Audit your git history for AI coding agent infractions and panic loops

agent-roast scans recorded git diffs for shortcuts taken by AI coding assistants (Claude Code, Cursor, Codex, Antigravity, Aider). It checks for skipped tests, fake tautological assertions, abandoned stubs, compiler type escapes (as any), swallowed errors, and panic revert loops, then outputs a discipline score and line proofs. 100% offline, zero API keys, zero telemetry.

# Initialize in your repository (creates .agentroastrc.json)
npx agent-roast init
npx agent-roast init --ci      # generate .github/workflows/agent-roast.yml
npx agent-roast init --hook    # install .git/hooks/pre-commit

# Audit repository history
npx agent-roast            # scan AI-attributed commits (last 90 days)
npx agent-roast --all      # scan entire repository history
npx agent-roast --verbose  # show commit SHAs and line proofs
npx agent-roast --fail-under 70 # exit code 1 if score is below 70

# Audit pull request diffs (CI gate)
npx agent-roast --base origin/main --head HEAD
npx agent-roast --base origin/main --head HEAD --fail-on test-skip,trivial-assert,stub-abandonment --format github

What a report looks like (a real repository audit, trimmed):

agent-roast — git discipline audit (304 AI commits in Soup)

SCORE: 55 / 100 · The Panic Looper
  Prone to rapid-fire fix and revert thrashing cycles when wrestling stubborn bugs.

INFRACTIONS DETECTED (42)

  ● panic-loop (15) — consecutive quick fixes < 15m apart
      latest: 3df29a1 -> a910f21 (3m apart)

  ● type-escape (19) — compiler type bypasses in added lines
      e.g. src/client.ts:42 — response.body as any

  ● test-skip (6) — disabled or skipped test suites
      e.g. tests/test_outbound.py:18 — pytest.skip(...)

  ● trivial-assert (2) — tautological assertions faking test coverage
      e.g. tests/auth.test.ts:31 — expect(true).toBe(true)

  ● stub-abandonment (1) — incomplete stubs left behind
      e.g. src/payment.ts:18 — throw new Error("Not implemented")

  ● swallowed-error (2) — empty catch blocks or except: pass

Configure custom ignore paths, rule severities, and CI thresholds with a .agentroastrc.json file in your repository root:

{
  "$schema": "https://raw.githubusercontent.com/sidzuya/agent-roast/main/schema.json",
  "ignorePaths": [
    "**/*.min.js",
    "**/vendor/**",
    "**/dist/**",
    "**/fixtures/**"
  ],
  "rules": {
    "hallucinated-package": "error",
    "empty-catch": "warn",
    "trivial-assert": "warn",
    "stub-abandonment": "warn",
    "mock-leak": "warn"
  },
  "scoreThreshold": 70
}

Add agent-roast as a gate in your pull request workflow (.github/workflows/agent-roast.yml):

name: Agent Roast
on:
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Required for complete merge-base history

      - name: Run agent-roast audit
        uses: Nari-Ab/agent-roast@v1
        with:
          fail-on: test-skip,trivial-assert,stub-abandonment
          format: github

Security Note: agent-roast runs in an isolated runner directory ($RUNNER_TEMP) with --ignore-scripts to neutralize malicious .npmrc files in untrusted pull requests. pull_request_target is not supported.

Only added lines (+) in source code files are scanned — deleted lines, file moves, and comments never trigger false alarms.

• Skipped tests (test-skip): it.skip, describe.skip, xit, pytest.skip, test.todo added to silence failing tests. (Default blocking gate).
• Trivial assertions (trivial-assert): Tautological or dummy assertions added to fabricate test green checks (expect(true).toBe(true), expect(1).toBe(1), assert True, self.assertTrue(True)).
• Stub abandonment (stub-abandonment): Dummy stubs left unimplemented in committed code (throw new Error("Not implemented"), raise NotImplementedError, Rust todo!() / unimplemented!()).
• Type escapes (type-escape): as any, as unknown as, as never, // @ts-ignore, // @ts-nocheck, // @ts-expect-error, # type: ignore, # noqa, eslint-disable.
• Swallowed errors (swallowed-error): Empty catch {} or except: pass blocks hiding runtime failures.
• Panic fix loops (panic-loop): Heuristic chain analysis of rapid-fire fix/revert commits by the same author within 15 minutes touching overlapping files. (Observational metric for repository audits; not a PR blocker).

• Repository Audit Score: Uses size-invariant defect density: $$\text{Score} = 100 \cdot \exp\left(-\left(\frac{\text{codeDensity}}{R_0} + \frac{\text{panicDensity}}{R_1}\right)\right)$$ where defect points are normalized by effective sample volume ($k\text{Loc} + 0.5$). Repositories with fewer than 200 lines added return null (insufficient data) rather than an arbitrary 100.
• Pull Request Mode: Avoids unstable micro-sample scores. Reports verified infractions, pass/fail status, and reference defect density per 100 LOC. Author identities are hidden by default to prevent team blame games.

• Requirements: Git 2.30+ (for --end-of-options argument isolation), Node.js 18+.
• 100% Local: Instant streaming parser runs directly on your machine.
• Zero Telemetry: No cloud dependencies, no LLM API calls, no network traffic. Verified by static bundle inspection.
• Hermetic: Enforces -c core.quotepath=false -c diff.noprefix=false to guarantee identical behavior across all environments.

Created by Nariman Abdukarimov (abdukarimov.nariman07@gmail.com).

MIT