@rigour-labs/cli 5.2.9 → 5.3.1

package/dist/cli.js

@@ -225,6 +225,9 @@ Examples:
   $ git diff main..HEAD | rigour review                # Review branch changes
   $ rigour review --diff changes.patch --deep          # Review diff file with deep analysis
   $ git diff | rigour review --ci                      # CI-friendly review
+  $ git diff main..HEAD | rigour review --files src/a.ts,src/b.ts
+
+Tip: Use in CI to gate only lines you changed — faster than full rigour check on large repos.
     `)
     .action(async (options) => {
     await reviewCommand(process.cwd(), options);
@@ -261,7 +264,20 @@ Examples:
 });
 const hooksCmd = program
     .command('hooks')
-    .description('Manage AI coding tool hook integrations');
+    .description('Manage AI coding tool hook integrations (file checks + DLP credential scanning)')
+    .addHelpText('after', `
+DLP false-positive learning:
+  When a hook blocks your prompt incorrectly, teach Rigour once:
+  $ rigour hooks check --dlp-allow-last
+
+  Learned patterns are stored per-project in .rigour/dlp-feedback.json.
+  Real secrets (provider API keys, AWS keys) are never learned away.
+
+Examples:
+  $ rigour hooks init --tool cursor
+  $ rigour hooks check --mode dlp --stdin
+  $ rigour hooks check --dlp-allow-last
+    `);
 hooksCmd
     .command('init')
     .description('Generate hook configs for AI coding tools (Claude, Cursor, Cline, Windsurf)')
@@ -289,15 +305,25 @@ hooksCmd
     .option('--timeout <ms>', 'Timeout in milliseconds (default: 5000)')
     .option('--mode <mode>', 'Check mode: "check" (default) or "dlp" (credential scanning)')
     .option('--agent <name>', 'Agent name for DLP audit trail (e.g., cursor, claude)')
+    .option('--dlp-allow-last', 'Record last DLP block as learned false positives (hook feedback)')
     .addHelpText('after', `
 Examples:
   $ rigour hooks check --files src/app.ts
   $ rigour hooks check --files src/a.ts,src/b.ts --block
   $ echo '{"file_path":"src/app.ts"}' | rigour hooks check --stdin
   $ echo 'AWS_SECRET=AKIA...' | rigour hooks check --mode dlp --stdin
+  $ rigour hooks check --dlp-allow-last
+
+DLP learning:
+  After a false-positive block, run --dlp-allow-last to store the detection shape
+  in .rigour/dlp-feedback.json. Future scans allow matching patterns on the same line.
+  Provider keys and high-confidence secrets are never learned away.
     `)
     .action(async (options) => {
-    await hooksCheckCommand(process.cwd(), options);
+    await hooksCheckCommand(process.cwd(), {
+        ...options,
+        dlpAllowLast: options.dlpAllowLast,
+    });
 });
 // Settings management (like Claude Code's settings.json)
 const settingsCmd = program

package/dist/commands/guide.js

@@ -9,9 +9,16 @@ export function guideCommand() {
     console.log(chalk.yellow('  • Fix Packet v2') + chalk.dim(': Structured diagnostics fed directly into AI agents.'));
     console.log(chalk.yellow('  • File Guard') + chalk.dim(': Protects critical paths from agent modification (max files changed).'));
     console.log(chalk.yellow('  • Security Patterns') + chalk.dim(': Detects XSS, SQL injection, hardcoded secrets, command injection (enabled by default).'));
+    console.log(chalk.yellow('  • DLP Hooks') + chalk.dim(': Scans prompts for credentials before they reach the model. Learns from false positives over time.'));
     console.log(chalk.yellow('  • Strategic Guardians') + chalk.dim(': Dependency and Architectural boundary enforcement.\n'));
+    console.log(chalk.bold('Hooks & DLP Learning:'));
+    console.log(chalk.dim('  1. Run ') + chalk.cyan('rigour hooks init') + chalk.dim(' to wire Cursor/Claude/Cline/Windsurf hooks.'));
+    console.log(chalk.dim('  2. When DLP blocks a prompt falsely, run ') + chalk.cyan('rigour hooks check --dlp-allow-last'));
+    console.log(chalk.dim('     to teach Rigour that pattern is safe (stored in ') + chalk.cyan('.rigour/dlp-feedback.json') + chalk.dim(').'));
+    console.log(chalk.dim('  3. Real provider keys (OpenAI, AWS, etc.) still block — learning only relaxes generic shapes.\n'));
     console.log(chalk.bold('Workflow Integration:'));
     console.log(chalk.green('  • Cursor') + chalk.dim(': Add the MCP server or use the ') + chalk.cyan('.cursor/rules/rigour.mdc') + chalk.dim(' handshake.'));
-    console.log(chalk.green('  • CI/CD') + chalk.dim(': Use ') + chalk.cyan('rigour check --ci') + chalk.dim(' to fail PRs that violate quality gates.\n'));
+    console.log(chalk.green('  • CI/CD') + chalk.dim(': Use ') + chalk.cyan('rigour check --ci') + chalk.dim(' to fail PRs that violate quality gates.'));
+    console.log(chalk.green('  • PR Review') + chalk.dim(': Pipe diffs through ') + chalk.cyan('rigour review') + chalk.dim(' to gate only changed lines.\n'));
     console.log(chalk.dim('For more detailed docs, visit: ') + chalk.underline('https://github.com/erashu212/rigour/docs\n'));
 }

package/dist/commands/hooks.d.ts

@@ -30,6 +30,8 @@ export interface HooksCheckOptions {
     mode?: 'check' | 'dlp';
     /** Agent name for audit trail (DLP mode) */
     agent?: string;
+    /** Record last DLP block detections as learned false positives (hook feedback) */
+    dlpAllowLast?: boolean;
 }
 export declare function hooksInitCommand(cwd: string, options?: HooksOptions): Promise<void>;
 export declare function hooksCheckCommand(cwd: string, options?: HooksCheckOptions): Promise<void>;

package/dist/commands/hooks.js

@@ -17,7 +17,7 @@ import fs from 'fs-extra';
 import path from 'path';
 import chalk from 'chalk';
 import { randomUUID } from 'crypto';
-import { runHookChecker, scanInputForCredentials, formatDLPAlert, createDLPAuditEntry } from '@rigour-labs/core';
+import { runHookChecker, scanInputForCredentials, formatDLPAlert, createDLPAuditEntry, writeDLPBlockManifest, allowLastDLPBlock } from '@rigour-labs/core';
 // ── Studio event logging ─────────────────────────────────────────────
 const MAX_EVENT_LOG_LINES = 2000;
 async function logStudioEvent(cwd, event) {
@@ -499,6 +499,12 @@ function extractCursorPromptText(payload) {
     return '';
 }
 export async function hooksCheckCommand(cwd, options = {}) {
+    // ── Learn from last DLP false positive (hook feedback loop) ──
+    if (options.dlpAllowLast) {
+        const count = await allowLastDLPBlock(cwd, 'hook');
+        process.stdout.write(JSON.stringify({ learned: count, message: `Recorded ${count} detection(s) as false positives` }));
+        return;
+    }
     // ── DLP Mode: Scan text for credentials ──────────────────
     if (options.mode === 'dlp') {
         let rawInput = options.stdin
@@ -528,6 +534,8 @@ export async function hooksCheckCommand(cwd, options = {}) {
         const result = scanInputForCredentials(textToScan, {
             enabled: true,
             block_on_detection: options.block ?? true,
+            cwd,
+            use_learned_feedback: true,
         });
         // Return Cursor-compatible format if detected as Cursor hook
         if (cursorMode) {
@@ -537,7 +545,7 @@ export async function hooksCheckCommand(cwd, options = {}) {
                     .join('\n');
                 process.stdout.write(JSON.stringify({
                     continue: false,
-                    user_message: `🛑 Rigour DLP: ${result.detections.length} credential(s) detected in your prompt:\n${messages}\n\nReplace with environment variable references before submitting.`,
+                    user_message: `🛑 Rigour DLP: ${result.detections.length} credential(s) detected in your prompt:\n${messages}\n\nReplace with environment variable references before submitting.\n\nIf this is a false positive, run: rigour hooks check --dlp-allow-last`,
                 }));
             }
             else {
@@ -560,6 +568,12 @@ export async function hooksCheckCommand(cwd, options = {}) {
                 // Silent
             }
             if (result.status === 'blocked') {
+                try {
+                    await writeDLPBlockManifest(cwd, result.detections, textToScan);
+                }
+                catch {
+                    // best-effort
+                }
                 process.exitCode = 2;
             }
         }

package/dist/commands/init.js

@@ -298,6 +298,19 @@ npx @rigour-labs/cli check   # Run quality gates (must PASS before task is done)
 npx @rigour-labs/cli explain # Explain failures
 \`\`\`
 
+## Context Efficiency Protocol
+
+Follow this workflow to minimize token usage without compromising quality:
+
+1. \`rigour_recall\` — load project memory at session start
+2. \`rigour_index\` — if the pattern index is missing or stale
+3. \`rigour_agent_register\` — claim a bounded task scope
+4. \`rigour_context_scope\` — get minimal file list before reading source files
+5. \`rigour_check_pattern\` — verify no reinvention before writing new code
+6. Work — only touch files in the scoped edit set
+7. \`rigour_checkpoint\` — every 30 minutes or before handoff
+8. \`rigour_check\` — quality gate unchanged (must PASS before done)
+
 ${ruleContent}`;
         if (!(await fs.pathExists(agentsPath)) || options.force) {
             await fs.writeFile(agentsPath, agentsContent);

package/dist/commands/studio.js

@@ -363,6 +363,139 @@ async function setupApiAndLaunch(apiPort, studioPort, eventsPath, cwd, studioPro
                 res.end(JSON.stringify({ totalScans: 0 }));
             }
         }
+        else if (url.pathname === '/api/context-stats') {
+            try {
+                const { getTaskContextStats } = await import('@rigour-labs/core');
+                const taskId = url.searchParams.get('taskId') || undefined;
+                const stats = await getTaskContextStats(taskId, cwd);
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(stats));
+            }
+            catch (e) {
+                res.writeHead(500);
+                res.end(JSON.stringify({ error: e.message }));
+            }
+        }
+        else if (url.pathname === '/api/task-cost') {
+            try {
+                const { getTaskCostStats } = await import('@rigour-labs/core');
+                const taskId = url.searchParams.get('taskId') || undefined;
+                const costStats = await getTaskCostStats(taskId, cwd);
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(costStats));
+            }
+            catch (e) {
+                res.writeHead(500);
+                res.end(JSON.stringify({ error: e.message }));
+            }
+        }
+        else if (url.pathname === '/api/cache-stats') {
+            try {
+                const { getCacheStats } = await import('@rigour-labs/core');
+                const stats = await getCacheStats(cwd);
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(stats));
+            }
+            catch (e) {
+                res.writeHead(500);
+                res.end(JSON.stringify({ error: e.message }));
+            }
+        }
+        else if (url.pathname === '/api/context-explain') {
+            try {
+                const { explainContext } = await import('@rigour-labs/core');
+                const target = url.searchParams.get('target') || 'all';
+                const taskId = url.searchParams.get('taskId') || undefined;
+                const explanation = await explainContext(target, taskId, cwd);
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(explanation));
+            }
+            catch (e) {
+                res.writeHead(500);
+                res.end(JSON.stringify({ error: e.message }));
+            }
+        }
+        else if (url.pathname === '/api/context-scope') {
+            try {
+                const { getContextScopeSummary } = await import('@rigour-labs/core');
+                const summary = await getContextScopeSummary(cwd);
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(summary));
+            }
+            catch (e) {
+                res.writeHead(500);
+                res.end(JSON.stringify({ error: e.message }));
+            }
+        }
+        else if (url.pathname === '/api/checkpoint-metrics') {
+            try {
+                const { getCheckpointSummary } = await import('@rigour-labs/core');
+                const taskId = url.searchParams.get('taskId') || undefined;
+                const summary = await getCheckpointSummary(taskId, cwd);
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(summary));
+            }
+            catch (e) {
+                res.writeHead(500);
+                res.end(JSON.stringify({ error: e.message }));
+            }
+        }
+        else if (url.pathname === '/api/cursor-api-key/status') {
+            try {
+                const { getCursorApiKey } = await import('@rigour-labs/core');
+                const configured = Boolean(getCursorApiKey());
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ configured }));
+            }
+            catch (e) {
+                res.writeHead(500);
+                res.end(JSON.stringify({ error: e.message }));
+            }
+        }
+        else if (url.pathname === '/api/cursor-api-key' && req.method === 'POST') {
+            let body = '';
+            req.on('data', chunk => body += chunk);
+            req.on('end', async () => {
+                try {
+                    const { apiKey } = JSON.parse(body || '{}');
+                    if (!apiKey || typeof apiKey !== 'string' || !apiKey.trim()) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Missing apiKey' }));
+                        return;
+                    }
+                    const { updateCursorApiKey } = await import('@rigour-labs/core');
+                    updateCursorApiKey(apiKey.trim());
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ success: true, configured: true }));
+                }
+                catch (e) {
+                    res.writeHead(500);
+                    res.end(JSON.stringify({ error: e.message }));
+                }
+            });
+        }
+        else if (url.pathname === '/api/import-cursor-usage' && req.method === 'POST') {
+            let body = '';
+            req.on('data', chunk => body += chunk);
+            req.on('end', async () => {
+                try {
+                    const { importCursorUsageCsv, importCursorUsageJson } = await import('@rigour-labs/core');
+                    let importedCount = 0;
+                    if (body.trim().startsWith('{') || body.trim().startsWith('[')) {
+                        importedCount = await importCursorUsageJson(JSON.parse(body), cwd);
+                    }
+                    else {
+                        importedCount = await importCursorUsageCsv(body, cwd);
+                    }
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ success: true, importedCount }));
+                }
+                catch (e) {
+                    res.writeHead(500);
+                    res.end(JSON.stringify({ error: e.message }));
+                }
+            });
+        }
         else if (url.pathname === '/api/arbitrate' && req.method === 'POST') {
             let body = '';
             req.on('data', chunk => body += chunk);

package/package.json

@@ -1,68 +1,68 @@
 {
-  "name": "@rigour-labs/cli",
-  "version": "5.2.9",
-  "description": "AI-native quality gates with local LLM analysis. Forces AI agents (Claude, Cursor, Copilot, Cline, Windsurf) to meet engineering standards. Bayesian Brain learns your codebase. Zero config: npx rigour-scan.",
-  "license": "MIT",
-  "homepage": "https://rigour.run",
-  "keywords": [
-    "ai",
-    "llm",
-    "ai-code-quality",
-    "ai-agent",
-    "quality-gates",
-    "cli",
-    "linter",
-    "static-analysis",
-    "security",
-    "vibe-coding",
-    "claude",
-    "cursor",
-    "copilot",
-    "cline",
-    "windsurf",
-    "mcp",
-    "code-review",
-    "ci-cd",
-    "fix-packets",
-    "agent-governance"
-  ],
-  "type": "module",
-  "bin": {
-    "rigour": "dist/cli.js"
-  },
-  "files": [
-    "dist",
-    "studio-dist",
-    "templates"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/rigour-labs/rigour"
-  },
-  "publishConfig": {
-    "access": "public",
-    "provenance": true
-  },
-  "dependencies": {
-    "chalk": "^5.3.0",
-    "commander": "^12.0.0",
-    "cosmiconfig": "^9.0.0",
-    "execa": "^8.0.1",
-    "fs-extra": "^11.2.0",
-    "globby": "^14.0.1",
-    "inquirer": "9.2.16",
-    "ora": "^8.0.1",
-    "yaml": "^2.8.2",
-    "@rigour-labs/core": "5.2.9"
-  },
-  "devDependencies": {
-    "@types/fs-extra": "^11.0.4",
-    "@types/inquirer": "9.0.7",
-    "@types/node": "^25.0.3"
-  },
-  "scripts": {
-    "build": "tsc && pnpm bundle-studio",
-    "bundle-studio": "node scripts/bundle-studio.js",
-    "test": "vitest run"
-  }
-}
+    "name": "@rigour-labs/cli",
+    "version": "5.3.1",
+    "description": "AI-native quality gates with local LLM analysis. Forces AI agents (Claude, Cursor, Copilot, Cline, Windsurf) to meet engineering standards. Bayesian Brain learns your codebase. Zero config: npx rigour-scan.",
+    "license": "MIT",
+    "homepage": "https://rigour.run",
+    "keywords": [
+        "ai",
+        "llm",
+        "ai-code-quality",
+        "ai-agent",
+        "quality-gates",
+        "cli",
+        "linter",
+        "static-analysis",
+        "security",
+        "vibe-coding",
+        "claude",
+        "cursor",
+        "copilot",
+        "cline",
+        "windsurf",
+        "mcp",
+        "code-review",
+        "ci-cd",
+        "fix-packets",
+        "agent-governance"
+    ],
+    "type": "module",
+    "bin": {
+        "rigour": "dist/cli.js"
+    },
+    "files": [
+        "dist",
+        "studio-dist",
+        "templates"
+    ],
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/rigour-labs/rigour"
+    },
+    "publishConfig": {
+        "access": "public",
+        "provenance": true
+    },
+    "scripts": {
+        "build": "tsc && pnpm bundle-studio",
+        "bundle-studio": "node scripts/bundle-studio.js",
+        "test": "vitest run"
+    },
+    "dependencies": {
+        "@rigour-labs/core": "workspace:*",
+        "chalk": "^5.3.0",
+        "commander": "^12.0.0",
+        "cosmiconfig": "^9.0.0",
+        "execa": "^8.0.1",
+        "fs-extra": "^11.2.0",
+        "globby": "^14.0.1",
+        "inquirer": "9.2.16",
+        "ora": "^8.0.1",
+        "yaml": "^2.8.2"
+    },
+    "devDependencies": {
+        "@types/fs-extra": "^11.0.4",
+        "@types/inquirer": "9.0.7",
+        "@types/node": "^25.0.3"
+    }
+}