calllint 0.3.0 → 0.5.0

package/README.md

@@ -60,6 +60,7 @@ will do, it says so and never silently upgrades to `SAFE`.
 ## More
 
 - SARIF 2.1.0 for GitHub Code Scanning: `calllint scan <config> --sarif`
+- Editor / agent-host diagnostics JSON (`calllint.diagnostics.v0`): `calllint diagnostics <config> --json`
 - Self-contained HTML report: `calllint scan <config> --html > report.html`
 - Drift / rug-pull detection: `calllint baseline <config>` then `calllint verify <config> --ci`
 - Policy-as-code: `calllint policy init`

package/dist/index.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync4 } from "node:fs";
+import { readFileSync as readFileSync6 } from "node:fs";
+import { execFileSync } from "node:child_process";
 
 // src/args.ts
 var EXIT = {
@@ -57,6 +58,7 @@ USAGE
 
 COMMANDS
   scan [target]      Scan an MCP config file, or npm:<pkg> / github:<owner/repo>
+  diagnostics [target]  Emit editor/agent-host diagnostics JSON (calllint.diagnostics.v0)
   baseline [target]  Record the approved risk surface as a baseline
   verify [target]    Compare a fresh scan against the baseline (drift / rug-pull)
   explain <server>   Explain the verdict for one server from the last scan
@@ -70,10 +72,12 @@ TARGETS
   github:<owner/repo>[@ref]   A GitHub repo (requires --online)
 
 SCAN OPTIONS
+  --changed          Scan only the agent-tool configs changed in the git diff
   --json             Emit the ScanReport JSON (stable, emoji-free)
   --compact          One line per server
   --no-emoji         Plain-text symbols (good for CI logs)
   --sarif            Emit SARIF 2.1.0 (GitHub Code Scanning / CI)
+  --markdown         Emit Markdown for PR comments / GitHub Step Summary
   --html             Emit a self-contained HTML report
   --policy <file>    Use a policy file (default: built-in defaults)
   --stdin            Read config JSON from stdin
@@ -87,8 +91,10 @@ VERIFY OPTIONS
 
 EXAMPLES
   calllint scan .cursor/mcp.json
+  calllint scan --changed --markdown
   cat .cursor/mcp.json | calllint scan --stdin --json
   calllint scan ./mcp.json --ci --no-emoji
+  calllint diagnostics ./mcp.json --json
   calllint scan npm:mcp-weather@1.0.0
   calllint scan github:owner/repo --online
   calllint baseline ./mcp.json
@@ -100,7 +106,7 @@ function helpCommand() {
 }
 
 // src/commands/scan.ts
-import { join as join3 } from "node:path";
+import { join as join4, resolve as resolve2 } from "node:path";
 
 // ../../packages/policy/src/defaultPolicy.ts
 function defaultPolicy() {
@@ -166,6 +172,12 @@ function validateOverride(o, index, issues) {
       message: "must be a valid ISO timestamp (overrides must expire)"
     });
   }
+  if (o.owner !== void 0 && (typeof o.owner !== "string" || !o.owner.trim())) {
+    issues.push({
+      path: `${base}.owner`,
+      message: "must be a non-empty string when present"
+    });
+  }
   const allow = Array.isArray(o.allow) ? o.allow : [];
   const allowsDangerous = allow.some(
     (s) => typeof s === "string" && DANGEROUS_SYMBOLS.has(s)
@@ -253,7 +265,7 @@ function applyPolicy(rawVerdict, serverName, blockingFindings, policy, now) {
   return {
     verdict: "REVIEW",
     changed: true,
-    note: `Policy decision: override for "${serverName}" (expires ${override.expiresAt}) \u2014 ${override.reason}`
+    note: `Policy decision: override for "${serverName}" (expires ${override.expiresAt}${override.owner ? `, owner: ${override.owner}` : ""}) \u2014 ${override.reason}`
   };
 }
 function shouldFailCi(verdict, policy) {
@@ -267,7 +279,8 @@ function resolveScanOptions(opts) {
     policy: opts?.policy ?? defaultPolicy(),
     now: opts?.now ?? 0,
     generatedAt: opts?.generatedAt ?? "1970-01-01T00:00:00.000Z",
-    extraFindings: opts?.extraFindings ?? {}
+    extraFindings: opts?.extraFindings ?? {},
+    surfaces: opts?.surfaces ?? []
   };
 }
 
@@ -534,6 +547,56 @@ function looksLikeBroadPath(arg) {
   if (/^[A-Za-z]:\\Users\\[^\\]+\\?$/.test(arg)) return true;
   return false;
 }
+function looksLikeHostPath(s) {
+  if (!s) return false;
+  return s.startsWith("/") || // POSIX absolute (incl. /Users, /home, /etc, ...)
+  s.startsWith("~") || // home
+  s.startsWith(".") || // workspace-relative (handled as not-broad by isWorkspaceScoped/below)
+  /^[A-Za-z]:[\\/]/.test(s) || // Windows drive, C:\ or C:/
+  s.startsWith("$") || // $HOME / ${HOME}
+  s.startsWith("%");
+}
+function extractDockerHostPaths(args) {
+  const hosts = [];
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--mount" || arg.startsWith("--mount=")) {
+      const csv = arg === "--mount" ? args[i + 1] ?? "" : arg.slice("--mount=".length);
+      if (arg === "--mount") i += 1;
+      const fields = /* @__PURE__ */ new Map();
+      for (const part of csv.split(",")) {
+        const eq = part.indexOf("=");
+        if (eq === -1) continue;
+        fields.set(part.slice(0, eq).trim(), part.slice(eq + 1).trim());
+      }
+      const type = fields.get("type") ?? "volume";
+      if (type !== "bind") continue;
+      const src = fields.get("source") ?? fields.get("src");
+      if (src && looksLikeHostPath(src)) hosts.push(src);
+      continue;
+    }
+    let spec;
+    if (arg === "-v" || arg === "--volume") {
+      spec = args[i + 1];
+      i += 1;
+    } else if (arg.startsWith("-v=")) {
+      spec = arg.slice("-v=".length);
+    } else if (arg.startsWith("--volume=")) {
+      spec = arg.slice("--volume=".length);
+    }
+    if (spec === void 0) continue;
+    const host = dockerVolumeHostSide(spec);
+    if (host && looksLikeHostPath(host)) hosts.push(host);
+  }
+  return hosts;
+}
+function dockerVolumeHostSide(spec) {
+  const winDrive = /^[A-Za-z]:[\\/]/.test(spec);
+  const searchFrom = winDrive ? 2 : 0;
+  const sep = spec.indexOf(":", searchFrom);
+  if (sep === -1) return void 0;
+  return spec.slice(0, sep);
+}
 function detectBroadFilesystemPath(ctx) {
   const { server } = ctx;
   const evidence = [];
@@ -547,6 +610,18 @@ function detectBroadFilesystemPath(ctx) {
       });
     }
   }
+  if ((server.command ?? "").toLowerCase() === "docker") {
+    for (const host of extractDockerHostPaths(server.args)) {
+      if (looksLikeBroadPath(host)) {
+        evidence.push({
+          type: "config",
+          path: server.sourceConfigPath,
+          key: "args",
+          value: host
+        });
+      }
+    }
+  }
   if (evidence.length === 0) return [];
   return [
     {
@@ -727,7 +802,7 @@ function detectUnknownRemote(ctx) {
   ];
 }
 
-// ../../packages/static-analyzer/src/detectors/promptPoisoning.ts
+// ../../packages/static-analyzer/src/promptScan.ts
 var POISON_PATTERNS = [
   "ignore previous instructions",
   "ignore all previous instructions",
@@ -749,23 +824,69 @@ var POISON_PATTERNS = [
   "override the system prompt",
   "you are now"
 ];
-function scanText(text, source) {
+function findPoisonPhrases(text) {
   if (!text) return [];
   const lower = text.toLowerCase();
   const hits = [];
   for (const pattern of POISON_PATTERNS) {
-    if (lower.includes(pattern)) {
-      hits.push({
-        pattern,
-        evidence: {
-          type: "tool-metadata",
-          path: source.path,
-          key: source.key,
-          snippet: pattern
-        }
-      });
+    if (lower.includes(pattern)) hits.push(pattern);
+  }
+  return hits;
+}
+var INVISIBLE_CODE_POINTS = [8203, 8204, 8205, 8288, 65279];
+var BIDI_RANGES = [
+  [8234, 8238],
+  [8294, 8297]
+];
+var TAG_RANGE = [917504, 917631];
+function hasInvisible(text) {
+  for (const ch of text) {
+    if (INVISIBLE_CODE_POINTS.includes(ch.codePointAt(0))) return true;
+  }
+  return false;
+}
+function inAnyRange(text, ranges) {
+  for (const ch of text) {
+    const cp = ch.codePointAt(0);
+    for (const [lo, hi] of ranges) {
+      if (cp >= lo && cp <= hi) return true;
     }
   }
+  return false;
+}
+function findHiddenContent(text) {
+  if (!text) return [];
+  const categories = [];
+  if (hasInvisible(text)) categories.push("zero-width or invisible characters");
+  if (inAnyRange(text, BIDI_RANGES)) {
+    categories.push("Unicode bidirectional override controls");
+  }
+  if (inAnyRange(text, [TAG_RANGE])) {
+    categories.push("invisible tag-character ASCII smuggling");
+  }
+  if (/<!--[\s\S]*?-->/.test(text)) categories.push("embedded HTML/XML comment");
+  return categories;
+}
+function poisonEvidence(pattern, source) {
+  return { type: source.type, path: source.path, key: source.key, snippet: pattern };
+}
+function hiddenEvidence(category, source) {
+  return { type: source.type, path: source.path, key: source.key, snippet: category };
+}
+
+// ../../packages/static-analyzer/src/detectors/promptPoisoning.ts
+function scanText(text, source) {
+  const hits = [];
+  for (const pattern of findPoisonPhrases(text)) {
+    hits.push({
+      pattern,
+      evidence: poisonEvidence(pattern, {
+        type: "tool-metadata",
+        path: source.path,
+        key: source.key
+      })
+    });
+  }
   return hits;
 }
 function detectPromptPoisoning(ctx) {
@@ -1009,6 +1130,93 @@ function detectFinancialAction(ctx) {
   return findings;
 }
 
+// ../../packages/static-analyzer/src/detectors/unverifiedLocalSource.ts
+function localSubject(args) {
+  for (const a of args) {
+    if (a === "-y" || a === "--yes" || a.startsWith("-")) continue;
+    return a;
+  }
+  return void 0;
+}
+function detectUnverifiedLocalSource(ctx) {
+  const { binding, server } = ctx;
+  if (!binding.sourceKnown) return [];
+  if (!binding.runtimeExecutable) return [];
+  if (binding.runtimeKind === "docker") return [];
+  if (binding.packageName) return [];
+  const command = binding.declaredCommand ?? server.command;
+  if (!command) return [];
+  const subject = localSubject(binding.declaredArgs);
+  const display = subject ? `${command} ${subject}` : command;
+  const evidence = [
+    {
+      type: "runtime-binding",
+      path: server.sourceConfigPath,
+      key: "command",
+      value: display
+    }
+  ];
+  return [
+    {
+      id: "exec.unverified-local-source",
+      title: "Runs an unverified local executable",
+      severity: "medium",
+      blocker: false,
+      symbol: "EXEC",
+      riskClass: "S2",
+      mode: "OBSERVED",
+      confidence: "medium",
+      detectionMethod: "runtime-binding",
+      evidence,
+      impact: "The runtime executes a local script or binary whose contents CallLint never inspects. It is not a recognized package or pinned image, so what actually runs cannot be verified from the config alone.",
+      fix: "Confirm you trust the local source, or run it from a pinned, recognized package (e.g. npx pkg@1.2.3 / a pinned docker image) so the runtime is independently verifiable.",
+      falsePositiveNote: "A developer running their own local server (e.g. node ./dist/server.js) is normal; this flags that the source is not independently verifiable, not that it is malicious."
+    }
+  ];
+}
+
+// ../../packages/static-analyzer/src/detectors/hiddenInstructions.ts
+function scanHidden(text, key, path) {
+  const out = [];
+  for (const category of findHiddenContent(text)) {
+    out.push(hiddenEvidence(category, { type: "tool-metadata", path, key }));
+  }
+  return out;
+}
+function detectHiddenInstructions(ctx) {
+  const { server } = ctx;
+  const evidence = [];
+  evidence.push(...scanHidden(server.instructions, "instructions", server.sourceConfigPath));
+  for (const tool of server.providedTools) {
+    const base = tool.name ? `tools.${tool.name}` : "tools";
+    evidence.push(...scanHidden(tool.name, `${base}.name`, server.sourceConfigPath));
+    evidence.push(
+      ...scanHidden(tool.description, `${base}.description`, server.sourceConfigPath)
+    );
+    evidence.push(
+      ...scanHidden(tool.inputSchemaText, `${base}.inputSchema`, server.sourceConfigPath)
+    );
+  }
+  if (evidence.length === 0) return [];
+  return [
+    {
+      id: "prompt.hidden-instructions",
+      title: "Hidden or obfuscated content in model-visible metadata",
+      severity: "medium",
+      blocker: false,
+      symbol: "PROMPT",
+      riskClass: "S2",
+      mode: "OBSERVED",
+      confidence: "medium",
+      detectionMethod: "tool-metadata",
+      evidence,
+      impact: "Invisible or obfuscated characters in tool metadata reach the model but not a human reader, so a model-directed instruction can hide from review while still steering autonomous tool use.",
+      fix: "Remove zero-width/bidirectional/tag characters and HTML comments from tool names, descriptions, schemas, and server instructions; keep model-visible text identical to what a human reviewer sees.",
+      falsePositiveNote: "Some hidden characters are benign (e.g. a BOM, or a bidi control in a legitimate right-to-left language sample, or an HTML comment in documentation). This flags that the model-visible text differs from the rendered text; review the surface in context."
+    }
+  ];
+}
+
 // ../../packages/static-analyzer/src/analyzeServerConfig.ts
 var DETECTORS = [
   detectBroadFilesystemPath,
@@ -1018,7 +1226,9 @@ var DETECTORS = [
   detectUnpinnedPackage,
   detectUnknownRemote,
   detectExternalMutation,
-  detectFinancialAction
+  detectFinancialAction,
+  detectUnverifiedLocalSource,
+  detectHiddenInstructions
 ];
 function analyzeServerConfig(server) {
   const binding = resolveRuntimeBinding(server);
@@ -1030,6 +1240,41 @@ function analyzeServerConfig(server) {
   return findings;
 }
 
+// ../../packages/static-analyzer/src/documentSurface.ts
+function analyzeDocumentSurfaces(surfaces) {
+  const evidence = [];
+  for (const surface of surfaces) {
+    for (const pattern of findPoisonPhrases(surface.text)) {
+      evidence.push(
+        poisonEvidence(pattern, { type: "source", path: surface.path, key: surface.kind })
+      );
+    }
+    for (const category of findHiddenContent(surface.text)) {
+      evidence.push(
+        hiddenEvidence(category, { type: "source", path: surface.path, key: surface.kind })
+      );
+    }
+  }
+  if (evidence.length === 0) return [];
+  return [
+    {
+      id: "prompt.surface-instructions",
+      title: "Model-directed or hidden content in a project document",
+      severity: "medium",
+      blocker: false,
+      symbol: "PROMPT",
+      riskClass: "S2",
+      mode: "OBSERVED",
+      confidence: "medium",
+      detectionMethod: "source-text",
+      evidence,
+      impact: "A project document (README / SKILL.md / AGENTS.md / package description) contains model-directed instructions or hidden/obfuscated content. An agent that reads project docs alongside the tool could be steered by text a human reviewer skims past.",
+      fix: "Remove model-directed instructions and hidden/obfuscated characters from project documents; keep their visible text equal to their intent.",
+      falsePositiveNote: "Documentation legitimately discusses prompts, tool ordering, or includes HTML comments and non-Latin scripts. This flags prompt-surface shape in project docs, not a proven injection; review the cited file in context."
+    }
+  ];
+}
+
 // ../../packages/risk-engine/src/computeRiskClass.ts
 function computeRiskClass(findings, binding) {
   const classes = findings.map((f) => f.riskClass);
@@ -1387,6 +1632,126 @@ function normalizeMcpServers(root, sourceConfigPath) {
 
 // ../../packages/config-parser/src/parseConfig.ts
 import { basename } from "node:path";
+
+// ../../packages/config-parser/src/positionIndex.ts
+function peek(c) {
+  return c.text[c.i] ?? "";
+}
+function advance(c) {
+  const ch = c.text[c.i] ?? "";
+  c.i++;
+  if (ch === "\n") {
+    c.line++;
+    c.col = 1;
+  } else {
+    c.col++;
+  }
+  return ch;
+}
+function skipWhitespace(c) {
+  while (c.i < c.text.length) {
+    const ch = peek(c);
+    if (ch === " " || ch === "	" || ch === "\n" || ch === "\r") advance(c);
+    else break;
+  }
+}
+function readString(c) {
+  advance(c);
+  let out = "";
+  while (c.i < c.text.length) {
+    const ch = advance(c);
+    if (ch === "\\") {
+      const esc2 = advance(c);
+      if (esc2 === "n") out += "\n";
+      else if (esc2 === "t") out += "	";
+      else if (esc2 === "r") out += "\r";
+      else if (esc2 === "u") {
+        let hex = "";
+        for (let k = 0; k < 4; k++) hex += advance(c);
+        const code = Number.parseInt(hex, 16);
+        out += Number.isNaN(code) ? "" : String.fromCharCode(code);
+      } else out += esc2;
+    } else if (ch === '"') {
+      break;
+    } else {
+      out += ch;
+    }
+  }
+  return out;
+}
+function skipValue(c, index, pathPrefix) {
+  skipWhitespace(c);
+  const ch = peek(c);
+  if (ch === "{") {
+    scanObject(c, index, pathPrefix);
+  } else if (ch === "[") {
+    scanArray(c, index, pathPrefix);
+  } else if (ch === '"') {
+    readString(c);
+  } else {
+    while (c.i < c.text.length) {
+      const n = peek(c);
+      if (n === "," || n === "}" || n === "]" || n === " " || n === "	" || n === "\n" || n === "\r") break;
+      advance(c);
+    }
+  }
+}
+function scanArray(c, index, pathPrefix) {
+  advance(c);
+  for (; ; ) {
+    skipWhitespace(c);
+    const ch = peek(c);
+    if (ch === "]" || ch === "") {
+      if (ch === "]") advance(c);
+      return;
+    }
+    if (ch === ",") {
+      advance(c);
+      continue;
+    }
+    skipValue(c, index, pathPrefix);
+  }
+}
+function scanObject(c, index, pathPrefix) {
+  advance(c);
+  for (; ; ) {
+    skipWhitespace(c);
+    const ch = peek(c);
+    if (ch === "}" || ch === "") {
+      if (ch === "}") advance(c);
+      return;
+    }
+    if (ch === ",") {
+      advance(c);
+      continue;
+    }
+    if (ch !== '"') {
+      advance(c);
+      continue;
+    }
+    const keyLine = c.line;
+    const keyCol = c.col;
+    const key = readString(c);
+    const path = pathPrefix ? `${pathPrefix}.${key}` : key;
+    if (!(path in index)) index[path] = { line: keyLine, column: keyCol };
+    skipWhitespace(c);
+    if (peek(c) === ":") advance(c);
+    skipValue(c, index, path);
+  }
+}
+function buildPositionIndex(text) {
+  const index = {};
+  const c = { text, i: 0, line: 1, col: 1 };
+  try {
+    skipWhitespace(c);
+    if (peek(c) === "{") scanObject(c, index, "");
+    else if (peek(c) === "[") scanArray(c, index, "");
+  } catch {
+  }
+  return index;
+}
+
+// ../../packages/config-parser/src/parseConfig.ts
 function kindForPath(path) {
   const base = basename(path).toLowerCase();
   if (base.includes("settings")) return "claude-settings";
@@ -1399,10 +1764,84 @@ function parseConfigText(text, configPath = "<inline>") {
     configPath,
     kind: configPath === "<inline>" ? "inline" : kindForPath(configPath),
     servers: normalizeMcpServers(root, configPath),
-    root
+    root,
+    positions: buildPositionIndex(text)
   };
 }
 
+// ../../packages/core/src/scanSurfaces.ts
+function scanDocumentSurfaces(surfaces, configPath, generatedAt) {
+  if (surfaces.length === 0) return void 0;
+  const findings = analyzeDocumentSurfaces(surfaces);
+  if (findings.length === 0) return void 0;
+  const truncated = surfaces.some((s) => s.truncated);
+  return {
+    schemaVersion: "calllint.report.v0",
+    reportKind: "single-target",
+    target: {
+      name: "project-docs",
+      kind: "project-docs",
+      configPath
+    },
+    verdict: "REVIEW",
+    publicVerdictLabel: VERDICT_PUBLIC_LABEL.REVIEW,
+    riskClass: "S2",
+    symbols: ["PROMPT"],
+    confidence: "medium",
+    reproducibility: {
+      level: "HIGH",
+      reasons: ["Static scan of local documents; deterministic given the same files."]
+    },
+    summary: "Project documents contain model-directed or hidden prompt-surface content; review the cited files.",
+    observed: findings,
+    inferred: [],
+    findings,
+    topFindings: findings,
+    policy: {
+      autonomousUse: "warn",
+      manualApproval: "recommended",
+      sandbox: "recommended"
+    },
+    fingerprints: {
+      configHash: "",
+      targetSpecHash: "",
+      riskSurfaceHash: ""
+    },
+    diagnostics: truncated ? [
+      {
+        level: "info",
+        code: "surface.truncated",
+        message: "One or more project documents exceeded the scan size cap and were truncated."
+      }
+    ] : [],
+    generatedAt
+  };
+}
+
+// ../../packages/core/src/enrichPositions.ts
+function enrichEvidencePositions(reports, positions) {
+  if (Object.keys(positions).length === 0) return;
+  const prefixes = ["mcpServers", "servers", ""];
+  for (const report of reports) {
+    const server = report.target.name;
+    for (const finding of report.findings) {
+      for (const ev of finding.evidence) {
+        if (ev.line !== void 0) continue;
+        if (!ev.key) continue;
+        for (const prefix of prefixes) {
+          const path = prefix ? `${prefix}.${server}.${ev.key}` : `${server}.${ev.key}`;
+          const pos = positions[path];
+          if (pos) {
+            ev.line = pos.line;
+            ev.column = pos.column;
+            break;
+          }
+        }
+      }
+    }
+  }
+}
+
 // ../../packages/core/src/scanConfig.ts
 function aggregate(configPath, reports, generatedAt) {
   const counts = { SAFE: 0, REVIEW: 0, BLOCK: 0, UNKNOWN: 0 };
@@ -1421,10 +1860,13 @@ function aggregate(configPath, reports, generatedAt) {
   };
 }
 function scanParsed(parsed, opts) {
-  const { generatedAt } = resolveScanOptions(opts);
+  const { generatedAt, surfaces } = resolveScanOptions(opts);
   const reports = parsed.servers.map(
     (server) => scanServer({ server, targetKind: parsed.kind }, opts)
   );
+  enrichEvidencePositions(reports, parsed.positions);
+  const surfaceReport = scanDocumentSurfaces(surfaces, parsed.configPath, generatedAt);
+  if (surfaceReport) reports.push(surfaceReport);
   return aggregate(parsed.configPath, reports, generatedAt);
 }
 function scanConfigText(text, configPath, opts) {
@@ -1872,6 +2314,146 @@ function renderSarif(summary) {
   return JSON.stringify(sarif, null, 2);
 }
 
+// ../../packages/report-renderer/src/renderMarkdown.ts
+function renderMarkdown(summary) {
+  const out = [];
+  const c = summary.counts;
+  out.push(`## CallLint: ${summary.verdict} \u2014 ${summary.publicVerdictLabel}`);
+  out.push("");
+  out.push(
+    `CallLint statically checked \`${summary.configPath}\` before the agent tool runs. It never executes, installs, or connects to the server it judges.`
+  );
+  out.push("");
+  out.push("| Server | Verdict | Risk class | Findings |");
+  out.push("| --- | --- | --- | --- |");
+  for (const r of summary.reports) {
+    out.push(
+      `| ${mdCell(r.target.name)} | ${r.verdict} | ${r.riskClass} | ${r.findings.length} |`
+    );
+  }
+  out.push(
+    `| **TOTAL** | **${summary.verdict}** | \u2014 | BLOCK ${c.BLOCK} \xB7 UNKNOWN ${c.UNKNOWN} \xB7 REVIEW ${c.REVIEW} \xB7 SAFE ${c.SAFE} |`
+  );
+  out.push("");
+  for (const r of summary.reports) {
+    renderServer2(out, r);
+  }
+  out.push("---");
+  out.push("");
+  out.push(
+    "> CallLint does not prove runtime safety. `SAFE` means no blockers observed under current evidence; `UNKNOWN` is never `SAFE`. Verdicts are heuristic decision support, not a safety guarantee."
+  );
+  return out.join("\n");
+}
+function renderServer2(out, r) {
+  out.push(`### ${r.target.name} \u2014 ${r.verdict}`);
+  out.push("");
+  if (r.summary) {
+    out.push(r.summary);
+    out.push("");
+  }
+  if (r.findings.length === 0) {
+    out.push("_No findings._");
+    out.push("");
+  } else {
+    for (const f of r.findings) {
+      renderFinding(out, f);
+    }
+  }
+  renderRecommendation(out, r.policy);
+  out.push("");
+}
+function renderFinding(out, f) {
+  const tag = f.blocker ? "BLOCKER" : f.severity.toUpperCase();
+  out.push(`#### ${tag}: ${f.title}`);
+  out.push("");
+  out.push(`- Risk: ${f.symbol} \xB7 ${f.riskClass} \xB7 ${f.mode} \xB7 confidence ${f.confidence}`);
+  const ev = f.evidence[0];
+  if (ev) {
+    const loc = ev.path ? ` \`${ev.path}\`${ev.line ? `:${ev.line}` : ""}` : "";
+    const shown = ev.snippet ?? ev.value ?? ev.key;
+    out.push(`- Evidence:${loc}`);
+    if (shown) {
+      out.push("");
+      out.push("  ```text");
+      for (const line of String(shown).split("\n")) out.push(`  ${line}`);
+      out.push("  ```");
+    }
+  }
+  out.push("");
+  out.push(`Why it matters: ${f.impact}`);
+  out.push("");
+  out.push(`Recommended fix: ${f.fix}`);
+  if (f.falsePositiveNote) {
+    out.push("");
+    out.push(`Note: ${f.falsePositiveNote}`);
+  }
+  out.push("");
+}
+function renderRecommendation(out, p) {
+  out.push("Policy recommendation:");
+  out.push(`- Autonomous use: ${p.autonomousUse}`);
+  out.push(`- Manual approval: ${p.manualApproval}`);
+  out.push(`- Sandbox: ${p.sandbox}`);
+}
+function mdCell(s) {
+  return s.replace(/\|/g, "\\|").replace(/\n/g, " ");
+}
+
+// ../../packages/report-renderer/src/renderDiagnostics.ts
+function verdictContributionFor(f) {
+  if (f.blocker) return "blocker";
+  return f.mode === "INFERRED" ? "inferred" : "review";
+}
+function keyPathFor(f) {
+  const ev = f.evidence[0];
+  if (!ev) return null;
+  return ev.key ?? null;
+}
+function observedFor(f) {
+  const ev = f.evidence[0];
+  if (!ev) return null;
+  return ev.value ?? ev.snippet ?? null;
+}
+function entryFromFinding(f, report, configFile) {
+  const ev = f.evidence[0];
+  return {
+    ruleId: f.id,
+    title: f.title,
+    severity: f.severity,
+    server: report.target.name,
+    file: ev?.path ?? configFile,
+    keyPath: keyPathFor(f),
+    // Populated by the post-hoc position enrichment (config-parser position
+    // index → core), when the evidence's config key maps to a source location;
+    // null for evidence with no locatable source key (e.g. binding-derived).
+    line: ev?.line ?? null,
+    column: ev?.column ?? null,
+    observed: observedFor(f),
+    remediation: f.fix,
+    mode: f.mode,
+    confidence: f.confidence,
+    verdictContribution: verdictContributionFor(f)
+  };
+}
+function renderDiagnostics(summary) {
+  const diagnostics = [];
+  for (const report of summary.reports) {
+    for (const f of report.findings) {
+      diagnostics.push(entryFromFinding(f, report, summary.configPath));
+    }
+  }
+  const out = {
+    schemaVersion: "calllint.diagnostics.v0",
+    verdict: summary.verdict,
+    publicVerdictLabel: summary.publicVerdictLabel,
+    file: summary.configPath,
+    diagnostics,
+    generatedAt: summary.generatedAt
+  };
+  return JSON.stringify(out, null, 2);
+}
+
 // ../../packages/report-renderer/src/logoBase64.ts
 var LOGO_REPORT_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAKdElEQVRo3u1aeXAT1xlf35cs2bJ8yJYtbGxjG+rgkJCjdaBMSYBAhstAhwSYZDJ105CGnBwNSUlKmibNJDR0GJrJQELb1C2kgQ6dtJwFAgFyTAB7tVpprdvyjW3Zkvb4+r2nAzVtZ/qHhO2ZLrOjZd/bx/f73u87Hwzz/+u/X8AwSeSezABSgJmVNikFJ7+m3PINnLq8NfbdpKAN+f1So8kTVAarNbfM9YWqpDB2bFJo36Iu32tP14EDb4umYh9510YpNYFBoHCp5JfTGTc5GA103vU9qbN5gWTHZ0tB1WYydhLnTDgQRKCTYeHZwurHhLRC4HVTZD/LKX7eqpiLqmQhTQfmgsofRUC8yDDJE0H2pFhacAVVzwtIGXNOsTxy6qwS7LRDwCLAyJlPFbNKL9sQBKub8sI3QY+jiwxp0W5o0Jq0Vb91JuUBX2CURk6eUZQxPwgzm8E64w6QfT4EcV7hdZWSMxnnaCvbWH2tLrxOctt4eiizvnYpn1NmcTLZ0Nl4t0hoIw8Ng+2ehWBKzgdTSj7Yvn0vSIPXwc/xSmfTd0Qy15xTKphLqlvGxR44pjqD05St4LJLT9iIsabrlK4nt0iKKIG/gwNhxl3A4m6YMouAyyqmQKwNs8HfzoIiy+B9drskZOgUG6MGNlt/ukNTtlJgjJkRWiZM8IjhsZqKSkd26ag7txycyx6Sxr6+KgNeA3v3AZdXAaaMQmBRONs9C8A+bwk+5wKXWQycphz697xHpsLYlQ7ZuWKd5FYZwJZTOnxFa6yPUCrhQepqwxwVarjdOWsukUUeu/g52Ocuhg4mh1KGRYpY62+HgLUTgjYHCA130HcsjpE5tuaFMPrZZUDUsvPO+fhOY/bMfzAnocGOGNpVhkmnQapyRjHL5PW65iwC0TeqWOtvQyHSwZxrAKHudvBu2gqixwsKoiO36O2G7mdeAKF+NnA4h8y11MwEyR9QXN8lwNU9jurZBqoc/DcSZtQR7VhLan9mYzLAu/WnstjTA3y+EThVKZiYPOh99ZeUIooogixJoRufydX72lu4E3k4twy9VRUEPV3g3fYyBroM6CyZ9mosTePOffQaq0xq/UY2u/SQBenAl9UqYm8fDOz+DQqeg9ovA1N6IQlW4L/aHgKBwtMbnwNo3GZdVWiOuhy/yYaBXXtA7OsHS9k0wDUVdAqHTGrDRlOO4ftxoVPsAi5V6YnBHAO4NBWSY/5SOSjYqMfh9bVgwgDFZeuRHuWU696Nz4Z34Yb2vU9uRqpkUZpxOaXApRcBX1ILAZaDINqK/d7lijvPKA2gUbtVZefiYtCxAFDIY47iGhj78usA0ajv9DmwVjZSo+VyysCcpUffrgdTqo6+l3B3ojaAWrZWN9ExKnxWCZiRRqbUArBMvQV8p85SkL4LlwLOiukITncm7gDY5PwTbkMDKIoieZ/ahtrMoO6SahS1b47eKGCKFoaP/h0i18jx0xgLtFR4c+xc/Jas0cFk4g5tQXc2JnVV34pz884lAID2hAcBoOeQnA+sQaqokMsGYDE1MKFGuQgQNaFRJvT94u0oAPJMYwHSw0xAkLn4DZusprGBjDnvXwXSyEgYgDb+ALhk7fGu8umE05Jr9cOotTSwNy+A7m0vI40QBBEQeW0mAiXlg/exp6MAPPhMhDRrKugcAp5NzYPuLTvAhq64A9Mq18p1IPl8CKApQQBStcc9BgQQDEquNY9AOw73hV2m728nwLVkDfCFU4FL09Ixx+LllP/kcixdDejf0QMVgLmwGsdWwcgnx0Ou9ZXX4RqORQFMRQApCQGgO+Ypa8AdCErOZWvBgh5E7OkNGaoSEpVE3uHDR6HvzXdg8Hd/jBrx4IcHoe+NXTD88VE6h16yEjLw7h7qyQgoaXRUclfeQmzoH3FLKyIg0IN87CmZBuLwsOR+5HEYOnQkJAcJWOQOBqNAIhf5+7+9wz90bjjQkWvooyPg2tAK4uCgRByFKa3gaNwARMK6Ob14X7fGCGJvr+h94nnwPPpEFIASFiTi+0mAE3v7QwCIlvv76Ts5Zh6N0MFQjPC0PgUejB3Brm7Jie4VM9j347kDtGrC7sIrXiwVx65cE/t/tZfy1nfsVEhoFGT0/EXoeW47OBauBB557Fr7aNQG3A8/DpYpjeBY1ALdOIfMVXAXqP0cO03X6seIPnrlmuQk9bOmfEes8uLSZbAXVa/txEg6+Ps/yaNnL1BD9az7AYjuLnAtexDQRsIZpwbHMsFxf0sUgHPFQ/guhXoelmSsGLnJN2JXN7jXt9K1fGc+xbUPSS70UILOuCZuvaTINrprmuo5JjtI0gQ0XgUbVmh800CovRWFyqL+ncN8KOTX1eBGcFE3ijbTQaqwPGM08NGUu3om5lR1YM4n1OxTvEgljCFjjsoZjXE34qstLel8Uv4XHqysJL9fdi1eTYXgsopionEJBUGEJVSJXCRWkDqAi43auZTrdA0X8UC4pnvGncAzmq/a2tpSEtKs6sw17PRgkPKdvyhdR9dI6MDjTtBELnKHE7rBd/dHAQwe+AO+09A0+l/SDnVo7lDbRzBy4RLSB8tTjWFn3Pj/TRo5jQ0zeSY74EHeYt6iWGuaaEJGEjMiUGyiNvrZ51EA/mtsKN3OihGegMFvrUhBspZ7XSuYmWy/raJuVkJKy2gxk1lyyIUC+M0WaeDd9yn/I9QgGiYFfGdTM8iBQDQOEJ9P0g5TeBdCFCqn3w7iGmMmXnJhEtiZrT+YsLIyohGLvr7ZwqhE16r1GJFkxd58HzVaCgK1TCjRu+O1G0Eu7OtJJCZj1F7wJt/Ysd0CkqQ4V64HsqZJX9Oc0MI+srCQa9jrRm0OHfmrGOgwoUBYTpKuQwYWKUVVtBt3oyKjDQsQnS7gS2swmSsM0U2Fu3ilHa4fPioS7pM1b1pXQjA2lAipOqvDUA+BLq98/YMPqUZNaOD9b+8JaZ9QCHtAhELkOdp2SSlAKqlg8L0DEPR2yzZcA9fi2yvq9DelBR9tnxfXLRYYteyYt4SoWOnZvpMGMOL/ScsksgOR9GH08lcYDzbS4qVn80ukpaLY5j2gWBm1xJfULEq49v9TfmTRVm4lkdOz4YeU6N4fb6ZpgQljQ9+bu6NeqP8dLPyx3CRjXeE6AYMbthixKNJWbhmXE5yoUedX/NqDgmCCR5Ob7md+QrVMAtfQwcMwgqUloRfpBXk3PgfhOUE3juPBx56EtVL+1xPItpaWFHSJBzwoEO5AkNLppZ+HmldV36IdOlJxEdqQMe/TRHgV8JryAyfnzCGJ4vidZEZAnGTmpPKaiv0ERJhOysDe/cCma7C8xP7PW9Swla7WTVTzGL0/uDyLnl6O/zEsEYBQABhI4jXGXU4U0HnfckkKBOThv3yCacKfMVzIsmvZWnSXGAfyp+wG3LUJdYYcFibUucazMIFRyY7GuxW/zS4FPF2S/ba5ikAMVjd1W8R+JuJhX1LEO+Hpy1ILo+l1ldaBGzsZPJPbz+qmrposJ5UhF1vaWMum6y5g5L0kGKfXT7bDbkonL54jcNWz1XFPj2/GRQz7xTDXYYIcqU7I/63yT1NyvbeodjVcAAAAAElFTkSuQmCC";
 
@@ -2066,8 +2648,78 @@ function resolveConfigInput(args, deps) {
   return { text: readFileSync3(resolved, "utf8"), configPath: resolved };
 }
 
+// src/commands/changedConfigs.ts
+import { basename as basename2, resolve } from "node:path";
+import { existsSync as existsSync3 } from "node:fs";
+function changedConfigPaths(cwd, diff) {
+  let raw;
+  try {
+    raw = diff();
+  } catch {
+    return [];
+  }
+  const knownLeaves = new Set(DEFAULT_CONFIG_PATHS.map((p) => basename2(p)));
+  const knownPaths = new Set(DEFAULT_CONFIG_PATHS);
+  return raw.split("\n").map((l) => l.trim()).filter(
+    (f) => f.length > 0 && (knownPaths.has(f) || DEFAULT_CONFIG_PATHS.some((p) => f.endsWith("/" + p)) || knownLeaves.has(basename2(f)))
+  ).map((f) => resolve(cwd, f)).filter((abs) => existsSync3(abs));
+}
+
+// src/commands/surfaces.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4, statSync } from "node:fs";
+import { join as join3 } from "node:path";
+var SURFACE_SIZE_CAP = 256 * 1024;
+var SURFACE_FILES = [
+  { file: "README.md", kind: "readme" },
+  { file: "SKILL.md", kind: "skill" },
+  { file: "AGENTS.md", kind: "agents" }
+];
+function readCapped(path) {
+  try {
+    const st = statSync(path);
+    if (!st.isFile()) return void 0;
+    const raw = readFileSync4(path, "utf8");
+    if (raw.length > SURFACE_SIZE_CAP) {
+      return { text: raw.slice(0, SURFACE_SIZE_CAP), truncated: true };
+    }
+    return { text: raw, truncated: false };
+  } catch {
+    return void 0;
+  }
+}
+function readDocumentSurfaces(dir) {
+  const surfaces = [];
+  if (!existsSync4(dir)) return surfaces;
+  for (const { file, kind } of SURFACE_FILES) {
+    const got = readCapped(join3(dir, file));
+    if (got) surfaces.push({ path: file, kind, text: got.text, truncated: got.truncated });
+  }
+  const pkgPath = join3(dir, "package.json");
+  const pkgRaw = readCapped(pkgPath);
+  if (pkgRaw) {
+    try {
+      const pkg = JSON.parse(pkgRaw.text);
+      const description = pkg && typeof pkg === "object" && !Array.isArray(pkg) ? pkg.description : void 0;
+      if (typeof description === "string") {
+        surfaces.push({
+          path: "package.json",
+          kind: "package-description",
+          text: description,
+          truncated: pkgRaw.truncated
+        });
+      }
+    } catch {
+    }
+  }
+  return surfaces;
+}
+
 // src/commands/scan.ts
+import { readFileSync as readFileSync5 } from "node:fs";
 function scanCommand(args, deps) {
+  if (flagBool(args.flags, "changed")) {
+    return scanChangedCommand(args, deps);
+  }
   const policyPath = flagStr(args.flags, "policy");
   let policy;
   try {
@@ -2084,13 +2736,19 @@ function scanCommand(args, deps) {
     return { stdout: "", stderr: input.error, exitCode: input.exitCode };
   }
   const { text, configPath } = input;
+  return scanOneConfig(text, configPath, policy, args, deps);
+}
+function scanOneConfig(text, configPath, policy, args, deps) {
+  const surfaceDir = flagStr(args.flags, "surface-dir");
+  const surfaces = surfaceDir ? readDocumentSurfaces(resolve2(deps.cwd, surfaceDir)) : void 0;
   let summary;
   try {
     summary = scanConfigText(text, configPath, {
       policy,
       now: deps.now,
       generatedAt: deps.generatedAt,
-      extraFindings: deps.online?.extraFindings
+      extraFindings: deps.online?.extraFindings,
+      surfaces
     });
   } catch (err) {
     if (err instanceof ConfigParseError) {
@@ -2104,23 +2762,113 @@ function scanCommand(args, deps) {
   }
   if (deps.writeCacheFile !== false) {
     try {
-      writeCache(summary, join3(deps.cwd, ".calllint", "last-scan.json"));
+      writeCache(summary, join4(deps.cwd, ".calllint", "last-scan.json"));
     } catch {
     }
   }
+  const stdout = renderSummary(summary, args);
+  const exitCode = flagBool(args.flags, "ci") ? exitCodeFor(summary, policy) : EXIT.OK;
+  return { stdout, exitCode };
+}
+function renderSummary(summary, args) {
   const style = flagBool(args.flags, "no-emoji") ? NO_EMOJI_STYLE : DEFAULT_STYLE;
+  if (flagBool(args.flags, "json")) return renderJson(summary);
+  if (flagBool(args.flags, "sarif")) return renderSarif(summary);
+  if (flagBool(args.flags, "markdown")) return renderMarkdown(summary);
+  if (flagBool(args.flags, "html")) return renderHtml(summary);
+  if (flagBool(args.flags, "compact")) return renderCompact(summary, style);
+  return renderTerminal(summary, style);
+}
+function scanChangedCommand(args, deps) {
+  const policyPath = flagStr(args.flags, "policy");
+  let policy;
+  try {
+    policy = loadPolicyOrDefault(policyPath);
+  } catch (err) {
+    return {
+      stdout: "",
+      stderr: err instanceof Error ? err.message : String(err),
+      exitCode: EXIT.ERROR
+    };
+  }
+  if (!deps.getChangedFilesDiff) {
+    return {
+      stdout: "",
+      stderr: "--changed needs a git diff source. Run inside a git repository, or scan a path directly.",
+      exitCode: EXIT.USAGE
+    };
+  }
+  const paths = changedConfigPaths(deps.cwd, deps.getChangedFilesDiff);
+  if (paths.length === 0) {
+    return {
+      stdout: "No agent-tool configs changed in the git diff. Nothing to scan.",
+      exitCode: EXIT.OK
+    };
+  }
+  const results = paths.map((p) => {
+    const text = readFileSync5(p, "utf8");
+    return scanOneConfig(text, p, policy, args, deps);
+  });
+  const exitCode = results.reduce((worst, r) => Math.max(worst, r.exitCode), EXIT.OK);
   let stdout;
-  if (flagBool(args.flags, "json")) stdout = renderJson(summary);
-  else if (flagBool(args.flags, "sarif")) stdout = renderSarif(summary);
-  else if (flagBool(args.flags, "html")) stdout = renderHtml(summary);
-  else if (flagBool(args.flags, "compact")) stdout = renderCompact(summary, style);
-  else stdout = renderTerminal(summary, style);
+  if (flagBool(args.flags, "json")) {
+    stdout = "[" + results.map((r) => r.stdout).join(",\n") + "]";
+  } else {
+    stdout = results.map((r) => r.stdout).join("\n\n---\n\n");
+  }
+  const stderr = results.map((r) => r.stderr).filter(Boolean).join("\n");
+  return { stdout, exitCode, ...stderr ? { stderr } : {} };
+}
+
+// src/commands/diagnostics.ts
+function diagnosticsCommand(args, deps) {
+  if (!flagBool(args.flags, "json")) {
+    return {
+      stdout: "",
+      stderr: "diagnostics v0 emits JSON only \u2014 pass --json (calllint.diagnostics.v0).",
+      exitCode: EXIT.USAGE
+    };
+  }
+  let policy;
+  try {
+    policy = loadPolicyOrDefault(flagStr(args.flags, "policy"));
+  } catch (err) {
+    return {
+      stdout: "",
+      stderr: err instanceof Error ? err.message : String(err),
+      exitCode: EXIT.ERROR
+    };
+  }
+  const input = deps.online?.inputOverride ?? resolveConfigInput(args, deps);
+  if (isInputError(input)) {
+    return { stdout: "", stderr: input.error, exitCode: input.exitCode };
+  }
+  const { text, configPath } = input;
+  let summary;
+  try {
+    summary = scanConfigText(text, configPath, {
+      policy,
+      now: deps.now,
+      generatedAt: deps.generatedAt,
+      extraFindings: deps.online?.extraFindings
+    });
+  } catch (err) {
+    if (err instanceof ConfigParseError) {
+      return {
+        stdout: "",
+        stderr: `Parse error in ${configPath}: ${err.message}`,
+        exitCode: EXIT.ERROR
+      };
+    }
+    throw err;
+  }
+  const stdout = renderDiagnostics(summary);
   const exitCode = flagBool(args.flags, "ci") ? exitCodeFor(summary, policy) : EXIT.OK;
   return { stdout, exitCode };
 }
 
 // src/commands/explain.ts
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 function explainCommand(args, deps) {
   const serverName = args.positionals[0];
   if (!serverName) {
@@ -2130,7 +2878,7 @@ function explainCommand(args, deps) {
       exitCode: EXIT.USAGE
     };
   }
-  const summary = readCache(join4(deps.cwd, ".calllint", "last-scan.json"));
+  const summary = readCache(join5(deps.cwd, ".calllint", "last-scan.json"));
   if (!summary) {
     return {
       stdout: "",
@@ -2152,13 +2900,13 @@ function explainCommand(args, deps) {
 }
 
 // src/commands/policy.ts
-import { existsSync as existsSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join5 } from "node:path";
+import { existsSync as existsSync5, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join6 } from "node:path";
 function policyCommand(args, deps) {
   const sub = args.positionals[0];
   if (sub === "init") {
-    const path = join5(deps.cwd, "calllint.policy.json");
-    if (existsSync3(path) && !flagBool(args.flags, "force")) {
+    const path = join6(deps.cwd, "calllint.policy.json");
+    if (existsSync5(path) && !flagBool(args.flags, "force")) {
       return {
         stdout: "",
         stderr: `${path} already exists. Use --force to overwrite.`,
@@ -2188,7 +2936,7 @@ function policyCommand(args, deps) {
 }
 
 // src/commands/verify.ts
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 function loadPolicy(args) {
   try {
     return loadPolicyOrDefault(flagStr(args.flags, "policy"));
@@ -2197,7 +2945,7 @@ function loadPolicy(args) {
   }
 }
 function baselinePathFor(args, cwd) {
-  return flagStr(args.flags, "baseline") ?? join6(cwd, ".calllint", "baseline.json");
+  return flagStr(args.flags, "baseline") ?? join7(cwd, ".calllint", "baseline.json");
 }
 function baselineCommand(args, deps) {
   const policy = loadPolicy(args);
@@ -2283,6 +3031,15 @@ function run(argv, deps) {
         now: deps.now,
         generatedAt: deps.generatedAt,
         writeCacheFile: deps.writeCacheFile,
+        online: deps.online,
+        getChangedFilesDiff: deps.getChangedFilesDiff
+      });
+    case "diagnostics":
+      return diagnosticsCommand(args, {
+        cwd: deps.cwd,
+        readStdin: deps.readStdin,
+        now: deps.now,
+        generatedAt: deps.generatedAt,
         online: deps.online
       });
     case "baseline":
@@ -2519,6 +3276,7 @@ function shouldBreathe(argv, deps = {}) {
   const { flags } = parseArgs(argv);
   if (flagBool(flags, "json")) return false;
   if (flagBool(flags, "sarif")) return false;
+  if (flagBool(flags, "markdown")) return false;
   if (flagBool(flags, "html")) return false;
   if (flagBool(flags, "compact")) return false;
   if (flagBool(flags, "no-color")) return false;
@@ -2548,7 +3306,18 @@ async function breathe(argv, deps = {}) {
 // src/index.ts
 function readStdin() {
   try {
-    return readFileSync4(0, "utf8");
+    return readFileSync6(0, "utf8");
+  } catch {
+    return "";
+  }
+}
+function gitChangedFiles(cwd) {
+  try {
+    return execFileSync("git", ["diff", "--name-only", "HEAD"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
   } catch {
     return "";
   }
@@ -2585,7 +3354,8 @@ async function main() {
     readStdin,
     now,
     generatedAt,
-    online
+    online,
+    getChangedFilesDiff: () => gitChangedFiles(process.cwd())
   });
   if (result.stdout) process.stdout.write(result.stdout + "\n");
   if (result.stderr) process.stderr.write(result.stderr + "\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "calllint",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Evidence-backed security verdicts for MCP servers and agent tools. Lint agent tool-call risk before tools run — SAFE / REVIEW / BLOCK / UNKNOWN, with evidence. Never executes the server it judges.",
   "keywords": [
     "mcp",