@rigour-labs/cli 2.0.0 → 2.2.0

package/dist/cli.js

@@ -43,17 +43,20 @@ Examples:
 program
     .command('check')
     .description('Run quality gate checks')
+    .argument('[files...]', 'Specific files or directories to check')
     .option('--ci', 'CI mode (minimal output, non-zero exit on fail)')
     .option('--json', 'Output report in JSON format')
     .option('-i, --interactive', 'Run in interactive mode with rich output')
     .addHelpText('after', `
 Examples:
   $ rigour check                       # Run standard check
+  $ rigour check ./src                 # Check only the src directory
+  $ rigour check ./src/app.ts          # Check only app.ts
   $ rigour check --interactive         # Run with rich, interactive output
   $ rigour check --ci                  # Run in CI environment
     `)
-    .action(async (options) => {
-    await (0, check_js_1.checkCommand)(process.cwd(), options);
+    .action(async (files, options) => {
+    await (0, check_js_1.checkCommand)(process.cwd(), files, options);
 });
 program
     .command('explain')

package/dist/commands/check.d.ts

@@ -3,4 +3,4 @@ export interface CheckOptions {
     json?: boolean;
     interactive?: boolean;
 }
-export declare function checkCommand(cwd: string, options?: CheckOptions): Promise<void>;
+export declare function checkCommand(cwd: string, files?: string[], options?: CheckOptions): Promise<void>;

package/dist/commands/check.js

@@ -9,12 +9,13 @@ const path_1 = __importDefault(require("path"));
 const chalk_1 = __importDefault(require("chalk"));
 const yaml_1 = __importDefault(require("yaml"));
 const core_1 = require("@rigour-labs/core");
+const inquirer_1 = __importDefault(require("inquirer"));
 // Exit codes per spec
 const EXIT_PASS = 0;
 const EXIT_FAIL = 1;
 const EXIT_CONFIG_ERROR = 2;
 const EXIT_INTERNAL_ERROR = 3;
-async function checkCommand(cwd, options = {}) {
+async function checkCommand(cwd, files = [], options = {}) {
     const configPath = path_1.default.join(cwd, 'rigour.yml');
     if (!(await fs_extra_1.default.pathExists(configPath))) {
         if (options.json) {
@@ -33,7 +34,7 @@ async function checkCommand(cwd, options = {}) {
             console.log(chalk_1.default.blue('Running Rigour checks...\n'));
         }
         const runner = new core_1.GateRunner(config);
-        const report = await runner.run(cwd);
+        const report = await runner.run(cwd, files.length > 0 ? files : undefined);
         // Write machine report
         const reportPath = path_1.default.join(cwd, config.output.report_path);
         await fs_extra_1.default.writeJson(reportPath, report, { spaces: 2 });
@@ -63,6 +64,10 @@ async function checkCommand(cwd, options = {}) {
             }
             process.exit(report.status === 'PASS' ? EXIT_PASS : EXIT_FAIL);
         }
+        if (options.interactive && report.status === 'FAIL') {
+            await interactiveMode(report, config);
+            process.exit(EXIT_FAIL);
+        }
         // Normal human-readable output
         if (report.status === 'PASS') {
             console.log(chalk_1.default.green.bold('✔ PASS - All quality gates satisfied.'));
@@ -87,6 +92,18 @@ async function checkCommand(cwd, options = {}) {
         process.exit(report.status === 'PASS' ? EXIT_PASS : EXIT_FAIL);
     }
     catch (error) {
+        if (error.name === 'ZodError') {
+            if (options.json) {
+                console.log(JSON.stringify({ error: 'CONFIG_ERROR', details: error.issues }));
+            }
+            else {
+                console.error(chalk_1.default.red('\nInvalid rigour.yml configuration:'));
+                error.issues.forEach((issue) => {
+                    console.error(chalk_1.default.red(`  • ${issue.path.join('.')}: ${issue.message}`));
+                });
+            }
+            process.exit(EXIT_CONFIG_ERROR);
+        }
         if (options.json) {
             console.log(JSON.stringify({ error: 'INTERNAL_ERROR', message: error.message }));
         }
@@ -96,3 +113,46 @@ async function checkCommand(cwd, options = {}) {
         process.exit(EXIT_INTERNAL_ERROR);
     }
 }
+async function interactiveMode(report, config) {
+    console.clear();
+    console.log(chalk_1.default.bold.blue('══ Rigour Interactive Review ══\n'));
+    console.log(chalk_1.default.yellow(`${report.failures.length} violations found.\n`));
+    const choices = report.failures.map((f, i) => ({
+        name: `[${f.id}] ${f.title}`,
+        value: i
+    }));
+    choices.push(new inquirer_1.default.Separator());
+    choices.push({ name: 'Exit', value: -1 });
+    let exit = false;
+    while (!exit) {
+        const { index } = await inquirer_1.default.prompt([
+            {
+                type: 'list',
+                name: 'index',
+                message: 'Select a violation to view details:',
+                choices,
+                pageSize: 15
+            }
+        ]);
+        if (index === -1) {
+            exit = true;
+            continue;
+        }
+        const failure = report.failures[index];
+        console.clear();
+        console.log(chalk_1.default.bold.red(`\nViolation: ${failure.title}`));
+        console.log(chalk_1.default.dim(`ID: ${failure.id}`));
+        console.log(`\n${chalk_1.default.bold('Details:')}\n${failure.details}`);
+        if (failure.files && failure.files.length > 0) {
+            console.log(`\n${chalk_1.default.bold('Impacted Files:')}`);
+            failure.files.forEach((f) => console.log(chalk_1.default.dim(`  - ${f}`)));
+        }
+        if (failure.hint) {
+            console.log(`\n${chalk_1.default.bold.cyan('Hint:')} ${failure.hint}`);
+        }
+        console.log(chalk_1.default.dim('\n' + '─'.repeat(40)));
+        await inquirer_1.default.prompt([{ type: 'input', name: 'continue', message: 'Press Enter to return to list...' }]);
+        console.clear();
+        console.log(chalk_1.default.bold.blue('══ Rigour Interactive Review ══\n'));
+    }
+}

package/dist/commands/init.js

@@ -116,8 +116,10 @@ npx @rigour-labs/cli run -- <agent-command>
 \`\`\`
 `;
     // 1. Create Universal Instructions
-    await fs_extra_1.default.writeFile(instructionsPath, ruleContent);
-    console.log(chalk_1.default.green('✔ Initialized Universal Agent Handshake (docs/AGENT_INSTRUCTIONS.md)'));
+    if (!(await fs_extra_1.default.pathExists(instructionsPath))) {
+        await fs_extra_1.default.writeFile(instructionsPath, ruleContent);
+        console.log(chalk_1.default.green('✔ Initialized Universal Agent Handshake (docs/AGENT_INSTRUCTIONS.md)'));
+    }
     // 2. Create Cursor Specific Rules (.mdc)
     const cursorRulesDir = path_1.default.join(cwd, '.cursor', 'rules');
     await fs_extra_1.default.ensureDir(cursorRulesDir);
@@ -128,7 +130,28 @@ globs: **/*
 ---
 
 ${ruleContent}`;
-    await fs_extra_1.default.writeFile(mdcPath, mdcContent);
-    console.log(chalk_1.default.green('✔ Initialized Cursor Handshake (.cursor/rules/rigour.mdc)'));
+    if (!(await fs_extra_1.default.pathExists(mdcPath))) {
+        await fs_extra_1.default.writeFile(mdcPath, mdcContent);
+        console.log(chalk_1.default.green('✔ Initialized Cursor Handshake (.cursor/rules/rigour.mdc)'));
+    }
+    // 3. Update .gitignore
+    const gitignorePath = path_1.default.join(cwd, '.gitignore');
+    const ignorePatterns = ['rigour-report.json', 'rigour-fix-packet.json', '.rigour/'];
+    try {
+        let content = '';
+        if (await fs_extra_1.default.pathExists(gitignorePath)) {
+            content = await fs_extra_1.default.readFile(gitignorePath, 'utf-8');
+        }
+        const toAdd = ignorePatterns.filter(p => !content.includes(p));
+        if (toAdd.length > 0) {
+            const separator = content.endsWith('\n') ? '' : '\n';
+            const newContent = `${content}${separator}\n# Rigour Artifacts\n${toAdd.join('\n')}\n`;
+            await fs_extra_1.default.writeFile(gitignorePath, newContent);
+            console.log(chalk_1.default.green('✔ Updated .gitignore'));
+        }
+    }
+    catch (e) {
+        // Failing to update .gitignore isn't fatal
+    }
     console.log(chalk_1.default.blue('\nRigour is ready. Run `npx @rigour-labs/cli check` to verify your project.'));
 }

package/dist/commands/run.js

@@ -41,13 +41,20 @@ async function runLoop(cwd, agentArgs, options) {
                 // We keep the first part of the command (the agent) but can append or wrap
                 // For simplicity, we assume the agent can read the JSON file we generate
             }
+            const getTrackedChanges = async () => {
+                try {
+                    const { stdout } = await (0, execa_1.execa)('git', ['status', '--porcelain'], { cwd });
+                    return stdout.split('\n')
+                        .filter(l => l.trim())
+                        .filter(line => /M|A|D|R/.test(line.slice(0, 2)))
+                        .map(l => l.slice(3).trim());
+                }
+                catch (e) {
+                    return [];
+                }
+            };
             // Snapshot changed files before agent runs
-            let beforeFiles = [];
-            try {
-                const { stdout } = await (0, execa_1.execa)('git', ['status', '--porcelain'], { cwd });
-                beforeFiles = stdout.split('\n').filter(l => l.trim()).map(l => l.slice(3).trim());
-            }
-            catch (e) { }
+            const beforeFiles = await getTrackedChanges();
             // 2. Run the agent command
             if (currentArgs.length > 0) {
                 console.log(chalk_1.default.cyan(`\n🚀 DEPLOYING AGENT:`));
@@ -60,12 +67,7 @@ async function runLoop(cwd, agentArgs, options) {
                 }
             }
             // Snapshot changed files after agent runs
-            let afterFiles = [];
-            try {
-                const { stdout } = await (0, execa_1.execa)('git', ['status', '--porcelain'], { cwd });
-                afterFiles = stdout.split('\n').filter(l => l.trim()).map(l => l.slice(3).trim());
-            }
-            catch (e) { }
+            const afterFiles = await getTrackedChanges();
             const changedThisCycle = afterFiles.filter(f => !beforeFiles.includes(f));
             const maxFiles = config.gates.safety?.max_files_changed_per_cycle || 10;
             if (changedThisCycle.length > maxFiles) {

package/dist/smoke.test.js

@@ -1,8 +1,63 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const vitest_1 = require("vitest");
+const check_js_1 = require("./commands/check.js");
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const path_1 = __importDefault(require("path"));
 (0, vitest_1.describe)('CLI Smoke Test', () => {
-    (0, vitest_1.it)('should pass', async () => {
-        (0, vitest_1.expect)(true).toBe(true);
+    const testDir = path_1.default.join(process.cwd(), 'temp-smoke-test');
+    (0, vitest_1.beforeEach)(async () => {
+        await fs_extra_1.default.ensureDir(testDir);
+        // @ts-ignore
+        vitest_1.vi.spyOn(process, 'exit').mockImplementation(() => { });
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await fs_extra_1.default.remove(testDir);
+        vitest_1.vi.restoreAllMocks();
+    });
+    (0, vitest_1.it)('should respect ignore patterns and avoid EPERM', async () => {
+        const restrictedDir = path_1.default.join(testDir, '.restricted');
+        await fs_extra_1.default.ensureDir(restrictedDir);
+        await fs_extra_1.default.writeFile(path_1.default.join(restrictedDir, 'secret.js'), 'TODO: leak');
+        await fs_extra_1.default.writeFile(path_1.default.join(testDir, 'rigour.yml'), `
+version: 1
+ignore:
+  - ".restricted/**"
+gates:
+  forbid_todos: true
+  required_files: []
+`);
+        // Simulate EPERM by changing permissions
+        await fs_extra_1.default.chmod(restrictedDir, 0o000);
+        try {
+            // We need to mock process.exit or checkCommand should not exit if we want to test it easily
+            // For now, we'll just verify it doesn't throw before it would exit (internal logic)
+            // But checkCommand calls process.exit(1) on failure.
+            // Re-importing checkCommand to ensure it uses the latest core
+            await (0, vitest_1.expect)((0, check_js_1.checkCommand)(testDir, [], { ci: true })).resolves.not.toThrow();
+        }
+        finally {
+            await fs_extra_1.default.chmod(restrictedDir, 0o777);
+        }
+    });
+    (0, vitest_1.it)('should check specific files when provided', async () => {
+        await fs_extra_1.default.writeFile(path_1.default.join(testDir, 'bad.js'), 'TODO: fixme');
+        await fs_extra_1.default.writeFile(path_1.default.join(testDir, 'good.js'), 'console.log("hello")');
+        await fs_extra_1.default.writeFile(path_1.default.join(testDir, 'rigour.yml'), `
+version: 1
+gates:
+  forbid_todos: true
+  required_files: []
+`);
+        // If we check ONLY good.js, it should PASS (exit PASS)
+        await (0, check_js_1.checkCommand)(testDir, [path_1.default.join(testDir, 'good.js')], { ci: true });
+        (0, vitest_1.expect)(process.exit).toHaveBeenCalledWith(0);
+        // If we check bad.js, it should FAIL (exit FAIL)
+        vitest_1.vi.clearAllMocks();
+        await (0, check_js_1.checkCommand)(testDir, [path_1.default.join(testDir, 'bad.js')], { ci: true });
+        (0, vitest_1.expect)(process.exit).toHaveBeenCalledWith(1);
     });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/cli",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "bin": {
     "rigour": "dist/cli.js"
   },
@@ -19,11 +19,13 @@
     "execa": "^8.0.1",
     "fs-extra": "^11.2.0",
     "globby": "^14.0.1",
+    "inquirer": "9.2.16",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "2.0.0"
+    "@rigour-labs/core": "2.2.0"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",
+    "@types/inquirer": "9.0.7",
     "@types/node": "^25.0.3"
   },
   "scripts": {

package/src/cli.ts

@@ -42,17 +42,20 @@ Examples:
 program
     .command('check')
     .description('Run quality gate checks')
+    .argument('[files...]', 'Specific files or directories to check')
     .option('--ci', 'CI mode (minimal output, non-zero exit on fail)')
     .option('--json', 'Output report in JSON format')
     .option('-i, --interactive', 'Run in interactive mode with rich output')
     .addHelpText('after', `
 Examples:
   $ rigour check                       # Run standard check
+  $ rigour check ./src                 # Check only the src directory
+  $ rigour check ./src/app.ts          # Check only app.ts
   $ rigour check --interactive         # Run with rich, interactive output
   $ rigour check --ci                  # Run in CI environment
     `)
-    .action(async (options: any) => {
-        await checkCommand(process.cwd(), options);
+    .action(async (files: string[], options: any) => {
+        await checkCommand(process.cwd(), files, options);
     });
 
 program

package/src/commands/check.ts

@@ -3,6 +3,7 @@ import path from 'path';
 import chalk from 'chalk';
 import yaml from 'yaml';
 import { GateRunner, ConfigSchema, Failure } from '@rigour-labs/core';
+import inquirer from 'inquirer';
 
 // Exit codes per spec
 const EXIT_PASS = 0;
@@ -16,7 +17,7 @@ export interface CheckOptions {
     interactive?: boolean;
 }
 
-export async function checkCommand(cwd: string, options: CheckOptions = {}) {
+export async function checkCommand(cwd: string, files: string[] = [], options: CheckOptions = {}) {
     const configPath = path.join(cwd, 'rigour.yml');
 
     if (!(await fs.pathExists(configPath))) {
@@ -38,7 +39,7 @@ export async function checkCommand(cwd: string, options: CheckOptions = {}) {
         }
 
         const runner = new GateRunner(config);
-        const report = await runner.run(cwd);
+        const report = await runner.run(cwd, files.length > 0 ? files : undefined);
 
         // Write machine report
         const reportPath = path.join(cwd, config.output.report_path);
@@ -72,6 +73,11 @@ export async function checkCommand(cwd: string, options: CheckOptions = {}) {
             process.exit(report.status === 'PASS' ? EXIT_PASS : EXIT_FAIL);
         }
 
+        if (options.interactive && report.status === 'FAIL') {
+            await interactiveMode(report, config);
+            process.exit(EXIT_FAIL);
+        }
+
         // Normal human-readable output
         if (report.status === 'PASS') {
             console.log(chalk.green.bold('✔ PASS - All quality gates satisfied.'));
@@ -99,6 +105,18 @@ export async function checkCommand(cwd: string, options: CheckOptions = {}) {
         process.exit(report.status === 'PASS' ? EXIT_PASS : EXIT_FAIL);
 
     } catch (error: any) {
+        if (error.name === 'ZodError') {
+            if (options.json) {
+                console.log(JSON.stringify({ error: 'CONFIG_ERROR', details: error.issues }));
+            } else {
+                console.error(chalk.red('\nInvalid rigour.yml configuration:'));
+                error.issues.forEach((issue: any) => {
+                    console.error(chalk.red(`  • ${issue.path.join('.')}: ${issue.message}`));
+                });
+            }
+            process.exit(EXIT_CONFIG_ERROR);
+        }
+
         if (options.json) {
             console.log(JSON.stringify({ error: 'INTERNAL_ERROR', message: error.message }));
         } else if (!options.ci) {
@@ -107,3 +125,55 @@ export async function checkCommand(cwd: string, options: CheckOptions = {}) {
         process.exit(EXIT_INTERNAL_ERROR);
     }
 }
+
+async function interactiveMode(report: any, config: any) {
+    console.clear();
+    console.log(chalk.bold.blue('══ Rigour Interactive Review ══\n'));
+    console.log(chalk.yellow(`${report.failures.length} violations found.\n`));
+
+    const choices = report.failures.map((f: Failure, i: number) => ({
+        name: `[${f.id}] ${f.title}`,
+        value: i
+    }));
+
+    choices.push(new (inquirer as any).Separator());
+    choices.push({ name: 'Exit', value: -1 });
+
+    let exit = false;
+    while (!exit) {
+        const { index } = await inquirer.prompt([
+            {
+                type: 'list',
+                name: 'index',
+                message: 'Select a violation to view details:',
+                choices,
+                pageSize: 15
+            }
+        ]);
+
+        if (index === -1) {
+            exit = true;
+            continue;
+        }
+
+        const failure = report.failures[index];
+        console.clear();
+        console.log(chalk.bold.red(`\nViolation: ${failure.title}`));
+        console.log(chalk.dim(`ID: ${failure.id}`));
+        console.log(`\n${chalk.bold('Details:')}\n${failure.details}`);
+
+        if (failure.files && failure.files.length > 0) {
+            console.log(`\n${chalk.bold('Impacted Files:')}`);
+            failure.files.forEach((f: string) => console.log(chalk.dim(`  - ${f}`)));
+        }
+
+        if (failure.hint) {
+            console.log(`\n${chalk.bold.cyan('Hint:')} ${failure.hint}`);
+        }
+
+        console.log(chalk.dim('\n' + '─'.repeat(40)));
+        await inquirer.prompt([{ type: 'input', name: 'continue', message: 'Press Enter to return to list...' }]);
+        console.clear();
+        console.log(chalk.bold.blue('══ Rigour Interactive Review ══\n'));
+    }
+}

package/src/commands/init.ts

@@ -124,8 +124,10 @@ npx @rigour-labs/cli run -- <agent-command>
 `;
 
     // 1. Create Universal Instructions
-    await fs.writeFile(instructionsPath, ruleContent);
-    console.log(chalk.green('✔ Initialized Universal Agent Handshake (docs/AGENT_INSTRUCTIONS.md)'));
+    if (!(await fs.pathExists(instructionsPath))) {
+        await fs.writeFile(instructionsPath, ruleContent);
+        console.log(chalk.green('✔ Initialized Universal Agent Handshake (docs/AGENT_INSTRUCTIONS.md)'));
+    }
 
     // 2. Create Cursor Specific Rules (.mdc)
     const cursorRulesDir = path.join(cwd, '.cursor', 'rules');
@@ -138,8 +140,30 @@ globs: **/*
 
 ${ruleContent}`;
 
-    await fs.writeFile(mdcPath, mdcContent);
-    console.log(chalk.green('✔ Initialized Cursor Handshake (.cursor/rules/rigour.mdc)'));
+    if (!(await fs.pathExists(mdcPath))) {
+        await fs.writeFile(mdcPath, mdcContent);
+        console.log(chalk.green('✔ Initialized Cursor Handshake (.cursor/rules/rigour.mdc)'));
+    }
+
+    // 3. Update .gitignore
+    const gitignorePath = path.join(cwd, '.gitignore');
+    const ignorePatterns = ['rigour-report.json', 'rigour-fix-packet.json', '.rigour/'];
+    try {
+        let content = '';
+        if (await fs.pathExists(gitignorePath)) {
+            content = await fs.readFile(gitignorePath, 'utf-8');
+        }
+
+        const toAdd = ignorePatterns.filter(p => !content.includes(p));
+        if (toAdd.length > 0) {
+            const separator = content.endsWith('\n') ? '' : '\n';
+            const newContent = `${content}${separator}\n# Rigour Artifacts\n${toAdd.join('\n')}\n`;
+            await fs.writeFile(gitignorePath, newContent);
+            console.log(chalk.green('✔ Updated .gitignore'));
+        }
+    } catch (e) {
+        // Failing to update .gitignore isn't fatal
+    }
 
     console.log(chalk.blue('\nRigour is ready. Run `npx @rigour-labs/cli check` to verify your project.'));
 }

package/src/commands/run.ts

@@ -43,12 +43,20 @@ export async function runLoop(cwd: string, agentArgs: string[], options: { itera
                 // For simplicity, we assume the agent can read the JSON file we generate
             }
 
+            const getTrackedChanges = async () => {
+                try {
+                    const { stdout } = await execa('git', ['status', '--porcelain'], { cwd });
+                    return stdout.split('\n')
+                        .filter(l => l.trim())
+                        .filter(line => /M|A|D|R/.test(line.slice(0, 2)))
+                        .map(l => l.slice(3).trim());
+                } catch (e) {
+                    return [];
+                }
+            };
+
             // Snapshot changed files before agent runs
-            let beforeFiles: string[] = [];
-            try {
-                const { stdout } = await execa('git', ['status', '--porcelain'], { cwd });
-                beforeFiles = stdout.split('\n').filter(l => l.trim()).map(l => l.slice(3).trim());
-            } catch (e) { }
+            const beforeFiles = await getTrackedChanges();
 
             // 2. Run the agent command
             if (currentArgs.length > 0) {
@@ -62,11 +70,7 @@ export async function runLoop(cwd: string, agentArgs: string[], options: { itera
             }
 
             // Snapshot changed files after agent runs
-            let afterFiles: string[] = [];
-            try {
-                const { stdout } = await execa('git', ['status', '--porcelain'], { cwd });
-                afterFiles = stdout.split('\n').filter(l => l.trim()).map(l => l.slice(3).trim());
-            } catch (e) { }
+            const afterFiles = await getTrackedChanges();
 
             const changedThisCycle = afterFiles.filter(f => !beforeFiles.includes(f));
             const maxFiles = config.gates.safety?.max_files_changed_per_cycle || 10;

package/src/smoke.test.ts

@@ -1,7 +1,68 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { checkCommand } from './commands/check.js';
+import fs from 'fs-extra';
+import path from 'path';
 
 describe('CLI Smoke Test', () => {
-    it('should pass', async () => {
-        expect(true).toBe(true);
+    const testDir = path.join(process.cwd(), 'temp-smoke-test');
+
+    beforeEach(async () => {
+        await fs.ensureDir(testDir);
+        // @ts-ignore
+        vi.spyOn(process, 'exit').mockImplementation(() => { });
+    });
+
+    afterEach(async () => {
+        await fs.remove(testDir);
+        vi.restoreAllMocks();
+    });
+
+    it('should respect ignore patterns and avoid EPERM', async () => {
+        const restrictedDir = path.join(testDir, '.restricted');
+        await fs.ensureDir(restrictedDir);
+        await fs.writeFile(path.join(restrictedDir, 'secret.js'), 'TODO: leak');
+
+        await fs.writeFile(path.join(testDir, 'rigour.yml'), `
+version: 1
+ignore:
+  - ".restricted/**"
+gates:
+  forbid_todos: true
+  required_files: []
+`);
+
+        // Simulate EPERM by changing permissions
+        await fs.chmod(restrictedDir, 0o000);
+
+        try {
+            // We need to mock process.exit or checkCommand should not exit if we want to test it easily
+            // For now, we'll just verify it doesn't throw before it would exit (internal logic)
+            // But checkCommand calls process.exit(1) on failure.
+
+            // Re-importing checkCommand to ensure it uses the latest core
+            await expect(checkCommand(testDir, [], { ci: true })).resolves.not.toThrow();
+        } finally {
+            await fs.chmod(restrictedDir, 0o777);
+        }
+    });
+
+    it('should check specific files when provided', async () => {
+        await fs.writeFile(path.join(testDir, 'bad.js'), 'TODO: fixme');
+        await fs.writeFile(path.join(testDir, 'good.js'), 'console.log("hello")');
+        await fs.writeFile(path.join(testDir, 'rigour.yml'), `
+version: 1
+gates:
+  forbid_todos: true
+  required_files: []
+`);
+
+        // If we check ONLY good.js, it should PASS (exit PASS)
+        await checkCommand(testDir, [path.join(testDir, 'good.js')], { ci: true });
+        expect(process.exit).toHaveBeenCalledWith(0);
+
+        // If we check bad.js, it should FAIL (exit FAIL)
+        vi.clearAllMocks();
+        await checkCommand(testDir, [path.join(testDir, 'bad.js')], { ci: true });
+        expect(process.exit).toHaveBeenCalledWith(1);
     });
 });