agent-roast 0.8.1 → 0.9.0

package/README.md

@@ -17,36 +17,75 @@
 
 </div>
 
-`agent-roast` is an offline review aid for skipped tests, fake assertions, swallowed
-errors, unfinished stubs and type-check bypasses. Start with the code you have now;
-no AI commit tags, cloud account, API key or commit history are required for `check`.
-A Git repository is required; `git init` is sufficient.
+**Did the AI fix the code, or just make the checks pass?**
+
+Coding agents (and tired humans) often get a red build green by changing the *checks*
+instead of the *code*: deleting the failing assertion, weakening it to `toBeDefined()`,
+removing the test, lowering the coverage threshold, switching off `strict`, or letting
+CI steps fail. A linter reading the new file cannot see that, because nothing in the new
+file looks wrong. `agent-roast review` compares the **before and after** of a change and
+flags exactly these moves. It is offline, runs no project code, and needs only Git.
 
 ```bash
-# Inspect current tracked + non-ignored untracked source files
-npx agent-roast check
+npx agent-roast review --base origin/main        # a pull request
+npx agent-roast --staged                         # what you are about to commit
+```
 
-# Understand a finding and what to do next
+| Rule | Fires when | Blocks by default |
+| --- | --- | --- |
+| `assertion-weakened` | a test keeps its name but loses assertions, or an exact check becomes `toBeDefined`/`toBeTruthy`/`assert x` | yes |
+| `guard-weakened` | coverage threshold lowered, `strict`/`noImplicitAny` off, lint rule downgraded, CI step may fail or no longer runs tests, test script cannot fail | yes |
+| `test-removed` | a test (or test file) disappears and no identical body appears elsewhere | no, reported |
+| `expectation-rewritten` | an expected value changed, test inputs did not, and production code changed in the same PR | no, reported |
+| `test-skip`, `test-focus`, `trivial-assert`, `swallowed-error`, `type-escape`, `stub-abandonment` | the classic shortcuts, compared before/after so old debt does not block | skip/focus/trivial: yes |
+
+Renames, moved tests, parametrization, and formatter rewraps (prettier, black) are
+recognized and not reported. Intentional cases can be accepted one by one with an
+expiring, reviewed exception (see below). Policy is read from the base branch, so a PR
+cannot switch the rules off for itself.
+
+### How well does it work?
+
+Measured, not promised (`npm run build`, then `npm run bench` and `npm run bench:noise`;
+method and raw numbers are in [docs/benchmarks.md](docs/benchmarks.md)):
+
+- **Labeled changes** (`benchmarks/cases.mjs`): 32 cheating edits across JS/TS, Python, Go
+  and CI/config files are caught, and 15 harmless look-alikes (reformat, rename, move,
+  parametrize, snapshot, raised thresholds, CI step split) stay silent. The cases were
+  written together with the detector, so they guard against regressions; they do not prove
+  accuracy. Three known gaps are listed in the file and still open: mocking the module
+  under test, hardcoding the tested value, and vacuous matchers such as `expect.anything()`.
+- **Noise on real human history** (the last 300 commits of commander.js, execa, click,
+  requests and zod; 606 of them touched tests or CI/config): the two blocking rules fired on
+  7 commits (1.2%). Each was read by hand: one was a real defect (a refactor in `requests`
+  dropped the `assert` keyword, leaving a comparison with no effect); the other six were
+  deliberate rewrites a reviewer should still see, such as a test-framework migration,
+  dropping Python 2, or a documented `continue-on-error`. `test-removed` fired on 6.1% and
+  `expectation-rewritten` on 2.8% of those commits, which is why they only report.
+- **Not measured yet:** accuracy on real AI-agent pull requests. The sample above is human
+  history, and it is small. Treat the numbers as a floor for noise, not a guarantee.
+
+It is a **review aid**. It cannot prove who wrote a change or that code is correct, and it
+reads text, not program semantics. A green result is not a quality certificate.
+
+### Quick start
+
+```bash
+# Everything that is true of the code you have now
+npx agent-roast check
 npx agent-roast explain swallowed-error
 
-# Adopt it in an existing project without blocking on all historical debt
+# Adopt in an existing project without blocking on historical debt
 npx agent-roast check --write-baseline .agentroast-baseline.json
-# Review the findings and commit this policy file, then gate only new problems
 npx agent-roast check --baseline .agentroast-baseline.json
 
-# Verify precisely what you are about to commit
-npx agent-roast --staged
-
-# Audit pull request diffs (CI gate)
-npx agent-roast review --base origin/main --head HEAD --format github
-
-# Optional historical audit
+# Optional: score a repository's history
 npx agent-roast --all --verbose
 ```
 
-A finding includes its file and line, the source snippet, and a concrete next step.
-To see the complete machine-readable result, use `check --format json`; terminal
-output shows the first 20 findings. `check --format markdown` produces a review table.
+A finding includes its file and line, the evidence, and a concrete next step.
+`--format json|markdown|sarif|github` are available; terminal output shows the first
+20 findings.
 
 ### Context review for pull requests
 
@@ -106,12 +145,12 @@ regressions) may appear in the report/summary rather than as an inline PR annota
 Use a separate SARIF category for introduced-findings review; it does not represent
 a full scan of all outstanding alerts.
 
-Install 0.8.1: `npx agent-roast@0.8.1 review --base origin/main`. For local development,
+Install 0.9.0: `npx agent-roast@0.9.0 review --base origin/main`. For local development,
 run `npm run build` and use `node dist/cli.js`.
 
 ### Precise exceptions (since 0.8.0)
 
-Use `npx agent-roast@0.8.1 check --format json`, or build this checkout with
+Use `npx agent-roast@0.9.0 check --format json`, or build this checkout with
 `npm run build` and run `node dist/cli.js`.
 
 Some skipped integrations or abstract stubs are intentional. In 0.8.0 you can accept
@@ -347,7 +386,7 @@ jobs:
 
 To pilot the Action without blocking on findings, set `advisory: true`. It passes
 an explicit empty fail-on list; invalid configuration, Git errors and incomplete
-scans still fail. The `v1` Action installs 0.8.1. The CLI equivalent is `--fail-on ''`.
+scans still fail. The `v1` Action installs 0.9.0. The CLI equivalent is `--fail-on ''`.
 
 > **Security Note:** `agent-roast` runs in an isolated runner directory (`$RUNNER_TEMP`) with `--ignore-scripts` to neutralize malicious `.npmrc` files in untrusted pull requests. `pull_request_target` is not supported.
 
@@ -435,7 +474,7 @@ node scripts/verify-user-workflows.mjs dist/cli.js
 against current code. Regression tests use disposable Git repositories. The programmatic
 `auditPullRequest({ staged: true })` API retains the legacy added-lines contract;
 use `reviewStagedChanges()` for the new context comparison and `ReviewResult`.
-The composite Action installs exactly 0.8.1. For local development, use
+The composite Action installs exactly 0.9.0. For local development, use
 `node dist/cli.js --staged` after building.
 
 ### Author & Support

package/dist/{chunk-U7OCVA3D.js → chunk-GMBQNL6Z.js}

@@ -786,6 +786,30 @@ var RULE_GUIDES = {
     suggestion: "Implement the path or make its unsupported state explicit to callers. Check whether this is an intentional abstract contract.",
     example: "throw new Error('Not implemented') \u2192 implement the operation and add a behavior test"
   },
+  "assertion-weakened": {
+    title: "Test checks less than before",
+    why: "A test that keeps its name but loses assertions, or has one replaced by a weaker check, still passes while verifying less behavior.",
+    suggestion: "Restore the removed assertion or explain in the PR why that behavior is no longer required. Fix the code under test instead of weakening its check.",
+    example: "expect(total).toBe(42) \u2192 expect(total).toBeDefined()  (restore the exact check)"
+  },
+  "test-removed": {
+    title: "Test removed",
+    why: "Deleting a failing test makes a suite green without fixing the behavior it covered. Removals are legitimate when the feature itself is gone.",
+    suggestion: "Confirm the behavior was intentionally removed. If it still exists, restore the test and fix the code.",
+    example: "it('rejects expired tokens', ...) deleted while token validation remains in src/"
+  },
+  "expectation-rewritten": {
+    title: "Expected value edited alongside production code",
+    why: "Changing an expected value while the test inputs stay the same can mean the test was adjusted to match new output instead of the output being corrected.",
+    suggestion: "Verify the new expectation against the requirement, not against the program's current output. Intentional behavior changes should say so in the PR.",
+    example: "expect(price(cart)).toBe(100) \u2192 toBe(90) with price() changed in the same PR"
+  },
+  "guard-weakened": {
+    title: "Quality gate made easier to pass",
+    why: "Lower coverage thresholds, disabled compiler strictness, downgraded lint rules, tolerated CI failures or an always-passing test script let defects through without touching the code.",
+    suggestion: "Keep the gate and fix the underlying failure. If the change is deliberate, record the reason and a plan to restore it.",
+    example: 'coverageThreshold lines: 80 \u2192 60, "strict": true \u2192 false, continue-on-error: true'
+  },
   "panic-loop": {
     title: "Rapid overlapping fix commits",
     why: "Repeated short fix cycles can suggest a missing reproduction or feedback loop; timing alone does not prove poor work.",
@@ -806,7 +830,11 @@ var VALID_DETECTORS = [
   "panic-loop",
   "trivial-assert",
   "stub-abandonment",
-  "test-focus"
+  "test-focus",
+  "assertion-weakened",
+  "test-removed",
+  "expectation-rewritten",
+  "guard-weakened"
 ];
 
 // src/file-read.ts
@@ -839,13 +867,13 @@ function readRegularFile(filename, limit) {
 import { createHash, randomUUID as randomUUID2 } from "crypto";
 import * as fs2 from "fs";
 import path from "path";
-function findingFingerprint(finding) {
-  return createHash("sha256").update(JSON.stringify([finding.type, finding.file, finding.lineSnippet?.trim()])).digest("hex");
+function findingFingerprint(finding2) {
+  return createHash("sha256").update(JSON.stringify([finding2.type, finding2.file, finding2.lineSnippet?.trim()])).digest("hex");
 }
 function createBaseline(findings) {
   const counts = /* @__PURE__ */ new Map();
-  for (const finding of findings) {
-    const fingerprint = findingFingerprint(finding);
+  for (const finding2 of findings) {
+    const fingerprint = findingFingerprint(finding2);
     counts.set(fingerprint, (counts.get(fingerprint) || 0) + 1);
   }
   return {
@@ -877,14 +905,14 @@ function applyBaseline(findings, baseline) {
   const remaining = new Map(baseline.entries.map((entry) => [entry.fingerprint, entry.count]));
   const fresh = [];
   let baselineCount = 0;
-  for (const finding of findings) {
-    const fingerprint = findingFingerprint(finding);
+  for (const finding2 of findings) {
+    const fingerprint = findingFingerprint(finding2);
     const count = remaining.get(fingerprint) || 0;
     if (count > 0) {
       remaining.set(fingerprint, count - 1);
       baselineCount++;
     } else {
-      fresh.push(finding);
+      fresh.push(finding2);
     }
   }
   return { findings: fresh, baselineCount, staleBaselineCount: [...remaining.values()].reduce((a, b) => a + b, 0) };
@@ -933,11 +961,11 @@ function applyExceptions(findings, exceptions = [], now = /* @__PURE__ */ new Da
   const occurrences = new Map(priorOccurrences);
   const actionable = [];
   const suppressedFindings = [];
-  for (const finding of findings) {
-    const fingerprint = findingFingerprint(finding);
+  for (const finding2 of findings) {
+    const fingerprint = findingFingerprint(finding2);
     const occurrence = (occurrences.get(fingerprint) ?? 0) + 1;
     occurrences.set(fingerprint, occurrence);
-    const enriched = { ...finding, fingerprint, occurrence };
+    const enriched = { ...finding2, fingerprint, occurrence };
     const allowance = active.get(fingerprint);
     if (allowance && allowance.remaining > 0) {
       allowance.remaining--;
@@ -950,7 +978,7 @@ function applyExceptions(findings, exceptions = [], now = /* @__PURE__ */ new Da
 // src/config.ts
 var MAX_CONFIG_BYTES = 64 * 1024;
 var DEFAULT_CONFIG = {
-  failOn: ["test-skip", "trivial-assert", "test-focus"],
+  failOn: ["test-skip", "trivial-assert", "test-focus", "assertion-weakened", "guard-weakened"],
   ignorePaths: [
     "**/fixtures/**",
     "**/__fixtures__/**",
@@ -966,6 +994,10 @@ var DEFAULT_CONFIG = {
     "test-skip": "error",
     "trivial-assert": "error",
     "test-focus": "error",
+    "assertion-weakened": "error",
+    "guard-weakened": "error",
+    "test-removed": "warn",
+    "expectation-rewritten": "warn",
     "swallowed-error": "warn",
     "stub-abandonment": "warn",
     "type-escape": "warn"
@@ -1395,7 +1427,7 @@ function auditFileDiffs(files, commitHash = "HEAD", commitDate = (/* @__PURE__ *
       });
     }
     const ordered = infractions.splice(firstFinding).sort((left, right) => (left.lineNumber || 0) - (right.lineNumber || 0));
-    for (const finding of ordered) infractions.push(finding);
+    for (const finding2 of ordered) infractions.push(finding2);
   }
   return { infractions: infractions.filter((inf) => options.rules?.[inf.type] !== "off").map((inf) => ({ ...inf, suggestion: RULE_GUIDES[inf.type].suggestion })), hasSupportedChanges, filesInspected, linesAdded };
 }
@@ -1530,7 +1562,7 @@ var MetricsCollector = class {
     const counts = {};
     for (const infraction of audit.infractions) {
       const count = counts[infraction.type] || 0;
-      if (count < MAX_INFRACTIONS_PER_COMMIT) buckets[infraction.type].push(infraction);
+      if (count < MAX_INFRACTIONS_PER_COMMIT) buckets[infraction.type]?.push(infraction);
       counts[infraction.type] = count + 1;
     }
   }
@@ -1976,8 +2008,8 @@ function exceptionTerminal(result) {
   const accepted = result.suppressedFindings || [];
   if (accepted.length) {
     lines.push(`  ${accepted.length} findings accepted by explicit exceptions (not fixed)`);
-    for (const finding of accepted.slice(0, 20)) lines.push(
-      `  ACCEPTED [${finding.type}] ${terminalText(finding.file || "unknown")}:${finding.lineNumber} \u2014 ${terminalText(finding.suppression.reason)} (expires ${terminalText(finding.suppression.expires)})`
+    for (const finding2 of accepted.slice(0, 20)) lines.push(
+      `  ACCEPTED [${finding2.type}] ${terminalText(finding2.file || "unknown")}:${finding2.lineNumber} \u2014 ${terminalText(finding2.suppression.reason)} (expires ${terminalText(finding2.suppression.expires)})`
     );
     if (accepted.length > 20) lines.push(`  ${accepted.length - 20} more accepted findings; use --format json.`);
   }
@@ -1997,7 +2029,7 @@ function exceptionMarkdown(result) {
       "| Rule | Location | Reason | Expires |",
       "| --- | --- | --- | --- |"
     );
-    for (const finding of accepted) lines.push(`| ${finding.type} | ${markdownCell(`${finding.file}:${finding.lineNumber}`)} | ${markdownCell(finding.suppression.reason)} | ${markdownCell(finding.suppression.expires)} |`);
+    for (const finding2 of accepted) lines.push(`| ${finding2.type} | ${markdownCell(`${finding2.file}:${finding2.lineNumber}`)} | ${markdownCell(finding2.suppression.reason)} | ${markdownCell(finding2.suppression.expires)} |`);
   }
   if (result.expiredExceptionCount) lines.push("", `${result.expiredExceptionCount} expired exceptions were not applied; review their findings.`);
   return lines;
@@ -2054,12 +2086,12 @@ function formatReviewTerminal(result) {
   lines.push(...exceptionTerminal(result));
   if (result.policyChanges.length) lines.push("  Candidate policy changes were ignored; adopt them separately after review.");
   if (result.excludedFiles || result.unsupportedFiles) lines.push(`  ${result.excludedFiles} excluded \xB7 ${result.unsupportedFiles} unsupported/non-source changes`);
-  for (const finding of result.infractions.slice(0, 20)) {
+  for (const finding2 of result.infractions.slice(0, 20)) {
     lines.push(
       "",
-      `  ${result.failedRules.includes(finding.type) ? "FAIL" : "WARN"} [${finding.type}] ${terminalText(finding.file || "unknown")}:${finding.lineNumber}`,
-      `    ${terminalText(finding.lineSnippet || finding.reason)}`,
-      `    Next: ${terminalText(finding.suggestion || "Review this occurrence.")}`
+      `  ${result.failedRules.includes(finding2.type) ? "FAIL" : "WARN"} [${finding2.type}] ${terminalText(finding2.file || "unknown")}:${finding2.lineNumber}`,
+      `    ${terminalText(finding2.lineSnippet || finding2.reason)}`,
+      `    Next: ${terminalText(finding2.suggestion || "Review this occurrence.")}`
     );
   }
   if (result.infractions.length > 20) lines.push(`  ${result.infractions.length - 20} more new findings; use --format json for all results.`);
@@ -2080,7 +2112,7 @@ function formatReviewMarkdown(result) {
   ];
   if (result.policyChanges.length) lines.push("Candidate policy changes were ignored. This review uses the supplied base commit's policy.", "");
   lines.push("| New finding | Head location | Evidence | Next step |", "| --- | --- | --- | --- |");
-  for (const finding of result.infractions) lines.push(`| ${finding.type} | ${markdownCell(`${finding.file}:${finding.lineNumber}`)} | ${markdownCell(finding.lineSnippet || finding.reason)} | ${markdownCell(finding.suggestion || "Review this occurrence.")} |`);
+  for (const finding2 of result.infractions) lines.push(`| ${finding2.type} | ${markdownCell(`${finding2.file}:${finding2.lineNumber}`)} | ${markdownCell(finding2.lineSnippet || finding2.reason)} | ${markdownCell(finding2.suggestion || "Review this occurrence.")} |`);
   lines.push(...exceptionMarkdown(result));
   if (result.removedFindings.length) {
     lines.push(
@@ -2092,7 +2124,7 @@ function formatReviewMarkdown(result) {
       "| Rule | Previous location | Previous evidence |",
       "| --- | --- | --- |"
     );
-    for (const finding of result.removedFindings) lines.push(`| ${finding.type} | ${markdownCell(`${finding.file}:${finding.lineNumber}`)} | ${markdownCell(finding.lineSnippet || finding.reason)} |`);
+    for (const finding2 of result.removedFindings) lines.push(`| ${finding2.type} | ${markdownCell(`${finding2.file}:${finding2.lineNumber}`)} | ${markdownCell(finding2.lineSnippet || finding2.reason)} |`);
   }
   for (const skipped of result.skippedFiles) lines.push("", `Not compared: ${markdownCell(skipped.file)} \u2014 ${markdownCell(skipped.reason)}`);
   lines.push("", `Scope: changed supported files only; ${result.excludedFiles} excluded and ${result.unsupportedFiles} unsupported/non-source changes.`);
@@ -2338,26 +2370,26 @@ var version = require2("../package.json").version;
 function formatSarif(report) {
   const occurrences = /* @__PURE__ */ new Map();
   const allFindings = [
-    ...report.infractions.map((finding) => ({ finding, suppression: void 0 })),
-    ...(report.suppressedFindings ?? []).map((finding) => ({ finding, suppression: finding.suppression }))
+    ...report.infractions.map((finding2) => ({ finding: finding2, suppression: void 0 })),
+    ...(report.suppressedFindings ?? []).map((finding2) => ({ finding: finding2, suppression: finding2.suppression }))
   ];
   allFindings.sort((a, b) => (a.finding.file ?? "").localeCompare(b.finding.file ?? "") || (a.finding.lineNumber ?? 1) - (b.finding.lineNumber ?? 1) || a.finding.type.localeCompare(b.finding.type));
-  const results = allFindings.map(({ finding, suppression }) => {
-    const filename = finding.file;
+  const results = allFindings.map(({ finding: finding2, suppression }) => {
+    const filename = finding2.file;
     if (!filename || filename.startsWith("/") || filename.split("/").includes("..") || /^[a-z]:/i.test(filename)) {
       throw new ConfigError("SARIF needs repository-relative finding paths.");
     }
-    const fingerprint = findingFingerprint(finding);
-    const occurrence = finding.occurrence ?? (occurrences.get(fingerprint) || 0) + 1;
+    const fingerprint = findingFingerprint(finding2);
+    const occurrence = finding2.occurrence ?? (occurrences.get(fingerprint) || 0) + 1;
     occurrences.set(fingerprint, occurrence);
     return {
-      ruleId: finding.type,
-      ruleIndex: VALID_DETECTORS.indexOf(finding.type),
-      level: report.failedRules.includes(finding.type) ? "error" : "warning",
-      message: { text: `${finding.reason}. ${finding.suggestion || RULE_GUIDES[finding.type].suggestion}` },
+      ruleId: finding2.type,
+      ruleIndex: VALID_DETECTORS.indexOf(finding2.type),
+      level: report.failedRules.includes(finding2.type) ? "error" : "warning",
+      message: { text: `${finding2.reason}. ${finding2.suggestion || RULE_GUIDES[finding2.type].suggestion}` },
       locations: [{ physicalLocation: {
         artifactLocation: { uri: filename.split("/").map((segment) => encodeURIComponent(segment)).join("/") },
-        region: { startLine: Math.max(1, finding.lineNumber || 1) }
+        region: { startLine: Math.max(1, finding2.lineNumber || 1) }
       } }],
       partialFingerprints: { "agentRoastFinding/v1": `${fingerprint}:${occurrence}` },
       ...suppression ? { suppressions: [{
@@ -2662,7 +2694,7 @@ async function checkProject(options = {}) {
   const cwd = path5.resolve(options.cwd || process.cwd());
   const root = await fs6.realpath(gitOutputPath(await git(cwd, ["rev-parse", "--show-toplevel"], options.signal)));
   const config = loadConfig(root);
-  const failOn = options.failOn ?? config.failOn ?? ["test-skip", "trivial-assert", "test-focus"];
+  const failOn = options.failOn ?? config.failOn ?? ["test-skip", "trivial-assert", "test-focus", "assertion-weakened", "guard-weakened"];
   for (const rule of failOn) if (!VALID_DETECTORS.includes(rule)) throw new ConfigError(`Unknown rule '${rule}'.`);
   const format = options.format || "terminal";
   if (!["terminal", "json", "github", "markdown", "sarif"].includes(format)) throw new ConfigError("Unsupported check output format.");
@@ -2699,14 +2731,14 @@ async function checkProject(options = {}) {
   const applied = baseline ? applyBaseline(infractions, baseline) : { findings: infractions, baselineCount: 0, staleBaselineCount: 0 };
   const notInBaseline = new Set(applied.findings);
   const acceptedCounts = /* @__PURE__ */ new Map();
-  for (const finding of infractions) {
-    if (notInBaseline.has(finding)) continue;
-    const fingerprint = findingFingerprint(finding);
+  for (const finding2 of infractions) {
+    if (notInBaseline.has(finding2)) continue;
+    const fingerprint = findingFingerprint(finding2);
     acceptedCounts.set(fingerprint, (acceptedCounts.get(fingerprint) ?? 0) + 1);
   }
   const exceptions = applyExceptions(applied.findings, options.ignoreExceptions ? [] : config.exceptions, /* @__PURE__ */ new Date(), acceptedCounts);
   const findings = exceptions.findings;
-  const failedRules = [...new Set(findings.filter((finding) => failOn.includes(finding.type)).map((finding) => finding.type))];
+  const failedRules = [...new Set(findings.filter((finding2) => failOn.includes(finding2.type)).map((finding2) => finding2.type))];
   const complete = skippedFiles.length === 0;
   const passed = complete && failedRules.length === 0;
   const result = {
@@ -2738,24 +2770,355 @@ async function checkProject(options = {}) {
 
 // src/review.ts
 import path6 from "path";
+
+// src/tampering.ts
+import { createHash as createHash3 } from "crypto";
+var EMPTY = { immediate: [], removedTests: [], addedHashes: [], rewritten: [] };
+function languageOf(file) {
+  if (/\.(?:[cm]?[jt]sx?)$/i.test(file)) return "js";
+  if (/\.py$/i.test(file)) return "py";
+  if (/_test\.go$/i.test(file)) return "go";
+  return null;
+}
+function codeLines(text, language) {
+  let block = false;
+  return text.split(/\r?\n/).map((line) => {
+    const trimmed = line.trim();
+    if (language !== "py") {
+      if (block) {
+        if (trimmed.includes("*/")) block = false;
+        return "";
+      }
+      if (trimmed.startsWith("/*")) {
+        if (!trimmed.includes("*/")) block = true;
+        return "";
+      }
+      if (trimmed.startsWith("//")) return "";
+    } else if (trimmed.startsWith("#")) return "";
+    return line;
+  });
+}
+var JS_TEST_START = /(?<![\w$.])(?:it|test)(?:\s*\.\s*(?:only|skip|concurrent|serial))*\s*\(\s*(['"`])((?:\\.|(?!\1)[^\\\n])*)\1/;
+var PY_TEST_START = /^\s*(?:async\s+)?def\s+(test\w*)\s*\(/;
+var GO_TEST_START = /^func\s+(Test\w+)\s*\(/;
+var JS_ASSERTION = /(?<![\w$.])(?:expect|assert|expectTypeOf)\b(?!\s*\.\s*(?:assertions|hasAssertions|extend|anything|any|objectContaining|arrayContaining|stringContaining|stringMatching)\b)(?:\s*\.\s*\w+)*\s*\(|\.should\b/;
+var PY_ASSERTION = /^\s*assert\b|\bself\s*\.\s*assert\w*\s*\(|\bpytest\s*\.\s*raises\b|\bassertRaises\b/;
+var GO_ASSERTION = /\bt\s*\.\s*(?:Error|Errorf|Fatal|Fatalf|Fail|FailNow)\b|\b(?:assert|require)\s*\.\s*\w+\s*\(/;
+function callEnd(text, from, limit) {
+  let depth = 1, quote = "";
+  for (let i = from; i < limit; i++) {
+    const char = text[i];
+    if (quote) {
+      if (char === "\\") i++;
+      else if (char === quote || char === "\n" && quote !== "`") quote = "";
+    } else if (char === '"' || char === "'" || char === "`") quote = char;
+    else if (char === "/" && text[i + 1] === "/" && (i === from || /\s/.test(text[i - 1]))) {
+      const newline = text.indexOf("\n", i);
+      i = newline < 0 || newline > limit ? limit : newline;
+    } else if (char === "(") depth++;
+    else if (char === ")" && --depth === 0) return i;
+  }
+  return limit;
+}
+function testBodies(text, language) {
+  const lines = codeLines(text, language);
+  if (language === "js") {
+    const code = lines.join("\n");
+    const matches = [...code.matchAll(new RegExp(JS_TEST_START.source, "g"))];
+    let line = 1, cursor = 0;
+    return matches.map((match, i) => {
+      const at = match.index ?? 0;
+      for (; cursor < at; cursor++) if (code.charCodeAt(cursor) === 10) line++;
+      const from = at + match[0].length;
+      const limit = i + 1 < matches.length ? matches[i + 1].index ?? code.length : code.length;
+      return { name: match[2], line, body: code.slice(from, Math.min(callEnd(code, from, limit) + 1, limit)), parametrized: false };
+    });
+  }
+  const startPattern = language === "py" ? PY_TEST_START : GO_TEST_START;
+  const starts = [];
+  lines.forEach((line, index) => {
+    const match = startPattern.exec(line);
+    if (match) starts.push({ index, name: match[1], length: match[0].length });
+  });
+  const indentOf = (line) => /^\s*/.exec(line)[0].length;
+  return starts.map((start, n) => {
+    const limit = n + 1 < starts.length ? starts[n + 1].index : lines.length;
+    const header = lines[start.index], indent = indentOf(header);
+    let end = start.index + 1, depth = balance(header);
+    while (depth > 0 && end < limit) depth += balance(lines[end++]);
+    while (end < limit && (language === "go" ? lines[end - 1] !== "}" : !lines[end].trim() || indentOf(lines[end]) > indent)) end++;
+    let top = start.index;
+    while (top > 0 && start.index - top < 200 && lines[top - 1].trim() && !/^\s*(?:async\s+)?(?:def|class)\b/.test(lines[top - 1])) top--;
+    return {
+      name: start.name,
+      line: start.index + 1,
+      body: [header.slice(start.length), ...lines.slice(start.index + 1, end)].join("\n"),
+      parametrized: /parametrize/.test(lines.slice(top, start.index).join("\n"))
+    };
+  });
+}
+function balance(line) {
+  const bare = line.replace(/(['"`])(?:\\.|(?!\1)[^\\])*\1/g, "");
+  let net = 0;
+  for (const char of bare) net += "([{".includes(char) ? 1 : ")]}".includes(char) ? -1 : 0;
+  return net;
+}
+function normalize(statement) {
+  return statement.replace(/\s+/g, "").replace(/'/g, '"').replace(/,([)\]}])/g, "$1").replace(/;$/, "");
+}
+function splitStatements(text) {
+  const pieces = [];
+  let quote = "", start = 0;
+  for (let i = 0; i < text.length; i++) {
+    const char = text[i];
+    if (quote) {
+      if (char === "\\") i++;
+      else if (char === quote) quote = "";
+    } else if (char === '"' || char === "'" || char === "`") quote = char;
+    else if (char === ";") {
+      pieces.push(text.slice(start, i));
+      start = i + 1;
+    }
+  }
+  pieces.push(text.slice(start));
+  return pieces.map((piece) => piece.trim()).filter(Boolean);
+}
+var CALLBACK_HEADER = /^[,\s]*(?:async\s*)?(?:\([^)]*\)|[\w$]+)\s*=>\s*\{\s*|^[,\s]*(?:async\s+)?function\s*\w*\s*\([^)]*\)\s*\{\s*/;
+function parseTests(text, language) {
+  const assertionPattern = language === "js" ? JS_ASSERTION : language === "py" ? PY_ASSERTION : GO_ASSERTION;
+  const seen = /* @__PURE__ */ new Map();
+  return testBodies(text, language).map((test) => {
+    const body = test.body.split("\n");
+    const assertions = [], raw = [], setupLines = [];
+    for (let i = 0; i < body.length; i++) {
+      if (!assertionPattern.test(body[i])) {
+        setupLines.push(body[i]);
+        continue;
+      }
+      let statement = body[i].trim(), depth = balance(body[i]);
+      while (depth > 0 && i + 1 < body.length) {
+        i++;
+        statement += " " + body[i].trim();
+        depth += balance(body[i]);
+      }
+      for (const piece of language === "js" ? splitStatements(statement) : [statement]) {
+        const clean = piece.replace(CALLBACK_HEADER, "");
+        if (assertionPattern.test(clean)) {
+          raw.push(clean);
+          assertions.push(normalize(clean));
+        } else setupLines.push(clean);
+      }
+    }
+    const setup = setupLines.join("\n").replace(/\s+/g, "");
+    const bodyHash = createHash3("sha1").update(test.body.replace(/\s+/g, "")).digest("hex");
+    const count = (seen.get(test.name) ?? 0) + 1;
+    seen.set(test.name, count);
+    return { key: `${test.name}#${count}`, parametrized: test.parametrized, name: test.name, line: test.line, assertions, raw, setup, bodyHash };
+  });
+}
+function skeleton(assertion) {
+  return assertion.replace(/(['"`])(?:\\.|(?!\1)[^\\])*\1/g, "S").replace(/\b\d+(?:\.\d+)?\b/g, "N").replace(/\b(?:true|false|null|undefined|None|True|False|nil)\b/g, "V").replace(/\s+/g, "");
+}
+var WEAK_JS = /\.(?:toBeDefined|toBeTruthy|toBeFalsy|toBeUndefined)\s*\(|\.not\s*\.\s*(?:toBeNull|toBeUndefined|toThrow)\s*\(|\.toBeGreaterThanOrEqual\s*\(\s*0\s*\)/;
+var WEAK_PY = /^\s*assert\s+[\w.()\[\]]+\s*$|^\s*assert\s+.+\sis\s+not\s+None\s*$|^\s*assert\s+True\s*$/;
+function isWeaker(oldAssertion, newAssertion, language) {
+  if (language === "js") return WEAK_JS.test(newAssertion) && !WEAK_JS.test(oldAssertion);
+  if (language === "py") return WEAK_PY.test(newAssertion) && !WEAK_PY.test(oldAssertion);
+  return false;
+}
+function finding(type, file, line, snippet, reason, commit) {
+  return { type, file, lineNumber: Math.max(1, line), lineSnippet: snippet, commitHash: commit, commitDate: "", reason, suggestion: RULE_GUIDES[type].suggestion };
+}
+function analyzeTestFile(oldPath, newPath, oldText, newText, commit) {
+  const language = languageOf(newText === null ? oldPath : newPath);
+  if (!language || !(isTestFile(newPath) || isTestFile(oldPath))) return EMPTY;
+  const before = oldText === null ? [] : parseTests(oldText, language);
+  const after = newText === null ? [] : parseTests(newText, language);
+  const afterByKey = new Map(after.map((test) => [test.key, test]));
+  const newCode = newText === null ? "" : codeLines(newText, language).join("\n");
+  const tally = (tests) => {
+    const totals = /* @__PURE__ */ new Map();
+    for (const test of tests) for (const assertion of test.assertions) totals.set(assertion, (totals.get(assertion) ?? 0) + 1);
+    return totals;
+  };
+  const oldTotals = tally(before), newTotals = tally(after);
+  const beforeKeys = new Set(before.map((test) => test.key));
+  const result = { immediate: [], removedTests: [], addedHashes: [], rewritten: [] };
+  for (const test of after) if (!beforeKeys.has(test.key)) result.addedHashes.push(test.bodyHash);
+  for (const old of before) {
+    const current = afterByKey.get(old.key);
+    if (!current) {
+      if (newCode && ['"', "'", "`"].some((quote) => newCode.includes(quote + old.name + quote))) continue;
+      result.removedTests.push({
+        bodyHash: old.bodyHash,
+        finding: finding(
+          "test-removed",
+          newPath,
+          1,
+          `${old.name}: test no longer present`,
+          newText === null ? "Test file deleted" : "Test removed",
+          commit
+        )
+      });
+      continue;
+    }
+    if (current.parametrized && !old.parametrized) continue;
+    const snapshot = (test) => test.raw.some((statement) => /\.toMatch(?:Inline)?Snapshot\b|\.matchSnapshot\b|\bsnapshot\s*\(/.test(statement));
+    if (snapshot(current) && !snapshot(old)) continue;
+    if (current.assertions.length < old.assertions.length) {
+      const budget = tally([current]);
+      const lost = old.assertions.filter((assertion) => {
+        const left = budget.get(assertion) ?? 0;
+        if (left > 0) {
+          budget.set(assertion, left - 1);
+          return false;
+        }
+        return true;
+      });
+      if (lost.every((assertion) => (newTotals.get(assertion) ?? 0) >= (oldTotals.get(assertion) ?? 0))) continue;
+      result.immediate.push(finding(
+        "assertion-weakened",
+        newPath,
+        current.line,
+        `${old.name}: ${old.assertions.length} \u2192 ${current.assertions.length} assertions`,
+        "Test checks less than before",
+        commit
+      ));
+      continue;
+    }
+    if (current.assertions.length === old.assertions.length && old.assertions.length > 0) {
+      const changed = old.assertions.map((assertion, i) => ({ before: assertion, after: current.assertions[i], rawBefore: old.raw[i], rawAfter: current.raw[i] })).filter((pair) => pair.before !== pair.after);
+      const weaker = changed.find((pair) => isWeaker(pair.rawBefore, pair.rawAfter, language));
+      if (weaker) {
+        result.immediate.push(finding(
+          "assertion-weakened",
+          newPath,
+          current.line,
+          `${old.name}: ${weaker.rawBefore.slice(0, 80)} \u2192 ${weaker.rawAfter.slice(0, 80)}`,
+          "Assertion replaced by a weaker check",
+          commit
+        ));
+      } else if (changed.length && old.setup === current.setup && changed.every((pair) => skeleton(pair.before) === skeleton(pair.after))) {
+        result.rewritten.push(finding(
+          "expectation-rewritten",
+          newPath,
+          current.line,
+          `${old.name}: ${changed[0].rawBefore.slice(0, 80)} \u2192 ${changed[0].rawAfter.slice(0, 80)}`,
+          "Expected value edited while the test inputs stayed the same",
+          commit
+        ));
+      }
+    }
+  }
+  return result;
+}
+function resolveTampering(files, productionChanged) {
+  const added = new Set(files.flatMap((file) => file.addedHashes));
+  return [
+    ...files.flatMap((file) => file.immediate),
+    ...files.flatMap((file) => file.removedTests).filter((removed) => !added.has(removed.bodyHash)).map((removed) => removed.finding),
+    ...productionChanged ? files.flatMap((file) => file.rewritten) : []
+  ];
+}
+var GUARD_FILE = /(?:^|\/)(?:package\.json|tsconfig[^/]*\.json|jsconfig\.json|(?:jest|vitest|vite)\.config\.[cm]?[jt]s|\.eslintrc(?:\.[a-z]+)?|eslint\.config\.[cm]?[jt]s|pyproject\.toml|setup\.cfg|pytest\.ini|tox\.ini|\.coveragerc|codecov\.ya?ml|\.gitlab-ci\.ya?ml|\.github\/workflows\/[^/]+\.ya?ml)$/i;
+function isGuardFile(file) {
+  return GUARD_FILE.test(file);
+}
+function lineOf(text, index) {
+  let line = 1;
+  for (let i = 0; i < index && i < text.length; i++) if (text.charCodeAt(i) === 10) line++;
+  return line;
+}
+function numbers(text, pattern) {
+  const seen = /* @__PURE__ */ new Map();
+  return [...text.matchAll(pattern)].map((match) => {
+    const label = match[1] ?? "value";
+    const count = (seen.get(label) ?? 0) + 1;
+    seen.set(label, count);
+    return { key: `${label}#${count}`, value: Number(match[match.length - 1]), index: match.index ?? 0 };
+  });
+}
+var THRESHOLD_PATTERNS = [
+  /\b(lines|branches|functions|statements)\b["']?\s*[:=]\s*(\d+(?:\.\d+)?)/g,
+  /\b(fail_under)\s*[:=]\s*(\d+(?:\.\d+)?)/g,
+  /(--cov-fail-under)[= ](\d+(?:\.\d+)?)/g
+];
+var SWITCHES = ["strict", "noImplicitAny", "strictNullChecks", "noImplicitReturns", "useUnknownInCatchVariables"];
+var TEST_COMMAND = /\brun:.*\b(?:tests?|unit|pytest|vitest|jest|mocha|ava|tap|tox|nox|e2e|spec)\b|^\s*-?\s*(?:npm|yarn|pnpm|go|cargo|mvn|gradle|make)\s+(?:run\s+)?(?:\w+\s+)?tests?\b/;
+function severityOf(value) {
+  return /^(?:error|2)$/.test(value) ? 2 : /^(?:warn|1)$/.test(value) ? 1 : 0;
+}
+function analyzeGuardFile(file, oldText, newText, commit) {
+  if (oldText === null || newText === null) return [];
+  const out = [];
+  const add = (index, snippet, reason) => out.push(finding("guard-weakened", file, lineOf(newText, index), snippet, reason, commit));
+  if (/threshold|fail_under|cov-fail-under|coverage/i.test(newText)) {
+    for (const pattern of THRESHOLD_PATTERNS) {
+      const old = new Map(numbers(oldText, pattern).map((item) => [item.key, item.value]));
+      for (const item of numbers(newText, pattern)) {
+        const previous = old.get(item.key);
+        if (previous !== void 0 && item.value < previous) {
+          add(item.index, `${item.key.split("#")[0]}: ${previous} \u2192 ${item.value}`, "Coverage threshold lowered");
+        }
+      }
+    }
+  }
+  if (/(?:^|\/)(?:tsconfig|jsconfig)[^/]*\.json$/i.test(file)) {
+    for (const name of SWITCHES) {
+      const pattern = new RegExp(`"${name}"\\s*:\\s*(true|false)`);
+      const before = pattern.exec(oldText), after = pattern.exec(newText);
+      if (before?.[1] === "true" && after?.[1] === "false") add(after.index, `${name}: true \u2192 false`, "Compiler strictness switched off");
+    }
+  }
+  if (/eslint/i.test(file)) {
+    const rules = (text) => new Map([...text.matchAll(/["']([@\w/.-]+)["']\s*:\s*(?:\[\s*)?["']?(error|warn|off|[012])["']?/g)].map((match) => [match[1], { level: severityOf(match[2]), index: match.index ?? 0 }]));
+    const before = rules(oldText);
+    for (const [name, now] of rules(newText)) {
+      const previous = before.get(name);
+      if (previous && previous.level === 2 && now.level < 2) add(now.index, `${name}: error \u2192 ${now.level ? "warn" : "off"}`, "Lint rule downgraded");
+    }
+  }
+  if (/(?:\.github\/workflows\/|\.gitlab-ci)/.test(file)) {
+    const count = (text, pattern) => text.split(/\r?\n/).filter((line) => !line.trim().startsWith("#") && pattern.test(line)).length;
+    const lenient = /continue-on-error:\s*true|allow_failure:\s*true/;
+    if (count(newText, lenient) > count(oldText, lenient)) {
+      add(newText.search(lenient), "continue-on-error: true", "CI step is now allowed to fail");
+    }
+    if (count(newText, TEST_COMMAND) < count(oldText, TEST_COMMAND)) {
+      add(0, "test command no longer runs in CI", "Test step removed from CI");
+    }
+  }
+  if (/(?:^|\/)package\.json$/i.test(file)) {
+    try {
+      const before = JSON.parse(oldText)?.scripts?.test, after = JSON.parse(newText)?.scripts?.test;
+      if (typeof before === "string" && typeof after === "string" && before !== after && (/^\s*(?:echo\b|true\b|exit\s+0|:)/.test(after) || /\|\|\s*(?:true|exit\s+0)\b/.test(after) || /--passWithNoTests/.test(after) && !/--passWithNoTests/.test(before))) {
+        add(Math.max(0, newText.indexOf('"test"')), `test: ${after}`, "Test script can no longer fail");
+      }
+    } catch {
+    }
+  }
+  return out;
+}
+
+// src/review.ts
 var GENERATED_PATHS2 = ["**/node_modules/**", "**/dist/**", "**/build/**", "**/vendor/**", "**/*.min.js", "**/*.map"];
 var MAX_SCAN_BYTES2 = 50 * 1024 * 1024;
 function compareFindings(before, after, newPath) {
   const old = /* @__PURE__ */ new Map();
-  for (const finding of before) {
-    const key = findingFingerprint({ ...finding, file: newPath });
+  for (const finding2 of before) {
+    const key = findingFingerprint({ ...finding2, file: newPath });
     const bucket = old.get(key) || { findings: [], matched: 0 };
-    bucket.findings.push(finding);
+    bucket.findings.push(finding2);
     old.set(key, bucket);
   }
   const introduced = [];
   let unchanged = 0;
-  for (const finding of after) {
-    const bucket = old.get(findingFingerprint(finding));
+  for (const finding2 of after) {
+    const bucket = old.get(findingFingerprint(finding2));
     if (bucket && bucket.matched < bucket.findings.length) {
       bucket.matched++;
       unchanged++;
-    } else introduced.push(finding);
+    } else introduced.push(finding2);
   }
   return { introduced, removed: [...old.values()].flatMap((bucket) => bucket.findings.slice(bucket.matched)), unchanged };
 }
@@ -2773,7 +3136,7 @@ async function compareSourceChanges(options) {
   const policy = refs.baseSha === "EMPTY" ? { config: configFromText("{}", "default first-commit policy"), filename: null } : await reviewPolicy(cwd, refs.baseSha, options.signal);
   const format = options.format ?? "terminal";
   if (!["terminal", "json", "github", "markdown", "sarif"].includes(format)) throw new ConfigError("Unsupported review format.");
-  const failOn = options.failOn ?? policy.config.failOn ?? ["test-skip", "trivial-assert", "test-focus"];
+  const failOn = options.failOn ?? policy.config.failOn ?? ["test-skip", "trivial-assert", "test-focus", "assertion-weakened", "guard-weakened"];
   for (const rule of failOn) if (!VALID_DETECTORS.includes(rule)) throw new ConfigError(`Unknown review rule '${rule}'.`);
   const changes = staged?.changes ?? await changedTreeFiles(cwd, refs.mergeBaseSha, refs.headSha, options.signal);
   const policyChanges = changes.filter((change) => CONFIG_FILENAMES.includes(change.oldPath) || CONFIG_FILENAMES.includes(change.newPath)).map((change) => change.newPath);
@@ -2805,13 +3168,39 @@ async function compareSourceChanges(options) {
     output: ""
   };
   let totalBytes = 0;
+  const tamperingFiles = [];
+  const guardFindings = [];
+  let productionChanged = false;
+  const readText = async (mode, oid) => {
+    if (mode === "000000") return null;
+    if (!["100644", "100755"].includes(mode)) throw new ConfigError("Changed source is a symlink, submodule or unsupported Git mode; comparison is incomplete.");
+    const content = await readBlob(cwd, oid, options.signal);
+    totalBytes += content.length;
+    if (totalBytes > MAX_SCAN_BYTES2) throw new ConfigError("Review exceeds the 50 MiB source comparison limit.");
+    if (content.includes(0)) throw new ConfigError("Binary content in a source comparison.");
+    return new TextDecoder("utf-8", { fatal: true }).decode(content);
+  };
   const existingCounts = /* @__PURE__ */ new Map();
   for (const change of changes) {
     assertNotAborted(options.signal);
     const oldSupported = change.oldMode !== "000000" && isCodeFile(change.oldPath);
     const newSupported = change.newMode !== "000000" && isCodeFile(change.newPath);
     if (!oldSupported && !newSupported) {
-      result.unsupportedFiles++;
+      const guarded = (isGuardFile(change.newPath) || isGuardFile(change.oldPath)) && isCodeFile(change.newPath + ".ts", ignores);
+      if (!guarded) {
+        result.unsupportedFiles++;
+        continue;
+      }
+      try {
+        const oldText = await readText(change.oldMode, change.oldOid);
+        const newText = await readText(change.newMode, change.newOid);
+        guardFindings.push(...analyzeGuardFile(change.newPath, oldText, newText, refs.headSha));
+        result.filesInspected++;
+      } catch (error) {
+        assertNotAborted(options.signal);
+        result.skippedFiles.push({ file: change.newPath, reason: error instanceof Error ? error.message : String(error) });
+        if (totalBytes > MAX_SCAN_BYTES2) break;
+      }
       continue;
     }
     const oldInScope = oldSupported && isCodeFile(change.oldPath, ignores);
@@ -2822,14 +3211,8 @@ async function compareSourceChanges(options) {
     }
     try {
       let inspectedLines = 0;
-      const scan = async (mode, oid, filename, commit) => {
-        if (mode === "000000") return [];
-        if (!["100644", "100755"].includes(mode)) throw new ConfigError("Changed source is a symlink, submodule or unsupported Git mode; comparison is incomplete.");
-        const content = await readBlob(cwd, oid, options.signal);
-        totalBytes += content.length;
-        if (totalBytes > MAX_SCAN_BYTES2) throw new ConfigError("Review exceeds the 50 MiB source comparison limit.");
-        if (content.includes(0)) throw new ConfigError("Binary content in a source comparison.");
-        const text = new TextDecoder("utf-8", { fatal: true }).decode(content);
+      const scan = (text, filename, commit) => {
+        if (text === null) return [];
         const lines = text.split(/\r?\n/);
         if (lines.at(-1) === "") lines.pop();
         inspectedLines += lines.length;
@@ -2838,13 +3221,18 @@ async function compareSourceChanges(options) {
       if (oldSupported && !newSupported && change.newMode !== "000000") {
         throw new ConfigError("Source moved to an unsupported extension; cannot claim its findings were resolved.");
       }
-      const before = await scan(change.oldMode, change.oldOid, change.oldPath, refs.mergeBaseSha);
-      const after = await scan(change.newMode, change.newOid, change.newPath, refs.headSha);
+      const oldText = await readText(change.oldMode, change.oldOid);
+      const newText = await readText(change.newMode, change.newOid);
+      const before = scan(oldText, change.oldPath, refs.mergeBaseSha);
+      const after = scan(newText, change.newPath, refs.headSha);
+      if (isTestFile(change.oldPath) || isTestFile(change.newPath)) tamperingFiles.push(analyzeTestFile(change.oldPath, change.newPath, oldText, newText, refs.headSha));
+      else if (change.oldOid !== change.newOid) productionChanged = true;
+      if ((isGuardFile(change.newPath) || isGuardFile(change.oldPath)) && oldText !== null && newText !== null) guardFindings.push(...analyzeGuardFile(change.newPath, oldText, newText, refs.headSha));
       const compared = compareFindings(before, after, change.newPath);
       const introduced = new Set(compared.introduced);
-      for (const finding of after) {
-        if (introduced.has(finding)) continue;
-        const fingerprint = findingFingerprint(finding);
+      for (const finding2 of after) {
+        if (introduced.has(finding2)) continue;
+        const fingerprint = findingFingerprint(finding2);
         existingCounts.set(fingerprint, (existingCounts.get(fingerprint) ?? 0) + 1);
       }
       result.infractions.push(...compared.introduced);
@@ -2863,11 +3251,13 @@ async function compareSourceChanges(options) {
   assertNotAborted(options.signal);
   await staged?.verify();
   result.complete = result.skippedFiles.length === 0;
+  const rules = policy.config.rules ?? {};
+  result.infractions.push(...[...resolveTampering(tamperingFiles, productionChanged), ...guardFindings].filter((finding2) => rules[finding2.type] !== "off"));
   const exceptions = applyExceptions(result.infractions, options.ignoreExceptions ? [] : policy.config.exceptions, /* @__PURE__ */ new Date(), existingCounts);
   result.infractions = exceptions.findings;
   result.suppressedFindings = exceptions.suppressedFindings;
   result.expiredExceptionCount = exceptions.expiredExceptionCount;
-  result.failedRules = [...new Set(result.infractions.filter((finding) => failOn.includes(finding.type)).map((finding) => finding.type))];
+  result.failedRules = [...new Set(result.infractions.filter((finding2) => failOn.includes(finding2.type)).map((finding2) => finding2.type))];
   result.passed = result.complete && result.failedRules.length === 0;
   result.exitCode = !result.complete ? 2 : result.passed ? 0 : 1;
   if (format === "json") result.output = JSON.stringify(result, null, 2);

package/dist/cli.js

@@ -22,7 +22,7 @@ import {
   roastRepository,
   terminalText,
   writeBaseline
-} from "./chunk-U7OCVA3D.js";
+} from "./chunk-GMBQNL6Z.js";
 
 // src/cli.ts
 import { Command } from "commander";

package/dist/index.d.ts

@@ -32,7 +32,7 @@ interface CommitInfo {
     isAiAttributed: boolean;
     aiSignatures: string[];
 }
-type DetectorType = "test-skip" | "type-escape" | "swallowed-error" | "panic-loop" | "trivial-assert" | "stub-abandonment" | "test-focus";
+type DetectorType = "test-skip" | "type-escape" | "swallowed-error" | "panic-loop" | "trivial-assert" | "stub-abandonment" | "test-focus" | "assertion-weakened" | "test-removed" | "expectation-rewritten" | "guard-weakened";
 declare const VALID_DETECTORS: readonly DetectorType[];
 interface Infraction {
     fingerprint?: string;

package/dist/index.js

@@ -63,7 +63,7 @@ import {
   unquoteGitPath,
   validateExceptions,
   writeBaseline
-} from "./chunk-U7OCVA3D.js";
+} from "./chunk-GMBQNL6Z.js";
 export {
   CONFIG_FILENAMES,
   ConfigError,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-roast",
-  "version": "0.8.1",
-  "description": "Offline code checks for skipped tests, swallowed errors, unfinished stubs and AI coding shortcuts",
+  "version": "0.9.0",
+  "description": "Offline review for AI-assisted changes: catches weakened tests, lowered quality gates, skipped tests and swallowed errors",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -20,16 +20,22 @@
     "test": "vitest run",
     "prepublishOnly": "npm run build",
     "pretest": "npm run build",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "bench": "node scripts/benchmark-recall.mjs",
+    "bench:noise": "node scripts/benchmark-noise.mjs"
   },
   "keywords": [
     "ai",
     "agents",
-    "cursor",
+    "ai-agents",
     "claude-code",
-    "roast",
+    "cursor",
+    "codex",
+    "code-review",
+    "test-quality",
+    "ci",
+    "sarif",
     "git",
-    "code-quality",
     "cli"
   ],
   "author": "Nari-Ab",
@@ -47,9 +53,7 @@
     "picocolors": "^1.1.0"
   },
   "devDependencies": {
-    "@napi-rs/canvas": "^1.0.10",
     "@types/node": "^20.0.0",
-    "gifenc": "^1.0.3",
     "tsup": "^8.0.0",
     "typescript": "^5.0.0",
     "vitest": "^4.1.12"

package/schema.json

@@ -20,7 +20,11 @@
           "panic-loop",
           "trivial-assert",
           "stub-abandonment",
-          "test-focus"
+          "test-focus",
+          "assertion-weakened",
+          "test-removed",
+          "expectation-rewritten",
+          "guard-weakened"
         ]
       }
     },
@@ -94,6 +98,34 @@
             "warn",
             "off"
           ]
+        },
+        "assertion-weakened": {
+          "enum": [
+            "error",
+            "warn",
+            "off"
+          ]
+        },
+        "test-removed": {
+          "enum": [
+            "error",
+            "warn",
+            "off"
+          ]
+        },
+        "expectation-rewritten": {
+          "enum": [
+            "error",
+            "warn",
+            "off"
+          ]
+        },
+        "guard-weakened": {
+          "enum": [
+            "error",
+            "warn",
+            "off"
+          ]
         }
       }
     },