agent-roast 0.5.0 → 0.6.0

package/README.md

@@ -48,6 +48,67 @@ A finding includes its file and line, the source snippet, and a concrete next st
 To see the complete machine-readable result, use `check --format json`; terminal
 output shows the first 20 findings. `check --format markdown` produces a review table.
 
+### Context review for pull requests
+
+```bash
+# Compare committed source at the common ancestor and candidate head
+agent-roast review --base origin/main --head HEAD
+agent-roast review --base origin/main --format markdown
+
+# Export a report for tools that consume SARIF 2.1.0
+agent-roast review --base origin/main --format sarif > agentroast.sarif
+agent-roast check --format sarif > current-code.sarif
+```
+
+`review` compares **full contents of changed source files**, so deleting the only
+handler inside a `catch` is detectable even when no suspicious line was added.
+It reports new findings, existing findings, and patterns no longer detected. Only
+new blocking findings fail the check; no manually generated baseline is required.
+Deleting a file is reported as disappearance of a pattern, not proof of a correct fix.
+
+Source is read directly from immutable Git blobs at the merge-base and head. The
+worktree and index are left untouched, and project code, hooks, diff programs and
+package scripts are never executed. Use `check` for uncommitted working files, and
+`--staged` for the index. Source comparison and policy are pinned to the reported SHAs.
+
+Policy comes from the explicitly supplied **base ref tip**; source comparison starts
+at the merge-base. Candidate changes to `.agentroastrc.json`, `.agentroastrc` or
+`agent-roast.config.json` are reported and ignored for this review. Adopt policy
+changes through separate human review. An explicit `--fail-on` overrides blocking
+severity but does not enable rules disabled by base policy.
+
+```bash
+# Advisory pilot: inspect findings before deciding what should block the team
+agent-roast review --base origin/main --fail-on ''
+# Gate the shortcuts the team agrees matter
+agent-roast review --base origin/main --fail-on test-skip,trivial-assert,swallowed-error
+```
+
+Matching uses rule, source snippet and occurrence count within a file pair. Line
+shifts and Git-recognized pure renames do not turn old debt into new debt. A second
+identical occurrence is new. This is not semantic tracking: rewritten snippets or
+language changes can require fresh review, and Git's rename recognition is heuristic.
+
+Limits: 1,000 changed files, 2 MiB per source blob, 50 MiB across inspected versions,
+30 seconds per Git command. Symlinked/binary/oversized source and missing comparison
+objects yield exit 2, never a clean pass. Partial clones and ambiguous multiple
+merge-bases are unsupported; fetch complete local history (`fetch-depth: 0`). The
+report counts excluded and unsupported changes explicitly. Only changed supported
+files are compared; this is not a whole-repository safety certification.
+
+SARIF includes rule metadata, relative locations, stable occurrence fingerprints
+and whether the scan completed. Source snippets are omitted from SARIF. JSON and
+Markdown reports contain evidence snippets and should be handled as source code.
+SARIF output is generated offline; uploading it is a separate, optional operation.
+GitHub supports SARIF ingestion, but this release has not been tested with a live
+code-scanning upload. Some findings on unchanged lines (including deletion-only
+regressions) may appear in the report/summary rather than as an inline PR annotation.
+Use a separate SARIF category for introduced-findings review; it does not represent
+a full scan of all outstanding alerts.
+
+Install with `npx agent-roast@0.6.0 review --base origin/main`. For local development,
+run `npm run build` and use `node dist/cli.js`.
+
 ### Baseline adoption
 
 A baseline explicitly accepts the findings present at adoption time. It does not fix
@@ -238,7 +299,7 @@ Only **added lines** (`+`) in source code files are scanned — deleted lines, f
 - **Requirements:** Git 2.30+ (for `--end-of-options` argument isolation), Node.js 18+.
 - **100% Local:** Instant streaming parser runs directly on your machine.
 - **Zero Telemetry:** No cloud dependencies, no LLM API calls, no network traffic. Verified by static bundle inspection.
-- **Hermetic:** Enforces `-c core.quotepath=false -c diff.noprefix=false` to guarantee identical behavior across all environments.
+- **Git isolation:** Forces stable diff paths, disables fsmonitor/external diff execution, and reads review content by object identity.
 
 ---
 

package/dist/{chunk-FUAUIURY.js → chunk-RU5OYHLR.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import path5 from "path";
+import path6 from "path";
 
 // src/git.ts
 import { spawn, spawnSync } from "child_process";
@@ -754,32 +754,36 @@ function validateConfig(value) {
     }
   }
 }
+function configFromText(text, source) {
+  try {
+    const parsed = JSON.parse(text);
+    validateConfig(parsed);
+    const rules = { ...DEFAULT_CONFIG.rules, ...parsed.rules };
+    const failOn = parsed.failOn ?? Object.entries(rules).filter(([, level]) => level === "error").map(([rule]) => rule);
+    return {
+      ...DEFAULT_CONFIG,
+      ...parsed,
+      failOn,
+      ignorePaths: [.../* @__PURE__ */ new Set([...DEFAULT_CONFIG.ignorePaths || [], ...parsed.ignorePaths || []])],
+      rules
+    };
+  } catch (error) {
+    throw new ConfigError(`Invalid ${source}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
 function loadConfig(cwd = process.cwd()) {
   for (const filename of CONFIG_FILENAMES) {
     const filePath = path.join(cwd, filename);
-    if (!fs.existsSync(filePath)) continue;
-    try {
-      const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
-      validateConfig(parsed);
-      const rules = { ...DEFAULT_CONFIG.rules, ...parsed.rules };
-      const failOn = parsed.failOn ?? Object.entries(rules).filter(([, level]) => level === "error").map(([rule]) => rule);
-      return {
-        ...DEFAULT_CONFIG,
-        ...parsed,
-        failOn,
-        ignorePaths: [.../* @__PURE__ */ new Set([...DEFAULT_CONFIG.ignorePaths || [], ...parsed.ignorePaths || []])],
-        rules
-      };
-    } catch (err) {
-      throw new ConfigError(`Invalid ${filename}: ${err instanceof Error ? err.message : String(err)}`);
+    if (fs.existsSync(filePath)) {
+      try {
+        return configFromText(fs.readFileSync(filePath, "utf8"), filename);
+      } catch (error) {
+        if (error instanceof ConfigError) throw error;
+        throw new ConfigError(`Cannot read ${filename}: ${error instanceof Error ? error.message : String(error)}`);
+      }
     }
   }
-  return {
-    ...DEFAULT_CONFIG,
-    failOn: [...DEFAULT_CONFIG.failOn || []],
-    ignorePaths: [...DEFAULT_CONFIG.ignorePaths || []],
-    rules: { ...DEFAULT_CONFIG.rules }
-  };
+  return configFromText("{}", "default configuration");
 }
 function matchIgnorePath(filePath, ignorePatterns) {
   if (!ignorePatterns || ignorePatterns.length === 0) {
@@ -1623,6 +1627,60 @@ function formatCheckMarkdown(result) {
   for (const skipped of result.skippedFiles) lines.push("", `Not scanned: ${markdownCell(skipped.file)} \u2014 ${markdownCell(skipped.reason)}`);
   return lines.join("\n");
 }
+function formatReviewTerminal(result) {
+  const status = !result.complete ? "INCOMPLETE" : result.passed ? "PASSED" : "BLOCKED";
+  const lines = [
+    "",
+    pc.bold(`agent-roast \u2014 context review: ${status}`),
+    `  ${result.mergeBaseSha.slice(0, 7)} \u2192 ${result.headSha.slice(0, 7)} \xB7 policy from base ${result.policySha.slice(0, 7)}`,
+    `  ${result.filesInspected} changed files compared \xB7 ${result.linesInspected} source lines inspected across both versions`,
+    `  ${result.infractions.length} new \xB7 ${result.unchangedCount} existing \xB7 ${result.removedFindings.length} no longer detected`
+  ];
+  if (result.policyChanges.length) lines.push("  Candidate policy changes were ignored; adopt them separately after review.");
+  if (result.excludedFiles || result.unsupportedFiles) lines.push(`  ${result.excludedFiles} excluded \xB7 ${result.unsupportedFiles} unsupported/non-source changes`);
+  for (const finding of result.infractions.slice(0, 20)) {
+    lines.push(
+      "",
+      `  ${result.failedRules.includes(finding.type) ? "FAIL" : "WARN"} [${finding.type}] ${terminalText(finding.file || "unknown")}:${finding.lineNumber}`,
+      `    ${terminalText(finding.lineSnippet || finding.reason)}`,
+      `    Next: ${finding.suggestion || "Review this occurrence."}`
+    );
+  }
+  if (result.infractions.length > 20) lines.push(`  ${result.infractions.length - 20} more new findings; use --format json for all results.`);
+  for (const skipped of result.skippedFiles) lines.push(`  NOT COMPARED ${terminalText(skipped.file)}: ${terminalText(skipped.reason)}`);
+  lines.push("", !result.complete ? "  INCOMPLETE: some changed source was not compared (exit 2)." : result.passed ? "  PASSED: no new blocking findings." : `  BLOCKED: ${result.failedRules.join(", ")}.`, "");
+  if (!result.filesInspected) lines.push("  No supported changed source files compared.", "");
+  return lines.join("\n");
+}
+function formatReviewMarkdown(result) {
+  const status = !result.complete ? "INCOMPLETE" : result.passed ? "PASSED" : "BLOCKED";
+  const lines = [
+    `## agent-roast context review: ${status}`,
+    "",
+    `Compared ${result.filesInspected} changed files at \`${result.mergeBaseSha.slice(0, 7)}\` \u2192 \`${result.headSha.slice(0, 7)}\`. Policy: \`${result.policySha.slice(0, 7)}\`.`,
+    "",
+    `**${result.infractions.length} new** \xB7 ${result.unchangedCount} existing \xB7 ${result.removedFindings.length} no longer detected.`,
+    ""
+  ];
+  if (result.policyChanges.length) lines.push("Candidate policy changes were ignored. This review uses the supplied base commit's policy.", "");
+  lines.push("| New finding | Head location | Evidence | Next step |", "| --- | --- | --- | --- |");
+  for (const finding of result.infractions) lines.push(`| ${finding.type} | ${markdownCell(`${finding.file}:${finding.lineNumber}`)} | ${markdownCell(finding.lineSnippet || finding.reason)} | ${markdownCell(finding.suggestion || "Review this occurrence.")} |`);
+  if (result.removedFindings.length) {
+    lines.push(
+      "",
+      "### No longer detected",
+      "",
+      "These patterns disappeared from the compared source. Deleting code is not proof of a behavioral fix.",
+      "",
+      "| Rule | Previous location | Previous evidence |",
+      "| --- | --- | --- |"
+    );
+    for (const finding of result.removedFindings) lines.push(`| ${finding.type} | ${markdownCell(`${finding.file}:${finding.lineNumber}`)} | ${markdownCell(finding.lineSnippet || finding.reason)} |`);
+  }
+  for (const skipped of result.skippedFiles) lines.push("", `Not compared: ${markdownCell(skipped.file)} \u2014 ${markdownCell(skipped.reason)}`);
+  lines.push("", `Scope: changed supported files only; ${result.excludedFiles} excluded and ${result.unsupportedFiles} unsupported/non-source changes.`);
+  return lines.join("\n");
+}
 
 // src/init.ts
 import * as fs2 from "fs";
@@ -1663,6 +1721,7 @@ jobs:
           base: \${{ github.event.pull_request.base.sha }}
           head: \${{ github.event.pull_request.head.sha }}
           format: github
+          mode: review
 `;
 var PRE_COMMIT_HOOK_TEMPLATE = `#!/bin/sh
 # Run agent-roast pre-commit verification
@@ -1775,11 +1834,8 @@ function generateShieldsJson(score, label = "AI Discipline") {
   };
 }
 
-// src/check.ts
-import { spawnSync as spawnSync2 } from "child_process";
-import * as fs4 from "fs/promises";
-import { constants as constants2 } from "fs";
-import path4 from "path";
+// src/sarif.ts
+import { createRequire } from "module";
 
 // src/baseline.ts
 import { createHash, randomUUID } from "crypto";
@@ -1873,7 +1929,78 @@ function writeBaseline(filename, findings) {
   }
 }
 
+// src/sarif.ts
+var require2 = createRequire(import.meta.url);
+var version = require2("../package.json").version;
+function formatSarif(report) {
+  const occurrences = /* @__PURE__ */ new Map();
+  const results = report.infractions.map((finding) => {
+    const filename = finding.file;
+    if (!filename || filename.startsWith("/") || filename.split("/").includes("..") || /^[a-z]:/i.test(filename)) {
+      throw new ConfigError("SARIF needs repository-relative finding paths.");
+    }
+    const fingerprint = findingFingerprint(finding);
+    const occurrence = (occurrences.get(fingerprint) || 0) + 1;
+    occurrences.set(fingerprint, occurrence);
+    return {
+      ruleId: finding.type,
+      ruleIndex: VALID_DETECTORS.indexOf(finding.type),
+      level: report.failedRules.includes(finding.type) ? "error" : "warning",
+      message: { text: `${finding.reason}. ${finding.suggestion || RULE_GUIDES[finding.type].suggestion}` },
+      locations: [{ physicalLocation: {
+        artifactLocation: { uri: filename.split("/").map((segment) => encodeURIComponent(segment)).join("/") },
+        region: { startLine: Math.max(1, finding.lineNumber || 1) }
+      } }],
+      partialFingerprints: { "agentRoastFinding/v1": `${fingerprint}:${occurrence}` },
+      ...report.mode === "review" ? { baselineState: "new" } : {}
+    };
+  });
+  return JSON.stringify({
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [{
+      tool: { driver: {
+        name: "agent-roast",
+        semanticVersion: version,
+        informationUri: "https://github.com/Nari-Ab/agent-roast",
+        rules: VALID_DETECTORS.map((rule) => ({
+          id: rule,
+          name: rule,
+          shortDescription: { text: RULE_GUIDES[rule].title },
+          fullDescription: { text: RULE_GUIDES[rule].why },
+          help: { text: `${RULE_GUIDES[rule].suggestion}
+Example: ${RULE_GUIDES[rule].example}` },
+          defaultConfiguration: { level: "warning" },
+          properties: { tags: ["maintainability", "code-review"] }
+        }))
+      } },
+      invocations: [{
+        executionSuccessful: report.complete,
+        exitCode: report.exitCode,
+        toolExecutionNotifications: report.skippedFiles.map((skipped) => ({
+          level: "error",
+          message: { text: `Not inspected: ${skipped.file}. ${skipped.reason}` }
+        }))
+      }],
+      results,
+      properties: report.mode === "review" ? {
+        scope: "introduced findings in changed files",
+        baseSha: report.baseSha,
+        headSha: report.headSha,
+        mergeBaseSha: report.mergeBaseSha,
+        policySha: report.policySha,
+        unchangedFindings: report.unchangedCount,
+        removedFindings: report.removedFindings.length
+      } : { scope: "current source", acceptedBaselineFindings: report.baselineCount }
+    }]
+  }, null, 2);
+}
+
 // src/check.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import * as fs4 from "fs/promises";
+import { constants as constants2 } from "fs";
+import path4 from "path";
 var MAX_FILE_BYTES = 2 * 1024 * 1024;
 var MAX_SCAN_BYTES = 50 * 1024 * 1024;
 var GENERATED_PATHS = ["**/node_modules/**", "**/dist/**", "**/build/**", "**/vendor/**", "**/*.min.js", "**/*.map"];
@@ -1939,7 +2066,7 @@ async function checkProject(options = {}) {
   const failOn = options.failOn ?? config.failOn ?? ["test-skip", "trivial-assert"];
   for (const rule of failOn) if (!VALID_DETECTORS.includes(rule)) throw new ConfigError(`Unknown rule '${rule}'.`);
   const format = options.format || "terminal";
-  if (!["terminal", "json", "github", "markdown"].includes(format)) throw new ConfigError("Unsupported check output format.");
+  if (!["terminal", "json", "github", "markdown", "sarif"].includes(format)) throw new ConfigError("Unsupported check output format.");
   const baseline = options.baseline ? loadBaseline(path4.resolve(cwd, options.baseline)) : void 0;
   const filenames = [...new Set(git(root, ["ls-files", "--cached", "--others", "--exclude-standard", "-z"]).split("\0").filter(Boolean))].sort();
   const infractions = [];
@@ -1992,6 +2119,7 @@ async function checkProject(options = {}) {
     output: ""
   };
   if (format === "json") result.output = JSON.stringify(result, null, 2);
+  else if (format === "sarif") result.output = formatSarif(result);
   else if (format === "markdown") result.output = formatCheckMarkdown(result);
   else if (format === "github") {
     result.output = formatGithubAnnotations(result) + (complete ? "" : "\n::error::Project scan incomplete. See the JSON or terminal report for skipped files.");
@@ -1999,6 +2127,246 @@ async function checkProject(options = {}) {
   return result;
 }
 
+// src/review.ts
+import path5 from "path";
+
+// src/snapshot.ts
+import { spawn as spawn2 } from "child_process";
+function assertNotAborted(signal) {
+  if (signal?.aborted) throw new ConfigError("Review cancelled; no complete result was produced.");
+}
+async function readGit(cwd, args, signal, limit = 8 * 1024 * 1024) {
+  assertNotAborted(signal);
+  const env = getHermeticGitEnv({ GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1", GIT_TERMINAL_PROMPT: "0" });
+  for (const key of ["GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR", "GIT_NAMESPACE", "GIT_INDEX_FILE", "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES"]) delete env[key];
+  return new Promise((resolve2, reject) => {
+    const child = spawn2("git", [...HERMETIC_GIT_FLAGS, ...args], {
+      cwd,
+      env,
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true
+    });
+    const chunks = [];
+    let bytes = 0;
+    let stderr = "";
+    let settled = false;
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+      if (error) {
+        child.kill();
+        reject(error);
+      } else resolve2(Buffer.concat(chunks));
+    };
+    const abort = () => finish(new ConfigError("Review cancelled; no complete result was produced."));
+    const timer = setTimeout(() => finish(new ConfigError("Git review read timed out after 30 seconds.")), 3e4);
+    signal?.addEventListener("abort", abort, { once: true });
+    child.stdout.on("data", (chunk) => {
+      if (settled) return;
+      bytes += chunk.length;
+      if (bytes > limit) finish(new ConfigError(`Git read exceeds the ${limit} byte limit.`));
+      else chunks.push(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      if (stderr.length < 64 * 1024) stderr += chunk.toString("utf8").slice(0, 64 * 1024 - stderr.length);
+    });
+    child.on("error", (error) => finish(error));
+    child.on("close", (code) => finish(code === 0 ? void 0 : new GitError(stderr, code)));
+    if (signal?.aborted) abort();
+  });
+}
+async function reviewRefs(cwd, base, head, signal) {
+  const resolve2 = async (ref) => {
+    if (!ref.trim()) throw new ConfigError("Review refs must not be empty.");
+    try {
+      return (await readGit(cwd, ["rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`], signal, 1024)).toString().trim();
+    } catch (error) {
+      assertNotAborted(signal);
+      throw new ConfigError(`Cannot resolve review ref '${ref}'. Use valid commits and fetch complete history (actions/checkout fetch-depth: 0). ${error instanceof Error ? error.message : String(error)}`);
+    }
+  };
+  try {
+    const promises = (await readGit(cwd, ["config", "--type=bool", "--get-regexp", "^remote\\..*\\.promisor$"], signal, 64 * 1024)).toString();
+    if (promises.split("\n").some((line) => /\s+(?:true|yes|on|1)\s*$/i.test(line))) {
+      throw new ConfigError("Offline review requires a non-partial clone with local objects; promisor remotes are unsupported.");
+    }
+  } catch (error) {
+    if (!(error instanceof GitError && error.code === 1)) throw error;
+  }
+  const baseSha = await resolve2(base);
+  const headSha = await resolve2(head);
+  let ancestors;
+  try {
+    ancestors = (await readGit(cwd, ["merge-base", "--all", "--end-of-options", baseSha, headSha], signal, 8192)).toString().trim().split("\n");
+  } catch (error) {
+    assertNotAborted(signal);
+    throw new ConfigError(`Cannot find review merge-base. Fetch full shared history (fetch-depth: 0). ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (ancestors.length !== 1 || !/^[a-f0-9]{40,64}$/.test(ancestors[0])) throw new ConfigError("Review needs exactly one merge base; ambiguous merge ancestry is unsupported.");
+  return { baseSha, headSha, mergeBaseSha: ancestors[0] };
+}
+async function changedTreeFiles(cwd, before, after, signal) {
+  const buffer = await readGit(cwd, ["diff", "--raw", "-z", "--no-relative", "--no-abbrev", "--no-ext-diff", "--no-textconv", "--find-renames=50%", "-l1000", "--end-of-options", before, after, "--"], signal);
+  const tokens = new TextDecoder("utf-8", { fatal: true }).decode(buffer).split("\0");
+  if (tokens.pop() !== "") throw new ConfigError("Truncated Git change inventory.");
+  const changes = [];
+  for (let i = 0; i < tokens.length; ) {
+    const match = /^:(\d{6}) (\d{6}) ([a-f0-9]{40,64}) ([a-f0-9]{40,64}) ([AMDRT]\d*)$/.exec(tokens[i++]);
+    if (!match) throw new ConfigError("Unsupported Git change inventory entry.");
+    const oldPath = tokens[i++];
+    const newPath = match[5].startsWith("R") ? tokens[i++] : oldPath;
+    if (!oldPath || !newPath) throw new ConfigError("Incomplete Git path inventory.");
+    changes.push({ oldMode: match[1], newMode: match[2], oldOid: match[3], newOid: match[4], status: match[5], oldPath, newPath });
+    if (changes.length > 1e3) throw new ConfigError("Review exceeds the 1000 changed-file limit; split the change into smaller reviews.");
+  }
+  return changes;
+}
+async function readBlob(cwd, oid, signal, limit = 2 * 1024 * 1024) {
+  if (!/^[a-f0-9]{40,64}$/.test(oid)) throw new ConfigError("Invalid Git blob identity.");
+  const sizeText = (await readGit(cwd, ["cat-file", "-s", oid], signal, 128)).toString().trim();
+  const size = Number(sizeText);
+  if (!Number.isSafeInteger(size) || size < 0 || size > limit) throw new ConfigError(`Source blob exceeds the ${limit} byte limit or has an invalid size.`);
+  const buffer = await readGit(cwd, ["cat-file", "blob", oid], signal, limit);
+  if (buffer.length !== size) throw new ConfigError("Git blob size differs from the recorded object.");
+  return buffer;
+}
+async function reviewPolicy(cwd, baseSha, signal) {
+  const raw = await readGit(cwd, ["ls-tree", "--full-tree", "-z", baseSha, "--", ...CONFIG_FILENAMES], signal, 8192);
+  const entries = raw.toString().split("\0").filter(Boolean);
+  for (const filename of CONFIG_FILENAMES) {
+    const entry = entries.find((line) => line.slice(line.indexOf("	") + 1) === filename);
+    if (!entry) continue;
+    const match = /^(100644|100755) blob ([a-f0-9]{40,64})\t/.exec(entry);
+    if (!match) throw new ConfigError(`Base policy '${filename}' must be a regular Git blob.`);
+    const content = await readBlob(cwd, match[2], signal, 64 * 1024);
+    return { config: configFromText(new TextDecoder("utf-8", { fatal: true }).decode(content), `${filename} in base ${baseSha.slice(0, 7)}`), filename };
+  }
+  return { config: configFromText("{}", "default review policy"), filename: null };
+}
+
+// src/review.ts
+var GENERATED_PATHS2 = ["**/node_modules/**", "**/dist/**", "**/build/**", "**/vendor/**", "**/*.min.js", "**/*.map"];
+var MAX_SCAN_BYTES2 = 50 * 1024 * 1024;
+function compareFindings(before, after, newPath) {
+  const old = /* @__PURE__ */ new Map();
+  for (const finding of before) {
+    const key = findingFingerprint({ ...finding, file: newPath });
+    const bucket = old.get(key) || { findings: [], matched: 0 };
+    bucket.findings.push(finding);
+    old.set(key, bucket);
+  }
+  const introduced = [];
+  let unchanged = 0;
+  for (const finding of after) {
+    const bucket = old.get(findingFingerprint(finding));
+    if (bucket && bucket.matched < bucket.findings.length) {
+      bucket.matched++;
+      unchanged++;
+    } else introduced.push(finding);
+  }
+  return { introduced, removed: [...old.values()].flatMap((bucket) => bucket.findings.slice(bucket.matched)), unchanged };
+}
+async function reviewChanges(options) {
+  assertNotAborted(options.signal);
+  const cwd = path5.resolve(options.cwd || process.cwd());
+  const refs = await reviewRefs(cwd, options.base, options.head ?? "HEAD", options.signal);
+  const policy = await reviewPolicy(cwd, refs.baseSha, options.signal);
+  const format = options.format ?? "terminal";
+  if (!["terminal", "json", "github", "markdown", "sarif"].includes(format)) throw new ConfigError("Unsupported review format.");
+  const failOn = options.failOn ?? policy.config.failOn ?? ["test-skip", "trivial-assert"];
+  for (const rule of failOn) if (!VALID_DETECTORS.includes(rule)) throw new ConfigError(`Unknown review rule '${rule}'.`);
+  const changes = await changedTreeFiles(cwd, refs.mergeBaseSha, refs.headSha, options.signal);
+  const policyChanges = changes.filter((change) => CONFIG_FILENAMES.includes(change.oldPath) || CONFIG_FILENAMES.includes(change.newPath)).map((change) => change.newPath);
+  const ignores = [...GENERATED_PATHS2, ...policy.config.ignorePaths || []];
+  const result = {
+    schemaVersion: "1.0.0",
+    mode: "review",
+    ...refs,
+    policySha: refs.baseSha,
+    policyFile: policy.filename,
+    policyChanges,
+    filesChanged: changes.length,
+    filesInspected: 0,
+    unsupportedFiles: 0,
+    excludedFiles: 0,
+    renamedFiles: changes.filter((change) => change.status.startsWith("R")).length,
+    linesInspected: 0,
+    beforeFindings: 0,
+    afterFindings: 0,
+    unchangedCount: 0,
+    infractions: [],
+    removedFindings: [],
+    skippedFiles: [],
+    complete: true,
+    failedRules: [],
+    passed: false,
+    exitCode: 2,
+    output: ""
+  };
+  let totalBytes = 0;
+  for (const change of changes) {
+    assertNotAborted(options.signal);
+    const oldSupported = change.oldMode !== "000000" && isCodeFile(change.oldPath);
+    const newSupported = change.newMode !== "000000" && isCodeFile(change.newPath);
+    if (!oldSupported && !newSupported) {
+      result.unsupportedFiles++;
+      continue;
+    }
+    const oldInScope = oldSupported && isCodeFile(change.oldPath, ignores);
+    const newInScope = newSupported && isCodeFile(change.newPath, ignores);
+    if (!oldInScope && !newInScope) {
+      result.excludedFiles++;
+      continue;
+    }
+    try {
+      let inspectedLines = 0;
+      const scan = async (mode, oid, filename, commit) => {
+        if (mode === "000000") return [];
+        if (!["100644", "100755"].includes(mode)) throw new ConfigError("Changed source is a symlink, submodule or unsupported Git mode; comparison is incomplete.");
+        const content = await readBlob(cwd, oid, options.signal);
+        totalBytes += content.length;
+        if (totalBytes > MAX_SCAN_BYTES2) throw new ConfigError("Review exceeds the 50 MiB source comparison limit.");
+        if (content.includes(0)) throw new ConfigError("Binary content in a source comparison.");
+        const text = new TextDecoder("utf-8", { fatal: true }).decode(content);
+        const lines = text.split(/\r?\n/);
+        if (lines.at(-1) === "") lines.pop();
+        inspectedLines += lines.length;
+        return auditFileDiffs([{ path: filename, addedLines: lines.map((line, index) => ({ line, lineNumber: index + 1 })) }], commit, "", { rules: policy.config.rules }).infractions;
+      };
+      if (oldSupported && !newSupported && change.newMode !== "000000") {
+        throw new ConfigError("Source moved to an unsupported extension; cannot claim its findings were resolved.");
+      }
+      const before = await scan(change.oldMode, change.oldOid, change.oldPath, refs.mergeBaseSha);
+      const after = await scan(change.newMode, change.newOid, change.newPath, refs.headSha);
+      const compared = compareFindings(before, after, change.newPath);
+      result.infractions.push(...compared.introduced);
+      result.removedFindings.push(...compared.removed);
+      result.unchangedCount += compared.unchanged;
+      result.beforeFindings += before.length;
+      result.afterFindings += after.length;
+      result.filesInspected++;
+      result.linesInspected += inspectedLines;
+    } catch (error) {
+      assertNotAborted(options.signal);
+      result.skippedFiles.push({ file: change.newPath, reason: error instanceof Error ? error.message : String(error) });
+      if (totalBytes > MAX_SCAN_BYTES2) break;
+    }
+  }
+  assertNotAborted(options.signal);
+  result.complete = result.skippedFiles.length === 0;
+  result.failedRules = [...new Set(result.infractions.filter((finding) => failOn.includes(finding.type)).map((finding) => finding.type))];
+  result.passed = result.complete && result.failedRules.length === 0;
+  result.exitCode = !result.complete ? 2 : result.passed ? 0 : 1;
+  if (format === "json") result.output = JSON.stringify(result, null, 2);
+  else if (format === "markdown") result.output = formatReviewMarkdown(result);
+  else if (format === "sarif") result.output = formatSarif(result);
+  else if (format === "github") result.output = formatGithubAnnotations(result) + (!result.complete ? "\n::error::Context review incomplete. Inspect skipped source files in the JSON report." : "") + (policyChanges.length ? "\n::notice::Candidate policy changes were ignored; review uses policy from the supplied base commit." : "");
+  else result.output = formatReviewTerminal(result);
+  return result;
+}
+
 // src/index.ts
 var InvalidDetectorError = class extends Error {
   constructor(message) {
@@ -2007,9 +2375,9 @@ var InvalidDetectorError = class extends Error {
   }
 };
 async function roastRepository(options = {}) {
-  const cwd = path5.resolve(options.cwd || process.cwd());
+  const cwd = path6.resolve(options.cwd || process.cwd());
   const since = options.since || "90 days ago";
-  const repoName = path5.basename(cwd);
+  const repoName = path6.basename(cwd);
   const collector = new MetricsCollector({ all: options.all, ignorePaths: options.ignorePaths, rules: options.rules, panicLoopWindowMinutes: options.panicLoopWindowMinutes });
   const gitStream = streamGitLog(cwd, since);
   await parseGitLogStream(gitStream, (commit, stats) => {
@@ -2024,7 +2392,7 @@ async function roastRepository(options = {}) {
   return { summary, output };
 }
 async function auditPullRequest(options) {
-  const cwd = path5.resolve(options.cwd || process.cwd());
+  const cwd = path6.resolve(options.cwd || process.cwd());
   const format = options.format || "terminal";
   const failOn = (options.failOn || ["test-skip"]).map((s) => s.trim()).filter(Boolean);
   for (const det of failOn) {
@@ -2109,7 +2477,9 @@ export {
   RULE_GUIDES,
   VALID_DETECTORS,
   DEFAULT_CONFIG,
+  CONFIG_FILENAMES,
   ConfigError,
+  configFromText,
   loadConfig,
   matchIgnorePath,
   isCodeFile,
@@ -2125,6 +2495,8 @@ export {
   formatPrMarkdownComment,
   formatCheckTerminal,
   formatCheckMarkdown,
+  formatReviewTerminal,
+  formatReviewMarkdown,
   DEFAULT_CONFIG_TEMPLATE,
   GITHUB_WORKFLOW_TEMPLATE,
   PRE_COMMIT_HOOK_TEMPLATE,
@@ -2138,7 +2510,10 @@ export {
   loadBaseline,
   applyBaseline,
   writeBaseline,
+  formatSarif,
   checkProject,
+  compareFindings,
+  reviewChanges,
   InvalidDetectorError,
   roastRepository,
   auditPullRequest

package/dist/cli.js

@@ -9,14 +9,16 @@ import {
   auditPullRequest,
   checkProject,
   formatGithubStepSummary,
+  formatReviewMarkdown,
   generateShieldsJson,
   generateShieldsMarkdown,
   generateSvgBadge,
   initProject,
   loadConfig,
+  reviewChanges,
   roastRepository,
   writeBaseline
-} from "./chunk-FUAUIURY.js";
+} from "./chunk-RU5OYHLR.js";
 
 // src/cli.ts
 import { Command } from "commander";
@@ -26,7 +28,7 @@ import * as path from "path";
 var require2 = createRequire(import.meta.url);
 var pkg = require2("../package.json");
 var program = new Command();
-program.name("agent-roast").description("Audit your git history or PR diffs for AI coding shortcuts and panic loops").version(pkg.version || "0.4.0").argument("[path]", "Path to git repository (default: current directory)", ".").option("-a, --all", "Audit ALL commits regardless of AI attribution tags", false).option("-s, --since <time>", "Time window for git analysis", "90 days ago").option("-v, --verbose", "Show commit SHAs and line snippets for all infractions", false).option("--json", "Output results as raw JSON", false).option("--staged", "Audit staged changes before committing (including the first commit)", false).option("--base <ref>", "Base git ref/branch for PR mode audit (e.g. origin/main)").option("--head <ref>", "Head git ref/SHA for PR mode audit (default: HEAD)", "HEAD").option("--fail-on <rules>", "Comma-separated detectors that trigger CI failure").option("--fail-under <score>", "Fail CI if agent score is below threshold (0-100)").option("--format <format>", "Output format: terminal, json, github, markdown", "terminal").option("--authors", "Display author names and emails in report", false).action(async (repoPath, options) => {
+program.name("agent-roast").description("Audit your git history or PR diffs for AI coding shortcuts and panic loops").version(pkg.version || "0.4.0").argument("[path]", "Path to git repository (default: current directory)", ".").option("-a, --all", "Audit ALL commits regardless of AI attribution tags", false).option("-s, --since <time>", "Time window for git analysis", "90 days ago").option("-v, --verbose", "Show commit SHAs and line snippets for all infractions", false).option("--json", "Output results as raw JSON", false).option("--staged", "Audit staged changes before committing (including the first commit)", false).option("--base <ref>", "Base git ref/branch for PR mode audit (e.g. origin/main)").option("--head <ref>", "Head git ref/SHA for PR mode audit (default: HEAD)", "HEAD").option("--fail-on <rules>", "Comma-separated detectors that trigger CI failure").option("--fail-under <score>", "Fail CI if agent score is below threshold (0-100)").option("--format <format>", "Output format: terminal, json, github, markdown (check/review also support sarif)", "terminal").option("--authors", "Display author names and emails in report", false).action(async (repoPath, options) => {
   try {
     if (process.env.GITHUB_EVENT_NAME === "pull_request_target") {
       console.warn(
@@ -120,7 +122,49 @@ has-supported-changes=${prResult.hasSupportedChanges}
     }
   }
 });
-program.command("check").description("Check current tracked and non-ignored untracked source files").argument("[path]", "Path to a git repository", ".").option("--baseline <file>", "Report only findings not accepted in this baseline").option("--write-baseline <file>", "Save current findings for adoption (refuses to overwrite)").addHelpText("after", "\nOutput options: --format terminal|json|github|markdown, --json, --fail-on <rules>\nExamples:\n  agent-roast check\n  agent-roast check --write-baseline .agentroast-baseline.json\n  agent-roast check --baseline .agentroast-baseline.json --format json").action(async (repoPath, opts) => {
+program.command("review").description("Compare full changed source at merge-base and head; gate only new findings").argument("[path]", "Path to the Git repository", ".").addHelpText("after", "\nRequired: --base <trusted-ref>  Optional: --head <ref> (default HEAD)\nOutput: --format terminal|json|github|markdown|sarif, --json, --fail-on <rules>\nExample: agent-roast review --base origin/main --format markdown").action(async (repoPath) => {
+  try {
+    const options = program.opts();
+    if (!options.base) throw new ConfigError("review requires --base <trusted-ref>.");
+    if (options.staged || options.all || options.failUnder !== void 0 || program.getOptionValueSource("since") === "cli") {
+      throw new ConfigError("review compares committed refs; --staged, --all, --since and --fail-under do not apply.");
+    }
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    process.once("SIGINT", abort);
+    process.once("SIGTERM", abort);
+    try {
+      const result = await reviewChanges({
+        cwd: repoPath,
+        base: options.base,
+        head: options.head,
+        failOn: options.failOn !== void 0 ? options.failOn.split(",").map((rule) => rule.trim()).filter(Boolean) : void 0,
+        format: options.json ? "json" : options.format,
+        signal: controller.signal
+      });
+      if (process.env.GITHUB_STEP_SUMMARY) fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, formatReviewMarkdown(result) + "\n");
+      if (process.env.GITHUB_OUTPUT) fs.appendFileSync(
+        process.env.GITHUB_OUTPUT,
+        `passed=${result.passed}
+infractions-count=${result.infractions.length}
+has-supported-changes=${result.filesInspected > 0}
+complete=${result.complete}
+existing-count=${result.unchangedCount}
+removed-count=${result.removedFindings.length}
+`
+      );
+      console.log(result.output);
+      process.exitCode = result.exitCode;
+    } finally {
+      process.removeListener("SIGINT", abort);
+      process.removeListener("SIGTERM", abort);
+    }
+  } catch (error) {
+    console.error(`agent-roast review error: ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 2;
+  }
+});
+program.command("check").description("Check current tracked and non-ignored untracked source files").argument("[path]", "Path to a git repository", ".").option("--baseline <file>", "Report only findings not accepted in this baseline").option("--write-baseline <file>", "Save current findings for adoption (refuses to overwrite)").addHelpText("after", "\nOutput options: --format terminal|json|github|markdown|sarif, --json, --fail-on <rules>\nExamples:\n  agent-roast check\n  agent-roast check --write-baseline .agentroast-baseline.json\n  agent-roast check --baseline .agentroast-baseline.json --format json").action(async (repoPath, opts) => {
   try {
     const global = program.opts();
     if (global.base || global.staged || global.failUnder !== void 0 || global.all || program.getOptionValueSource("head") === "cli" || program.getOptionValueSource("since") === "cli") {

package/dist/index.d.ts

@@ -86,7 +86,7 @@ interface PrAuditResult {
 interface CheckOptions {
     cwd?: string;
     failOn?: string[];
-    format?: "terminal" | "json" | "github" | "markdown";
+    format?: ReviewFormat;
     baseline?: string;
     signal?: AbortSignal;
 }
@@ -109,6 +109,45 @@ interface CheckResult {
     exitCode: number;
     output: string;
 }
+type ReviewFormat = "terminal" | "json" | "github" | "markdown" | "sarif";
+interface ReviewOptions {
+    cwd?: string;
+    base: string;
+    head?: string;
+    failOn?: string[];
+    format?: ReviewFormat;
+    signal?: AbortSignal;
+}
+interface ReviewResult {
+    schemaVersion: string;
+    mode: "review";
+    baseSha: string;
+    headSha: string;
+    mergeBaseSha: string;
+    policySha: string;
+    policyFile: string | null;
+    policyChanges: string[];
+    filesChanged: number;
+    filesInspected: number;
+    unsupportedFiles: number;
+    excludedFiles: number;
+    renamedFiles: number;
+    linesInspected: number;
+    beforeFindings: number;
+    afterFindings: number;
+    unchangedCount: number;
+    infractions: Infraction[];
+    removedFindings: Infraction[];
+    skippedFiles: {
+        file: string;
+        reason: string;
+    }[];
+    complete: boolean;
+    failedRules: string[];
+    passed: boolean;
+    exitCode: number;
+    output: string;
+}
 
 interface AiAttributionResult {
     isAiAttributed: boolean;
@@ -246,6 +285,8 @@ declare function formatPrMarkdownComment(result: PrAuditResult): string;
 /** Current-tree report emphasizes next actions and explicitly accounts for baseline debt. */
 declare function formatCheckTerminal(result: CheckResult): string;
 declare function formatCheckMarkdown(result: CheckResult): string;
+declare function formatReviewTerminal(result: ReviewResult): string;
+declare function formatReviewMarkdown(result: ReviewResult): string;
 
 interface AgentRoastConfig {
     /** Detector rules to fail CI on in PR mode */
@@ -260,9 +301,12 @@ interface AgentRoastConfig {
     panicLoopWindowMinutes?: number;
 }
 declare const DEFAULT_CONFIG: AgentRoastConfig;
+declare const CONFIG_FILENAMES: string[];
 declare class ConfigError extends Error {
     constructor(message: string);
 }
+/** Parse one explicit policy source; shared by worktree and trusted Git reviews. */
+declare function configFromText(text: string, source: string): AgentRoastConfig;
 /** Invalid policy must stop the audit instead of silently changing CI behavior. */
 declare function loadConfig(cwd?: string): AgentRoastConfig;
 /**
@@ -287,7 +331,7 @@ declare const DEFAULT_CONFIG_TEMPLATE: {
     };
     scoreThreshold: number;
 };
-declare const GITHUB_WORKFLOW_TEMPLATE = "name: Agent Roast\non:\n  pull_request:\n    branches: [main, master]\n\npermissions:\n  contents: read\n\njobs:\n  audit:\n    name: Audit AI Shortcuts\n    runs-on: ubuntu-latest\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@v4\n        with:\n          fetch-depth: 0\n\n      - name: Run agent-roast PR check\n        if: github.event_name == 'pull_request'\n        uses: Nari-Ab/agent-roast@v1\n        with:\n          base: ${{ github.event.pull_request.base.sha }}\n          head: ${{ github.event.pull_request.head.sha }}\n          format: github\n";
+declare const GITHUB_WORKFLOW_TEMPLATE = "name: Agent Roast\non:\n  pull_request:\n    branches: [main, master]\n\npermissions:\n  contents: read\n\njobs:\n  audit:\n    name: Audit AI Shortcuts\n    runs-on: ubuntu-latest\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@v4\n        with:\n          fetch-depth: 0\n\n      - name: Run agent-roast PR check\n        if: github.event_name == 'pull_request'\n        uses: Nari-Ab/agent-roast@v1\n        with:\n          base: ${{ github.event.pull_request.base.sha }}\n          head: ${{ github.event.pull_request.head.sha }}\n          format: github\n          mode: review\n";
 declare const PRE_COMMIT_HOOK_TEMPLATE = "#!/bin/sh\n# Run agent-roast pre-commit verification\nnpx --no-install agent-roast --staged\n";
 declare function initProject(options?: InitOptions): Promise<InitResult>;
 
@@ -308,6 +352,20 @@ declare function generateShieldsJson(score: number | null, label?: string): Shie
 /** Read current tracked and non-ignored untracked source; never run project code. */
 declare function checkProject(options?: CheckOptions): Promise<CheckResult>;
 
+/** Match only within the same changed-file pair; Git renames remap old paths.
+ * Counts matter: an identical second shortcut is still a new finding. */
+declare function compareFindings(before: Infraction[], after: Infraction[], newPath: string): {
+    introduced: Infraction[];
+    removed: Infraction[];
+    unchanged: number;
+};
+/** Compare full source blobs in changed files without executing or checking out the candidate. */
+declare function reviewChanges(options: ReviewOptions): Promise<ReviewResult>;
+
+/** Offline SARIF 2.1.0, with relative URIs and explicit incomplete-run status.
+ * Snippets are omitted to avoid embedding source code in integration artifacts. */
+declare function formatSarif(report: CheckResult | ReviewResult): string;
+
 interface FindingBaseline {
     schemaVersion: "1.0.0";
     fingerprintVersion: 1;
@@ -346,4 +404,4 @@ declare function roastRepository(options?: RoastOptions): Promise<{
 }>;
 declare function auditPullRequest(options: PrAuditOptions): Promise<PrAuditResult>;
 
-export { type AgentRoastConfig, type AiAttributionResult, type CheckOptions, type CheckResult, type CommitInfo, ConfigError, DEFAULT_CONFIG, DEFAULT_CONFIG_TEMPLATE, type DetectorType, FIELD_SEPARATOR, type FindingBaseline, GITHUB_WORKFLOW_TEMPLATE, GitError, GitResolutionError, HERMETIC_GIT_FLAGS, type Infraction, type InitOptions, type InitResult, InvalidDetectorError, type MetricSummary, MetricsCollector, PRE_COMMIT_HOOK_TEMPLATE, type ParseDiffResult, type ParsedCommit, type ParsedDiffLine, type ParsedFileDiff, type PrAuditOptions, type PrAuditResult, RECORD_SEPARATOR, RULE_GUIDES, type RoastOptions, type RuleGuide, type ShieldsEndpointResponse, VALID_DETECTORS, applyBaseline, auditFileDiffs, auditPullRequest, checkProject, createBaseline, detectAiAttribution, findMergeBase, findingFingerprint, formatCheckMarkdown, formatCheckTerminal, formatGithubAnnotations, formatGithubStepSummary, formatPrMarkdownComment, formatPrTerminalCard, formatTerminalCard, generateShareUrl, generateShieldsJson, generateShieldsMarkdown, generateSvgBadge, getHermeticGitEnv, getScoreColor, initProject, isCodeFile, isTestFile, loadBaseline, loadConfig, matchIgnorePath, parseDiff, parseGitLogStream, resolveCommitSha, roastRepository, streamGitDiff, streamGitLog, stripStringAndRegexLiterals, unquoteGitPath, writeBaseline };
+export { type AgentRoastConfig, type AiAttributionResult, CONFIG_FILENAMES, type CheckOptions, type CheckResult, type CommitInfo, ConfigError, DEFAULT_CONFIG, DEFAULT_CONFIG_TEMPLATE, type DetectorType, FIELD_SEPARATOR, type FindingBaseline, GITHUB_WORKFLOW_TEMPLATE, GitError, GitResolutionError, HERMETIC_GIT_FLAGS, type Infraction, type InitOptions, type InitResult, InvalidDetectorError, type MetricSummary, MetricsCollector, PRE_COMMIT_HOOK_TEMPLATE, type ParseDiffResult, type ParsedCommit, type ParsedDiffLine, type ParsedFileDiff, type PrAuditOptions, type PrAuditResult, RECORD_SEPARATOR, RULE_GUIDES, type ReviewFormat, type ReviewOptions, type ReviewResult, type RoastOptions, type RuleGuide, type ShieldsEndpointResponse, VALID_DETECTORS, applyBaseline, auditFileDiffs, auditPullRequest, checkProject, compareFindings, configFromText, createBaseline, detectAiAttribution, findMergeBase, findingFingerprint, formatCheckMarkdown, formatCheckTerminal, formatGithubAnnotations, formatGithubStepSummary, formatPrMarkdownComment, formatPrTerminalCard, formatReviewMarkdown, formatReviewTerminal, formatSarif, formatTerminalCard, generateShareUrl, generateShieldsJson, generateShieldsMarkdown, generateSvgBadge, getHermeticGitEnv, getScoreColor, initProject, isCodeFile, isTestFile, loadBaseline, loadConfig, matchIgnorePath, parseDiff, parseGitLogStream, resolveCommitSha, reviewChanges, roastRepository, streamGitDiff, streamGitLog, stripStringAndRegexLiterals, unquoteGitPath, writeBaseline };

package/dist/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import {
+  CONFIG_FILENAMES,
   ConfigError,
   DEFAULT_CONFIG,
   DEFAULT_CONFIG_TEMPLATE,
@@ -18,6 +19,8 @@ import {
   auditFileDiffs,
   auditPullRequest,
   checkProject,
+  compareFindings,
+  configFromText,
   createBaseline,
   detectAiAttribution,
   findMergeBase,
@@ -28,6 +31,9 @@ import {
   formatGithubStepSummary,
   formatPrMarkdownComment,
   formatPrTerminalCard,
+  formatReviewMarkdown,
+  formatReviewTerminal,
+  formatSarif,
   formatTerminalCard,
   generateShareUrl,
   generateShieldsJson,
@@ -44,14 +50,16 @@ import {
   parseDiff,
   parseGitLogStream,
   resolveCommitSha,
+  reviewChanges,
   roastRepository,
   streamGitDiff,
   streamGitLog,
   stripStringAndRegexLiterals,
   unquoteGitPath,
   writeBaseline
-} from "./chunk-FUAUIURY.js";
+} from "./chunk-RU5OYHLR.js";
 export {
+  CONFIG_FILENAMES,
   ConfigError,
   DEFAULT_CONFIG,
   DEFAULT_CONFIG_TEMPLATE,
@@ -70,6 +78,8 @@ export {
   auditFileDiffs,
   auditPullRequest,
   checkProject,
+  compareFindings,
+  configFromText,
   createBaseline,
   detectAiAttribution,
   findMergeBase,
@@ -80,6 +90,9 @@ export {
   formatGithubStepSummary,
   formatPrMarkdownComment,
   formatPrTerminalCard,
+  formatReviewMarkdown,
+  formatReviewTerminal,
+  formatSarif,
   formatTerminalCard,
   generateShareUrl,
   generateShieldsJson,
@@ -96,6 +109,7 @@ export {
   parseDiff,
   parseGitLogStream,
   resolveCommitSha,
+  reviewChanges,
   roastRepository,
   streamGitDiff,
   streamGitLog,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-roast",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Offline code checks for skipped tests, swallowed errors, unfinished stubs and AI coding shortcuts",
   "type": "module",
   "main": "./dist/index.js",