project-athena 0.2.1 → 0.4.0

package/dist/chunk-ELKFRTZT.js

@@ -0,0 +1,221 @@
+#!/usr/bin/env node
+import {
+  DEFAULT_IGNORES
+} from "./chunk-2DY4PUR4.js";
+import {
+  toPosix
+} from "./chunk-XW3MLHI2.js";
+
+// src/core/fs/ignore.ts
+import { promises as fs } from "fs";
+import path from "path";
+import ignoreFactory from "ignore";
+var IgnoreMatcher = class _IgnoreMatcher {
+  base;
+  include;
+  /** Directory (repo-relative POSIX, "" for root) → rules from its .gitignore. */
+  scoped = /* @__PURE__ */ new Map();
+  constructor(config) {
+    this.base = ignoreFactory().add(DEFAULT_IGNORES.map((d) => `${d}/`)).add(config.ignore);
+    this.include = config.include.length ? ignoreFactory().add(config.include) : null;
+  }
+  static async load(root, config) {
+    const m = new _IgnoreMatcher(config);
+    const exclude = await fs.readFile(path.join(root, ".git", "info", "exclude"), "utf8").catch(() => null);
+    if (exclude) m.setGitignore("", exclude);
+    const rootGi = await fs.readFile(path.join(root, ".gitignore"), "utf8").catch(() => null);
+    if (rootGi) m.setGitignore("", rootGi, true);
+    return m;
+  }
+  /** Register (or replace) the rules of `<dir>/.gitignore`. `append` merges with existing rules for that dir. */
+  setGitignore(dir, content, append = false) {
+    const existing = append ? this.scoped.get(dir) : void 0;
+    this.scoped.set(dir, (existing ?? ignoreFactory()).add(content));
+  }
+  removeGitignore(dir) {
+    this.scoped.delete(dir);
+  }
+  /** Is the repo-relative POSIX path ignored? `isDir` enables directory-only patterns ("build/"). */
+  ignores(rel, isDir = false) {
+    if (!rel || rel === ".") return false;
+    const test = isDir ? `${rel}/` : rel;
+    if (this.include?.ignores(test)) return false;
+    if (this.base.ignores(test)) return true;
+    if (!this.scoped.size) return false;
+    const rootRules = this.scoped.get("");
+    if (rootRules?.ignores(test)) return true;
+    for (let i = rel.indexOf("/"); i > 0; i = rel.indexOf("/", i + 1)) {
+      const ig = this.scoped.get(rel.slice(0, i));
+      if (!ig) continue;
+      const sub = rel.slice(i + 1);
+      if (ig.ignores(isDir ? `${sub}/` : sub)) return true;
+    }
+    return false;
+  }
+};
+
+// src/core/fs/walker.ts
+import { promises as fs2, statSync } from "fs";
+import path2 from "path";
+import crypto from "crypto";
+var SNIFF_BYTES = 8e3;
+function sniffBinary(buf) {
+  return buf.subarray(0, SNIFF_BYTES).includes(0);
+}
+async function walkProject(root, opts) {
+  const rootReal = await fs2.realpath(root);
+  const matcher = opts.matcher ?? await IgnoreMatcher.load(rootReal, opts.config);
+  const result = { files: [], skippedBinary: 0, skippedLarge: 0, skippedUnreadable: 0, truncated: false, warnings: [], symlinks: 0 };
+  const visitedDirs = /* @__PURE__ */ new Set([rootReal]);
+  const pending = [];
+  const isIgnored = (rel, isDir) => matcher.ignores(rel, isDir);
+  const stack = [rootReal];
+  while (stack.length) {
+    opts.signal?.throwIfAborted();
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = await fs2.readdir(dir, { withFileTypes: true });
+    } catch (err) {
+      result.skippedUnreadable++;
+      result.warnings.push(`Cannot read directory ${toPosix(path2.relative(rootReal, dir)) || "."}: ${err.code ?? "error"}`);
+      continue;
+    }
+    entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    const dirRel = toPosix(path2.relative(rootReal, dir));
+    if (dirRel && entries.some((e) => e.name === ".gitignore" && e.isFile())) {
+      const gi = await fs2.readFile(path2.join(dir, ".gitignore"), "utf8").catch(() => null);
+      if (gi !== null) matcher.setGitignore(dirRel, gi);
+    }
+    for (const ent of entries) {
+      const abs = path2.join(dir, ent.name);
+      const rel = dirRel ? `${dirRel}/${ent.name}` : toPosix(ent.name);
+      let isDir = ent.isDirectory();
+      let isFile = ent.isFile();
+      if (ent.isSymbolicLink()) {
+        try {
+          const target = await fs2.realpath(abs);
+          const relTarget = path2.relative(rootReal, target);
+          if (relTarget.startsWith("..") || path2.isAbsolute(relTarget)) continue;
+          const st = await fs2.stat(target);
+          isDir = st.isDirectory();
+          isFile = st.isFile();
+          if (isDir) {
+            if (visitedDirs.has(target)) continue;
+          }
+          result.symlinks++;
+        } catch {
+          continue;
+        }
+      }
+      if (isDir) {
+        if (isIgnored(rel, true)) continue;
+        const real = await fs2.realpath(abs).catch(() => abs);
+        if (visitedDirs.has(real)) continue;
+        visitedDirs.add(real);
+        stack.push(abs);
+      } else if (isFile) {
+        if (isIgnored(rel, false)) continue;
+        if (result.files.length + pending.length >= opts.config.maxFiles) {
+          result.truncated = true;
+          break;
+        }
+        pending.push(rel);
+      }
+    }
+    if (result.truncated) break;
+    if (pending.length >= 256) await flush();
+  }
+  await flush();
+  if (result.truncated) {
+    result.warnings.push(`File limit reached (${opts.config.maxFiles}); analysis is partial. Raise maxFiles in .athena/config.json or add ignores.`);
+  }
+  result.files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  return result;
+  async function flush() {
+    const batch = pending.splice(0, pending.length);
+    await mapLimit(batch, 32, async (rel) => {
+      opts.signal?.throwIfAborted();
+      const entry = await statEntry(rootReal, rel, opts.config.maxFileBytes, opts.reuse?.[rel], opts.deferRead);
+      if (!entry) {
+        result.skippedUnreadable++;
+        return;
+      }
+      if (entry.binary) result.skippedBinary++;
+      if (entry.large) result.skippedLarge++;
+      result.files.push(entry);
+    });
+    opts.onProgress?.(result.files.length);
+  }
+}
+async function statEntry(root, rel, maxBytes, prev, deferRead) {
+  const abs = path2.join(root, rel);
+  try {
+    const st = deferRead ? statSync(abs) : await fs2.stat(abs);
+    if (prev && prev.s === st.size && prev.m === Math.floor(st.mtimeMs) && prev.h.startsWith("meta:") === st.size > maxBytes) {
+      return { path: rel, size: st.size, mtimeMs: prev.m, hash: prev.h, binary: prev.b === 1, large: prev.h.startsWith("meta:") };
+    }
+    if (st.size > maxBytes) {
+      return { path: rel, size: st.size, mtimeMs: Math.floor(st.mtimeMs), hash: `meta:${st.size}:${Math.floor(st.mtimeMs)}`, binary: false, large: true };
+    }
+    if (deferRead) return { path: rel, size: st.size, mtimeMs: Math.floor(st.mtimeMs), hash: "", binary: false, large: false };
+    const buf = await fs2.readFile(abs);
+    const binary = sniffBinary(buf);
+    return {
+      path: rel,
+      size: st.size,
+      mtimeMs: Math.floor(st.mtimeMs),
+      hash: crypto.createHash("sha256").update(buf).digest("hex"),
+      binary,
+      large: false
+    };
+  } catch {
+    return null;
+  }
+}
+async function mapLimit(items, limit, fn) {
+  const out = new Array(items.length);
+  let i = 0;
+  const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
+    while (i < items.length) {
+      const idx = i++;
+      out[idx] = await fn(items[idx]);
+    }
+  });
+  await Promise.all(workers);
+  return out;
+}
+
+// src/core/analyzer/config-hash.ts
+import crypto2 from "crypto";
+function factsConfigHash(config) {
+  return crypto2.createHash("sha256").update(JSON.stringify({ ignore: config.ignore, include: config.include, maxFileBytes: config.maxFileBytes })).digest("hex").slice(0, 16);
+}
+
+// src/core/patterns.ts
+var TEST_FILE = /(^|\/)(__tests__|tests?|spec|specs|e2e|integration_tests|androidTest|test_driver)\/|\.(test|spec|e2e)\.[cm]?[jt]sx?$|(^|\/)test_[^/]+\.py$|_test\.(py|go|exs)$|_spec\.rb$|Tests?\.(java|kt|cs)$|_test\.dart$/;
+var TEST_RUNNER_CONFIG = /(^|\/)(jest|vitest|playwright|cypress)\.config\./;
+var SOURCE_FILE = /\.(m|c)?(t|j)sx?$|\.(py|go|rs|java|kt|cs|php|rb|dart|ex|swift|vue|svelte)$/;
+var AUTH_PATH = /(auth|session|login|oauth|jwt|guard|permission|rbac|acl|polic(y|ies)|middleware)/i;
+var API_ROUTE_PATH = /(^|\/)(routes?|controllers?|handlers?|api|endpoints?|resolvers?)\/|(^|\/)(urls\.py|routes\.rb)$|(^|\/)app\/(.+\/)?route\.(t|j)sx?$/i;
+var API_SURFACE_PATH = /(^|\/)(routes?|controllers?|handlers?|api|endpoints?|views|resolvers?)\/|(^|\/)(urls\.py|routes\.rb)$|(^|\/)app\/(.+\/)?route\.(t|j)sx?$|\.(graphql|gql|proto)$|(openapi|swagger)[^/]*\.(json|ya?ml)$/i;
+var SCHEMA_PATH = /\.prisma$|\.sql$|(^|\/)(migrations?|migrate|alembic)\/|(^|\/)models(\.py|\/)/i;
+var SCHEMA_RELATED_PATH = /\.prisma$|\.sql$|(^|\/)(migrations?|migrate|alembic|changelog)\/|(^|\/)models(\.py|\/)|(^|\/)(schema|entities|entity)\b/i;
+
+export {
+  IgnoreMatcher,
+  sniffBinary,
+  walkProject,
+  statEntry,
+  mapLimit,
+  factsConfigHash,
+  TEST_FILE,
+  TEST_RUNNER_CONFIG,
+  SOURCE_FILE,
+  AUTH_PATH,
+  API_ROUTE_PATH,
+  API_SURFACE_PATH,
+  SCHEMA_PATH,
+  SCHEMA_RELATED_PATH
+};
+//# sourceMappingURL=chunk-ELKFRTZT.js.map

package/dist/chunk-EUPETUWA.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+
+// src/core/paths.ts
+import path from "path";
+var ATHENA_DIR = ".athena";
+function athenaDir(root) {
+  return path.join(root, ATHENA_DIR);
+}
+
+export {
+  ATHENA_DIR,
+  athenaDir
+};
+//# sourceMappingURL=chunk-EUPETUWA.js.map

package/dist/chunk-FQEGEVLY.js

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+
+// src/core/knowledge/documents.ts
+var KNOWLEDGE_DOCS = [
+  { id: "project", file: "project.md", title: "Project", purpose: "What this project is, its technologies, structure, entry points, commands and development workflow." },
+  { id: "architecture", file: "architecture.md", title: "Architecture", purpose: "System and module architecture, service relationships, data flow and external services." },
+  { id: "database", file: "database.md", title: "Database", purpose: "Database technologies, schemas, entities, relationships, indexes and migrations." },
+  { id: "api", file: "api.md", title: "API", purpose: "API style, endpoints, specifications, and authentication/error-handling expectations." },
+  { id: "auth", file: "auth.md", title: "Authentication & Authorization", purpose: "Authentication mechanisms, sessions/tokens, roles and permissions, and security assumptions." },
+  { id: "security", file: "security.md", title: "Security", purpose: "Attack surface, security controls, secret handling, tooling, and known/potential issues." },
+  { id: "testing", file: "testing.md", title: "Testing", purpose: "Test frameworks, commands, layout, coverage configuration and detectable gaps." },
+  { id: "debugging", file: "debugging.md", title: "Debugging", purpose: "Known bugs, common errors, debugging commands, logs and troubleshooting procedures." },
+  { id: "performance", file: "performance.md", title: "Performance", purpose: "Performance-sensitive areas, caching, queues, background jobs and performance rules." },
+  { id: "code-review", file: "code-review.md", title: "Code Review", purpose: "Project-specific review checklist covering architecture, security, testing and performance." },
+  { id: "deployment", file: "deployment.md", title: "Deployment", purpose: "Deployment architecture, environments, containers, CI/CD, hosting and environment variables." },
+  { id: "rules", file: "rules.md", title: "Project Rules", purpose: "Developer-defined rules that AI agents must follow. Owned by the developer." }
+];
+var DOC_FILES = new Set(KNOWLEDGE_DOCS.map((d) => d.file));
+var RELEVANCE_MAP = [
+  { task: "Database / schema / migrations / queries", docs: ["database", "architecture", "api", "security", "testing", "rules"] },
+  { task: "API endpoints / controllers / request handling", docs: ["api", "auth", "security", "architecture", "testing", "rules"] },
+  { task: "Authentication / authorization / sessions / permissions", docs: ["auth", "security", "api", "database", "testing", "rules"] },
+  { task: "Frontend UI / styling / components", docs: ["project", "architecture", "rules"] },
+  { task: "New feature spanning multiple layers", docs: ["project", "architecture", "database", "api", "auth", "security", "testing", "rules"] },
+  { task: "Bug fix / debugging", docs: ["debugging", "architecture", "testing", "rules"] },
+  { task: "Performance work / caching / background jobs", docs: ["performance", "architecture", "database", "rules"] },
+  { task: "Tests", docs: ["testing", "project", "rules"] },
+  { task: "Build / CI / Docker / deployment / infrastructure", docs: ["deployment", "project", "security", "rules"] },
+  { task: "Dependency changes", docs: ["project", "security", "rules"] },
+  { task: "Code review", docs: ["code-review", "rules", "security", "testing"] },
+  { task: "Small, local change (typo, rename, copy)", docs: ["rules"] }
+];
+
+export {
+  KNOWLEDGE_DOCS,
+  RELEVANCE_MAP
+};
+//# sourceMappingURL=chunk-FQEGEVLY.js.map

package/dist/chunk-FVCDMQUQ.js

@@ -0,0 +1,343 @@
+#!/usr/bin/env node
+import {
+  listRules,
+  parseRules
+} from "./chunk-3IS2X2Z7.js";
+import {
+  loadScan,
+  manifestDependencyNames
+} from "./chunk-MPG3IEGB.js";
+import {
+  API_ROUTE_PATH,
+  AUTH_PATH,
+  SCHEMA_PATH,
+  SOURCE_FILE,
+  TEST_FILE
+} from "./chunk-ELKFRTZT.js";
+import {
+  GitCommandError,
+  git,
+  gitOrThrow,
+  isSafeRef,
+  parseNameStatusZ,
+  workingChanges
+} from "./chunk-OLPSEQS5.js";
+import {
+  scanText
+} from "./chunk-JCGDR4UV.js";
+import {
+  athenaDir
+} from "./chunk-2DY4PUR4.js";
+import {
+  readTextIfExists,
+  readTextInsideRoot
+} from "./chunk-IQQBAWSM.js";
+import {
+  AthenaError,
+  EXIT
+} from "./chunk-AD4OZCU2.js";
+
+// src/services/review.ts
+import { promises as fs } from "fs";
+import path from "path";
+var ENV_FILE = /(^|\/)\.env(\.(local|production|development|prod|dev|staging))?$/;
+var MANIFEST_FILE = /(^|\/)(package\.json|pyproject\.toml|requirements[^/]*\.txt|go\.mod|Cargo\.toml|composer\.json|Gemfile|pubspec\.yaml|pom\.xml|build\.gradle(\.kts)?)$/;
+var LARGE_ADDED_BYTES = 512 * 1024;
+var MAX_DIFF_BYTES = 64 * 1024 * 1024;
+var REVIEW_GIT_TIMEOUT_MS = 12e4;
+var FETCH_HINT = "Make sure the base commit and the history back to the merge base are present. In GitHub Actions use `actions/checkout` with `fetch-depth: 0`; elsewhere run `git fetch --unshallow` or fetch the base branch.";
+function unquoteGitPath(p) {
+  if (!p.startsWith('"') || !p.endsWith('"')) return p;
+  const bytes = [];
+  const body = p.slice(1, -1);
+  const esc = { a: 7, b: 8, t: 9, n: 10, v: 11, f: 12, r: 13, '"': 34, "\\": 92 };
+  for (let i = 0; i < body.length; i++) {
+    const ch = body[i];
+    if (ch !== "\\") {
+      bytes.push(...Buffer.from(ch, "utf8"));
+      continue;
+    }
+    const next = body[i + 1] ?? "";
+    if (/[0-7]/.test(next)) {
+      bytes.push(parseInt(body.slice(i + 1, i + 4), 8));
+      i += 3;
+    } else {
+      bytes.push(esc[next] ?? next.charCodeAt(0));
+      i += 1;
+    }
+  }
+  return Buffer.from(bytes).toString("utf8");
+}
+function addedLines(patch) {
+  const out = [];
+  let file = "";
+  let lineNo = 0;
+  let oldLeft = 0;
+  let newLeft = 0;
+  for (const raw of patch.split("\n")) {
+    if (oldLeft > 0 || newLeft > 0) {
+      const c = raw[0];
+      if (c === "+") {
+        out.push({ file, line: lineNo++, text: raw.slice(1) });
+        newLeft--;
+        continue;
+      }
+      if (c === "-") {
+        oldLeft--;
+        continue;
+      }
+      if (c === " ") {
+        lineNo++;
+        oldLeft--;
+        newLeft--;
+        continue;
+      }
+      if (c === "\\") continue;
+      oldLeft = newLeft = 0;
+    } else if (raw.startsWith("\\")) continue;
+    if (raw.startsWith("diff --git ")) {
+      file = "";
+      continue;
+    }
+    if (raw.startsWith("+++ ")) {
+      const p = unquoteGitPath(raw.slice(4).replace(/\t$/, ""));
+      file = p === "/dev/null" ? "" : p.startsWith("b/") ? p.slice(2) : p;
+      continue;
+    }
+    const h = /^@@ -\d+(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/.exec(raw);
+    if (h) {
+      oldLeft = h[1] === void 0 ? 1 : Number(h[1]);
+      lineNo = Number(h[2]);
+      newLeft = h[3] === void 0 ? 1 : Number(h[3]);
+    }
+  }
+  return out;
+}
+function scanAddedLines(lines) {
+  const hits = [];
+  let block = [];
+  const flush = () => {
+    if (!block.length) return;
+    const b = block;
+    block = [];
+    for (const m of scanText(b.map((l) => l.text).join("\n"))) {
+      const at = b[m.line - 1] ?? b[0];
+      hits.push({ type: m.type, file: at.file, line: at.line });
+    }
+  };
+  for (const l of lines) {
+    const prev = block[block.length - 1];
+    if (prev && (prev.file !== l.file || prev.line + 1 !== l.line)) flush();
+    block.push(l);
+  }
+  flush();
+  return hits;
+}
+var DIFF_FLAGS = ["--no-color", "--no-ext-diff", "--no-textconv", "--relative", "--src-prefix=a/", "--dst-prefix=b/", "-M"];
+async function reviewChanges(root, opts = {}) {
+  try {
+    return await review(root, opts);
+  } catch (err) {
+    if (err instanceof GitCommandError) {
+      throw new AthenaError(`Could not complete the review: ${err.message}`, "Athena did not check this change. Fix the Git problem above and run `athena review` again.", EXIT.NOT_AVAILABLE);
+    }
+    throw err;
+  }
+}
+async function review(root, opts) {
+  const signal = opts.signal;
+  signal?.throwIfAborted();
+  const repoCheck = await git(root, ["rev-parse", "--is-inside-work-tree"], { signal });
+  if (repoCheck.aborted) throw signal?.reason ?? new Error("Aborted");
+  const isRepo = repoCheck.stdout.trim() === "true";
+  if (!isRepo) throw new AthenaError("`athena review` needs a Git repository.", "Initialize Git, or review changes manually.");
+  if (opts.base !== void 0 && opts.staged) throw new AthenaError("`--staged` and `--base` cannot be combined.", "Use `--staged` before committing, or `--base <ref>` to review commits.");
+  if (opts.base !== void 0 && !isSafeRef(opts.base)) throw new AthenaError(`Invalid base ref: ${opts.base}`);
+  const runOpts = { signal, timeoutMs: REVIEW_GIT_TIMEOUT_MS };
+  const g = (args, extra = {}) => gitOrThrow(root, args, { ...runOpts, ...extra });
+  const mode = opts.base !== void 0 ? "base" : opts.staged ? "staged" : "working";
+  const base = opts.base ?? "HEAD";
+  const headCommit = await git(root, ["rev-parse", "--verify", "-q", "HEAD^{commit}"], runOpts);
+  if (headCommit.aborted) throw signal?.reason ?? new Error("Aborted");
+  let before;
+  let diffArgs;
+  let mergeBase;
+  if (mode === "base") {
+    if (!headCommit.ok) throw new AthenaError("Can't review: HEAD has no commits yet.", void 0, EXIT.NOT_AVAILABLE);
+    const baseCommit = await git(root, ["rev-parse", "--verify", "-q", `${opts.base}^{commit}`], runOpts);
+    if (baseCommit.aborted) throw signal?.reason ?? new Error("Aborted");
+    if (!baseCommit.ok || !baseCommit.stdout.trim()) {
+      throw new AthenaError(`Can't review against ${opts.base}: it is not a commit in this repository (insufficient Git history).`, FETCH_HINT, EXIT.NOT_AVAILABLE);
+    }
+    const mb = await git(root, ["merge-base", baseCommit.stdout.trim(), headCommit.stdout.trim()], runOpts);
+    if (mb.aborted) throw signal?.reason ?? new Error("Aborted");
+    if (!mb.ok || !mb.stdout.trim()) {
+      throw new AthenaError(`Can't review against ${opts.base}: no common ancestor with HEAD was found (the clone may be shallow).`, FETCH_HINT, EXIT.NOT_AVAILABLE);
+    }
+    mergeBase = mb.stdout.trim();
+    before = mergeBase;
+    diffArgs = [mergeBase, "HEAD"];
+  } else {
+    before = headCommit.ok ? headCommit.stdout.trim() : null;
+    const from = before ?? (await g(["hash-object", "-t", "tree", "--stdin"], { input: "" })).trim();
+    diffArgs = mode === "staged" ? ["--cached", from] : [from];
+  }
+  let changed;
+  if (mode === "working") {
+    const w = await workingChanges(root);
+    if (!w) throw new AthenaError("Could not complete the review: `git status` failed.", "Athena did not check this change.", EXIT.NOT_AVAILABLE);
+    changed = w;
+  } else {
+    changed = parseNameStatusZ(await g(["diff", "--name-status", "-z", ...DIFF_FLAGS, ...diffArgs, "--", "."]));
+  }
+  const changedFiles = changed.filter((f) => !f.path.startsWith(".athena/"));
+  const budget = opts.maxDiffBytes ?? MAX_DIFF_BYTES;
+  const diff = await git(root, ["-c", "core.quotePath=false", "diff", ...DIFF_FLAGS, ...diffArgs, "--", "."], { ...runOpts, maxBytes: budget });
+  if (diff.aborted) throw signal?.reason ?? new Error("Aborted");
+  if (diff.overflow) {
+    throw new AthenaError(`The diff is larger than ${Math.round(budget / (1024 * 1024))} MB, so Athena can't review all of it.`, "Athena did not check this change. Review a smaller range or split the change.", EXIT.NOT_AVAILABLE);
+  }
+  if (!diff.ok) throw new GitCommandError(["diff"], diff);
+  const added = addedLines(diff.stdout);
+  const skipped = [];
+  const large = [];
+  const untrackedText = /* @__PURE__ */ new Map();
+  let untrackedAdded = 0;
+  let untrackedBytes = diff.stdout.length;
+  for (const f of changedFiles.filter((x) => x.status === "untracked")) {
+    signal?.throwIfAborted();
+    if (untrackedBytes > budget) {
+      skipped.push({ path: f.path, reason: "budget" });
+      continue;
+    }
+    const r = await readTextInsideRoot(root, f.path, LARGE_ADDED_BYTES);
+    if (!r.ok) {
+      if (r.reason === "too-large") large.push(f.path);
+      if (r.reason !== "missing") skipped.push({ path: f.path, reason: r.reason });
+      continue;
+    }
+    untrackedBytes += r.bytes;
+    untrackedText.set(f.path, r.text);
+    const lines = r.text.split("\n");
+    if (lines.length > 1 && lines[lines.length - 1] === "") lines.pop();
+    lines.forEach((text, i) => added.push({ file: f.path, line: i + 1, text }));
+    untrackedAdded += lines.filter((l) => l.length > 0).length;
+  }
+  const numstat = await g(["diff", "--numstat", ...DIFF_FLAGS, ...diffArgs, "--", "."]);
+  let addedCount = 0;
+  let removedCount = 0;
+  for (const line of numstat.split("\n")) {
+    const [a, r] = line.split("	");
+    if (a && r && a !== "-") {
+      addedCount += Number(a) || 0;
+      removedCount += Number(r) || 0;
+    }
+  }
+  const readNew = async (p) => {
+    if (untrackedText.has(p)) return untrackedText.get(p);
+    if (mode === "working") {
+      const r2 = await readTextInsideRoot(root, p, LARGE_ADDED_BYTES);
+      return r2.ok ? r2.text : null;
+    }
+    const spec = `${mode === "staged" ? "" : "HEAD"}:./${p}`;
+    const r = await git(root, ["cat-file", "blob", spec], { ...runOpts, maxBytes: LARGE_ADDED_BYTES });
+    if (r.aborted) throw signal?.reason ?? new Error("Aborted");
+    if (r.overflow) return null;
+    if (!r.ok) throw new GitCommandError(["cat-file", "blob", spec], r);
+    return r.stdout;
+  };
+  const findings = [];
+  const paths = changedFiles.map((f) => f.path);
+  const add = (f) => findings.push(f);
+  const secretHits = /* @__PURE__ */ new Map();
+  for (const hit of scanAddedLines(added)) {
+    if (!secretHits.has(hit.type)) secretHits.set(hit.type, /* @__PURE__ */ new Set());
+    secretHits.get(hit.type).add(`${hit.file}:${hit.line}`);
+  }
+  for (const [type, locations] of secretHits) {
+    add({ level: "blocker", check: "secrets", message: `Possible ${type} added`, files: [...locations].slice(0, 10), hint: "Remove the value, use an environment variable, and rotate the credential if it was real." });
+  }
+  const envFiles = changedFiles.filter((f) => f.status !== "deleted" && ENV_FILE.test(f.path)).map((f) => f.path);
+  if (envFiles.length) add({ level: "blocker", check: "env-file", message: "Environment file included in the change", files: envFiles, hint: "Add it to .gitignore and commit a .env.example with names only." });
+  for (const f of changedFiles.filter((x) => x.status !== "deleted" && MANIFEST_FILE.test(x.path))) {
+    signal?.throwIfAborted();
+    const now = await readNew(f.path);
+    if (now === null) continue;
+    const nowDeps = await manifestDependencyNames(f.path, now);
+    if (!nowDeps) continue;
+    let beforeText = "";
+    const beforePath = f.status === "renamed" && f.from ? f.from : f.path;
+    if (before && f.status !== "added" && f.status !== "untracked") {
+      const spec = `${before}:./${beforePath}`;
+      const r = await git(root, ["cat-file", "blob", spec], { ...runOpts, maxBytes: 8 * 1024 * 1024 });
+      if (r.aborted) throw signal?.reason ?? new Error("Aborted");
+      if (r.ok) beforeText = r.stdout;
+      else if (f.status === "modified" || f.status === "renamed") throw new GitCommandError(["cat-file", "blob", spec], r);
+    }
+    const beforeDeps = await manifestDependencyNames(f.path, beforeText) ?? /* @__PURE__ */ new Set();
+    const newDeps = [...nowDeps].filter((d) => !beforeDeps.has(d));
+    if (newDeps.length) add({ level: "info", check: "dependencies", message: `New dependencies: ${newDeps.slice(0, 10).join(", ")}${newDeps.length > 10 ? ` +${newDeps.length - 10}` : ""}`, files: [f.path], hint: "Justify each addition; check licence, maintenance and size." });
+  }
+  const changedSource = paths.filter((p) => SOURCE_FILE.test(p) && !TEST_FILE.test(p));
+  const changedTests = paths.filter((p) => TEST_FILE.test(p));
+  if (changedSource.length && !changedTests.length) {
+    add({ level: "warning", check: "tests", message: `${changedSource.length} source file(s) changed with no test file changes`, files: changedSource.slice(0, 10), hint: "See `.athena/testing.md` for the project test commands and layout." });
+  }
+  const routeFiles = changedSource.filter((p) => API_ROUTE_PATH.test(p));
+  if (routeFiles.length) add({ level: "info", check: "api", message: "API surface changed", files: routeFiles.slice(0, 10), hint: "Check auth/authorization and error handling (`.athena/api.md`, `.athena/auth.md`)." });
+  const schemaFiles = paths.filter((p) => SCHEMA_PATH.test(p));
+  if (schemaFiles.length) add({ level: "info", check: "database", message: "Database schema or migrations changed", files: schemaFiles.slice(0, 10), hint: "Check indexes, constraints and backward compatibility (`.athena/database.md`)." });
+  const authFiles = changedSource.filter((p) => AUTH_PATH.test(p));
+  if (authFiles.length) add({ level: "warning", check: "auth", message: "Authentication/authorization code changed", files: authFiles.slice(0, 10), hint: "Review against `.athena/auth.md` and `.athena/security.md`." });
+  for (const f of changedFiles.filter((x) => x.status === "added")) {
+    signal?.throwIfAborted();
+    let size = null;
+    if (mode === "working") {
+      const st = await fs.lstat(path.join(root, f.path)).catch(() => null);
+      size = st?.isFile() ? st.size : null;
+    } else {
+      const r = await git(root, ["cat-file", "-s", `${mode === "staged" ? "" : "HEAD"}:./${f.path}`], runOpts);
+      if (r.ok) size = Number(r.stdout.trim());
+    }
+    if (size !== null && size > LARGE_ADDED_BYTES && !large.includes(f.path)) large.push(f.path);
+  }
+  if (large.length) add({ level: "warning", check: "large-files", message: "Large files added", files: large, hint: "Consider whether these belong in Git." });
+  const debugHits = added.filter((l) => /\b(TODO|FIXME|XXX|console\.log|debugger|print\(|binding\.pry|dd\()/.test(l.text) && SOURCE_FILE.test(l.file));
+  if (debugHits.length) {
+    add({ level: "info", check: "leftovers", message: `${debugHits.length} added line(s) contain TODO/FIXME or debug statements`, files: [...new Set(debugHits.map((l) => `${l.file}:${l.line}`))].slice(0, 10) });
+  }
+  const scan = await loadScan(root);
+  if (scan) {
+    const vulnerable = scan.tools.flatMap((t) => t.findings).filter((f) => ["critical", "high"].includes(f.severity));
+    if (vulnerable.length) add({ level: "warning", check: "vulnerabilities", message: `${vulnerable.length} high/critical dependency advisor${vulnerable.length === 1 ? "y" : "ies"} from the last scan (${scan.scannedAt.slice(0, 10)})`, files: [], hint: "Run `athena security` for details." });
+  }
+  let knowledgeInSync = null;
+  if (opts.checkSync) {
+    knowledgeInSync = await opts.checkSync(root).catch(() => null);
+    if (knowledgeInSync === false) add({ level: "info", check: "knowledge", message: "Athena knowledge is out of date for these changes", files: [], hint: "Run `athena sync` so agents read current context." });
+  }
+  const rulesText = await readTextIfExists(path.join(athenaDir(root), "rules.md"));
+  const rules = rulesText ? listRules(parseRules(rulesText)).filter((r) => r.enabled) : [];
+  const reviewDoc = await readTextIfExists(path.join(athenaDir(root), "code-review.md"));
+  const checklist = reviewDoc ? [...reviewDoc.matchAll(/^- \[ \] (.+)$/gm)].map((m) => m[1].trim()) : [];
+  if (skipped.length) {
+    add({ level: "warning", check: "skipped", message: `${skipped.length} changed file${skipped.length === 1 ? " was" : "s were"} not checked`, files: skipped.map((s) => `${s.path} (${SKIP_REASON[s.reason]})`).slice(0, 10), hint: "Athena could not read these files, so their contents were not checked for secrets. Check them yourself." });
+  }
+  return { base, mode, ...mergeBase ? { mergeBase } : {}, changedFiles, findings, rules, checklist, knowledgeInSync, stats: { added: addedCount + untrackedAdded, removed: removedCount, files: changedFiles.length }, incomplete: skipped.length > 0, skipped };
+}
+var SKIP_REASON = {
+  "outside-root": "symlink to a path outside the project",
+  "too-large": `larger than ${LARGE_ADDED_BYTES / 1024} KB`,
+  "not-a-file": "not a regular file",
+  unreadable: "could not be read",
+  budget: `over the ${MAX_DIFF_BYTES / (1024 * 1024)} MB review limit`
+};
+function hasBlockers(result) {
+  return result.findings.some((f) => f.level === "blocker");
+}
+
+export {
+  reviewChanges,
+  hasBlockers
+};
+//# sourceMappingURL=chunk-FVCDMQUQ.js.map