codehere 1.0.1 → 1.0.2

package/dist/infrastructure/orchestration/artifacts-extractor.js

@@ -1,199 +1,7 @@
 /**
- * ArtifactsExtractor — PM UX Layer 3 (principles #2 "info density", #7 "agent-provenance").
- *
- * When a task finishes, a product manager reports: what changed, was anything
- * risky, did tests pass. We derive that from ground truth:
- *   - git diff (working tree + untracked) vs the HEAD snapshot taken at spawn
- *   - trust score per changed file via the existing SAST scorer (F0)
- *   - test pass/fail counts parsed out of collected stdout (best-effort)
- *
- * Agent-agnostic on purpose. Both Claude and Codex mutate the filesystem;
- * git tells the truth regardless of which tool did the write.
- *
- * v0.6.x: dirty-baseline subtraction. Without it, files the user had
- * uncommitted at spawn time would falsely appear in artifacts even though
- * the agent never touched them — git diff vs spawn-HEAD includes EVERYTHING
- * dirty in the working tree, not just what changed during the session.
- * Now snapshotCwd captures `git status --porcelain` + per-file mtime/size at
- * spawn time. extractArtifacts filters out files whose stat is unchanged
- * since spawn — they were dirty before, not by this session. Files that were
- * dirty at spawn AND further modified during the session still appear.
- *
- * Limitation: cannot distinguish concurrent human writes from agent writes
- * during the session window. True PID-level attribution would require
- * fanotify/audit subsystem. The dirty-baseline filter eliminates the most
- * common false-positive (pre-existing uncommitted work) without that.
+ * Test summary parsing: "N passed", "M failed" and the runner-specific variants, out of collected stdout.
+ * Used by `codehere check` to read what a test run reported.
  */
-import { execFileSync } from 'child_process';
-import { existsSync, readFileSync, statSync } from 'fs';
-import { join, isAbsolute } from 'path';
-import { scoreFile } from '../security/trust-scorer.js';
-/** Capture mtime + size for a single path. Returns null if stat fails. */
-function statBaseline(fullPath) {
-    try {
-        const st = statSync(fullPath);
-        return { mtimeMs: st.mtimeMs, size: st.size };
-    }
-    catch {
-        return null;
-    }
-}
-/** Read `git status --porcelain` and stat every dirty path. Best-effort.
- *  Paths are git-relative (i.e. relative to repoRoot, not cwd). */
-function captureDirtyBaseline(cwd, repoRoot) {
-    const baseline = new Map();
-    try {
-        // -uall: porcelain normally collapses an untracked DIRECTORY into one
-        // "?? dir/" entry, while changedFiles() lists its contents per-file via
-        // ls-files --others — so the baseline could never match those paths and a
-        // whole pre-existing untracked dir got attributed to the agent (2026-06-07
-        // v1 walk: memory-init's .codehere/ scaffolding showed as 8 agent edits).
-        const out = execFileSync('git', ['status', '--porcelain', '-uall', '-z'], {
-            cwd,
-            encoding: 'utf-8',
-            timeout: 5000,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        });
-        // Porcelain -z separates entries by NUL. First two chars are status, then space, then path.
-        // Renames have an extra NUL-separated old path which we don't need here.
-        for (const entry of out.split('\0')) {
-            if (!entry)
-                continue;
-            // Strip the 2-char status prefix + 1 separator (3 chars total)
-            const path = entry.slice(3);
-            if (!path)
-                continue;
-            const full = isAbsolute(path) ? path : join(repoRoot, path);
-            const b = statBaseline(full);
-            if (b)
-                baseline.set(path, b);
-        }
-    }
-    catch {
-        /* best-effort — empty baseline means no filtering, status-quo behavior */
-    }
-    return baseline;
-}
-/** Get repo root via `git rev-parse --show-toplevel`. Returns null if not in a repo. */
-function getRepoRoot(cwd) {
-    try {
-        const out = execFileSync('git', ['rev-parse', '--show-toplevel'], {
-            cwd,
-            encoding: 'utf-8',
-            timeout: 2000,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        }).trim();
-        return out.length > 0 ? out : null;
-    }
-    catch {
-        return null;
-    }
-}
-/** Take a baseline so Layer 3 can diff against it on exit. Cheap; ~5ms. */
-export function snapshotCwd(cwd) {
-    const spawnedAtMs = Date.now();
-    try {
-        const out = execFileSync('git', ['rev-parse', 'HEAD'], {
-            cwd,
-            encoding: 'utf-8',
-            timeout: 2000,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        }).trim();
-        const isGitRepo = out.length > 0;
-        const repoRoot = isGitRepo ? (getRepoRoot(cwd) ?? cwd) : cwd;
-        return {
-            cwd,
-            head: out,
-            isGitRepo,
-            spawnedAtMs,
-            repoRoot,
-            dirtyBaseline: isGitRepo ? captureDirtyBaseline(cwd, repoRoot) : new Map(),
-        };
-    }
-    catch {
-        return {
-            cwd,
-            head: null,
-            isGitRepo: false,
-            spawnedAtMs,
-            repoRoot: cwd,
-            dirtyBaseline: new Map(),
-        };
-    }
-}
-/** Collect {path, +, -} from git diff (numstat) + untracked files (wc -l). */
-// codehere's own per-project state dir. Its contents (memory, protocols,
-// skills, context packs) are product plumbing, not the user's code — they
-// never belong in the room's "what the agent changed" list, even when the
-// memory write-back touches them mid-session.
-function isInternalPath(path) {
-    return path === '.codehere' || path.startsWith('.codehere/') || path.includes('/.codehere/');
-}
-function changedFiles(snap) {
-    if (!snap.isGitRepo)
-        return [];
-    const out = [];
-    try {
-        // Staged + unstaged vs HEAD at spawn
-        const diff = execFileSync('git', ['diff', '--numstat', snap.head ?? 'HEAD'], {
-            cwd: snap.cwd,
-            encoding: 'utf-8',
-            timeout: 5000,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        });
-        for (const line of diff.split('\n')) {
-            const m = line.match(/^(-|\d+)\t(-|\d+)\t(.+)$/);
-            if (!m)
-                continue;
-            const [, aStr, rStr, path] = m;
-            if (isInternalPath(path))
-                continue;
-            out.push({
-                path,
-                added: aStr === '-' ? 0 : parseInt(aStr, 10) || 0,
-                removed: rStr === '-' ? 0 : parseInt(rStr, 10) || 0,
-            });
-        }
-    }
-    catch {
-        /* diff failed — skip */
-    }
-    try {
-        // Untracked files — not in diff output
-        const untracked = execFileSync('git', ['ls-files', '--others', '--exclude-standard'], {
-            cwd: snap.cwd,
-            encoding: 'utf-8',
-            timeout: 5000,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        });
-        for (const rel of untracked.split('\n')) {
-            if (!rel.trim())
-                continue;
-            if (isInternalPath(rel))
-                continue;
-            // Count lines in the new file. Untracked paths come from git relative
-            // to repoRoot — must join with repoRoot, not cwd, when cwd is a subdir.
-            try {
-                const full = isAbsolute(rel) ? rel : join(snap.repoRoot, rel);
-                if (!existsSync(full))
-                    continue;
-                const size = statSync(full).size;
-                if (size > 2 * 1024 * 1024)
-                    continue; // skip files >2MB, don't need their trust score
-                const content = readFileSync(full, 'utf-8');
-                const lines = content ? content.split('\n').length : 0;
-                out.push({ path: rel, added: lines, removed: 0 });
-            }
-            catch {
-                /* skip */
-            }
-        }
-    }
-    catch {
-        /* ls-files failed — skip */
-    }
-    return out;
-}
 /** Parse "N passed", "M failed", "K tests" out of accumulated stdout. Best-effort.
  *  Vitest + jest output both have TWO pass/fail lines ("Test Files 11 passed" then
  *  "Tests  47 passed"). We want the second/last. Take the last match in the buffer,
@@ -255,133 +63,4 @@ export function parseTestSummary(stdout) {
         result.durationMs = Math.round(parseFloat(dur[1]) * 1000);
     return result;
 }
-/** Score each changed file with the existing SAST trust scorer. Safe on binaries (skipped). */
-function annotateTrust(snap, files) {
-    return files.map((f) => {
-        try {
-            // Git-relative path: join with repoRoot, not cwd (matters when cwd is
-            // a subdirectory of the repo).
-            const full = isAbsolute(f.path) ? f.path : join(snap.repoRoot, f.path);
-            if (!existsSync(full))
-                return f;
-            const size = statSync(full).size;
-            if (size > 2 * 1024 * 1024)
-                return f;
-            // Only score text-like files — trust scorer regexes operate on UTF-8
-            if (!/\.(ts|tsx|js|jsx|mjs|cjs|py|rb|go|rs|java|kt|cs|php|sh|bash|zsh|yml|yaml|json|md|sql)$/i.test(f.path))
-                return f;
-            const content = readFileSync(full, 'utf-8');
-            const scored = scoreFile(f.path, content);
-            return { ...f, trust: scored.score };
-        }
-        catch {
-            return f;
-        }
-    });
-}
-/**
- * Keep only files whose mtime is at or after spawn time — the signal that this
- * session touched them. Prevents Session B in the same cwd from reporting files
- * Session A already edited before B started. Not bulletproof (both sessions
- * hitting the same file both report it) but fixes the common concurrent-sessions
- * pollution observed in beta.3.
- */
-function filterByMtime(snap, files) {
-    const grace = 1000; // ms; allow clock skew between git's touch and our Date.now()
-    return files.filter((f) => {
-        try {
-            // Git-relative path: join with repoRoot, not cwd.
-            const full = isAbsolute(f.path) ? f.path : join(snap.repoRoot, f.path);
-            if (!existsSync(full))
-                return true; // file was deleted — keep it
-            const { mtimeMs } = statSync(full);
-            return mtimeMs >= snap.spawnedAtMs - grace;
-        }
-        catch {
-            return true; // stat failed — be permissive
-        }
-    });
-}
-/**
- * Drop files that were dirty at spawn time and have NOT been further modified
- * since. The git-diff-vs-spawn-HEAD path picks up the user's pre-existing
- * uncommitted changes; without this filter, those files get mis-attributed to
- * the agent's task. A file is considered "further modified" if its mtime OR
- * size changed since the spawn snapshot — content-level tampering with same
- * mtime/size is rare enough to ignore.
- */
-function filterBySpawnBaseline(snap, files) {
-    if (snap.dirtyBaseline.size === 0)
-        return files;
-    return files.filter((f) => {
-        const baseline = snap.dirtyBaseline.get(f.path);
-        if (!baseline)
-            return true; // wasn't dirty at spawn — definitely a session change
-        try {
-            // Git-relative path: join with repoRoot, not cwd.
-            const full = isAbsolute(f.path) ? f.path : join(snap.repoRoot, f.path);
-            if (!existsSync(full))
-                return true; // deleted during session — that's a change
-            const { mtimeMs, size } = statSync(full);
-            // Further-modified if either mtime advanced or size differs from baseline.
-            return mtimeMs > baseline.mtimeMs || size !== baseline.size;
-        }
-        catch {
-            return true; // stat failed — be permissive (don't drop files we can't verify)
-        }
-    });
-}
-/** The spawned tool's OWN housekeeping — never the task's work product. Live
- *  2026-07-02: aider wrote .aider* + a .gitignore line on a run that did
- *  nothing else, the audit confirmed those writes on disk, and a no-op run
- *  graded proven/green off its tool's litter. Chat histories, tool caches,
- *  and the .gitignore edits tools make to hide them don't count as work.
- *  .gitignore is dropped ONLY when every added line is tool litter — a task
- *  whose real job is editing .gitignore still counts. */
-const TOOL_HOUSEKEEPING = /(^|\/)\.(aider|claude|codehere|gemini|codex|opencode)[^/]*($|\/)/i;
-const LITTER_LINE = /^\s*($|#|\.?(aider|claude|codehere|gemini|codex|opencode))/i;
-function gitignoreOnlyLitter(snap, path) {
-    try {
-        const d = execFileSync('git', ['diff', snap.head ?? 'HEAD', '--', path], {
-            cwd: snap.cwd,
-            encoding: 'utf-8',
-            timeout: 3000,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        });
-        let added = d
-            .split('\n')
-            .filter((l) => l.startsWith('+') && !l.startsWith('+++'))
-            .map((l) => l.slice(1));
-        if (added.length === 0) {
-            // Untracked (brand-new) .gitignore: git diff HEAD shows nothing — the
-            // whole file is the addition.
-            added = readFileSync(join(snap.cwd, path), 'utf-8').split('\n');
-        }
-        const lines = added.filter((l) => l.trim().length > 0);
-        return lines.length > 0 && lines.every((l) => LITTER_LINE.test(l));
-    }
-    catch {
-        return false; // can't inspect — keep it counted (honest over-count beats hiding work)
-    }
-}
-function dropToolHousekeeping(snap, files) {
-    return files.filter((f) => {
-        if (TOOL_HOUSEKEEPING.test(f.path))
-            return false;
-        if (/(^|\/)\.gitignore$/.test(f.path))
-            return !gitignoreOnlyLitter(snap, f.path);
-        return true;
-    });
-}
-export function extractArtifacts(snap, collectedStdout) {
-    const raw = dropToolHousekeeping(snap, changedFiles(snap));
-    const sessionScoped = filterByMtime(snap, raw);
-    const agentLikely = filterBySpawnBaseline(snap, sessionScoped);
-    const files = annotateTrust(snap, agentLikely);
-    const tests = parseTestSummary(collectedStdout);
-    // Non-git cwd: files is empty because we can't diff, not because nothing
-    // changed. Flag it so the UI + Final Report say "can't track here" instead
-    // of silently implying "no files changed".
-    return { files, tests, ...(snap.isGitRepo ? {} : { noGitTracking: true }) };
-}
 //# sourceMappingURL=artifacts-extractor.js.map

package/dist/presentation/cli/commands/check-command.js

@@ -1,12 +1,63 @@
 /**
  * CLI: check — the simplest proof. codehere independently RE-RUNS your project's
  * tests and reports the real result, so you trust what the AI actually did, not
- * what it claimed. Zero setup, no daemon, no API. Exit 1 on failure (CI-usable).
+ * what it claimed. Zero setup, no daemon, no API. Exit codes for CI: 0 a verified pass, 1 a finding (tests
+ * failed, no test ran, a test weakened, a claimed test file missing), 2 nothing could be verified.
  */
 import { execFileSync } from 'node:child_process';
+import { statSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { colors, symbols } from '../../../ui.js';
 import { rerunTests } from '../../../application/use-cases/rerun-tests.js';
+import { scanTestWeakening, } from '../../../application/use-cases/detect-test-weakening.js';
+import { findMissingClaimedTests } from '../../../application/use-cases/check-claimed-tests.js';
+const WHY_TEXT = {
+    'trivial-assertion': 'assertion that checks nothing',
+    skipped: 'test skipped',
+    'commented-out': 'assertion commented out',
+    'unreachable-assertion': 'assertion after an early return',
+};
+// File names, diff lines and branch names come from whoever wrote the change, so they are treated as untrusted:
+// control characters (terminal escapes among them) are replaced, and in the markdown receipt the text sits inside
+// an inline code span, where no link, @mention or emphasis renders.
+// Control characters, plus direction overrides, zero-width, soft-hyphen, line-separator and tag characters that can
+// disguise a file name.
+const plain = (s) => s.replace(/[\u0000-\u001f\u007f-\u009f\u00ad\u061c\u180e\u200b-\u200f\u2028-\u202e\u2060-\u2069\ufeff\u{e0000}-\u{e007f}]|\u034f/gu, '?');
+const code = (s) => '`' + plain(s).replace(/`/g, "'") + '`';
+/** Characters a branch name usually has; anything else is not repeated in the reproduce command. */
+const SAFE_REF = /^[A-Za-z0-9._/@+-]+$/;
+const weakenedLines = (w) => w.map((f) => `${plain(f.file)}:${f.line} · ${WHY_TEXT[f.why]} · ${plain(f.text)}`);
+const weakenedMarkdown = (w) => w.map((f) => `${code(f.file)}:${f.line} · ${WHY_TEXT[f.why]} · ${code(f.text)}`);
+export const RECEIPT_MARKER = '<!-- codehere-receipt -->';
+/**
+ * One word per result, for CI. Green (`pass`) only when codehere re-ran the suite, it exited 0, no test
+ * was weakened, no named test file was missing and the weakened-test scan finished. Tampering is `fail` even if
+ * no suite could run; every other case where nothing was verified is `unverified`, never a pass.
+ */
+export function checkVerdict(r, weakened, missingClaimed, scanError) {
+    if (weakened.length || missingClaimed.length)
+        return 'fail';
+    if (r.kind === 'disabled')
+        return 'skipped';
+    if (r.kind === 'failed')
+        return 'fail';
+    if (scanError)
+        return 'unverified';
+    if (r.kind === 'passed' && r.ran && (r.exitCode ?? 1) === 0)
+        return 'pass';
+    return 'unverified';
+}
+/** The check command that gives the same verdict as this run: the options that changed it are repeated. */
+function reproduceCommand({ base, claim }) {
+    let cmd = 'codehere check';
+    if (base)
+        cmd += SAFE_REF.test(base) ? ` --base ${base}` : ' --base <the same base>';
+    if (claim) {
+        const inlineable = claim.length <= 160 && !/[`'\n\r]/.test(claim);
+        cmd += inlineable ? ` --claim '${plain(claim)}'` : ' --claim <the same summary>';
+    }
+    return cmd;
+}
 /** Short commit SHA of `cwd`'s repo, or null when it isn't a git checkout. */
 function gitShortSha(cwd) {
     try {
@@ -37,60 +88,164 @@ function gitShortSha(cwd) {
  * chain covers this commit, fold in its verified hash (audit-chain.ts) so the receipt
  * also carries a digest a third party can check against an append-only log.
  */
-function buildProofBlock(cwd, r) {
+function buildProofBlock(cwd, r, weakened = [], missingClaimed = [], repro = {}, scan = { findings: [] }) {
     const sha = gitShortSha(cwd);
     const when = new Date().toISOString().replace('T', ' ').slice(0, 16) + ' UTC';
     const at = sha ? `commit \`${sha}\`` : 'the working tree';
+    const weakenedNote = weakened.length
+        ? `> Tests changed in this diff, so a pass may check nothing: ${weakenedMarkdown(weakened).join(' · ')}\n`
+        : '';
+    const missingNote = missingClaimed.length
+        ? `> The AI named test files that are not in the repo: ${missingClaimed.map(code).join(' · ')}\n`
+        : '';
+    const scanNote = scan.error
+        ? `> Weakened-test scan could not run: ${scan.error}\n`
+        : scan.skipped
+            ? `> Weakened-test scan skipped: ${scan.skipped}\n`
+            : '';
+    // A finding is reported even when the suite could not run.
+    const notes = weakenedNote + missingNote + scanNote;
     if (!r.ran) {
-        return `> **codehere · verified outcome receipt** — no suite re-run (${r.skippedReason || 'none detected'}) · nothing verified · ${when}\n`;
+        if (r.kind === 'command-not-found') {
+            const fix = r.remedy ? ` · fix: \`${r.remedy}\`` : '';
+            return `> **codehere · verified outcome receipt** — couldn't run ${code(r.command || 'the tests')} (runner/deps not installed) · unverified${fix} · ${when}\n${notes}`;
+        }
+        return `> **codehere · verified outcome receipt** — no suite re-run (${code(r.skippedReason || 'none detected')}) · nothing verified · ${when}\n${notes}`;
     }
-    if (r.exitCode === 126 || r.exitCode === 127) {
-        return `> **codehere · verified outcome receipt** — couldn't run \`${r.command}\` on ${at} (runner not installed, exit ${r.exitCode}) · unverified · ${when}\n`;
+    if (r.kind === 'runner-missing') {
+        const fix = r.remedy ? ` · fix: \`${r.remedy}\`` : '';
+        return `> **codehere · verified outcome receipt** — couldn't run ${code(r.command ?? '')} on ${at} (runner not installed, exit ${r.exitCode}) · unverified${fix} · ${when}\n${notes}`;
     }
-    const passed = (r.exitCode ?? 1) === 0;
+    const passed = (r.exitCode ?? 1) === 0 && !r.noTests;
     const counts = typeof r.passed === 'number' || typeof r.failed === 'number'
         ? ` (${r.passed ?? '?'} passed · ${r.failed ?? 0} failed)`
         : '';
-    const verdict = passed ? '✓ tests pass' : '✕ tests FAIL';
+    const verdict = r.noTests
+        ? '✕ no tests ran'
+        : !passed
+            ? '✕ tests FAIL'
+            : weakened.length
+                ? `✕ tests pass · ${weakened.length} weakened`
+                : missingClaimed.length
+                    ? `✕ tests pass · ${missingClaimed.length} claimed test file not found`
+                    : scan.error
+                        ? '✕ tests pass · weakened-test scan could not run'
+                        : '✓ tests pass';
     // Reproduce line: the real, verifiable trust — anyone can re-run and confirm.
-    const reproduce = sha ? `> Reproduce independently: \`git checkout ${sha} && codehere check\`\n` : '';
+    const reproduce = sha ? `> Reproduce independently: \`git checkout ${sha} && ${reproduceCommand(repro)}\`\n` : '';
     return (`> **codehere · verified outcome receipt** · ${verdict}${counts}\n` +
-        `> codehere independently re-ran \`${r.command}\` on ${at} — exit ${r.exitCode}. Observed, not the AI's claim. · ${when}\n` +
+        `> codehere independently re-ran ${code(r.command ?? '')} on ${at} — exit ${r.exitCode}. Observed, not the AI's claim. · ${when}\n` +
+        notes +
         reproduce +
         `> Scope: the project's test suite — not a security or logic audit.\n`);
 }
 export async function executeCheckCommand(target, options = {}) {
     const cwd = resolve(target || '.');
+    let isFolder = false;
+    try {
+        isFolder = statSync(cwd).isDirectory();
+    }
+    catch {
+        /* missing path: handled below */
+    }
+    if (!isFolder)
+        throw new Error(`No such folder: ${target}`);
     const r = await rerunTests(cwd);
+    const scan = scanTestWeakening(cwd, options.base);
+    const weakened = scan.findings;
+    const missingClaimed = options.claim ? findMissingClaimedTests(cwd, options.claim) : [];
+    const verdict = checkVerdict(r, weakened, missingClaimed, scan.error);
+    const weakeningScan = scan.error ? `could not run: ${scan.error}` : scan.skipped ? `skipped: ${scan.skipped}` : 'ran';
+    const exitCode = verdict === 'pass' ? 0 : verdict === 'fail' ? 1 : 2;
+    const weakenedText = () => weakened.length
+        ? weakenedLines(weakened)
+            .map((l) => colors.dim(`  ${l}\n`))
+            .join('') + colors.dim(`  › ${options.base ? `git diff ${plain(options.base)}...HEAD` : 'git diff HEAD'}\n`)
+        : '';
+    const scanText = () => scan.error
+        ? colors.dim(`  weakened-test scan could not run: ${scan.error}\n`)
+        : scan.skipped
+            ? colors.dim(`  weakened-test scan skipped: ${scan.skipped}\n`)
+            : '';
+    const missingLines = () => missingClaimed.length
+        ? missingClaimed.map((f) => colors.dim(`  ${plain(f)} · named by the AI, not in the repo\n`)).join('')
+        : '';
     if (options.json) {
-        process.stdout.write(JSON.stringify({ cwd, ...r }, null, 2) + '\n');
-        return r.ran && (r.exitCode ?? 1) !== 0 ? 1 : 0;
+        const receipt = RECEIPT_MARKER +
+            '\n' +
+            buildProofBlock(cwd, r, weakened, missingClaimed, { base: options.base, claim: options.claim }, scan);
+        process.stdout.write(JSON.stringify({ cwd, ...r, weakened, missingClaimed, weakeningScan, verdict, receipt }, null, 2) + '\n');
+        return exitCode;
     }
     if (options.proof) {
-        process.stdout.write(buildProofBlock(cwd, r));
-        return r.ran && (r.exitCode ?? 1) !== 0 ? 1 : 0;
+        process.stdout.write(buildProofBlock(cwd, r, weakened, missingClaimed, { base: options.base, claim: options.claim }, scan));
+        return exitCode;
     }
     if (!r.ran) {
+        // The runner/deps aren't installed (e.g. `spawn pytest ENOENT`) — that's a
+        // fixable environment gap, not "no tests". Name the one command that fixes it.
+        if (r.kind === 'command-not-found') {
+            process.stdout.write('\n' +
+                colors.error(`${symbols.error} Couldn't run the tests`) +
+                colors.dim(`  — the runner for '${r.command || 'your tests'}' isn't installed here.\n`) +
+                (r.remedy
+                    ? colors.dim('  Fix it, then re-check:  ') + colors.success(`${r.remedy}\n\n`)
+                    : colors.dim('  Install the test runner, then run check again.\n\n')));
+            process.stdout.write(weakenedText() + missingLines() + scanText());
+            return exitCode; // couldn't verify (2); a weakened test or a missing named test file still counts (1)
+        }
+        if (r.kind === 'timed-out' || r.kind === 'disabled') {
+            process.stdout.write(colors.error(`${symbols.error} Nothing verified`) +
+                colors.dim(`  — ${r.kind === 'timed-out' ? `'${r.command}' ${r.skippedReason?.replace(/^test re-run /, '')}` : r.skippedReason}.\n`));
+            process.stdout.write(weakenedText() + missingLines() + scanText());
+            return exitCode;
+        }
         process.stdout.write(colors.dim(`No test suite codehere can run here — ${r.skippedReason || 'none detected'}.\n`) +
             colors.dim('codehere proves the AI by re-running your tests; add one (npm test / node --test / pytest / go test / cargo test) and run check again.\n'));
-        return 0; // nothing to verify is not a failure
+        process.stdout.write(weakenedText() + missingLines() + scanText());
+        return exitCode; // nothing was verified (2); a weakened test or a missing named test file still counts (1)
     }
-    // Honesty: exit 126/127 means the test command couldn't be RUN (binary missing /
-    // deps not installed), not that the tests failed. Never report "FAIL" for that.
-    if (r.exitCode === 126 || r.exitCode === 127) {
+    // Honesty: runner-missing (exit 126/127) means the test command couldn't be RUN
+    // (deps not installed), not that the tests failed. Never report "FAIL" for that —
+    // name the one command that makes it runnable.
+    if (r.kind === 'runner-missing') {
         process.stdout.write('\n' +
             colors.error(`${symbols.error} Couldn't run the tests`) +
-            colors.dim(`  — '${r.command}' exited ${r.exitCode} (the runner isn't installed; try installing deps, then re-run).\n\n`));
-        return 1; // non-zero for CI (unverified), but NOT a false "tests failed"
+            colors.dim(`  — '${r.command}' exited ${r.exitCode}: the deps/runner aren't installed here.\n`) +
+            (r.remedy
+                ? colors.dim('  Fix it, then re-check:  ') + colors.success(`${r.remedy}\n\n`)
+                : colors.dim('  Install deps, then run check again.\n\n')));
+        process.stdout.write(weakenedText() + missingLines() + scanText());
+        return exitCode; // non-zero for CI (unverified), but NOT a false "tests failed"
     }
-    const passed = (r.exitCode ?? 1) === 0;
+    const passed = (r.exitCode ?? 1) === 0 && !r.noTests;
     const counts = typeof r.passed === 'number' || typeof r.failed === 'number'
         ? `  ${r.passed ?? '?'} passed · ${r.failed ?? 0} failed`
         : '';
+    const headline = r.noTests
+        ? colors.error(`${symbols.error} No tests ran`)
+        : !passed
+            ? colors.error(`${symbols.error} Tests FAIL`)
+            : weakened.length
+                ? colors.error(`${symbols.error} Tests pass · ${weakened.length} weakened in this change`)
+                : missingClaimed.length
+                    ? colors.error(`${symbols.error} Tests pass · ${missingClaimed.length} claimed test file not found`)
+                    : scan.error
+                        ? colors.error(`${symbols.error} Tests pass · weakened-test scan could not run`)
+                        : colors.success(`${symbols.success} Tests pass`);
     process.stdout.write('\n' +
-        (passed ? colors.success(`${symbols.success} Tests pass`) : colors.error(`${symbols.error} Tests FAIL`)) +
+        headline +
         colors.dim(`  — codehere re-ran them itself (${r.command}, exit ${r.exitCode})${counts}\n`) +
-        colors.dim("This is observed reality, not the agent's claim.\n\n"));
-    return passed ? 0 : 1;
+        colors.dim("This is observed reality, not the agent's claim.\n") +
+        (r.noTests
+            ? colors.dim(r.allSkipped
+                ? '  The runner says every test was skipped, so nothing was tested.\n'
+                : '  The runner reported 0 tests, so nothing was tested. Check the test file names.\n')
+            : '') +
+        weakenedText() +
+        missingLines() +
+        scanText() +
+        '\n');
+    return exitCode;
 }
 //# sourceMappingURL=check-command.js.map