agent-roast 0.8.0 → 0.9.0

package/README.md

@@ -17,36 +17,75 @@
 
 </div>
 
-`agent-roast` is an offline review aid for skipped tests, fake assertions, swallowed
-errors, unfinished stubs and type-check bypasses. Start with the code you have now;
-no AI commit tags, cloud account, API key or commit history are required for `check`.
-A Git repository is required; `git init` is sufficient.
+**Did the AI fix the code, or just make the checks pass?**
+
+Coding agents (and tired humans) often get a red build green by changing the *checks*
+instead of the *code*: deleting the failing assertion, weakening it to `toBeDefined()`,
+removing the test, lowering the coverage threshold, switching off `strict`, or letting
+CI steps fail. A linter reading the new file cannot see that, because nothing in the new
+file looks wrong. `agent-roast review` compares the **before and after** of a change and
+flags exactly these moves. It is offline, runs no project code, and needs only Git.
 
 ```bash
-# Inspect current tracked + non-ignored untracked source files
-npx agent-roast check
+npx agent-roast review --base origin/main        # a pull request
+npx agent-roast --staged                         # what you are about to commit
+```
 
-# Understand a finding and what to do next
+| Rule | Fires when | Blocks by default |
+| --- | --- | --- |
+| `assertion-weakened` | a test keeps its name but loses assertions, or an exact check becomes `toBeDefined`/`toBeTruthy`/`assert x` | yes |
+| `guard-weakened` | coverage threshold lowered, `strict`/`noImplicitAny` off, lint rule downgraded, CI step may fail or no longer runs tests, test script cannot fail | yes |
+| `test-removed` | a test (or test file) disappears and no identical body appears elsewhere | no, reported |
+| `expectation-rewritten` | an expected value changed, test inputs did not, and production code changed in the same PR | no, reported |
+| `test-skip`, `test-focus`, `trivial-assert`, `swallowed-error`, `type-escape`, `stub-abandonment` | the classic shortcuts, compared before/after so old debt does not block | skip/focus/trivial: yes |
+
+Renames, moved tests, parametrization, and formatter rewraps (prettier, black) are
+recognized and not reported. Intentional cases can be accepted one by one with an
+expiring, reviewed exception (see below). Policy is read from the base branch, so a PR
+cannot switch the rules off for itself.
+
+### How well does it work?
+
+Measured, not promised (`npm run build`, then `npm run bench` and `npm run bench:noise`;
+method and raw numbers are in [docs/benchmarks.md](docs/benchmarks.md)):
+
+- **Labeled changes** (`benchmarks/cases.mjs`): 32 cheating edits across JS/TS, Python, Go
+  and CI/config files are caught, and 15 harmless look-alikes (reformat, rename, move,
+  parametrize, snapshot, raised thresholds, CI step split) stay silent. The cases were
+  written together with the detector, so they guard against regressions; they do not prove
+  accuracy. Three known gaps are listed in the file and still open: mocking the module
+  under test, hardcoding the tested value, and vacuous matchers such as `expect.anything()`.
+- **Noise on real human history** (the last 300 commits of commander.js, execa, click,
+  requests and zod; 606 of them touched tests or CI/config): the two blocking rules fired on
+  7 commits (1.2%). Each was read by hand: one was a real defect (a refactor in `requests`
+  dropped the `assert` keyword, leaving a comparison with no effect); the other six were
+  deliberate rewrites a reviewer should still see, such as a test-framework migration,
+  dropping Python 2, or a documented `continue-on-error`. `test-removed` fired on 6.1% and
+  `expectation-rewritten` on 2.8% of those commits, which is why they only report.
+- **Not measured yet:** accuracy on real AI-agent pull requests. The sample above is human
+  history, and it is small. Treat the numbers as a floor for noise, not a guarantee.
+
+It is a **review aid**. It cannot prove who wrote a change or that code is correct, and it
+reads text, not program semantics. A green result is not a quality certificate.
+
+### Quick start
+
+```bash
+# Everything that is true of the code you have now
+npx agent-roast check
 npx agent-roast explain swallowed-error
 
-# Adopt it in an existing project without blocking on all historical debt
+# Adopt in an existing project without blocking on historical debt
 npx agent-roast check --write-baseline .agentroast-baseline.json
-# Review the findings and commit this policy file, then gate only new problems
 npx agent-roast check --baseline .agentroast-baseline.json
 
-# Verify precisely what you are about to commit
-npx agent-roast --staged
-
-# Audit pull request diffs (CI gate)
-npx agent-roast review --base origin/main --head HEAD --format github
-
-# Optional historical audit
+# Optional: score a repository's history
 npx agent-roast --all --verbose
 ```
 
-A finding includes its file and line, the source snippet, and a concrete next step.
-To see the complete machine-readable result, use `check --format json`; terminal
-output shows the first 20 findings. `check --format markdown` produces a review table.
+A finding includes its file and line, the evidence, and a concrete next step.
+`--format json|markdown|sarif|github` are available; terminal output shows the first
+20 findings.
 
 ### Context review for pull requests
 
@@ -106,12 +145,12 @@ regressions) may appear in the report/summary rather than as an inline PR annota
 Use a separate SARIF category for introduced-findings review; it does not represent
 a full scan of all outstanding alerts.
 
-Install 0.8.0: `npx agent-roast@0.8.0 review --base origin/main`. For local development,
+Install 0.9.0: `npx agent-roast@0.9.0 review --base origin/main`. For local development,
 run `npm run build` and use `node dist/cli.js`.
 
 ### Precise exceptions (since 0.8.0)
 
-Use `npx agent-roast@0.8.0 check --format json`, or build this checkout with
+Use `npx agent-roast@0.9.0 check --format json`, or build this checkout with
 `npm run build` and run `node dist/cli.js`.
 
 Some skipped integrations or abstract stubs are intentional. In 0.8.0 you can accept
@@ -278,6 +317,11 @@ The JSON schema version for context reviews is now `1.1.0`.
 The generated hook uses the locally installed CLI (`--no-install`) and blocks on configured error rules instead of scoring
 old commits. It preserves an existing pre-commit hook.
 
+`init` resolves the repository root even when run from a package/subdirectory, so
+its policy is used by `check` and its workflow can be discovered by GitHub. Outside
+a Git repository, initialization uses the supplied directory. Its output shows the
+actual destination and existing policy/hooks are preserved.
+
 ### Configure what blocks a change
 
 Create `.agentroastrc.json` (or run `npx agent-roast init`):
@@ -342,7 +386,7 @@ jobs:
 
 To pilot the Action without blocking on findings, set `advisory: true`. It passes
 an explicit empty fail-on list; invalid configuration, Git errors and incomplete
-scans still fail. The `v1` Action installs 0.8.0. The CLI equivalent is `--fail-on ''`.
+scans still fail. The `v1` Action installs 0.9.0. The CLI equivalent is `--fail-on ''`.
 
 > **Security Note:** `agent-roast` runs in an isolated runner directory (`$RUNNER_TEMP`) with `--ignore-scripts` to neutralize malicious `.npmrc` files in untrusted pull requests. `pull_request_target` is not supported.
 
@@ -393,6 +437,11 @@ Rust raw strings/lifetimes and Java/Kotlin text blocks. Contiguous comments, Pyt
 docstrings and multiline empty handlers are recognized. Template interpolation, complex language syntax and context outside
 the added diff in legacy audit modes are not fully parsed. Custom test API aliases,
 computed property calls and type/import resolution are not handled. Panic loops are an observational history heuristic.
+Test registration options such as Node's `test('name', { skip: true }, fn)` and
+`{ only: true }` are currently not inspected; use explicit `.skip`/`.only` APIs and
+the runner's CI safeguards. Regexp masking is contextual, not a full JavaScript
+parser. Formatting across contiguous lines is supported for casts, empty catches
+and placeholder errors, but legacy added-line audits cannot recover missing hunks.
 The discipline score summarizes added history; it does not certify current code quality.
 `check` reports actionable findings without assigning a personality or quality score.
 History attribution is based on explicit text/identity heuristics; it does not prove
@@ -416,13 +465,16 @@ are exercised on Node 18/20/22 using `AGENT_ROAST_TEST_NODE`.
 npm ci
 npm run typecheck
 npm test
+
+# Optional end-to-end CLI checks in disposable Git repositories
+node scripts/verify-user-workflows.mjs dist/cli.js
 ```
 
 `npm test` builds the distribution first so CLI integration and bundle checks run
 against current code. Regression tests use disposable Git repositories. The programmatic
 `auditPullRequest({ staged: true })` API retains the legacy added-lines contract;
 use `reviewStagedChanges()` for the new context comparison and `ReviewResult`.
-The composite Action installs exactly 0.8.0. For local development, use
+The composite Action installs exactly 0.9.0. For local development, use
 `node dist/cli.js --staged` after building.
 
 ### Author & Support

package/dist/{chunk-C423TSZF.js → chunk-GMBQNL6Z.js}

@@ -576,6 +576,8 @@ var SourceMasker = class {
   triple = false;
   verbatim = false;
   previousLine = 0;
+  tokenPrefix = "";
+  parentheses = [];
   python;
   javascript;
   rust;
@@ -602,12 +604,14 @@ var SourceMasker = class {
       this.rawEnd = "";
       this.triple = false;
       this.verbatim = false;
+      this.tokenPrefix = "";
+      this.parentheses.length = 0;
     }
     this.previousLine = number;
     const code = Array(line.length).fill(" ");
     const comments = Array(line.length).fill(" ");
     let i = 0;
-    let prefix = "";
+    let prefix = this.tokenPrefix;
     const appendPrefix = (text) => {
       for (const char of text) {
         if (/\s/.test(char)) {
@@ -706,7 +710,7 @@ var SourceMasker = class {
         appendPrefix(" literal ");
         continue;
       }
-      if (this.javascript && char === "/" && (/(?:[=(:,[!&|?{;]|\breturn|\byield)\s*$/.test(prefix) || !prefix.trim())) {
+      if (this.javascript && char === "/" && (/(?:=>|[=(:,[!&|?{;]|\breturn|\byield|\bthrow)\s*$/.test(prefix) || !prefix.trim())) {
         let j = i + 1;
         let inClass = false;
         for (; j < line.length; j++) {
@@ -727,10 +731,19 @@ var SourceMasker = class {
         }
       }
       code[i] = char;
+      if (this.javascript && char === "(") {
+        const control = /(?<![\w$])(?:if|while|for|with|switch|catch)\s*$/.exec(prefix);
+        this.parentheses.push(Boolean(control && !/\.\s*$/.test(prefix.slice(0, control.index))));
+      } else if (this.javascript && char === ")" && this.parentheses.pop()) {
+        prefix = "; ";
+        i++;
+        continue;
+      }
       appendPrefix(char);
       i++;
     }
     if (this.quote !== "`" && !this.triple && !this.verbatim && !continued) this.quote = "";
+    this.tokenPrefix = this.javascript ? (prefix + " ").slice(-64) : "";
     return { code: code.join(""), comments: comments.join(""), templateStarts, blockStarts };
   }
 };
@@ -773,6 +786,30 @@ var RULE_GUIDES = {
     suggestion: "Implement the path or make its unsupported state explicit to callers. Check whether this is an intentional abstract contract.",
     example: "throw new Error('Not implemented') \u2192 implement the operation and add a behavior test"
   },
+  "assertion-weakened": {
+    title: "Test checks less than before",
+    why: "A test that keeps its name but loses assertions, or has one replaced by a weaker check, still passes while verifying less behavior.",
+    suggestion: "Restore the removed assertion or explain in the PR why that behavior is no longer required. Fix the code under test instead of weakening its check.",
+    example: "expect(total).toBe(42) \u2192 expect(total).toBeDefined()  (restore the exact check)"
+  },
+  "test-removed": {
+    title: "Test removed",
+    why: "Deleting a failing test makes a suite green without fixing the behavior it covered. Removals are legitimate when the feature itself is gone.",
+    suggestion: "Confirm the behavior was intentionally removed. If it still exists, restore the test and fix the code.",
+    example: "it('rejects expired tokens', ...) deleted while token validation remains in src/"
+  },
+  "expectation-rewritten": {
+    title: "Expected value edited alongside production code",
+    why: "Changing an expected value while the test inputs stay the same can mean the test was adjusted to match new output instead of the output being corrected.",
+    suggestion: "Verify the new expectation against the requirement, not against the program's current output. Intentional behavior changes should say so in the PR.",
+    example: "expect(price(cart)).toBe(100) \u2192 toBe(90) with price() changed in the same PR"
+  },
+  "guard-weakened": {
+    title: "Quality gate made easier to pass",
+    why: "Lower coverage thresholds, disabled compiler strictness, downgraded lint rules, tolerated CI failures or an always-passing test script let defects through without touching the code.",
+    suggestion: "Keep the gate and fix the underlying failure. If the change is deliberate, record the reason and a plan to restore it.",
+    example: 'coverageThreshold lines: 80 \u2192 60, "strict": true \u2192 false, continue-on-error: true'
+  },
   "panic-loop": {
     title: "Rapid overlapping fix commits",
     why: "Repeated short fix cycles can suggest a missing reproduction or feedback loop; timing alone does not prove poor work.",
@@ -793,7 +830,11 @@ var VALID_DETECTORS = [
   "panic-loop",
   "trivial-assert",
   "stub-abandonment",
-  "test-focus"
+  "test-focus",
+  "assertion-weakened",
+  "test-removed",
+  "expectation-rewritten",
+  "guard-weakened"
 ];
 
 // src/file-read.ts
@@ -826,13 +867,13 @@ function readRegularFile(filename, limit) {
 import { createHash, randomUUID as randomUUID2 } from "crypto";
 import * as fs2 from "fs";
 import path from "path";
-function findingFingerprint(finding) {
-  return createHash("sha256").update(JSON.stringify([finding.type, finding.file, finding.lineSnippet?.trim()])).digest("hex");
+function findingFingerprint(finding2) {
+  return createHash("sha256").update(JSON.stringify([finding2.type, finding2.file, finding2.lineSnippet?.trim()])).digest("hex");
 }
 function createBaseline(findings) {
   const counts = /* @__PURE__ */ new Map();
-  for (const finding of findings) {
-    const fingerprint = findingFingerprint(finding);
+  for (const finding2 of findings) {
+    const fingerprint = findingFingerprint(finding2);
     counts.set(fingerprint, (counts.get(fingerprint) || 0) + 1);
   }
   return {
@@ -864,14 +905,14 @@ function applyBaseline(findings, baseline) {
   const remaining = new Map(baseline.entries.map((entry) => [entry.fingerprint, entry.count]));
   const fresh = [];
   let baselineCount = 0;
-  for (const finding of findings) {
-    const fingerprint = findingFingerprint(finding);
+  for (const finding2 of findings) {
+    const fingerprint = findingFingerprint(finding2);
     const count = remaining.get(fingerprint) || 0;
     if (count > 0) {
       remaining.set(fingerprint, count - 1);
       baselineCount++;
     } else {
-      fresh.push(finding);
+      fresh.push(finding2);
     }
   }
   return { findings: fresh, baselineCount, staleBaselineCount: [...remaining.values()].reduce((a, b) => a + b, 0) };
@@ -920,11 +961,11 @@ function applyExceptions(findings, exceptions = [], now = /* @__PURE__ */ new Da
   const occurrences = new Map(priorOccurrences);
   const actionable = [];
   const suppressedFindings = [];
-  for (const finding of findings) {
-    const fingerprint = findingFingerprint(finding);
+  for (const finding2 of findings) {
+    const fingerprint = findingFingerprint(finding2);
     const occurrence = (occurrences.get(fingerprint) ?? 0) + 1;
     occurrences.set(fingerprint, occurrence);
-    const enriched = { ...finding, fingerprint, occurrence };
+    const enriched = { ...finding2, fingerprint, occurrence };
     const allowance = active.get(fingerprint);
     if (allowance && allowance.remaining > 0) {
       allowance.remaining--;
@@ -937,7 +978,7 @@ function applyExceptions(findings, exceptions = [], now = /* @__PURE__ */ new Da
 // src/config.ts
 var MAX_CONFIG_BYTES = 64 * 1024;
 var DEFAULT_CONFIG = {
-  failOn: ["test-skip", "trivial-assert", "test-focus"],
+  failOn: ["test-skip", "trivial-assert", "test-focus", "assertion-weakened", "guard-weakened"],
   ignorePaths: [
     "**/fixtures/**",
     "**/__fixtures__/**",
@@ -953,6 +994,10 @@ var DEFAULT_CONFIG = {
     "test-skip": "error",
     "trivial-assert": "error",
     "test-focus": "error",
+    "assertion-weakened": "error",
+    "guard-weakened": "error",
+    "test-removed": "warn",
+    "expectation-rewritten": "warn",
     "swallowed-error": "warn",
     "stub-abandonment": "warn",
     "type-escape": "warn"
@@ -1139,7 +1184,7 @@ var PYTHON_TRIVIAL_ASSERT_PATTERNS = [
   { regex: /\bself\s*\.\s*assertEqual\s*\(\s*(?:1\s*,\s*1|True\s*,\s*True)\s*\)/, name: "trivial assert (self.assertEqual(1, 1))" }
 ];
 var JS_STUB_PATTERNS = [
-  { regex: /\bthrow\s+new\s+Error\s*\(\s*["'](?:TODO\b|Not implemented\b|to be implemented\b|stub\b|implement me\b)/i, name: "unimplemented stub (throw new Error('Not implemented'))" }
+  { regex: /\bthrow\s+new\s+Error\s*\(\s*["'`](?:TODO(?=\s*(?:["'`:]|implement\b))|Not implemented\b|to be implemented\b|stub\b|implement me\b)/i, name: "unimplemented stub (throw new Error('Not implemented'))" }
 ];
 var PYTHON_STUB_PATTERNS = [
   { regex: /\braise\s+NotImplementedError\b/, name: "unimplemented stub (raise NotImplementedError)" },
@@ -1251,22 +1296,6 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
         infractions.push({ type: "type-escape", file: file.path, lineNumber: added.lineNumber, lineSnippet: rawLine.trim(), commitHash, commitDate, reason: "linter suppression (eslint-disable)" });
         foundEscape = true;
       }
-      if (typescript && !foundEscape && !isComment) {
-        for (const rule of CODE_TYPE_ESCAPE_PATTERNS) {
-          if (rule.regex.test(cleanedLine)) {
-            infractions.push({
-              type: "type-escape",
-              file: file.path,
-              lineNumber: added.lineNumber,
-              lineSnippet: rawLine.trim(),
-              commitHash,
-              commitDate,
-              reason: rule.name
-            });
-            break;
-          }
-        }
-      }
       if (python && !isComment && isTestFile(file.path)) {
         for (const rule of PYTHON_TRIVIAL_ASSERT_PATTERNS) {
           if (rule.regex.test(cleanedLine)) {
@@ -1283,40 +1312,55 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
           }
         }
       }
-      if (!isComment) {
-        for (const rule of stubs) {
-          const matches = rawLine.matchAll(new RegExp(rule.regex.source, rule.regex.flags + "g"));
-          const match = [...matches].find((candidate) => cleanedLine[candidate.index] === rawLine[candidate.index]);
-          if (match) {
-            infractions.push({
-              type: "stub-abandonment",
-              file: file.path,
-              lineNumber: added.lineNumber,
-              lineSnippet: rawLine.trim(),
-              commitHash,
-              commitDate,
-              reason: rule.name
-            });
-            break;
-          }
+    }
+    let source = "";
+    let code = "";
+    let raw = "";
+    const offsets = [];
+    for (let i = 0; i < maskedLines.length; i++) {
+      const separator = i ? maskedLines[i].number === maskedLines[i - 1].number + 1 ? "\n" : "\0" : "";
+      source += separator;
+      code += separator;
+      raw += separator;
+      offsets.push(source.length);
+      source += maskedLines[i].testCode;
+      code += maskedLines[i].code;
+      raw += maskedLines[i].raw;
+    }
+    const evidence = (index, length) => {
+      let low = 0;
+      let high = offsets.length;
+      while (low + 1 < high) {
+        const middle = low + high >>> 1;
+        if (offsets[middle] <= index) low = middle;
+        else high = middle;
+      }
+      let end = low;
+      while (end + 1 < offsets.length && offsets[end + 1] < index + length) end++;
+      return { lineNumber: maskedLines[low].number, lineSnippet: maskedLines.slice(low, end + 1).map((line) => line.raw.trim()).join(" ") };
+    };
+    const reportedStubs = /* @__PURE__ */ new Set();
+    for (const rule of stubs) {
+      for (const match of raw.matchAll(new RegExp(rule.regex.source, rule.regex.flags + "g"))) {
+        if (code[match.index] !== raw[match.index]) continue;
+        const location = evidence(match.index, match[0].length);
+        if (reportedStubs.has(location.lineNumber)) continue;
+        reportedStubs.add(location.lineNumber);
+        infractions.push({ type: "stub-abandonment", file: file.path, ...location, commitHash, commitDate, reason: rule.name });
+      }
+    }
+    if (typescript) {
+      const reported = new Set(infractions.slice(firstFinding).filter((f) => f.type === "type-escape").map((f) => f.lineNumber));
+      for (const rule of CODE_TYPE_ESCAPE_PATTERNS) {
+        for (const match of code.matchAll(new RegExp(rule.regex.source, "g"))) {
+          const location = evidence(match.index, match[0].length);
+          if (reported.has(location.lineNumber)) continue;
+          reported.add(location.lineNumber);
+          infractions.push({ type: "type-escape", file: file.path, ...location, commitHash, commitDate, reason: rule.name });
         }
       }
     }
     if (javascript) {
-      let source = "";
-      const offsets = [];
-      for (let i = 0; i < maskedLines.length; i++) {
-        if (i) source += maskedLines[i].number === maskedLines[i - 1].number + 1 ? "\n" : "\0";
-        offsets.push(source.length);
-        source += maskedLines[i].testCode;
-      }
-      let row = 0;
-      const evidence = (index, length) => {
-        while (row + 1 < offsets.length && offsets[row + 1] <= index) row++;
-        let end = row;
-        while (end + 1 < offsets.length && offsets[end + 1] < index + length) end++;
-        return { lineNumber: maskedLines[row].number, lineSnippet: maskedLines.slice(row, end + 1).map((line) => line.raw.trim()).join(" ") };
-      };
       for (const match of source.matchAll(JS_TEST_API)) {
         let previous = match.index - 1;
         while (previous >= 0 && /\s/.test(source[previous])) previous--;
@@ -1335,34 +1379,35 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
         });
       }
       if (isTestFile(file.path)) {
-        row = 0;
         for (const rule of JS_TRIVIAL_ASSERT_PATTERNS) {
           for (const match of source.matchAll(new RegExp(rule.regex.source, "g"))) {
             infractions.push({ type: "trivial-assert", file: file.path, ...evidence(match.index, match[0].length), commitHash, commitDate, reason: rule.name });
           }
-          row = 0;
         }
       }
     }
+    if (braceCatches) {
+      for (const match of code.matchAll(/(?<![\w$.])catch\s*(?:\(\s*[^()\s\0][^()\0]*\))?\s*\{\s*\}/g)) {
+        infractions.push({
+          type: "swallowed-error",
+          file: file.path,
+          ...evidence(match.index, match[0].length),
+          commitHash,
+          commitDate,
+          reason: match[0].includes("\n") ? "empty multi-line catch block" : "empty catch block (catch {})"
+        });
+      }
+    }
     for (let index = 0; index < maskedLines.length; index++) {
       const start = maskedLines[index];
-      const catches = braceCatches ? [...start.code.matchAll(/(?<![\w$.])catch\s*(?:\(\s*[^)\s][^)]*\))?\s*\{/g)] : [];
-      for (const match of catches) {
-        if (/^\s*}/.test(start.code.slice(match.index + match[0].length))) {
-          infractions.push({ type: "swallowed-error", file: file.path, lineNumber: start.number, lineSnippet: start.raw.trim(), commitHash, commitDate, reason: "empty catch block (catch {})" });
-        }
-      }
-      const lastCatch = catches.at(-1);
-      const isCatch = lastCatch && /^\s*$/.test(start.code.slice(lastCatch.index + lastCatch[0].length));
       const inlineExcept = python && /^\s*except(?:\*?\s+[^:]+)?:\s*pass\s*;?\s*$/.test(start.code);
       if (inlineExcept) infractions.push({ type: "swallowed-error", file: file.path, lineNumber: start.number, lineSnippet: start.raw.trim(), commitHash, commitDate, reason: "silent python error swallow (except: pass)" });
       const isExcept = python && /^\s*except(?:\*?\s+[^:]+)?:\s*$/.test(start.code);
-      if (!isCatch && !isExcept) continue;
+      if (!isExcept) continue;
       let next = index + 1;
       while (next < maskedLines.length && maskedLines[next].number === maskedLines[next - 1].number + 1 && !maskedLines[next].code.trim()) next++;
       const end = maskedLines[next];
       if (!end || end.number !== maskedLines[next - 1].number + 1) continue;
-      const closesCatch = isCatch && /^\s*}/.test(end.code);
       let closesExcept = isExcept && /^\s*pass\s*;?\s*$/.test(end.code);
       if (closesExcept) {
         const indent = start.raw.search(/\S/);
@@ -1371,18 +1416,18 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
         while (after < maskedLines.length && maskedLines[after].number === maskedLines[after - 1].number + 1 && !maskedLines[after].code.trim()) after++;
         if (after < maskedLines.length && maskedLines[after].number === maskedLines[after - 1].number + 1 && maskedLines[after].raw.search(/\S/) > indent) closesExcept = false;
       }
-      if (closesCatch || closesExcept) infractions.push({
+      if (closesExcept) infractions.push({
         type: "swallowed-error",
         file: file.path,
         lineNumber: start.number,
         lineSnippet: maskedLines.slice(index, next + 1).map((line) => line.raw.trim()).join(" "),
         commitHash,
         commitDate,
-        reason: closesCatch ? "empty multi-line catch block" : "silent multi-line python error swallow"
+        reason: "silent multi-line python error swallow"
       });
     }
     const ordered = infractions.splice(firstFinding).sort((left, right) => (left.lineNumber || 0) - (right.lineNumber || 0));
-    for (const finding of ordered) infractions.push(finding);
+    for (const finding2 of ordered) infractions.push(finding2);
   }
   return { infractions: infractions.filter((inf) => options.rules?.[inf.type] !== "off").map((inf) => ({ ...inf, suggestion: RULE_GUIDES[inf.type].suggestion })), hasSupportedChanges, filesInspected, linesAdded };
 }
@@ -1517,7 +1562,7 @@ var MetricsCollector = class {
     const counts = {};
     for (const infraction of audit.infractions) {
       const count = counts[infraction.type] || 0;
-      if (count < MAX_INFRACTIONS_PER_COMMIT) buckets[infraction.type].push(infraction);
+      if (count < MAX_INFRACTIONS_PER_COMMIT) buckets[infraction.type]?.push(infraction);
       counts[infraction.type] = count + 1;
     }
   }
@@ -1963,8 +2008,8 @@ function exceptionTerminal(result) {
   const accepted = result.suppressedFindings || [];
   if (accepted.length) {
     lines.push(`  ${accepted.length} findings accepted by explicit exceptions (not fixed)`);
-    for (const finding of accepted.slice(0, 20)) lines.push(
-      `  ACCEPTED [${finding.type}] ${terminalText(finding.file || "unknown")}:${finding.lineNumber} \u2014 ${terminalText(finding.suppression.reason)} (expires ${terminalText(finding.suppression.expires)})`
+    for (const finding2 of accepted.slice(0, 20)) lines.push(
+      `  ACCEPTED [${finding2.type}] ${terminalText(finding2.file || "unknown")}:${finding2.lineNumber} \u2014 ${terminalText(finding2.suppression.reason)} (expires ${terminalText(finding2.suppression.expires)})`
     );
     if (accepted.length > 20) lines.push(`  ${accepted.length - 20} more accepted findings; use --format json.`);
   }
@@ -1984,7 +2029,7 @@ function exceptionMarkdown(result) {
       "| Rule | Location | Reason | Expires |",
       "| --- | --- | --- | --- |"
     );
-    for (const finding of accepted) lines.push(`| ${finding.type} | ${markdownCell(`${finding.file}:${finding.lineNumber}`)} | ${markdownCell(finding.suppression.reason)} | ${markdownCell(finding.suppression.expires)} |`);
+    for (const finding2 of accepted) lines.push(`| ${finding2.type} | ${markdownCell(`${finding2.file}:${finding2.lineNumber}`)} | ${markdownCell(finding2.suppression.reason)} | ${markdownCell(finding2.suppression.expires)} |`);
   }
   if (result.expiredExceptionCount) lines.push("", `${result.expiredExceptionCount} expired exceptions were not applied; review their findings.`);
   return lines;
@@ -2041,12 +2086,12 @@ function formatReviewTerminal(result) {
   lines.push(...exceptionTerminal(result));
   if (result.policyChanges.length) lines.push("  Candidate policy changes were ignored; adopt them separately after review.");
   if (result.excludedFiles || result.unsupportedFiles) lines.push(`  ${result.excludedFiles} excluded \xB7 ${result.unsupportedFiles} unsupported/non-source changes`);
-  for (const finding of result.infractions.slice(0, 20)) {
+  for (const finding2 of result.infractions.slice(0, 20)) {
     lines.push(
       "",
-      `  ${result.failedRules.includes(finding.type) ? "FAIL" : "WARN"} [${finding.type}] ${terminalText(finding.file || "unknown")}:${finding.lineNumber}`,
-      `    ${terminalText(finding.lineSnippet || finding.reason)}`,
-      `    Next: ${terminalText(finding.suggestion || "Review this occurrence.")}`
+      `  ${result.failedRules.includes(finding2.type) ? "FAIL" : "WARN"} [${finding2.type}] ${terminalText(finding2.file || "unknown")}:${finding2.lineNumber}`,
+      `    ${terminalText(finding2.lineSnippet || finding2.reason)}`,
+      `    Next: ${terminalText(finding2.suggestion || "Review this occurrence.")}`
     );
   }
   if (result.infractions.length > 20) lines.push(`  ${result.infractions.length - 20} more new findings; use --format json for all results.`);
@@ -2067,7 +2112,7 @@ function formatReviewMarkdown(result) {
   ];
   if (result.policyChanges.length) lines.push("Candidate policy changes were ignored. This review uses the supplied base commit's policy.", "");
   lines.push("| New finding | Head location | Evidence | Next step |", "| --- | --- | --- | --- |");
-  for (const finding of result.infractions) lines.push(`| ${finding.type} | ${markdownCell(`${finding.file}:${finding.lineNumber}`)} | ${markdownCell(finding.lineSnippet || finding.reason)} | ${markdownCell(finding.suggestion || "Review this occurrence.")} |`);
+  for (const finding2 of result.infractions) lines.push(`| ${finding2.type} | ${markdownCell(`${finding2.file}:${finding2.lineNumber}`)} | ${markdownCell(finding2.lineSnippet || finding2.reason)} | ${markdownCell(finding2.suggestion || "Review this occurrence.")} |`);
   lines.push(...exceptionMarkdown(result));
   if (result.removedFindings.length) {
     lines.push(
@@ -2079,7 +2124,7 @@ function formatReviewMarkdown(result) {
       "| Rule | Previous location | Previous evidence |",
       "| --- | --- | --- |"
     );
-    for (const finding of result.removedFindings) lines.push(`| ${finding.type} | ${markdownCell(`${finding.file}:${finding.lineNumber}`)} | ${markdownCell(finding.lineSnippet || finding.reason)} |`);
+    for (const finding2 of result.removedFindings) lines.push(`| ${finding2.type} | ${markdownCell(`${finding2.file}:${finding2.lineNumber}`)} | ${markdownCell(finding2.lineSnippet || finding2.reason)} |`);
   }
   for (const skipped of result.skippedFiles) lines.push("", `Not compared: ${markdownCell(skipped.file)} \u2014 ${markdownCell(skipped.reason)}`);
   lines.push("", `Scope: changed supported files only; ${result.excludedFiles} excluded and ${result.unsupportedFiles} unsupported/non-source changes.`);
@@ -2184,11 +2229,24 @@ var hasEntry = (filename) => {
   }
 };
 async function initProject(options = {}) {
-  const cwd = fs4.realpathSync(path3.resolve(options.cwd || process.cwd()));
+  let cwd = fs4.realpathSync(path3.resolve(options.cwd || process.cwd()));
+  const root = spawnSync2("git", [...HERMETIC_GIT_FLAGS, "rev-parse", "--show-toplevel"], {
+    cwd,
+    env: { ...getHermeticGitEnv(), LC_ALL: "C" },
+    encoding: "utf8",
+    timeout: 3e4,
+    maxBuffer: 8192,
+    windowsHide: true
+  });
+  if (root.error) throw new ConfigError("Cannot resolve the repository root for initialization.");
+  if (root.status === 0) cwd = fs4.realpathSync(gitOutputPath(root.stdout));
+  else if (root.status !== 128 || !root.stderr.includes("not a git repository")) {
+    throw new ConfigError("Cannot resolve a working repository root for initialization.");
+  }
   const created = [];
   const skipped = [];
-  const publish = (root, relative2, label, content, mode) => {
-    (createNewFile(root, relative2, content, mode) ? created : skipped).push(label);
+  const publish = (root2, relative2, label, content, mode) => {
+    (createNewFile(root2, relative2, content, mode) ? created : skipped).push(label);
   };
   if ([".agentroastrc.json", "agent-roast.config.json", ".agentroastrc"].some((name) => hasEntry(path3.join(cwd, name)))) {
     skipped.push(".agentroastrc.json");
@@ -2220,7 +2278,7 @@ async function initProject(options = {}) {
       } else publish(commonDir, relative2, ".git/hooks/pre-commit", PRE_COMMIT_HOOK_TEMPLATE, 493);
     }
   }
-  return { created, skipped };
+  return { directory: cwd, created, skipped };
 }
 
 // src/badge.ts
@@ -2312,26 +2370,26 @@ var version = require2("../package.json").version;
 function formatSarif(report) {
   const occurrences = /* @__PURE__ */ new Map();
   const allFindings = [
-    ...report.infractions.map((finding) => ({ finding, suppression: void 0 })),
-    ...(report.suppressedFindings ?? []).map((finding) => ({ finding, suppression: finding.suppression }))
+    ...report.infractions.map((finding2) => ({ finding: finding2, suppression: void 0 })),
+    ...(report.suppressedFindings ?? []).map((finding2) => ({ finding: finding2, suppression: finding2.suppression }))
   ];
   allFindings.sort((a, b) => (a.finding.file ?? "").localeCompare(b.finding.file ?? "") || (a.finding.lineNumber ?? 1) - (b.finding.lineNumber ?? 1) || a.finding.type.localeCompare(b.finding.type));
-  const results = allFindings.map(({ finding, suppression }) => {
-    const filename = finding.file;
+  const results = allFindings.map(({ finding: finding2, suppression }) => {
+    const filename = finding2.file;
     if (!filename || filename.startsWith("/") || filename.split("/").includes("..") || /^[a-z]:/i.test(filename)) {
       throw new ConfigError("SARIF needs repository-relative finding paths.");
     }
-    const fingerprint = findingFingerprint(finding);
-    const occurrence = finding.occurrence ?? (occurrences.get(fingerprint) || 0) + 1;
+    const fingerprint = findingFingerprint(finding2);
+    const occurrence = finding2.occurrence ?? (occurrences.get(fingerprint) || 0) + 1;
     occurrences.set(fingerprint, occurrence);
     return {
-      ruleId: finding.type,
-      ruleIndex: VALID_DETECTORS.indexOf(finding.type),
-      level: report.failedRules.includes(finding.type) ? "error" : "warning",
-      message: { text: `${finding.reason}. ${finding.suggestion || RULE_GUIDES[finding.type].suggestion}` },
+      ruleId: finding2.type,
+      ruleIndex: VALID_DETECTORS.indexOf(finding2.type),
+      level: report.failedRules.includes(finding2.type) ? "error" : "warning",
+      message: { text: `${finding2.reason}. ${finding2.suggestion || RULE_GUIDES[finding2.type].suggestion}` },
       locations: [{ physicalLocation: {
         artifactLocation: { uri: filename.split("/").map((segment) => encodeURIComponent(segment)).join("/") },
-        region: { startLine: Math.max(1, finding.lineNumber || 1) }
+        region: { startLine: Math.max(1, finding2.lineNumber || 1) }
       } }],
       partialFingerprints: { "agentRoastFinding/v1": `${fingerprint}:${occurrence}` },
       ...suppression ? { suppressions: [{
@@ -2636,7 +2694,7 @@ async function checkProject(options = {}) {
   const cwd = path5.resolve(options.cwd || process.cwd());
   const root = await fs6.realpath(gitOutputPath(await git(cwd, ["rev-parse", "--show-toplevel"], options.signal)));
   const config = loadConfig(root);
-  const failOn = options.failOn ?? config.failOn ?? ["test-skip", "trivial-assert", "test-focus"];
+  const failOn = options.failOn ?? config.failOn ?? ["test-skip", "trivial-assert", "test-focus", "assertion-weakened", "guard-weakened"];
   for (const rule of failOn) if (!VALID_DETECTORS.includes(rule)) throw new ConfigError(`Unknown rule '${rule}'.`);
   const format = options.format || "terminal";
   if (!["terminal", "json", "github", "markdown", "sarif"].includes(format)) throw new ConfigError("Unsupported check output format.");
@@ -2673,14 +2731,14 @@ async function checkProject(options = {}) {
   const applied = baseline ? applyBaseline(infractions, baseline) : { findings: infractions, baselineCount: 0, staleBaselineCount: 0 };
   const notInBaseline = new Set(applied.findings);
   const acceptedCounts = /* @__PURE__ */ new Map();
-  for (const finding of infractions) {
-    if (notInBaseline.has(finding)) continue;
-    const fingerprint = findingFingerprint(finding);
+  for (const finding2 of infractions) {
+    if (notInBaseline.has(finding2)) continue;
+    const fingerprint = findingFingerprint(finding2);
     acceptedCounts.set(fingerprint, (acceptedCounts.get(fingerprint) ?? 0) + 1);
   }
   const exceptions = applyExceptions(applied.findings, options.ignoreExceptions ? [] : config.exceptions, /* @__PURE__ */ new Date(), acceptedCounts);
   const findings = exceptions.findings;
-  const failedRules = [...new Set(findings.filter((finding) => failOn.includes(finding.type)).map((finding) => finding.type))];
+  const failedRules = [...new Set(findings.filter((finding2) => failOn.includes(finding2.type)).map((finding2) => finding2.type))];
   const complete = skippedFiles.length === 0;
   const passed = complete && failedRules.length === 0;
   const result = {
@@ -2712,24 +2770,355 @@ async function checkProject(options = {}) {
 
 // src/review.ts
 import path6 from "path";
+
+// src/tampering.ts
+import { createHash as createHash3 } from "crypto";
+var EMPTY = { immediate: [], removedTests: [], addedHashes: [], rewritten: [] };
+function languageOf(file) {
+  if (/\.(?:[cm]?[jt]sx?)$/i.test(file)) return "js";
+  if (/\.py$/i.test(file)) return "py";
+  if (/_test\.go$/i.test(file)) return "go";
+  return null;
+}
+function codeLines(text, language) {
+  let block = false;
+  return text.split(/\r?\n/).map((line) => {
+    const trimmed = line.trim();
+    if (language !== "py") {
+      if (block) {
+        if (trimmed.includes("*/")) block = false;
+        return "";
+      }
+      if (trimmed.startsWith("/*")) {
+        if (!trimmed.includes("*/")) block = true;
+        return "";
+      }
+      if (trimmed.startsWith("//")) return "";
+    } else if (trimmed.startsWith("#")) return "";
+    return line;
+  });
+}
+var JS_TEST_START = /(?<![\w$.])(?:it|test)(?:\s*\.\s*(?:only|skip|concurrent|serial))*\s*\(\s*(['"`])((?:\\.|(?!\1)[^\\\n])*)\1/;
+var PY_TEST_START = /^\s*(?:async\s+)?def\s+(test\w*)\s*\(/;
+var GO_TEST_START = /^func\s+(Test\w+)\s*\(/;
+var JS_ASSERTION = /(?<![\w$.])(?:expect|assert|expectTypeOf)\b(?!\s*\.\s*(?:assertions|hasAssertions|extend|anything|any|objectContaining|arrayContaining|stringContaining|stringMatching)\b)(?:\s*\.\s*\w+)*\s*\(|\.should\b/;
+var PY_ASSERTION = /^\s*assert\b|\bself\s*\.\s*assert\w*\s*\(|\bpytest\s*\.\s*raises\b|\bassertRaises\b/;
+var GO_ASSERTION = /\bt\s*\.\s*(?:Error|Errorf|Fatal|Fatalf|Fail|FailNow)\b|\b(?:assert|require)\s*\.\s*\w+\s*\(/;
+function callEnd(text, from, limit) {
+  let depth = 1, quote = "";
+  for (let i = from; i < limit; i++) {
+    const char = text[i];
+    if (quote) {
+      if (char === "\\") i++;
+      else if (char === quote || char === "\n" && quote !== "`") quote = "";
+    } else if (char === '"' || char === "'" || char === "`") quote = char;
+    else if (char === "/" && text[i + 1] === "/" && (i === from || /\s/.test(text[i - 1]))) {
+      const newline = text.indexOf("\n", i);
+      i = newline < 0 || newline > limit ? limit : newline;
+    } else if (char === "(") depth++;
+    else if (char === ")" && --depth === 0) return i;
+  }
+  return limit;
+}
+function testBodies(text, language) {
+  const lines = codeLines(text, language);
+  if (language === "js") {
+    const code = lines.join("\n");
+    const matches = [...code.matchAll(new RegExp(JS_TEST_START.source, "g"))];
+    let line = 1, cursor = 0;
+    return matches.map((match, i) => {
+      const at = match.index ?? 0;
+      for (; cursor < at; cursor++) if (code.charCodeAt(cursor) === 10) line++;
+      const from = at + match[0].length;
+      const limit = i + 1 < matches.length ? matches[i + 1].index ?? code.length : code.length;
+      return { name: match[2], line, body: code.slice(from, Math.min(callEnd(code, from, limit) + 1, limit)), parametrized: false };
+    });
+  }
+  const startPattern = language === "py" ? PY_TEST_START : GO_TEST_START;
+  const starts = [];
+  lines.forEach((line, index) => {
+    const match = startPattern.exec(line);
+    if (match) starts.push({ index, name: match[1], length: match[0].length });
+  });
+  const indentOf = (line) => /^\s*/.exec(line)[0].length;
+  return starts.map((start, n) => {
+    const limit = n + 1 < starts.length ? starts[n + 1].index : lines.length;
+    const header = lines[start.index], indent = indentOf(header);
+    let end = start.index + 1, depth = balance(header);
+    while (depth > 0 && end < limit) depth += balance(lines[end++]);
+    while (end < limit && (language === "go" ? lines[end - 1] !== "}" : !lines[end].trim() || indentOf(lines[end]) > indent)) end++;
+    let top = start.index;
+    while (top > 0 && start.index - top < 200 && lines[top - 1].trim() && !/^\s*(?:async\s+)?(?:def|class)\b/.test(lines[top - 1])) top--;
+    return {
+      name: start.name,
+      line: start.index + 1,
+      body: [header.slice(start.length), ...lines.slice(start.index + 1, end)].join("\n"),
+      parametrized: /parametrize/.test(lines.slice(top, start.index).join("\n"))
+    };
+  });
+}
+function balance(line) {
+  const bare = line.replace(/(['"`])(?:\\.|(?!\1)[^\\])*\1/g, "");
+  let net = 0;
+  for (const char of bare) net += "([{".includes(char) ? 1 : ")]}".includes(char) ? -1 : 0;
+  return net;
+}
+function normalize(statement) {
+  return statement.replace(/\s+/g, "").replace(/'/g, '"').replace(/,([)\]}])/g, "$1").replace(/;$/, "");
+}
+function splitStatements(text) {
+  const pieces = [];
+  let quote = "", start = 0;
+  for (let i = 0; i < text.length; i++) {
+    const char = text[i];
+    if (quote) {
+      if (char === "\\") i++;
+      else if (char === quote) quote = "";
+    } else if (char === '"' || char === "'" || char === "`") quote = char;
+    else if (char === ";") {
+      pieces.push(text.slice(start, i));
+      start = i + 1;
+    }
+  }
+  pieces.push(text.slice(start));
+  return pieces.map((piece) => piece.trim()).filter(Boolean);
+}
+var CALLBACK_HEADER = /^[,\s]*(?:async\s*)?(?:\([^)]*\)|[\w$]+)\s*=>\s*\{\s*|^[,\s]*(?:async\s+)?function\s*\w*\s*\([^)]*\)\s*\{\s*/;
+function parseTests(text, language) {
+  const assertionPattern = language === "js" ? JS_ASSERTION : language === "py" ? PY_ASSERTION : GO_ASSERTION;
+  const seen = /* @__PURE__ */ new Map();
+  return testBodies(text, language).map((test) => {
+    const body = test.body.split("\n");
+    const assertions = [], raw = [], setupLines = [];
+    for (let i = 0; i < body.length; i++) {
+      if (!assertionPattern.test(body[i])) {
+        setupLines.push(body[i]);
+        continue;
+      }
+      let statement = body[i].trim(), depth = balance(body[i]);
+      while (depth > 0 && i + 1 < body.length) {
+        i++;
+        statement += " " + body[i].trim();
+        depth += balance(body[i]);
+      }
+      for (const piece of language === "js" ? splitStatements(statement) : [statement]) {
+        const clean = piece.replace(CALLBACK_HEADER, "");
+        if (assertionPattern.test(clean)) {
+          raw.push(clean);
+          assertions.push(normalize(clean));
+        } else setupLines.push(clean);
+      }
+    }
+    const setup = setupLines.join("\n").replace(/\s+/g, "");
+    const bodyHash = createHash3("sha1").update(test.body.replace(/\s+/g, "")).digest("hex");
+    const count = (seen.get(test.name) ?? 0) + 1;
+    seen.set(test.name, count);
+    return { key: `${test.name}#${count}`, parametrized: test.parametrized, name: test.name, line: test.line, assertions, raw, setup, bodyHash };
+  });
+}
+function skeleton(assertion) {
+  return assertion.replace(/(['"`])(?:\\.|(?!\1)[^\\])*\1/g, "S").replace(/\b\d+(?:\.\d+)?\b/g, "N").replace(/\b(?:true|false|null|undefined|None|True|False|nil)\b/g, "V").replace(/\s+/g, "");
+}
+var WEAK_JS = /\.(?:toBeDefined|toBeTruthy|toBeFalsy|toBeUndefined)\s*\(|\.not\s*\.\s*(?:toBeNull|toBeUndefined|toThrow)\s*\(|\.toBeGreaterThanOrEqual\s*\(\s*0\s*\)/;
+var WEAK_PY = /^\s*assert\s+[\w.()\[\]]+\s*$|^\s*assert\s+.+\sis\s+not\s+None\s*$|^\s*assert\s+True\s*$/;
+function isWeaker(oldAssertion, newAssertion, language) {
+  if (language === "js") return WEAK_JS.test(newAssertion) && !WEAK_JS.test(oldAssertion);
+  if (language === "py") return WEAK_PY.test(newAssertion) && !WEAK_PY.test(oldAssertion);
+  return false;
+}
+function finding(type, file, line, snippet, reason, commit) {
+  return { type, file, lineNumber: Math.max(1, line), lineSnippet: snippet, commitHash: commit, commitDate: "", reason, suggestion: RULE_GUIDES[type].suggestion };
+}
+function analyzeTestFile(oldPath, newPath, oldText, newText, commit) {
+  const language = languageOf(newText === null ? oldPath : newPath);
+  if (!language || !(isTestFile(newPath) || isTestFile(oldPath))) return EMPTY;
+  const before = oldText === null ? [] : parseTests(oldText, language);
+  const after = newText === null ? [] : parseTests(newText, language);
+  const afterByKey = new Map(after.map((test) => [test.key, test]));
+  const newCode = newText === null ? "" : codeLines(newText, language).join("\n");
+  const tally = (tests) => {
+    const totals = /* @__PURE__ */ new Map();
+    for (const test of tests) for (const assertion of test.assertions) totals.set(assertion, (totals.get(assertion) ?? 0) + 1);
+    return totals;
+  };
+  const oldTotals = tally(before), newTotals = tally(after);
+  const beforeKeys = new Set(before.map((test) => test.key));
+  const result = { immediate: [], removedTests: [], addedHashes: [], rewritten: [] };
+  for (const test of after) if (!beforeKeys.has(test.key)) result.addedHashes.push(test.bodyHash);
+  for (const old of before) {
+    const current = afterByKey.get(old.key);
+    if (!current) {
+      if (newCode && ['"', "'", "`"].some((quote) => newCode.includes(quote + old.name + quote))) continue;
+      result.removedTests.push({
+        bodyHash: old.bodyHash,
+        finding: finding(
+          "test-removed",
+          newPath,
+          1,
+          `${old.name}: test no longer present`,
+          newText === null ? "Test file deleted" : "Test removed",
+          commit
+        )
+      });
+      continue;
+    }
+    if (current.parametrized && !old.parametrized) continue;
+    const snapshot = (test) => test.raw.some((statement) => /\.toMatch(?:Inline)?Snapshot\b|\.matchSnapshot\b|\bsnapshot\s*\(/.test(statement));
+    if (snapshot(current) && !snapshot(old)) continue;
+    if (current.assertions.length < old.assertions.length) {
+      const budget = tally([current]);
+      const lost = old.assertions.filter((assertion) => {
+        const left = budget.get(assertion) ?? 0;
+        if (left > 0) {
+          budget.set(assertion, left - 1);
+          return false;
+        }
+        return true;
+      });
+      if (lost.every((assertion) => (newTotals.get(assertion) ?? 0) >= (oldTotals.get(assertion) ?? 0))) continue;
+      result.immediate.push(finding(
+        "assertion-weakened",
+        newPath,
+        current.line,
+        `${old.name}: ${old.assertions.length} \u2192 ${current.assertions.length} assertions`,
+        "Test checks less than before",
+        commit
+      ));
+      continue;
+    }
+    if (current.assertions.length === old.assertions.length && old.assertions.length > 0) {
+      const changed = old.assertions.map((assertion, i) => ({ before: assertion, after: current.assertions[i], rawBefore: old.raw[i], rawAfter: current.raw[i] })).filter((pair) => pair.before !== pair.after);
+      const weaker = changed.find((pair) => isWeaker(pair.rawBefore, pair.rawAfter, language));
+      if (weaker) {
+        result.immediate.push(finding(
+          "assertion-weakened",
+          newPath,
+          current.line,
+          `${old.name}: ${weaker.rawBefore.slice(0, 80)} \u2192 ${weaker.rawAfter.slice(0, 80)}`,
+          "Assertion replaced by a weaker check",
+          commit
+        ));
+      } else if (changed.length && old.setup === current.setup && changed.every((pair) => skeleton(pair.before) === skeleton(pair.after))) {
+        result.rewritten.push(finding(
+          "expectation-rewritten",
+          newPath,
+          current.line,
+          `${old.name}: ${changed[0].rawBefore.slice(0, 80)} \u2192 ${changed[0].rawAfter.slice(0, 80)}`,
+          "Expected value edited while the test inputs stayed the same",
+          commit
+        ));
+      }
+    }
+  }
+  return result;
+}
+function resolveTampering(files, productionChanged) {
+  const added = new Set(files.flatMap((file) => file.addedHashes));
+  return [
+    ...files.flatMap((file) => file.immediate),
+    ...files.flatMap((file) => file.removedTests).filter((removed) => !added.has(removed.bodyHash)).map((removed) => removed.finding),
+    ...productionChanged ? files.flatMap((file) => file.rewritten) : []
+  ];
+}
+var GUARD_FILE = /(?:^|\/)(?:package\.json|tsconfig[^/]*\.json|jsconfig\.json|(?:jest|vitest|vite)\.config\.[cm]?[jt]s|\.eslintrc(?:\.[a-z]+)?|eslint\.config\.[cm]?[jt]s|pyproject\.toml|setup\.cfg|pytest\.ini|tox\.ini|\.coveragerc|codecov\.ya?ml|\.gitlab-ci\.ya?ml|\.github\/workflows\/[^/]+\.ya?ml)$/i;
+function isGuardFile(file) {
+  return GUARD_FILE.test(file);
+}
+function lineOf(text, index) {
+  let line = 1;
+  for (let i = 0; i < index && i < text.length; i++) if (text.charCodeAt(i) === 10) line++;
+  return line;
+}
+function numbers(text, pattern) {
+  const seen = /* @__PURE__ */ new Map();
+  return [...text.matchAll(pattern)].map((match) => {
+    const label = match[1] ?? "value";
+    const count = (seen.get(label) ?? 0) + 1;
+    seen.set(label, count);
+    return { key: `${label}#${count}`, value: Number(match[match.length - 1]), index: match.index ?? 0 };
+  });
+}
+var THRESHOLD_PATTERNS = [
+  /\b(lines|branches|functions|statements)\b["']?\s*[:=]\s*(\d+(?:\.\d+)?)/g,
+  /\b(fail_under)\s*[:=]\s*(\d+(?:\.\d+)?)/g,
+  /(--cov-fail-under)[= ](\d+(?:\.\d+)?)/g
+];
+var SWITCHES = ["strict", "noImplicitAny", "strictNullChecks", "noImplicitReturns", "useUnknownInCatchVariables"];
+var TEST_COMMAND = /\brun:.*\b(?:tests?|unit|pytest|vitest|jest|mocha|ava|tap|tox|nox|e2e|spec)\b|^\s*-?\s*(?:npm|yarn|pnpm|go|cargo|mvn|gradle|make)\s+(?:run\s+)?(?:\w+\s+)?tests?\b/;
+function severityOf(value) {
+  return /^(?:error|2)$/.test(value) ? 2 : /^(?:warn|1)$/.test(value) ? 1 : 0;
+}
+function analyzeGuardFile(file, oldText, newText, commit) {
+  if (oldText === null || newText === null) return [];
+  const out = [];
+  const add = (index, snippet, reason) => out.push(finding("guard-weakened", file, lineOf(newText, index), snippet, reason, commit));
+  if (/threshold|fail_under|cov-fail-under|coverage/i.test(newText)) {
+    for (const pattern of THRESHOLD_PATTERNS) {
+      const old = new Map(numbers(oldText, pattern).map((item) => [item.key, item.value]));
+      for (const item of numbers(newText, pattern)) {
+        const previous = old.get(item.key);
+        if (previous !== void 0 && item.value < previous) {
+          add(item.index, `${item.key.split("#")[0]}: ${previous} \u2192 ${item.value}`, "Coverage threshold lowered");
+        }
+      }
+    }
+  }
+  if (/(?:^|\/)(?:tsconfig|jsconfig)[^/]*\.json$/i.test(file)) {
+    for (const name of SWITCHES) {
+      const pattern = new RegExp(`"${name}"\\s*:\\s*(true|false)`);
+      const before = pattern.exec(oldText), after = pattern.exec(newText);
+      if (before?.[1] === "true" && after?.[1] === "false") add(after.index, `${name}: true \u2192 false`, "Compiler strictness switched off");
+    }
+  }
+  if (/eslint/i.test(file)) {
+    const rules = (text) => new Map([...text.matchAll(/["']([@\w/.-]+)["']\s*:\s*(?:\[\s*)?["']?(error|warn|off|[012])["']?/g)].map((match) => [match[1], { level: severityOf(match[2]), index: match.index ?? 0 }]));
+    const before = rules(oldText);
+    for (const [name, now] of rules(newText)) {
+      const previous = before.get(name);
+      if (previous && previous.level === 2 && now.level < 2) add(now.index, `${name}: error \u2192 ${now.level ? "warn" : "off"}`, "Lint rule downgraded");
+    }
+  }
+  if (/(?:\.github\/workflows\/|\.gitlab-ci)/.test(file)) {
+    const count = (text, pattern) => text.split(/\r?\n/).filter((line) => !line.trim().startsWith("#") && pattern.test(line)).length;
+    const lenient = /continue-on-error:\s*true|allow_failure:\s*true/;
+    if (count(newText, lenient) > count(oldText, lenient)) {
+      add(newText.search(lenient), "continue-on-error: true", "CI step is now allowed to fail");
+    }
+    if (count(newText, TEST_COMMAND) < count(oldText, TEST_COMMAND)) {
+      add(0, "test command no longer runs in CI", "Test step removed from CI");
+    }
+  }
+  if (/(?:^|\/)package\.json$/i.test(file)) {
+    try {
+      const before = JSON.parse(oldText)?.scripts?.test, after = JSON.parse(newText)?.scripts?.test;
+      if (typeof before === "string" && typeof after === "string" && before !== after && (/^\s*(?:echo\b|true\b|exit\s+0|:)/.test(after) || /\|\|\s*(?:true|exit\s+0)\b/.test(after) || /--passWithNoTests/.test(after) && !/--passWithNoTests/.test(before))) {
+        add(Math.max(0, newText.indexOf('"test"')), `test: ${after}`, "Test script can no longer fail");
+      }
+    } catch {
+    }
+  }
+  return out;
+}
+
+// src/review.ts
 var GENERATED_PATHS2 = ["**/node_modules/**", "**/dist/**", "**/build/**", "**/vendor/**", "**/*.min.js", "**/*.map"];
 var MAX_SCAN_BYTES2 = 50 * 1024 * 1024;
 function compareFindings(before, after, newPath) {
   const old = /* @__PURE__ */ new Map();
-  for (const finding of before) {
-    const key = findingFingerprint({ ...finding, file: newPath });
+  for (const finding2 of before) {
+    const key = findingFingerprint({ ...finding2, file: newPath });
     const bucket = old.get(key) || { findings: [], matched: 0 };
-    bucket.findings.push(finding);
+    bucket.findings.push(finding2);
     old.set(key, bucket);
   }
   const introduced = [];
   let unchanged = 0;
-  for (const finding of after) {
-    const bucket = old.get(findingFingerprint(finding));
+  for (const finding2 of after) {
+    const bucket = old.get(findingFingerprint(finding2));
     if (bucket && bucket.matched < bucket.findings.length) {
       bucket.matched++;
       unchanged++;
-    } else introduced.push(finding);
+    } else introduced.push(finding2);
   }
   return { introduced, removed: [...old.values()].flatMap((bucket) => bucket.findings.slice(bucket.matched)), unchanged };
 }
@@ -2747,7 +3136,7 @@ async function compareSourceChanges(options) {
   const policy = refs.baseSha === "EMPTY" ? { config: configFromText("{}", "default first-commit policy"), filename: null } : await reviewPolicy(cwd, refs.baseSha, options.signal);
   const format = options.format ?? "terminal";
   if (!["terminal", "json", "github", "markdown", "sarif"].includes(format)) throw new ConfigError("Unsupported review format.");
-  const failOn = options.failOn ?? policy.config.failOn ?? ["test-skip", "trivial-assert", "test-focus"];
+  const failOn = options.failOn ?? policy.config.failOn ?? ["test-skip", "trivial-assert", "test-focus", "assertion-weakened", "guard-weakened"];
   for (const rule of failOn) if (!VALID_DETECTORS.includes(rule)) throw new ConfigError(`Unknown review rule '${rule}'.`);
   const changes = staged?.changes ?? await changedTreeFiles(cwd, refs.mergeBaseSha, refs.headSha, options.signal);
   const policyChanges = changes.filter((change) => CONFIG_FILENAMES.includes(change.oldPath) || CONFIG_FILENAMES.includes(change.newPath)).map((change) => change.newPath);
@@ -2779,13 +3168,39 @@ async function compareSourceChanges(options) {
     output: ""
   };
   let totalBytes = 0;
+  const tamperingFiles = [];
+  const guardFindings = [];
+  let productionChanged = false;
+  const readText = async (mode, oid) => {
+    if (mode === "000000") return null;
+    if (!["100644", "100755"].includes(mode)) throw new ConfigError("Changed source is a symlink, submodule or unsupported Git mode; comparison is incomplete.");
+    const content = await readBlob(cwd, oid, options.signal);
+    totalBytes += content.length;
+    if (totalBytes > MAX_SCAN_BYTES2) throw new ConfigError("Review exceeds the 50 MiB source comparison limit.");
+    if (content.includes(0)) throw new ConfigError("Binary content in a source comparison.");
+    return new TextDecoder("utf-8", { fatal: true }).decode(content);
+  };
   const existingCounts = /* @__PURE__ */ new Map();
   for (const change of changes) {
     assertNotAborted(options.signal);
     const oldSupported = change.oldMode !== "000000" && isCodeFile(change.oldPath);
     const newSupported = change.newMode !== "000000" && isCodeFile(change.newPath);
     if (!oldSupported && !newSupported) {
-      result.unsupportedFiles++;
+      const guarded = (isGuardFile(change.newPath) || isGuardFile(change.oldPath)) && isCodeFile(change.newPath + ".ts", ignores);
+      if (!guarded) {
+        result.unsupportedFiles++;
+        continue;
+      }
+      try {
+        const oldText = await readText(change.oldMode, change.oldOid);
+        const newText = await readText(change.newMode, change.newOid);
+        guardFindings.push(...analyzeGuardFile(change.newPath, oldText, newText, refs.headSha));
+        result.filesInspected++;
+      } catch (error) {
+        assertNotAborted(options.signal);
+        result.skippedFiles.push({ file: change.newPath, reason: error instanceof Error ? error.message : String(error) });
+        if (totalBytes > MAX_SCAN_BYTES2) break;
+      }
       continue;
     }
     const oldInScope = oldSupported && isCodeFile(change.oldPath, ignores);
@@ -2796,14 +3211,8 @@ async function compareSourceChanges(options) {
     }
     try {
       let inspectedLines = 0;
-      const scan = async (mode, oid, filename, commit) => {
-        if (mode === "000000") return [];
-        if (!["100644", "100755"].includes(mode)) throw new ConfigError("Changed source is a symlink, submodule or unsupported Git mode; comparison is incomplete.");
-        const content = await readBlob(cwd, oid, options.signal);
-        totalBytes += content.length;
-        if (totalBytes > MAX_SCAN_BYTES2) throw new ConfigError("Review exceeds the 50 MiB source comparison limit.");
-        if (content.includes(0)) throw new ConfigError("Binary content in a source comparison.");
-        const text = new TextDecoder("utf-8", { fatal: true }).decode(content);
+      const scan = (text, filename, commit) => {
+        if (text === null) return [];
         const lines = text.split(/\r?\n/);
         if (lines.at(-1) === "") lines.pop();
         inspectedLines += lines.length;
@@ -2812,13 +3221,18 @@ async function compareSourceChanges(options) {
       if (oldSupported && !newSupported && change.newMode !== "000000") {
         throw new ConfigError("Source moved to an unsupported extension; cannot claim its findings were resolved.");
       }
-      const before = await scan(change.oldMode, change.oldOid, change.oldPath, refs.mergeBaseSha);
-      const after = await scan(change.newMode, change.newOid, change.newPath, refs.headSha);
+      const oldText = await readText(change.oldMode, change.oldOid);
+      const newText = await readText(change.newMode, change.newOid);
+      const before = scan(oldText, change.oldPath, refs.mergeBaseSha);
+      const after = scan(newText, change.newPath, refs.headSha);
+      if (isTestFile(change.oldPath) || isTestFile(change.newPath)) tamperingFiles.push(analyzeTestFile(change.oldPath, change.newPath, oldText, newText, refs.headSha));
+      else if (change.oldOid !== change.newOid) productionChanged = true;
+      if ((isGuardFile(change.newPath) || isGuardFile(change.oldPath)) && oldText !== null && newText !== null) guardFindings.push(...analyzeGuardFile(change.newPath, oldText, newText, refs.headSha));
       const compared = compareFindings(before, after, change.newPath);
       const introduced = new Set(compared.introduced);
-      for (const finding of after) {
-        if (introduced.has(finding)) continue;
-        const fingerprint = findingFingerprint(finding);
+      for (const finding2 of after) {
+        if (introduced.has(finding2)) continue;
+        const fingerprint = findingFingerprint(finding2);
         existingCounts.set(fingerprint, (existingCounts.get(fingerprint) ?? 0) + 1);
       }
       result.infractions.push(...compared.introduced);
@@ -2837,11 +3251,13 @@ async function compareSourceChanges(options) {
   assertNotAborted(options.signal);
   await staged?.verify();
   result.complete = result.skippedFiles.length === 0;
+  const rules = policy.config.rules ?? {};
+  result.infractions.push(...[...resolveTampering(tamperingFiles, productionChanged), ...guardFindings].filter((finding2) => rules[finding2.type] !== "off"));
   const exceptions = applyExceptions(result.infractions, options.ignoreExceptions ? [] : policy.config.exceptions, /* @__PURE__ */ new Date(), existingCounts);
   result.infractions = exceptions.findings;
   result.suppressedFindings = exceptions.suppressedFindings;
   result.expiredExceptionCount = exceptions.expiredExceptionCount;
-  result.failedRules = [...new Set(result.infractions.filter((finding) => failOn.includes(finding.type)).map((finding) => finding.type))];
+  result.failedRules = [...new Set(result.infractions.filter((finding2) => failOn.includes(finding2.type)).map((finding2) => finding2.type))];
   result.passed = result.complete && result.failedRules.length === 0;
   result.exitCode = !result.complete ? 2 : result.passed ? 0 : 1;
   if (format === "json") result.output = JSON.stringify(result, null, 2);

package/dist/cli.js

@@ -22,7 +22,7 @@ import {
   roastRepository,
   terminalText,
   writeBaseline
-} from "./chunk-C423TSZF.js";
+} from "./chunk-GMBQNL6Z.js";
 
 // src/cli.ts
 import { Command } from "commander";
@@ -254,7 +254,7 @@ program.command("init").description("Initialize .agentroastrc.json and CI/hook c
       hook: opts.hook
     });
     if (res.created.length > 0) {
-      console.log(`Initialized agent-roast in ${terminalText(targetDir)}:`);
+      console.log(`Initialized agent-roast in ${terminalText(res.directory)}:`);
       for (const file of res.created) {
         console.log(`  + Created ${terminalText(file)}`);
       }

package/dist/index.d.ts

@@ -32,7 +32,7 @@ interface CommitInfo {
     isAiAttributed: boolean;
     aiSignatures: string[];
 }
-type DetectorType = "test-skip" | "type-escape" | "swallowed-error" | "panic-loop" | "trivial-assert" | "stub-abandonment" | "test-focus";
+type DetectorType = "test-skip" | "type-escape" | "swallowed-error" | "panic-loop" | "trivial-assert" | "stub-abandonment" | "test-focus" | "assertion-weakened" | "test-removed" | "expectation-rewritten" | "guard-weakened";
 declare const VALID_DETECTORS: readonly DetectorType[];
 interface Infraction {
     fingerprint?: string;
@@ -366,6 +366,8 @@ interface InitOptions {
     hook?: boolean;
 }
 interface InitResult {
+    /** Actual project root containing the initialized files. */
+    directory: string;
     created: string[];
     skipped: string[];
 }

package/dist/index.js

@@ -63,7 +63,7 @@ import {
   unquoteGitPath,
   validateExceptions,
   writeBaseline
-} from "./chunk-C423TSZF.js";
+} from "./chunk-GMBQNL6Z.js";
 export {
   CONFIG_FILENAMES,
   ConfigError,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-roast",
-  "version": "0.8.0",
-  "description": "Offline code checks for skipped tests, swallowed errors, unfinished stubs and AI coding shortcuts",
+  "version": "0.9.0",
+  "description": "Offline review for AI-assisted changes: catches weakened tests, lowered quality gates, skipped tests and swallowed errors",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -20,16 +20,22 @@
     "test": "vitest run",
     "prepublishOnly": "npm run build",
     "pretest": "npm run build",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "bench": "node scripts/benchmark-recall.mjs",
+    "bench:noise": "node scripts/benchmark-noise.mjs"
   },
   "keywords": [
     "ai",
     "agents",
-    "cursor",
+    "ai-agents",
     "claude-code",
-    "roast",
+    "cursor",
+    "codex",
+    "code-review",
+    "test-quality",
+    "ci",
+    "sarif",
     "git",
-    "code-quality",
     "cli"
   ],
   "author": "Nari-Ab",
@@ -47,9 +53,7 @@
     "picocolors": "^1.1.0"
   },
   "devDependencies": {
-    "@napi-rs/canvas": "^1.0.10",
     "@types/node": "^20.0.0",
-    "gifenc": "^1.0.3",
     "tsup": "^8.0.0",
     "typescript": "^5.0.0",
     "vitest": "^4.1.12"

package/schema.json

@@ -20,7 +20,11 @@
           "panic-loop",
           "trivial-assert",
           "stub-abandonment",
-          "test-focus"
+          "test-focus",
+          "assertion-weakened",
+          "test-removed",
+          "expectation-rewritten",
+          "guard-weakened"
         ]
       }
     },
@@ -94,6 +98,34 @@
             "warn",
             "off"
           ]
+        },
+        "assertion-weakened": {
+          "enum": [
+            "error",
+            "warn",
+            "off"
+          ]
+        },
+        "test-removed": {
+          "enum": [
+            "error",
+            "warn",
+            "off"
+          ]
+        },
+        "expectation-rewritten": {
+          "enum": [
+            "error",
+            "warn",
+            "off"
+          ]
+        },
+        "guard-weakened": {
+          "enum": [
+            "error",
+            "warn",
+            "off"
+          ]
         }
       }
     },