += delimiter.length;
+          this.quote = "";
+          this.triple = false;
+        } else i++;
+        continue;
+      }
+      if (!this.python && line.startsWith("//", i) || this.hashComments && line[i] === "#") {
+        for (let j = i; j < line.length; j++) comments[j] = line[j];
+        break;
+      }
+      if (!this.python && line.startsWith("/*", i)) {
+        this.blockComment = true;
+        i += 2;
+        continue;
+      }
+      const char = line[i];
+      if (char === '"' || char === "'" || this.backticks && char === "`") {
+        this.quote = char;
+        this.triple = this.python && line.startsWith(char.repeat(3), i);
+        i += this.triple ? 3 : 1;
+        prefix += " literal ";
+        continue;
+      }
+      if (this.javascript && char === "/" && (/(?:[=(:,[!&|?{;]|\breturn|\byield)\s*$/.test(prefix) || !prefix.trim())) {
+        let j = i + 1;
+        let inClass = false;
+        for (; j < line.length; j++) {
+          if (line[j] === "\\") {
+            j++;
+            continue;
+          }
+          if (line[j] === "[") inClass = true;
+          if (line[j] === "]") inClass = false;
+          if (line[j] === "/" && !inClass) break;
+        }
+        if (j < line.length) {
+          j++;
+          while (/[a-z]/i.test(line[j] || "") && j < line.length) j++;
+          i = j;
+          prefix += " literal ";
+          continue;
+        }
+      }
+      code[i] = char;
+      prefix += char;
+      i++;
+    }
+    if (this.quote !== "`" && !this.triple) this.quote = "";
+    return { code: code.join(""), comments: comments.join("") };
+  }
+};
+
+// src/rules.ts
+var RULE_GUIDES = {
+  "test-skip": {
+    title: "Skipped or disabled test",
+    why: "The test runner may report success without executing this behavior check.",
+    suggestion: "Re-enable the test and fix its failure. If a skip is intentional, document its reason and track when to restore it.",
+    example: 'it.skip("auth", ...) \u2192 it("auth", ...) after fixing the failing behavior'
+  },
+  "trivial-assert": {
+    title: "Assertion that always passes",
+    why: "Comparing a constant to itself does not check the implementation and cannot catch regressions.",
+    suggestion: "Call the real behavior and assert its output or observable side effect instead of comparing constants.",
+    example: "expect(true).toBe(true) \u2192 expect(canSignIn(validUser)).toBe(true)"
+  },
+  "type-escape": {
+    title: "Type or linter check bypass",
+    why: "A suppression can hide incompatible values or a disabled correctness check. Some suppressions are justified.",
+    suggestion: "Narrow or validate the value at the boundary. Keep a suppression only with a specific reason and the smallest possible scope.",
+    example: "response as any \u2192 parse and validate response before using it"
+  },
+  "swallowed-error": {
+    title: "Error discarded without handling",
+    why: "An empty handler makes a failed operation look successful to callers and hides diagnostics.",
+    suggestion: "Handle the expected error explicitly, return an observable failure, or rethrow it. Document an intentional best-effort operation.",
+    example: "catch (error) {} \u2192 catch (error) { throw new Error('Save failed', { cause: error }); }"
+  },
+  "stub-abandonment": {
+    title: "Unimplemented code path",
+    why: "A placeholder throws at runtime when a caller reaches the unfinished path. Abstract methods may be intentional.",
+    suggestion: "Implement the path or make its unsupported state explicit to callers. Check whether this is an intentional abstract contract.",
+    example: "throw new Error('Not implemented') \u2192 implement the operation and add a behavior test"
+  },
+  "panic-loop": {
+    title: "Rapid overlapping fix commits",
+    why: "Repeated short fix cycles can suggest a missing reproduction or feedback loop; timing alone does not prove poor work.",
+    suggestion: "Find a minimal reproduction, add a regression test, and verify the complete fix before the next patch.",
+    example: "fix \u2192 revert \u2192 fix \u2192 add a reproducer and validate the final behavior"
+  }
+};
+
 // src/config.ts
 import * as fs from "fs";
 import * as path from "path";
+
+// src/types.ts
+var VALID_DETECTORS = [
+  "test-skip",
+  "type-escape",
+  "swallowed-error",
+  "panic-loop",
+  "trivial-assert",
+  "stub-abandonment"
+];
+
+// src/config.ts
 var DEFAULT_CONFIG = {
   failOn: ["test-skip", "trivial-assert"],
   ignorePaths: [
@@ -571,31 +719,67 @@ var CONFIG_FILENAMES = [
   ".agentroastrc",
   "agent-roast.config.json"
 ];
+var ConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigError";
+  }
+};
+function validateConfig(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new ConfigError("Configuration must be a JSON object.");
+  }
+  const config = value;
+  const knownRules = new Set(VALID_DETECTORS);
+  if (config.failOn !== void 0 && (!Array.isArray(config.failOn) || config.failOn.some((rule) => typeof rule !== "string" || !knownRules.has(rule)))) {
+    throw new ConfigError(`failOn must contain known rules: ${VALID_DETECTORS.join(", ")}`);
+  }
+  if (config.ignorePaths !== void 0 && (!Array.isArray(config.ignorePaths) || config.ignorePaths.some((pattern) => typeof pattern !== "string"))) {
+    throw new ConfigError("ignorePaths must be an array of strings.");
+  }
+  if (config.scoreThreshold !== void 0 && (typeof config.scoreThreshold !== "number" || !Number.isFinite(config.scoreThreshold) || config.scoreThreshold < 0 || config.scoreThreshold > 100)) {
+    throw new ConfigError("scoreThreshold must be a number between 0 and 100.");
+  }
+  if (config.panicLoopWindowMinutes !== void 0 && (typeof config.panicLoopWindowMinutes !== "number" || !Number.isFinite(config.panicLoopWindowMinutes) || config.panicLoopWindowMinutes <= 0)) {
+    throw new ConfigError("panicLoopWindowMinutes must be a positive number.");
+  }
+  if (config.rules !== void 0) {
+    if (!config.rules || typeof config.rules !== "object" || Array.isArray(config.rules)) {
+      throw new ConfigError("rules must be an object.");
+    }
+    for (const [rule, level] of Object.entries(config.rules)) {
+      if (!knownRules.has(rule) || !["error", "warn", "off"].includes(String(level))) {
+        throw new ConfigError(`Invalid rule '${rule}' or level '${level}'. Use known rules with error, warn, or off.`);
+      }
+    }
+  }
+}
 function loadConfig(cwd = process.cwd()) {
   for (const filename of CONFIG_FILENAMES) {
     const filePath = path.join(cwd, filename);
-    if (fs.existsSync(filePath)) {
-      try {
-        const raw = fs.readFileSync(filePath, "utf8");
-        const parsed = JSON.parse(raw);
-        if (typeof parsed === "object" && parsed !== null) {
-          return {
-            ...DEFAULT_CONFIG,
-            ...parsed,
-            failOn: Array.isArray(parsed.failOn) ? parsed.failOn : DEFAULT_CONFIG.failOn,
-            ignorePaths: Array.isArray(parsed.ignorePaths) ? Array.from(/* @__PURE__ */ new Set([...DEFAULT_CONFIG.ignorePaths || [], ...parsed.ignorePaths])) : DEFAULT_CONFIG.ignorePaths,
-            rules: {
-              ...DEFAULT_CONFIG.rules,
-              ...parsed.rules || {}
-            }
-          };
-        }
-      } catch (err) {
-        console.warn(`Warning: Failed to parse ${filename}: ${err.message}. Using default configuration.`);
-      }
+    if (!fs.existsSync(filePath)) continue;
+    try {
+      const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+      validateConfig(parsed);
+      const rules = { ...DEFAULT_CONFIG.rules, ...parsed.rules };
+      const failOn = parsed.failOn ?? Object.entries(rules).filter(([, level]) => level === "error").map(([rule]) => rule);
+      return {
+        ...DEFAULT_CONFIG,
+        ...parsed,
+        failOn,
+        ignorePaths: [.../* @__PURE__ */ new Set([...DEFAULT_CONFIG.ignorePaths || [], ...parsed.ignorePaths || []])],
+        rules
+      };
+    } catch (err) {
+      throw new ConfigError(`Invalid ${filename}: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
-  return { ...DEFAULT_CONFIG };
+  return {
+    ...DEFAULT_CONFIG,
+    failOn: [...DEFAULT_CONFIG.failOn || []],
+    ignorePaths: [...DEFAULT_CONFIG.ignorePaths || []],
+    rules: { ...DEFAULT_CONFIG.rules }
+  };
 }
 function matchIgnorePath(filePath, ignorePatterns) {
   if (!ignorePatterns || ignorePatterns.length === 0) {
@@ -605,7 +789,25 @@ function matchIgnorePath(filePath, ignorePatterns) {
   for (const pattern of ignorePatterns) {
     if (!pattern) continue;
     const cleanPattern = pattern.replace(/\\/g, "/");
-    let regexPattern = cleanPattern.replace(/[.+^${}()|[\]]/g, "\\$&").replace(/\*\*\//g, "(?:^|.*?/)").replace(/\/\*\*/g, "(?:/.*)?").replace(/\*/g, "[^/]*");
+    let regexPattern = "";
+    for (let i = 0; i < cleanPattern.length; i++) {
+      const char = cleanPattern[i];
+      if (char === "*" && cleanPattern[i + 1] === "*") {
+        i++;
+        if (cleanPattern[i + 1] === "/") {
+          regexPattern += "(?:.*/)?";
+          i++;
+        } else {
+          regexPattern += ".*";
+        }
+      } else if (char === "*") {
+        regexPattern += "[^/]*";
+      } else if (char === "?") {
+        regexPattern += "[^/]";
+      } else {
+        regexPattern += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+      }
+    }
     if (!regexPattern.startsWith("^") && !regexPattern.startsWith("(?:^")) {
       regexPattern = "(?:^|/)" + regexPattern;
     }
@@ -628,7 +830,7 @@ function matchIgnorePath(filePath, ignorePatterns) {
 
 // src/metrics.ts
 var TEST_SKIP_PATTERNS = [
-  { regex: /(?:it|test|describe)\.skip\b/, name: "skipped test (it.skip / describe.skip)" },
+  { regex: /\b(?:it|test|describe)\.skip\b/, name: "skipped test (it.skip / describe.skip)" },
   { regex: /\b(?:xit|xtest)\(/, name: "disabled test (xit / xtest)" },
   { regex: /@pytest\.mark\.skip\b/, name: "skipped pytest (@pytest.mark.skip)" },
   { regex: /\bpytest\.skip\(/, name: "imperative pytest skip (pytest.skip)" },
@@ -652,9 +854,9 @@ var SWALLOWED_ERROR_PATTERNS = [
   { regex: /except(?:\s+[^:]*)?:\s*pass\b/, name: "silent python error swallow (except: pass)" }
 ];
 var TRIVIAL_ASSERT_PATTERNS = [
-  { regex: /expect\s*\(\s*(?:true|false|1|0|null|undefined)\s*\)\.toBe\s*\(\s*(?:true|false|1|0|null|undefined)\s*\)/, name: "trivial assertion (expect(val).toBe(val))" },
-  { regex: /expect\s*\(\s*(?:true|false|1|0|null|undefined)\s*\)\.toEqual\s*\(\s*(?:true|false|1|0|null|undefined)\s*\)/, name: "trivial assertion (expect(val).toEqual(val))" },
-  { regex: /\bassert\s+(?:True|False|1\s*==\s*1)\b/, name: "trivial python assert (assert True / 1 == 1)" },
+  { regex: /expect\s*\(\s*(true|false|1|0|null|undefined)\s*\)\.toBe\s*\(\s*\1\s*\)/, name: "trivial assertion (expect(val).toBe(val))" },
+  { regex: /expect\s*\(\s*(true|false|1|0|null|undefined)\s*\)\.toEqual\s*\(\s*\1\s*\)/, name: "trivial assertion (expect(val).toEqual(val))" },
+  { regex: /\bassert\s+(?:True|1\s*==\s*1)\s*(?=$|#|,)/, name: "trivial python assert (assert True / 1 == 1)" },
   { regex: /self\.assertTrue\s*\(\s*(?:True|1)\s*\)/, name: "trivial assert (self.assertTrue(True))" },
   { regex: /self\.assertEqual\s*\(\s*(?:1\s*,\s*1|True\s*,\s*True)\s*\)/, name: "trivial assert (self.assertEqual(1, 1))" },
   { regex: /assert\.(?:strictEqual|equal)\s*\(\s*(?:true\s*,\s*true|1\s*,\s*1)\s*\)/, name: "trivial assert (assert.equal(1, 1))" }
@@ -687,7 +889,7 @@ var CODE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".c"
 ]);
 var IGNORED_PATH_REGEX = /(?:^|\/)(?:fixtures|__fixtures__|testdata|mocks|test_data|__snapshots__|sample[s]?)\//i;
-var TEST_PATH_REGEX = /(?:^|\/)(?:tests?|__tests__|specs?)\/|[._-](?:test|spec)\.[a-z0-9]+$/i;
+var TEST_PATH_REGEX = /(?:^|\/)test_[^/]+\.py$|(?:^|\/)(?:tests?|__tests__|specs?)\/|[._-](?:test|spec)\.[a-z0-9]+$/i;
 function isCodeFile(filePath, customIgnorePaths) {
   if (IGNORED_PATH_REGEX.test(filePath)) {
     return false;
@@ -712,11 +914,14 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
     hasSupportedChanges = true;
     filesInspected++;
     linesAdded += file.addedLines.length;
+    const masker = new SourceMasker(file.path);
+    const maskedLines = [];
     for (const added of file.addedLines) {
       const rawLine = added.line;
-      const cleanedLine = stripStringAndRegexLiterals(rawLine);
-      const trimmedCleaned = cleanedLine.trim();
-      const isComment = isCommentOnlyLine(trimmedCleaned);
+      const masked = masker.mask(rawLine, added.lineNumber);
+      const cleanedLine = masked.code;
+      maskedLines.push({ code: cleanedLine, raw: rawLine, number: added.lineNumber });
+      const isComment = !cleanedLine.trim();
       if (!isComment) {
         for (const rule of TEST_SKIP_PATTERNS) {
           if (rule.regex.test(cleanedLine)) {
@@ -735,7 +940,7 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
       }
       let foundEscape = false;
       for (const rule of COMMENT_DIRECTIVE_PATTERNS) {
-        if (rule.regex.test(cleanedLine)) {
+        if (rule.regex.test(masked.comments)) {
           infractions.push({
             type: "type-escape",
             file: file.path,
@@ -799,7 +1004,8 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
       }
       if (!isComment) {
         for (const rule of STUB_ABANDONMENT_PATTERNS) {
-          if (rule.regex.test(rawLine)) {
+          const match = rule.regex.exec(rawLine);
+          if (match && cleanedLine[match.index] === rawLine[match.index]) {
             infractions.push({
               type: "stub-abandonment",
               file: file.path,
@@ -814,14 +1020,39 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
         }
       }
     }
+    for (let index = 0; index < maskedLines.length; index++) {
+      const start = maskedLines[index];
+      const isCatch = /\bcatch\s*(?:\([^)]*\))?\s*\{\s*$/.test(start.code);
+      const isExcept = /\bexcept(?:\s+[^:]*)?:\s*$/.test(start.code);
+      if (!isCatch && !isExcept) continue;
+      let next = index + 1;
+      while (next < maskedLines.length && maskedLines[next].number === maskedLines[next - 1].number + 1 && !maskedLines[next].code.trim()) next++;
+      const end = maskedLines[next];
+      if (!end || end.number !== maskedLines[next - 1].number + 1) continue;
+      const closesCatch = isCatch && /^\s*}/.test(end.code);
+      let closesExcept = isExcept && /^\s*pass\s*$/.test(end.code);
+      if (closesExcept) {
+        const indent = start.raw.search(/\S/);
+        if (end.raw.search(/\S/) <= indent) closesExcept = false;
+        let after = next + 1;
+        while (after < maskedLines.length && maskedLines[after].number === maskedLines[after - 1].number + 1 && !maskedLines[after].code.trim()) after++;
+        if (after < maskedLines.length && maskedLines[after].number === maskedLines[after - 1].number + 1 && maskedLines[after].raw.search(/\S/) > indent) closesExcept = false;
+      }
+      if (closesCatch || closesExcept) infractions.push({
+        type: "swallowed-error",
+        file: file.path,
+        lineNumber: start.number,
+        lineSnippet: maskedLines.slice(index, next + 1).map((line) => line.raw.trim()).join(" "),
+        commitHash,
+        commitDate,
+        reason: closesCatch ? "empty multi-line catch block" : "silent multi-line python error swallow"
+      });
+    }
   }
-  return { infractions, hasSupportedChanges, filesInspected, linesAdded };
+  return { infractions: infractions.filter((inf) => options.rules?.[inf.type] !== "off").map((inf) => ({ ...inf, suggestion: RULE_GUIDES[inf.type].suggestion })), hasSupportedChanges, filesInspected, linesAdded };
 }
 function stripStringAndRegexLiterals(line) {
-  return line.replace(/(["'`])(?:\\.|(?!\1)[^\\\r\n])*\1/g, '""').replace(/\/(?=[^\/\s])(?:\\\/|[^\/\r\n])+\/[gimsuy]*/g, '""');
-}
-function isCommentOnlyLine(trimmedLine) {
-  return trimmedLine.startsWith("//") || trimmedLine.startsWith("/*") || trimmedLine.startsWith("*") || trimmedLine.startsWith("#");
+  return new SourceMasker("source.ts").mask(line, 1).code;
 }
 var PANIC_COMMIT_REGEX = /\b(?:fix|quickfix|revert|hotfix|retry|patch|undo|workaround)\b/i;
 var MAX_INFRACTIONS_PER_COMMIT = 10;
@@ -842,16 +1073,20 @@ var MetricsCollector = class {
   activePanicChain = null;
   includeAll;
   ignorePaths;
+  rules;
+  panicLoopWindowMinutes;
   constructor(options = {}) {
     this.includeAll = options.all ?? false;
     this.ignorePaths = options.ignorePaths;
+    this.rules = options.rules;
+    this.panicLoopWindowMinutes = options.panicLoopWindowMinutes ?? 15;
   }
   recordSkipped(stats) {
     if (stats.skippedLongLines) this.skippedLongLines += stats.skippedLongLines;
     if (stats.skippedUnknownFiles) this.skippedUnknownFiles += stats.skippedUnknownFiles;
   }
   flushPanicChain() {
-    if (this.activePanicChain && this.activePanicChain.commitCount >= 2) {
+    if (this.rules?.["panic-loop"] !== "off" && this.activePanicChain && this.activePanicChain.commitCount >= 2) {
       const chain = this.activePanicChain;
       const durationMinutes = Math.max(
         1,
@@ -876,6 +1111,7 @@ var MetricsCollector = class {
       this.aiLinesAdded += commit.totalAddedCount;
     }
     if (!isTarget) {
+      this.flushPanicChain();
       return;
     }
     const subject = commit.message.split("\n")[0];
@@ -888,7 +1124,7 @@ var MetricsCollector = class {
       if (this.activePanicChain && this.activePanicChain.author.toLowerCase() === commit.authorEmail.toLowerCase()) {
         const diffMinutes = Math.abs(commitDateMs - this.activePanicChain.latestDate) / (1e3 * 60);
         const touchedSameFiles = currentActiveFiles.size > 0 && [...currentActiveFiles].some((p) => this.activePanicChain.activeFiles.has(p));
-        if (diffMinutes > 0 && diffMinutes <= 15 && touchedSameFiles) {
+        if (diffMinutes > 0 && diffMinutes <= this.panicLoopWindowMinutes && touchedSameFiles) {
           this.activePanicChain.commitCount++;
           this.activePanicChain.latestHash = commit.hash;
           this.activePanicChain.latestDate = commitDateMs;
@@ -927,123 +1163,23 @@ var MetricsCollector = class {
     } else {
       this.flushPanicChain();
     }
-    let commitSkips = 0;
-    let commitEscapes = 0;
-    let commitSwallowed = 0;
-    let commitTrivial = 0;
-    let commitStubs = 0;
-    for (const file of commit.files) {
-      if (!isCodeFile(file.path, this.ignorePaths)) {
-        continue;
-      }
-      for (const added of file.addedLines) {
-        const rawLine = added.line;
-        const cleanedLine = stripStringAndRegexLiterals(rawLine);
-        const trimmedCleaned = cleanedLine.trim();
-        const isComment = isCommentOnlyLine(trimmedCleaned);
-        if (!isComment && commitSkips < MAX_INFRACTIONS_PER_COMMIT) {
-          for (const rule of TEST_SKIP_PATTERNS) {
-            if (rule.regex.test(cleanedLine)) {
-              this.testSkips.push({
-                type: "test-skip",
-                file: file.path,
-                lineNumber: added.lineNumber,
-                lineSnippet: rawLine.trim(),
-                commitHash: commit.hash,
-                commitDate: commit.date,
-                reason: rule.name
-              });
-              commitSkips++;
-              break;
-            }
-          }
-        }
-        if (commitEscapes < MAX_INFRACTIONS_PER_COMMIT) {
-          for (const rule of COMMENT_DIRECTIVE_PATTERNS) {
-            if (rule.regex.test(cleanedLine)) {
-              this.typeEscapes.push({
-                type: "type-escape",
-                file: file.path,
-                lineNumber: added.lineNumber,
-                lineSnippet: rawLine.trim(),
-                commitHash: commit.hash,
-                commitDate: commit.date,
-                reason: rule.name
-              });
-              commitEscapes++;
-              break;
-            }
-          }
-          if (!isComment && commitEscapes < MAX_INFRACTIONS_PER_COMMIT) {
-            for (const rule of CODE_TYPE_ESCAPE_PATTERNS) {
-              if (rule.regex.test(cleanedLine)) {
-                this.typeEscapes.push({
-                  type: "type-escape",
-                  file: file.path,
-                  lineNumber: added.lineNumber,
-                  lineSnippet: rawLine.trim(),
-                  commitHash: commit.hash,
-                  commitDate: commit.date,
-                  reason: rule.name
-                });
-                commitEscapes++;
-                break;
-              }
-            }
-          }
-        }
-        if (!isComment && commitSwallowed < MAX_INFRACTIONS_PER_COMMIT) {
-          for (const rule of SWALLOWED_ERROR_PATTERNS) {
-            if (rule.regex.test(cleanedLine)) {
-              this.swallowedErrors.push({
-                type: "swallowed-error",
-                file: file.path,
-                lineNumber: added.lineNumber,
-                lineSnippet: rawLine.trim(),
-                commitHash: commit.hash,
-                commitDate: commit.date,
-                reason: rule.name
-              });
-              commitSwallowed++;
-              break;
-            }
-          }
-        }
-        if (!isComment && isTestFile(file.path) && commitTrivial < MAX_INFRACTIONS_PER_COMMIT) {
-          for (const rule of TRIVIAL_ASSERT_PATTERNS) {
-            if (rule.regex.test(cleanedLine)) {
-              this.trivialAsserts.push({
-                type: "trivial-assert",
-                file: file.path,
-                lineNumber: added.lineNumber,
-                lineSnippet: rawLine.trim(),
-                commitHash: commit.hash,
-                commitDate: commit.date,
-                reason: rule.name
-              });
-              commitTrivial++;
-              break;
-            }
-          }
-        }
-        if (!isComment && commitStubs < MAX_INFRACTIONS_PER_COMMIT) {
-          for (const rule of STUB_ABANDONMENT_PATTERNS) {
-            if (rule.regex.test(rawLine)) {
-              this.stubAbandonments.push({
-                type: "stub-abandonment",
-                file: file.path,
-                lineNumber: added.lineNumber,
-                lineSnippet: rawLine.trim(),
-                commitHash: commit.hash,
-                commitDate: commit.date,
-                reason: rule.name
-              });
-              commitStubs++;
-              break;
-            }
-          }
-        }
-      }
+    const audit = auditFileDiffs(commit.files, commit.hash, commit.date, {
+      ignorePaths: this.ignorePaths,
+      rules: this.rules
+    });
+    const buckets = {
+      "test-skip": this.testSkips,
+      "type-escape": this.typeEscapes,
+      "swallowed-error": this.swallowedErrors,
+      "trivial-assert": this.trivialAsserts,
+      "stub-abandonment": this.stubAbandonments,
+      "panic-loop": this.panicLoops
+    };
+    const counts = {};
+    for (const infraction of audit.infractions) {
+      const count = counts[infraction.type] || 0;
+      if (count < MAX_INFRACTIONS_PER_COMMIT) buckets[infraction.type].push(infraction);
+      counts[infraction.type] = count + 1;
     }
   }
   getSummary() {
@@ -1161,25 +1297,26 @@ function formatTerminalCard(summary, options) {
   );
   lines.push("");
   if (!summary.isSufficientData || summary.score === null) {
-    lines.push(pc.yellow(`  insufficient data (< 200 lines added by AI)`));
-    lines.push(pc.dim("  commit more code and run `npx agent-roast` again."));
+    lines.push(pc.yellow(`  insufficient data (< 200 analyzed lines added)`));
+    lines.push(pc.dim("  Findings below remain actionable; a score needs a larger sample."));
+    lines.push("");
+  }
+  if (summary.isSufficientData && summary.score !== null) {
+    let scoreColor = pc.green;
+    if (summary.score < 60) scoreColor = pc.red;
+    else if (summary.score < 80) scoreColor = pc.yellow;
+    lines.push(
+      `  ${pc.bold("SCORE:")} ${scoreColor(pc.bold(`${summary.score} / 100`))}  ${pc.dim("\xB7")}  ${pc.magenta(pc.bold(summary.archetype))}`
+    );
+    lines.push(`  ${pc.dim(summary.archetypeDescription)}`);
     lines.push("");
-    return lines.join("\n");
   }
-  let scoreColor = pc.green;
-  if (summary.score < 60) scoreColor = pc.red;
-  else if (summary.score < 80) scoreColor = pc.yellow;
-  lines.push(
-    `  ${pc.bold("SCORE:")} ${scoreColor(pc.bold(`${summary.score} / 100`))}  ${pc.dim("\xB7")}  ${pc.magenta(pc.bold(summary.archetype))}`
-  );
-  lines.push(`  ${pc.dim(summary.archetypeDescription)}`);
-  lines.push("");
   const totalInfractions = (summary.testSkips?.length || 0) + (summary.typeEscapes?.length || 0) + (summary.swallowedErrors?.length || 0) + (summary.panicLoops?.length || 0) + (summary.trivialAsserts?.length || 0) + (summary.stubAbandonments?.length || 0);
   lines.push(pc.bold(`  INFRACTIONS (${totalInfractions})`));
   lines.push(pc.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   if (summary.panicLoops && summary.panicLoops.length > 0) {
     lines.push(
-      `  ${pc.magenta("\u25CF")} ${pc.bold("panic-loop")} (${summary.panicLoops.length})  ${pc.dim("consecutive quick fixes < 15m apart")}`
+      `  ${pc.magenta("\u25CF")} ${pc.bold("panic-loop")} (${summary.panicLoops.length})  ${pc.dim("rapid consecutive fixes touching overlapping files")}`
     );
     const sample = summary.panicLoops[0];
     lines.push(`      ${pc.dim(sample.reason)}`);
@@ -1278,10 +1415,10 @@ function formatPrTerminalCard(result) {
   const lines = [];
   lines.push("");
   lines.push(
-    `${pc.bold(pc.cyan("agent-roast"))} ${pc.dim("\u2014 pull request audit")} ${pc.white(`${result.baseSha.slice(0, 7)}...${result.headSha.slice(0, 7)}`)}`
+    `${pc.bold(pc.cyan("agent-roast"))} ${pc.dim(result.mode === "staged" ? "\u2014 staged changes audit" : "\u2014 pull request audit")} ${pc.white(`${result.baseSha.slice(0, 7)}...${result.headSha.slice(0, 7)}`)}`
   );
   if (!result.hasSupportedChanges) {
-    lines.push(`  ${pc.dim("no supported source changes detected in pull request.")}`);
+    lines.push(`  ${pc.dim("no supported source changes detected in the audited diff.")}`);
     lines.push("");
     return lines.join("\n");
   }
@@ -1290,7 +1427,7 @@ function formatPrTerminalCard(result) {
   );
   lines.push("");
   if (result.infractions.length === 0) {
-    lines.push(`  ${pc.green("PASS")} ${pc.dim("zero infractions detected across all pull request changes.")}`);
+    lines.push(`  ${pc.green("PASS")} ${pc.dim("zero infractions detected across all audited changes.")}`);
   } else {
     lines.push(pc.bold(`  INFRACTIONS DETECTED (${result.infractions.length})`));
     lines.push(pc.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
@@ -1302,6 +1439,7 @@ function formatPrTerminalCard(result) {
       if (inf.lineSnippet) {
         lines.push(`      ${pc.dim(`\u2514\u2500 ${inf.lineSnippet}`)}`);
       }
+      if (inf.suggestion) lines.push(`      ${pc.dim(`Next: ${inf.suggestion}`)}`);
     }
   }
   lines.push("");
@@ -1328,6 +1466,10 @@ function sortInfractionsDeterministic(infractions) {
     return (a.lineNumber || 0) - (b.lineNumber || 0);
   });
 }
+function escapeCommand(value, property = false) {
+  const escaped = value.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
+  return property ? escaped.replace(/:/g, "%3A").replace(/,/g, "%2C") : escaped;
+}
 function formatGithubAnnotations(result) {
   const outputLines = [];
   const sorted = sortInfractionsDeterministic(result.infractions);
@@ -1337,20 +1479,20 @@ function formatGithubAnnotations(result) {
   let omittedCount = 0;
   for (const inf of sorted) {
     if (!inf.file || inf.file === "unknown") continue;
-    const isError = result.failedRules.includes(inf.type) || inf.type === "test-skip" || inf.type === "trivial-assert" || inf.type === "swallowed-error";
+    const isError = result.failedRules.includes(inf.type);
     const line = inf.lineNumber || 1;
-    const title = inf.reason.replace(/[\r\n]/g, " ");
-    const msg = (inf.lineSnippet || inf.reason).replace(/[\r\n]/g, " ");
+    const title = escapeCommand(inf.reason, true);
+    const msg = escapeCommand(inf.lineSnippet || inf.reason);
     if (isError) {
       if (errorCount < MAX_PER_LEVEL) {
-        outputLines.push(`::error file=${inf.file},line=${line},title=${title}::${msg}`);
+        outputLines.push(`::error file=${escapeCommand(inf.file, true)},line=${line},title=${title}::${msg}`);
         errorCount++;
       } else {
         omittedCount++;
       }
     } else {
       if (warnCount < MAX_PER_LEVEL) {
-        outputLines.push(`::warning file=${inf.file},line=${line},title=${title}::${msg}`);
+        outputLines.push(`::warning file=${escapeCommand(inf.file, true)},line=${line},title=${title}::${msg}`);
         warnCount++;
       } else {
         omittedCount++;
@@ -1366,10 +1508,10 @@ function formatGithubAnnotations(result) {
 }
 function formatGithubStepSummary(result) {
   const lines = [];
-  lines.push("### agent-roast Pull Request Audit");
+  lines.push(result.mode === "staged" ? "### agent-roast Staged Changes Audit" : "### agent-roast Pull Request Audit");
   lines.push("");
   if (!result.hasSupportedChanges) {
-    lines.push("No supported source file changes detected in this pull request.");
+    lines.push("No supported source file changes detected in the audited diff.");
     return lines.join("\n");
   }
   const statusBadge = result.passed ? "Passed" : `Failed (${result.failedRules.join(", ")})`;
@@ -1404,7 +1546,7 @@ function formatPrMarkdownComment(result) {
   lines.push(`## \u{1F6E1}\uFE0F agent-roast audit: ${titleStatus} ${titleEmoji}`);
   lines.push("");
   if (!result.hasSupportedChanges) {
-    lines.push("No supported source file changes detected in this pull request.");
+    lines.push("No supported source file changes detected in the audited diff.");
     lines.push("");
     lines.push("---");
     lines.push("*Audited 100% offline with [agent-roast](https://github.com/Nari-Ab/agent-roast)*");
@@ -1440,22 +1582,52 @@ function formatPrMarkdownComment(result) {
   lines.push("*Audited 100% offline with [agent-roast](https://github.com/Nari-Ab/agent-roast)*");
   return lines.join("\n");
 }
-
-// src/types.ts
-var VALID_DETECTORS = [
-  "test-skip",
-  "type-escape",
-  "swallowed-error",
-  "panic-loop",
-  "trivial-assert",
-  "stub-abandonment"
-];
+function terminalText(value) {
+  return value.replace(/[\u0000-\u001f\u007f-\u009f]/g, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function formatCheckTerminal(result) {
+  const lines = [
+    "",
+    pc.bold("agent-roast \u2014 current code check"),
+    `  ${result.filesInspected} files \xB7 ${result.linesInspected} lines inspected`,
+    `  ${result.infractions.length} findings to review \xB7 ${result.baselineCount} accepted baseline findings`
+  ];
+  if (result.staleBaselineCount) lines.push(`  ${result.staleBaselineCount} baseline findings no longer present (or now disabled/ignored).`);
+  for (const inf of result.infractions.slice(0, 20)) {
+    lines.push("", `  ${result.failedRules.includes(inf.type) ? pc.red("FAIL") : pc.yellow("WARN")} [${inf.type}] ${terminalText(inf.file || "unknown")}:${inf.lineNumber}`, `    ${terminalText(inf.lineSnippet || inf.reason)}`);
+    if (inf.suggestion) lines.push(`    Next: ${inf.suggestion}`);
+  }
+  if (result.infractions.length > 20) lines.push(`
+  ${result.infractions.length - 20} more findings. Use --format json for the complete report.`);
+  for (const skipped of result.skippedFiles) lines.push(`
+  NOT SCANNED ${terminalText(skipped.file)}: ${terminalText(skipped.reason)}`);
+  lines.push("", !result.complete ? pc.red("  INCOMPLETE: some source could not be inspected; exit 2.") : result.passed ? pc.green("  PASSED: no new blocking findings.") : pc.red(`  BLOCKED: ${result.failedRules.join(", ")}.`), "");
+  if (!result.filesInspected) lines.push("  No supported source files inspected.", "");
+  return lines.join("\n");
+}
+function markdownCell(value) {
+  return value.replace(/[\\[\]()*_!]/g, "\\$&").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/\|/g, "\\|").replace(/`/g, "&#96;").replace(/[\r\n]/g, " ");
+}
+function formatCheckMarkdown(result) {
+  const status = !result.complete ? "INCOMPLETE" : result.passed ? "PASSED" : "BLOCKED";
+  const lines = [
+    `## agent-roast current code check: ${status}`,
+    "",
+    `${result.filesInspected} files, ${result.linesInspected} lines inspected. ${result.infractions.length} findings to review; ${result.baselineCount} accepted baseline findings.`,
+    "",
+    "| Rule | Location | Finding | Next step |",
+    "| --- | --- | --- | --- |"
+  ];
+  for (const inf of result.infractions) lines.push(`| ${inf.type} | ${markdownCell(`${inf.file}:${inf.lineNumber}`)} | ${markdownCell(inf.lineSnippet || inf.reason)} | ${markdownCell(inf.suggestion || "Review this occurrence.")} |`);
+  if (result.staleBaselineCount) lines.push("", `${result.staleBaselineCount} baseline findings no longer present (or now disabled/ignored).`);
+  for (const skipped of result.skippedFiles) lines.push("", `Not scanned: ${markdownCell(skipped.file)} \u2014 ${markdownCell(skipped.reason)}`);
+  return lines.join("\n");
+}
 
 // src/init.ts
 import * as fs2 from "fs";
 import * as path2 from "path";
 var DEFAULT_CONFIG_TEMPLATE = {
-  $schema: "https://raw.githubusercontent.com/Nari-Ab/agent-roast/main/schema.json",
   ignorePaths: [
     "**/*.min.js",
     "**/vendor/**",
@@ -1463,21 +1635,16 @@ var DEFAULT_CONFIG_TEMPLATE = {
     "**/build/**",
     "**/fixtures/**"
   ],
-  rules: {
-    "hallucinated-package": "error",
-    "empty-catch": "warn",
-    "trivial-assert": "warn",
-    "stub-abandonment": "warn",
-    "mock-leak": "warn"
-  },
+  rules: { ...DEFAULT_CONFIG.rules },
   scoreThreshold: 70
 };
 var GITHUB_WORKFLOW_TEMPLATE = `name: Agent Roast
 on:
   pull_request:
     branches: [main, master]
-  push:
-    branches: [main, master]
+
+permissions:
+  contents: read
 
 jobs:
   audit:
@@ -1489,22 +1656,17 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-
       - name: Run agent-roast PR check
         if: github.event_name == 'pull_request'
-        run: npx agent-roast --base \${{ github.event.pull_request.base.sha }} --head \${{ github.event.pull_request.head.sha }} --format github
-
-      - name: Run agent-roast repo audit
-        if: github.event_name != 'pull_request'
-        run: npx agent-roast --fail-under 70
+        uses: Nari-Ab/agent-roast@v1
+        with:
+          base: \${{ github.event.pull_request.base.sha }}
+          head: \${{ github.event.pull_request.head.sha }}
+          format: github
 `;
 var PRE_COMMIT_HOOK_TEMPLATE = `#!/bin/sh
 # Run agent-roast pre-commit verification
-npx agent-roast --fail-under 70
+npx --no-install agent-roast --staged
 `;
 async function initProject(options = {}) {
   const cwd = path2.resolve(options.cwd || process.cwd());
@@ -1512,7 +1674,7 @@ async function initProject(options = {}) {
   const skipped = [];
   const configPath = path2.join(cwd, ".agentroastrc.json");
   const altConfigPath = path2.join(cwd, "agent-roast.config.json");
-  if (fs2.existsSync(configPath) || fs2.existsSync(altConfigPath)) {
+  if (fs2.existsSync(configPath) || fs2.existsSync(altConfigPath) || fs2.existsSync(path2.join(cwd, ".agentroastrc"))) {
     skipped.push(".agentroastrc.json");
   } else {
     fs2.writeFileSync(
@@ -1613,6 +1775,230 @@ function generateShieldsJson(score, label = "AI Discipline") {
   };
 }
 
+// src/check.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import * as fs4 from "fs/promises";
+import { constants as constants2 } from "fs";
+import path4 from "path";
+
+// src/baseline.ts
+import { createHash, randomUUID } from "crypto";
+import * as fs3 from "fs";
+import path3 from "path";
+function findingFingerprint(finding) {
+  return createHash("sha256").update(JSON.stringify([finding.type, finding.file, finding.lineSnippet?.trim()])).digest("hex");
+}
+function createBaseline(findings) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const finding of findings) {
+    const fingerprint = findingFingerprint(finding);
+    counts.set(fingerprint, (counts.get(fingerprint) || 0) + 1);
+  }
+  return {
+    schemaVersion: "1.0.0",
+    fingerprintVersion: 1,
+    entries: [...counts].sort(([a], [b]) => a.localeCompare(b)).map(([fingerprint, count]) => ({ fingerprint, count }))
+  };
+}
+function loadBaseline(filename) {
+  try {
+    const stat = fs3.lstatSync(filename);
+    if (!stat.isFile() || stat.size > 5 * 1024 * 1024) throw new Error("Expected a regular baseline file under 5 MiB.");
+    const fd = fs3.openSync(filename, fs3.constants.O_RDONLY | (fs3.constants.O_NOFOLLOW || 0));
+    let content;
+    try {
+      const opened = fs3.fstatSync(fd);
+      if (opened.ino !== stat.ino || opened.dev !== stat.dev) throw new Error("Baseline changed while opening.");
+      const buffer = Buffer.alloc(5 * 1024 * 1024 + 1);
+      let size = 0;
+      while (size < buffer.length) {
+        const read = fs3.readSync(fd, buffer, size, buffer.length - size, null);
+        if (!read) break;
+        size += read;
+      }
+      const after = fs3.fstatSync(fd);
+      if (size > 5 * 1024 * 1024 || size !== after.size || opened.mtimeMs !== after.mtimeMs) throw new Error("Baseline changed or exceeded the size limit.");
+      content = buffer.subarray(0, size).toString("utf8");
+    } finally {
+      fs3.closeSync(fd);
+    }
+    const parsed = JSON.parse(content);
+    if (!parsed || parsed.schemaVersion !== "1.0.0" || parsed.fingerprintVersion !== 1 || !Array.isArray(parsed.entries) || parsed.entries.length > 1e5) {
+      throw new Error("Unsupported baseline schema.");
+    }
+    const seen = /* @__PURE__ */ new Set();
+    for (const entry of parsed.entries) {
+      if (!entry || typeof entry.fingerprint !== "string" || !/^[a-f0-9]{64}$/.test(entry.fingerprint) || !Number.isSafeInteger(entry.count) || entry.count <= 0 || entry.count > 1e6 || seen.has(entry.fingerprint)) {
+        throw new Error("Invalid or duplicate baseline entry.");
+      }
+      seen.add(entry.fingerprint);
+    }
+    return parsed;
+  } catch (error) {
+    throw new ConfigError(`Cannot load baseline '${filename}': ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function applyBaseline(findings, baseline) {
+  const remaining = new Map(baseline.entries.map((entry) => [entry.fingerprint, entry.count]));
+  const fresh = [];
+  let baselineCount = 0;
+  for (const finding of findings) {
+    const fingerprint = findingFingerprint(finding);
+    const count = remaining.get(fingerprint) || 0;
+    if (count > 0) {
+      remaining.set(fingerprint, count - 1);
+      baselineCount++;
+    } else {
+      fresh.push(finding);
+    }
+  }
+  return { findings: fresh, baselineCount, staleBaselineCount: [...remaining.values()].reduce((a, b) => a + b, 0) };
+}
+function writeBaseline(filename, findings) {
+  const destination = path3.resolve(filename);
+  const temporary = path3.join(path3.dirname(destination), `.agent-roast-${randomUUID()}.tmp`);
+  let fd;
+  try {
+    fd = fs3.openSync(temporary, "wx", 384);
+    fs3.writeFileSync(fd, JSON.stringify(createBaseline(findings), null, 2) + "\n");
+    fs3.fsyncSync(fd);
+    fs3.closeSync(fd);
+    fd = void 0;
+    fs3.linkSync(temporary, destination);
+  } catch (error) {
+    throw new ConfigError(`Cannot write baseline '${filename}' (existing files are preserved): ${error instanceof Error ? error.message : String(error)}`);
+  } finally {
+    if (fd !== void 0) fs3.closeSync(fd);
+    fs3.rmSync(temporary, { force: true });
+  }
+}
+
+// src/check.ts
+var MAX_FILE_BYTES = 2 * 1024 * 1024;
+var MAX_SCAN_BYTES = 50 * 1024 * 1024;
+var GENERATED_PATHS = ["**/node_modules/**", "**/dist/**", "**/build/**", "**/vendor/**", "**/*.min.js", "**/*.map"];
+function git(cwd, args) {
+  const result = spawnSync2("git", [...HERMETIC_GIT_FLAGS, ...args], {
+    cwd,
+    env: getHermeticGitEnv(),
+    encoding: "utf8",
+    maxBuffer: 16 * 1024 * 1024,
+    windowsHide: true
+  });
+  if (result.error || result.status !== 0) throw new GitError(result.error?.message || result.stderr, result.status);
+  return result.stdout;
+}
+function checkAborted(signal) {
+  if (signal?.aborted) throw new ConfigError("Project check cancelled; no complete result was produced.");
+}
+function insideRoot(root, filename) {
+  const relative = path4.relative(root, filename);
+  return relative.length > 0 && relative !== ".." && !relative.startsWith(".." + path4.sep) && !path4.isAbsolute(relative);
+}
+async function readSource(root, file, signal) {
+  const filename = path4.resolve(root, file);
+  if (!insideRoot(root, filename)) throw new Error("File escapes the repository.");
+  let stat;
+  try {
+    stat = await fs4.lstat(filename);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  if (!stat.isFile() || stat.isSymbolicLink()) throw new Error("Symlinks and special files are not scanned.");
+  const real = await fs4.realpath(filename);
+  if (!insideRoot(root, real)) throw new Error("File resolves outside the repository.");
+  if (stat.size > MAX_FILE_BYTES) throw new Error("File exceeds the 2 MiB scan limit.");
+  const handle = await fs4.open(filename, constants2.O_RDONLY | (constants2.O_NOFOLLOW || 0));
+  try {
+    const opened = await handle.stat();
+    if (opened.ino !== stat.ino || opened.dev !== stat.dev || !opened.isFile()) throw new Error("File changed while opening.");
+    const chunks = [];
+    let size = 0;
+    while (true) {
+      checkAborted(signal);
+      const chunk = Buffer.alloc(Math.min(64 * 1024, MAX_FILE_BYTES + 1 - size));
+      const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);
+      if (!bytesRead) break;
+      size += bytesRead;
+      if (size > MAX_FILE_BYTES) throw new Error("File exceeds the 2 MiB scan limit.");
+      chunks.push(chunk.subarray(0, bytesRead));
+    }
+    const after = await handle.stat();
+    if (after.size !== opened.size || after.mtimeMs !== opened.mtimeMs || size !== after.size) throw new Error("File changed while reading; rerun the check.");
+    return Buffer.concat(chunks);
+  } finally {
+    await handle.close();
+  }
+}
+async function checkProject(options = {}) {
+  checkAborted(options.signal);
+  const cwd = path4.resolve(options.cwd || process.cwd());
+  const root = await fs4.realpath(git(cwd, ["rev-parse", "--show-toplevel"]).trim());
+  const config = loadConfig(root);
+  const failOn = options.failOn ?? config.failOn ?? ["test-skip", "trivial-assert"];
+  for (const rule of failOn) if (!VALID_DETECTORS.includes(rule)) throw new ConfigError(`Unknown rule '${rule}'.`);
+  const format = options.format || "terminal";
+  if (!["terminal", "json", "github", "markdown"].includes(format)) throw new ConfigError("Unsupported check output format.");
+  const baseline = options.baseline ? loadBaseline(path4.resolve(cwd, options.baseline)) : void 0;
+  const filenames = [...new Set(git(root, ["ls-files", "--cached", "--others", "--exclude-standard", "-z"]).split("\0").filter(Boolean))].sort();
+  const infractions = [];
+  const skippedFiles = [];
+  let filesInspected = 0;
+  let linesInspected = 0;
+  let totalBytes = 0;
+  for (const file of filenames) {
+    checkAborted(options.signal);
+    if (!isCodeFile(file, [...GENERATED_PATHS, ...config.ignorePaths || []])) continue;
+    try {
+      const content = await readSource(root, file, options.signal);
+      if (content === null) continue;
+      totalBytes += content.length;
+      if (totalBytes > MAX_SCAN_BYTES) throw new Error("Project exceeds the 50 MiB scan limit.");
+      if (content.includes(0)) throw new Error("Binary content in a source file.");
+      const text = new TextDecoder("utf-8", { fatal: true }).decode(content);
+      const lines = text.split(/\r?\n/);
+      if (lines[lines.length - 1] === "") lines.pop();
+      const audit = auditFileDiffs([{ path: file, addedLines: lines.map((line, index) => ({ line, lineNumber: index + 1 })) }], "WORKTREE", "", { rules: config.rules });
+      infractions.push(...audit.infractions);
+      filesInspected++;
+      linesInspected += lines.length;
+    } catch (error) {
+      checkAborted(options.signal);
+      skippedFiles.push({ file, reason: error instanceof Error ? error.message : String(error) });
+      if (totalBytes > MAX_SCAN_BYTES) break;
+    }
+  }
+  checkAborted(options.signal);
+  const applied = baseline ? applyBaseline(infractions, baseline) : { findings: infractions, baselineCount: 0, staleBaselineCount: 0 };
+  const findings = applied.findings;
+  const failedRules = [...new Set(findings.filter((finding) => failOn.includes(finding.type)).map((finding) => finding.type))];
+  const complete = skippedFiles.length === 0;
+  const passed = complete && failedRules.length === 0;
+  const result = {
+    schemaVersion: "1.0.0",
+    mode: "check",
+    filesInspected,
+    linesInspected,
+    totalFindings: infractions.length,
+    infractions: findings,
+    baselineCount: applied.baselineCount,
+    staleBaselineCount: applied.staleBaselineCount,
+    skippedFiles,
+    complete,
+    failedRules,
+    passed,
+    exitCode: complete ? passed ? 0 : 1 : 2,
+    output: ""
+  };
+  if (format === "json") result.output = JSON.stringify(result, null, 2);
+  else if (format === "markdown") result.output = formatCheckMarkdown(result);
+  else if (format === "github") {
+    result.output = formatGithubAnnotations(result) + (complete ? "" : "\n::error::Project scan incomplete. See the JSON or terminal report for skipped files.");
+  } else result.output = formatCheckTerminal(result);
+  return result;
+}
+
 // src/index.ts
 var InvalidDetectorError = class extends Error {
   constructor(message) {
@@ -1621,10 +2007,10 @@ var InvalidDetectorError = class extends Error {
   }
 };
 async function roastRepository(options = {}) {
-  const cwd = path3.resolve(options.cwd || process.cwd());
+  const cwd = path5.resolve(options.cwd || process.cwd());
   const since = options.since || "90 days ago";
-  const repoName = path3.basename(cwd);
-  const collector = new MetricsCollector({ all: options.all, ignorePaths: options.ignorePaths });
+  const repoName = path5.basename(cwd);
+  const collector = new MetricsCollector({ all: options.all, ignorePaths: options.ignorePaths, rules: options.rules, panicLoopWindowMinutes: options.panicLoopWindowMinutes });
   const gitStream = streamGitLog(cwd, since);
   await parseGitLogStream(gitStream, (commit, stats) => {
     collector.processCommit(commit);
@@ -1638,7 +2024,7 @@ async function roastRepository(options = {}) {
   return { summary, output };
 }
 async function auditPullRequest(options) {
-  const cwd = path3.resolve(options.cwd || process.cwd());
+  const cwd = path5.resolve(options.cwd || process.cwd());
   const format = options.format || "terminal";
   const failOn = (options.failOn || ["test-skip"]).map((s) => s.trim()).filter(Boolean);
   for (const det of failOn) {
@@ -1648,10 +2034,16 @@ async function auditPullRequest(options) {
       );
     }
   }
-  const baseSha = resolveCommitSha(cwd, options.base, "Base ref");
-  const headSha = resolveCommitSha(cwd, options.head, "Head ref");
-  const mergeBaseSha = findMergeBase(cwd, baseSha, headSha);
-  const diffStream = streamGitDiff(cwd, mergeBaseSha, headSha);
+  if (options.staged && options.base) {
+    throw new GitResolutionError("--staged cannot be combined with --base.");
+  }
+  if (!options.staged && !options.base) {
+    throw new GitResolutionError("A base ref is required for a pull request audit.");
+  }
+  const baseSha = options.staged ? "INDEX" : resolveCommitSha(cwd, options.base, "Base ref");
+  const headSha = options.staged ? "INDEX" : resolveCommitSha(cwd, options.head || "HEAD", "Head ref");
+  const mergeBaseSha = options.staged ? "INDEX" : findMergeBase(cwd, baseSha, headSha);
+  const diffStream = streamGitDiff(cwd, mergeBaseSha, headSha, options.staged);
   let rawDiff = "";
   await new Promise((resolve2, reject) => {
     diffStream.on("data", (chunk) => {
@@ -1661,7 +2053,7 @@ async function auditPullRequest(options) {
     diffStream.on("error", reject);
   });
   const { files, skippedLongLines, skippedUnknownFiles } = parseDiff(rawDiff);
-  const audit = auditFileDiffs(files, headSha, (/* @__PURE__ */ new Date()).toISOString(), { ignorePaths: options.ignorePaths });
+  const audit = auditFileDiffs(files, headSha, (/* @__PURE__ */ new Date()).toISOString(), { ignorePaths: options.ignorePaths, rules: options.rules });
   const infractions = audit.infractions;
   const defectDensityPer100Lines = audit.linesAdded > 0 ? Math.round(infractions.length / audit.linesAdded * 100 * 100) / 100 : 0;
   const failedRules = [...new Set(
@@ -1671,6 +2063,7 @@ async function auditPullRequest(options) {
   const exitCode = passed ? 0 : 1;
   const result = {
     schemaVersion: "1.0.0",
+    mode: options.staged ? "staged" : "pr",
     baseSha,
     headSha,
     mergeBaseSha,
@@ -1713,7 +2106,10 @@ export {
   resolveCommitSha,
   findMergeBase,
   GitResolutionError,
+  RULE_GUIDES,
+  VALID_DETECTORS,
   DEFAULT_CONFIG,
+  ConfigError,
   loadConfig,
   matchIgnorePath,
   isCodeFile,
@@ -1727,7 +2123,8 @@ export {
   formatGithubAnnotations,
   formatGithubStepSummary,
   formatPrMarkdownComment,
-  VALID_DETECTORS,
+  formatCheckTerminal,
+  formatCheckMarkdown,
   DEFAULT_CONFIG_TEMPLATE,
   GITHUB_WORKFLOW_TEMPLATE,
   PRE_COMMIT_HOOK_TEMPLATE,
@@ -1736,6 +2133,12 @@ export {
   generateSvgBadge,
   generateShieldsMarkdown,
   generateShieldsJson,
+  findingFingerprint,
+  createBaseline,
+  loadBaseline,
+  applyBaseline,
+  writeBaseline,
+  checkProject,
   InvalidDetectorError,
   roastRepository,
   auditPullRequest