agent-roast 0.8.0 → 0.8.1

package/README.md

@@ -106,12 +106,12 @@ regressions) may appear in the report/summary rather than as an inline PR annota
 Use a separate SARIF category for introduced-findings review; it does not represent
 a full scan of all outstanding alerts.
 
-Install 0.8.0: `npx agent-roast@0.8.0 review --base origin/main`. For local development,
+Install 0.8.1: `npx agent-roast@0.8.1 review --base origin/main`. For local development,
 run `npm run build` and use `node dist/cli.js`.
 
 ### Precise exceptions (since 0.8.0)
 
-Use `npx agent-roast@0.8.0 check --format json`, or build this checkout with
+Use `npx agent-roast@0.8.1 check --format json`, or build this checkout with
 `npm run build` and run `node dist/cli.js`.
 
 Some skipped integrations or abstract stubs are intentional. In 0.8.0 you can accept
@@ -278,6 +278,11 @@ The JSON schema version for context reviews is now `1.1.0`.
 The generated hook uses the locally installed CLI (`--no-install`) and blocks on configured error rules instead of scoring
 old commits. It preserves an existing pre-commit hook.
 
+`init` resolves the repository root even when run from a package/subdirectory, so
+its policy is used by `check` and its workflow can be discovered by GitHub. Outside
+a Git repository, initialization uses the supplied directory. Its output shows the
+actual destination and existing policy/hooks are preserved.
+
 ### Configure what blocks a change
 
 Create `.agentroastrc.json` (or run `npx agent-roast init`):
@@ -342,7 +347,7 @@ jobs:
 
 To pilot the Action without blocking on findings, set `advisory: true`. It passes
 an explicit empty fail-on list; invalid configuration, Git errors and incomplete
-scans still fail. The `v1` Action installs 0.8.0. The CLI equivalent is `--fail-on ''`.
+scans still fail. The `v1` Action installs 0.8.1. The CLI equivalent is `--fail-on ''`.
 
 > **Security Note:** `agent-roast` runs in an isolated runner directory (`$RUNNER_TEMP`) with `--ignore-scripts` to neutralize malicious `.npmrc` files in untrusted pull requests. `pull_request_target` is not supported.
 
@@ -393,6 +398,11 @@ Rust raw strings/lifetimes and Java/Kotlin text blocks. Contiguous comments, Pyt
 docstrings and multiline empty handlers are recognized. Template interpolation, complex language syntax and context outside
 the added diff in legacy audit modes are not fully parsed. Custom test API aliases,
 computed property calls and type/import resolution are not handled. Panic loops are an observational history heuristic.
+Test registration options such as Node's `test('name', { skip: true }, fn)` and
+`{ only: true }` are currently not inspected; use explicit `.skip`/`.only` APIs and
+the runner's CI safeguards. Regexp masking is contextual, not a full JavaScript
+parser. Formatting across contiguous lines is supported for casts, empty catches
+and placeholder errors, but legacy added-line audits cannot recover missing hunks.
 The discipline score summarizes added history; it does not certify current code quality.
 `check` reports actionable findings without assigning a personality or quality score.
 History attribution is based on explicit text/identity heuristics; it does not prove
@@ -416,13 +426,16 @@ are exercised on Node 18/20/22 using `AGENT_ROAST_TEST_NODE`.
 npm ci
 npm run typecheck
 npm test
+
+# Optional end-to-end CLI checks in disposable Git repositories
+node scripts/verify-user-workflows.mjs dist/cli.js
 ```
 
 `npm test` builds the distribution first so CLI integration and bundle checks run
 against current code. Regression tests use disposable Git repositories. The programmatic
 `auditPullRequest({ staged: true })` API retains the legacy added-lines contract;
 use `reviewStagedChanges()` for the new context comparison and `ReviewResult`.
-The composite Action installs exactly 0.8.0. For local development, use
+The composite Action installs exactly 0.8.1. For local development, use
 `node dist/cli.js --staged` after building.
 
 ### Author & Support

package/dist/{chunk-C423TSZF.js → chunk-U7OCVA3D.js}

@@ -576,6 +576,8 @@ var SourceMasker = class {
   triple = false;
   verbatim = false;
   previousLine = 0;
+  tokenPrefix = "";
+  parentheses = [];
   python;
   javascript;
   rust;
@@ -602,12 +604,14 @@ var SourceMasker = class {
       this.rawEnd = "";
       this.triple = false;
       this.verbatim = false;
+      this.tokenPrefix = "";
+      this.parentheses.length = 0;
     }
     this.previousLine = number;
     const code = Array(line.length).fill(" ");
     const comments = Array(line.length).fill(" ");
     let i = 0;
-    let prefix = "";
+    let prefix = this.tokenPrefix;
     const appendPrefix = (text) => {
       for (const char of text) {
         if (/\s/.test(char)) {
@@ -706,7 +710,7 @@ var SourceMasker = class {
         appendPrefix(" literal ");
         continue;
       }
-      if (this.javascript && char === "/" && (/(?:[=(:,[!&|?{;]|\breturn|\byield)\s*$/.test(prefix) || !prefix.trim())) {
+      if (this.javascript && char === "/" && (/(?:=>|[=(:,[!&|?{;]|\breturn|\byield|\bthrow)\s*$/.test(prefix) || !prefix.trim())) {
         let j = i + 1;
         let inClass = false;
         for (; j < line.length; j++) {
@@ -727,10 +731,19 @@ var SourceMasker = class {
         }
       }
       code[i] = char;
+      if (this.javascript && char === "(") {
+        const control = /(?<![\w$])(?:if|while|for|with|switch|catch)\s*$/.exec(prefix);
+        this.parentheses.push(Boolean(control && !/\.\s*$/.test(prefix.slice(0, control.index))));
+      } else if (this.javascript && char === ")" && this.parentheses.pop()) {
+        prefix = "; ";
+        i++;
+        continue;
+      }
       appendPrefix(char);
       i++;
     }
     if (this.quote !== "`" && !this.triple && !this.verbatim && !continued) this.quote = "";
+    this.tokenPrefix = this.javascript ? (prefix + " ").slice(-64) : "";
     return { code: code.join(""), comments: comments.join(""), templateStarts, blockStarts };
   }
 };
@@ -1139,7 +1152,7 @@ var PYTHON_TRIVIAL_ASSERT_PATTERNS = [
   { regex: /\bself\s*\.\s*assertEqual\s*\(\s*(?:1\s*,\s*1|True\s*,\s*True)\s*\)/, name: "trivial assert (self.assertEqual(1, 1))" }
 ];
 var JS_STUB_PATTERNS = [
-  { regex: /\bthrow\s+new\s+Error\s*\(\s*["'](?:TODO\b|Not implemented\b|to be implemented\b|stub\b|implement me\b)/i, name: "unimplemented stub (throw new Error('Not implemented'))" }
+  { regex: /\bthrow\s+new\s+Error\s*\(\s*["'`](?:TODO(?=\s*(?:["'`:]|implement\b))|Not implemented\b|to be implemented\b|stub\b|implement me\b)/i, name: "unimplemented stub (throw new Error('Not implemented'))" }
 ];
 var PYTHON_STUB_PATTERNS = [
   { regex: /\braise\s+NotImplementedError\b/, name: "unimplemented stub (raise NotImplementedError)" },
@@ -1251,22 +1264,6 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
         infractions.push({ type: "type-escape", file: file.path, lineNumber: added.lineNumber, lineSnippet: rawLine.trim(), commitHash, commitDate, reason: "linter suppression (eslint-disable)" });
         foundEscape = true;
       }
-      if (typescript && !foundEscape && !isComment) {
-        for (const rule of CODE_TYPE_ESCAPE_PATTERNS) {
-          if (rule.regex.test(cleanedLine)) {
-            infractions.push({
-              type: "type-escape",
-              file: file.path,
-              lineNumber: added.lineNumber,
-              lineSnippet: rawLine.trim(),
-              commitHash,
-              commitDate,
-              reason: rule.name
-            });
-            break;
-          }
-        }
-      }
       if (python && !isComment && isTestFile(file.path)) {
         for (const rule of PYTHON_TRIVIAL_ASSERT_PATTERNS) {
           if (rule.regex.test(cleanedLine)) {
@@ -1283,40 +1280,55 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
           }
         }
       }
-      if (!isComment) {
-        for (const rule of stubs) {
-          const matches = rawLine.matchAll(new RegExp(rule.regex.source, rule.regex.flags + "g"));
-          const match = [...matches].find((candidate) => cleanedLine[candidate.index] === rawLine[candidate.index]);
-          if (match) {
-            infractions.push({
-              type: "stub-abandonment",
-              file: file.path,
-              lineNumber: added.lineNumber,
-              lineSnippet: rawLine.trim(),
-              commitHash,
-              commitDate,
-              reason: rule.name
-            });
-            break;
-          }
+    }
+    let source = "";
+    let code = "";
+    let raw = "";
+    const offsets = [];
+    for (let i = 0; i < maskedLines.length; i++) {
+      const separator = i ? maskedLines[i].number === maskedLines[i - 1].number + 1 ? "\n" : "\0" : "";
+      source += separator;
+      code += separator;
+      raw += separator;
+      offsets.push(source.length);
+      source += maskedLines[i].testCode;
+      code += maskedLines[i].code;
+      raw += maskedLines[i].raw;
+    }
+    const evidence = (index, length) => {
+      let low = 0;
+      let high = offsets.length;
+      while (low + 1 < high) {
+        const middle = low + high >>> 1;
+        if (offsets[middle] <= index) low = middle;
+        else high = middle;
+      }
+      let end = low;
+      while (end + 1 < offsets.length && offsets[end + 1] < index + length) end++;
+      return { lineNumber: maskedLines[low].number, lineSnippet: maskedLines.slice(low, end + 1).map((line) => line.raw.trim()).join(" ") };
+    };
+    const reportedStubs = /* @__PURE__ */ new Set();
+    for (const rule of stubs) {
+      for (const match of raw.matchAll(new RegExp(rule.regex.source, rule.regex.flags + "g"))) {
+        if (code[match.index] !== raw[match.index]) continue;
+        const location = evidence(match.index, match[0].length);
+        if (reportedStubs.has(location.lineNumber)) continue;
+        reportedStubs.add(location.lineNumber);
+        infractions.push({ type: "stub-abandonment", file: file.path, ...location, commitHash, commitDate, reason: rule.name });
+      }
+    }
+    if (typescript) {
+      const reported = new Set(infractions.slice(firstFinding).filter((f) => f.type === "type-escape").map((f) => f.lineNumber));
+      for (const rule of CODE_TYPE_ESCAPE_PATTERNS) {
+        for (const match of code.matchAll(new RegExp(rule.regex.source, "g"))) {
+          const location = evidence(match.index, match[0].length);
+          if (reported.has(location.lineNumber)) continue;
+          reported.add(location.lineNumber);
+          infractions.push({ type: "type-escape", file: file.path, ...location, commitHash, commitDate, reason: rule.name });
         }
       }
     }
     if (javascript) {
-      let source = "";
-      const offsets = [];
-      for (let i = 0; i < maskedLines.length; i++) {
-        if (i) source += maskedLines[i].number === maskedLines[i - 1].number + 1 ? "\n" : "\0";
-        offsets.push(source.length);
-        source += maskedLines[i].testCode;
-      }
-      let row = 0;
-      const evidence = (index, length) => {
-        while (row + 1 < offsets.length && offsets[row + 1] <= index) row++;
-        let end = row;
-        while (end + 1 < offsets.length && offsets[end + 1] < index + length) end++;
-        return { lineNumber: maskedLines[row].number, lineSnippet: maskedLines.slice(row, end + 1).map((line) => line.raw.trim()).join(" ") };
-      };
       for (const match of source.matchAll(JS_TEST_API)) {
         let previous = match.index - 1;
         while (previous >= 0 && /\s/.test(source[previous])) previous--;
@@ -1335,34 +1347,35 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
         });
       }
       if (isTestFile(file.path)) {
-        row = 0;
         for (const rule of JS_TRIVIAL_ASSERT_PATTERNS) {
           for (const match of source.matchAll(new RegExp(rule.regex.source, "g"))) {
             infractions.push({ type: "trivial-assert", file: file.path, ...evidence(match.index, match[0].length), commitHash, commitDate, reason: rule.name });
           }
-          row = 0;
         }
       }
     }
+    if (braceCatches) {
+      for (const match of code.matchAll(/(?<![\w$.])catch\s*(?:\(\s*[^()\s\0][^()\0]*\))?\s*\{\s*\}/g)) {
+        infractions.push({
+          type: "swallowed-error",
+          file: file.path,
+          ...evidence(match.index, match[0].length),
+          commitHash,
+          commitDate,
+          reason: match[0].includes("\n") ? "empty multi-line catch block" : "empty catch block (catch {})"
+        });
+      }
+    }
     for (let index = 0; index < maskedLines.length; index++) {
       const start = maskedLines[index];
-      const catches = braceCatches ? [...start.code.matchAll(/(?<![\w$.])catch\s*(?:\(\s*[^)\s][^)]*\))?\s*\{/g)] : [];
-      for (const match of catches) {
-        if (/^\s*}/.test(start.code.slice(match.index + match[0].length))) {
-          infractions.push({ type: "swallowed-error", file: file.path, lineNumber: start.number, lineSnippet: start.raw.trim(), commitHash, commitDate, reason: "empty catch block (catch {})" });
-        }
-      }
-      const lastCatch = catches.at(-1);
-      const isCatch = lastCatch && /^\s*$/.test(start.code.slice(lastCatch.index + lastCatch[0].length));
       const inlineExcept = python && /^\s*except(?:\*?\s+[^:]+)?:\s*pass\s*;?\s*$/.test(start.code);
       if (inlineExcept) infractions.push({ type: "swallowed-error", file: file.path, lineNumber: start.number, lineSnippet: start.raw.trim(), commitHash, commitDate, reason: "silent python error swallow (except: pass)" });
       const isExcept = python && /^\s*except(?:\*?\s+[^:]+)?:\s*$/.test(start.code);
-      if (!isCatch && !isExcept) continue;
+      if (!isExcept) continue;
       let next = index + 1;
       while (next < maskedLines.length && maskedLines[next].number === maskedLines[next - 1].number + 1 && !maskedLines[next].code.trim()) next++;
       const end = maskedLines[next];
       if (!end || end.number !== maskedLines[next - 1].number + 1) continue;
-      const closesCatch = isCatch && /^\s*}/.test(end.code);
       let closesExcept = isExcept && /^\s*pass\s*;?\s*$/.test(end.code);
       if (closesExcept) {
         const indent = start.raw.search(/\S/);
@@ -1371,14 +1384,14 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
         while (after < maskedLines.length && maskedLines[after].number === maskedLines[after - 1].number + 1 && !maskedLines[after].code.trim()) after++;
         if (after < maskedLines.length && maskedLines[after].number === maskedLines[after - 1].number + 1 && maskedLines[after].raw.search(/\S/) > indent) closesExcept = false;
       }
-      if (closesCatch || closesExcept) infractions.push({
+      if (closesExcept) infractions.push({
         type: "swallowed-error",
         file: file.path,
         lineNumber: start.number,
         lineSnippet: maskedLines.slice(index, next + 1).map((line) => line.raw.trim()).join(" "),
         commitHash,
         commitDate,
-        reason: closesCatch ? "empty multi-line catch block" : "silent multi-line python error swallow"
+        reason: "silent multi-line python error swallow"
       });
     }
     const ordered = infractions.splice(firstFinding).sort((left, right) => (left.lineNumber || 0) - (right.lineNumber || 0));
@@ -2184,11 +2197,24 @@ var hasEntry = (filename) => {
   }
 };
 async function initProject(options = {}) {
-  const cwd = fs4.realpathSync(path3.resolve(options.cwd || process.cwd()));
+  let cwd = fs4.realpathSync(path3.resolve(options.cwd || process.cwd()));
+  const root = spawnSync2("git", [...HERMETIC_GIT_FLAGS, "rev-parse", "--show-toplevel"], {
+    cwd,
+    env: { ...getHermeticGitEnv(), LC_ALL: "C" },
+    encoding: "utf8",
+    timeout: 3e4,
+    maxBuffer: 8192,
+    windowsHide: true
+  });
+  if (root.error) throw new ConfigError("Cannot resolve the repository root for initialization.");
+  if (root.status === 0) cwd = fs4.realpathSync(gitOutputPath(root.stdout));
+  else if (root.status !== 128 || !root.stderr.includes("not a git repository")) {
+    throw new ConfigError("Cannot resolve a working repository root for initialization.");
+  }
   const created = [];
   const skipped = [];
-  const publish = (root, relative2, label, content, mode) => {
-    (createNewFile(root, relative2, content, mode) ? created : skipped).push(label);
+  const publish = (root2, relative2, label, content, mode) => {
+    (createNewFile(root2, relative2, content, mode) ? created : skipped).push(label);
   };
   if ([".agentroastrc.json", "agent-roast.config.json", ".agentroastrc"].some((name) => hasEntry(path3.join(cwd, name)))) {
     skipped.push(".agentroastrc.json");
@@ -2220,7 +2246,7 @@ async function initProject(options = {}) {
       } else publish(commonDir, relative2, ".git/hooks/pre-commit", PRE_COMMIT_HOOK_TEMPLATE, 493);
     }
   }
-  return { created, skipped };
+  return { directory: cwd, created, skipped };
 }
 
 // src/badge.ts

package/dist/cli.js

@@ -22,7 +22,7 @@ import {
   roastRepository,
   terminalText,
   writeBaseline
-} from "./chunk-C423TSZF.js";
+} from "./chunk-U7OCVA3D.js";
 
 // src/cli.ts
 import { Command } from "commander";
@@ -254,7 +254,7 @@ program.command("init").description("Initialize .agentroastrc.json and CI/hook c
       hook: opts.hook
     });
     if (res.created.length > 0) {
-      console.log(`Initialized agent-roast in ${terminalText(targetDir)}:`);
+      console.log(`Initialized agent-roast in ${terminalText(res.directory)}:`);
       for (const file of res.created) {
         console.log(`  + Created ${terminalText(file)}`);
       }

package/dist/index.d.ts

@@ -366,6 +366,8 @@ interface InitOptions {
     hook?: boolean;
 }
 interface InitResult {
+    /** Actual project root containing the initialized files. */
+    directory: string;
     created: string[];
     skipped: string[];
 }

package/dist/index.js

@@ -63,7 +63,7 @@ import {
   unquoteGitPath,
   validateExceptions,
   writeBaseline
-} from "./chunk-C423TSZF.js";
+} from "./chunk-U7OCVA3D.js";
 export {
   CONFIG_FILENAMES,
   ConfigError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-roast",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Offline code checks for skipped tests, swallowed errors, unfinished stubs and AI coding shortcuts",
   "type": "module",
   "main": "./dist/index.js",