agent-roast 0.6.0 → 0.8.0

package/dist/cli.js

@@ -13,12 +13,16 @@ import {
   generateShieldsJson,
   generateShieldsMarkdown,
   generateSvgBadge,
+  gitOutputPath,
   initProject,
   loadConfig,
+  readGit,
   reviewChanges,
+  reviewStagedChanges,
   roastRepository,
+  terminalText,
   writeBaseline
-} from "./chunk-RU5OYHLR.js";
+} from "./chunk-C423TSZF.js";
 
 // src/cli.ts
 import { Command } from "commander";
@@ -27,8 +31,47 @@ import * as fs from "fs";
 import * as path from "path";
 var require2 = createRequire(import.meta.url);
 var pkg = require2("../package.json");
+var errorMessage = (error) => terminalText(error instanceof Error ? error.message : String(error));
+async function runContextReview(repoPath, options, staged) {
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  process.once("SIGINT", abort);
+  process.once("SIGTERM", abort);
+  try {
+    const common = {
+      cwd: repoPath,
+      failOn: options.failOn !== void 0 ? options.failOn.split(",").map((rule) => rule.trim()).filter(Boolean) : void 0,
+      ignoreExceptions: options.ignoreExceptions,
+      format: options.json ? "json" : options.format,
+      signal: controller.signal
+    };
+    const result = staged ? await reviewStagedChanges(common) : await reviewChanges({ ...common, base: options.base, head: options.head });
+    console.log(result.output);
+    process.exitCode = result.exitCode;
+    for (const [filename, content] of [
+      [process.env.GITHUB_STEP_SUMMARY, formatReviewMarkdown(result) + "\n"],
+      [process.env.GITHUB_OUTPUT, `passed=${result.passed}
+infractions-count=${result.infractions.length}
+has-supported-changes=${result.filesInspected > 0}
+complete=${result.complete}
+existing-count=${result.unchangedCount}
+removed-count=${result.removedFindings.length}
+`]
+    ]) {
+      if (!filename) continue;
+      try {
+        fs.appendFileSync(filename, content);
+      } catch (error) {
+        console.error(`Warning: could not write an optional GitHub report artifact: ${errorMessage(error)}`);
+      }
+    }
+  } finally {
+    process.removeListener("SIGINT", abort);
+    process.removeListener("SIGTERM", abort);
+  }
+}
 var program = new Command();
-program.name("agent-roast").description("Audit your git history or PR diffs for AI coding shortcuts and panic loops").version(pkg.version || "0.4.0").argument("[path]", "Path to git repository (default: current directory)", ".").option("-a, --all", "Audit ALL commits regardless of AI attribution tags", false).option("-s, --since <time>", "Time window for git analysis", "90 days ago").option("-v, --verbose", "Show commit SHAs and line snippets for all infractions", false).option("--json", "Output results as raw JSON", false).option("--staged", "Audit staged changes before committing (including the first commit)", false).option("--base <ref>", "Base git ref/branch for PR mode audit (e.g. origin/main)").option("--head <ref>", "Head git ref/SHA for PR mode audit (default: HEAD)", "HEAD").option("--fail-on <rules>", "Comma-separated detectors that trigger CI failure").option("--fail-under <score>", "Fail CI if agent score is below threshold (0-100)").option("--format <format>", "Output format: terminal, json, github, markdown (check/review also support sarif)", "terminal").option("--authors", "Display author names and emails in report", false).action(async (repoPath, options) => {
+program.name("agent-roast").description("Check current code, review changes and audit Git history for coding shortcuts").version(pkg.version || "0.4.0").argument("[path]", "Path to git repository (default: current directory)", ".").option("-a, --all", "Audit ALL commits regardless of AI attribution tags", false).option("-s, --since <time>", "Time window for git analysis", "90 days ago").option("-v, --verbose", "Show commit SHAs and line snippets for all infractions", false).option("--json", "Output results as raw JSON", false).option("--staged", "Compare full HEAD/index source and gate new staged findings (including the first commit)", false).option("--base <ref>", "Base git ref/branch for PR mode audit (e.g. origin/main)").option("--head <ref>", "Head git ref/SHA for PR mode audit (default: HEAD)", "HEAD").option("--ignore-exceptions", "Report findings even when accepted by reviewed, unexpired exceptions", false).option("--fail-on <rules>", "Comma-separated detectors that trigger CI failure").option("--fail-under <score>", "Fail CI if agent score is below threshold (0-100)").option("--format <format>", "Output format: terminal, json, github, markdown (check/review also support sarif)", "terminal").option("--authors", "Display author names and emails in report", false).action(async (repoPath, options) => {
   try {
     if (process.env.GITHUB_EVENT_NAME === "pull_request_target") {
       console.warn(
@@ -36,6 +79,14 @@ program.name("agent-roast").description("Audit your git history or PR diffs for
       );
     }
     if (options.staged && options.base) throw new ConfigError("--staged cannot be combined with --base.");
+    if (options.staged) {
+      if (options.all || options.failUnder !== void 0 || program.getOptionValueSource("since") === "cli" || program.getOptionValueSource("head") === "cli") {
+        throw new ConfigError("--staged compares HEAD and index; --all, --since, --head and --fail-under do not apply.");
+      }
+      await runContextReview(repoPath, options, true);
+      return;
+    }
+    if (options.ignoreExceptions) throw new ConfigError("--ignore-exceptions applies to check, review and --staged context checks.");
     if (!["terminal", "json", "github", "markdown"].includes(options.format)) {
       throw new ConfigError("--format must be terminal, json, github, or markdown.");
     }
@@ -48,7 +99,8 @@ program.name("agent-roast").description("Audit your git history or PR diffs for
     if (!options.base && !options.staged && !options.json && !["terminal", "json"].includes(options.format)) {
       throw new ConfigError("Repository audits support terminal or json format; use --base or --staged for github/markdown.");
     }
-    const config = await loadConfig(repoPath);
+    const configRoot = gitOutputPath((await readGit(path.resolve(repoPath), ["rev-parse", "--show-toplevel"])).toString("utf8"));
+    const config = loadConfig(configRoot);
     if (options.base || options.staged) {
       const failOnRules = options.failOn !== void 0 ? options.failOn.split(",").map((s) => s.trim()).filter(Boolean) : config.failOn;
       const chosenFormat = options.json ? "json" : options.format || "terminal";
@@ -71,7 +123,7 @@ program.name("agent-roast").description("Audit your git history or PR diffs for
             formatGithubStepSummary(prResult) + "\n"
           );
         } catch (err) {
-          console.error(`Warning: Failed to write to GITHUB_STEP_SUMMARY: ${err.message}`);
+          console.error(`Warning: Failed to write to GITHUB_STEP_SUMMARY: ${errorMessage(err)}`);
         }
       }
       if (process.env.GITHUB_OUTPUT) {
@@ -84,7 +136,7 @@ has-supported-changes=${prResult.hasSupportedChanges}
 `
           );
         } catch (err) {
-          console.error(`Warning: Failed to write to GITHUB_OUTPUT: ${err.message}`);
+          console.error(`Warning: Failed to write to GITHUB_OUTPUT: ${errorMessage(err)}`);
         }
       }
       console.log(prResult.output);
@@ -106,7 +158,9 @@ has-supported-changes=${prResult.hasSupportedChanges}
         console.log(result.output);
       }
       const scoreThreshold = options.failUnder !== void 0 ? Number(options.failUnder) : config.scoreThreshold;
-      if (scoreThreshold !== void 0 && !isNaN(scoreThreshold) && result.summary.score !== null && result.summary.score < scoreThreshold) {
+      if (result.summary.skippedLongLines || result.summary.skippedUnknownFiles || result.summary.skippedBinaryFiles) {
+        process.exitCode = 2;
+      } else if (scoreThreshold !== void 0 && !isNaN(scoreThreshold) && result.summary.score !== null && result.summary.score < scoreThreshold) {
         process.exitCode = 1;
       } else {
         process.exitCode = 0;
@@ -114,53 +168,26 @@ has-supported-changes=${prResult.hasSupportedChanges}
     }
   } catch (err) {
     if (err instanceof ConfigError || err instanceof GitResolutionError || err instanceof InvalidDetectorError || err instanceof GitError || err.name === "GitError") {
-      console.error(`agent-roast error: ${err.message}`);
+      console.error(`agent-roast error: ${errorMessage(err)}`);
       process.exitCode = 2;
     } else {
-      console.error(`Error auditing repository: ${err.message}`);
+      console.error(`Error auditing repository: ${errorMessage(err)}`);
       process.exitCode = 1;
     }
   }
 });
-program.command("review").description("Compare full changed source at merge-base and head; gate only new findings").argument("[path]", "Path to the Git repository", ".").addHelpText("after", "\nRequired: --base <trusted-ref>  Optional: --head <ref> (default HEAD)\nOutput: --format terminal|json|github|markdown|sarif, --json, --fail-on <rules>\nExample: agent-roast review --base origin/main --format markdown").action(async (repoPath) => {
+program.command("review").description("Compare full changed source at merge-base and head; gate only new findings").argument("[path]", "Path to the Git repository", ".").addHelpText("after", "\nRequired: --base <trusted-ref>  Optional: --head <ref> (default HEAD), or use --staged for HEAD/index\nOutput: --format terminal|json|github|markdown|sarif, --json, --fail-on <rules>\nExample: agent-roast review --base origin/main --format markdown").action(async (repoPath) => {
   try {
     const options = program.opts();
-    if (!options.base) throw new ConfigError("review requires --base <trusted-ref>.");
-    if (options.staged || options.all || options.failUnder !== void 0 || program.getOptionValueSource("since") === "cli") {
-      throw new ConfigError("review compares committed refs; --staged, --all, --since and --fail-under do not apply.");
+    if (options.staged ? options.base || program.getOptionValueSource("head") === "cli" : !options.base) {
+      throw new ConfigError("Use review --base <trusted-ref> or review --staged; --base/--head cannot be combined with --staged.");
     }
-    const controller = new AbortController();
-    const abort = () => controller.abort();
-    process.once("SIGINT", abort);
-    process.once("SIGTERM", abort);
-    try {
-      const result = await reviewChanges({
-        cwd: repoPath,
-        base: options.base,
-        head: options.head,
-        failOn: options.failOn !== void 0 ? options.failOn.split(",").map((rule) => rule.trim()).filter(Boolean) : void 0,
-        format: options.json ? "json" : options.format,
-        signal: controller.signal
-      });
-      if (process.env.GITHUB_STEP_SUMMARY) fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, formatReviewMarkdown(result) + "\n");
-      if (process.env.GITHUB_OUTPUT) fs.appendFileSync(
-        process.env.GITHUB_OUTPUT,
-        `passed=${result.passed}
-infractions-count=${result.infractions.length}
-has-supported-changes=${result.filesInspected > 0}
-complete=${result.complete}
-existing-count=${result.unchangedCount}
-removed-count=${result.removedFindings.length}
-`
-      );
-      console.log(result.output);
-      process.exitCode = result.exitCode;
-    } finally {
-      process.removeListener("SIGINT", abort);
-      process.removeListener("SIGTERM", abort);
+    if (options.all || options.failUnder !== void 0 || program.getOptionValueSource("since") === "cli") {
+      throw new ConfigError("review compares source snapshots; --all, --since and --fail-under do not apply.");
     }
+    await runContextReview(repoPath, options, options.staged);
   } catch (error) {
-    console.error(`agent-roast review error: ${error instanceof Error ? error.message : String(error)}`);
+    console.error(`agent-roast review error: ${errorMessage(error)}`);
     process.exitCode = 2;
   }
 });
@@ -174,6 +201,7 @@ program.command("check").description("Check current tracked and non-ignored untr
     const result = await checkProject({
       cwd: repoPath,
       baseline: opts.baseline,
+      ignoreExceptions: global.ignoreExceptions,
       failOn: global.failOn !== void 0 ? global.failOn.split(",").map((rule) => rule.trim()).filter(Boolean) : void 0,
       format: global.json ? "json" : global.format
     });
@@ -182,22 +210,27 @@ program.command("check").description("Check current tracked and non-ignored untr
       const basePath = path.resolve(repoPath, opts.writeBaseline);
       writeBaseline(basePath, result.infractions);
       const message = `Baseline created: ${basePath}
-Accepted ${result.totalFindings} existing findings. The code has not been fixed.
+Accepted ${result.infractions.length} existing findings. The code has not been fixed.
 Review and commit the baseline, then run check --baseline <file> to catch new findings.`;
-      console.log(global.json || global.format === "json" ? JSON.stringify({ operation: "write-baseline", baseline: basePath, acceptedFindings: result.totalFindings }, null, 2) : message);
+      console.log(global.json || global.format === "json" ? JSON.stringify({ operation: "write-baseline", baseline: basePath, acceptedFindings: result.infractions.length }, null, 2) : message);
       process.exitCode = 0;
       return;
     }
     console.log(result.output);
     process.exitCode = result.exitCode;
   } catch (err) {
-    console.error(`agent-roast check error: ${err instanceof Error ? err.message : String(err)}`);
+    console.error(`agent-roast check error: ${errorMessage(err)}`);
     process.exitCode = 2;
   }
 });
 program.command("explain <rule>").description("Explain a detector, its limits, and how to address a finding").action((rule) => {
+  if (program.opts().ignoreExceptions) {
+    console.error("--ignore-exceptions applies to check, review and --staged context checks.");
+    process.exitCode = 2;
+    return;
+  }
   if (!VALID_DETECTORS.includes(rule)) {
-    console.error(`Unknown rule '${rule}'. Valid rules: ${VALID_DETECTORS.join(", ")}`);
+    console.error(`Unknown rule '${terminalText(rule)}'. Valid rules: ${VALID_DETECTORS.join(", ")}`);
     process.exitCode = 2;
     return;
   }
@@ -213,6 +246,7 @@ Example: ${guide.example}
 });
 program.command("init").description("Initialize .agentroastrc.json and CI/hook configurations").argument("[dir]", "Directory to initialize", ".").option("-y, --yes", "Skip interactive prompts and use defaults", false).option("--ci", "Generate GitHub Actions workflow file", false).option("--hook", "Install Git pre-commit hook", false).action(async (targetDir, opts) => {
   try {
+    if (program.opts().ignoreExceptions) throw new ConfigError("--ignore-exceptions applies to check, review and --staged context checks.");
     const res = await initProject({
       cwd: targetDir,
       yes: opts.yes,
@@ -220,31 +254,33 @@ program.command("init").description("Initialize .agentroastrc.json and CI/hook c
       hook: opts.hook
     });
     if (res.created.length > 0) {
-      console.log(`Initialized agent-roast in ${targetDir}:`);
+      console.log(`Initialized agent-roast in ${terminalText(targetDir)}:`);
       for (const file of res.created) {
-        console.log(`  + Created ${file}`);
+        console.log(`  + Created ${terminalText(file)}`);
       }
     }
     if (res.skipped.length > 0) {
       for (const file of res.skipped) {
-        console.log(`  - Skipped ${file} (already exists or not applicable)`);
+        console.log(`  - Skipped ${terminalText(file)} (already exists or not applicable)`);
       }
     }
     if (res.created.length === 0 && res.skipped.length === 0) {
       console.log("No files were created.");
     }
   } catch (err) {
-    console.error(`Failed to initialize agent-roast: ${err.message}`);
+    console.error(`Failed to initialize agent-roast: ${errorMessage(err)}`);
     process.exitCode = 1;
   }
 });
-program.command("badge").description("Generate an AI discipline badge (SVG, Markdown, or Shields JSON)").argument("[path]", "Path to git repository (default: current directory)", ".").option("-a, --all", "Audit ALL commits regardless of AI attribution tags", false).option("-s, --since <time>", "Time window for git analysis", "90 days ago").option("--label <text>", "Badge label text", "AI Discipline").option("--out <file>", "Output SVG file path (e.g. ./badge.svg)").action(async (repoPath, opts) => {
+program.command("badge").description("Generate an AI discipline badge (SVG, Markdown, or Shields JSON)").argument("[path]", "Path to git repository (default: current directory)", ".").option("-a, --all", "Audit ALL commits regardless of AI attribution tags", false).option("-s, --since <time>", "Time window for git analysis", "90 days ago").option("--label <text>", "Badge label text", "AI Discipline").option("--out <file>", "Output SVG file path (e.g. ./badge.svg)").action(async (repoPath, opts, command) => {
   try {
     const rootOpts = program.opts();
     const isJson = Boolean(opts.json || rootOpts.json);
     const isAll = Boolean(opts.all || rootOpts.all);
-    const since = opts.since || rootOpts.since || "90 days ago";
-    const config = await loadConfig(repoPath);
+    if (rootOpts.ignoreExceptions) throw new ConfigError("--ignore-exceptions applies to check, review and --staged context checks.");
+    const since = command.getOptionValueSource("since") === "cli" ? opts.since : rootOpts.since || "90 days ago";
+    const configRoot = gitOutputPath((await readGit(path.resolve(repoPath), ["rev-parse", "--show-toplevel"])).toString("utf8"));
+    const config = loadConfig(configRoot);
     const result = await roastRepository({
       cwd: repoPath,
       since,
@@ -253,6 +289,7 @@ program.command("badge").description("Generate an AI discipline badge (SVG, Mark
       rules: config.rules,
       panicLoopWindowMinutes: config.panicLoopWindowMinutes
     });
+    if (result.summary.skippedLongLines || result.summary.skippedUnknownFiles || result.summary.skippedBinaryFiles) throw new ConfigError("Cannot generate a badge from an incomplete historical audit; resolve skipped source first.");
     const score = result.summary.score;
     const label = opts.label || "AI Discipline";
     if (isJson) {
@@ -266,7 +303,7 @@ program.command("badge").description("Generate an AI discipline badge (SVG, Mark
       const outPath = path.resolve(opts.out);
       fs.mkdirSync(path.dirname(outPath), { recursive: true });
       fs.writeFileSync(outPath, svg, "utf-8");
-      console.log(`Generated SVG badge at: ${opts.out}`);
+      console.log(`Generated SVG badge at: ${terminalText(opts.out)}`);
       process.exitCode = 0;
       return;
     }
@@ -278,8 +315,8 @@ ${markdown}
 `);
     process.exitCode = 0;
   } catch (err) {
-    console.error(`Error generating badge: ${err.message}`);
-    process.exitCode = 1;
+    console.error(`Error generating badge: ${errorMessage(err)}`);
+    process.exitCode = err instanceof ConfigError || err instanceof GitError || err instanceof GitResolutionError ? 2 : 1;
   }
 });
 program.parse(process.argv);

package/dist/index.d.ts

@@ -1,5 +1,28 @@
 import { Readable } from 'stream';
 
+/** A reviewed allowance for a precise pattern and number of occurrences.
+ * No wildcard, inline bypass, source snippet or executable policy is needed. */
+interface FindingException {
+    fingerprint: string;
+    count: number;
+    reason: string;
+    expires: string;
+}
+interface SuppressedFinding extends Infraction {
+    suppression: {
+        reason: string;
+        expires: string;
+    };
+}
+declare function validateExceptions(value: unknown): asserts value is FindingException[] | undefined;
+/** Line shifts are tolerated; duplicate occurrences beyond the approved count
+ * remain actionable. Expiry uses UTC calendar days, inclusive through that day. */
+declare function applyExceptions(findings: Infraction[], exceptions?: FindingException[], now?: Date, priorOccurrences?: ReadonlyMap<string, number>): {
+    findings: Infraction[];
+    suppressedFindings: SuppressedFinding[];
+    expiredExceptionCount: number;
+};
+
 interface CommitInfo {
     hash: string;
     date: string;
@@ -9,9 +32,11 @@ interface CommitInfo {
     isAiAttributed: boolean;
     aiSignatures: string[];
 }
-type DetectorType = "test-skip" | "type-escape" | "swallowed-error" | "panic-loop" | "trivial-assert" | "stub-abandonment";
+type DetectorType = "test-skip" | "type-escape" | "swallowed-error" | "panic-loop" | "trivial-assert" | "stub-abandonment" | "test-focus";
 declare const VALID_DETECTORS: readonly DetectorType[];
 interface Infraction {
+    fingerprint?: string;
+    occurrence?: number;
     type: DetectorType;
     file?: string;
     lineNumber?: number;
@@ -22,12 +47,14 @@ interface Infraction {
     suggestion?: string;
 }
 interface MetricSummary {
+    complete?: boolean;
     schemaVersion: string;
     totalLinesAdded: number;
     aiLinesAdded: number;
     totalCommits: number;
     aiCommits: number;
     testSkips: Infraction[];
+    focusedTests?: Infraction[];
     typeEscapes: Infraction[];
     swallowedErrors: Infraction[];
     panicLoops: Infraction[];
@@ -40,6 +67,7 @@ interface MetricSummary {
     archetypeDescription: string;
     skippedLongLines?: number;
     skippedUnknownFiles?: number;
+    skippedBinaryFiles?: number;
 }
 interface RoastOptions {
     cwd?: string;
@@ -78,8 +106,10 @@ interface PrAuditResult {
     infractions: Infraction[];
     failedRules: string[];
     passed: boolean;
+    complete?: boolean;
     skippedLongLines: number;
     skippedUnknownFiles: number;
+    skippedBinaryFiles?: number;
     output: string;
     exitCode: number;
 }
@@ -88,6 +118,7 @@ interface CheckOptions {
     failOn?: string[];
     format?: ReviewFormat;
     baseline?: string;
+    ignoreExceptions?: boolean;
     signal?: AbortSignal;
 }
 interface CheckResult {
@@ -103,6 +134,8 @@ interface CheckResult {
         file: string;
         reason: string;
     }[];
+    suppressedFindings?: SuppressedFinding[];
+    expiredExceptionCount?: number;
     complete: boolean;
     failedRules: string[];
     passed: boolean;
@@ -116,11 +149,14 @@ interface ReviewOptions {
     head?: string;
     failOn?: string[];
     format?: ReviewFormat;
+    ignoreExceptions?: boolean;
     signal?: AbortSignal;
 }
+type StagedReviewOptions = Omit<ReviewOptions, "base" | "head">;
 interface ReviewResult {
     schemaVersion: string;
     mode: "review";
+    source?: "commits" | "index";
     baseSha: string;
     headSha: string;
     mergeBaseSha: string;
@@ -142,6 +178,8 @@ interface ReviewResult {
         file: string;
         reason: string;
     }[];
+    suppressedFindings?: SuppressedFinding[];
+    expiredExceptionCount?: number;
     complete: boolean;
     failedRules: string[];
     passed: boolean;
@@ -163,6 +201,7 @@ interface ParsedFileDiff {
     path: string;
     addedLines: ParsedDiffLine[];
     deleted?: boolean;
+    binary?: boolean;
 }
 interface ParsedCommit extends CommitInfo {
     files: ParsedFileDiff[];
@@ -183,6 +222,9 @@ declare class GitError extends Error {
 }
 declare const HERMETIC_GIT_FLAGS: readonly ["-c", "core.quotepath=false", "-c", "core.fsmonitor=false", "-c", "diff.noprefix=false", "-c", "diff.mnemonicPrefix=false", "--no-pager"];
 declare function getHermeticGitEnv(extraEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/** Git path output has one record-terminating LF. Spaces, CR and extra LFs may
+ * belong to the actual pathname and must not be removed with trim(). */
+declare function gitOutputPath(value: string): string;
 declare function parseGitLogStream(stream: Readable, onCommit: (commit: ParsedCommit, stats: {
     skippedLongLines: number;
     skippedUnknownFiles: number;
@@ -240,6 +282,7 @@ declare class MetricsCollector {
     private totalCommits;
     private aiCommits;
     private testSkips;
+    private focusedTests;
     private typeEscapes;
     private swallowedErrors;
     private panicLoops;
@@ -247,6 +290,7 @@ declare class MetricsCollector {
     private stubAbandonments;
     private skippedLongLines;
     private skippedUnknownFiles;
+    private skippedBinaryFiles;
     private activePanicChain;
     private includeAll;
     private ignorePaths?;
@@ -282,13 +326,17 @@ declare function formatGithubStepSummary(result: PrAuditResult): string;
  * Generates rich GitHub PR Comment Markdown (for PR comments / sticky bots)
  */
 declare function formatPrMarkdownComment(result: PrAuditResult): string;
+declare function terminalText(value: string): string;
 /** Current-tree report emphasizes next actions and explicitly accounts for baseline debt. */
 declare function formatCheckTerminal(result: CheckResult): string;
 declare function formatCheckMarkdown(result: CheckResult): string;
 declare function formatReviewTerminal(result: ReviewResult): string;
 declare function formatReviewMarkdown(result: ReviewResult): string;
 
+declare const MAX_CONFIG_BYTES: number;
 interface AgentRoastConfig {
+    /** Reviewed, occurrence-limited allowances that expire on a calendar date. */
+    exceptions?: FindingException[];
     /** Detector rules to fail CI on in PR mode */
     failOn?: string[];
     /** Glob patterns or prefixes to ignore from analysis */
@@ -309,9 +357,6 @@ declare class ConfigError extends Error {
 declare function configFromText(text: string, source: string): AgentRoastConfig;
 /** Invalid policy must stop the audit instead of silently changing CI behavior. */
 declare function loadConfig(cwd?: string): AgentRoastConfig;
-/**
- * Matches a relative or normalized file path against an array of glob ignore patterns.
- */
 declare function matchIgnorePath(filePath: string, ignorePatterns?: string[]): boolean;
 
 interface InitOptions {
@@ -361,6 +406,7 @@ declare function compareFindings(before: Infraction[], after: Infraction[], newP
 };
 /** Compare full source blobs in changed files without executing or checking out the candidate. */
 declare function reviewChanges(options: ReviewOptions): Promise<ReviewResult>;
+declare function reviewStagedChanges(options?: StagedReviewOptions): Promise<ReviewResult>;
 
 /** Offline SARIF 2.1.0, with relative URIs and explicit incomplete-run status.
  * Snippets are omitted to avoid embedding source code in integration artifacts. */
@@ -404,4 +450,4 @@ declare function roastRepository(options?: RoastOptions): Promise<{
 }>;
 declare function auditPullRequest(options: PrAuditOptions): Promise<PrAuditResult>;
 
-export { type AgentRoastConfig, type AiAttributionResult, CONFIG_FILENAMES, type CheckOptions, type CheckResult, type CommitInfo, ConfigError, DEFAULT_CONFIG, DEFAULT_CONFIG_TEMPLATE, type DetectorType, FIELD_SEPARATOR, type FindingBaseline, GITHUB_WORKFLOW_TEMPLATE, GitError, GitResolutionError, HERMETIC_GIT_FLAGS, type Infraction, type InitOptions, type InitResult, InvalidDetectorError, type MetricSummary, MetricsCollector, PRE_COMMIT_HOOK_TEMPLATE, type ParseDiffResult, type ParsedCommit, type ParsedDiffLine, type ParsedFileDiff, type PrAuditOptions, type PrAuditResult, RECORD_SEPARATOR, RULE_GUIDES, type ReviewFormat, type ReviewOptions, type ReviewResult, type RoastOptions, type RuleGuide, type ShieldsEndpointResponse, VALID_DETECTORS, applyBaseline, auditFileDiffs, auditPullRequest, checkProject, compareFindings, configFromText, createBaseline, detectAiAttribution, findMergeBase, findingFingerprint, formatCheckMarkdown, formatCheckTerminal, formatGithubAnnotations, formatGithubStepSummary, formatPrMarkdownComment, formatPrTerminalCard, formatReviewMarkdown, formatReviewTerminal, formatSarif, formatTerminalCard, generateShareUrl, generateShieldsJson, generateShieldsMarkdown, generateSvgBadge, getHermeticGitEnv, getScoreColor, initProject, isCodeFile, isTestFile, loadBaseline, loadConfig, matchIgnorePath, parseDiff, parseGitLogStream, resolveCommitSha, reviewChanges, roastRepository, streamGitDiff, streamGitLog, stripStringAndRegexLiterals, unquoteGitPath, writeBaseline };
+export { type AgentRoastConfig, type AiAttributionResult, CONFIG_FILENAMES, type CheckOptions, type CheckResult, type CommitInfo, ConfigError, DEFAULT_CONFIG, DEFAULT_CONFIG_TEMPLATE, type DetectorType, FIELD_SEPARATOR, type FindingBaseline, type FindingException, GITHUB_WORKFLOW_TEMPLATE, GitError, GitResolutionError, HERMETIC_GIT_FLAGS, type Infraction, type InitOptions, type InitResult, InvalidDetectorError, MAX_CONFIG_BYTES, type MetricSummary, MetricsCollector, PRE_COMMIT_HOOK_TEMPLATE, type ParseDiffResult, type ParsedCommit, type ParsedDiffLine, type ParsedFileDiff, type PrAuditOptions, type PrAuditResult, RECORD_SEPARATOR, RULE_GUIDES, type ReviewFormat, type ReviewOptions, type ReviewResult, type RoastOptions, type RuleGuide, type ShieldsEndpointResponse, type StagedReviewOptions, type SuppressedFinding, VALID_DETECTORS, applyBaseline, applyExceptions, auditFileDiffs, auditPullRequest, checkProject, compareFindings, configFromText, createBaseline, detectAiAttribution, findMergeBase, findingFingerprint, formatCheckMarkdown, formatCheckTerminal, formatGithubAnnotations, formatGithubStepSummary, formatPrMarkdownComment, formatPrTerminalCard, formatReviewMarkdown, formatReviewTerminal, formatSarif, formatTerminalCard, generateShareUrl, generateShieldsJson, generateShieldsMarkdown, generateSvgBadge, getHermeticGitEnv, getScoreColor, gitOutputPath, initProject, isCodeFile, isTestFile, loadBaseline, loadConfig, matchIgnorePath, parseDiff, parseGitLogStream, resolveCommitSha, reviewChanges, reviewStagedChanges, roastRepository, streamGitDiff, streamGitLog, stripStringAndRegexLiterals, terminalText, unquoteGitPath, validateExceptions, writeBaseline };

package/dist/index.js

@@ -10,12 +10,14 @@ import {
   GitResolutionError,
   HERMETIC_GIT_FLAGS,
   InvalidDetectorError,
+  MAX_CONFIG_BYTES,
   MetricsCollector,
   PRE_COMMIT_HOOK_TEMPLATE,
   RECORD_SEPARATOR,
   RULE_GUIDES,
   VALID_DETECTORS,
   applyBaseline,
+  applyExceptions,
   auditFileDiffs,
   auditPullRequest,
   checkProject,
@@ -41,6 +43,7 @@ import {
   generateSvgBadge,
   getHermeticGitEnv,
   getScoreColor,
+  gitOutputPath,
   initProject,
   isCodeFile,
   isTestFile,
@@ -51,13 +54,16 @@ import {
   parseGitLogStream,
   resolveCommitSha,
   reviewChanges,
+  reviewStagedChanges,
   roastRepository,
   streamGitDiff,
   streamGitLog,
   stripStringAndRegexLiterals,
+  terminalText,
   unquoteGitPath,
+  validateExceptions,
   writeBaseline
-} from "./chunk-RU5OYHLR.js";
+} from "./chunk-C423TSZF.js";
 export {
   CONFIG_FILENAMES,
   ConfigError,
@@ -69,12 +75,14 @@ export {
   GitResolutionError,
   HERMETIC_GIT_FLAGS,
   InvalidDetectorError,
+  MAX_CONFIG_BYTES,
   MetricsCollector,
   PRE_COMMIT_HOOK_TEMPLATE,
   RECORD_SEPARATOR,
   RULE_GUIDES,
   VALID_DETECTORS,
   applyBaseline,
+  applyExceptions,
   auditFileDiffs,
   auditPullRequest,
   checkProject,
@@ -100,6 +108,7 @@ export {
   generateSvgBadge,
   getHermeticGitEnv,
   getScoreColor,
+  gitOutputPath,
   initProject,
   isCodeFile,
   isTestFile,
@@ -110,10 +119,13 @@ export {
   parseGitLogStream,
   resolveCommitSha,
   reviewChanges,
+  reviewStagedChanges,
   roastRepository,
   streamGitDiff,
   streamGitLog,
   stripStringAndRegexLiterals,
+  terminalText,
   unquoteGitPath,
+  validateExceptions,
   writeBaseline
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-roast",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Offline code checks for skipped tests, swallowed errors, unfinished stubs and AI coding shortcuts",
   "type": "module",
   "main": "./dist/index.js",
@@ -11,7 +11,8 @@
   "files": [
     "dist",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "schema.json"
   ],
   "scripts": {
     "build": "tsup",
@@ -51,9 +52,13 @@
     "gifenc": "^1.0.3",
     "tsup": "^8.0.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.0.0"
+    "vitest": "^4.1.12"
   },
   "engines": {
     "node": ">=18"
+  },
+  "overrides": {
+    "esbuild": "^0.28.1",
+    "vite": "^7.3.7"
   }
 }