@rigour-labs/cli 5.1.1 → 5.1.2

package/dist/cli.js

@@ -15,6 +15,7 @@ import { hooksInitCommand, hooksCheckCommand } from './commands/hooks.js';
 import { settingsShowCommand, settingsSetKeyCommand, settingsRemoveKeyCommand, settingsSetCommand, settingsGetCommand, settingsResetCommand, settingsPathCommand } from './commands/settings.js';
 import { doctorCommand } from './commands/doctor.js';
 import { brainCommand } from './commands/brain.js';
+import { deepStatsCommand } from './commands/deep-stats.js';
 import { checkForUpdates } from './utils/version.js';
 import { getCliVersion } from './utils/cli-version.js';
 import chalk from 'chalk';
@@ -23,6 +24,7 @@ const program = new Command();
 program.addCommand(indexCommand);
 program.addCommand(studioCommand);
 program.addCommand(brainCommand);
+program.addCommand(deepStatsCommand);
 program
     .name('rigour')
     .description('🛡️ Rigour: The Quality Gate Loop for AI-Assisted Engineering')
@@ -71,6 +73,7 @@ program
     .option('--api-base-url <url>', 'Custom API base URL (for self-hosted or proxy endpoints)')
     .option('--model-name <name>', 'Override cloud model name')
     .option('--agents <count>', 'Number of parallel agents for deep scan (cloud-only, default: 1)', '1')
+    .option('--no-cache', 'Force full scan even if no files changed')
     .addHelpText('after', `
 Examples:
   $ rigour check                                          # AST only. Instant. Free.
@@ -227,11 +230,14 @@ hooksCmd
     .option('--stdin', 'Read hook payload from stdin (Cursor/Windsurf/Cline format)')
     .option('--block', 'Exit code 2 on failures (for blocking hooks)')
     .option('--timeout <ms>', 'Timeout in milliseconds (default: 5000)')
+    .option('--mode <mode>', 'Check mode: "check" (default) or "dlp" (credential scanning)')
+    .option('--agent <name>', 'Agent name for DLP audit trail (e.g., cursor, claude)')
     .addHelpText('after', `
 Examples:
   $ rigour hooks check --files src/app.ts
   $ rigour hooks check --files src/a.ts,src/b.ts --block
   $ echo '{"file_path":"src/app.ts"}' | rigour hooks check --stdin
+  $ echo 'AWS_SECRET=AKIA...' | rigour hooks check --mode dlp --stdin
     `)
     .action(async (options) => {
     await hooksCheckCommand(process.cwd(), options);
@@ -278,11 +284,15 @@ settingsCmd
 (async () => {
     try {
         const updateInfo = await checkForUpdates(CLI_VERSION);
-        // Suppress update message in JSON/CI mode to keep stdout clean
-        const isSilent = process.argv.includes('--json') || process.argv.includes('--ci');
-        if (updateInfo?.hasUpdate && !isSilent) {
-            console.log(chalk.yellow(`\n⚡ Update available: ${updateInfo.currentVersion} → ${updateInfo.latestVersion}`));
-            console.log(chalk.dim(`   Run: npx @rigour-labs/cli@latest init --force\n`));
+        // Suppress update message when stdout must be clean JSON:
+        // --json, --ci flags, or hooks subcommand (Cursor/Claude parse stdout as JSON)
+        const isSilent = process.argv.includes('--json') || process.argv.includes('--ci') || process.argv.includes('hooks');
+        // Skip for local dev builds where package.json version hasn't been bumped
+        const isDevBuild = CLI_VERSION === '1.0.0' || CLI_VERSION === '0.0.0';
+        if (updateInfo?.hasUpdate && !isSilent && !isDevBuild) {
+            // Use stderr so stdout stays clean for programmatic consumers
+            console.error(chalk.yellow(`\n⚡ Update available: ${updateInfo.currentVersion} → ${updateInfo.latestVersion}`));
+            console.error(chalk.dim(`   Run: npx @rigour-labs/cli@latest init --force\n`));
         }
     }
     catch {

package/dist/commands/brain.js

@@ -42,8 +42,25 @@ async function handleStatus(core) {
     const cwd = process.cwd();
     const stats = await core.getProjectStats(cwd);
     if (!stats) {
-        console.log(chalk.yellow('   SQLite not available (sqlite3 not installed).'));
-        console.log(chalk.dim('   Run: npm install sqlite3'));
+        const os = await import('os');
+        const path = await import('path');
+        const fs = await import('fs-extra');
+        const rigourDir = path.default.join(os.default.homedir(), '.rigour');
+        console.log(chalk.yellow('   SQLite not available — installing sqlite3...'));
+        try {
+            const { execSync } = await import('child_process');
+            // Install into ~/.rigour/ so it's always findable regardless of cwd
+            await fs.default.ensureDir(rigourDir);
+            if (!fs.default.existsSync(path.default.join(rigourDir, 'package.json'))) {
+                fs.default.writeJsonSync(path.default.join(rigourDir, 'package.json'), { name: 'rigour-deps', private: true });
+            }
+            execSync('npm install sqlite3 --no-save', { cwd: rigourDir, stdio: 'pipe', timeout: 120000 });
+            console.log(chalk.green('   ✔ sqlite3 installed to ~/.rigour/. Re-run `rigour brain` to see stats.'));
+        }
+        catch (err) {
+            console.log(chalk.red(`   Auto-install failed: ${err?.message?.slice(0, 100) || 'unknown error'}`));
+            console.log(chalk.dim('   Manual fix: cd ~/.rigour && npm install sqlite3'));
+        }
         return;
     }
     if (stats.totalScans === 0) {

package/dist/commands/check.d.ts

@@ -3,6 +3,8 @@ export interface CheckOptions {
     json?: boolean;
     interactive?: boolean;
     config?: string;
+    noCache?: boolean;
+    cache?: boolean;
     deep?: boolean;
     pro?: boolean;
     apiKey?: string;

package/dist/commands/check.js

@@ -2,7 +2,7 @@ import fs from 'fs-extra';
 import path from 'path';
 import chalk from 'chalk';
 import yaml from 'yaml';
-import { GateRunner, ConfigSchema, recordScore, getScoreTrend, resolveDeepOptions, getProvenanceTrends, getQualityTrend } from '@rigour-labs/core';
+import { GateRunner, ConfigSchema, recordScore, getScoreTrend, resolveDeepOptions, getProvenanceTrends, getQualityTrend, IncrementalCache } from '@rigour-labs/core';
 import inquirer from 'inquirer';
 import { randomUUID } from 'crypto';
 // Exit codes per spec
@@ -44,6 +44,51 @@ export async function checkCommand(cwd, files = [], options = {}) {
         const config = ConfigSchema.parse(rawConfig);
         const isDeep = !!options.deep || !!options.pro || !!options.apiKey;
         const isSilent = !!options.ci || !!options.json;
+        const useCache = options.cache !== false && !options.noCache && !isDeep; // Cache only for non-deep runs
+        // ── Incremental Cache: skip scan if no files changed ──
+        if (useCache && files.length === 0) {
+            try {
+                const cache = new IncrementalCache(cwd);
+                const { FileScanner } = await import('@rigour-labs/core');
+                const allFiles = await FileScanner.findFiles({ cwd, ignore: config.ignore });
+                const result = await cache.check(allFiles, configContent);
+                if (result.hit && result.report) {
+                    if (!isSilent) {
+                        console.log(chalk.green(`⚡ No files changed — returning cached result (${result.checkMs}ms)\n`));
+                    }
+                    // Still write the report and record score
+                    const reportPath = path.join(cwd, config.output.report_path);
+                    await fs.writeJson(reportPath, result.report, { spaces: 2 });
+                    recordScore(cwd, result.report);
+                    if (options.json) {
+                        process.stdout.write(JSON.stringify(result.report, null, 2) + '\n', () => {
+                            process.exit(result.report.status === 'PASS' ? EXIT_PASS : EXIT_FAIL);
+                        });
+                        return;
+                    }
+                    if (options.ci) {
+                        const scoreStr = result.report.stats.score !== undefined ? ` (${result.report.stats.score}/100)` : '';
+                        console.log(`${result.report.status}${scoreStr} (cached)`);
+                        process.exit(result.report.status === 'PASS' ? EXIT_PASS : EXIT_FAIL);
+                    }
+                    renderStandardOutput(result.report, config);
+                    const trend = getScoreTrend(cwd);
+                    if (trend && trend.recentScores.length >= 3) {
+                        const arrow = trend.direction === 'improving' ? chalk.green('↑') :
+                            trend.direction === 'degrading' ? chalk.red('↓') : chalk.dim('→');
+                        const trendColor = trend.direction === 'improving' ? chalk.green :
+                            trend.direction === 'degrading' ? chalk.red : chalk.dim;
+                        const scoresStr = trend.recentScores.map(s => String(s)).join(' → ');
+                        console.log(trendColor(`\nScore Trend: ${scoresStr} (${trend.direction} ${arrow})`));
+                    }
+                    console.log(chalk.dim(`\nFinished in ${result.checkMs}ms (cached) | Score: ${result.report.stats.score ?? '?'}/100`));
+                    process.exit(result.report.status === 'PASS' ? EXIT_PASS : EXIT_FAIL);
+                }
+            }
+            catch {
+                // Cache check failed — proceed with full scan silently
+            }
+        }
         if (!isSilent) {
             if (isDeep) {
                 console.log(chalk.blue.bold('Running Rigour checks + deep analysis...\n'));
@@ -110,6 +155,18 @@ export async function checkCommand(cwd, files = [], options = {}) {
         await fs.writeJson(reportPath, report, { spaces: 2 });
         // Record score for trend tracking
         recordScore(cwd, report);
+        // Save incremental cache for next run (non-deep only)
+        if (useCache && files.length === 0) {
+            try {
+                const cache = new IncrementalCache(cwd);
+                const { FileScanner } = await import('@rigour-labs/core');
+                const allFiles = await FileScanner.findFiles({ cwd, ignore: config.ignore });
+                await cache.save(allFiles, configContent, report);
+            }
+            catch {
+                // Cache save is best-effort
+            }
+        }
         // Persist to SQLite if deep analysis was used
         if (isDeep) {
             try {

package/dist/commands/deep-stats.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare const deepStatsCommand: Command;

package/dist/commands/deep-stats.js

@@ -0,0 +1,74 @@
+/**
+ * Deep Stats Command — show score trends and deep analysis history.
+ * Uses the JSONL score history (no sqlite required).
+ */
+import chalk from 'chalk';
+import { Command } from 'commander';
+import { getScoreHistory, getScoreTrend } from '@rigour-labs/core';
+export const deepStatsCommand = new Command('deep-stats')
+    .description('Show score trends and deep analysis statistics')
+    .option('--limit <n>', 'Number of recent scans to show', '10')
+    .action(async (options) => {
+    const cwd = process.cwd();
+    const limit = parseInt(options.limit, 10) || 10;
+    const history = getScoreHistory(cwd, limit);
+    const trend = getScoreTrend(cwd);
+    console.log(chalk.bold.cyan('\n📊 Rigour Deep Stats\n'));
+    if (history.length === 0) {
+        console.log(chalk.dim('   No scan history found.'));
+        console.log(chalk.dim('   Run `rigour check` to start recording scores.\n'));
+        return;
+    }
+    // Score trend
+    if (trend && trend.recentScores.length >= 3) {
+        const arrow = trend.direction === 'improving' ? chalk.green('↑') :
+            trend.direction === 'degrading' ? chalk.red('↓') : chalk.dim('→');
+        const trendColor = trend.direction === 'improving' ? chalk.green :
+            trend.direction === 'degrading' ? chalk.red : chalk.dim;
+        const scoresStr = trend.recentScores.map(s => String(s)).join(' → ');
+        console.log(`   Trend:    ${trendColor(`${scoresStr} (${trend.direction} ${arrow})`)}`);
+        console.log(`   Average:  ${chalk.bold(String(trend.recentAvg))} (recent) vs ${String(trend.previousAvg)} (previous)`);
+        console.log('');
+    }
+    // Recent scans table
+    console.log(chalk.bold('   Recent Scans:'));
+    console.log(chalk.dim('   ─────────────────────────────────────────────'));
+    for (const entry of history.slice(-limit)) {
+        const date = new Date(entry.timestamp).toLocaleDateString('en-US', {
+            month: 'short', day: 'numeric', hour: '2-digit', minute: '2-digit'
+        });
+        const scoreColor = entry.score >= 80 ? chalk.green :
+            entry.score >= 50 ? chalk.yellow : chalk.red;
+        const statusIcon = entry.status === 'PASS' ? chalk.green('✔') : chalk.red('✘');
+        const scoreBar = '█'.repeat(Math.round(entry.score / 10)) + '░'.repeat(10 - Math.round(entry.score / 10));
+        console.log(`   ${statusIcon} ${chalk.dim(date)} ${scoreColor(scoreBar)} ${scoreColor(String(entry.score).padStart(3))}/100  ${chalk.dim(`${entry.failureCount} findings`)}`);
+    }
+    // Severity breakdown from last scan
+    const latest = history[history.length - 1];
+    if (latest.severity_breakdown && Object.keys(latest.severity_breakdown).length > 0) {
+        console.log(chalk.bold('\n   Latest Severity Breakdown:'));
+        const sev = latest.severity_breakdown;
+        if (sev.critical)
+            console.log(`   ${chalk.red('●')} Critical: ${chalk.red(String(sev.critical))}`);
+        if (sev.high)
+            console.log(`   ${chalk.yellow('●')} High:     ${chalk.yellow(String(sev.high))}`);
+        if (sev.medium)
+            console.log(`   ${chalk.blue('●')} Medium:   ${chalk.blue(String(sev.medium))}`);
+        if (sev.low)
+            console.log(`   ${chalk.dim('●')} Low:      ${chalk.dim(String(sev.low))}`);
+    }
+    // Provenance breakdown
+    if (latest.provenance_breakdown && Object.keys(latest.provenance_breakdown).length > 0) {
+        console.log(chalk.bold('\n   Latest Provenance:'));
+        const prov = latest.provenance_breakdown;
+        for (const [key, count] of Object.entries(prov)) {
+            if (count > 0) {
+                const color = key === 'ai-drift' ? chalk.magenta :
+                    key === 'security' ? chalk.red :
+                        key === 'deep-analysis' ? chalk.blue : chalk.dim;
+                console.log(`   ${color('●')} ${key}: ${color(String(count))}`);
+            }
+        }
+    }
+    console.log('');
+});

package/dist/commands/hooks.js

@@ -75,11 +75,19 @@ function detectTools(cwd) {
     return detected;
 }
 function resolveCheckerCommand(cwd) {
+    // 1. Try project-local node_modules (installed as dependency)
     const localPath = path.join(cwd, 'node_modules', '@rigour-labs', 'core', 'dist', 'hooks', 'standalone-checker.js');
     if (fs.existsSync(localPath)) {
         return { command: 'node', args: [localPath] };
     }
-    return { command: 'rigour', args: ['hooks', 'check'] };
+    // 2. Try dev checkout: ESM has no __dirname, derive from import.meta.url
+    const thisDir = path.dirname(new URL(import.meta.url).pathname);
+    const localCli = path.resolve(thisDir, '../cli.js');
+    if (fs.existsSync(localCli)) {
+        return { command: 'node', args: [localCli, 'hooks', 'check'] };
+    }
+    // 3. Fallback: assume globally installed or aliased
+    return { command: 'npx', args: ['@rigour-labs/cli', 'hooks', 'check'] };
 }
 function shellEscape(arg) {
     if (/^[A-Za-z0-9_/@%+=:,.-]+$/.test(arg)) {
@@ -154,14 +162,14 @@ function generateCursorHooks(checker, block, dlp = true) {
         afterFileEdit: [{ command: `${checkerCommand} --stdin${blockFlag}` }],
     };
     if (dlp) {
-        hookEntries.beforeFileEdit = [{ command: `${checkerCommand} --mode dlp --stdin` }];
+        hookEntries.beforeSubmitPrompt = [{ command: `${checkerCommand} --mode dlp --stdin` }];
     }
     const hooks = { version: 1, hooks: hookEntries };
     return [{
             path: '.cursor/hooks.json',
             content: JSON.stringify(hooks, null, 4),
             description: dlp
-                ? 'Cursor hooks — afterFileEdit quality checks + beforeFileEdit DLP credential interception'
+                ? 'Cursor hooks — afterFileEdit quality checks + beforeSubmitPrompt DLP credential interception'
                 : 'Cursor afterFileEdit hook config',
         }];
 }
@@ -429,36 +437,116 @@ function parseStdinFiles(input) {
         if (Array.isArray(payload.files)) {
             return payload.files;
         }
+        // Direct file_path (Cursor afterFileEdit, Claude Code)
         if (payload.file_path) {
             return [payload.file_path];
         }
+        // Claude Code camelCase format
         if (payload.toolInput?.path) {
             return [payload.toolInput.path];
         }
         if (payload.toolInput?.file_path) {
             return [payload.toolInput.file_path];
         }
+        // Cursor postToolUse: snake_case tool_input (may be object or string)
+        if (payload.tool_input) {
+            const ti = payload.tool_input;
+            if (typeof ti === 'object' && ti !== null) {
+                if (ti.file_path)
+                    return [ti.file_path];
+                if (ti.path)
+                    return [ti.path];
+            }
+        }
+        // Cursor postToolUse: file_path inside tool_output (JSON string)
+        if (typeof payload.tool_output === 'string') {
+            try {
+                const toolOut = JSON.parse(payload.tool_output);
+                if (toolOut.file_path)
+                    return [toolOut.file_path];
+            }
+            catch {
+                // tool_output wasn't JSON
+            }
+        }
         return [];
     }
     catch {
         return input.split('\n').map(l => l.trim()).filter(Boolean);
     }
 }
+/**
+ * Detect if stdin payload is from a Cursor hook (has hook_event_name or prompt field).
+ * Cursor hooks send structured JSON with specific fields and expect
+ * { continue: boolean, user_message?: string } back.
+ */
+function isCursorHookPayload(payload) {
+    return payload && (typeof payload.hook_event_name === 'string' ||
+        typeof payload.prompt === 'string' ||
+        typeof payload.conversation_id === 'string');
+}
+/**
+ * Extract text to scan from a Cursor beforeSubmitPrompt payload.
+ * The prompt field contains the user's input text.
+ */
+function extractCursorPromptText(payload) {
+    if (typeof payload.prompt === 'string')
+        return payload.prompt;
+    if (typeof payload.content === 'string')
+        return payload.content;
+    if (typeof payload.new_content === 'string')
+        return payload.new_content;
+    return '';
+}
 export async function hooksCheckCommand(cwd, options = {}) {
     // ── DLP Mode: Scan text for credentials ──────────────────
     if (options.mode === 'dlp') {
-        const input = options.stdin
+        let rawInput = options.stdin
             ? await readStdin()
             : (options.files ?? ''); // Reuse files param as text in DLP mode
-        if (!input) {
-            process.stdout.write(JSON.stringify({ status: 'clean', detections: [], duration_ms: 0, scanned_length: 0 }));
+        if (!rawInput) {
+            process.stdout.write(JSON.stringify({ continue: true }));
+            return;
+        }
+        // Parse Cursor's structured payload to extract prompt text
+        let textToScan = rawInput;
+        let cursorMode = false;
+        try {
+            const payload = JSON.parse(rawInput);
+            if (isCursorHookPayload(payload)) {
+                cursorMode = true;
+                textToScan = extractCursorPromptText(payload);
+            }
+        }
+        catch {
+            // Not JSON — scan raw text as-is
+        }
+        if (!textToScan) {
+            process.stdout.write(JSON.stringify(cursorMode ? { continue: true } : { status: 'clean', detections: [], duration_ms: 0, scanned_length: 0 }));
             return;
         }
-        const result = scanInputForCredentials(input, {
+        const result = scanInputForCredentials(textToScan, {
             enabled: true,
             block_on_detection: options.block ?? true,
         });
-        process.stdout.write(JSON.stringify(result));
+        // Return Cursor-compatible format if detected as Cursor hook
+        if (cursorMode) {
+            if (result.status === 'blocked') {
+                const messages = result.detections
+                    .map((d) => `[${d.type}] ${d.description} → ${d.recommendation}`)
+                    .join('\n');
+                process.stdout.write(JSON.stringify({
+                    continue: false,
+                    user_message: `🛑 Rigour DLP: ${result.detections.length} credential(s) detected in your prompt:\n${messages}\n\nReplace with environment variable references before submitting.`,
+                }));
+            }
+            else {
+                process.stdout.write(JSON.stringify({ continue: true }));
+            }
+        }
+        else {
+            process.stdout.write(JSON.stringify(result));
+        }
         if (result.status !== 'clean') {
             process.stderr.write('\n' + formatDLPAlert(result) + '\n');
             // Audit trail
@@ -479,11 +567,27 @@ export async function hooksCheckCommand(cwd, options = {}) {
     }
     // ── Standard Mode: Check files ───────────────────────────
     const timeout = options.timeout ? Number(options.timeout) : 5000;
+    let rawStdin = '';
+    let cursorMode = false;
+    if (options.stdin) {
+        rawStdin = await readStdin();
+        // Detect Cursor/IDE hook payload format
+        try {
+            const payload = JSON.parse(rawStdin);
+            if (isCursorHookPayload(payload) || typeof payload.new_content === 'string') {
+                cursorMode = true;
+            }
+        }
+        catch (parseErr) {
+            // Not valid JSON — log for debugging (stderr only, stdout must stay clean)
+            process.stderr.write(`[rigour-hook-debug] stdin JSON parse failed: ${parseErr?.message?.slice(0, 100)}\n`);
+        }
+    }
     const files = options.stdin
-        ? parseStdinFiles(await readStdin())
+        ? parseStdinFiles(rawStdin)
         : (options.files ?? '').split(',').map(f => f.trim()).filter(Boolean);
     if (files.length === 0) {
-        process.stdout.write(JSON.stringify({ status: 'pass', failures: [], duration_ms: 0 }));
+        process.stdout.write(JSON.stringify(cursorMode ? { continue: true } : { status: 'pass', failures: [], duration_ms: 0 }));
         return;
     }
     const result = await runHookChecker({
@@ -491,7 +595,27 @@ export async function hooksCheckCommand(cwd, options = {}) {
         files,
         timeout_ms: Number.isFinite(timeout) ? timeout : 5000,
     });
-    process.stdout.write(JSON.stringify(result));
+    // Return Cursor-compatible format if detected as Cursor hook
+    if (cursorMode) {
+        if (result.status === 'fail') {
+            const messages = result.failures
+                .map(f => {
+                const loc = f.line ? `:${f.line}` : '';
+                return `[${f.gate}] ${f.file}${loc}: ${f.message}`;
+            })
+                .join('\n');
+            process.stdout.write(JSON.stringify({
+                continue: !options.block, // block mode = stop, otherwise warn
+                user_message: `⚠️ Rigour: ${result.failures.length} issue(s) found:\n${messages}`,
+            }));
+        }
+        else {
+            process.stdout.write(JSON.stringify({ continue: true }));
+        }
+    }
+    else {
+        process.stdout.write(JSON.stringify(result));
+    }
     if (result.status === 'fail') {
         for (const failure of result.failures) {
             const loc = failure.line ? `:${failure.line}` : '';

package/dist/commands/hooks.test.js

@@ -30,7 +30,7 @@ describe('hooksInitCommand', () => {
         const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
         expect(settings.hooks).toBeDefined();
         expect(settings.hooks.PostToolUse).toBeDefined();
-        expect(settings.hooks.PostToolUse[0].hooks[0].command).toContain('rigour hooks check');
+        expect(settings.hooks.PostToolUse[0].hooks[0].command).toContain('hooks check');
     });
     it('should generate Cursor hooks', async () => {
         await hooksInitCommand(testDir, { tool: 'cursor' });
@@ -115,7 +115,7 @@ describe('hooksInitCommand — DLP integration', () => {
         const hooksPath = path.join(testDir, '.cursor', 'hooks.json');
         const hooks = JSON.parse(fs.readFileSync(hooksPath, 'utf-8'));
         expect(hooks.hooks.afterFileEdit).toBeDefined();
-        expect(hooks.hooks.beforeFileEdit).toBeDefined();
+        expect(hooks.hooks.beforeSubmitPrompt).toBeDefined();
     });
     it('should generate Windsurf hooks with DLP by default', async () => {
         await hooksInitCommand(testDir, { tool: 'windsurf', force: true });

package/dist/commands/init.js

@@ -23,57 +23,61 @@ async function logStudioEvent(cwd, event) {
         // Silent fail
     }
 }
-function detectIDE(cwd) {
-    // Check for Claude Code markers
+/**
+ * Detect ALL IDEs/agents present in the project (not just the first match).
+ * A project using Cursor often also has CLAUDE.md, .clinerules, etc.
+ * We need hooks for every tool that has markers.
+ */
+function detectAllIDEs(cwd) {
+    const detected = [];
     if (fs.existsSync(path.join(cwd, 'CLAUDE.md')) || fs.existsSync(path.join(cwd, '.claude'))) {
-        return 'claude';
+        detected.push('claude');
     }
-    // Check for Gemini Code Assist markers
-    if (fs.existsSync(path.join(cwd, '.gemini'))) {
-        return 'gemini';
+    if (fs.existsSync(path.join(cwd, '.cursor'))) {
+        detected.push('cursor');
     }
-    // Check for Codex/Aider AGENTS.md (universal standard)
-    if (fs.existsSync(path.join(cwd, 'AGENTS.md'))) {
-        return 'codex';
+    if (fs.existsSync(path.join(cwd, '.clinerules'))) {
+        detected.push('cline');
     }
-    // Check for Windsurf markers
     if (fs.existsSync(path.join(cwd, '.windsurfrules')) || fs.existsSync(path.join(cwd, '.windsurf'))) {
-        return 'windsurf';
+        detected.push('windsurf');
     }
-    // Check for Cline-specific markers
-    if (fs.existsSync(path.join(cwd, '.clinerules'))) {
-        return 'cline';
+    if (fs.existsSync(path.join(cwd, '.gemini'))) {
+        detected.push('gemini');
     }
-    // Check for Cursor-specific markers
-    if (fs.existsSync(path.join(cwd, '.cursor'))) {
-        return 'cursor';
+    if (fs.existsSync(path.join(cwd, 'AGENTS.md'))) {
+        detected.push('codex');
     }
-    // Check for VS Code markers
     if (fs.existsSync(path.join(cwd, '.vscode'))) {
-        return 'vscode';
-    }
-    // Check environment variables that IDEs/Agents set
-    const termProgram = process.env.TERM_PROGRAM || '';
-    const terminal = process.env.TERMINAL_EMULATOR || '';
-    const appName = process.env.APP_NAME || '';
-    if (termProgram.toLowerCase().includes('cursor') || terminal.toLowerCase().includes('cursor')) {
-        return 'cursor';
-    }
-    if (termProgram.toLowerCase().includes('cline') || appName.toLowerCase().includes('cline')) {
-        return 'cline';
-    }
-    if (termProgram.toLowerCase().includes('vscode') || process.env.VSCODE_INJECTION) {
-        return 'vscode';
-    }
-    // Check for Claude Code environment
-    if (process.env.CLAUDE_CODE || process.env.ANTHROPIC_API_KEY) {
-        return 'claude';
-    }
-    // Check for Gemini environment
-    if (process.env.GEMINI_API_KEY || process.env.GOOGLE_CLOUD_PROJECT) {
-        return 'gemini';
+        detected.push('vscode');
+    }
+    // Fallback: check environment variables if no file markers found
+    if (detected.length === 0) {
+        const termProgram = process.env.TERM_PROGRAM || '';
+        const terminal = process.env.TERMINAL_EMULATOR || '';
+        const appName = process.env.APP_NAME || '';
+        if (termProgram.toLowerCase().includes('cursor') || terminal.toLowerCase().includes('cursor')) {
+            detected.push('cursor');
+        }
+        else if (termProgram.toLowerCase().includes('cline') || appName.toLowerCase().includes('cline')) {
+            detected.push('cline');
+        }
+        else if (termProgram.toLowerCase().includes('vscode') || process.env.VSCODE_INJECTION) {
+            detected.push('vscode');
+        }
+        else if (process.env.CLAUDE_CODE || process.env.ANTHROPIC_API_KEY) {
+            detected.push('claude');
+        }
+        else if (process.env.GEMINI_API_KEY || process.env.GOOGLE_CLOUD_PROJECT) {
+            detected.push('gemini');
+        }
     }
-    return 'unknown';
+    return detected.length > 0 ? detected : ['unknown'];
+}
+/** Legacy single-IDE detection for backward compatibility (returns primary IDE). */
+function detectIDE(cwd) {
+    const all = detectAllIDEs(cwd);
+    return all[0] || 'unknown';
 }
 export async function initCommand(cwd, options = {}) {
     const discovery = new DiscoveryService();
@@ -154,6 +158,12 @@ export async function initCommand(cwd, options = {}) {
         console.log(chalk.cyan(`   Paradigm: `) + chalk.bold(recommendedConfig.paradigm.toUpperCase()));
     }
     console.log('');
+    const ALL_HOOK_TOOLS = ['claude', 'cursor', 'cline', 'windsurf'];
+    recommendedConfig.hooks = {
+        ...recommendedConfig.hooks,
+        enabled: true,
+        tools: ALL_HOOK_TOOLS,
+    };
     const yamlHeader = `# ⚠️ TEAM STANDARD - DO NOT MODIFY WITHOUT TEAM APPROVAL
 # AI Assistants: Adjust YOUR code to meet these standards, not the other way around.
 # Modifying thresholds or adding ignores to pass checks defeats the purpose of Rigour.
@@ -178,21 +188,47 @@ export async function initCommand(cwd, options = {}) {
     const instructionsPath = path.join(rigourDocsDir, 'AGENT_INSTRUCTIONS.md');
     const ruleContent = `# 🛡️ Rigour: Mandatory Engineering Governance Protocol
 
-**You are an AI Engineering Agent governed by Rigour.** 
+**You are an AI Engineering Agent governed by Rigour.** You MUST use the Rigour MCP tools at specific points in your workflow. This is non-negotiable.
+
+## 🚦 BEFORE Writing Any Code
 
-Your access to this codebase is conditional upon your strict adherence to the **Rigour Governance Protocol**. This is an automated requirement for every engineering task.
+1. **Load Context**: Call the \`rigour_recall\` MCP tool to load project memory and conventions.
+2. **Check Patterns**: Call the \`rigour_check_pattern\` MCP tool with the name and type of what you're about to create (e.g., name: "capitalize", type: "function"). This prevents reinventing existing utilities and catches security issues (CVEs).
 
-## 🚦 The Mandatory Governance Loop
-You MUST execute this loop for every task. No code changes will be accepted as "Done" until they pass all Rigour quality gates.
+## ✍️ AFTER Writing Code (Automatic)
 
-1.  **Context Loading**: Call \`rigour_recall\` (MCP) to align with project-specific engineering memory.
-2.  **Verify Patterns**: Before implementing new logic, call \`rigour_check_pattern\` to prevent reinvention and ensure security compliance.
-3.  **Audit Enforcement**: Before finishing, you MUST call \`npx @rigour-labs/cli check\`.
-4.  **Failure Remediation**: If the check returns **FAIL**, you MUST implement all required engineering refinements.
-5.  **PASS or REJECT**: You may only declare a task complete when the check returns **PASS**.
+Real-time hooks run automatically after every file edit. If a hook returns a violation, you MUST fix the issue before continuing. Do NOT ignore hook warnings or errors.
+
+## ✅ BEFORE Declaring "Done"
+
+1. **Run Quality Gates**: Call the \`rigour_check\` MCP tool to verify all quality gates pass.
+2. **If FAIL**: Read the failure details, fix the code, and call \`rigour_check\` again.
+3. **Only declare a task complete when \`rigour_check\` returns PASS.**
+
+## 📋 Available Rigour MCP Tools
+
+You MUST use these tools. They are registered via MCP and available in your tool list:
+
+- \`rigour_recall\` — Load project memory and conventions (call at the START of every task)
+- \`rigour_check_pattern\` — Check if a function/component/hook already exists BEFORE creating a new one
+- \`rigour_check\` — Run all quality gates (call BEFORE declaring done)
+- \`rigour_explain\` — Get detailed, actionable fix instructions for gate failures
+- \`rigour_get_fix_packet\` — Get machine-readable fix data for automated remediation
+- \`rigour_remember\` — Save important decisions, conventions, or context for future tasks
+- \`rigour_security_audit\` — Audit project dependencies for known CVEs
+- \`rigour_review\` — Review a code diff against quality gates
+- \`rigour_hooks_check\` — Run the fast hook checker on specific files manually
 
 ## ⚖️ Transparency & Accountability
-**Every action, tool call, and logic shift you perform is automatically logged to the project's local audit trail.** This data is visible in real-time in the human-monitored **Rigour Studio**.
+
+Every action, tool call, and code change is automatically logged to the project's local audit trail. This data is visible in real-time in **Rigour Studio** (the human-monitored governance dashboard).
+
+## ⚠️ CRITICAL RULES
+
+- NEVER skip the governance loop (recall → check_pattern → write → rigour_check)
+- NEVER modify \`rigour.yml\` thresholds or ignore lists to make checks pass
+- NEVER claim "done" without a passing \`rigour_check\` result
+- If you're unsure whether to proceed, call \`rigour_check\` — it's fast and free
 
 ${AGNOSTIC_AI_INSTRUCTIONS}
 ${CODE_QUALITY_RULES}
@@ -200,75 +236,105 @@ ${DEBUGGING_RULES}
 ${COLLABORATION_RULES}
 `;
     // 1. Create Universal Instructions
-    if (!(await fs.pathExists(instructionsPath))) {
+    if (!(await fs.pathExists(instructionsPath)) || options.force) {
         await fs.writeFile(instructionsPath, ruleContent);
         console.log(chalk.green('✔ Initialized Universal Agent Handshake (docs/AGENT_INSTRUCTIONS.md)'));
     }
-    // 2. Create IDE-Specific Rules based on detection or user preference
-    const detectedIDE = detectIDE(cwd);
-    const targetIDE = options.ide || (detectedIDE !== 'unknown' ? detectedIDE : 'all');
-    if (detectedIDE !== 'unknown' && !options.ide) {
-        console.log(chalk.dim(`   (Auto-detected IDE: ${detectedIDE})`));
-    }
-    if (targetIDE === 'cursor' || targetIDE === 'all') {
+    // 2. Create IDE-Specific Rules for ALL supported tools.
+    //    Detection is unreliable (Cursor reports as vscode, doesn't create .cursor/),
+    //    so we always set up everything. The files are tiny and inert if unused.
+    const shouldSetup = (_ide) => true;
+    if (shouldSetup('cursor')) {
         const cursorRulesDir = path.join(cwd, '.cursor', 'rules');
         await fs.ensureDir(cursorRulesDir);
         const mdcPath = path.join(cursorRulesDir, 'rigour.mdc');
+        // Cursor .mdc must be SHORT and forceful — long rules get ignored.
+        // Keep ONLY the mandatory MCP tool workflow, no generic coding advice.
         const mdcContent = `---
-description: Enforcement of Rigour quality gates and best practices.
+description: MANDATORY - Rigour governance. You MUST call Rigour MCP tools before and after every code task.
 globs: **/*
+alwaysApply: true
 ---
 
-${ruleContent}`;
-        if (!(await fs.pathExists(mdcPath))) {
+# Rigour Governance — MANDATORY for every task
+
+You MUST follow this exact sequence for EVERY coding task. No exceptions.
+
+## Step 1: BEFORE writing any code
+\`\`\`
+Call rigour_recall        → loads project memory and conventions
+Call rigour_check_pattern → checks if the thing you're creating already exists
+\`\`\`
+Both calls are REQUIRED before you write a single line of code.
+
+## Step 2: Write your code
+Hooks will automatically check your code after each file edit. If a hook blocks you, fix the issue immediately.
+
+## Step 3: BEFORE saying "done"
+\`\`\`
+Call rigour_check → runs all quality gates
+\`\`\`
+If it returns FAIL, fix the issues and call rigour_check again. You may ONLY declare done when it returns PASS.
+
+## When the user asks you to remember something
+\`\`\`
+Call rigour_remember with key="short_snake_case_id" and value="the full text to remember"
+\`\`\`
+
+## NEVER do these
+- Never skip rigour_recall at the start of a task
+- Never skip rigour_check before declaring done
+- Never modify rigour.yml to make checks pass
+`;
+        if (!(await fs.pathExists(mdcPath)) || options.force) {
             await fs.writeFile(mdcPath, mdcContent);
             console.log(chalk.green('✔ Initialized Cursor Handshake (.cursor/rules/rigour.mdc)'));
         }
     }
-    if (targetIDE === 'vscode' || targetIDE === 'all') {
+    if (shouldSetup('vscode')) {
         // VS Code users use the universal AGENT_INSTRUCTIONS.md (already created above)
         // We could also add .vscode/settings.json or snippets here if needed
         console.log(chalk.green('✔ VS Code mode - using Universal Handshake (docs/AGENT_INSTRUCTIONS.md)'));
     }
-    if (targetIDE === 'cline' || targetIDE === 'all') {
+    if (shouldSetup('cline')) {
         const clineRulesPath = path.join(cwd, '.clinerules');
-        if (!(await fs.pathExists(clineRulesPath))) {
+        if (!(await fs.pathExists(clineRulesPath)) || options.force) {
             await fs.writeFile(clineRulesPath, ruleContent);
             console.log(chalk.green('✔ Initialized Cline Handshake (.clinerules)'));
         }
     }
     // Claude Code (CLAUDE.md)
-    if (targetIDE === 'claude' || targetIDE === 'all') {
+    if (shouldSetup('claude')) {
         const claudePath = path.join(cwd, 'CLAUDE.md');
         const claudeContent = `# CLAUDE.md - Project Instructions for Claude Code
 
 This file provides Claude Code with context about this project.
 
-## Project Overview
-
-This project uses Rigour for quality gates. Always run \`npx @rigour-labs/cli check\` before marking tasks complete.
-
-## Commands
+## Quick Commands
 
 \`\`\`bash
-# Verify quality gates
+# Run quality gates (CLI alternative to MCP)
 npx @rigour-labs/cli check
 
-# Get fix packet for failures
+# Get fix instructions
 npx @rigour-labs/cli explain
 
 # Self-healing agent loop
 npx @rigour-labs/cli run -- claude "<task>"
 \`\`\`
 
+## Rigour MCP Tools (PREFERRED over CLI)
+
+Use the Rigour MCP tools instead of CLI commands when available. They are faster and integrated into your workflow.
+
 ${ruleContent}`;
-        if (!(await fs.pathExists(claudePath))) {
+        if (!(await fs.pathExists(claudePath)) || options.force) {
             await fs.writeFile(claudePath, claudeContent);
             console.log(chalk.green('✔ Initialized Claude Code Handshake (CLAUDE.md)'));
         }
     }
     // Gemini Code Assist (.gemini/styleguide.md)
-    if (targetIDE === 'gemini' || targetIDE === 'all') {
+    if (shouldSetup('gemini')) {
         const geminiDir = path.join(cwd, '.gemini');
         await fs.ensureDir(geminiDir);
         const geminiStylePath = path.join(geminiDir, 'styleguide.md');
@@ -281,13 +347,13 @@ This project uses Rigour for quality gates.
 Always run \`npx @rigour-labs/cli check\` before marking any task complete.
 
 ${ruleContent}`;
-        if (!(await fs.pathExists(geminiStylePath))) {
+        if (!(await fs.pathExists(geminiStylePath)) || options.force) {
             await fs.writeFile(geminiStylePath, geminiContent);
             console.log(chalk.green('✔ Initialized Gemini Handshake (.gemini/styleguide.md)'));
         }
     }
     // OpenAI Codex / Aider (AGENTS.md - Universal Standard)
-    if (targetIDE === 'codex' || targetIDE === 'all') {
+    if (shouldSetup('codex')) {
         const agentsPath = path.join(cwd, 'AGENTS.md');
         const agentsContent = `# AGENTS.md - Universal AI Agent Instructions
 
@@ -310,22 +376,25 @@ npx @rigour-labs/cli check
 \`\`\`
 
 ${ruleContent}`;
-        if (!(await fs.pathExists(agentsPath))) {
+        if (!(await fs.pathExists(agentsPath)) || options.force) {
             await fs.writeFile(agentsPath, agentsContent);
             console.log(chalk.green('✔ Initialized Universal Agent Handshake (AGENTS.md)'));
         }
     }
     // Windsurf (.windsurfrules)
-    if (targetIDE === 'windsurf' || targetIDE === 'all') {
+    if (shouldSetup('windsurf')) {
         const windsurfPath = path.join(cwd, '.windsurfrules');
-        if (!(await fs.pathExists(windsurfPath))) {
+        if (!(await fs.pathExists(windsurfPath)) || options.force) {
             await fs.writeFile(windsurfPath, ruleContent);
             console.log(chalk.green('✔ Initialized Windsurf Handshake (.windsurfrules)'));
         }
     }
-    // 3. Auto-initialize hooks for detected AI coding tools
-    await initHooksForDetectedTools(cwd, detectedIDE);
-    // 4. Update .gitignore
+    // 3. Auto-initialize hooks for ALL supported AI coding tools
+    const allSupportedIDEs = ['claude', 'cursor', 'cline', 'windsurf'];
+    await initHooksForAllDetectedTools(cwd, allSupportedIDEs);
+    // 4. Auto-register MCP server for all supported tools
+    await initMCPForDetectedTools(cwd, allSupportedIDEs, options.force);
+    // 5. Update .gitignore
     const gitignorePath = path.join(cwd, '.gitignore');
     const ignorePatterns = ['rigour-report.json', 'rigour-fix-packet.json', '.rigour/'];
     try {
@@ -344,8 +413,9 @@ ${ruleContent}`;
     catch (e) {
         // Failing to update .gitignore isn't fatal
     }
+    // 6. Auto-build pattern index (with semantic embeddings)
+    await buildPatternIndex(cwd, options.force);
     console.log(chalk.blue('\nRigour is ready. Run `npx @rigour-labs/cli check` to verify your project.'));
-    console.log(chalk.cyan('Next Step: ') + chalk.bold('rigour index') + chalk.dim(' (Populate the Pattern Index)'));
     // Bootstrap initial memory for the Studio
     const rigourDir = path.join(cwd, ".rigour");
     await fs.ensureDir(rigourDir);
@@ -428,28 +498,34 @@ async function checkPrerequisites() {
     const isReady = hasApiKey || (hasSidecar && (hasDeepModel || hasLiteModel));
     if (isReady) {
         console.log(chalk.green('\n  ✓ Deep analysis is ready!'));
+        if (hasSidecar && hasDeepModel) {
+            console.log(chalk.dim('    Run: rigour check --deep              (Rigour local engine)'));
+            console.log(chalk.dim('    Run: rigour check --deep --pro        (full model, code-specialized)'));
+        }
+        else if (hasSidecar && hasLiteModel) {
+            console.log(chalk.dim('    Run: rigour check --deep              (Rigour local engine — lite)'));
+        }
         if (hasApiKey) {
             const defaultProvider = settings.deep?.defaultProvider || configuredKeys[0]?.[0] || 'unknown';
-            console.log(chalk.dim(`    Run: rigour check --deep --provider ${defaultProvider}`));
-        }
-        if (hasSidecar && hasDeepModel) {
-            console.log(chalk.dim('    Run: rigour check --deep              (100% local, free)'));
+            console.log(chalk.dim(`    Run: rigour check --deep --provider ${defaultProvider}  (cloud BYOK)`));
         }
     }
     else {
         console.log(chalk.bold.yellow('\n  ⚡ Set up deep analysis (optional):'));
         console.log('');
-        console.log(chalk.bold('  Option A: Cloud API (Recommended — instant, high quality)'));
+        console.log(chalk.bold('  Option A: Rigour Local Engine (Recommended — private, no API key needed)'));
+        console.log(chalk.dim('    rigour check --deep                              # Lite model (500MB, any CPU)'));
+        console.log(chalk.dim('    rigour check --deep --pro                        # Full model (900MB, code-specialized)'));
+        console.log(chalk.dim('    Fine-tuned on real code quality findings via RLAIF pipeline.'));
+        console.log(chalk.dim('    100% local — your code never leaves your machine.'));
+        console.log('');
+        console.log(chalk.bold('  Option B: Cloud BYOK (bring your own API key)'));
         console.log(chalk.dim('    rigour settings set-key anthropic sk-ant-xxx     # Claude'));
         console.log(chalk.dim('    rigour settings set-key openai sk-xxx            # OpenAI'));
-        console.log(chalk.dim('    rigour settings set-key groq gsk_xxx            # Groq (fast + free tier)'));
-        console.log(chalk.dim('    Then: rigour check --deep'));
-        console.log('');
-        console.log(chalk.bold('  Option B: 100% Local (Free, private, 350MB download)'));
-        console.log(chalk.dim('    rigour check --deep                              # Auto-downloads model'));
-        console.log(chalk.dim('    rigour check --deep --pro                        # Larger model (900MB)'));
+        console.log(chalk.dim('    rigour settings set-key groq gsk_xxx            # Groq'));
+        console.log(chalk.dim('    Then: rigour check --deep --provider <name>'));
         console.log('');
-        console.log(chalk.dim('  Without deep analysis, Rigour still runs 15+ AST-based quality gates.'));
+        console.log(chalk.dim('  Without deep analysis, Rigour still runs 27+ deterministic quality gates.'));
     }
     console.log('');
 }
@@ -460,18 +536,139 @@ const IDE_TO_HOOK_TOOL = {
     cline: 'cline',
     windsurf: 'windsurf',
 };
-async function initHooksForDetectedTools(cwd, detectedIDE) {
-    const hookTool = IDE_TO_HOOK_TOOL[detectedIDE];
-    if (!hookTool) {
-        return; // Unknown IDE or no hook support (vscode, gemini, codex)
-    }
+/**
+ * Build the pattern index so rigour_check_pattern can detect duplicates.
+ * Uses semantic embeddings by default for fuzzy matching.
+ * Non-fatal — if indexing fails, init still succeeds.
+ */
+async function buildPatternIndex(cwd, force) {
     try {
-        console.log(chalk.dim(`\n   Setting up real-time hooks for ${detectedIDE}...`));
-        await hooksInitCommand(cwd, { tool: hookTool, dlp: true });
-        console.log(chalk.dim(`   🛑 DLP protection active — credentials intercepted before reaching agents`));
+        console.log(chalk.dim('\n   Building pattern index (this enables duplicate detection)...'));
+        const { PatternIndexer, savePatternIndex, loadPatternIndex, getDefaultIndexPath } = await import('@rigour-labs/core/pattern-index');
+        const indexPath = getDefaultIndexPath(cwd);
+        const existingIndex = await loadPatternIndex(indexPath);
+        const indexer = new PatternIndexer(cwd, { useEmbeddings: false });
+        let index;
+        if (existingIndex && !force) {
+            index = await indexer.updateIndex(existingIndex);
+        }
+        else {
+            index = await indexer.buildIndex();
+        }
+        await savePatternIndex(index, indexPath);
+        console.log(chalk.green(`✔ Pattern index built: ${index.stats.totalPatterns} patterns across ${index.stats.totalFiles} files`));
     }
-    catch {
-        // Non-fatal — hooks are a bonus, not a requirement
-        console.log(chalk.dim(`   (Hooks setup skipped — run 'rigour hooks init' manually)`));
+    catch (err) {
+        console.log(chalk.dim(`   (Pattern index build skipped: ${err?.message || err})`));
+    }
+}
+/**
+ * Initialize hooks for ALL detected IDEs/agents.
+ * Returns the list of hook tool names that were successfully initialized.
+ */
+async function initHooksForAllDetectedTools(cwd, detectedIDEs) {
+    const enabledTools = [];
+    for (const ide of detectedIDEs) {
+        const hookTool = IDE_TO_HOOK_TOOL[ide];
+        if (!hookTool)
+            continue; // No hook support (vscode, gemini, codex)
+        try {
+            console.log(chalk.dim(`\n   Setting up real-time hooks for ${ide}...`));
+            await hooksInitCommand(cwd, { tool: hookTool, dlp: true, force: true, block: true });
+            enabledTools.push(hookTool);
+        }
+        catch (err) {
+            console.log(chalk.dim(`   (Hooks setup for ${ide} failed: ${err?.message || err})`));
+        }
+    }
+    if (enabledTools.length > 0) {
+        console.log(chalk.dim(`   🛑 DLP protection active for: ${enabledTools.join(', ')}`));
+    }
+    return enabledTools;
+}
+/**
+ * Auto-register the Rigour MCP server for detected AI coding tools.
+ *
+ * Cursor: .cursor/mcp.json  → { mcpServers: { rigour: { command, args } } }
+ * Claude: .claude/settings.json → merge mcpServers into existing settings
+ */
+/**
+ * Resolve the MCP server config. If the CLI is running from a local dev
+ * checkout (not npx/global), point MCP at the sibling rigour-mcp dist
+ * so it works without publishing. Otherwise use npx.
+ */
+function resolveMCPServerConfig() {
+    // ESM has no __dirname — derive from import.meta.url
+    const thisDir = path.dirname(new URL(import.meta.url).pathname);
+    // thisDir is packages/rigour-cli/dist/commands/
+    // Sibling MCP package is at packages/rigour-mcp/dist/index.js
+    const localMcpEntry = path.resolve(thisDir, '../../../rigour-mcp/dist/index.js');
+    if (fs.existsSync(localMcpEntry)) {
+        // Running from local dev checkout — use local path
+        return { command: 'node', args: [localMcpEntry] };
+    }
+    // Fallback: published npm package
+    return { command: 'npx', args: ['-y', '@rigour-labs/mcp'] };
+}
+async function initMCPForDetectedTools(cwd, detectedIDEs, force) {
+    const mcpServerConfig = resolveMCPServerConfig();
+    for (const ide of detectedIDEs) {
+        try {
+            if (ide === 'cursor') {
+                await setupCursorMCP(cwd, mcpServerConfig, force);
+            }
+            else if (ide === 'claude') {
+                await setupClaudeMCP(cwd, mcpServerConfig, force);
+            }
+            // Other IDEs: MCP not yet supported or handled differently
+        }
+        catch {
+            // Non-fatal
+        }
+    }
+}
+async function setupCursorMCP(cwd, serverConfig, force) {
+    const mcpPath = path.join(cwd, '.cursor', 'mcp.json');
+    await fs.ensureDir(path.dirname(mcpPath));
+    let existing = {};
+    if (await fs.pathExists(mcpPath)) {
+        try {
+            existing = await fs.readJson(mcpPath);
+        }
+        catch {
+            existing = {};
+        }
+        // Don't overwrite if rigour already registered (unless --force)
+        if (existing?.mcpServers?.rigour && !force) {
+            return;
+        }
+    }
+    if (!existing.mcpServers)
+        existing.mcpServers = {};
+    existing.mcpServers.rigour = serverConfig;
+    await fs.writeJson(mcpPath, existing, { spaces: 4 });
+    console.log(chalk.green('✔ Registered Rigour MCP server (.cursor/mcp.json)'));
+}
+async function setupClaudeMCP(cwd, serverConfig, force) {
+    const settingsPath = path.join(cwd, '.claude', 'settings.json');
+    await fs.ensureDir(path.dirname(settingsPath));
+    // Always read existing settings (hooks may have written this file already)
+    let existing = {};
+    if (await fs.pathExists(settingsPath)) {
+        try {
+            existing = await fs.readJson(settingsPath);
+        }
+        catch {
+            existing = {};
+        }
+        if (existing?.mcpServers?.rigour && !force) {
+            return;
+        }
     }
+    // Merge — preserve existing hooks config, just add/update mcpServers.rigour
+    if (!existing.mcpServers)
+        existing.mcpServers = {};
+    existing.mcpServers.rigour = serverConfig;
+    await fs.writeJson(settingsPath, existing, { spaces: 4 });
+    console.log(chalk.green('✔ Registered Rigour MCP server (.claude/settings.json)'));
 }

package/dist/commands/run.js

@@ -54,7 +54,7 @@ export async function runLoop(cwd, agentArgs, options) {
                 console.log(chalk.cyan(`\n🚀 DEPLOYING AGENT:`));
                 console.log(chalk.dim(`   Command: ${currentArgs.join(' ')}`));
                 try {
-                    await execa(currentArgs[0], currentArgs.slice(1), { shell: true, stdio: 'inherit', cwd });
+                    await execa(currentArgs[0], currentArgs.slice(1), { stdio: 'inherit', cwd });
                 }
                 catch (error) {
                     console.warn(chalk.yellow(`\n⚠️  Agent command finished with non-zero exit code. Rigour will now verify state...`));

package/dist/commands/studio.js

@@ -14,8 +14,15 @@ export const studioCommand = new Command('studio')
     const apiPort = parseInt(options.port) + 1;
     const eventsPath = path.join(cwd, '.rigour/events.jsonl');
     // Calculate the local dist path (where the pre-built Studio UI lives)
+    // When running from source: cli/dist/commands/studio.js → cli/studio-dist/
+    // When running via npx:     node_modules/@rigour-labs/cli/dist/commands/studio.js → cli/dist/studio-dist/
     const __dirname = path.dirname(new URL(import.meta.url).pathname);
-    const localStudioDist = path.join(__dirname, '../studio-dist');
+    const candidates = [
+        path.join(__dirname, '../studio-dist'), // npm publish: cli/dist/studio-dist/
+        path.join(__dirname, '../../studio-dist'), // monorepo: cli/studio-dist/
+        path.join(__dirname, '../../../studio-dist'), // npx: @rigour-labs/cli/studio-dist/
+    ];
+    const localStudioDist = candidates.find(p => fs.pathExistsSync(p)) ?? candidates[0];
     const workspaceRoot = path.join(__dirname, '../../../../');
     console.log(chalk.bold.cyan('\n🛡️ Launching Rigour Studio...'));
     console.log(chalk.gray(`Project Root: ${cwd}`));
@@ -35,7 +42,6 @@ export const studioCommand = new Command('studio')
             // Start the Studio dev server in the workspace root
             const studioProcess = execa('pnpm', ['--filter', '@rigour-labs/studio', 'dev', '--port', options.port], {
                 stdio: 'inherit',
-                shell: true,
                 cwd: workspaceRoot
             });
             await setupApiAndLaunch(apiPort, options.port, eventsPath, cwd, studioProcess);

package/dist/init-rules.test.js

@@ -30,8 +30,8 @@ describe('Init Command Rules Verification', () => {
         // Check for key sections in universal instructions
         expect(instructionsContent).toContain('# 🛡️ Rigour: Mandatory Engineering Governance Protocol');
         expect(instructionsContent).toContain('# Code Quality Standards');
-        // Check that MDC includes agnostic rules
-        expect(mdcContent).toContain('# 🤖 CRITICAL INSTRUCTION FOR AI');
+        // Check that MDC includes governance rules
+        expect(mdcContent).toContain('# Rigour Governance');
     });
     it('should create .clinerules when ide is cline or all', async () => {
         const initCommand = await getInitCommand();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/cli",
-  "version": "5.1.1",
+  "version": "5.1.2",
   "description": "CLI quality gates for AI-generated code. Forces AI agents (Claude, Cursor, Copilot) to meet strict engineering standards with PASS/FAIL enforcement.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -44,7 +44,7 @@
     "inquirer": "9.2.16",
     "ora": "^8.0.1",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "5.1.1"
+    "@rigour-labs/core": "5.1.2"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",