agent-roast 0.4.0 → 0.6.0

package/dist/{chunk-O4SB2FCT.js → chunk-RU5OYHLR.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import path3 from "path";
+import path6 from "path";
 
 // src/git.ts
 import { spawn, spawnSync } from "child_process";
@@ -84,6 +84,8 @@ var HERMETIC_GIT_FLAGS = [
   "-c",
   "core.quotepath=false",
   "-c",
+  "core.fsmonitor=false",
+  "-c",
   "diff.noprefix=false",
   "-c",
   "diff.mnemonicPrefix=false",
@@ -433,7 +435,7 @@ function streamGitLog(cwd = process.cwd(), since = "90 days ago") {
   });
   return output;
 }
-function streamGitDiff(cwd, baseSha, headSha) {
+function streamGitDiff(cwd, baseSha, headSha, staged = false) {
   const gitArgs = [
     ...HERMETIC_GIT_FLAGS,
     "diff",
@@ -443,9 +445,9 @@ function streamGitDiff(cwd, baseSha, headSha) {
     "--no-textconv",
     "--src-prefix=a/",
     "--dst-prefix=b/",
+    ...staged ? ["--cached"] : [],
     "--end-of-options",
-    baseSha,
-    headSha,
+    ...staged ? [] : [baseSha, headSha],
     ...COMMON_EXCLUDE_SPECS
   ];
   const output = new PassThrough();
@@ -542,9 +544,155 @@ var GitResolutionError = class extends Error {
   }
 };
 
+// src/source.ts
+var SourceMasker = class {
+  blockComment = false;
+  quote = "";
+  triple = false;
+  previousLine = 0;
+  python;
+  javascript;
+  hashComments;
+  backticks;
+  constructor(filename) {
+    this.python = filename.endsWith(".py");
+    this.hashComments = this.python || filename.endsWith(".rb");
+    this.backticks = /\.(?:go|[cm]?[jt]sx?|vue|svelte)$/.test(filename);
+    this.javascript = /\.(?:[cm]?[jt]sx?|vue|svelte)$/.test(filename);
+  }
+  mask(line, number) {
+    if (number !== this.previousLine + 1) {
+      this.blockComment = false;
+      this.quote = "";
+      this.triple = false;
+    }
+    this.previousLine = number;
+    const code = Array(line.length).fill(" ");
+    const comments = Array(line.length).fill(" ");
+    let i = 0;
+    let prefix = "";
+    while (i < line.length) {
+      if (this.blockComment) {
+        if (line.startsWith("*/", i)) {
+          this.blockComment = false;
+          i += 2;
+        } else i++;
+        continue;
+      }
+      if (this.quote) {
+        if (line[i] === "\\") {
+          i += 2;
+          continue;
+        }
+        const delimiter = this.triple ? this.quote.repeat(3) : this.quote;
+        if (line.startsWith(delimiter, i)) {
+          i += delimiter.length;
+          this.quote = "";
+          this.triple = false;
+        } else i++;
+        continue;
+      }
+      if (!this.python && line.startsWith("//", i) || this.hashComments && line[i] === "#") {
+        for (let j = i; j < line.length; j++) comments[j] = line[j];
+        break;
+      }
+      if (!this.python && line.startsWith("/*", i)) {
+        this.blockComment = true;
+        i += 2;
+        continue;
+      }
+      const char = line[i];
+      if (char === '"' || char === "'" || this.backticks && char === "`") {
+        this.quote = char;
+        this.triple = this.python && line.startsWith(char.repeat(3), i);
+        i += this.triple ? 3 : 1;
+        prefix += " literal ";
+        continue;
+      }
+      if (this.javascript && char === "/" && (/(?:[=(:,[!&|?{;]|\breturn|\byield)\s*$/.test(prefix) || !prefix.trim())) {
+        let j = i + 1;
+        let inClass = false;
+        for (; j < line.length; j++) {
+          if (line[j] === "\\") {
+            j++;
+            continue;
+          }
+          if (line[j] === "[") inClass = true;
+          if (line[j] === "]") inClass = false;
+          if (line[j] === "/" && !inClass) break;
+        }
+        if (j < line.length) {
+          j++;
+          while (/[a-z]/i.test(line[j] || "") && j < line.length) j++;
+          i = j;
+          prefix += " literal ";
+          continue;
+        }
+      }
+      code[i] = char;
+      prefix += char;
+      i++;
+    }
+    if (this.quote !== "`" && !this.triple) this.quote = "";
+    return { code: code.join(""), comments: comments.join("") };
+  }
+};
+
+// src/rules.ts
+var RULE_GUIDES = {
+  "test-skip": {
+    title: "Skipped or disabled test",
+    why: "The test runner may report success without executing this behavior check.",
+    suggestion: "Re-enable the test and fix its failure. If a skip is intentional, document its reason and track when to restore it.",
+    example: 'it.skip("auth", ...) \u2192 it("auth", ...) after fixing the failing behavior'
+  },
+  "trivial-assert": {
+    title: "Assertion that always passes",
+    why: "Comparing a constant to itself does not check the implementation and cannot catch regressions.",
+    suggestion: "Call the real behavior and assert its output or observable side effect instead of comparing constants.",
+    example: "expect(true).toBe(true) \u2192 expect(canSignIn(validUser)).toBe(true)"
+  },
+  "type-escape": {
+    title: "Type or linter check bypass",
+    why: "A suppression can hide incompatible values or a disabled correctness check. Some suppressions are justified.",
+    suggestion: "Narrow or validate the value at the boundary. Keep a suppression only with a specific reason and the smallest possible scope.",
+    example: "response as any \u2192 parse and validate response before using it"
+  },
+  "swallowed-error": {
+    title: "Error discarded without handling",
+    why: "An empty handler makes a failed operation look successful to callers and hides diagnostics.",
+    suggestion: "Handle the expected error explicitly, return an observable failure, or rethrow it. Document an intentional best-effort operation.",
+    example: "catch (error) {} \u2192 catch (error) { throw new Error('Save failed', { cause: error }); }"
+  },
+  "stub-abandonment": {
+    title: "Unimplemented code path",
+    why: "A placeholder throws at runtime when a caller reaches the unfinished path. Abstract methods may be intentional.",
+    suggestion: "Implement the path or make its unsupported state explicit to callers. Check whether this is an intentional abstract contract.",
+    example: "throw new Error('Not implemented') \u2192 implement the operation and add a behavior test"
+  },
+  "panic-loop": {
+    title: "Rapid overlapping fix commits",
+    why: "Repeated short fix cycles can suggest a missing reproduction or feedback loop; timing alone does not prove poor work.",
+    suggestion: "Find a minimal reproduction, add a regression test, and verify the complete fix before the next patch.",
+    example: "fix \u2192 revert \u2192 fix \u2192 add a reproducer and validate the final behavior"
+  }
+};
+
 // src/config.ts
 import * as fs from "fs";
 import * as path from "path";
+
+// src/types.ts
+var VALID_DETECTORS = [
+  "test-skip",
+  "type-escape",
+  "swallowed-error",
+  "panic-loop",
+  "trivial-assert",
+  "stub-abandonment"
+];
+
+// src/config.ts
 var DEFAULT_CONFIG = {
   failOn: ["test-skip", "trivial-assert"],
   ignorePaths: [
@@ -571,31 +719,71 @@ var CONFIG_FILENAMES = [
   ".agentroastrc",
   "agent-roast.config.json"
 ];
+var ConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigError";
+  }
+};
+function validateConfig(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new ConfigError("Configuration must be a JSON object.");
+  }
+  const config = value;
+  const knownRules = new Set(VALID_DETECTORS);
+  if (config.failOn !== void 0 && (!Array.isArray(config.failOn) || config.failOn.some((rule) => typeof rule !== "string" || !knownRules.has(rule)))) {
+    throw new ConfigError(`failOn must contain known rules: ${VALID_DETECTORS.join(", ")}`);
+  }
+  if (config.ignorePaths !== void 0 && (!Array.isArray(config.ignorePaths) || config.ignorePaths.some((pattern) => typeof pattern !== "string"))) {
+    throw new ConfigError("ignorePaths must be an array of strings.");
+  }
+  if (config.scoreThreshold !== void 0 && (typeof config.scoreThreshold !== "number" || !Number.isFinite(config.scoreThreshold) || config.scoreThreshold < 0 || config.scoreThreshold > 100)) {
+    throw new ConfigError("scoreThreshold must be a number between 0 and 100.");
+  }
+  if (config.panicLoopWindowMinutes !== void 0 && (typeof config.panicLoopWindowMinutes !== "number" || !Number.isFinite(config.panicLoopWindowMinutes) || config.panicLoopWindowMinutes <= 0)) {
+    throw new ConfigError("panicLoopWindowMinutes must be a positive number.");
+  }
+  if (config.rules !== void 0) {
+    if (!config.rules || typeof config.rules !== "object" || Array.isArray(config.rules)) {
+      throw new ConfigError("rules must be an object.");
+    }
+    for (const [rule, level] of Object.entries(config.rules)) {
+      if (!knownRules.has(rule) || !["error", "warn", "off"].includes(String(level))) {
+        throw new ConfigError(`Invalid rule '${rule}' or level '${level}'. Use known rules with error, warn, or off.`);
+      }
+    }
+  }
+}
+function configFromText(text, source) {
+  try {
+    const parsed = JSON.parse(text);
+    validateConfig(parsed);
+    const rules = { ...DEFAULT_CONFIG.rules, ...parsed.rules };
+    const failOn = parsed.failOn ?? Object.entries(rules).filter(([, level]) => level === "error").map(([rule]) => rule);
+    return {
+      ...DEFAULT_CONFIG,
+      ...parsed,
+      failOn,
+      ignorePaths: [.../* @__PURE__ */ new Set([...DEFAULT_CONFIG.ignorePaths || [], ...parsed.ignorePaths || []])],
+      rules
+    };
+  } catch (error) {
+    throw new ConfigError(`Invalid ${source}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
 function loadConfig(cwd = process.cwd()) {
   for (const filename of CONFIG_FILENAMES) {
     const filePath = path.join(cwd, filename);
     if (fs.existsSync(filePath)) {
       try {
-        const raw = fs.readFileSync(filePath, "utf8");
-        const parsed = JSON.parse(raw);
-        if (typeof parsed === "object" && parsed !== null) {
-          return {
-            ...DEFAULT_CONFIG,
-            ...parsed,
-            failOn: Array.isArray(parsed.failOn) ? parsed.failOn : DEFAULT_CONFIG.failOn,
-            ignorePaths: Array.isArray(parsed.ignorePaths) ? Array.from(/* @__PURE__ */ new Set([...DEFAULT_CONFIG.ignorePaths || [], ...parsed.ignorePaths])) : DEFAULT_CONFIG.ignorePaths,
-            rules: {
-              ...DEFAULT_CONFIG.rules,
-              ...parsed.rules || {}
-            }
-          };
-        }
-      } catch (err) {
-        console.warn(`Warning: Failed to parse ${filename}: ${err.message}. Using default configuration.`);
+        return configFromText(fs.readFileSync(filePath, "utf8"), filename);
+      } catch (error) {
+        if (error instanceof ConfigError) throw error;
+        throw new ConfigError(`Cannot read ${filename}: ${error instanceof Error ? error.message : String(error)}`);
       }
     }
   }
-  return { ...DEFAULT_CONFIG };
+  return configFromText("{}", "default configuration");
 }
 function matchIgnorePath(filePath, ignorePatterns) {
   if (!ignorePatterns || ignorePatterns.length === 0) {
@@ -605,7 +793,25 @@ function matchIgnorePath(filePath, ignorePatterns) {
   for (const pattern of ignorePatterns) {
     if (!pattern) continue;
     const cleanPattern = pattern.replace(/\\/g, "/");
-    let regexPattern = cleanPattern.replace(/[.+^${}()|[\]]/g, "\\$&").replace(/\*\*\//g, "(?:^|.*?/)").replace(/\/\*\*/g, "(?:/.*)?").replace(/\*/g, "[^/]*");
+    let regexPattern = "";
+    for (let i = 0; i < cleanPattern.length; i++) {
+      const char = cleanPattern[i];
+      if (char === "*" && cleanPattern[i + 1] === "*") {
+        i++;
+        if (cleanPattern[i + 1] === "/") {
+          regexPattern += "(?:.*/)?";
+          i++;
+        } else {
+          regexPattern += ".*";
+        }
+      } else if (char === "*") {
+        regexPattern += "[^/]*";
+      } else if (char === "?") {
+        regexPattern += "[^/]";
+      } else {
+        regexPattern += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+      }
+    }
     if (!regexPattern.startsWith("^") && !regexPattern.startsWith("(?:^")) {
       regexPattern = "(?:^|/)" + regexPattern;
     }
@@ -628,7 +834,7 @@ function matchIgnorePath(filePath, ignorePatterns) {
 
 // src/metrics.ts
 var TEST_SKIP_PATTERNS = [
-  { regex: /(?:it|test|describe)\.skip\b/, name: "skipped test (it.skip / describe.skip)" },
+  { regex: /\b(?:it|test|describe)\.skip\b/, name: "skipped test (it.skip / describe.skip)" },
   { regex: /\b(?:xit|xtest)\(/, name: "disabled test (xit / xtest)" },
   { regex: /@pytest\.mark\.skip\b/, name: "skipped pytest (@pytest.mark.skip)" },
   { regex: /\bpytest\.skip\(/, name: "imperative pytest skip (pytest.skip)" },
@@ -652,9 +858,9 @@ var SWALLOWED_ERROR_PATTERNS = [
   { regex: /except(?:\s+[^:]*)?:\s*pass\b/, name: "silent python error swallow (except: pass)" }
 ];
 var TRIVIAL_ASSERT_PATTERNS = [
-  { regex: /expect\s*\(\s*(?:true|false|1|0|null|undefined)\s*\)\.toBe\s*\(\s*(?:true|false|1|0|null|undefined)\s*\)/, name: "trivial assertion (expect(val).toBe(val))" },
-  { regex: /expect\s*\(\s*(?:true|false|1|0|null|undefined)\s*\)\.toEqual\s*\(\s*(?:true|false|1|0|null|undefined)\s*\)/, name: "trivial assertion (expect(val).toEqual(val))" },
-  { regex: /\bassert\s+(?:True|False|1\s*==\s*1)\b/, name: "trivial python assert (assert True / 1 == 1)" },
+  { regex: /expect\s*\(\s*(true|false|1|0|null|undefined)\s*\)\.toBe\s*\(\s*\1\s*\)/, name: "trivial assertion (expect(val).toBe(val))" },
+  { regex: /expect\s*\(\s*(true|false|1|0|null|undefined)\s*\)\.toEqual\s*\(\s*\1\s*\)/, name: "trivial assertion (expect(val).toEqual(val))" },
+  { regex: /\bassert\s+(?:True|1\s*==\s*1)\s*(?=$|#|,)/, name: "trivial python assert (assert True / 1 == 1)" },
   { regex: /self\.assertTrue\s*\(\s*(?:True|1)\s*\)/, name: "trivial assert (self.assertTrue(True))" },
   { regex: /self\.assertEqual\s*\(\s*(?:1\s*,\s*1|True\s*,\s*True)\s*\)/, name: "trivial assert (self.assertEqual(1, 1))" },
   { regex: /assert\.(?:strictEqual|equal)\s*\(\s*(?:true\s*,\s*true|1\s*,\s*1)\s*\)/, name: "trivial assert (assert.equal(1, 1))" }
@@ -687,7 +893,7 @@ var CODE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".c"
 ]);
 var IGNORED_PATH_REGEX = /(?:^|\/)(?:fixtures|__fixtures__|testdata|mocks|test_data|__snapshots__|sample[s]?)\//i;
-var TEST_PATH_REGEX = /(?:^|\/)(?:tests?|__tests__|specs?)\/|[._-](?:test|spec)\.[a-z0-9]+$/i;
+var TEST_PATH_REGEX = /(?:^|\/)test_[^/]+\.py$|(?:^|\/)(?:tests?|__tests__|specs?)\/|[._-](?:test|spec)\.[a-z0-9]+$/i;
 function isCodeFile(filePath, customIgnorePaths) {
   if (IGNORED_PATH_REGEX.test(filePath)) {
     return false;
@@ -712,11 +918,14 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
     hasSupportedChanges = true;
     filesInspected++;
     linesAdded += file.addedLines.length;
+    const masker = new SourceMasker(file.path);
+    const maskedLines = [];
     for (const added of file.addedLines) {
       const rawLine = added.line;
-      const cleanedLine = stripStringAndRegexLiterals(rawLine);
-      const trimmedCleaned = cleanedLine.trim();
-      const isComment = isCommentOnlyLine(trimmedCleaned);
+      const masked = masker.mask(rawLine, added.lineNumber);
+      const cleanedLine = masked.code;
+      maskedLines.push({ code: cleanedLine, raw: rawLine, number: added.lineNumber });
+      const isComment = !cleanedLine.trim();
       if (!isComment) {
         for (const rule of TEST_SKIP_PATTERNS) {
           if (rule.regex.test(cleanedLine)) {
@@ -735,7 +944,7 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
       }
       let foundEscape = false;
       for (const rule of COMMENT_DIRECTIVE_PATTERNS) {
-        if (rule.regex.test(cleanedLine)) {
+        if (rule.regex.test(masked.comments)) {
           infractions.push({
             type: "type-escape",
             file: file.path,
@@ -799,7 +1008,8 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
       }
       if (!isComment) {
         for (const rule of STUB_ABANDONMENT_PATTERNS) {
-          if (rule.regex.test(rawLine)) {
+          const match = rule.regex.exec(rawLine);
+          if (match && cleanedLine[match.index] === rawLine[match.index]) {
             infractions.push({
               type: "stub-abandonment",
               file: file.path,
@@ -814,14 +1024,39 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
         }
       }
     }
+    for (let index = 0; index < maskedLines.length; index++) {
+      const start = maskedLines[index];
+      const isCatch = /\bcatch\s*(?:\([^)]*\))?\s*\{\s*$/.test(start.code);
+      const isExcept = /\bexcept(?:\s+[^:]*)?:\s*$/.test(start.code);
+      if (!isCatch && !isExcept) continue;
+      let next = index + 1;
+      while (next < maskedLines.length && maskedLines[next].number === maskedLines[next - 1].number + 1 && !maskedLines[next].code.trim()) next++;
+      const end = maskedLines[next];
+      if (!end || end.number !== maskedLines[next - 1].number + 1) continue;
+      const closesCatch = isCatch && /^\s*}/.test(end.code);
+      let closesExcept = isExcept && /^\s*pass\s*$/.test(end.code);
+      if (closesExcept) {
+        const indent = start.raw.search(/\S/);
+        if (end.raw.search(/\S/) <= indent) closesExcept = false;
+        let after = next + 1;
+        while (after < maskedLines.length && maskedLines[after].number === maskedLines[after - 1].number + 1 && !maskedLines[after].code.trim()) after++;
+        if (after < maskedLines.length && maskedLines[after].number === maskedLines[after - 1].number + 1 && maskedLines[after].raw.search(/\S/) > indent) closesExcept = false;
+      }
+      if (closesCatch || closesExcept) infractions.push({
+        type: "swallowed-error",
+        file: file.path,
+        lineNumber: start.number,
+        lineSnippet: maskedLines.slice(index, next + 1).map((line) => line.raw.trim()).join(" "),
+        commitHash,
+        commitDate,
+        reason: closesCatch ? "empty multi-line catch block" : "silent multi-line python error swallow"
+      });
+    }
   }
-  return { infractions, hasSupportedChanges, filesInspected, linesAdded };
+  return { infractions: infractions.filter((inf) => options.rules?.[inf.type] !== "off").map((inf) => ({ ...inf, suggestion: RULE_GUIDES[inf.type].suggestion })), hasSupportedChanges, filesInspected, linesAdded };
 }
 function stripStringAndRegexLiterals(line) {
-  return line.replace(/(["'`])(?:\\.|(?!\1)[^\\\r\n])*\1/g, '""').replace(/\/(?=[^\/\s])(?:\\\/|[^\/\r\n])+\/[gimsuy]*/g, '""');
-}
-function isCommentOnlyLine(trimmedLine) {
-  return trimmedLine.startsWith("//") || trimmedLine.startsWith("/*") || trimmedLine.startsWith("*") || trimmedLine.startsWith("#");
+  return new SourceMasker("source.ts").mask(line, 1).code;
 }
 var PANIC_COMMIT_REGEX = /\b(?:fix|quickfix|revert|hotfix|retry|patch|undo|workaround)\b/i;
 var MAX_INFRACTIONS_PER_COMMIT = 10;
@@ -842,16 +1077,20 @@ var MetricsCollector = class {
   activePanicChain = null;
   includeAll;
   ignorePaths;
+  rules;
+  panicLoopWindowMinutes;
   constructor(options = {}) {
     this.includeAll = options.all ?? false;
     this.ignorePaths = options.ignorePaths;
+    this.rules = options.rules;
+    this.panicLoopWindowMinutes = options.panicLoopWindowMinutes ?? 15;
   }
   recordSkipped(stats) {
     if (stats.skippedLongLines) this.skippedLongLines += stats.skippedLongLines;
     if (stats.skippedUnknownFiles) this.skippedUnknownFiles += stats.skippedUnknownFiles;
   }
   flushPanicChain() {
-    if (this.activePanicChain && this.activePanicChain.commitCount >= 2) {
+    if (this.rules?.["panic-loop"] !== "off" && this.activePanicChain && this.activePanicChain.commitCount >= 2) {
       const chain = this.activePanicChain;
       const durationMinutes = Math.max(
         1,
@@ -876,6 +1115,7 @@ var MetricsCollector = class {
       this.aiLinesAdded += commit.totalAddedCount;
     }
     if (!isTarget) {
+      this.flushPanicChain();
       return;
     }
     const subject = commit.message.split("\n")[0];
@@ -888,7 +1128,7 @@ var MetricsCollector = class {
       if (this.activePanicChain && this.activePanicChain.author.toLowerCase() === commit.authorEmail.toLowerCase()) {
         const diffMinutes = Math.abs(commitDateMs - this.activePanicChain.latestDate) / (1e3 * 60);
         const touchedSameFiles = currentActiveFiles.size > 0 && [...currentActiveFiles].some((p) => this.activePanicChain.activeFiles.has(p));
-        if (diffMinutes > 0 && diffMinutes <= 15 && touchedSameFiles) {
+        if (diffMinutes > 0 && diffMinutes <= this.panicLoopWindowMinutes && touchedSameFiles) {
           this.activePanicChain.commitCount++;
           this.activePanicChain.latestHash = commit.hash;
           this.activePanicChain.latestDate = commitDateMs;
@@ -927,123 +1167,23 @@ var MetricsCollector = class {
     } else {
       this.flushPanicChain();
     }
-    let commitSkips = 0;
-    let commitEscapes = 0;
-    let commitSwallowed = 0;
-    let commitTrivial = 0;
-    let commitStubs = 0;
-    for (const file of commit.files) {
-      if (!isCodeFile(file.path, this.ignorePaths)) {
-        continue;
-      }
-      for (const added of file.addedLines) {
-        const rawLine = added.line;
-        const cleanedLine = stripStringAndRegexLiterals(rawLine);
-        const trimmedCleaned = cleanedLine.trim();
-        const isComment = isCommentOnlyLine(trimmedCleaned);
-        if (!isComment && commitSkips < MAX_INFRACTIONS_PER_COMMIT) {
-          for (const rule of TEST_SKIP_PATTERNS) {
-            if (rule.regex.test(cleanedLine)) {
-              this.testSkips.push({
-                type: "test-skip",
-                file: file.path,
-                lineNumber: added.lineNumber,
-                lineSnippet: rawLine.trim(),
-                commitHash: commit.hash,
-                commitDate: commit.date,
-                reason: rule.name
-              });
-              commitSkips++;
-              break;
-            }
-          }
-        }
-        if (commitEscapes < MAX_INFRACTIONS_PER_COMMIT) {
-          for (const rule of COMMENT_DIRECTIVE_PATTERNS) {
-            if (rule.regex.test(cleanedLine)) {
-              this.typeEscapes.push({
-                type: "type-escape",
-                file: file.path,
-                lineNumber: added.lineNumber,
-                lineSnippet: rawLine.trim(),
-                commitHash: commit.hash,
-                commitDate: commit.date,
-                reason: rule.name
-              });
-              commitEscapes++;
-              break;
-            }
-          }
-          if (!isComment && commitEscapes < MAX_INFRACTIONS_PER_COMMIT) {
-            for (const rule of CODE_TYPE_ESCAPE_PATTERNS) {
-              if (rule.regex.test(cleanedLine)) {
-                this.typeEscapes.push({
-                  type: "type-escape",
-                  file: file.path,
-                  lineNumber: added.lineNumber,
-                  lineSnippet: rawLine.trim(),
-                  commitHash: commit.hash,
-                  commitDate: commit.date,
-                  reason: rule.name
-                });
-                commitEscapes++;
-                break;
-              }
-            }
-          }
-        }
-        if (!isComment && commitSwallowed < MAX_INFRACTIONS_PER_COMMIT) {
-          for (const rule of SWALLOWED_ERROR_PATTERNS) {
-            if (rule.regex.test(cleanedLine)) {
-              this.swallowedErrors.push({
-                type: "swallowed-error",
-                file: file.path,
-                lineNumber: added.lineNumber,
-                lineSnippet: rawLine.trim(),
-                commitHash: commit.hash,
-                commitDate: commit.date,
-                reason: rule.name
-              });
-              commitSwallowed++;
-              break;
-            }
-          }
-        }
-        if (!isComment && isTestFile(file.path) && commitTrivial < MAX_INFRACTIONS_PER_COMMIT) {
-          for (const rule of TRIVIAL_ASSERT_PATTERNS) {
-            if (rule.regex.test(cleanedLine)) {
-              this.trivialAsserts.push({
-                type: "trivial-assert",
-                file: file.path,
-                lineNumber: added.lineNumber,
-                lineSnippet: rawLine.trim(),
-                commitHash: commit.hash,
-                commitDate: commit.date,
-                reason: rule.name
-              });
-              commitTrivial++;
-              break;
-            }
-          }
-        }
-        if (!isComment && commitStubs < MAX_INFRACTIONS_PER_COMMIT) {
-          for (const rule of STUB_ABANDONMENT_PATTERNS) {
-            if (rule.regex.test(rawLine)) {
-              this.stubAbandonments.push({
-                type: "stub-abandonment",
-                file: file.path,
-                lineNumber: added.lineNumber,
-                lineSnippet: rawLine.trim(),
-                commitHash: commit.hash,
-                commitDate: commit.date,
-                reason: rule.name
-              });
-              commitStubs++;
-              break;
-            }
-          }
-        }
-      }
+    const audit = auditFileDiffs(commit.files, commit.hash, commit.date, {
+      ignorePaths: this.ignorePaths,
+      rules: this.rules
+    });
+    const buckets = {
+      "test-skip": this.testSkips,
+      "type-escape": this.typeEscapes,
+      "swallowed-error": this.swallowedErrors,
+      "trivial-assert": this.trivialAsserts,
+      "stub-abandonment": this.stubAbandonments,
+      "panic-loop": this.panicLoops
+    };
+    const counts = {};
+    for (const infraction of audit.infractions) {
+      const count = counts[infraction.type] || 0;
+      if (count < MAX_INFRACTIONS_PER_COMMIT) buckets[infraction.type].push(infraction);
+      counts[infraction.type] = count + 1;
     }
   }
   getSummary() {
@@ -1161,25 +1301,26 @@ function formatTerminalCard(summary, options) {
   );
   lines.push("");
   if (!summary.isSufficientData || summary.score === null) {
-    lines.push(pc.yellow(`  insufficient data (< 200 lines added by AI)`));
-    lines.push(pc.dim("  commit more code and run `npx agent-roast` again."));
+    lines.push(pc.yellow(`  insufficient data (< 200 analyzed lines added)`));
+    lines.push(pc.dim("  Findings below remain actionable; a score needs a larger sample."));
+    lines.push("");
+  }
+  if (summary.isSufficientData && summary.score !== null) {
+    let scoreColor = pc.green;
+    if (summary.score < 60) scoreColor = pc.red;
+    else if (summary.score < 80) scoreColor = pc.yellow;
+    lines.push(
+      `  ${pc.bold("SCORE:")} ${scoreColor(pc.bold(`${summary.score} / 100`))}  ${pc.dim("\xB7")}  ${pc.magenta(pc.bold(summary.archetype))}`
+    );
+    lines.push(`  ${pc.dim(summary.archetypeDescription)}`);
     lines.push("");
-    return lines.join("\n");
   }
-  let scoreColor = pc.green;
-  if (summary.score < 60) scoreColor = pc.red;
-  else if (summary.score < 80) scoreColor = pc.yellow;
-  lines.push(
-    `  ${pc.bold("SCORE:")} ${scoreColor(pc.bold(`${summary.score} / 100`))}  ${pc.dim("\xB7")}  ${pc.magenta(pc.bold(summary.archetype))}`
-  );
-  lines.push(`  ${pc.dim(summary.archetypeDescription)}`);
-  lines.push("");
   const totalInfractions = (summary.testSkips?.length || 0) + (summary.typeEscapes?.length || 0) + (summary.swallowedErrors?.length || 0) + (summary.panicLoops?.length || 0) + (summary.trivialAsserts?.length || 0) + (summary.stubAbandonments?.length || 0);
   lines.push(pc.bold(`  INFRACTIONS (${totalInfractions})`));
   lines.push(pc.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   if (summary.panicLoops && summary.panicLoops.length > 0) {
     lines.push(
-      `  ${pc.magenta("\u25CF")} ${pc.bold("panic-loop")} (${summary.panicLoops.length})  ${pc.dim("consecutive quick fixes < 15m apart")}`
+      `  ${pc.magenta("\u25CF")} ${pc.bold("panic-loop")} (${summary.panicLoops.length})  ${pc.dim("rapid consecutive fixes touching overlapping files")}`
     );
     const sample = summary.panicLoops[0];
     lines.push(`      ${pc.dim(sample.reason)}`);
@@ -1278,10 +1419,10 @@ function formatPrTerminalCard(result) {
   const lines = [];
   lines.push("");
   lines.push(
-    `${pc.bold(pc.cyan("agent-roast"))} ${pc.dim("\u2014 pull request audit")} ${pc.white(`${result.baseSha.slice(0, 7)}...${result.headSha.slice(0, 7)}`)}`
+    `${pc.bold(pc.cyan("agent-roast"))} ${pc.dim(result.mode === "staged" ? "\u2014 staged changes audit" : "\u2014 pull request audit")} ${pc.white(`${result.baseSha.slice(0, 7)}...${result.headSha.slice(0, 7)}`)}`
   );
   if (!result.hasSupportedChanges) {
-    lines.push(`  ${pc.dim("no supported source changes detected in pull request.")}`);
+    lines.push(`  ${pc.dim("no supported source changes detected in the audited diff.")}`);
     lines.push("");
     return lines.join("\n");
   }
@@ -1290,7 +1431,7 @@ function formatPrTerminalCard(result) {
   );
   lines.push("");
   if (result.infractions.length === 0) {
-    lines.push(`  ${pc.green("PASS")} ${pc.dim("zero infractions detected across all pull request changes.")}`);
+    lines.push(`  ${pc.green("PASS")} ${pc.dim("zero infractions detected across all audited changes.")}`);
   } else {
     lines.push(pc.bold(`  INFRACTIONS DETECTED (${result.infractions.length})`));
     lines.push(pc.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
@@ -1302,6 +1443,7 @@ function formatPrTerminalCard(result) {
       if (inf.lineSnippet) {
         lines.push(`      ${pc.dim(`\u2514\u2500 ${inf.lineSnippet}`)}`);
       }
+      if (inf.suggestion) lines.push(`      ${pc.dim(`Next: ${inf.suggestion}`)}`);
     }
   }
   lines.push("");
@@ -1328,6 +1470,10 @@ function sortInfractionsDeterministic(infractions) {
     return (a.lineNumber || 0) - (b.lineNumber || 0);
   });
 }
+function escapeCommand(value, property = false) {
+  const escaped = value.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
+  return property ? escaped.replace(/:/g, "%3A").replace(/,/g, "%2C") : escaped;
+}
 function formatGithubAnnotations(result) {
   const outputLines = [];
   const sorted = sortInfractionsDeterministic(result.infractions);
@@ -1337,20 +1483,20 @@ function formatGithubAnnotations(result) {
   let omittedCount = 0;
   for (const inf of sorted) {
     if (!inf.file || inf.file === "unknown") continue;
-    const isError = result.failedRules.includes(inf.type) || inf.type === "test-skip" || inf.type === "trivial-assert" || inf.type === "swallowed-error";
+    const isError = result.failedRules.includes(inf.type);
     const line = inf.lineNumber || 1;
-    const title = inf.reason.replace(/[\r\n]/g, " ");
-    const msg = (inf.lineSnippet || inf.reason).replace(/[\r\n]/g, " ");
+    const title = escapeCommand(inf.reason, true);
+    const msg = escapeCommand(inf.lineSnippet || inf.reason);
     if (isError) {
       if (errorCount < MAX_PER_LEVEL) {
-        outputLines.push(`::error file=${inf.file},line=${line},title=${title}::${msg}`);
+        outputLines.push(`::error file=${escapeCommand(inf.file, true)},line=${line},title=${title}::${msg}`);
         errorCount++;
       } else {
         omittedCount++;
       }
     } else {
       if (warnCount < MAX_PER_LEVEL) {
-        outputLines.push(`::warning file=${inf.file},line=${line},title=${title}::${msg}`);
+        outputLines.push(`::warning file=${escapeCommand(inf.file, true)},line=${line},title=${title}::${msg}`);
         warnCount++;
       } else {
         omittedCount++;
@@ -1366,10 +1512,10 @@ function formatGithubAnnotations(result) {
 }
 function formatGithubStepSummary(result) {
   const lines = [];
-  lines.push("### agent-roast Pull Request Audit");
+  lines.push(result.mode === "staged" ? "### agent-roast Staged Changes Audit" : "### agent-roast Pull Request Audit");
   lines.push("");
   if (!result.hasSupportedChanges) {
-    lines.push("No supported source file changes detected in this pull request.");
+    lines.push("No supported source file changes detected in the audited diff.");
     return lines.join("\n");
   }
   const statusBadge = result.passed ? "Passed" : `Failed (${result.failedRules.join(", ")})`;
@@ -1404,7 +1550,7 @@ function formatPrMarkdownComment(result) {
   lines.push(`## \u{1F6E1}\uFE0F agent-roast audit: ${titleStatus} ${titleEmoji}`);
   lines.push("");
   if (!result.hasSupportedChanges) {
-    lines.push("No supported source file changes detected in this pull request.");
+    lines.push("No supported source file changes detected in the audited diff.");
     lines.push("");
     lines.push("---");
     lines.push("*Audited 100% offline with [agent-roast](https://github.com/Nari-Ab/agent-roast)*");
@@ -1440,22 +1586,106 @@ function formatPrMarkdownComment(result) {
   lines.push("*Audited 100% offline with [agent-roast](https://github.com/Nari-Ab/agent-roast)*");
   return lines.join("\n");
 }
-
-// src/types.ts
-var VALID_DETECTORS = [
-  "test-skip",
-  "type-escape",
-  "swallowed-error",
-  "panic-loop",
-  "trivial-assert",
-  "stub-abandonment"
-];
+function terminalText(value) {
+  return value.replace(/[\u0000-\u001f\u007f-\u009f]/g, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function formatCheckTerminal(result) {
+  const lines = [
+    "",
+    pc.bold("agent-roast \u2014 current code check"),
+    `  ${result.filesInspected} files \xB7 ${result.linesInspected} lines inspected`,
+    `  ${result.infractions.length} findings to review \xB7 ${result.baselineCount} accepted baseline findings`
+  ];
+  if (result.staleBaselineCount) lines.push(`  ${result.staleBaselineCount} baseline findings no longer present (or now disabled/ignored).`);
+  for (const inf of result.infractions.slice(0, 20)) {
+    lines.push("", `  ${result.failedRules.includes(inf.type) ? pc.red("FAIL") : pc.yellow("WARN")} [${inf.type}] ${terminalText(inf.file || "unknown")}:${inf.lineNumber}`, `    ${terminalText(inf.lineSnippet || inf.reason)}`);
+    if (inf.suggestion) lines.push(`    Next: ${inf.suggestion}`);
+  }
+  if (result.infractions.length > 20) lines.push(`
+  ${result.infractions.length - 20} more findings. Use --format json for the complete report.`);
+  for (const skipped of result.skippedFiles) lines.push(`
+  NOT SCANNED ${terminalText(skipped.file)}: ${terminalText(skipped.reason)}`);
+  lines.push("", !result.complete ? pc.red("  INCOMPLETE: some source could not be inspected; exit 2.") : result.passed ? pc.green("  PASSED: no new blocking findings.") : pc.red(`  BLOCKED: ${result.failedRules.join(", ")}.`), "");
+  if (!result.filesInspected) lines.push("  No supported source files inspected.", "");
+  return lines.join("\n");
+}
+function markdownCell(value) {
+  return value.replace(/[\\[\]()*_!]/g, "\\$&").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/\|/g, "\\|").replace(/`/g, "&#96;").replace(/[\r\n]/g, " ");
+}
+function formatCheckMarkdown(result) {
+  const status = !result.complete ? "INCOMPLETE" : result.passed ? "PASSED" : "BLOCKED";
+  const lines = [
+    `## agent-roast current code check: ${status}`,
+    "",
+    `${result.filesInspected} files, ${result.linesInspected} lines inspected. ${result.infractions.length} findings to review; ${result.baselineCount} accepted baseline findings.`,
+    "",
+    "| Rule | Location | Finding | Next step |",
+    "| --- | --- | --- | --- |"
+  ];
+  for (const inf of result.infractions) lines.push(`| ${inf.type} | ${markdownCell(`${inf.file}:${inf.lineNumber}`)} | ${markdownCell(inf.lineSnippet || inf.reason)} | ${markdownCell(inf.suggestion || "Review this occurrence.")} |`);
+  if (result.staleBaselineCount) lines.push("", `${result.staleBaselineCount} baseline findings no longer present (or now disabled/ignored).`);
+  for (const skipped of result.skippedFiles) lines.push("", `Not scanned: ${markdownCell(skipped.file)} \u2014 ${markdownCell(skipped.reason)}`);
+  return lines.join("\n");
+}
+function formatReviewTerminal(result) {
+  const status = !result.complete ? "INCOMPLETE" : result.passed ? "PASSED" : "BLOCKED";
+  const lines = [
+    "",
+    pc.bold(`agent-roast \u2014 context review: ${status}`),
+    `  ${result.mergeBaseSha.slice(0, 7)} \u2192 ${result.headSha.slice(0, 7)} \xB7 policy from base ${result.policySha.slice(0, 7)}`,
+    `  ${result.filesInspected} changed files compared \xB7 ${result.linesInspected} source lines inspected across both versions`,
+    `  ${result.infractions.length} new \xB7 ${result.unchangedCount} existing \xB7 ${result.removedFindings.length} no longer detected`
+  ];
+  if (result.policyChanges.length) lines.push("  Candidate policy changes were ignored; adopt them separately after review.");
+  if (result.excludedFiles || result.unsupportedFiles) lines.push(`  ${result.excludedFiles} excluded \xB7 ${result.unsupportedFiles} unsupported/non-source changes`);
+  for (const finding of result.infractions.slice(0, 20)) {
+    lines.push(
+      "",
+      `  ${result.failedRules.includes(finding.type) ? "FAIL" : "WARN"} [${finding.type}] ${terminalText(finding.file || "unknown")}:${finding.lineNumber}`,
+      `    ${terminalText(finding.lineSnippet || finding.reason)}`,
+      `    Next: ${finding.suggestion || "Review this occurrence."}`
+    );
+  }
+  if (result.infractions.length > 20) lines.push(`  ${result.infractions.length - 20} more new findings; use --format json for all results.`);
+  for (const skipped of result.skippedFiles) lines.push(`  NOT COMPARED ${terminalText(skipped.file)}: ${terminalText(skipped.reason)}`);
+  lines.push("", !result.complete ? "  INCOMPLETE: some changed source was not compared (exit 2)." : result.passed ? "  PASSED: no new blocking findings." : `  BLOCKED: ${result.failedRules.join(", ")}.`, "");
+  if (!result.filesInspected) lines.push("  No supported changed source files compared.", "");
+  return lines.join("\n");
+}
+function formatReviewMarkdown(result) {
+  const status = !result.complete ? "INCOMPLETE" : result.passed ? "PASSED" : "BLOCKED";
+  const lines = [
+    `## agent-roast context review: ${status}`,
+    "",
+    `Compared ${result.filesInspected} changed files at \`${result.mergeBaseSha.slice(0, 7)}\` \u2192 \`${result.headSha.slice(0, 7)}\`. Policy: \`${result.policySha.slice(0, 7)}\`.`,
+    "",
+    `**${result.infractions.length} new** \xB7 ${result.unchangedCount} existing \xB7 ${result.removedFindings.length} no longer detected.`,
+    ""
+  ];
+  if (result.policyChanges.length) lines.push("Candidate policy changes were ignored. This review uses the supplied base commit's policy.", "");
+  lines.push("| New finding | Head location | Evidence | Next step |", "| --- | --- | --- | --- |");
+  for (const finding of result.infractions) lines.push(`| ${finding.type} | ${markdownCell(`${finding.file}:${finding.lineNumber}`)} | ${markdownCell(finding.lineSnippet || finding.reason)} | ${markdownCell(finding.suggestion || "Review this occurrence.")} |`);
+  if (result.removedFindings.length) {
+    lines.push(
+      "",
+      "### No longer detected",
+      "",
+      "These patterns disappeared from the compared source. Deleting code is not proof of a behavioral fix.",
+      "",
+      "| Rule | Previous location | Previous evidence |",
+      "| --- | --- | --- |"
+    );
+    for (const finding of result.removedFindings) lines.push(`| ${finding.type} | ${markdownCell(`${finding.file}:${finding.lineNumber}`)} | ${markdownCell(finding.lineSnippet || finding.reason)} |`);
+  }
+  for (const skipped of result.skippedFiles) lines.push("", `Not compared: ${markdownCell(skipped.file)} \u2014 ${markdownCell(skipped.reason)}`);
+  lines.push("", `Scope: changed supported files only; ${result.excludedFiles} excluded and ${result.unsupportedFiles} unsupported/non-source changes.`);
+  return lines.join("\n");
+}
 
 // src/init.ts
 import * as fs2 from "fs";
 import * as path2 from "path";
 var DEFAULT_CONFIG_TEMPLATE = {
-  $schema: "https://raw.githubusercontent.com/Nari-Ab/agent-roast/main/schema.json",
   ignorePaths: [
     "**/*.min.js",
     "**/vendor/**",
@@ -1463,21 +1693,16 @@ var DEFAULT_CONFIG_TEMPLATE = {
     "**/build/**",
     "**/fixtures/**"
   ],
-  rules: {
-    "hallucinated-package": "error",
-    "empty-catch": "warn",
-    "trivial-assert": "warn",
-    "stub-abandonment": "warn",
-    "mock-leak": "warn"
-  },
+  rules: { ...DEFAULT_CONFIG.rules },
   scoreThreshold: 70
 };
 var GITHUB_WORKFLOW_TEMPLATE = `name: Agent Roast
 on:
   pull_request:
     branches: [main, master]
-  push:
-    branches: [main, master]
+
+permissions:
+  contents: read
 
 jobs:
   audit:
@@ -1489,22 +1714,18 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-
       - name: Run agent-roast PR check
         if: github.event_name == 'pull_request'
-        run: npx agent-roast --base \${{ github.event.pull_request.base.sha }} --head \${{ github.event.pull_request.head.sha }} --format github
-
-      - name: Run agent-roast repo audit
-        if: github.event_name != 'pull_request'
-        run: npx agent-roast --fail-under 70
+        uses: Nari-Ab/agent-roast@v1
+        with:
+          base: \${{ github.event.pull_request.base.sha }}
+          head: \${{ github.event.pull_request.head.sha }}
+          format: github
+          mode: review
 `;
 var PRE_COMMIT_HOOK_TEMPLATE = `#!/bin/sh
 # Run agent-roast pre-commit verification
-npx agent-roast --fail-under 70
+npx --no-install agent-roast --staged
 `;
 async function initProject(options = {}) {
   const cwd = path2.resolve(options.cwd || process.cwd());
@@ -1512,7 +1733,7 @@ async function initProject(options = {}) {
   const skipped = [];
   const configPath = path2.join(cwd, ".agentroastrc.json");
   const altConfigPath = path2.join(cwd, "agent-roast.config.json");
-  if (fs2.existsSync(configPath) || fs2.existsSync(altConfigPath)) {
+  if (fs2.existsSync(configPath) || fs2.existsSync(altConfigPath) || fs2.existsSync(path2.join(cwd, ".agentroastrc"))) {
     skipped.push(".agentroastrc.json");
   } else {
     fs2.writeFileSync(
@@ -1613,6 +1834,539 @@ function generateShieldsJson(score, label = "AI Discipline") {
   };
 }
 
+// src/sarif.ts
+import { createRequire } from "module";
+
+// src/baseline.ts
+import { createHash, randomUUID } from "crypto";
+import * as fs3 from "fs";
+import path3 from "path";
+function findingFingerprint(finding) {
+  return createHash("sha256").update(JSON.stringify([finding.type, finding.file, finding.lineSnippet?.trim()])).digest("hex");
+}
+function createBaseline(findings) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const finding of findings) {
+    const fingerprint = findingFingerprint(finding);
+    counts.set(fingerprint, (counts.get(fingerprint) || 0) + 1);
+  }
+  return {
+    schemaVersion: "1.0.0",
+    fingerprintVersion: 1,
+    entries: [...counts].sort(([a], [b]) => a.localeCompare(b)).map(([fingerprint, count]) => ({ fingerprint, count }))
+  };
+}
+function loadBaseline(filename) {
+  try {
+    const stat = fs3.lstatSync(filename);
+    if (!stat.isFile() || stat.size > 5 * 1024 * 1024) throw new Error("Expected a regular baseline file under 5 MiB.");
+    const fd = fs3.openSync(filename, fs3.constants.O_RDONLY | (fs3.constants.O_NOFOLLOW || 0));
+    let content;
+    try {
+      const opened = fs3.fstatSync(fd);
+      if (opened.ino !== stat.ino || opened.dev !== stat.dev) throw new Error("Baseline changed while opening.");
+      const buffer = Buffer.alloc(5 * 1024 * 1024 + 1);
+      let size = 0;
+      while (size < buffer.length) {
+        const read = fs3.readSync(fd, buffer, size, buffer.length - size, null);
+        if (!read) break;
+        size += read;
+      }
+      const after = fs3.fstatSync(fd);
+      if (size > 5 * 1024 * 1024 || size !== after.size || opened.mtimeMs !== after.mtimeMs) throw new Error("Baseline changed or exceeded the size limit.");
+      content = buffer.subarray(0, size).toString("utf8");
+    } finally {
+      fs3.closeSync(fd);
+    }
+    const parsed = JSON.parse(content);
+    if (!parsed || parsed.schemaVersion !== "1.0.0" || parsed.fingerprintVersion !== 1 || !Array.isArray(parsed.entries) || parsed.entries.length > 1e5) {
+      throw new Error("Unsupported baseline schema.");
+    }
+    const seen = /* @__PURE__ */ new Set();
+    for (const entry of parsed.entries) {
+      if (!entry || typeof entry.fingerprint !== "string" || !/^[a-f0-9]{64}$/.test(entry.fingerprint) || !Number.isSafeInteger(entry.count) || entry.count <= 0 || entry.count > 1e6 || seen.has(entry.fingerprint)) {
+        throw new Error("Invalid or duplicate baseline entry.");
+      }
+      seen.add(entry.fingerprint);
+    }
+    return parsed;
+  } catch (error) {
+    throw new ConfigError(`Cannot load baseline '${filename}': ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function applyBaseline(findings, baseline) {
+  const remaining = new Map(baseline.entries.map((entry) => [entry.fingerprint, entry.count]));
+  const fresh = [];
+  let baselineCount = 0;
+  for (const finding of findings) {
+    const fingerprint = findingFingerprint(finding);
+    const count = remaining.get(fingerprint) || 0;
+    if (count > 0) {
+      remaining.set(fingerprint, count - 1);
+      baselineCount++;
+    } else {
+      fresh.push(finding);
+    }
+  }
+  return { findings: fresh, baselineCount, staleBaselineCount: [...remaining.values()].reduce((a, b) => a + b, 0) };
+}
+function writeBaseline(filename, findings) {
+  const destination = path3.resolve(filename);
+  const temporary = path3.join(path3.dirname(destination), `.agent-roast-${randomUUID()}.tmp`);
+  let fd;
+  try {
+    fd = fs3.openSync(temporary, "wx", 384);
+    fs3.writeFileSync(fd, JSON.stringify(createBaseline(findings), null, 2) + "\n");
+    fs3.fsyncSync(fd);
+    fs3.closeSync(fd);
+    fd = void 0;
+    fs3.linkSync(temporary, destination);
+  } catch (error) {
+    throw new ConfigError(`Cannot write baseline '${filename}' (existing files are preserved): ${error instanceof Error ? error.message : String(error)}`);
+  } finally {
+    if (fd !== void 0) fs3.closeSync(fd);
+    fs3.rmSync(temporary, { force: true });
+  }
+}
+
+// src/sarif.ts
+var require2 = createRequire(import.meta.url);
+var version = require2("../package.json").version;
+function formatSarif(report) {
+  const occurrences = /* @__PURE__ */ new Map();
+  const results = report.infractions.map((finding) => {
+    const filename = finding.file;
+    if (!filename || filename.startsWith("/") || filename.split("/").includes("..") || /^[a-z]:/i.test(filename)) {
+      throw new ConfigError("SARIF needs repository-relative finding paths.");
+    }
+    const fingerprint = findingFingerprint(finding);
+    const occurrence = (occurrences.get(fingerprint) || 0) + 1;
+    occurrences.set(fingerprint, occurrence);
+    return {
+      ruleId: finding.type,
+      ruleIndex: VALID_DETECTORS.indexOf(finding.type),
+      level: report.failedRules.includes(finding.type) ? "error" : "warning",
+      message: { text: `${finding.reason}. ${finding.suggestion || RULE_GUIDES[finding.type].suggestion}` },
+      locations: [{ physicalLocation: {
+        artifactLocation: { uri: filename.split("/").map((segment) => encodeURIComponent(segment)).join("/") },
+        region: { startLine: Math.max(1, finding.lineNumber || 1) }
+      } }],
+      partialFingerprints: { "agentRoastFinding/v1": `${fingerprint}:${occurrence}` },
+      ...report.mode === "review" ? { baselineState: "new" } : {}
+    };
+  });
+  return JSON.stringify({
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [{
+      tool: { driver: {
+        name: "agent-roast",
+        semanticVersion: version,
+        informationUri: "https://github.com/Nari-Ab/agent-roast",
+        rules: VALID_DETECTORS.map((rule) => ({
+          id: rule,
+          name: rule,
+          shortDescription: { text: RULE_GUIDES[rule].title },
+          fullDescription: { text: RULE_GUIDES[rule].why },
+          help: { text: `${RULE_GUIDES[rule].suggestion}
+Example: ${RULE_GUIDES[rule].example}` },
+          defaultConfiguration: { level: "warning" },
+          properties: { tags: ["maintainability", "code-review"] }
+        }))
+      } },
+      invocations: [{
+        executionSuccessful: report.complete,
+        exitCode: report.exitCode,
+        toolExecutionNotifications: report.skippedFiles.map((skipped) => ({
+          level: "error",
+          message: { text: `Not inspected: ${skipped.file}. ${skipped.reason}` }
+        }))
+      }],
+      results,
+      properties: report.mode === "review" ? {
+        scope: "introduced findings in changed files",
+        baseSha: report.baseSha,
+        headSha: report.headSha,
+        mergeBaseSha: report.mergeBaseSha,
+        policySha: report.policySha,
+        unchangedFindings: report.unchangedCount,
+        removedFindings: report.removedFindings.length
+      } : { scope: "current source", acceptedBaselineFindings: report.baselineCount }
+    }]
+  }, null, 2);
+}
+
+// src/check.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import * as fs4 from "fs/promises";
+import { constants as constants2 } from "fs";
+import path4 from "path";
+var MAX_FILE_BYTES = 2 * 1024 * 1024;
+var MAX_SCAN_BYTES = 50 * 1024 * 1024;
+var GENERATED_PATHS = ["**/node_modules/**", "**/dist/**", "**/build/**", "**/vendor/**", "**/*.min.js", "**/*.map"];
+function git(cwd, args) {
+  const result = spawnSync2("git", [...HERMETIC_GIT_FLAGS, ...args], {
+    cwd,
+    env: getHermeticGitEnv(),
+    encoding: "utf8",
+    maxBuffer: 16 * 1024 * 1024,
+    windowsHide: true
+  });
+  if (result.error || result.status !== 0) throw new GitError(result.error?.message || result.stderr, result.status);
+  return result.stdout;
+}
+function checkAborted(signal) {
+  if (signal?.aborted) throw new ConfigError("Project check cancelled; no complete result was produced.");
+}
+function insideRoot(root, filename) {
+  const relative = path4.relative(root, filename);
+  return relative.length > 0 && relative !== ".." && !relative.startsWith(".." + path4.sep) && !path4.isAbsolute(relative);
+}
+async function readSource(root, file, signal) {
+  const filename = path4.resolve(root, file);
+  if (!insideRoot(root, filename)) throw new Error("File escapes the repository.");
+  let stat;
+  try {
+    stat = await fs4.lstat(filename);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  if (!stat.isFile() || stat.isSymbolicLink()) throw new Error("Symlinks and special files are not scanned.");
+  const real = await fs4.realpath(filename);
+  if (!insideRoot(root, real)) throw new Error("File resolves outside the repository.");
+  if (stat.size > MAX_FILE_BYTES) throw new Error("File exceeds the 2 MiB scan limit.");
+  const handle = await fs4.open(filename, constants2.O_RDONLY | (constants2.O_NOFOLLOW || 0));
+  try {
+    const opened = await handle.stat();
+    if (opened.ino !== stat.ino || opened.dev !== stat.dev || !opened.isFile()) throw new Error("File changed while opening.");
+    const chunks = [];
+    let size = 0;
+    while (true) {
+      checkAborted(signal);
+      const chunk = Buffer.alloc(Math.min(64 * 1024, MAX_FILE_BYTES + 1 - size));
+      const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);
+      if (!bytesRead) break;
+      size += bytesRead;
+      if (size > MAX_FILE_BYTES) throw new Error("File exceeds the 2 MiB scan limit.");
+      chunks.push(chunk.subarray(0, bytesRead));
+    }
+    const after = await handle.stat();
+    if (after.size !== opened.size || after.mtimeMs !== opened.mtimeMs || size !== after.size) throw new Error("File changed while reading; rerun the check.");
+    return Buffer.concat(chunks);
+  } finally {
+    await handle.close();
+  }
+}
+async function checkProject(options = {}) {
+  checkAborted(options.signal);
+  const cwd = path4.resolve(options.cwd || process.cwd());
+  const root = await fs4.realpath(git(cwd, ["rev-parse", "--show-toplevel"]).trim());
+  const config = loadConfig(root);
+  const failOn = options.failOn ?? config.failOn ?? ["test-skip", "trivial-assert"];
+  for (const rule of failOn) if (!VALID_DETECTORS.includes(rule)) throw new ConfigError(`Unknown rule '${rule}'.`);
+  const format = options.format || "terminal";
+  if (!["terminal", "json", "github", "markdown", "sarif"].includes(format)) throw new ConfigError("Unsupported check output format.");
+  const baseline = options.baseline ? loadBaseline(path4.resolve(cwd, options.baseline)) : void 0;
+  const filenames = [...new Set(git(root, ["ls-files", "--cached", "--others", "--exclude-standard", "-z"]).split("\0").filter(Boolean))].sort();
+  const infractions = [];
+  const skippedFiles = [];
+  let filesInspected = 0;
+  let linesInspected = 0;
+  let totalBytes = 0;
+  for (const file of filenames) {
+    checkAborted(options.signal);
+    if (!isCodeFile(file, [...GENERATED_PATHS, ...config.ignorePaths || []])) continue;
+    try {
+      const content = await readSource(root, file, options.signal);
+      if (content === null) continue;
+      totalBytes += content.length;
+      if (totalBytes > MAX_SCAN_BYTES) throw new Error("Project exceeds the 50 MiB scan limit.");
+      if (content.includes(0)) throw new Error("Binary content in a source file.");
+      const text = new TextDecoder("utf-8", { fatal: true }).decode(content);
+      const lines = text.split(/\r?\n/);
+      if (lines[lines.length - 1] === "") lines.pop();
+      const audit = auditFileDiffs([{ path: file, addedLines: lines.map((line, index) => ({ line, lineNumber: index + 1 })) }], "WORKTREE", "", { rules: config.rules });
+      infractions.push(...audit.infractions);
+      filesInspected++;
+      linesInspected += lines.length;
+    } catch (error) {
+      checkAborted(options.signal);
+      skippedFiles.push({ file, reason: error instanceof Error ? error.message : String(error) });
+      if (totalBytes > MAX_SCAN_BYTES) break;
+    }
+  }
+  checkAborted(options.signal);
+  const applied = baseline ? applyBaseline(infractions, baseline) : { findings: infractions, baselineCount: 0, staleBaselineCount: 0 };
+  const findings = applied.findings;
+  const failedRules = [...new Set(findings.filter((finding) => failOn.includes(finding.type)).map((finding) => finding.type))];
+  const complete = skippedFiles.length === 0;
+  const passed = complete && failedRules.length === 0;
+  const result = {
+    schemaVersion: "1.0.0",
+    mode: "check",
+    filesInspected,
+    linesInspected,
+    totalFindings: infractions.length,
+    infractions: findings,
+    baselineCount: applied.baselineCount,
+    staleBaselineCount: applied.staleBaselineCount,
+    skippedFiles,
+    complete,
+    failedRules,
+    passed,
+    exitCode: complete ? passed ? 0 : 1 : 2,
+    output: ""
+  };
+  if (format === "json") result.output = JSON.stringify(result, null, 2);
+  else if (format === "sarif") result.output = formatSarif(result);
+  else if (format === "markdown") result.output = formatCheckMarkdown(result);
+  else if (format === "github") {
+    result.output = formatGithubAnnotations(result) + (complete ? "" : "\n::error::Project scan incomplete. See the JSON or terminal report for skipped files.");
+  } else result.output = formatCheckTerminal(result);
+  return result;
+}
+
+// src/review.ts
+import path5 from "path";
+
+// src/snapshot.ts
+import { spawn as spawn2 } from "child_process";
+function assertNotAborted(signal) {
+  if (signal?.aborted) throw new ConfigError("Review cancelled; no complete result was produced.");
+}
+async function readGit(cwd, args, signal, limit = 8 * 1024 * 1024) {
+  assertNotAborted(signal);
+  const env = getHermeticGitEnv({ GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1", GIT_TERMINAL_PROMPT: "0" });
+  for (const key of ["GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR", "GIT_NAMESPACE", "GIT_INDEX_FILE", "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES"]) delete env[key];
+  return new Promise((resolve2, reject) => {
+    const child = spawn2("git", [...HERMETIC_GIT_FLAGS, ...args], {
+      cwd,
+      env,
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true
+    });
+    const chunks = [];
+    let bytes = 0;
+    let stderr = "";
+    let settled = false;
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+      if (error) {
+        child.kill();
+        reject(error);
+      } else resolve2(Buffer.concat(chunks));
+    };
+    const abort = () => finish(new ConfigError("Review cancelled; no complete result was produced."));
+    const timer = setTimeout(() => finish(new ConfigError("Git review read timed out after 30 seconds.")), 3e4);
+    signal?.addEventListener("abort", abort, { once: true });
+    child.stdout.on("data", (chunk) => {
+      if (settled) return;
+      bytes += chunk.length;
+      if (bytes > limit) finish(new ConfigError(`Git read exceeds the ${limit} byte limit.`));
+      else chunks.push(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      if (stderr.length < 64 * 1024) stderr += chunk.toString("utf8").slice(0, 64 * 1024 - stderr.length);
+    });
+    child.on("error", (error) => finish(error));
+    child.on("close", (code) => finish(code === 0 ? void 0 : new GitError(stderr, code)));
+    if (signal?.aborted) abort();
+  });
+}
+async function reviewRefs(cwd, base, head, signal) {
+  const resolve2 = async (ref) => {
+    if (!ref.trim()) throw new ConfigError("Review refs must not be empty.");
+    try {
+      return (await readGit(cwd, ["rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`], signal, 1024)).toString().trim();
+    } catch (error) {
+      assertNotAborted(signal);
+      throw new ConfigError(`Cannot resolve review ref '${ref}'. Use valid commits and fetch complete history (actions/checkout fetch-depth: 0). ${error instanceof Error ? error.message : String(error)}`);
+    }
+  };
+  try {
+    const promises = (await readGit(cwd, ["config", "--type=bool", "--get-regexp", "^remote\\..*\\.promisor$"], signal, 64 * 1024)).toString();
+    if (promises.split("\n").some((line) => /\s+(?:true|yes|on|1)\s*$/i.test(line))) {
+      throw new ConfigError("Offline review requires a non-partial clone with local objects; promisor remotes are unsupported.");
+    }
+  } catch (error) {
+    if (!(error instanceof GitError && error.code === 1)) throw error;
+  }
+  const baseSha = await resolve2(base);
+  const headSha = await resolve2(head);
+  let ancestors;
+  try {
+    ancestors = (await readGit(cwd, ["merge-base", "--all", "--end-of-options", baseSha, headSha], signal, 8192)).toString().trim().split("\n");
+  } catch (error) {
+    assertNotAborted(signal);
+    throw new ConfigError(`Cannot find review merge-base. Fetch full shared history (fetch-depth: 0). ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (ancestors.length !== 1 || !/^[a-f0-9]{40,64}$/.test(ancestors[0])) throw new ConfigError("Review needs exactly one merge base; ambiguous merge ancestry is unsupported.");
+  return { baseSha, headSha, mergeBaseSha: ancestors[0] };
+}
+async function changedTreeFiles(cwd, before, after, signal) {
+  const buffer = await readGit(cwd, ["diff", "--raw", "-z", "--no-relative", "--no-abbrev", "--no-ext-diff", "--no-textconv", "--find-renames=50%", "-l1000", "--end-of-options", before, after, "--"], signal);
+  const tokens = new TextDecoder("utf-8", { fatal: true }).decode(buffer).split("\0");
+  if (tokens.pop() !== "") throw new ConfigError("Truncated Git change inventory.");
+  const changes = [];
+  for (let i = 0; i < tokens.length; ) {
+    const match = /^:(\d{6}) (\d{6}) ([a-f0-9]{40,64}) ([a-f0-9]{40,64}) ([AMDRT]\d*)$/.exec(tokens[i++]);
+    if (!match) throw new ConfigError("Unsupported Git change inventory entry.");
+    const oldPath = tokens[i++];
+    const newPath = match[5].startsWith("R") ? tokens[i++] : oldPath;
+    if (!oldPath || !newPath) throw new ConfigError("Incomplete Git path inventory.");
+    changes.push({ oldMode: match[1], newMode: match[2], oldOid: match[3], newOid: match[4], status: match[5], oldPath, newPath });
+    if (changes.length > 1e3) throw new ConfigError("Review exceeds the 1000 changed-file limit; split the change into smaller reviews.");
+  }
+  return changes;
+}
+async function readBlob(cwd, oid, signal, limit = 2 * 1024 * 1024) {
+  if (!/^[a-f0-9]{40,64}$/.test(oid)) throw new ConfigError("Invalid Git blob identity.");
+  const sizeText = (await readGit(cwd, ["cat-file", "-s", oid], signal, 128)).toString().trim();
+  const size = Number(sizeText);
+  if (!Number.isSafeInteger(size) || size < 0 || size > limit) throw new ConfigError(`Source blob exceeds the ${limit} byte limit or has an invalid size.`);
+  const buffer = await readGit(cwd, ["cat-file", "blob", oid], signal, limit);
+  if (buffer.length !== size) throw new ConfigError("Git blob size differs from the recorded object.");
+  return buffer;
+}
+async function reviewPolicy(cwd, baseSha, signal) {
+  const raw = await readGit(cwd, ["ls-tree", "--full-tree", "-z", baseSha, "--", ...CONFIG_FILENAMES], signal, 8192);
+  const entries = raw.toString().split("\0").filter(Boolean);
+  for (const filename of CONFIG_FILENAMES) {
+    const entry = entries.find((line) => line.slice(line.indexOf("	") + 1) === filename);
+    if (!entry) continue;
+    const match = /^(100644|100755) blob ([a-f0-9]{40,64})\t/.exec(entry);
+    if (!match) throw new ConfigError(`Base policy '${filename}' must be a regular Git blob.`);
+    const content = await readBlob(cwd, match[2], signal, 64 * 1024);
+    return { config: configFromText(new TextDecoder("utf-8", { fatal: true }).decode(content), `${filename} in base ${baseSha.slice(0, 7)}`), filename };
+  }
+  return { config: configFromText("{}", "default review policy"), filename: null };
+}
+
+// src/review.ts
+var GENERATED_PATHS2 = ["**/node_modules/**", "**/dist/**", "**/build/**", "**/vendor/**", "**/*.min.js", "**/*.map"];
+var MAX_SCAN_BYTES2 = 50 * 1024 * 1024;
+function compareFindings(before, after, newPath) {
+  const old = /* @__PURE__ */ new Map();
+  for (const finding of before) {
+    const key = findingFingerprint({ ...finding, file: newPath });
+    const bucket = old.get(key) || { findings: [], matched: 0 };
+    bucket.findings.push(finding);
+    old.set(key, bucket);
+  }
+  const introduced = [];
+  let unchanged = 0;
+  for (const finding of after) {
+    const bucket = old.get(findingFingerprint(finding));
+    if (bucket && bucket.matched < bucket.findings.length) {
+      bucket.matched++;
+      unchanged++;
+    } else introduced.push(finding);
+  }
+  return { introduced, removed: [...old.values()].flatMap((bucket) => bucket.findings.slice(bucket.matched)), unchanged };
+}
+async function reviewChanges(options) {
+  assertNotAborted(options.signal);
+  const cwd = path5.resolve(options.cwd || process.cwd());
+  const refs = await reviewRefs(cwd, options.base, options.head ?? "HEAD", options.signal);
+  const policy = await reviewPolicy(cwd, refs.baseSha, options.signal);
+  const format = options.format ?? "terminal";
+  if (!["terminal", "json", "github", "markdown", "sarif"].includes(format)) throw new ConfigError("Unsupported review format.");
+  const failOn = options.failOn ?? policy.config.failOn ?? ["test-skip", "trivial-assert"];
+  for (const rule of failOn) if (!VALID_DETECTORS.includes(rule)) throw new ConfigError(`Unknown review rule '${rule}'.`);
+  const changes = await changedTreeFiles(cwd, refs.mergeBaseSha, refs.headSha, options.signal);
+  const policyChanges = changes.filter((change) => CONFIG_FILENAMES.includes(change.oldPath) || CONFIG_FILENAMES.includes(change.newPath)).map((change) => change.newPath);
+  const ignores = [...GENERATED_PATHS2, ...policy.config.ignorePaths || []];
+  const result = {
+    schemaVersion: "1.0.0",
+    mode: "review",
+    ...refs,
+    policySha: refs.baseSha,
+    policyFile: policy.filename,
+    policyChanges,
+    filesChanged: changes.length,
+    filesInspected: 0,
+    unsupportedFiles: 0,
+    excludedFiles: 0,
+    renamedFiles: changes.filter((change) => change.status.startsWith("R")).length,
+    linesInspected: 0,
+    beforeFindings: 0,
+    afterFindings: 0,
+    unchangedCount: 0,
+    infractions: [],
+    removedFindings: [],
+    skippedFiles: [],
+    complete: true,
+    failedRules: [],
+    passed: false,
+    exitCode: 2,
+    output: ""
+  };
+  let totalBytes = 0;
+  for (const change of changes) {
+    assertNotAborted(options.signal);
+    const oldSupported = change.oldMode !== "000000" && isCodeFile(change.oldPath);
+    const newSupported = change.newMode !== "000000" && isCodeFile(change.newPath);
+    if (!oldSupported && !newSupported) {
+      result.unsupportedFiles++;
+      continue;
+    }
+    const oldInScope = oldSupported && isCodeFile(change.oldPath, ignores);
+    const newInScope = newSupported && isCodeFile(change.newPath, ignores);
+    if (!oldInScope && !newInScope) {
+      result.excludedFiles++;
+      continue;
+    }
+    try {
+      let inspectedLines = 0;
+      const scan = async (mode, oid, filename, commit) => {
+        if (mode === "000000") return [];
+        if (!["100644", "100755"].includes(mode)) throw new ConfigError("Changed source is a symlink, submodule or unsupported Git mode; comparison is incomplete.");
+        const content = await readBlob(cwd, oid, options.signal);
+        totalBytes += content.length;
+        if (totalBytes > MAX_SCAN_BYTES2) throw new ConfigError("Review exceeds the 50 MiB source comparison limit.");
+        if (content.includes(0)) throw new ConfigError("Binary content in a source comparison.");
+        const text = new TextDecoder("utf-8", { fatal: true }).decode(content);
+        const lines = text.split(/\r?\n/);
+        if (lines.at(-1) === "") lines.pop();
+        inspectedLines += lines.length;
+        return auditFileDiffs([{ path: filename, addedLines: lines.map((line, index) => ({ line, lineNumber: index + 1 })) }], commit, "", { rules: policy.config.rules }).infractions;
+      };
+      if (oldSupported && !newSupported && change.newMode !== "000000") {
+        throw new ConfigError("Source moved to an unsupported extension; cannot claim its findings were resolved.");
+      }
+      const before = await scan(change.oldMode, change.oldOid, change.oldPath, refs.mergeBaseSha);
+      const after = await scan(change.newMode, change.newOid, change.newPath, refs.headSha);
+      const compared = compareFindings(before, after, change.newPath);
+      result.infractions.push(...compared.introduced);
+      result.removedFindings.push(...compared.removed);
+      result.unchangedCount += compared.unchanged;
+      result.beforeFindings += before.length;
+      result.afterFindings += after.length;
+      result.filesInspected++;
+      result.linesInspected += inspectedLines;
+    } catch (error) {
+      assertNotAborted(options.signal);
+      result.skippedFiles.push({ file: change.newPath, reason: error instanceof Error ? error.message : String(error) });
+      if (totalBytes > MAX_SCAN_BYTES2) break;
+    }
+  }
+  assertNotAborted(options.signal);
+  result.complete = result.skippedFiles.length === 0;
+  result.failedRules = [...new Set(result.infractions.filter((finding) => failOn.includes(finding.type)).map((finding) => finding.type))];
+  result.passed = result.complete && result.failedRules.length === 0;
+  result.exitCode = !result.complete ? 2 : result.passed ? 0 : 1;
+  if (format === "json") result.output = JSON.stringify(result, null, 2);
+  else if (format === "markdown") result.output = formatReviewMarkdown(result);
+  else if (format === "sarif") result.output = formatSarif(result);
+  else if (format === "github") result.output = formatGithubAnnotations(result) + (!result.complete ? "\n::error::Context review incomplete. Inspect skipped source files in the JSON report." : "") + (policyChanges.length ? "\n::notice::Candidate policy changes were ignored; review uses policy from the supplied base commit." : "");
+  else result.output = formatReviewTerminal(result);
+  return result;
+}
+
 // src/index.ts
 var InvalidDetectorError = class extends Error {
   constructor(message) {
@@ -1621,10 +2375,10 @@ var InvalidDetectorError = class extends Error {
   }
 };
 async function roastRepository(options = {}) {
-  const cwd = path3.resolve(options.cwd || process.cwd());
+  const cwd = path6.resolve(options.cwd || process.cwd());
   const since = options.since || "90 days ago";
-  const repoName = path3.basename(cwd);
-  const collector = new MetricsCollector({ all: options.all, ignorePaths: options.ignorePaths });
+  const repoName = path6.basename(cwd);
+  const collector = new MetricsCollector({ all: options.all, ignorePaths: options.ignorePaths, rules: options.rules, panicLoopWindowMinutes: options.panicLoopWindowMinutes });
   const gitStream = streamGitLog(cwd, since);
   await parseGitLogStream(gitStream, (commit, stats) => {
     collector.processCommit(commit);
@@ -1638,7 +2392,7 @@ async function roastRepository(options = {}) {
   return { summary, output };
 }
 async function auditPullRequest(options) {
-  const cwd = path3.resolve(options.cwd || process.cwd());
+  const cwd = path6.resolve(options.cwd || process.cwd());
   const format = options.format || "terminal";
   const failOn = (options.failOn || ["test-skip"]).map((s) => s.trim()).filter(Boolean);
   for (const det of failOn) {
@@ -1648,10 +2402,16 @@ async function auditPullRequest(options) {
       );
     }
   }
-  const baseSha = resolveCommitSha(cwd, options.base, "Base ref");
-  const headSha = resolveCommitSha(cwd, options.head, "Head ref");
-  const mergeBaseSha = findMergeBase(cwd, baseSha, headSha);
-  const diffStream = streamGitDiff(cwd, mergeBaseSha, headSha);
+  if (options.staged && options.base) {
+    throw new GitResolutionError("--staged cannot be combined with --base.");
+  }
+  if (!options.staged && !options.base) {
+    throw new GitResolutionError("A base ref is required for a pull request audit.");
+  }
+  const baseSha = options.staged ? "INDEX" : resolveCommitSha(cwd, options.base, "Base ref");
+  const headSha = options.staged ? "INDEX" : resolveCommitSha(cwd, options.head || "HEAD", "Head ref");
+  const mergeBaseSha = options.staged ? "INDEX" : findMergeBase(cwd, baseSha, headSha);
+  const diffStream = streamGitDiff(cwd, mergeBaseSha, headSha, options.staged);
   let rawDiff = "";
   await new Promise((resolve2, reject) => {
     diffStream.on("data", (chunk) => {
@@ -1661,7 +2421,7 @@ async function auditPullRequest(options) {
     diffStream.on("error", reject);
   });
   const { files, skippedLongLines, skippedUnknownFiles } = parseDiff(rawDiff);
-  const audit = auditFileDiffs(files, headSha, (/* @__PURE__ */ new Date()).toISOString(), { ignorePaths: options.ignorePaths });
+  const audit = auditFileDiffs(files, headSha, (/* @__PURE__ */ new Date()).toISOString(), { ignorePaths: options.ignorePaths, rules: options.rules });
   const infractions = audit.infractions;
   const defectDensityPer100Lines = audit.linesAdded > 0 ? Math.round(infractions.length / audit.linesAdded * 100 * 100) / 100 : 0;
   const failedRules = [...new Set(
@@ -1671,6 +2431,7 @@ async function auditPullRequest(options) {
   const exitCode = passed ? 0 : 1;
   const result = {
     schemaVersion: "1.0.0",
+    mode: options.staged ? "staged" : "pr",
     baseSha,
     headSha,
     mergeBaseSha,
@@ -1713,7 +2474,12 @@ export {
   resolveCommitSha,
   findMergeBase,
   GitResolutionError,
+  RULE_GUIDES,
+  VALID_DETECTORS,
   DEFAULT_CONFIG,
+  CONFIG_FILENAMES,
+  ConfigError,
+  configFromText,
   loadConfig,
   matchIgnorePath,
   isCodeFile,
@@ -1727,7 +2493,10 @@ export {
   formatGithubAnnotations,
   formatGithubStepSummary,
   formatPrMarkdownComment,
-  VALID_DETECTORS,
+  formatCheckTerminal,
+  formatCheckMarkdown,
+  formatReviewTerminal,
+  formatReviewMarkdown,
   DEFAULT_CONFIG_TEMPLATE,
   GITHUB_WORKFLOW_TEMPLATE,
   PRE_COMMIT_HOOK_TEMPLATE,
@@ -1736,6 +2505,15 @@ export {
   generateSvgBadge,
   generateShieldsMarkdown,
   generateShieldsJson,
+  findingFingerprint,
+  createBaseline,
+  loadBaseline,
+  applyBaseline,
+  writeBaseline,
+  formatSarif,
+  checkProject,
+  compareFindings,
+  reviewChanges,
   InvalidDetectorError,
   roastRepository,
   auditPullRequest