agent-roast 0.7.0 → 0.8.0

package/dist/{chunk-YGHNTWHX.js → chunk-C423TSZF.js}

@@ -1,75 +1,53 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import path6 from "path";
+import path7 from "path";
 
 // src/git.ts
 import { spawn, spawnSync } from "child_process";
+import { randomUUID } from "crypto";
 import { PassThrough } from "stream";
-import { StringDecoder } from "string_decoder";
 
 // src/detector.ts
-var TRAILER_AI_PATTERNS = [
-  { regex: /Co-Authored-By:.*(?:Claude|Anthropic)/i, name: "trailer:claude" },
-  { regex: /Co-Authored-By:.*(?:Cursor|Anysphere)/i, name: "trailer:cursor" },
-  { regex: /Co-Authored-By:.*(?:Copilot|GitHub Copilot)/i, name: "trailer:copilot" },
-  { regex: /Co-Authored-By:.*(?:Aider|aider)/i, name: "trailer:aider" },
-  { regex: /Co-Authored-By:.*(?:Devin|cognition)/i, name: "trailer:devin" },
-  { regex: /Co-Authored-By:.*(?:Windsurf|Codeium)/i, name: "trailer:windsurf" },
-  { regex: /Co-Authored-By:.*(?:ChatGPT|OpenAI|GPT)/i, name: "trailer:gpt" },
-  { regex: /Co-Authored-By:.*(?:Antigravity|Deepmind|Google)/i, name: "trailer:antigravity" },
-  { regex: /Co-Authored-By:.*(?:Codex)/i, name: "trailer:codex" },
-  { regex: /Co-Authored-By:.*(?:Gemini)/i, name: "trailer:gemini" },
-  { regex: /Co-Authored-By:.*(?:OpenClaw|Claw)/i, name: "trailer:openclaw" }
-];
-var MESSAGE_AI_PATTERNS = [
-  { regex: /(?:Generated|Assisted|Created|Written) by Cursor/i, name: "message:cursor" },
-  { regex: /(?:Generated|Assisted|Created|Written) by Claude/i, name: "message:claude" },
-  { regex: /(?:Generated|Assisted|Created|Written) by Aider/i, name: "message:aider" },
-  { regex: /(?:Generated|Assisted|Created|Written) by Copilot/i, name: "message:copilot" },
-  { regex: /(?:Generated|Assisted|Created|Written) by Devin/i, name: "message:devin" },
-  { regex: /(?:Generated|Assisted|Created|Written) by (?:Antigravity|AGY)/i, name: "message:antigravity" },
-  { regex: /(?:Generated|Assisted|Created|Written) by Codex/i, name: "message:codex" },
-  { regex: /(?:Generated|Assisted|Created|Written) by Gemini/i, name: "message:gemini" }
-];
-var AUTHOR_AI_PATTERNS = [
-  { regex: /(?:claude|anthropic)/i, name: "author:claude" },
-  { regex: /(?:cursor|anysphere)/i, name: "author:cursor" },
-  { regex: /(?:copilot)/i, name: "author:copilot" },
-  { regex: /(?:aider)/i, name: "author:aider" },
-  { regex: /(?:devin)/i, name: "author:devin" },
-  { regex: /(?:antigravity|deepmind)/i, name: "author:antigravity" },
-  { regex: /(?:codex)/i, name: "author:codex" },
-  { regex: /(?:gemini)/i, name: "author:gemini" },
-  { regex: /(?:\[bot\]|bot@|automation)/i, name: "author:bot" }
+var AGENT_IDENTITIES = [
+  { name: "claude", label: /^(?:Claude(?: Code| Agent| AI)?|Anthropic Agent)(?:\s*\((?:Anthropic|v?[\d.]+)\))?$/i, email: /^(?:noreply|claude)@anthropic\.com$/i },
+  { name: "cursor", label: /^(?:Cursor(?: Agent| AI)?|Anysphere Agent)$/i, email: /^(?:cursor|noreply)@(?:cursor\.com|cursor\.sh|anysphere\.co)$/i },
+  { name: "copilot", label: /^(?:GitHub )?Copilot(?: Agent| AI|\[bot\])?$/i, email: /^(?:\d+\+)?copilot(?:\[bot\])?@users\.noreply\.github\.com$/i },
+  { name: "aider", label: /^Aider(?:\s*\(v?[\d.]+\))?$/i, email: /^aider@(?:local|aider\.chat)$/i },
+  { name: "devin", label: /^Devin(?: AI| Agent|\[bot\])?$/i, email: /^devin@(?:cognition\.ai|users\.noreply\.github\.com)$/i },
+  { name: "windsurf", label: /^(?:Windsurf|Codeium)(?: Agent| AI)?$/i, email: /^(?:windsurf|codeium)@(?:windsurf\.com|codeium\.com)$/i },
+  { name: "gpt", label: /^(?:ChatGPT|OpenAI Agent|GPT Agent)$/i, email: /^(?:chatgpt|gpt)@openai\.com$/i },
+  { name: "antigravity", label: /^(?:Antigravity(?: Agent| AI)?|DeepMind Agent)$/i, email: /^antigravity@(?:google\.com|deepmind\.com)$/i },
+  { name: "codex", label: /^Codex(?: Agent| AI)?$/i, email: /^codex@openai\.com$/i },
+  { name: "gemini", label: /^Gemini(?: CLI| Agent| AI)?$/i, email: /^gemini@google\.com$/i },
+  { name: "openclaw", label: /^OpenClaw(?: Agent| AI)?$/i, email: /^openclaw@(?:local|openclaw\.ai)$/i }
 ];
+function identitySignals(name, email) {
+  return AGENT_IDENTITIES.filter((agent) => agent.label.test(name.trim()) || agent.email.test(email.trim())).map((agent) => agent.name);
+}
 function detectAiAttribution(authorName, authorEmail, message) {
-  const signatures = [];
-  for (const { regex, name } of TRAILER_AI_PATTERNS) {
-    if (regex.test(message)) {
-      signatures.push(name);
-    }
-  }
-  for (const { regex, name } of MESSAGE_AI_PATTERNS) {
-    if (regex.test(message)) {
-      signatures.push(name);
-    }
-  }
-  const authorIdentity = `${authorName} <${authorEmail}>`;
-  for (const { regex, name } of AUTHOR_AI_PATTERNS) {
-    if (regex.test(authorIdentity)) {
-      signatures.push(name);
-    }
-  }
-  return {
-    isAiAttributed: signatures.length > 0,
-    signatures
-  };
+  const signatures = /* @__PURE__ */ new Set();
+  const lines = message.trimEnd().split(/\r?\n/);
+  let trailerStart = lines.length;
+  while (trailerStart > 0 && /^[A-Za-z][A-Za-z-]*:\s*.+$/.test(lines[trailerStart - 1])) trailerStart--;
+  for (const line of lines.slice(trailerStart)) {
+    const trailer = /^Co-Authored-By:\s*(.+?)\s*<([^<>]+)>\s*$/i.exec(line);
+    if (!trailer) continue;
+    for (const name of identitySignals(trailer[1], trailer[2])) signatures.add(`trailer:${name}`);
+  }
+  for (const line of lines) {
+    const attribution = /^\s*(?:Generated|Assisted|Created|Written) by (.+?)\.?\s*$/i.exec(line);
+    if (!attribution) continue;
+    for (const name of identitySignals(attribution[1], "")) signatures.add(`message:${name}`);
+  }
+  for (const name of identitySignals(authorName, authorEmail)) signatures.add(`author:${name}`);
+  return { isAiAttributed: signatures.size > 0, signatures: [...signatures] };
 }
 
 // src/git.ts
 var RECORD_SEPARATOR = "__ROAST_REC__";
 var FIELD_SEPARATOR = "__ROAST_FIELD__";
+var LOG_FRAMING = /* @__PURE__ */ Symbol("agent-roast Git log framing");
 var GitError = class extends Error {
   constructor(stderr, code) {
     super(`git exited with code ${code}: ${stderr.trim() || "unknown error"}`);
@@ -92,33 +70,46 @@ var HERMETIC_GIT_FLAGS = [
   "--no-pager"
 ];
 function getHermeticGitEnv(extraEnv) {
+  const inherited = { ...process.env };
+  for (const key of ["GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR", "GIT_NAMESPACE", "GIT_INDEX_FILE", "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES", "GIT_DIFF_OPTS"]) delete inherited[key];
   return {
-    ...process.env,
+    ...inherited,
     ...extraEnv,
     GIT_PAGER: "cat",
     GIT_CONFIG_NOSYSTEM: "1",
-    GIT_CONFIG_GLOBAL: extraEnv?.GIT_CONFIG_GLOBAL || process.env.GIT_CONFIG_GLOBAL || "/dev/null"
+    GIT_CONFIG_GLOBAL: extraEnv?.GIT_CONFIG_GLOBAL || process.env.GIT_CONFIG_GLOBAL || "/dev/null",
+    GIT_NO_REPLACE_OBJECTS: "1",
+    GIT_NO_LAZY_FETCH: "1",
+    GIT_TERMINAL_PROMPT: "0"
   };
 }
+function gitOutputPath(value) {
+  return value.endsWith("\n") ? value.slice(0, -1) : value;
+}
 var MAX_RECORD_BUFFER_SIZE = 50 * 1024 * 1024;
 async function parseGitLogStream(stream, onCommit) {
   let buffer = "";
+  let bufferedBytes = 0;
   let totalSkippedLongLines = 0;
   let totalSkippedUnknownFiles = 0;
   let scanFrom = 0;
-  let activeRecSep = null;
-  let activeFieldSep = null;
+  const framing = stream[LOG_FRAMING];
+  let activeRecSep = framing?.record ?? null;
+  let activeFieldSep = framing?.field ?? null;
   const processBlock = (block) => {
     if (!block.trim()) return;
     const fieldSep = activeFieldSep || (block.includes(FIELD_SEPARATOR) ? FIELD_SEPARATOR : "");
     const parts = block.split(fieldSep);
-    if (parts.length < 5) return;
+    if (parts.length !== 6) throw new GitError("Malformed or ambiguous Git log record; no complete history result was produced.", 2);
     const hash = parts[0].trim();
     const date = parts[1].trim();
     const authorName = parts[2].trim();
     const authorEmail = parts[3].trim();
     const message = parts[4].trim();
     const rawDiff = parts.slice(5).join(fieldSep);
+    if (framing && (!/^[a-f0-9]{40,64}$/.test(hash) || !Number.isFinite(Date.parse(date)))) {
+      throw new GitError("Invalid Git log header; no complete history result was produced.", 2);
+    }
     const attribution = detectAiAttribution(authorName, authorEmail, message);
     const { files, totalAdded, skippedLongLines, skippedUnknownFiles } = parseDiff(rawDiff);
     totalSkippedLongLines += skippedLongLines;
@@ -152,12 +143,21 @@ async function parseGitLogStream(stream, onCommit) {
         reject(err);
       }
     };
-    const decoder = new StringDecoder("utf8");
+    const decoder = new TextDecoder("utf-8", { fatal: true });
     stream.on("data", (chunk) => {
-      const chunkStr = typeof chunk === "string" ? chunk : decoder.write(chunk);
+      let chunkStr;
+      try {
+        chunkStr = typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
+      } catch {
+        const error = new GitError("Git history contains invalid UTF-8; no complete result was produced.", 2);
+        stream.destroy(error);
+        safeReject(error);
+        return;
+      }
       buffer += chunkStr;
-      if (buffer.length > MAX_RECORD_BUFFER_SIZE) {
-        const oomErr = new Error(`Git log record exceeded maximum buffer limit (${MAX_RECORD_BUFFER_SIZE} bytes).`);
+      bufferedBytes += Buffer.byteLength(chunkStr, "utf8");
+      if (bufferedBytes > MAX_RECORD_BUFFER_SIZE) {
+        const oomErr = new GitError(`Git log record exceeded maximum buffer limit (${MAX_RECORD_BUFFER_SIZE} bytes).`, 2);
         stream.destroy(oomErr);
         safeReject(oomErr);
         return;
@@ -185,6 +185,7 @@ async function parseGitLogStream(stream, onCommit) {
       while ((idx = buffer.indexOf(recSep, scanFrom)) !== -1) {
         const completeBlock = buffer.slice(0, idx);
         buffer = buffer.slice(idx + recSep.length);
+        bufferedBytes -= Buffer.byteLength(completeBlock, "utf8") + Buffer.byteLength(recSep, "utf8");
         scanFrom = 0;
         try {
           processBlock(completeBlock);
@@ -195,17 +196,17 @@ async function parseGitLogStream(stream, onCommit) {
           return;
         }
       }
-      scanFrom = buffer.length;
+      scanFrom = Math.max(0, buffer.length - recSep.length + 1);
     });
     stream.on("end", () => {
-      buffer += decoder.end();
-      if (buffer.trim()) {
-        try {
+      try {
+        buffer += decoder.decode();
+        if (buffer.trim()) {
           processBlock(buffer);
-        } catch (err) {
-          safeReject(err);
-          return;
         }
+      } catch (err) {
+        safeReject(err);
+        return;
       }
       safeResolve({ totalSkippedLongLines, totalSkippedUnknownFiles });
     });
@@ -302,6 +303,7 @@ function parseDiff(rawDiff) {
         continue;
       }
       if (char === "+") {
+        if (newLeft <= 0) throw new GitError("Malformed diff hunk adds more lines than declared.", 2);
         if (currentFile && !currentFile.deleted && currentFile.path !== "unknown") {
           const content = line.slice(1);
           if (content.length <= MAX_LINE_LENGTH) {
@@ -319,23 +321,25 @@ function parseDiff(rawDiff) {
         continue;
       }
       if (char === "-") {
+        if (oldLeft <= 0) throw new GitError("Malformed diff hunk removes more lines than declared.", 2);
         oldLeft--;
         continue;
       }
       if (char === " ") {
+        if (oldLeft <= 0 || newLeft <= 0) throw new GitError("Malformed diff hunk has invalid context counts.", 2);
         oldLeft--;
         newLeft--;
         lineNo++;
         continue;
       }
-      oldLeft = 0;
-      newLeft = 0;
+      throw new GitError("Truncated or malformed diff hunk; no complete audit result was produced.", 2);
     }
     const hunkMatch = HUNK_REGEX.exec(line);
     if (hunkMatch) {
       oldLeft = hunkMatch[1] === void 0 ? 1 : parseInt(hunkMatch[1], 10);
       lineNo = parseInt(hunkMatch[2], 10);
       newLeft = hunkMatch[3] === void 0 ? 1 : parseInt(hunkMatch[3], 10);
+      if (![oldLeft, newLeft, lineNo].every(Number.isSafeInteger)) throw new GitError("Invalid diff hunk line counts.", 2);
       continue;
     }
     if (line.startsWith("diff --git ")) {
@@ -353,6 +357,10 @@ function parseDiff(rawDiff) {
       files.push(currentFile);
       continue;
     }
+    if (currentFile && (line.startsWith("Binary files ") || line === "GIT binary patch")) {
+      currentFile.binary = true;
+      continue;
+    }
     if (line.startsWith("+++ /dev/null")) {
       if (currentFile) {
         currentFile.deleted = true;
@@ -371,6 +379,7 @@ function parseDiff(rawDiff) {
       continue;
     }
   }
+  if (oldLeft > 0 || newLeft > 0) throw new GitError("Truncated diff hunk; no complete audit result was produced.", 2);
   let skippedUnknownFiles = 0;
   for (const file of files) {
     if (file.path === "unknown" && !file.deleted) {
@@ -381,17 +390,69 @@ function parseDiff(rawDiff) {
 }
 var COMMON_EXCLUDE_SPECS = [
   "--",
-  ".",
-  ":(exclude,glob)**/*.lock",
-  ":(exclude,glob)**/*-lock.json",
-  ":(exclude,glob)**/*.lockb",
-  ":(exclude,glob)**/dist/**",
-  ":(exclude,glob)**/build/**",
-  ":(exclude,glob)**/node_modules/**",
-  ":(exclude,glob)**/*.min.js",
-  ":(exclude,glob)**/*.map"
+  ":(top,glob)**",
+  ":(top,exclude,glob)**/*.lock",
+  ":(top,exclude,glob)**/*-lock.json",
+  ":(top,exclude,glob)**/*.lockb",
+  ":(top,exclude,glob)**/dist/**",
+  ":(top,exclude,glob)**/build/**",
+  ":(top,exclude,glob)**/node_modules/**",
+  ":(top,exclude,glob)**/*.min.js",
+  ":(top,exclude,glob)**/*.map"
 ];
+function requireLocalObjects(cwd) {
+  const result = spawnSync("git", [...HERMETIC_GIT_FLAGS, "config", "--type=bool", "--get-regexp", "^remote\\..*\\.promisor$"], {
+    cwd,
+    env: getHermeticGitEnv(),
+    encoding: "utf8",
+    timeout: 3e4,
+    maxBuffer: 64 * 1024,
+    windowsHide: true
+  });
+  if (result.error) throw new GitError(result.error.message, result.status);
+  if (result.status !== 0 && result.status !== 1) throw new GitError(result.stderr, result.status);
+  if (result.stdout.split("\n").some((line) => /\s+(?:true|yes|on|1)\s*$/i.test(line))) {
+    throw new GitError("Offline audits require a non-partial clone with local objects; promisor remotes are unsupported.", 2);
+  }
+}
+function streamGit(cwd, gitArgs) {
+  const output = new PassThrough();
+  try {
+    requireLocalObjects(cwd);
+  } catch (error) {
+    queueMicrotask(() => output.destroy(error instanceof Error ? error : new Error(String(error))));
+    return output;
+  }
+  const child = spawn("git", gitArgs, {
+    cwd,
+    env: getHermeticGitEnv(),
+    stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true
+  });
+  let stderr = "";
+  const timer = setTimeout(() => output.destroy(new GitError("Git audit timed out after 30 seconds; no complete result was produced.", 2)), 3e4);
+  child.stderr.on("data", (chunk) => {
+    if (stderr.length < 64 * 1024) stderr += chunk.toString().slice(0, 64 * 1024 - stderr.length);
+  });
+  child.stdout.pipe(output, { end: false });
+  output.on("close", () => {
+    clearTimeout(timer);
+    if (child.exitCode === null) child.kill();
+  });
+  child.stdout.on("error", (error) => output.destroy(error));
+  child.on("error", (error) => output.destroy(error));
+  child.on("close", (code) => {
+    clearTimeout(timer);
+    if (output.destroyed) return;
+    if (code !== 0) output.destroy(new GitError(stderr, code));
+    else output.end();
+  });
+  return output;
+}
 function streamGitLog(cwd = process.cwd(), since = "90 days ago") {
+  const nonce = randomUUID();
+  const record = `__ROAST_REC_${nonce}__`;
+  const field = `__ROAST_FIELD_${nonce}__`;
   const gitArgs = [
     ...HERMETIC_GIT_FLAGS,
     "log",
@@ -402,37 +463,16 @@ function streamGitLog(cwd = process.cwd(), since = "90 days ago") {
     "--no-show-signature",
     "--no-ext-diff",
     "--no-textconv",
+    "--no-relative",
     "--encoding=UTF-8",
     "--src-prefix=a/",
     "--dst-prefix=b/",
     `--since=${since}`,
-    `--format=${RECORD_SEPARATOR}%H${FIELD_SEPARATOR}%aI${FIELD_SEPARATOR}%an${FIELD_SEPARATOR}%ae${FIELD_SEPARATOR}%B${FIELD_SEPARATOR}`,
+    `--format=${record}%H${field}%aI${field}%an${field}%ae${field}%B${field}`,
     ...COMMON_EXCLUDE_SPECS
   ];
-  const output = new PassThrough();
-  const child = spawn("git", gitArgs, {
-    cwd,
-    env: getHermeticGitEnv(),
-    stdio: ["ignore", "pipe", "pipe"],
-    windowsHide: true
-  });
-  child.stdout.on("data", (chunk) => {
-    output.write(chunk);
-  });
-  let stderrBuffer = "";
-  child.stderr.on("data", (chunk) => {
-    stderrBuffer += chunk.toString();
-  });
-  child.on("close", (code) => {
-    if (code !== 0) {
-      output.destroy(new GitError(stderrBuffer, code));
-    } else {
-      output.end();
-    }
-  });
-  child.on("error", (err) => {
-    output.destroy(err);
-  });
+  const output = streamGit(cwd, gitArgs);
+  output[LOG_FRAMING] = { record, field };
   return output;
 }
 function streamGitDiff(cwd, baseSha, headSha, staged = false) {
@@ -443,6 +483,7 @@ function streamGitDiff(cwd, baseSha, headSha, staged = false) {
     "--no-color",
     "--no-ext-diff",
     "--no-textconv",
+    "--no-relative",
     "--src-prefix=a/",
     "--dst-prefix=b/",
     ...staged ? ["--cached"] : [],
@@ -450,33 +491,10 @@ function streamGitDiff(cwd, baseSha, headSha, staged = false) {
     ...staged ? [] : [baseSha, headSha],
     ...COMMON_EXCLUDE_SPECS
   ];
-  const output = new PassThrough();
-  const child = spawn("git", gitArgs, {
-    cwd,
-    env: getHermeticGitEnv(),
-    stdio: ["ignore", "pipe", "pipe"],
-    windowsHide: true
-  });
-  child.stdout.on("data", (chunk) => {
-    output.write(chunk);
-  });
-  let stderrBuffer = "";
-  child.stderr.on("data", (chunk) => {
-    stderrBuffer += chunk.toString();
-  });
-  child.on("close", (code) => {
-    if (code !== 0) {
-      output.destroy(new GitError(stderrBuffer, code));
-    } else {
-      output.end();
-    }
-  });
-  child.on("error", (err) => {
-    output.destroy(err);
-  });
-  return output;
+  return streamGit(cwd, gitArgs);
 }
 function resolveCommitSha(cwd, ref, roleName = "ref") {
+  requireLocalObjects(cwd);
   const result = spawnSync(
     "git",
     [...HERMETIC_GIT_FLAGS, "rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`],
@@ -484,6 +502,8 @@ function resolveCommitSha(cwd, ref, roleName = "ref") {
       cwd,
       env: getHermeticGitEnv(),
       encoding: "utf8",
+      timeout: 3e4,
+      maxBuffer: 64 * 1024,
       windowsHide: true
     }
   );
@@ -508,6 +528,8 @@ function findMergeBase(cwd, baseSha, headSha) {
       cwd,
       env: getHermeticGitEnv(),
       encoding: "utf8",
+      timeout: 3e4,
+      maxBuffer: 64 * 1024,
       windowsHide: true
     }
   );
@@ -530,6 +552,8 @@ function checkIfShallow(cwd) {
       cwd,
       env: getHermeticGitEnv(),
       encoding: "utf8",
+      timeout: 3e4,
+      maxBuffer: 64 * 1024,
       windowsHide: true
     });
     return res.stdout.trim() === "true";
@@ -546,41 +570,79 @@ var GitResolutionError = class extends Error {
 
 // src/source.ts
 var SourceMasker = class {
-  blockComment = false;
+  blockDepth = 0;
   quote = "";
+  rawEnd = "";
   triple = false;
+  verbatim = false;
   previousLine = 0;
   python;
   javascript;
+  rust;
   hashComments;
   backticks;
+  textBlocks;
+  csharp;
+  cpp;
   constructor(filename) {
-    this.python = filename.endsWith(".py");
-    this.hashComments = this.python || filename.endsWith(".rb");
-    this.backticks = /\.(?:go|[cm]?[jt]sx?|vue|svelte)$/.test(filename);
-    this.javascript = /\.(?:[cm]?[jt]sx?|vue|svelte)$/.test(filename);
+    const name = filename.toLowerCase();
+    this.python = name.endsWith(".py");
+    this.rust = name.endsWith(".rs");
+    this.hashComments = this.python || /\.(?:rb|php)$/.test(name);
+    this.backticks = /\.(?:go|[cm]?[jt]sx?|vue|svelte)$/.test(name);
+    this.javascript = /\.(?:[cm]?[jt]sx?|vue|svelte)$/.test(name);
+    this.textBlocks = /\.(?:java|kt|cs)$/.test(name);
+    this.csharp = name.endsWith(".cs");
+    this.cpp = /\.(?:cpp|c)$/.test(name);
   }
   mask(line, number) {
     if (number !== this.previousLine + 1) {
-      this.blockComment = false;
+      this.blockDepth = 0;
       this.quote = "";
+      this.rawEnd = "";
       this.triple = false;
+      this.verbatim = false;
     }
     this.previousLine = number;
     const code = Array(line.length).fill(" ");
     const comments = Array(line.length).fill(" ");
     let i = 0;
     let prefix = "";
+    const appendPrefix = (text) => {
+      for (const char of text) {
+        if (/\s/.test(char)) {
+          if (!prefix.endsWith(" ")) prefix = (prefix + " ").slice(-64);
+        } else prefix = (prefix + char).slice(-64);
+      }
+    };
+    let continued = false;
+    const templateStarts = [];
+    const blockStarts = [];
     while (i < line.length) {
-      if (this.blockComment) {
-        if (line.startsWith("*/", i)) {
-          this.blockComment = false;
+      if (this.blockDepth) {
+        if (this.rust && line.startsWith("/*", i)) {
+          this.blockDepth++;
+          i += 2;
+        } else if (line.startsWith("*/", i)) {
+          this.blockDepth--;
           i += 2;
         } else i++;
         continue;
       }
+      if (this.rawEnd) {
+        if (line.startsWith(this.rawEnd, i)) {
+          i += this.rawEnd.length;
+          this.rawEnd = "";
+        } else i++;
+        continue;
+      }
       if (this.quote) {
-        if (line[i] === "\\") {
+        if (this.verbatim && line.startsWith('""', i)) {
+          i += 2;
+          continue;
+        }
+        if (!this.verbatim && !(this.quote === "`" && !this.javascript) && line[i] === "\\") {
+          if (i === line.length - 1) continued = true;
           i += 2;
           continue;
         }
@@ -589,6 +651,7 @@ var SourceMasker = class {
           i += delimiter.length;
           this.quote = "";
           this.triple = false;
+          this.verbatim = false;
         } else i++;
         continue;
       }
@@ -597,16 +660,50 @@ var SourceMasker = class {
         break;
       }
       if (!this.python && line.startsWith("/*", i)) {
-        this.blockComment = true;
+        blockStarts.push(i);
+        this.blockDepth = 1;
+        i += 2;
+        continue;
+      }
+      if (this.rust && (i === 0 || !/[\w]/.test(line[i - 1]))) {
+        const raw = /^(?:br|cr|r)(#{0,255})"/.exec(line.slice(i));
+        if (raw) {
+          this.rawEnd = '"' + raw[1];
+          i += raw[0].length;
+          appendPrefix(" literal ");
+          continue;
+        }
+      }
+      if (this.cpp && (i === 0 || !/[\w]/.test(line[i - 1]))) {
+        const raw = /^(?:u8|u|U|L)?R"([^\s()\\]{0,16})\(/.exec(line.slice(i));
+        if (raw) {
+          this.rawEnd = ")" + raw[1] + '"';
+          i += raw[0].length;
+          appendPrefix(" literal ");
+          continue;
+        }
+      }
+      if (this.csharp && line.startsWith('@"', i)) {
+        this.quote = '"';
+        this.verbatim = true;
         i += 2;
+        appendPrefix(" literal ");
         continue;
       }
       const char = line[i];
+      const lifetime = this.rust && char === "'" && /^'[A-Za-z_][A-Za-z0-9_]*(?![A-Za-z0-9_])/.exec(line.slice(i));
+      if (lifetime && line[i + lifetime[0].length] !== "'") {
+        for (let j = 0; j < lifetime[0].length; j++) code[i + j] = line[i + j];
+        appendPrefix(lifetime[0]);
+        i += lifetime[0].length;
+        continue;
+      }
       if (char === '"' || char === "'" || this.backticks && char === "`") {
         this.quote = char;
-        this.triple = this.python && line.startsWith(char.repeat(3), i);
+        if (this.javascript && char === "`") templateStarts.push(i);
+        this.triple = (this.python || this.textBlocks && char === '"') && line.startsWith(char.repeat(3), i);
         i += this.triple ? 3 : 1;
-        prefix += " literal ";
+        appendPrefix(" literal ");
         continue;
       }
       if (this.javascript && char === "/" && (/(?:[=(:,[!&|?{;]|\breturn|\byield)\s*$/.test(prefix) || !prefix.trim())) {
@@ -623,18 +720,18 @@ var SourceMasker = class {
         }
         if (j < line.length) {
           j++;
-          while (/[a-z]/i.test(line[j] || "") && j < line.length) j++;
+          while (j < line.length && /[a-z]/i.test(line[j])) j++;
           i = j;
-          prefix += " literal ";
+          appendPrefix(" literal ");
           continue;
         }
       }
       code[i] = char;
-      prefix += char;
+      appendPrefix(char);
       i++;
     }
-    if (this.quote !== "`" && !this.triple) this.quote = "";
-    return { code: code.join(""), comments: comments.join("") };
+    if (this.quote !== "`" && !this.triple && !this.verbatim && !continued) this.quote = "";
+    return { code: code.join(""), comments: comments.join(""), templateStarts, blockStarts };
   }
 };
 
@@ -685,8 +782,8 @@ var RULE_GUIDES = {
 };
 
 // src/config.ts
-import * as fs from "fs";
-import * as path from "path";
+import * as fs3 from "fs";
+import * as path2 from "path";
 
 // src/types.ts
 var VALID_DETECTORS = [
@@ -699,7 +796,146 @@ var VALID_DETECTORS = [
   "test-focus"
 ];
 
+// src/file-read.ts
+import * as fs from "fs";
+function readRegularFile(filename, limit) {
+  const stat = fs.lstatSync(filename);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > limit) throw new Error(`Expected a regular file no larger than ${limit} bytes.`);
+  const fd = fs.openSync(filename, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0) | (fs.constants.O_NONBLOCK || 0));
+  try {
+    const opened = fs.fstatSync(fd);
+    if (!opened.isFile() || opened.ino !== stat.ino || opened.dev !== stat.dev) throw new Error("File changed while opening.");
+    const buffer = Buffer.alloc(limit + 1);
+    let size = 0;
+    while (size < buffer.length) {
+      const read = fs.readSync(fd, buffer, size, buffer.length - size, null);
+      if (!read) break;
+      size += read;
+    }
+    const after = fs.fstatSync(fd);
+    if (size > limit || size !== after.size || opened.size !== after.size || opened.mtimeMs !== after.mtimeMs || opened.ctimeMs !== after.ctimeMs) {
+      throw new Error("File changed or exceeded the read limit.");
+    }
+    return buffer.subarray(0, size);
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+// src/baseline.ts
+import { createHash, randomUUID as randomUUID2 } from "crypto";
+import * as fs2 from "fs";
+import path from "path";
+function findingFingerprint(finding) {
+  return createHash("sha256").update(JSON.stringify([finding.type, finding.file, finding.lineSnippet?.trim()])).digest("hex");
+}
+function createBaseline(findings) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const finding of findings) {
+    const fingerprint = findingFingerprint(finding);
+    counts.set(fingerprint, (counts.get(fingerprint) || 0) + 1);
+  }
+  return {
+    schemaVersion: "1.0.0",
+    fingerprintVersion: 1,
+    entries: [...counts].sort(([a], [b]) => a.localeCompare(b)).map(([fingerprint, count]) => ({ fingerprint, count }))
+  };
+}
+function loadBaseline(filename) {
+  try {
+    const content = new TextDecoder("utf-8", { fatal: true }).decode(readRegularFile(filename, 5 * 1024 * 1024));
+    const parsed = JSON.parse(content);
+    if (!parsed || parsed.schemaVersion !== "1.0.0" || parsed.fingerprintVersion !== 1 || !Array.isArray(parsed.entries) || parsed.entries.length > 1e5) {
+      throw new Error("Unsupported baseline schema.");
+    }
+    const seen = /* @__PURE__ */ new Set();
+    for (const entry of parsed.entries) {
+      if (!entry || typeof entry.fingerprint !== "string" || !/^[a-f0-9]{64}$/.test(entry.fingerprint) || !Number.isSafeInteger(entry.count) || entry.count <= 0 || entry.count > 1e6 || seen.has(entry.fingerprint)) {
+        throw new Error("Invalid or duplicate baseline entry.");
+      }
+      seen.add(entry.fingerprint);
+    }
+    return parsed;
+  } catch (error) {
+    throw new ConfigError(`Cannot load baseline '${filename}': ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function applyBaseline(findings, baseline) {
+  const remaining = new Map(baseline.entries.map((entry) => [entry.fingerprint, entry.count]));
+  const fresh = [];
+  let baselineCount = 0;
+  for (const finding of findings) {
+    const fingerprint = findingFingerprint(finding);
+    const count = remaining.get(fingerprint) || 0;
+    if (count > 0) {
+      remaining.set(fingerprint, count - 1);
+      baselineCount++;
+    } else {
+      fresh.push(finding);
+    }
+  }
+  return { findings: fresh, baselineCount, staleBaselineCount: [...remaining.values()].reduce((a, b) => a + b, 0) };
+}
+function writeBaseline(filename, findings) {
+  const destination = path.resolve(filename);
+  const temporary = path.join(path.dirname(destination), `.agent-roast-${randomUUID2()}.tmp`);
+  let fd;
+  try {
+    const baseline = createBaseline(findings);
+    const serialized = JSON.stringify(baseline, null, 2) + "\n";
+    if (Buffer.byteLength(serialized, "utf8") > 5 * 1024 * 1024 || baseline.entries.length > 1e5 || baseline.entries.some((entry) => entry.count > 1e6)) {
+      throw new Error("Baseline exceeds the supported read limits; narrow the adopted scope.");
+    }
+    fd = fs2.openSync(temporary, "wx", 384);
+    fs2.writeFileSync(fd, serialized);
+    fs2.fsyncSync(fd);
+    fs2.closeSync(fd);
+    fd = void 0;
+    fs2.linkSync(temporary, destination);
+  } catch (error) {
+    throw new ConfigError(`Cannot write baseline '${filename}' (existing files are preserved): ${error instanceof Error ? error.message : String(error)}`);
+  } finally {
+    if (fd !== void 0) fs2.closeSync(fd);
+    fs2.rmSync(temporary, { force: true });
+  }
+}
+
+// src/exceptions.ts
+function validateExceptions(value) {
+  if (value === void 0) return;
+  if (!Array.isArray(value) || value.length > 1e3) throw new ConfigError("exceptions must be an array with at most 1000 entries.");
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of value) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry) || Object.keys(entry).some((key) => !["fingerprint", "count", "reason", "expires"].includes(key)) || typeof entry.fingerprint !== "string" || !/^[a-f0-9]{64}$/.test(entry.fingerprint) || seen.has(entry.fingerprint) || !Number.isSafeInteger(entry.count) || entry.count < 1 || entry.count > 1e5 || typeof entry.reason !== "string" || !entry.reason.trim() || entry.reason.length > 1e3 || /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/u.test(entry.reason) || typeof entry.expires !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(entry.expires) || !Number.isFinite(Date.parse(entry.expires)) || new Date(entry.expires).toISOString().slice(0, 10) !== entry.expires) {
+      throw new ConfigError("Each exception needs a unique SHA-256 fingerprint, positive count, non-empty single-line reason and real expires date (YYYY-MM-DD).");
+    }
+    seen.add(entry.fingerprint);
+  }
+}
+function applyExceptions(findings, exceptions = [], now = /* @__PURE__ */ new Date(), priorOccurrences = /* @__PURE__ */ new Map()) {
+  validateExceptions(exceptions);
+  if (!Number.isFinite(now.getTime())) throw new ConfigError("Invalid exception evaluation time.");
+  const today = now.toISOString().slice(0, 10);
+  const active = new Map(exceptions.filter((entry) => entry.expires >= today).map((entry) => [entry.fingerprint, { ...entry, remaining: Math.max(0, entry.count - (priorOccurrences.get(entry.fingerprint) ?? 0)) }]));
+  const occurrences = new Map(priorOccurrences);
+  const actionable = [];
+  const suppressedFindings = [];
+  for (const finding of findings) {
+    const fingerprint = findingFingerprint(finding);
+    const occurrence = (occurrences.get(fingerprint) ?? 0) + 1;
+    occurrences.set(fingerprint, occurrence);
+    const enriched = { ...finding, fingerprint, occurrence };
+    const allowance = active.get(fingerprint);
+    if (allowance && allowance.remaining > 0) {
+      allowance.remaining--;
+      suppressedFindings.push({ ...enriched, suppression: { reason: allowance.reason, expires: allowance.expires } });
+    } else actionable.push(enriched);
+  }
+  return { findings: actionable, suppressedFindings, expiredExceptionCount: exceptions.filter((entry) => entry.expires < today).length };
+}
+
 // src/config.ts
+var MAX_CONFIG_BYTES = 64 * 1024;
 var DEFAULT_CONFIG = {
   failOn: ["test-skip", "trivial-assert", "test-focus"],
   ignorePaths: [
@@ -738,12 +974,16 @@ function validateConfig(value) {
     throw new ConfigError("Configuration must be a JSON object.");
   }
   const config = value;
+  const supported = /* @__PURE__ */ new Set(["$schema", "failOn", "ignorePaths", "scoreThreshold", "rules", "panicLoopWindowMinutes", "exceptions"]);
+  for (const key of Object.keys(config)) if (!supported.has(key)) throw new ConfigError(`Unknown configuration setting '${key}'.`);
+  if (config.$schema !== void 0 && typeof config.$schema !== "string") throw new ConfigError("$schema must be a string.");
+  validateExceptions(config.exceptions);
   const knownRules = new Set(VALID_DETECTORS);
   if (config.failOn !== void 0 && (!Array.isArray(config.failOn) || config.failOn.some((rule) => typeof rule !== "string" || !knownRules.has(rule)))) {
     throw new ConfigError(`failOn must contain known rules: ${VALID_DETECTORS.join(", ")}`);
   }
-  if (config.ignorePaths !== void 0 && (!Array.isArray(config.ignorePaths) || config.ignorePaths.some((pattern) => typeof pattern !== "string"))) {
-    throw new ConfigError("ignorePaths must be an array of strings.");
+  if (config.ignorePaths !== void 0 && (!Array.isArray(config.ignorePaths) || config.ignorePaths.length > 1e3 || config.ignorePaths.some((pattern) => typeof pattern !== "string" || pattern.length > 1024))) {
+    throw new ConfigError("ignorePaths must contain at most 1000 strings, each no longer than 1024 characters.");
   }
   if (config.scoreThreshold !== void 0 && (typeof config.scoreThreshold !== "number" || !Number.isFinite(config.scoreThreshold) || config.scoreThreshold < 0 || config.scoreThreshold > 100)) {
     throw new ConfigError("scoreThreshold must be a number between 0 and 100.");
@@ -756,7 +996,7 @@ function validateConfig(value) {
       throw new ConfigError("rules must be an object.");
     }
     for (const [rule, level] of Object.entries(config.rules)) {
-      if (!knownRules.has(rule) || !["error", "warn", "off"].includes(String(level))) {
+      if (!knownRules.has(rule) || typeof level !== "string" || !["error", "warn", "off"].includes(level)) {
         throw new ConfigError(`Invalid rule '${rule}' or level '${level}'. Use known rules with error, warn, or off.`);
       }
     }
@@ -764,6 +1004,7 @@ function validateConfig(value) {
 }
 function configFromText(text, source) {
   try {
+    if (Buffer.byteLength(text, "utf8") > MAX_CONFIG_BYTES) throw new ConfigError("Configuration exceeds the 64 KiB limit.");
     const parsed = JSON.parse(text);
     validateConfig(parsed);
     const rules = { ...DEFAULT_CONFIG.rules, ...parsed.rules };
@@ -781,10 +1022,16 @@ function configFromText(text, source) {
 }
 function loadConfig(cwd = process.cwd()) {
   for (const filename of CONFIG_FILENAMES) {
-    const filePath = path.join(cwd, filename);
-    if (fs.existsSync(filePath)) {
+    const filePath = path2.join(cwd, filename);
+    try {
+      fs3.lstatSync(filePath);
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      throw new ConfigError(`Cannot inspect ${filename}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    {
       try {
-        return configFromText(fs.readFileSync(filePath, "utf8"), filename);
+        return configFromText(new TextDecoder("utf-8", { fatal: true }).decode(readRegularFile(filePath, MAX_CONFIG_BYTES)), filename);
       } catch (error) {
         if (error instanceof ConfigError) throw error;
         throw new ConfigError(`Cannot read ${filename}: ${error instanceof Error ? error.message : String(error)}`);
@@ -793,93 +1040,114 @@ function loadConfig(cwd = process.cwd()) {
   }
   return configFromText("{}", "default configuration");
 }
-function matchIgnorePath(filePath, ignorePatterns) {
-  if (!ignorePatterns || ignorePatterns.length === 0) {
-    return false;
-  }
-  const normalized = filePath.replace(/\\/g, "/");
-  for (const pattern of ignorePatterns) {
-    if (!pattern) continue;
-    const cleanPattern = pattern.replace(/\\/g, "/");
-    let regexPattern = "";
-    for (let i = 0; i < cleanPattern.length; i++) {
-      const char = cleanPattern[i];
-      if (char === "*" && cleanPattern[i + 1] === "*") {
+function matchesGlob(filename, pattern) {
+  const tokens = [];
+  for (let i = 0; i < pattern.length; i++) {
+    if (pattern[i] === "*" && pattern[i + 1] === "*") {
+      i++;
+      if (pattern[i + 1] === "/") {
+        tokens.push({ kind: "directoryStart" }, { kind: "directoryBody" });
         i++;
-        if (cleanPattern[i + 1] === "/") {
-          regexPattern += "(?:.*/)?";
-          i++;
-        } else {
-          regexPattern += ".*";
+      } else tokens.push({ kind: "globstar" });
+    } else if (pattern[i] === "*") tokens.push({ kind: "star" });
+    else if (pattern[i] === "?") tokens.push({ kind: "question" });
+    else tokens.push({ kind: "literal", value: pattern[i].toLowerCase() });
+  }
+  const closure = (states2) => {
+    const queue = [...states2];
+    for (let i = 0; i < queue.length; i++) {
+      const state = queue[i];
+      const kind = tokens[state]?.kind;
+      const add = (next) => {
+        if (!states2.has(next)) {
+          states2.add(next);
+          queue.push(next);
         }
-      } else if (char === "*") {
-        regexPattern += "[^/]*";
-      } else if (char === "?") {
-        regexPattern += "[^/]";
-      } else {
-        regexPattern += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+      };
+      if (kind === "star" || kind === "globstar") add(state + 1);
+      else if (kind === "directoryStart") {
+        add(state + 1);
+        add(state + 2);
       }
     }
-    if (!regexPattern.startsWith("^") && !regexPattern.startsWith("(?:^")) {
-      regexPattern = "(?:^|/)" + regexPattern;
-    }
-    if (!regexPattern.endsWith("$")) {
-      regexPattern = regexPattern + "(?:$|/)";
-    }
-    try {
-      const rx = new RegExp(regexPattern, "i");
-      if (rx.test(normalized)) {
-        return true;
-      }
-    } catch {
-      if (normalized.includes(cleanPattern.replace(/\*/g, ""))) {
-        return true;
+    return states2;
+  };
+  let states = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset <= filename.length; offset++) {
+    if (!offset || filename[offset - 1] === "/") states.add(0);
+    closure(states);
+    if (states.has(tokens.length) && (offset === filename.length || filename[offset] === "/")) return true;
+    if (offset === filename.length) break;
+    const char = filename[offset];
+    const next = /* @__PURE__ */ new Set();
+    for (const state of states) {
+      const token = tokens[state];
+      if (!token) continue;
+      if (token.kind === "literal") {
+        if (token.value === char.toLowerCase()) next.add(state + 1);
+      } else if (token.kind === "question") {
+        if (char !== "/") next.add(state + 1);
+      } else if (token.kind === "star") {
+        if (char !== "/") next.add(state);
+      } else if (token.kind === "globstar") next.add(state);
+      else if (token.kind === "directoryBody") {
+        next.add(state);
+        if (char === "/") next.add(state + 1);
       }
     }
+    states = next;
   }
   return false;
 }
+function matchIgnorePath(filePath, ignorePatterns) {
+  if (!ignorePatterns?.length) return false;
+  const normalized = filePath.replace(/\\/g, "/");
+  return ignorePatterns.some((pattern) => Boolean(pattern) && matchesGlob(normalized, pattern.replace(/\\/g, "/")));
+}
 
 // src/metrics.ts
-var TEST_SKIP_PATTERNS = [
-  { regex: /\b(?:it|test|describe)\.skip\b/, name: "skipped test (it.skip / describe.skip)" },
-  { regex: /\b(?:xit|xtest)\(/, name: "disabled test (xit / xtest)" },
-  { regex: /@pytest\.mark\.skip\b/, name: "skipped pytest (@pytest.mark.skip)" },
-  { regex: /\bpytest\.skip\(/, name: "imperative pytest skip (pytest.skip)" },
-  { regex: /\btest\.todo\(/, name: "todo placeholder test" }
+var PYTHON_TEST_SKIP_PATTERNS = [
+  { regex: /@pytest\s*\.\s*mark\s*\.\s*skip\b/, name: "skipped pytest (@pytest.mark.skip)" },
+  { regex: /(?<![\w.])pytest\s*\.\s*skip\s*\(/, name: "imperative pytest skip (pytest.skip)" },
+  { regex: /@unittest\s*\.\s*skip\s*\(/, name: "skipped unittest (@unittest.skip)" },
+  { regex: /\bself\s*\.\s*skipTest\s*\(/, name: "imperative unittest skip (self.skipTest)" }
 ];
-var FOCUSED_TEST = /(?<![\w$.])(?:it|test|describe|suite)(?:\s*\.\s*(?:concurrent|serial|parallel|describe))*\s*\.\s*only\b(?=\s*(?:\(|\.\s*(?:each|failing|concurrent|serial|parallel)\b))|(?<![\w$.])(?:fit|fdescribe)\b(?=\s*(?:\(|\.\s*each\b))/g;
-var COMMENT_DIRECTIVE_PATTERNS = [
+var JS_TEST_API = /(?<![\w$.])(?:(?:it|test|describe|suite)(?:\s*\.\s*(?:concurrent|serial|parallel|describe|failing|sequential))*\s*\.\s*(skip|todo|only)|((?:xit|xtest|xdescribe|fit|fdescribe)))\b((?:\s*\.\s*(?:each|failing|concurrent|serial|parallel|sequential))*)\s*(?=\(|\u0001)/g;
+var JS_COMMENT_DIRECTIVE_PATTERNS = [
   { regex: /^\s*\/\/\s*@ts-ignore\b/, name: "compiler ignore (@ts-ignore)" },
   { regex: /^\s*\/\/\s*@ts-expect-error\b/, name: "compiler suppression (@ts-expect-error)" },
   { regex: /^\s*\/\/\s*@ts-nocheck\b/, name: "compiler check disable (@ts-nocheck)" },
-  { regex: /(?:^\s*#\s*type:\s*ignore\b|#\s*type:\s*ignore\s*$)/, name: "python type ignore" },
-  { regex: /(?:^\s*#\s*noqa\b|#\s*noqa\s*$)/, name: "python linter suppression (# noqa)" },
-  { regex: /^\s*\/\/\s*eslint-disable(?:-next-line)?\b/, name: "linter suppression (eslint-disable)" }
+  { regex: /^\s*\/\/\s*eslint-disable(?:-next-line|-line)?\b/, name: "linter suppression (eslint-disable)" }
+];
+var PYTHON_COMMENT_DIRECTIVE_PATTERNS = [
+  { regex: /#\s*type:\s*ignore\b/, name: "python type ignore" },
+  { regex: /#\s*noqa\b/, name: "python linter suppression (# noqa)" }
 ];
 var CODE_TYPE_ESCAPE_PATTERNS = [
   { regex: /\bas\s+any\b/, name: "type bypass (as any)" },
   { regex: /\bas\s+unknown\s+as\b/, name: "double assertion bypass (as unknown as)" },
   { regex: /\bas\s+never\b/, name: "type escape (as never)" }
 ];
-var SWALLOWED_ERROR_PATTERNS = [
-  { regex: /catch\s*(?:\([^)]*\))?\s*\{\s*\}/, name: "empty catch block (catch {})" },
-  { regex: /except(?:\s+[^:]*)?:\s*pass\b/, name: "silent python error swallow (except: pass)" }
+var JS_TRIVIAL_ASSERT_PATTERNS = [
+  { regex: /(?<![\w$.])expect\s*\(\s*(true|false|1|0|null|undefined)\s*\)\s*\.\s*toBe\s*\(\s*\1\s*\)/, name: "trivial assertion (expect(val).toBe(val))" },
+  { regex: /(?<![\w$.])expect\s*\(\s*(true|false|1|0|null|undefined)\s*\)\s*\.\s*toEqual\s*\(\s*\1\s*\)/, name: "trivial assertion (expect(val).toEqual(val))" },
+  { regex: /(?<![\w$.])assert\s*\.\s*(?:strictEqual|equal)\s*\(\s*(?:true\s*,\s*true|1\s*,\s*1)\s*\)/, name: "trivial assert (assert.equal(1, 1))" }
 ];
-var TRIVIAL_ASSERT_PATTERNS = [
-  { regex: /expect\s*\(\s*(true|false|1|0|null|undefined)\s*\)\.toBe\s*\(\s*\1\s*\)/, name: "trivial assertion (expect(val).toBe(val))" },
-  { regex: /expect\s*\(\s*(true|false|1|0|null|undefined)\s*\)\.toEqual\s*\(\s*\1\s*\)/, name: "trivial assertion (expect(val).toEqual(val))" },
+var PYTHON_TRIVIAL_ASSERT_PATTERNS = [
   { regex: /\bassert\s+(?:True|1\s*==\s*1)\s*(?=$|#|,)/, name: "trivial python assert (assert True / 1 == 1)" },
-  { regex: /self\.assertTrue\s*\(\s*(?:True|1)\s*\)/, name: "trivial assert (self.assertTrue(True))" },
-  { regex: /self\.assertEqual\s*\(\s*(?:1\s*,\s*1|True\s*,\s*True)\s*\)/, name: "trivial assert (self.assertEqual(1, 1))" },
-  { regex: /assert\.(?:strictEqual|equal)\s*\(\s*(?:true\s*,\s*true|1\s*,\s*1)\s*\)/, name: "trivial assert (assert.equal(1, 1))" }
+  { regex: /\bself\s*\.\s*assertTrue\s*\(\s*(?:True|1)\s*\)/, name: "trivial assert (self.assertTrue(True))" },
+  { regex: /\bself\s*\.\s*assertEqual\s*\(\s*(?:1\s*,\s*1|True\s*,\s*True)\s*\)/, name: "trivial assert (self.assertEqual(1, 1))" }
 ];
-var STUB_ABANDONMENT_PATTERNS = [
-  { regex: /\bthrow\s+new\s+Error\s*\(\s*["'](?:TODO|Not implemented|to be implemented|stub|implement me)/i, name: "unimplemented stub (throw new Error('Not implemented'))" },
+var JS_STUB_PATTERNS = [
+  { regex: /\bthrow\s+new\s+Error\s*\(\s*["'](?:TODO\b|Not implemented\b|to be implemented\b|stub\b|implement me\b)/i, name: "unimplemented stub (throw new Error('Not implemented'))" }
+];
+var PYTHON_STUB_PATTERNS = [
   { regex: /\braise\s+NotImplementedError\b/, name: "unimplemented stub (raise NotImplementedError)" },
-  { regex: /\braise\s+NotImplemented\b/, name: "unimplemented stub (raise NotImplemented)" },
-  { regex: /\btodo!\s*\(\s*\)/, name: "unimplemented rust stub (todo!())" },
-  { regex: /\bunimplemented!\s*\(\s*\)/, name: "unimplemented rust stub (unimplemented!())" }
+  { regex: /\braise\s+NotImplemented\b/, name: "unimplemented stub (raise NotImplemented)" }
+];
+var RUST_STUB_PATTERNS = [
+  { regex: /\btodo!\s*\(/, name: "unimplemented rust stub (todo!())" },
+  { regex: /\bunimplemented!\s*\(/, name: "unimplemented rust stub (unimplemented!())" }
 ];
 var CODE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".ts",
@@ -929,16 +1197,26 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
     hasSupportedChanges = true;
     filesInspected++;
     linesAdded += file.addedLines.length;
+    const javascript = /\.(?:[cm]?[jt]sx?|vue|svelte)$/i.test(file.path);
+    const typescript = /\.(?:[cm]?tsx?|vue|svelte)$/i.test(file.path);
+    const python = /\.py$/i.test(file.path);
+    const rust = /\.rs$/i.test(file.path);
+    const braceCatches = javascript || /\.(?:java|kt|php|cs|cpp)$/i.test(file.path);
+    const directives = javascript ? JS_COMMENT_DIRECTIVE_PATTERNS : python ? PYTHON_COMMENT_DIRECTIVE_PATTERNS : [];
+    const stubs = javascript ? JS_STUB_PATTERNS : python ? PYTHON_STUB_PATTERNS : rust ? RUST_STUB_PATTERNS : [];
+    const firstFinding = infractions.length;
     const masker = new SourceMasker(file.path);
     const maskedLines = [];
     for (const added of file.addedLines) {
       const rawLine = added.line;
       const masked = masker.mask(rawLine, added.lineNumber);
       const cleanedLine = masked.code;
-      maskedLines.push({ code: cleanedLine, raw: rawLine, number: added.lineNumber });
+      const testCode = cleanedLine.split("");
+      for (const start of masked.templateStarts) testCode[start] = "
";
+      maskedLines.push({ code: cleanedLine, testCode: testCode.join(""), raw: rawLine, number: added.lineNumber });
       const isComment = !cleanedLine.trim();
-      if (!isComment) {
-        for (const rule of TEST_SKIP_PATTERNS) {
+      if (python && !isComment) {
+        for (const rule of PYTHON_TEST_SKIP_PATTERNS) {
           if (rule.regex.test(cleanedLine)) {
             infractions.push({
               type: "test-skip",
@@ -954,7 +1232,7 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
         }
       }
       let foundEscape = false;
-      for (const rule of COMMENT_DIRECTIVE_PATTERNS) {
+      for (const rule of directives) {
         if (rule.regex.test(masked.comments)) {
           infractions.push({
             type: "type-escape",
@@ -969,7 +1247,11 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
           break;
         }
       }
-      if (!foundEscape && !isComment) {
+      if (javascript && !foundEscape && masked.blockStarts.some((start) => /^\/\*\s*eslint-disable(?:-next-line|-line)?\b/.test(rawLine.slice(start)))) {
+        infractions.push({ type: "type-escape", file: file.path, lineNumber: added.lineNumber, lineSnippet: rawLine.trim(), commitHash, commitDate, reason: "linter suppression (eslint-disable)" });
+        foundEscape = true;
+      }
+      if (typescript && !foundEscape && !isComment) {
         for (const rule of CODE_TYPE_ESCAPE_PATTERNS) {
           if (rule.regex.test(cleanedLine)) {
             infractions.push({
@@ -985,24 +1267,8 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
           }
         }
       }
-      if (!isComment) {
-        for (const rule of SWALLOWED_ERROR_PATTERNS) {
-          if (rule.regex.test(cleanedLine)) {
-            infractions.push({
-              type: "swallowed-error",
-              file: file.path,
-              lineNumber: added.lineNumber,
-              lineSnippet: rawLine.trim(),
-              commitHash,
-              commitDate,
-              reason: rule.name
-            });
-            break;
-          }
-        }
-      }
-      if (!isComment && isTestFile(file.path)) {
-        for (const rule of TRIVIAL_ASSERT_PATTERNS) {
+      if (python && !isComment && isTestFile(file.path)) {
+        for (const rule of PYTHON_TRIVIAL_ASSERT_PATTERNS) {
           if (rule.regex.test(cleanedLine)) {
             infractions.push({
               type: "trivial-assert",
@@ -1018,9 +1284,10 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
         }
       }
       if (!isComment) {
-        for (const rule of STUB_ABANDONMENT_PATTERNS) {
-          const match = rule.regex.exec(rawLine);
-          if (match && cleanedLine[match.index] === rawLine[match.index]) {
+        for (const rule of stubs) {
+          const matches = rawLine.matchAll(new RegExp(rule.regex.source, rule.regex.flags + "g"));
+          const match = [...matches].find((candidate) => cleanedLine[candidate.index] === rawLine[candidate.index]);
+          if (match) {
             infractions.push({
               type: "stub-abandonment",
               file: file.path,
@@ -1035,46 +1302,68 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
         }
       }
     }
-    if (/\.(?:[cm]?[jt]sx?|vue|svelte)$/i.test(file.path)) {
+    if (javascript) {
       let source = "";
       const offsets = [];
       for (let i = 0; i < maskedLines.length; i++) {
         if (i) source += maskedLines[i].number === maskedLines[i - 1].number + 1 ? "\n" : "\0";
         offsets.push(source.length);
-        source += maskedLines[i].code;
+        source += maskedLines[i].testCode;
       }
       let row = 0;
-      for (const match of source.matchAll(FOCUSED_TEST)) {
+      const evidence = (index, length) => {
+        while (row + 1 < offsets.length && offsets[row + 1] <= index) row++;
+        let end = row;
+        while (end + 1 < offsets.length && offsets[end + 1] < index + length) end++;
+        return { lineNumber: maskedLines[row].number, lineSnippet: maskedLines.slice(row, end + 1).map((line) => line.raw.trim()).join(" ") };
+      };
+      for (const match of source.matchAll(JS_TEST_API)) {
         let previous = match.index - 1;
         while (previous >= 0 && /\s/.test(source[previous])) previous--;
         if (source[previous] === ".") continue;
-        if (/^(?:fit|fdescribe)$/.test(match[0]) && !isTestFile(file.path)) continue;
+        if (match[2] && !isTestFile(file.path)) continue;
         if (/\bfunction$/.test(source.slice(Math.max(0, previous - 8), previous + 1))) continue;
-        while (row + 1 < offsets.length && offsets[row + 1] <= match.index) row++;
-        let end = row;
-        while (end + 1 < offsets.length && offsets[end + 1] < match.index + match[0].length) end++;
+        if (source[match.index + match[0].length] === "
" && !/\.\s*each\s*$/.test(match[3])) continue;
+        const focus = match[1] === "only" || match[2] === "fit" || match[2] === "fdescribe";
         infractions.push({
-          type: "test-focus",
+          type: focus ? "test-focus" : "test-skip",
           file: file.path,
-          lineNumber: maskedLines[row].number,
-          lineSnippet: maskedLines.slice(row, end + 1).map((line) => line.raw.trim()).join(" "),
+          ...evidence(match.index, match[0].length),
           commitHash,
           commitDate,
-          reason: "focused test or suite excludes other tests from the run"
+          reason: focus ? "focused test or suite excludes other tests from the run" : `skipped, disabled or placeholder test registration (${match[0].replace(/\s/g, "")})`
         });
       }
+      if (isTestFile(file.path)) {
+        row = 0;
+        for (const rule of JS_TRIVIAL_ASSERT_PATTERNS) {
+          for (const match of source.matchAll(new RegExp(rule.regex.source, "g"))) {
+            infractions.push({ type: "trivial-assert", file: file.path, ...evidence(match.index, match[0].length), commitHash, commitDate, reason: rule.name });
+          }
+          row = 0;
+        }
+      }
     }
     for (let index = 0; index < maskedLines.length; index++) {
       const start = maskedLines[index];
-      const isCatch = /\bcatch\s*(?:\([^)]*\))?\s*\{\s*$/.test(start.code);
-      const isExcept = /\bexcept(?:\s+[^:]*)?:\s*$/.test(start.code);
+      const catches = braceCatches ? [...start.code.matchAll(/(?<![\w$.])catch\s*(?:\(\s*[^)\s][^)]*\))?\s*\{/g)] : [];
+      for (const match of catches) {
+        if (/^\s*}/.test(start.code.slice(match.index + match[0].length))) {
+          infractions.push({ type: "swallowed-error", file: file.path, lineNumber: start.number, lineSnippet: start.raw.trim(), commitHash, commitDate, reason: "empty catch block (catch {})" });
+        }
+      }
+      const lastCatch = catches.at(-1);
+      const isCatch = lastCatch && /^\s*$/.test(start.code.slice(lastCatch.index + lastCatch[0].length));
+      const inlineExcept = python && /^\s*except(?:\*?\s+[^:]+)?:\s*pass\s*;?\s*$/.test(start.code);
+      if (inlineExcept) infractions.push({ type: "swallowed-error", file: file.path, lineNumber: start.number, lineSnippet: start.raw.trim(), commitHash, commitDate, reason: "silent python error swallow (except: pass)" });
+      const isExcept = python && /^\s*except(?:\*?\s+[^:]+)?:\s*$/.test(start.code);
       if (!isCatch && !isExcept) continue;
       let next = index + 1;
       while (next < maskedLines.length && maskedLines[next].number === maskedLines[next - 1].number + 1 && !maskedLines[next].code.trim()) next++;
       const end = maskedLines[next];
       if (!end || end.number !== maskedLines[next - 1].number + 1) continue;
       const closesCatch = isCatch && /^\s*}/.test(end.code);
-      let closesExcept = isExcept && /^\s*pass\s*$/.test(end.code);
+      let closesExcept = isExcept && /^\s*pass\s*;?\s*$/.test(end.code);
       if (closesExcept) {
         const indent = start.raw.search(/\S/);
         if (end.raw.search(/\S/) <= indent) closesExcept = false;
@@ -1092,6 +1381,8 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
         reason: closesCatch ? "empty multi-line catch block" : "silent multi-line python error swallow"
       });
     }
+    const ordered = infractions.splice(firstFinding).sort((left, right) => (left.lineNumber || 0) - (right.lineNumber || 0));
+    for (const finding of ordered) infractions.push(finding);
   }
   return { infractions: infractions.filter((inf) => options.rules?.[inf.type] !== "off").map((inf) => ({ ...inf, suggestion: RULE_GUIDES[inf.type].suggestion })), hasSupportedChanges, filesInspected, linesAdded };
 }
@@ -1115,6 +1406,7 @@ var MetricsCollector = class {
   stubAbandonments = [];
   skippedLongLines = 0;
   skippedUnknownFiles = 0;
+  skippedBinaryFiles = 0;
   activePanicChain = null;
   includeAll;
   ignorePaths;
@@ -1159,6 +1451,7 @@ var MetricsCollector = class {
       this.flushPanicChain();
       return;
     }
+    this.skippedBinaryFiles += commit.files.filter((file) => file.binary && isCodeFile(file.path, this.ignorePaths)).length;
     const subject = commit.message.split("\n")[0];
     const commitDateMs = Date.parse(commit.date);
     const isFixCommit = PANIC_COMMIT_REGEX.test(subject);
@@ -1231,7 +1524,8 @@ var MetricsCollector = class {
   getSummary() {
     this.flushPanicChain();
     const linesSample = this.includeAll ? this.totalLinesAdded : this.aiLinesAdded;
-    const isSufficientData = linesSample >= MIN_SAMPLE_LOC;
+    const complete = !this.skippedLongLines && !this.skippedUnknownFiles && !this.skippedBinaryFiles;
+    const isSufficientData = complete && linesSample >= MIN_SAMPLE_LOC;
     const codeInfractionPoints = this.testSkips.length * 15 + this.focusedTests.length * 15 + this.trivialAsserts.length * 15 + this.swallowedErrors.length * 10 + this.stubAbandonments.length * 8 + this.typeEscapes.length * 3;
     let panicInfractionPoints = 0;
     for (const loop of this.panicLoops) {
@@ -1294,7 +1588,12 @@ var MetricsCollector = class {
         }
       }
     }
+    if (!complete) {
+      archetype = "Incomplete audit";
+      archetypeDescription = "Source was skipped; findings are partial and no complete score can be issued.";
+    }
     return {
+      complete,
       schemaVersion: "1.0.0",
       totalLinesAdded: this.totalLinesAdded,
       aiLinesAdded: this.aiLinesAdded,
@@ -1313,14 +1612,22 @@ var MetricsCollector = class {
       archetype,
       archetypeDescription,
       skippedLongLines: this.skippedLongLines,
-      skippedUnknownFiles: this.skippedUnknownFiles
+      skippedUnknownFiles: this.skippedUnknownFiles,
+      skippedBinaryFiles: this.skippedBinaryFiles
     };
   }
 };
 
 // src/renderer.ts
 import pc from "picocolors";
+function historyIncomplete(summary) {
+  return Boolean(summary.skippedLongLines || summary.skippedUnknownFiles || summary.skippedBinaryFiles);
+}
 function generateShareUrl(summary) {
+  if (historyIncomplete(summary)) {
+    const text2 = "My agent-roast history audit was incomplete: some long lines, unparsed paths or binary source were skipped. No complete score was issued.\n\nAudit your repo: npx agent-roast";
+    return `https://twitter.com/intent/tweet?text=${encodeURIComponent(text2)}`;
+  }
   const scoreDisplay = summary.score !== null ? `${summary.score}/100` : "N/A";
   const text = `My AI coding agent scored ${scoreDisplay} on agent-roast.
 
@@ -1335,27 +1642,32 @@ Audit your repo: npx agent-roast`;
 }
 function formatTerminalCard(summary, options) {
   const lines = [];
+  const incomplete = historyIncomplete(summary);
   lines.push("");
   lines.push(
-    `${pc.bold(pc.cyan("agent-roast"))} ${pc.dim("\u2014 git discipline audit")} ${pc.white(options.repoName)}`
+    `${pc.bold(pc.cyan("agent-roast"))} ${pc.dim("\u2014 git discipline audit")} ${pc.white(terminalText(options.repoName))}`
   );
   lines.push(
     `  ${pc.dim("commits:")} ${pc.yellow(summary.aiCommits)} AI / ${summary.totalCommits} total   ${pc.dim("lines added:")} ${pc.green(summary.aiLinesAdded)} AI / ${summary.totalLinesAdded} total`
   );
   lines.push("");
-  if (!summary.isSufficientData || summary.score === null) {
+  if (incomplete) {
+    lines.push(pc.yellow("  INCOMPLETE: long lines, unparsed paths or binary source were skipped; no complete score issued."));
+    lines.push(pc.dim(`  Skipped: ${summary.skippedLongLines || 0} long lines \xB7 ${summary.skippedUnknownFiles || 0} unparsed files \xB7 ${summary.skippedBinaryFiles || 0} binary source files.`));
+    lines.push("");
+  } else if (!summary.isSufficientData || summary.score === null) {
     lines.push(pc.yellow(`  insufficient data (< 200 analyzed lines added)`));
     lines.push(pc.dim("  Findings below remain actionable; a score needs a larger sample."));
     lines.push("");
   }
-  if (summary.isSufficientData && summary.score !== null) {
+  if (!incomplete && summary.isSufficientData && summary.score !== null) {
     let scoreColor = pc.green;
     if (summary.score < 60) scoreColor = pc.red;
     else if (summary.score < 80) scoreColor = pc.yellow;
     lines.push(
-      `  ${pc.bold("SCORE:")} ${scoreColor(pc.bold(`${summary.score} / 100`))}  ${pc.dim("\xB7")}  ${pc.magenta(pc.bold(summary.archetype))}`
+      `  ${pc.bold("SCORE:")} ${scoreColor(pc.bold(`${summary.score} / 100`))}  ${pc.dim("\xB7")}  ${pc.magenta(pc.bold(terminalText(summary.archetype)))}`
     );
-    lines.push(`  ${pc.dim(summary.archetypeDescription)}`);
+    lines.push(`  ${pc.dim(terminalText(summary.archetypeDescription))}`);
     lines.push("");
   }
   const totalInfractions = (summary.testSkips?.length || 0) + (summary.focusedTests?.length || 0) + (summary.typeEscapes?.length || 0) + (summary.swallowedErrors?.length || 0) + (summary.panicLoops?.length || 0) + (summary.trivialAsserts?.length || 0) + (summary.stubAbandonments?.length || 0);
@@ -1366,7 +1678,7 @@ function formatTerminalCard(summary, options) {
       `  ${pc.magenta("\u25CF")} ${pc.bold("panic-loop")} (${summary.panicLoops.length})  ${pc.dim("rapid consecutive fixes touching overlapping files")}`
     );
     const sample = summary.panicLoops[0];
-    lines.push(`      ${pc.dim(sample.reason)}`);
+    lines.push(`      ${pc.dim(terminalText(sample.reason))}`);
   }
   if (summary.trivialAsserts && summary.trivialAsserts.length > 0) {
     lines.push(
@@ -1374,7 +1686,7 @@ function formatTerminalCard(summary, options) {
     );
     const sample = summary.trivialAsserts[0];
     if (sample.file) {
-      lines.push(`      ${pc.dim(`${sample.file}: ${sample.lineSnippet || ""}`)}`);
+      lines.push(`      ${pc.dim(`${terminalText(sample.file)}: ${terminalText(sample.lineSnippet || "")}`)}`);
     }
   }
   if (summary.focusedTests?.length) {
@@ -1388,7 +1700,7 @@ function formatTerminalCard(summary, options) {
     );
     const sample = summary.testSkips[0];
     if (sample.file) {
-      lines.push(`      ${pc.dim(`${sample.file}: ${sample.lineSnippet || ""}`)}`);
+      lines.push(`      ${pc.dim(`${terminalText(sample.file)}: ${terminalText(sample.lineSnippet || "")}`)}`);
     }
   }
   if (summary.swallowedErrors && summary.swallowedErrors.length > 0) {
@@ -1397,7 +1709,7 @@ function formatTerminalCard(summary, options) {
     );
     const sample = summary.swallowedErrors[0];
     if (sample.file) {
-      lines.push(`      ${pc.dim(`${sample.file}: ${sample.lineSnippet || ""}`)}`);
+      lines.push(`      ${pc.dim(`${terminalText(sample.file)}: ${terminalText(sample.lineSnippet || "")}`)}`);
     }
   }
   if (summary.stubAbandonments && summary.stubAbandonments.length > 0) {
@@ -1406,7 +1718,7 @@ function formatTerminalCard(summary, options) {
     );
     const sample = summary.stubAbandonments[0];
     if (sample.file) {
-      lines.push(`      ${pc.dim(`${sample.file}: ${sample.lineSnippet || ""}`)}`);
+      lines.push(`      ${pc.dim(`${terminalText(sample.file)}: ${terminalText(sample.lineSnippet || "")}`)}`);
     }
   }
   if (summary.typeEscapes && summary.typeEscapes.length > 0) {
@@ -1415,15 +1727,15 @@ function formatTerminalCard(summary, options) {
     );
     const sample = summary.typeEscapes[0];
     if (sample.file) {
-      lines.push(`      ${pc.dim(`${sample.file}: ${sample.lineSnippet || ""}`)}`);
+      lines.push(`      ${pc.dim(`${terminalText(sample.file)}: ${terminalText(sample.lineSnippet || "")}`)}`);
     }
   }
   if (totalInfractions === 0) {
-    lines.push(`  ${pc.green("\u25CF")} ${pc.dim("zero infractions detected across all inspected lines.")}`);
+    lines.push(incomplete ? "  No findings in the inspected portion; skipped source remains unreviewed." : `  ${pc.green("\u25CF")} ${pc.dim("zero infractions detected across all inspected lines.")}`);
   }
   lines.push("");
   if (options.verbose) {
-    if (summary.skippedLongLines || summary.skippedUnknownFiles) {
+    if (incomplete) {
       lines.push(pc.bold("  PARSER AUDIT STATS:"));
       lines.push(pc.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
       if (summary.skippedLongLines) {
@@ -1432,6 +1744,9 @@ function formatTerminalCard(summary, options) {
       if (summary.skippedUnknownFiles) {
         lines.push(`  ${pc.dim("skipped files with unparseable path:")} ${pc.yellow(summary.skippedUnknownFiles)}`);
       }
+      if (summary.skippedBinaryFiles) {
+        lines.push(`  ${pc.dim("skipped binary source files:")} ${pc.yellow(summary.skippedBinaryFiles)}`);
+      }
       lines.push("");
     }
     const allInfractions = [
@@ -1449,16 +1764,16 @@ function formatTerminalCard(summary, options) {
       for (const inf of allInfractions.slice(0, 10)) {
         const fileLoc = inf.file ? `${inf.file}${inf.lineNumber ? `:${inf.lineNumber}` : ""}` : "commit history";
         lines.push(
-          `  \u25CF ${pc.cyan(inf.commitHash.slice(0, 7))} [${inf.type}] ${pc.white(fileLoc)}`
+          `  \u25CF ${pc.cyan(terminalText(inf.commitHash.slice(0, 7)))} [${inf.type}] ${pc.white(terminalText(fileLoc))}`
         );
         if (inf.lineSnippet) {
-          lines.push(`      ${pc.dim(`\u2514\u2500 ${inf.lineSnippet}`)}`);
+          lines.push(`      ${pc.dim(`\u2514\u2500 ${terminalText(inf.lineSnippet)}`)}`);
         }
       }
       lines.push("");
     }
   }
-  lines.push(
+  if (!incomplete) lines.push(
     `  ${pc.dim("Share score:")} ${pc.cyan(generateShareUrl(summary))}`
   );
   lines.push("");
@@ -1471,6 +1786,7 @@ function formatPrTerminalCard(result) {
     `${pc.bold(pc.cyan("agent-roast"))} ${pc.dim(result.mode === "staged" ? "\u2014 staged changes audit" : "\u2014 pull request audit")} ${pc.white(`${result.baseSha.slice(0, 7)}...${result.headSha.slice(0, 7)}`)}`
   );
   if (!result.hasSupportedChanges) {
+    if (result.complete === false) lines.push("  INCOMPLETE: some long lines, unparsed paths or binary source could not be inspected; exit 2.");
     lines.push(`  ${pc.dim("no supported source changes detected in the audited diff.")}`);
     lines.push("");
     return lines.join("\n");
@@ -1479,7 +1795,7 @@ function formatPrTerminalCard(result) {
     `  ${pc.dim("files inspected:")} ${result.filesInspected}   ${pc.dim("lines added:")} ${result.linesAdded}`
   );
   lines.push("");
-  if (result.infractions.length === 0) {
+  if (result.infractions.length === 0 && result.complete !== false) {
     lines.push(`  ${pc.green("PASS")} ${pc.dim("zero infractions detected across all audited changes.")}`);
   } else {
     lines.push(pc.bold(`  INFRACTIONS DETECTED (${result.infractions.length})`));
@@ -1488,15 +1804,17 @@ function formatPrTerminalCard(result) {
       const isFailedRule = result.failedRules.includes(inf.type);
       const badge = isFailedRule ? pc.red("FAIL") : pc.yellow("WARN");
       const loc = `${inf.file || "unknown"}:${inf.lineNumber || 1}`;
-      lines.push(`  ${badge} [${inf.type}] ${pc.white(loc)} \u2014 ${pc.dim(inf.reason)}`);
+      lines.push(`  ${badge} [${inf.type}] ${pc.white(terminalText(loc))} \u2014 ${pc.dim(terminalText(inf.reason))}`);
       if (inf.lineSnippet) {
-        lines.push(`      ${pc.dim(`\u2514\u2500 ${inf.lineSnippet}`)}`);
+        lines.push(`      ${pc.dim(`\u2514\u2500 ${terminalText(inf.lineSnippet)}`)}`);
       }
-      if (inf.suggestion) lines.push(`      ${pc.dim(`Next: ${inf.suggestion}`)}`);
+      if (inf.suggestion) lines.push(`      ${pc.dim(`Next: ${terminalText(inf.suggestion)}`)}`);
     }
   }
   lines.push("");
-  if (result.failedRules.length > 0) {
+  if (result.complete === false) {
+    lines.push("  INCOMPLETE: some long lines, unparsed paths or binary source could not be inspected; exit 2.");
+  } else if (result.failedRules.length > 0) {
     lines.push(
       `  ${pc.red(pc.bold("BLOCKING FAILURE:"))} ${result.failedRules.length} rule(s) violated in --fail-on: ${result.failedRules.join(", ")}`
     );
@@ -1564,10 +1882,11 @@ function formatGithubStepSummary(result) {
   lines.push(result.mode === "staged" ? "### agent-roast Staged Changes Audit" : "### agent-roast Pull Request Audit");
   lines.push("");
   if (!result.hasSupportedChanges) {
+    if (result.complete === false) lines.push("INCOMPLETE: some long lines, unparsed paths or binary source could not be inspected; exit 2.");
     lines.push("No supported source file changes detected in the audited diff.");
     return lines.join("\n");
   }
-  const statusBadge = result.passed ? "Passed" : `Failed (${result.failedRules.join(", ")})`;
+  const statusBadge = result.complete === false ? "INCOMPLETE" : result.passed ? "Passed" : `Failed (${result.failedRules.join(", ")})`;
   lines.push(`| Status | Base | Head | Files | Lines Added | Infractions |`);
   lines.push(`| --- | --- | --- | --- | --- | --- |`);
   lines.push(
@@ -1581,31 +1900,32 @@ function formatGithubStepSummary(result) {
     lines.push("| --- | --- | --- | --- |");
     const sorted = sortInfractionsDeterministic(result.infractions);
     for (const inf of sorted) {
-      const loc = inf.file ? `\`${inf.file}:${inf.lineNumber || 1}\`` : "*history*";
-      const snippet = inf.lineSnippet ? `\`${inf.lineSnippet.replace(/\|/g, "\\|")}\`` : "-";
-      lines.push(`| \`${inf.type}\` | ${loc} | ${inf.reason} | ${snippet} |`);
+      const loc = inf.file ? markdownCell(`${inf.file}:${inf.lineNumber || 1}`) : "history";
+      const snippet = inf.lineSnippet ? markdownCell(inf.lineSnippet) : "-";
+      lines.push(`| ${inf.type} | ${loc} | ${markdownCell(inf.reason)} | ${snippet} |`);
     }
     lines.push("");
   } else {
-    lines.push("Clean pull request: zero shortcuts or bypassed checks detected.");
+    lines.push(result.complete === false ? "INCOMPLETE: skipped long lines, unparsed paths or binary source prevent a clean result." : "Clean pull request: zero shortcuts or bypassed checks detected.");
     lines.push("");
   }
   return lines.join("\n");
 }
 function formatPrMarkdownComment(result) {
   const lines = [];
-  const titleEmoji = result.passed ? "\u2705" : "\u274C";
-  const titleStatus = result.passed ? "PASSED" : "BLOCKED";
+  const titleEmoji = result.complete === false ? "\u26A0\uFE0F" : result.passed ? "\u2705" : "\u274C";
+  const titleStatus = result.complete === false ? "INCOMPLETE" : result.passed ? "PASSED" : "BLOCKED";
   lines.push(`## \u{1F6E1}\uFE0F agent-roast audit: ${titleStatus} ${titleEmoji}`);
   lines.push("");
   if (!result.hasSupportedChanges) {
+    if (result.complete === false) lines.push("INCOMPLETE: some long lines, unparsed paths or binary source could not be inspected; exit 2.");
     lines.push("No supported source file changes detected in the audited diff.");
     lines.push("");
     lines.push("---");
     lines.push("*Audited 100% offline with [agent-roast](https://github.com/Nari-Ab/agent-roast)*");
     return lines.join("\n");
   }
-  const statusText = result.passed ? "\u2705 Passed" : `\u274C Blocked on ${result.failedRules.join(", ")}`;
+  const statusText = result.complete === false ? "\u26A0\uFE0F INCOMPLETE" : result.passed ? "\u2705 Passed" : `\u274C Blocked on ${result.failedRules.join(", ")}`;
   lines.push("| Status | Defect Density | Files Inspected | Lines Added | Infractions |");
   lines.push("| :--- | :--- | :--- | :--- | :--- |");
   lines.push(
@@ -1620,15 +1940,15 @@ function formatPrMarkdownComment(result) {
     lines.push("| :--- | :--- | :--- | :--- |");
     const sorted = sortInfractionsDeterministic(result.infractions);
     for (const inf of sorted) {
-      const loc = inf.file ? `\`${inf.file}:${inf.lineNumber || 1}\`` : "*history*";
-      const snippet = inf.lineSnippet ? `\`${inf.lineSnippet.replace(/\|/g, "\\|")}\`` : "-";
-      lines.push(`| \`${inf.type}\` | ${loc} | ${inf.reason} | ${snippet} |`);
+      const loc = inf.file ? markdownCell(`${inf.file}:${inf.lineNumber || 1}`) : "history";
+      const snippet = inf.lineSnippet ? markdownCell(inf.lineSnippet) : "-";
+      lines.push(`| ${inf.type} | ${loc} | ${markdownCell(inf.reason)} | ${snippet} |`);
     }
     lines.push("");
     lines.push("</details>");
     lines.push("");
   } else {
-    lines.push("\u2728 **Clean pull request**: Zero AI shortcuts, bypassed tests, or compiler type escapes detected.");
+    lines.push(result.complete === false ? "INCOMPLETE: skipped long lines, unparsed paths or binary source prevent a clean result." : "\u2728 **Clean pull request**: Zero AI shortcuts, bypassed tests, or compiler type escapes detected.");
     lines.push("");
   }
   lines.push("---");
@@ -1636,7 +1956,38 @@ function formatPrMarkdownComment(result) {
   return lines.join("\n");
 }
 function terminalText(value) {
-  return value.replace(/[\u0000-\u001f\u007f-\u009f]/g, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
+  return value.replace(/[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/g, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function exceptionTerminal(result) {
+  const lines = [];
+  const accepted = result.suppressedFindings || [];
+  if (accepted.length) {
+    lines.push(`  ${accepted.length} findings accepted by explicit exceptions (not fixed)`);
+    for (const finding of accepted.slice(0, 20)) lines.push(
+      `  ACCEPTED [${finding.type}] ${terminalText(finding.file || "unknown")}:${finding.lineNumber} \u2014 ${terminalText(finding.suppression.reason)} (expires ${terminalText(finding.suppression.expires)})`
+    );
+    if (accepted.length > 20) lines.push(`  ${accepted.length - 20} more accepted findings; use --format json.`);
+  }
+  if (result.expiredExceptionCount) lines.push(`  ${result.expiredExceptionCount} expired exceptions were not applied; review their findings.`);
+  return lines;
+}
+function exceptionMarkdown(result) {
+  const lines = [];
+  const accepted = result.suppressedFindings || [];
+  if (accepted.length) {
+    lines.push(
+      "",
+      `### Accepted exceptions (${accepted.length})`,
+      "",
+      "These findings remain in the source and were accepted by explicit policy; they were not fixed.",
+      "",
+      "| Rule | Location | Reason | Expires |",
+      "| --- | --- | --- | --- |"
+    );
+    for (const finding of accepted) lines.push(`| ${finding.type} | ${markdownCell(`${finding.file}:${finding.lineNumber}`)} | ${markdownCell(finding.suppression.reason)} | ${markdownCell(finding.suppression.expires)} |`);
+  }
+  if (result.expiredExceptionCount) lines.push("", `${result.expiredExceptionCount} expired exceptions were not applied; review their findings.`);
+  return lines;
 }
 function formatCheckTerminal(result) {
   const lines = [
@@ -1645,10 +1996,11 @@ function formatCheckTerminal(result) {
     `  ${result.filesInspected} files \xB7 ${result.linesInspected} lines inspected`,
     `  ${result.infractions.length} findings to review \xB7 ${result.baselineCount} accepted baseline findings`
   ];
+  lines.push(...exceptionTerminal(result));
   if (result.staleBaselineCount) lines.push(`  ${result.staleBaselineCount} baseline findings no longer present (or now disabled/ignored).`);
   for (const inf of result.infractions.slice(0, 20)) {
     lines.push("", `  ${result.failedRules.includes(inf.type) ? pc.red("FAIL") : pc.yellow("WARN")} [${inf.type}] ${terminalText(inf.file || "unknown")}:${inf.lineNumber}`, `    ${terminalText(inf.lineSnippet || inf.reason)}`);
-    if (inf.suggestion) lines.push(`    Next: ${inf.suggestion}`);
+    if (inf.suggestion) lines.push(`    Next: ${terminalText(inf.suggestion)}`);
   }
   if (result.infractions.length > 20) lines.push(`
   ${result.infractions.length - 20} more findings. Use --format json for the complete report.`);
@@ -1659,7 +2011,7 @@ function formatCheckTerminal(result) {
   return lines.join("\n");
 }
 function markdownCell(value) {
-  return value.replace(/[\\[\]()*_!]/g, "\\$&").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/\|/g, "\\|").replace(/`/g, "&#96;").replace(/[\r\n]/g, " ");
+  return terminalText(value).replace(/[\\[\]*_!]/g, "\\$&").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/\|/g, "\\|").replace(/`/g, "&#96;").replace(/@/g, "&#64;");
 }
 function formatCheckMarkdown(result) {
   const status = !result.complete ? "INCOMPLETE" : result.passed ? "PASSED" : "BLOCKED";
@@ -1672,6 +2024,7 @@ function formatCheckMarkdown(result) {
     "| --- | --- | --- | --- |"
   ];
   for (const inf of result.infractions) lines.push(`| ${inf.type} | ${markdownCell(`${inf.file}:${inf.lineNumber}`)} | ${markdownCell(inf.lineSnippet || inf.reason)} | ${markdownCell(inf.suggestion || "Review this occurrence.")} |`);
+  lines.push(...exceptionMarkdown(result));
   if (result.staleBaselineCount) lines.push("", `${result.staleBaselineCount} baseline findings no longer present (or now disabled/ignored).`);
   for (const skipped of result.skippedFiles) lines.push("", `Not scanned: ${markdownCell(skipped.file)} \u2014 ${markdownCell(skipped.reason)}`);
   return lines.join("\n");
@@ -1685,6 +2038,7 @@ function formatReviewTerminal(result) {
     `  ${result.filesInspected} changed files compared \xB7 ${result.linesInspected} source lines inspected across both versions`,
     `  ${result.infractions.length} new \xB7 ${result.unchangedCount} existing \xB7 ${result.removedFindings.length} no longer detected`
   ];
+  lines.push(...exceptionTerminal(result));
   if (result.policyChanges.length) lines.push("  Candidate policy changes were ignored; adopt them separately after review.");
   if (result.excludedFiles || result.unsupportedFiles) lines.push(`  ${result.excludedFiles} excluded \xB7 ${result.unsupportedFiles} unsupported/non-source changes`);
   for (const finding of result.infractions.slice(0, 20)) {
@@ -1692,7 +2046,7 @@ function formatReviewTerminal(result) {
       "",
       `  ${result.failedRules.includes(finding.type) ? "FAIL" : "WARN"} [${finding.type}] ${terminalText(finding.file || "unknown")}:${finding.lineNumber}`,
       `    ${terminalText(finding.lineSnippet || finding.reason)}`,
-      `    Next: ${finding.suggestion || "Review this occurrence."}`
+      `    Next: ${terminalText(finding.suggestion || "Review this occurrence.")}`
     );
   }
   if (result.infractions.length > 20) lines.push(`  ${result.infractions.length - 20} more new findings; use --format json for all results.`);
@@ -1714,6 +2068,7 @@ function formatReviewMarkdown(result) {
   if (result.policyChanges.length) lines.push("Candidate policy changes were ignored. This review uses the supplied base commit's policy.", "");
   lines.push("| New finding | Head location | Evidence | Next step |", "| --- | --- | --- | --- |");
   for (const finding of result.infractions) lines.push(`| ${finding.type} | ${markdownCell(`${finding.file}:${finding.lineNumber}`)} | ${markdownCell(finding.lineSnippet || finding.reason)} | ${markdownCell(finding.suggestion || "Review this occurrence.")} |`);
+  lines.push(...exceptionMarkdown(result));
   if (result.removedFindings.length) {
     lines.push(
       "",
@@ -1732,8 +2087,10 @@ function formatReviewMarkdown(result) {
 }
 
 // src/init.ts
-import * as fs2 from "fs";
-import * as path2 from "path";
+import * as fs4 from "fs";
+import * as path3 from "path";
+import { randomUUID as randomUUID3 } from "crypto";
+import { spawnSync as spawnSync2 } from "child_process";
 var DEFAULT_CONFIG_TEMPLATE = {
   ignorePaths: [
     "**/*.min.js",
@@ -1776,58 +2133,112 @@ var PRE_COMMIT_HOOK_TEMPLATE = `#!/bin/sh
 # Run agent-roast pre-commit verification
 npx --no-install agent-roast --staged
 `;
-async function initProject(options = {}) {
-  const cwd = path2.resolve(options.cwd || process.cwd());
-  const created = [];
-  const skipped = [];
-  const configPath = path2.join(cwd, ".agentroastrc.json");
-  const altConfigPath = path2.join(cwd, "agent-roast.config.json");
-  if (fs2.existsSync(configPath) || fs2.existsSync(altConfigPath) || fs2.existsSync(path2.join(cwd, ".agentroastrc"))) {
-    skipped.push(".agentroastrc.json");
-  } else {
-    fs2.writeFileSync(
-      configPath,
-      JSON.stringify(DEFAULT_CONFIG_TEMPLATE, null, 2) + "\n",
-      "utf-8"
-    );
-    created.push(".agentroastrc.json");
+function createNewFile(root, relative2, content, mode = 420) {
+  const destination = path3.resolve(root, relative2);
+  const inside = path3.relative(root, destination);
+  if (!inside || inside === ".." || inside.startsWith(".." + path3.sep) || path3.isAbsolute(inside)) throw new ConfigError("Initialization target escapes its allowed directory.");
+  let directory = root;
+  for (const segment of path3.dirname(inside).split(path3.sep).filter((part) => part !== ".")) {
+    directory = path3.join(directory, segment);
+    let stat;
+    try {
+      stat = fs4.lstatSync(directory);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      try {
+        fs4.mkdirSync(directory);
+      } catch (mkdirError) {
+        if (mkdirError.code !== "EEXIST") throw mkdirError;
+      }
+      stat = fs4.lstatSync(directory);
+    }
+    if (!stat.isDirectory() || stat.isSymbolicLink()) throw new ConfigError("Initialization refuses symlinked or non-directory parent paths.");
   }
-  if (options.ci) {
-    const workflowDir = path2.join(cwd, ".github", "workflows");
-    const workflowPath = path2.join(workflowDir, "agent-roast.yml");
-    if (fs2.existsSync(workflowPath)) {
-      skipped.push(".github/workflows/agent-roast.yml");
-    } else {
-      fs2.mkdirSync(workflowDir, { recursive: true });
-      fs2.writeFileSync(workflowPath, GITHUB_WORKFLOW_TEMPLATE, "utf-8");
-      created.push(".github/workflows/agent-roast.yml");
+  const temporary = path3.join(directory, `.agent-roast-init-${randomUUID3()}.tmp`);
+  let fd;
+  try {
+    fd = fs4.openSync(temporary, "wx", mode);
+    fs4.writeFileSync(fd, content);
+    fs4.fsyncSync(fd);
+    fs4.closeSync(fd);
+    fd = void 0;
+    try {
+      fs4.linkSync(temporary, destination);
+    } catch (error) {
+      if (error.code === "EEXIST") return false;
+      throw error;
     }
+    return true;
+  } finally {
+    if (fd !== void 0) fs4.closeSync(fd);
+    fs4.rmSync(temporary, { force: true });
+  }
+}
+var hasEntry = (filename) => {
+  try {
+    fs4.lstatSync(filename);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
   }
+};
+async function initProject(options = {}) {
+  const cwd = fs4.realpathSync(path3.resolve(options.cwd || process.cwd()));
+  const created = [];
+  const skipped = [];
+  const publish = (root, relative2, label, content, mode) => {
+    (createNewFile(root, relative2, content, mode) ? created : skipped).push(label);
+  };
+  if ([".agentroastrc.json", "agent-roast.config.json", ".agentroastrc"].some((name) => hasEntry(path3.join(cwd, name)))) {
+    skipped.push(".agentroastrc.json");
+  } else publish(cwd, ".agentroastrc.json", ".agentroastrc.json", JSON.stringify(DEFAULT_CONFIG_TEMPLATE, null, 2) + "\n");
+  if (options.ci) publish(cwd, ".github/workflows/agent-roast.yml", ".github/workflows/agent-roast.yml", GITHUB_WORKFLOW_TEMPLATE);
   if (options.hook) {
-    const gitDir = path2.join(cwd, ".git");
-    if (!fs2.existsSync(gitDir) || !fs2.statSync(gitDir).isDirectory()) {
-      skipped.push(".git/hooks/pre-commit (no .git directory found)");
+    const run = (...args) => spawnSync2("git", [...HERMETIC_GIT_FLAGS, ...args], {
+      cwd,
+      env: getHermeticGitEnv(),
+      encoding: "utf8",
+      timeout: 3e4,
+      maxBuffer: 8192,
+      windowsHide: true
+    });
+    const common = run("rev-parse", "--git-common-dir");
+    if (common.error || common.status !== 0) {
+      const plainGit = path3.join(cwd, ".git");
+      if (hasEntry(plainGit) && fs4.lstatSync(plainGit).isDirectory() && !fs4.lstatSync(plainGit).isSymbolicLink()) {
+        publish(plainGit, "hooks/pre-commit", ".git/hooks/pre-commit", PRE_COMMIT_HOOK_TEMPLATE, 493);
+      } else skipped.push(".git/hooks/pre-commit (no .git directory found)");
     } else {
-      const hooksDir = path2.join(gitDir, "hooks");
-      const hookPath = path2.join(hooksDir, "pre-commit");
-      if (fs2.existsSync(hookPath)) {
-        skipped.push(".git/hooks/pre-commit");
-      } else {
-        fs2.mkdirSync(hooksDir, { recursive: true });
-        fs2.writeFileSync(hookPath, PRE_COMMIT_HOOK_TEMPLATE, {
-          encoding: "utf-8",
-          mode: 493
-        });
-        created.push(".git/hooks/pre-commit");
-      }
+      const commonDir = fs4.realpathSync(path3.resolve(cwd, gitOutputPath(common.stdout)));
+      const hooks = run("rev-parse", "--git-path", "hooks");
+      if (hooks.error || hooks.status !== 0) throw new ConfigError("Cannot resolve this repository's hooks directory.");
+      const hookDir = path3.resolve(cwd, gitOutputPath(hooks.stdout));
+      const relative2 = path3.relative(commonDir, path3.join(hookDir, "pre-commit"));
+      if (!relative2 || relative2 === ".." || relative2.startsWith(".." + path3.sep) || path3.isAbsolute(relative2)) {
+        skipped.push(".git/hooks/pre-commit (custom hooks path outside repository metadata; install manually)");
+      } else publish(commonDir, relative2, ".git/hooks/pre-commit", PRE_COMMIT_HOOK_TEMPLATE, 493);
     }
   }
   return { created, skipped };
 }
 
 // src/badge.ts
+function displayText(value) {
+  return value.replace(
+    /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/g,
+    (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`
+  );
+}
+function xmlText(value) {
+  return displayText(value).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function badgeScore(score) {
+  return score !== null && Number.isFinite(score) && score >= 0 && score <= 100 ? score : null;
+}
 function getScoreColor(score) {
-  if (score === null || isNaN(score)) {
+  score = badgeScore(score);
+  if (score === null) {
     return { name: "lightgrey", hex: "#9f9f9f" };
   }
   if (score >= 90) return { name: "brightgreen", hex: "#4c1" };
@@ -1837,14 +2248,16 @@ function getScoreColor(score) {
   return { name: "red", hex: "#e05d44" };
 }
 function generateSvgBadge(score, label = "AI Discipline") {
-  const value = score !== null && !isNaN(score) ? `${score}/100` : "N/A";
+  score = badgeScore(score);
+  const value = score !== null ? `${score}/100` : "N/A";
   const color = getScoreColor(score);
+  const safeLabel = xmlText(label);
   const labelWidth = Math.round(label.length * 6.8 + 14);
   const valueWidth = Math.round(value.length * 7.2 + 14);
   const totalWidth = labelWidth + valueWidth;
   const labelX = Math.round(labelWidth / 2);
   const valueX = Math.round(labelWidth + valueWidth / 2);
-  return `<svg xmlns="http://www.w3.org/2000/svg" width="${totalWidth}" height="20" role="img" aria-label="${label}: ${value}">
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="${totalWidth}" height="20" role="img" aria-label="${safeLabel}: ${value}">
   <linearGradient id="s" x2="0" y2="100%">
     <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
     <stop offset="1" stop-opacity=".1"/>
@@ -1858,22 +2271,31 @@ function generateSvgBadge(score, label = "AI Discipline") {
     <rect width="${totalWidth}" height="20" fill="url(#s)"/>
   </g>
   <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110">
-    <text aria-hidden="true" x="${labelX * 10}" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="${(labelWidth - 14) * 10}">${label}</text>
-    <text x="${labelX * 10}" y="140" transform="scale(.1)" fill="#fff" textLength="${(labelWidth - 14) * 10}">${label}</text>
+    <text aria-hidden="true" x="${labelX * 10}" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="${(labelWidth - 14) * 10}">${safeLabel}</text>
+    <text x="${labelX * 10}" y="140" transform="scale(.1)" fill="#fff" textLength="${(labelWidth - 14) * 10}">${safeLabel}</text>
     <text aria-hidden="true" x="${valueX * 10}" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="${(valueWidth - 14) * 10}">${value}</text>
     <text x="${valueX * 10}" y="140" transform="scale(.1)" fill="#fff" textLength="${(valueWidth - 14) * 10}">${value}</text>
   </g>
 </svg>`;
 }
 function generateShieldsMarkdown(score, label = "AI Discipline", repoUrl = "https://github.com/Nari-Ab/agent-roast") {
-  const value = score !== null && !isNaN(score) ? `${score}%2F100` : "N%2FA";
+  score = badgeScore(score);
+  const value = score !== null ? `${score}%2F100` : "N%2FA";
   const color = getScoreColor(score);
-  const encodedLabel = encodeURIComponent(label);
+  const shownLabel = displayText(label);
+  const encodedLabel = encodeURIComponent(shownLabel.replace(/-/g, "--").replace(/_/g, "__"));
+  const alt = shownLabel.replace(/[\\[\]*_!`]/g, "\\$&").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  const destination = new URL(repoUrl);
+  if (!["https:", "http:"].includes(destination.protocol) || destination.username || destination.password) {
+    throw new Error("Badge destination must be an HTTP(S) URL without credentials.");
+  }
+  const safeDestination = destination.href.replace(/[()\\]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`);
   const badgeUrl = `https://img.shields.io/badge/${encodedLabel}-${value}-${color.name}?style=flat-square`;
-  return `[![${label}](${badgeUrl})](${repoUrl})`;
+  return `[![${alt}](${badgeUrl})](${safeDestination})`;
 }
 function generateShieldsJson(score, label = "AI Discipline") {
-  const value = score !== null && !isNaN(score) ? `${score}/100` : "N/A";
+  score = badgeScore(score);
+  const value = score !== null ? `${score}/100` : "N/A";
   const color = getScoreColor(score);
   return {
     schemaVersion: 1,
@@ -1885,111 +2307,22 @@ function generateShieldsJson(score, label = "AI Discipline") {
 
 // src/sarif.ts
 import { createRequire } from "module";
-
-// src/baseline.ts
-import { createHash, randomUUID } from "crypto";
-import * as fs3 from "fs";
-import path3 from "path";
-function findingFingerprint(finding) {
-  return createHash("sha256").update(JSON.stringify([finding.type, finding.file, finding.lineSnippet?.trim()])).digest("hex");
-}
-function createBaseline(findings) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const finding of findings) {
-    const fingerprint = findingFingerprint(finding);
-    counts.set(fingerprint, (counts.get(fingerprint) || 0) + 1);
-  }
-  return {
-    schemaVersion: "1.0.0",
-    fingerprintVersion: 1,
-    entries: [...counts].sort(([a], [b]) => a.localeCompare(b)).map(([fingerprint, count]) => ({ fingerprint, count }))
-  };
-}
-function loadBaseline(filename) {
-  try {
-    const stat = fs3.lstatSync(filename);
-    if (!stat.isFile() || stat.size > 5 * 1024 * 1024) throw new Error("Expected a regular baseline file under 5 MiB.");
-    const fd = fs3.openSync(filename, fs3.constants.O_RDONLY | (fs3.constants.O_NOFOLLOW || 0));
-    let content;
-    try {
-      const opened = fs3.fstatSync(fd);
-      if (opened.ino !== stat.ino || opened.dev !== stat.dev) throw new Error("Baseline changed while opening.");
-      const buffer = Buffer.alloc(5 * 1024 * 1024 + 1);
-      let size = 0;
-      while (size < buffer.length) {
-        const read = fs3.readSync(fd, buffer, size, buffer.length - size, null);
-        if (!read) break;
-        size += read;
-      }
-      const after = fs3.fstatSync(fd);
-      if (size > 5 * 1024 * 1024 || size !== after.size || opened.mtimeMs !== after.mtimeMs) throw new Error("Baseline changed or exceeded the size limit.");
-      content = buffer.subarray(0, size).toString("utf8");
-    } finally {
-      fs3.closeSync(fd);
-    }
-    const parsed = JSON.parse(content);
-    if (!parsed || parsed.schemaVersion !== "1.0.0" || parsed.fingerprintVersion !== 1 || !Array.isArray(parsed.entries) || parsed.entries.length > 1e5) {
-      throw new Error("Unsupported baseline schema.");
-    }
-    const seen = /* @__PURE__ */ new Set();
-    for (const entry of parsed.entries) {
-      if (!entry || typeof entry.fingerprint !== "string" || !/^[a-f0-9]{64}$/.test(entry.fingerprint) || !Number.isSafeInteger(entry.count) || entry.count <= 0 || entry.count > 1e6 || seen.has(entry.fingerprint)) {
-        throw new Error("Invalid or duplicate baseline entry.");
-      }
-      seen.add(entry.fingerprint);
-    }
-    return parsed;
-  } catch (error) {
-    throw new ConfigError(`Cannot load baseline '${filename}': ${error instanceof Error ? error.message : String(error)}`);
-  }
-}
-function applyBaseline(findings, baseline) {
-  const remaining = new Map(baseline.entries.map((entry) => [entry.fingerprint, entry.count]));
-  const fresh = [];
-  let baselineCount = 0;
-  for (const finding of findings) {
-    const fingerprint = findingFingerprint(finding);
-    const count = remaining.get(fingerprint) || 0;
-    if (count > 0) {
-      remaining.set(fingerprint, count - 1);
-      baselineCount++;
-    } else {
-      fresh.push(finding);
-    }
-  }
-  return { findings: fresh, baselineCount, staleBaselineCount: [...remaining.values()].reduce((a, b) => a + b, 0) };
-}
-function writeBaseline(filename, findings) {
-  const destination = path3.resolve(filename);
-  const temporary = path3.join(path3.dirname(destination), `.agent-roast-${randomUUID()}.tmp`);
-  let fd;
-  try {
-    fd = fs3.openSync(temporary, "wx", 384);
-    fs3.writeFileSync(fd, JSON.stringify(createBaseline(findings), null, 2) + "\n");
-    fs3.fsyncSync(fd);
-    fs3.closeSync(fd);
-    fd = void 0;
-    fs3.linkSync(temporary, destination);
-  } catch (error) {
-    throw new ConfigError(`Cannot write baseline '${filename}' (existing files are preserved): ${error instanceof Error ? error.message : String(error)}`);
-  } finally {
-    if (fd !== void 0) fs3.closeSync(fd);
-    fs3.rmSync(temporary, { force: true });
-  }
-}
-
-// src/sarif.ts
 var require2 = createRequire(import.meta.url);
 var version = require2("../package.json").version;
 function formatSarif(report) {
   const occurrences = /* @__PURE__ */ new Map();
-  const results = report.infractions.map((finding) => {
+  const allFindings = [
+    ...report.infractions.map((finding) => ({ finding, suppression: void 0 })),
+    ...(report.suppressedFindings ?? []).map((finding) => ({ finding, suppression: finding.suppression }))
+  ];
+  allFindings.sort((a, b) => (a.finding.file ?? "").localeCompare(b.finding.file ?? "") || (a.finding.lineNumber ?? 1) - (b.finding.lineNumber ?? 1) || a.finding.type.localeCompare(b.finding.type));
+  const results = allFindings.map(({ finding, suppression }) => {
     const filename = finding.file;
     if (!filename || filename.startsWith("/") || filename.split("/").includes("..") || /^[a-z]:/i.test(filename)) {
       throw new ConfigError("SARIF needs repository-relative finding paths.");
     }
     const fingerprint = findingFingerprint(finding);
-    const occurrence = (occurrences.get(fingerprint) || 0) + 1;
+    const occurrence = finding.occurrence ?? (occurrences.get(fingerprint) || 0) + 1;
     occurrences.set(fingerprint, occurrence);
     return {
       ruleId: finding.type,
@@ -2001,6 +2334,11 @@ function formatSarif(report) {
         region: { startLine: Math.max(1, finding.lineNumber || 1) }
       } }],
       partialFingerprints: { "agentRoastFinding/v1": `${fingerprint}:${occurrence}` },
+      ...suppression ? { suppressions: [{
+        kind: "external",
+        status: "accepted",
+        justification: `${suppression.reason} (expires ${suppression.expires}, UTC)`
+      }] } : {},
       ...report.mode === "review" ? { baselineState: "new" } : {}
     };
   });
@@ -2040,156 +2378,31 @@ Example: ${RULE_GUIDES[rule].example}` },
         mergeBaseSha: report.mergeBaseSha,
         policySha: report.policySha,
         unchangedFindings: report.unchangedCount,
-        removedFindings: report.removedFindings.length
-      } : { scope: "current source", acceptedBaselineFindings: report.baselineCount }
+        removedFindings: report.removedFindings.length,
+        acceptedExceptions: report.suppressedFindings?.length ?? 0,
+        expiredExceptions: report.expiredExceptionCount ?? 0
+      } : { scope: "current source", acceptedBaselineFindings: report.baselineCount, acceptedExceptions: report.suppressedFindings?.length ?? 0, expiredExceptions: report.expiredExceptionCount ?? 0 }
     }]
   }, null, 2);
 }
 
 // src/check.ts
-import { spawnSync as spawnSync2 } from "child_process";
-import * as fs4 from "fs/promises";
+import * as fs6 from "fs/promises";
 import { constants as constants2 } from "fs";
-import path4 from "path";
-var MAX_FILE_BYTES = 2 * 1024 * 1024;
-var MAX_SCAN_BYTES = 50 * 1024 * 1024;
-var GENERATED_PATHS = ["**/node_modules/**", "**/dist/**", "**/build/**", "**/vendor/**", "**/*.min.js", "**/*.map"];
-function git(cwd, args) {
-  const result = spawnSync2("git", [...HERMETIC_GIT_FLAGS, ...args], {
-    cwd,
-    env: getHermeticGitEnv(),
-    encoding: "utf8",
-    maxBuffer: 16 * 1024 * 1024,
-    windowsHide: true
-  });
-  if (result.error || result.status !== 0) throw new GitError(result.error?.message || result.stderr, result.status);
-  return result.stdout;
-}
-function checkAborted(signal) {
-  if (signal?.aborted) throw new ConfigError("Project check cancelled; no complete result was produced.");
-}
-function insideRoot(root, filename) {
-  const relative = path4.relative(root, filename);
-  return relative.length > 0 && relative !== ".." && !relative.startsWith(".." + path4.sep) && !path4.isAbsolute(relative);
-}
-async function readSource(root, file, signal) {
-  const filename = path4.resolve(root, file);
-  if (!insideRoot(root, filename)) throw new Error("File escapes the repository.");
-  let stat;
-  try {
-    stat = await fs4.lstat(filename);
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-  if (!stat.isFile() || stat.isSymbolicLink()) throw new Error("Symlinks and special files are not scanned.");
-  const real = await fs4.realpath(filename);
-  if (!insideRoot(root, real)) throw new Error("File resolves outside the repository.");
-  if (stat.size > MAX_FILE_BYTES) throw new Error("File exceeds the 2 MiB scan limit.");
-  const handle = await fs4.open(filename, constants2.O_RDONLY | (constants2.O_NOFOLLOW || 0));
-  try {
-    const opened = await handle.stat();
-    if (opened.ino !== stat.ino || opened.dev !== stat.dev || !opened.isFile()) throw new Error("File changed while opening.");
-    const chunks = [];
-    let size = 0;
-    while (true) {
-      checkAborted(signal);
-      const chunk = Buffer.alloc(Math.min(64 * 1024, MAX_FILE_BYTES + 1 - size));
-      const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);
-      if (!bytesRead) break;
-      size += bytesRead;
-      if (size > MAX_FILE_BYTES) throw new Error("File exceeds the 2 MiB scan limit.");
-      chunks.push(chunk.subarray(0, bytesRead));
-    }
-    const after = await handle.stat();
-    if (after.size !== opened.size || after.mtimeMs !== opened.mtimeMs || size !== after.size) throw new Error("File changed while reading; rerun the check.");
-    return Buffer.concat(chunks);
-  } finally {
-    await handle.close();
-  }
-}
-async function checkProject(options = {}) {
-  checkAborted(options.signal);
-  const cwd = path4.resolve(options.cwd || process.cwd());
-  const root = await fs4.realpath(git(cwd, ["rev-parse", "--show-toplevel"]).trim());
-  const config = loadConfig(root);
-  const failOn = options.failOn ?? config.failOn ?? ["test-skip", "trivial-assert", "test-focus"];
-  for (const rule of failOn) if (!VALID_DETECTORS.includes(rule)) throw new ConfigError(`Unknown rule '${rule}'.`);
-  const format = options.format || "terminal";
-  if (!["terminal", "json", "github", "markdown", "sarif"].includes(format)) throw new ConfigError("Unsupported check output format.");
-  const baseline = options.baseline ? loadBaseline(path4.resolve(cwd, options.baseline)) : void 0;
-  const filenames = [...new Set(git(root, ["ls-files", "--cached", "--others", "--exclude-standard", "-z"]).split("\0").filter(Boolean))].sort();
-  const infractions = [];
-  const skippedFiles = [];
-  let filesInspected = 0;
-  let linesInspected = 0;
-  let totalBytes = 0;
-  for (const file of filenames) {
-    checkAborted(options.signal);
-    if (!isCodeFile(file, [...GENERATED_PATHS, ...config.ignorePaths || []])) continue;
-    try {
-      const content = await readSource(root, file, options.signal);
-      if (content === null) continue;
-      totalBytes += content.length;
-      if (totalBytes > MAX_SCAN_BYTES) throw new Error("Project exceeds the 50 MiB scan limit.");
-      if (content.includes(0)) throw new Error("Binary content in a source file.");
-      const text = new TextDecoder("utf-8", { fatal: true }).decode(content);
-      const lines = text.split(/\r?\n/);
-      if (lines[lines.length - 1] === "") lines.pop();
-      const audit = auditFileDiffs([{ path: file, addedLines: lines.map((line, index) => ({ line, lineNumber: index + 1 })) }], "WORKTREE", "", { rules: config.rules });
-      infractions.push(...audit.infractions);
-      filesInspected++;
-      linesInspected += lines.length;
-    } catch (error) {
-      checkAborted(options.signal);
-      skippedFiles.push({ file, reason: error instanceof Error ? error.message : String(error) });
-      if (totalBytes > MAX_SCAN_BYTES) break;
-    }
-  }
-  checkAborted(options.signal);
-  const applied = baseline ? applyBaseline(infractions, baseline) : { findings: infractions, baselineCount: 0, staleBaselineCount: 0 };
-  const findings = applied.findings;
-  const failedRules = [...new Set(findings.filter((finding) => failOn.includes(finding.type)).map((finding) => finding.type))];
-  const complete = skippedFiles.length === 0;
-  const passed = complete && failedRules.length === 0;
-  const result = {
-    schemaVersion: "1.0.0",
-    mode: "check",
-    filesInspected,
-    linesInspected,
-    totalFindings: infractions.length,
-    infractions: findings,
-    baselineCount: applied.baselineCount,
-    staleBaselineCount: applied.staleBaselineCount,
-    skippedFiles,
-    complete,
-    failedRules,
-    passed,
-    exitCode: complete ? passed ? 0 : 1 : 2,
-    output: ""
-  };
-  if (format === "json") result.output = JSON.stringify(result, null, 2);
-  else if (format === "sarif") result.output = formatSarif(result);
-  else if (format === "markdown") result.output = formatCheckMarkdown(result);
-  else if (format === "github") {
-    result.output = formatGithubAnnotations(result) + (complete ? "" : "\n::error::Project scan incomplete. See the JSON or terminal report for skipped files.");
-  } else result.output = formatCheckTerminal(result);
-  return result;
-}
-
-// src/review.ts
 import path5 from "path";
 
 // src/snapshot.ts
 import { createHash as createHash2 } from "crypto";
+import * as fs5 from "fs/promises";
+import path4 from "path";
 import { spawn as spawn2 } from "child_process";
 function assertNotAborted(signal) {
   if (signal?.aborted) throw new ConfigError("Review cancelled; no complete result was produced.");
 }
-async function readGit(cwd, args, signal, limit = 8 * 1024 * 1024) {
+async function readGit(cwd, args, signal, limit = 8 * 1024 * 1024, indexFile) {
   assertNotAborted(signal);
   const env = getHermeticGitEnv({ GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1", GIT_TERMINAL_PROMPT: "0" });
-  for (const key of ["GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR", "GIT_NAMESPACE", "GIT_INDEX_FILE", "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES"]) delete env[key];
+  if (indexFile) env.GIT_INDEX_FILE = indexFile;
   return new Promise((resolve2, reject) => {
     const child = spawn2("git", [...HERMETIC_GIT_FLAGS, ...args], {
       cwd,
@@ -2228,7 +2441,7 @@ async function readGit(cwd, args, signal, limit = 8 * 1024 * 1024) {
     if (signal?.aborted) abort();
   });
 }
-async function requireLocalObjects(cwd, signal) {
+async function requireLocalObjects2(cwd, signal) {
   try {
     const promises = (await readGit(cwd, ["config", "--type=bool", "--get-regexp", "^remote\\..*\\.promisor$"], signal, 64 * 1024)).toString();
     if (promises.split("\n").some((line) => /\s+(?:true|yes|on|1)\s*$/i.test(line))) {
@@ -2248,7 +2461,7 @@ async function reviewRefs(cwd, base, head, signal) {
       throw new ConfigError(`Cannot resolve review ref '${ref}'. Use valid commits and fetch complete history (actions/checkout fetch-depth: 0). ${error instanceof Error ? error.message : String(error)}`);
     }
   };
-  await requireLocalObjects(cwd, signal);
+  await requireLocalObjects2(cwd, signal);
   const baseSha = await resolve2(base);
   const headSha = await resolve2(head);
   let ancestors;
@@ -2303,7 +2516,19 @@ async function reviewPolicy(cwd, baseSha, signal) {
   return { config: configFromText("{}", "default review policy"), filename: null };
 }
 async function stagedSnapshot(cwd, signal) {
-  await requireLocalObjects(cwd, signal);
+  await requireLocalObjects2(cwd, signal);
+  let indexFile;
+  if (process.env.GIT_INDEX_FILE) {
+    const gitDirectory = await fs5.realpath(gitOutputPath((await readGit(cwd, ["rev-parse", "--absolute-git-dir"], signal, 8192)).toString()));
+    const requested = path4.resolve(cwd, process.env.GIT_INDEX_FILE);
+    const stat = await fs5.lstat(requested);
+    const resolved = await fs5.realpath(requested);
+    const relative2 = path4.relative(gitDirectory, resolved);
+    if (!stat.isFile() || stat.isSymbolicLink() || !relative2 || relative2 === ".." || relative2.startsWith(".." + path4.sep) || path4.isAbsolute(relative2)) {
+      throw new ConfigError("GIT_INDEX_FILE must be a regular candidate index inside this repository's Git directory; refusing to review another index.");
+    }
+    indexFile = resolved;
+  }
   const head = async () => {
     try {
       return (await readGit(cwd, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"], signal, 1024)).toString().trim();
@@ -2336,8 +2561,8 @@ async function stagedSnapshot(cwd, signal) {
     "--end-of-options",
     ...baseSha === "EMPTY" ? [] : [baseSha],
     "--"
-  ], signal);
-  const conflicts = await readGit(cwd, ["ls-files", "--unmerged", "-z", "--full-name"], signal);
+  ], signal, 8 * 1024 * 1024, indexFile);
+  const conflicts = await readGit(cwd, ["ls-files", "--unmerged", "-z", "--full-name"], signal, 8 * 1024 * 1024, indexFile);
   if (conflicts.length) throw new ConfigError("Resolve unmerged index entries before reviewing staged changes.");
   const pinned = await inventory();
   const changes = parseTreeChanges(pinned);
@@ -2356,7 +2581,137 @@ async function stagedSnapshot(cwd, signal) {
   };
 }
 
+// src/check.ts
+var MAX_FILE_BYTES = 2 * 1024 * 1024;
+var MAX_SCAN_BYTES = 50 * 1024 * 1024;
+var GENERATED_PATHS = ["**/node_modules/**", "**/dist/**", "**/build/**", "**/vendor/**", "**/*.min.js", "**/*.map"];
+async function git(cwd, args, signal) {
+  return new TextDecoder("utf-8", { fatal: true }).decode(await readGit(cwd, args, signal, 16 * 1024 * 1024));
+}
+function checkAborted(signal) {
+  if (signal?.aborted) throw new ConfigError("Project check cancelled; no complete result was produced.");
+}
+function insideRoot(root, filename) {
+  const relative2 = path5.relative(root, filename);
+  return relative2.length > 0 && relative2 !== ".." && !relative2.startsWith(".." + path5.sep) && !path5.isAbsolute(relative2);
+}
+async function readSource(root, file, signal) {
+  const filename = path5.resolve(root, file);
+  if (!insideRoot(root, filename)) throw new Error("File escapes the repository.");
+  let stat;
+  try {
+    stat = await fs6.lstat(filename);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  if (!stat.isFile() || stat.isSymbolicLink()) throw new Error("Symlinks and special files are not scanned.");
+  const real = await fs6.realpath(filename);
+  if (!insideRoot(root, real)) throw new Error("File resolves outside the repository.");
+  if (stat.size > MAX_FILE_BYTES) throw new Error("File exceeds the 2 MiB scan limit.");
+  const handle = await fs6.open(filename, constants2.O_RDONLY | (constants2.O_NOFOLLOW || 0) | (constants2.O_NONBLOCK || 0));
+  try {
+    const opened = await handle.stat();
+    if (opened.ino !== stat.ino || opened.dev !== stat.dev || !opened.isFile()) throw new Error("File changed while opening.");
+    const chunks = [];
+    let size = 0;
+    while (true) {
+      checkAborted(signal);
+      const chunk = Buffer.alloc(Math.min(64 * 1024, MAX_FILE_BYTES + 1 - size));
+      const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);
+      if (!bytesRead) break;
+      size += bytesRead;
+      if (size > MAX_FILE_BYTES) throw new Error("File exceeds the 2 MiB scan limit.");
+      chunks.push(chunk.subarray(0, bytesRead));
+    }
+    const after = await handle.stat();
+    if (after.size !== opened.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs || size !== after.size) throw new Error("File changed while reading; rerun the check.");
+    return Buffer.concat(chunks);
+  } finally {
+    await handle.close();
+  }
+}
+async function checkProject(options = {}) {
+  checkAborted(options.signal);
+  const cwd = path5.resolve(options.cwd || process.cwd());
+  const root = await fs6.realpath(gitOutputPath(await git(cwd, ["rev-parse", "--show-toplevel"], options.signal)));
+  const config = loadConfig(root);
+  const failOn = options.failOn ?? config.failOn ?? ["test-skip", "trivial-assert", "test-focus"];
+  for (const rule of failOn) if (!VALID_DETECTORS.includes(rule)) throw new ConfigError(`Unknown rule '${rule}'.`);
+  const format = options.format || "terminal";
+  if (!["terminal", "json", "github", "markdown", "sarif"].includes(format)) throw new ConfigError("Unsupported check output format.");
+  const baseline = options.baseline ? loadBaseline(path5.resolve(cwd, options.baseline)) : void 0;
+  const filenames = [...new Set((await git(root, ["ls-files", "--cached", "--others", "--exclude-standard", "-z"], options.signal)).split("\0").filter(Boolean))].sort();
+  const infractions = [];
+  const skippedFiles = [];
+  let filesInspected = 0;
+  let linesInspected = 0;
+  let totalBytes = 0;
+  for (const file of filenames) {
+    checkAborted(options.signal);
+    if (!isCodeFile(file, [...GENERATED_PATHS, ...config.ignorePaths || []])) continue;
+    try {
+      const content = await readSource(root, file, options.signal);
+      if (content === null) continue;
+      totalBytes += content.length;
+      if (totalBytes > MAX_SCAN_BYTES) throw new Error("Project exceeds the 50 MiB scan limit.");
+      if (content.includes(0)) throw new Error("Binary content in a source file.");
+      const text = new TextDecoder("utf-8", { fatal: true }).decode(content);
+      const lines = text.split(/\r?\n/);
+      if (lines[lines.length - 1] === "") lines.pop();
+      const audit = auditFileDiffs([{ path: file, addedLines: lines.map((line, index) => ({ line, lineNumber: index + 1 })) }], "WORKTREE", "", { rules: config.rules });
+      infractions.push(...audit.infractions);
+      filesInspected++;
+      linesInspected += lines.length;
+    } catch (error) {
+      checkAborted(options.signal);
+      skippedFiles.push({ file, reason: error instanceof Error ? error.message : String(error) });
+      if (totalBytes > MAX_SCAN_BYTES) break;
+    }
+  }
+  checkAborted(options.signal);
+  const applied = baseline ? applyBaseline(infractions, baseline) : { findings: infractions, baselineCount: 0, staleBaselineCount: 0 };
+  const notInBaseline = new Set(applied.findings);
+  const acceptedCounts = /* @__PURE__ */ new Map();
+  for (const finding of infractions) {
+    if (notInBaseline.has(finding)) continue;
+    const fingerprint = findingFingerprint(finding);
+    acceptedCounts.set(fingerprint, (acceptedCounts.get(fingerprint) ?? 0) + 1);
+  }
+  const exceptions = applyExceptions(applied.findings, options.ignoreExceptions ? [] : config.exceptions, /* @__PURE__ */ new Date(), acceptedCounts);
+  const findings = exceptions.findings;
+  const failedRules = [...new Set(findings.filter((finding) => failOn.includes(finding.type)).map((finding) => finding.type))];
+  const complete = skippedFiles.length === 0;
+  const passed = complete && failedRules.length === 0;
+  const result = {
+    schemaVersion: "1.0.0",
+    mode: "check",
+    filesInspected,
+    linesInspected,
+    totalFindings: infractions.length,
+    infractions: findings,
+    baselineCount: applied.baselineCount,
+    staleBaselineCount: applied.staleBaselineCount,
+    suppressedFindings: exceptions.suppressedFindings,
+    expiredExceptionCount: exceptions.expiredExceptionCount,
+    skippedFiles,
+    complete,
+    failedRules,
+    passed,
+    exitCode: complete ? passed ? 0 : 1 : 2,
+    output: ""
+  };
+  if (format === "json") result.output = JSON.stringify(result, null, 2);
+  else if (format === "sarif") result.output = formatSarif(result);
+  else if (format === "markdown") result.output = formatCheckMarkdown(result);
+  else if (format === "github") {
+    result.output = formatGithubAnnotations(result) + (complete ? "" : "\n::error::Project scan incomplete. See the JSON or terminal report for skipped files.");
+  } else result.output = formatCheckTerminal(result);
+  return result;
+}
+
 // src/review.ts
+import path6 from "path";
 var GENERATED_PATHS2 = ["**/node_modules/**", "**/dist/**", "**/build/**", "**/vendor/**", "**/*.min.js", "**/*.map"];
 var MAX_SCAN_BYTES2 = 50 * 1024 * 1024;
 function compareFindings(before, after, newPath) {
@@ -2386,7 +2741,7 @@ function reviewStagedChanges(options = {}) {
 }
 async function compareSourceChanges(options) {
   assertNotAborted(options.signal);
-  const cwd = path5.resolve(options.cwd || process.cwd());
+  const cwd = path6.resolve(options.cwd || process.cwd());
   const staged = options.staged ? await stagedSnapshot(cwd, options.signal) : void 0;
   const refs = options.staged ? { baseSha: staged.baseSha, headSha: staged.headSha, mergeBaseSha: staged.mergeBaseSha } : await reviewRefs(cwd, options.base, options.head ?? "HEAD", options.signal);
   const policy = refs.baseSha === "EMPTY" ? { config: configFromText("{}", "default first-commit policy"), filename: null } : await reviewPolicy(cwd, refs.baseSha, options.signal);
@@ -2424,6 +2779,7 @@ async function compareSourceChanges(options) {
     output: ""
   };
   let totalBytes = 0;
+  const existingCounts = /* @__PURE__ */ new Map();
   for (const change of changes) {
     assertNotAborted(options.signal);
     const oldSupported = change.oldMode !== "000000" && isCodeFile(change.oldPath);
@@ -2459,6 +2815,12 @@ async function compareSourceChanges(options) {
       const before = await scan(change.oldMode, change.oldOid, change.oldPath, refs.mergeBaseSha);
       const after = await scan(change.newMode, change.newOid, change.newPath, refs.headSha);
       const compared = compareFindings(before, after, change.newPath);
+      const introduced = new Set(compared.introduced);
+      for (const finding of after) {
+        if (introduced.has(finding)) continue;
+        const fingerprint = findingFingerprint(finding);
+        existingCounts.set(fingerprint, (existingCounts.get(fingerprint) ?? 0) + 1);
+      }
       result.infractions.push(...compared.introduced);
       result.removedFindings.push(...compared.removed);
       result.unchangedCount += compared.unchanged;
@@ -2475,6 +2837,10 @@ async function compareSourceChanges(options) {
   assertNotAborted(options.signal);
   await staged?.verify();
   result.complete = result.skippedFiles.length === 0;
+  const exceptions = applyExceptions(result.infractions, options.ignoreExceptions ? [] : policy.config.exceptions, /* @__PURE__ */ new Date(), existingCounts);
+  result.infractions = exceptions.findings;
+  result.suppressedFindings = exceptions.suppressedFindings;
+  result.expiredExceptionCount = exceptions.expiredExceptionCount;
   result.failedRules = [...new Set(result.infractions.filter((finding) => failOn.includes(finding.type)).map((finding) => finding.type))];
   result.passed = result.complete && result.failedRules.length === 0;
   result.exitCode = !result.complete ? 2 : result.passed ? 0 : 1;
@@ -2494,9 +2860,9 @@ var InvalidDetectorError = class extends Error {
   }
 };
 async function roastRepository(options = {}) {
-  const cwd = path6.resolve(options.cwd || process.cwd());
+  const cwd = path7.resolve(options.cwd || process.cwd());
   const since = options.since || "90 days ago";
-  const repoName = path6.basename(cwd);
+  const repoName = path7.basename(cwd);
   const collector = new MetricsCollector({ all: options.all, ignorePaths: options.ignorePaths, rules: options.rules, panicLoopWindowMinutes: options.panicLoopWindowMinutes });
   const gitStream = streamGitLog(cwd, since);
   await parseGitLogStream(gitStream, (commit, stats) => {
@@ -2511,7 +2877,7 @@ async function roastRepository(options = {}) {
   return { summary, output };
 }
 async function auditPullRequest(options) {
-  const cwd = path6.resolve(options.cwd || process.cwd());
+  const cwd = path7.resolve(options.cwd || process.cwd());
   const format = options.format || "terminal";
   const failOn = (options.failOn || ["test-skip"]).map((s) => s.trim()).filter(Boolean);
   for (const det of failOn) {
@@ -2530,15 +2896,26 @@ async function auditPullRequest(options) {
   const baseSha = options.staged ? "INDEX" : resolveCommitSha(cwd, options.base, "Base ref");
   const headSha = options.staged ? "INDEX" : resolveCommitSha(cwd, options.head || "HEAD", "Head ref");
   const mergeBaseSha = options.staged ? "INDEX" : findMergeBase(cwd, baseSha, headSha);
+  if (!["terminal", "json", "github", "markdown"].includes(format)) throw new InvalidDetectorError("Unsupported legacy audit output format.");
   const diffStream = streamGitDiff(cwd, mergeBaseSha, headSha, options.staged);
-  let rawDiff = "";
+  const chunks = [];
+  let bytes = 0;
   await new Promise((resolve2, reject) => {
     diffStream.on("data", (chunk) => {
-      rawDiff += chunk.toString();
+      bytes += chunk.length;
+      if (bytes > 50 * 1024 * 1024) {
+        diffStream.destroy(new GitResolutionError("Legacy diff exceeds the 50 MiB limit; use a smaller context review."));
+      } else chunks.push(chunk);
     });
-    diffStream.on("end", () => resolve2());
+    diffStream.on("end", resolve2);
     diffStream.on("error", reject);
   });
+  let rawDiff;
+  try {
+    rawDiff = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks));
+  } catch {
+    throw new GitResolutionError("Legacy diff contains invalid UTF-8; no complete result was produced.");
+  }
   const { files, skippedLongLines, skippedUnknownFiles } = parseDiff(rawDiff);
   const audit = auditFileDiffs(files, headSha, (/* @__PURE__ */ new Date()).toISOString(), { ignorePaths: options.ignorePaths, rules: options.rules });
   const infractions = audit.infractions;
@@ -2546,8 +2923,10 @@ async function auditPullRequest(options) {
   const failedRules = [...new Set(
     infractions.filter((inf) => failOn.includes(inf.type)).map((inf) => inf.type)
   )];
-  const passed = failedRules.length === 0;
-  const exitCode = passed ? 0 : 1;
+  const skippedBinaryFiles = files.filter((file) => file.binary && isCodeFile(file.path, options.ignorePaths)).length;
+  const complete = skippedLongLines === 0 && skippedUnknownFiles === 0 && skippedBinaryFiles === 0;
+  const passed = complete && failedRules.length === 0;
+  const exitCode = !complete ? 2 : passed ? 0 : 1;
   const result = {
     schemaVersion: "1.0.0",
     mode: options.staged ? "staged" : "pr",
@@ -2561,15 +2940,17 @@ async function auditPullRequest(options) {
     infractions,
     failedRules,
     passed,
+    complete,
     skippedLongLines,
     skippedUnknownFiles,
+    skippedBinaryFiles,
     output: "",
     exitCode
   };
   if (format === "json") {
     result.output = JSON.stringify(result, null, 2);
   } else if (format === "github") {
-    result.output = formatGithubAnnotations(result);
+    result.output = formatGithubAnnotations(result) + (complete ? "" : "\n::error::Legacy audit incomplete: long lines, binary-marked or unparsed source were skipped. Use context review.");
   } else if (format === "markdown") {
     result.output = formatPrMarkdownComment(result);
   } else {
@@ -2579,12 +2960,28 @@ async function auditPullRequest(options) {
 }
 
 export {
+  VALID_DETECTORS,
+  findingFingerprint,
+  createBaseline,
+  loadBaseline,
+  applyBaseline,
+  writeBaseline,
+  validateExceptions,
+  applyExceptions,
+  MAX_CONFIG_BYTES,
+  DEFAULT_CONFIG,
+  CONFIG_FILENAMES,
+  ConfigError,
+  configFromText,
+  loadConfig,
+  matchIgnorePath,
   detectAiAttribution,
   RECORD_SEPARATOR,
   FIELD_SEPARATOR,
   GitError,
   HERMETIC_GIT_FLAGS,
   getHermeticGitEnv,
+  gitOutputPath,
   parseGitLogStream,
   unquoteGitPath,
   parseDiff,
@@ -2593,14 +2990,8 @@ export {
   resolveCommitSha,
   findMergeBase,
   GitResolutionError,
+  readGit,
   RULE_GUIDES,
-  VALID_DETECTORS,
-  DEFAULT_CONFIG,
-  CONFIG_FILENAMES,
-  ConfigError,
-  configFromText,
-  loadConfig,
-  matchIgnorePath,
   isCodeFile,
   isTestFile,
   auditFileDiffs,
@@ -2612,6 +3003,7 @@ export {
   formatGithubAnnotations,
   formatGithubStepSummary,
   formatPrMarkdownComment,
+  terminalText,
   formatCheckTerminal,
   formatCheckMarkdown,
   formatReviewTerminal,
@@ -2624,11 +3016,6 @@ export {
   generateSvgBadge,
   generateShieldsMarkdown,
   generateShieldsJson,
-  findingFingerprint,
-  createBaseline,
-  loadBaseline,
-  applyBaseline,
-  writeBaseline,
   formatSarif,
   checkProject,
   compareFindings,