@rigour-labs/cli 5.1.2 → 5.2.1

package/dist/cli.js

@@ -16,6 +16,9 @@ import { settingsShowCommand, settingsSetKeyCommand, settingsRemoveKeyCommand, s
 import { doctorCommand } from './commands/doctor.js';
 import { brainCommand } from './commands/brain.js';
 import { deepStatsCommand } from './commands/deep-stats.js';
+import { reviewCommand } from './commands/review.js';
+import { checkPatternCommand } from './commands/check-pattern.js';
+import { securityAuditCommand } from './commands/security-audit.js';
 import { checkForUpdates } from './utils/version.js';
 import { getCliVersion } from './utils/cli-version.js';
 import chalk from 'chalk';
@@ -202,6 +205,60 @@ program
     .action(async () => {
     await doctorCommand();
 });
+program
+    .command('review')
+    .description('Review a diff against quality gates (filter to changed lines)')
+    .option('--json', 'Output report in JSON format')
+    .option('--ci', 'CI mode (minimal output)')
+    .option('-c, --config <path>', 'Path to custom rigour.yml configuration')
+    .option('--diff <path>', 'Path to diff file (reads stdin if omitted)')
+    .option('--files <paths>', 'Comma-separated list of changed files (auto-detected from diff if omitted)')
+    .option('--deep', 'Enable deep LLM-powered analysis')
+    .option('--pro', 'Use full deep model for analysis')
+    .option('-k, --api-key <key>', 'Cloud API key for deep analysis')
+    .option('--provider <name>', 'Cloud provider for deep analysis')
+    .option('--api-base-url <url>', 'Custom API base URL')
+    .option('--model-name <name>', 'Override cloud model name')
+    .addHelpText('after', `
+Examples:
+  $ git diff | rigour review --json                    # Review staged changes (JSON)
+  $ git diff main..HEAD | rigour review                # Review branch changes
+  $ rigour review --diff changes.patch --deep          # Review diff file with deep analysis
+  $ git diff | rigour review --ci                      # CI-friendly review
+    `)
+    .action(async (options) => {
+    await reviewCommand(process.cwd(), options);
+});
+program
+    .command('check-pattern')
+    .description('Check if a pattern already exists, is stale, or has security issues')
+    .requiredOption('-n, --name <name>', 'Name of the function, class, or component to create')
+    .option('-t, --type <type>', 'Pattern type (function, component, hook, class)')
+    .option('-i, --intent <intent>', 'What the code is for (e.g., "format dates", "import lodash")')
+    .option('--json', 'Output report in JSON format')
+    .addHelpText('after', `
+Examples:
+  $ rigour check-pattern --name useDebounce --type hook             # Check before creating hook
+  $ rigour check-pattern --name formatDate --type function --json   # JSON output
+  $ rigour check-pattern --name lodash --intent "import lodash"     # Checks CVEs too
+    `)
+    .action(async (options) => {
+    await checkPatternCommand(process.cwd(), options);
+});
+program
+    .command('security-audit')
+    .description('Run a CVE security audit on project dependencies')
+    .option('--json', 'Output report in JSON format')
+    .option('--ci', 'CI mode (minimal output)')
+    .addHelpText('after', `
+Examples:
+  $ rigour security-audit                 # Human-readable security report
+  $ rigour security-audit --json          # Machine-readable JSON
+  $ rigour security-audit --ci            # CI pipeline integration
+    `)
+    .action(async (options) => {
+    await securityAuditCommand(process.cwd(), options);
+});
 const hooksCmd = program
     .command('hooks')
     .description('Manage AI coding tool hook integrations');

package/dist/commands/check-pattern.d.ts

@@ -0,0 +1,7 @@
+export interface CheckPatternOptions {
+    name: string;
+    type?: string;
+    intent?: string;
+    json?: boolean;
+}
+export declare function checkPatternCommand(cwd: string, options: CheckPatternOptions): Promise<void>;

package/dist/commands/check-pattern.js

@@ -0,0 +1,143 @@
+/**
+ * Pattern Check CLI Command
+ *
+ * Wraps the same core logic as the MCP `rigour_check_pattern` tool.
+ * Three-layer check before creating new code:
+ * 1. Reinvention detection (pattern index fuzzy match)
+ * 2. Staleness / anti-pattern detection
+ * 3. Security / CVE check (when intent includes imports)
+ *
+ * Usage:
+ *   rigour check-pattern --name useDebounce --type hook --intent "debounce user input"
+ *   rigour check-pattern --name formatDate --type function --json
+ */
+import chalk from 'chalk';
+import { PatternMatcher, loadPatternIndex, getDefaultIndexPath, StalenessDetector, SecurityDetector, } from '@rigour-labs/core/pattern-index';
+const EXIT_PASS = 0;
+const EXIT_FAIL = 1;
+const EXIT_INTERNAL_ERROR = 3;
+export async function checkPatternCommand(cwd, options) {
+    const { name: patternName, type, intent } = options;
+    if (!patternName) {
+        if (options.json) {
+            console.log(JSON.stringify({ error: 'INPUT_ERROR', message: '--name is required' }));
+        }
+        else {
+            console.error(chalk.red('Error: --name is required.'));
+        }
+        process.exit(EXIT_FAIL);
+    }
+    try {
+        const findings = [];
+        // 1. Check for Reinvention
+        const indexPath = getDefaultIndexPath(cwd);
+        const index = await loadPatternIndex(indexPath);
+        if (index) {
+            const matcher = new PatternMatcher(index);
+            const matchResult = await matcher.match({ name: patternName, type, intent });
+            if (matchResult.status === 'FOUND_SIMILAR') {
+                findings.push({
+                    level: 'error',
+                    category: 'reinvention',
+                    message: `Similar pattern already exists: "${matchResult.matches[0].pattern.name}" in ${matchResult.matches[0].pattern.file}`,
+                    suggestion: matchResult.suggestion,
+                });
+            }
+        }
+        else {
+            findings.push({
+                level: 'info',
+                category: 'index_missing',
+                message: 'Pattern index not found. Run `rigour index` to enable reinvention detection.',
+            });
+        }
+        // 2. Check for Staleness / Anti-patterns
+        const detector = new StalenessDetector(cwd);
+        const staleness = await detector.checkStaleness(`${type || 'function'} ${patternName} {}`);
+        if (staleness.status !== 'FRESH') {
+            for (const issue of staleness.issues) {
+                findings.push({
+                    level: 'warning',
+                    category: 'staleness',
+                    message: issue.reason,
+                    suggestion: issue.replacement,
+                });
+            }
+        }
+        // 3. Security / CVE check (when intent suggests imports)
+        if (intent && intent.includes('import')) {
+            const security = new SecurityDetector(cwd);
+            const audit = await security.runAudit();
+            const relatedVulns = audit.vulnerabilities.filter((v) => patternName.toLowerCase().includes(v.packageName.toLowerCase()) ||
+                intent.toLowerCase().includes(v.packageName.toLowerCase()));
+            if (relatedVulns.length > 0) {
+                for (const v of relatedVulns) {
+                    findings.push({
+                        level: 'error',
+                        category: 'security',
+                        message: `[${v.severity.toUpperCase()}] ${v.packageName}: ${v.title}`,
+                        suggestion: v.url,
+                    });
+                }
+            }
+        }
+        // Determine overall status
+        const hasErrors = findings.some(f => f.level === 'error');
+        const hasWarnings = findings.some(f => f.level === 'warning');
+        const status = hasErrors ? 'FAIL' : 'PASS';
+        // Determine recommendation
+        let recommendation = 'Proceed with implementation.';
+        if (findings.some(f => f.category === 'reinvention')) {
+            recommendation = 'STOP and REUSE the existing pattern. Do not create a duplicate.';
+        }
+        else if (findings.some(f => f.category === 'security')) {
+            recommendation = 'STOP and update dependencies or find an alternative.';
+        }
+        else if (hasWarnings) {
+            recommendation = 'Proceed with caution, addressing the warnings above.';
+        }
+        // JSON output
+        if (options.json) {
+            const jsonOutput = JSON.stringify({
+                status,
+                pattern: patternName,
+                type: type || 'function',
+                intent: intent || '',
+                findings,
+                recommendation,
+            }, null, 2);
+            process.stdout.write(jsonOutput + '\n', () => {
+                process.exit(status === 'PASS' ? EXIT_PASS : EXIT_FAIL);
+            });
+            return;
+        }
+        // Human-readable output
+        console.log(chalk.bold(`\nPattern Check: ${patternName}\n`));
+        if (findings.length === 0) {
+            console.log(chalk.green(`✅ Pattern "${patternName}" is fresh, secure, and unique to the codebase.\n`));
+        }
+        else {
+            for (const f of findings) {
+                const icon = f.level === 'error' ? chalk.red('🚨') :
+                    f.level === 'warning' ? chalk.yellow('⚠️') :
+                        chalk.dim('ℹ️');
+                console.log(`${icon} [${f.category.toUpperCase()}] ${f.message}`);
+                if (f.suggestion) {
+                    console.log(chalk.cyan(`   → ${f.suggestion}`));
+                }
+            }
+            console.log('');
+        }
+        console.log(chalk.bold(`Recommendation: ${recommendation}\n`));
+        process.exit(status === 'PASS' ? EXIT_PASS : EXIT_FAIL);
+    }
+    catch (error) {
+        if (options.json) {
+            console.log(JSON.stringify({ error: 'INTERNAL_ERROR', message: error.message }));
+        }
+        else {
+            console.error(chalk.red(`Internal error: ${error.message}`));
+        }
+        process.exit(EXIT_INTERNAL_ERROR);
+    }
+}

package/dist/commands/demo-display.js

@@ -227,7 +227,21 @@ export function printClosing(cinematic) {
     console.log(chalk.white('  $ npx @rigour-labs/cli check'));
     console.log(chalk.white('  $ npx @rigour-labs/cli hooks init'));
     console.log('');
-    console.log(chalk.dim('GitHub: https://github.com/rigour-labs/rigour'));
+    // ── Rigovo Ecosystem ──
+    console.log(divider);
+    console.log(chalk.bold('Rigovo Ecosystem — AI-Native Engineering Platform\n'));
+    console.log(chalk.bold('  Rigour'));
+    console.log(chalk.dim('  Quality gates for AI-generated code (this tool)'));
+    console.log(chalk.dim('  27+ deterministic gates + local LLM deep analysis'));
+    console.log(chalk.white('  https://github.com/rigour-labs/rigour\n'));
+    console.log(chalk.bold('  Rigovo HR'));
+    console.log(chalk.dim('  AI-powered technical hiring — Maya AI interviewer'));
+    console.log(chalk.dim('  15-signal verification, job success prediction, evidence reports'));
+    console.log(chalk.white('  https://rigovo.com\n'));
+    console.log(chalk.bold('  Rigovo Virtual Team'));
+    console.log(chalk.dim('  Multi-agent software delivery with deterministic quality gates'));
+    console.log(chalk.dim('  Planning → Coding → Review → QA → Security → DevOps pipeline'));
+    console.log(chalk.white('  https://github.com/rigovo/rigovo-virtual-team\n'));
     console.log(chalk.dim('Docs:   https://docs.rigour.run'));
     console.log(chalk.dim('Paper:  https://zenodo.org/records/18673564\n'));
     console.log(chalk.dim.italic('If this saved you from a bad commit, star the repo ⭐'));

package/dist/commands/demo-scenarios.js

@@ -2,7 +2,7 @@ import fs from 'fs-extra';
 import path from 'path';
 import chalk from 'chalk';
 import yaml from 'yaml';
-import { GateRunner, ConfigSchema } from '@rigour-labs/core';
+import { GateRunner, ConfigSchema, IncrementalCache, FileScanner } from '@rigour-labs/core';
 import { recordScore } from '@rigour-labs/core';
 import { pause, typewrite } from './demo-helpers.js';
 import { simulateCodeWrite, simulateHookCatch, renderScoreBar, renderTrendChart, displayGateResults, } from './demo-display.js';
@@ -192,6 +192,27 @@ export async function handleRequest(req: express.Request, res: express.Response)
             console.log(chalk.green.bold('  All issues resolved!'));
         }
         console.log('');
+        // ── Incremental Cache Demo ──
+        // Save cache after the rescan, then run a third scan to show cache hit
+        try {
+            const allFiles = await FileScanner.findFiles({ cwd: demoDir, ignore: config.ignore });
+            const cache = new IncrementalCache(demoDir);
+            await cache.save(allFiles, configContent, report2);
+            await pause(300, options);
+            console.log(chalk.bold.blue('Running scan again (no changes)...\n'));
+            await pause(200, options);
+            const cacheStart = Date.now();
+            const cacheResult = await cache.check(allFiles, configContent);
+            const cacheMs = Date.now() - cacheStart;
+            if (cacheResult.hit) {
+                console.log(chalk.green.bold(`  ⚡ Incremental cache hit — ${cacheMs}ms (no files changed)`));
+                console.log(chalk.dim(`  Skipped all 27+ gates. Same result returned instantly.`));
+                console.log(chalk.dim(`  Use --no-cache to force a full re-scan.\n`));
+            }
+        }
+        catch {
+            // Cache demo is best-effort
+        }
     }
     catch (error) {
         const msg = error instanceof Error ? error.message : String(error);

package/dist/commands/review.d.ts

@@ -0,0 +1,14 @@
+export interface ReviewOptions {
+    json?: boolean;
+    ci?: boolean;
+    config?: string;
+    diff?: string;
+    files?: string;
+    deep?: boolean;
+    pro?: boolean;
+    apiKey?: string;
+    provider?: string;
+    apiBaseUrl?: string;
+    modelName?: string;
+}
+export declare function reviewCommand(cwd: string, options?: ReviewOptions): Promise<void>;

package/dist/commands/review.js

@@ -0,0 +1,241 @@
+/**
+ * Code Review CLI Command
+ *
+ * Wraps the same core logic as the MCP `rigour_review` tool.
+ * Parses a git diff (from stdin or --diff flag), runs quality gates
+ * on changed files, and filters failures to modified lines only.
+ *
+ * Usage:
+ *   git diff | rigour review --json
+ *   rigour review --diff path/to/diff.patch --json
+ *   rigour review --json --files src/a.ts,src/b.ts  (stdin diff)
+ */
+import fs from 'fs-extra';
+import path from 'path';
+import chalk from 'chalk';
+import yaml from 'yaml';
+import { GateRunner, ConfigSchema, resolveDeepOptions } from '@rigour-labs/core';
+const EXIT_PASS = 0;
+const EXIT_FAIL = 1;
+const EXIT_CONFIG_ERROR = 2;
+const EXIT_INTERNAL_ERROR = 3;
+/**
+ * Parse unified diff into a mapping of file → modified line numbers.
+ * Same logic as MCP's parseDiff utility.
+ */
+function parseDiff(diff) {
+    const lines = diff.split('\n');
+    const mapping = {};
+    let currentFile = '';
+    let currentLine = 0;
+    for (const line of lines) {
+        if (line.startsWith('+++ b/')) {
+            currentFile = line.slice(6);
+            mapping[currentFile] = new Set();
+        }
+        else if (line.startsWith('@@')) {
+            const match = line.match(/\+(\d+)/);
+            if (match) {
+                currentLine = parseInt(match[1], 10);
+            }
+        }
+        else if (line.startsWith('+') && !line.startsWith('+++')) {
+            if (currentFile) {
+                mapping[currentFile].add(currentLine);
+            }
+            currentLine++;
+        }
+        else if (!line.startsWith('-')) {
+            currentLine++;
+        }
+    }
+    return mapping;
+}
+async function readStdin() {
+    if (process.stdin.isTTY)
+        return '';
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks).toString('utf-8');
+}
+export async function reviewCommand(cwd, options = {}) {
+    // Load diff from --diff file, or stdin
+    let diffContent = '';
+    if (options.diff) {
+        const diffPath = path.resolve(cwd, options.diff);
+        if (!(await fs.pathExists(diffPath))) {
+            if (options.json) {
+                console.log(JSON.stringify({ error: 'INPUT_ERROR', message: `Diff file not found: ${diffPath}` }));
+            }
+            else {
+                console.error(chalk.red(`Error: Diff file not found: ${diffPath}`));
+            }
+            process.exit(EXIT_CONFIG_ERROR);
+        }
+        diffContent = await fs.readFile(diffPath, 'utf-8');
+    }
+    else {
+        diffContent = await readStdin();
+    }
+    if (!diffContent.trim()) {
+        if (options.json) {
+            console.log(JSON.stringify({ status: 'PASS', score: 100, failures: [], message: 'No diff provided' }));
+        }
+        else {
+            console.log(chalk.green('No diff provided — nothing to review.'));
+        }
+        process.exit(EXIT_PASS);
+    }
+    // Load config
+    const configPath = options.config ? path.resolve(cwd, options.config) : path.join(cwd, 'rigour.yml');
+    if (!(await fs.pathExists(configPath))) {
+        if (options.json) {
+            console.log(JSON.stringify({ error: 'CONFIG_ERROR', message: `Config file not found: ${configPath}` }));
+        }
+        else {
+            console.error(chalk.red(`Error: Config file not found at ${configPath}. Run \`rigour init\` first.`));
+        }
+        process.exit(EXIT_CONFIG_ERROR);
+    }
+    try {
+        const configContent = await fs.readFile(configPath, 'utf-8');
+        const config = ConfigSchema.parse(yaml.parse(configContent));
+        // Parse diff into file→line mapping
+        const diffMapping = parseDiff(diffContent);
+        const explicitFiles = options.files ? options.files.split(',').map(f => f.trim()) : undefined;
+        const targetFiles = explicitFiles || Object.keys(diffMapping);
+        if (targetFiles.length === 0) {
+            if (options.json) {
+                console.log(JSON.stringify({ status: 'PASS', score: 100, failures: [] }));
+            }
+            else {
+                console.log(chalk.green('No changed files detected in diff.'));
+            }
+            process.exit(EXIT_PASS);
+        }
+        const isDeep = !!options.deep || !!options.pro || !!options.apiKey;
+        const isSilent = !!options.ci || !!options.json;
+        if (!isSilent) {
+            console.log(chalk.blue(`Reviewing ${targetFiles.length} file(s)...`));
+            if (isDeep)
+                console.log(chalk.blue.bold('Deep analysis enabled.\n'));
+        }
+        const runner = new GateRunner(config);
+        // Build deep options if enabled
+        let deepOpts;
+        if (isDeep) {
+            const resolved = resolveDeepOptions({
+                apiKey: options.apiKey,
+                provider: options.provider,
+                apiBaseUrl: options.apiBaseUrl,
+                modelName: options.modelName,
+            });
+            const hasApiKey = !!resolved.apiKey;
+            deepOpts = {
+                enabled: true,
+                pro: !!options.pro,
+                apiKey: resolved.apiKey,
+                provider: hasApiKey ? (resolved.provider || 'claude') : 'local',
+                apiBaseUrl: resolved.apiBaseUrl,
+                modelName: resolved.modelName,
+            };
+        }
+        const report = await runner.run(cwd, targetFiles, deepOpts);
+        // Filter failures to only those on changed lines (or global gate failures)
+        const filteredFailures = report.failures.filter(failure => {
+            if (!failure.files || failure.files.length === 0)
+                return true;
+            return failure.files.some(file => {
+                const fileModifiedLines = diffMapping[file];
+                if (!fileModifiedLines)
+                    return false;
+                if (failure.line !== undefined)
+                    return fileModifiedLines.has(failure.line);
+                return true;
+            });
+        });
+        const status = filteredFailures.length > 0 ? 'FAIL' : 'PASS';
+        // JSON output
+        if (options.json) {
+            const jsonOutput = JSON.stringify({
+                status,
+                score: report.stats.score,
+                ai_health_score: report.stats.ai_health_score,
+                structural_score: report.stats.structural_score,
+                total_failures: report.failures.length,
+                filtered_failures: filteredFailures.length,
+                failures: filteredFailures.map(f => ({
+                    id: f.id,
+                    gate: f.title,
+                    severity: f.severity || 'medium',
+                    provenance: f.provenance || 'traditional',
+                    message: f.details,
+                    file: f.files?.[0] || '',
+                    line: f.line || 1,
+                    suggestion: f.hint,
+                })),
+            }, null, 2);
+            process.stdout.write(jsonOutput + '\n', () => {
+                process.exit(status === 'PASS' ? EXIT_PASS : EXIT_FAIL);
+            });
+            return;
+        }
+        // CI output
+        if (options.ci) {
+            const scoreStr = report.stats.score !== undefined ? ` (${report.stats.score}/100)` : '';
+            if (status === 'PASS') {
+                console.log(`PASS${scoreStr}`);
+            }
+            else {
+                console.log(`FAIL: ${filteredFailures.length} violation(s) on changed lines${scoreStr}`);
+                for (const f of filteredFailures) {
+                    const sev = (f.severity || 'medium').toUpperCase();
+                    console.log(`  - [${sev}] ${f.files?.[0] || ''}:${f.line || '?'} ${f.title}`);
+                }
+            }
+            process.exit(status === 'PASS' ? EXIT_PASS : EXIT_FAIL);
+        }
+        // Human-readable output
+        if (status === 'PASS') {
+            console.log(chalk.green.bold('\n✔ PASS — No quality issues on changed lines.\n'));
+        }
+        else {
+            console.log(chalk.red.bold(`\n✘ FAIL — ${filteredFailures.length} issue(s) on changed lines.\n`));
+            for (const f of filteredFailures) {
+                const sev = (f.severity || 'medium').toUpperCase();
+                console.log(`  ${chalk.red(`[${sev}]`)} ${f.files?.[0] || '?'}:${f.line || '?'}`);
+                console.log(`    ${f.title}`);
+                if (f.hint)
+                    console.log(chalk.cyan(`    → ${f.hint}`));
+                console.log('');
+            }
+            if (report.failures.length > filteredFailures.length) {
+                console.log(chalk.dim(`  (${report.failures.length - filteredFailures.length} additional issue(s) on unchanged lines were excluded)\n`));
+            }
+        }
+        process.exit(status === 'PASS' ? EXIT_PASS : EXIT_FAIL);
+    }
+    catch (error) {
+        if (error.name === 'ZodError') {
+            if (options.json) {
+                console.log(JSON.stringify({ error: 'CONFIG_ERROR', details: error.issues }));
+            }
+            else {
+                console.error(chalk.red('Invalid rigour.yml configuration:'));
+                error.issues.forEach((issue) => {
+                    console.error(chalk.red(`  • ${issue.path.join('.')}: ${issue.message}`));
+                });
+            }
+            process.exit(EXIT_CONFIG_ERROR);
+        }
+        if (options.json) {
+            console.log(JSON.stringify({ error: 'INTERNAL_ERROR', message: error.message }));
+        }
+        else {
+            console.error(chalk.red(`Internal error: ${error.message}`));
+        }
+        process.exit(EXIT_INTERNAL_ERROR);
+    }
+}

package/dist/commands/security-audit.d.ts

@@ -0,0 +1,5 @@
+export interface SecurityAuditOptions {
+    json?: boolean;
+    ci?: boolean;
+}
+export declare function securityAuditCommand(cwd: string, options?: SecurityAuditOptions): Promise<void>;

package/dist/commands/security-audit.js

@@ -0,0 +1,63 @@
+/**
+ * Security Audit CLI Command
+ *
+ * Wraps the same core logic as the MCP `rigour_security_audit` tool.
+ * Runs CVE scanning against project dependencies.
+ *
+ * Usage:
+ *   rigour security-audit
+ *   rigour security-audit --json
+ */
+import chalk from 'chalk';
+import { SecurityDetector } from '@rigour-labs/core/pattern-index';
+const EXIT_PASS = 0;
+const EXIT_FAIL = 1;
+const EXIT_INTERNAL_ERROR = 3;
+export async function securityAuditCommand(cwd, options = {}) {
+    try {
+        const security = new SecurityDetector(cwd);
+        if (options.json) {
+            // For JSON mode, get the raw audit data
+            const audit = await security.runAudit();
+            const status = audit.vulnerabilities.length > 0 ? 'FAIL' : 'PASS';
+            const jsonOutput = JSON.stringify({
+                status,
+                total_vulnerabilities: audit.vulnerabilities.length,
+                vulnerabilities: audit.vulnerabilities.map((v) => ({
+                    package: v.packageName,
+                    severity: v.severity,
+                    title: v.title,
+                    url: v.url,
+                    fixAvailable: v.fixAvailable,
+                })),
+            }, null, 2);
+            process.stdout.write(jsonOutput + '\n', () => {
+                process.exit(status === 'PASS' ? EXIT_PASS : EXIT_FAIL);
+            });
+            return;
+        }
+        // Human-readable: delegate to SecurityDetector's formatted summary
+        const summary = await security.getSecuritySummary();
+        if (options.ci) {
+            // CI mode: compact
+            console.log(summary.includes('No known vulnerabilities') ? 'PASS' : 'FAIL');
+            console.log(summary);
+            const hasVulns = !summary.includes('No known vulnerabilities');
+            process.exit(hasVulns ? EXIT_FAIL : EXIT_PASS);
+        }
+        console.log(chalk.bold('\nSecurity Audit\n'));
+        console.log(summary);
+        console.log('');
+        const hasVulns = !summary.includes('No known vulnerabilities');
+        process.exit(hasVulns ? EXIT_FAIL : EXIT_PASS);
+    }
+    catch (error) {
+        if (options.json) {
+            console.log(JSON.stringify({ error: 'INTERNAL_ERROR', message: error.message }));
+        }
+        else {
+            console.error(chalk.red(`Internal error: ${error.message}`));
+        }
+        process.exit(EXIT_INTERNAL_ERROR);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/cli",
-  "version": "5.1.2",
+  "version": "5.2.1",
   "description": "CLI quality gates for AI-generated code. Forces AI agents (Claude, Cursor, Copilot) to meet strict engineering standards with PASS/FAIL enforcement.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -44,7 +44,7 @@
     "inquirer": "9.2.16",
     "ora": "^8.0.1",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "5.1.2"
+    "@rigour-labs/core": "5.2.1"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",