@rigour-labs/cli 5.5.4 → 6.1.0-beta.1

package/dist/cli.js

@@ -19,6 +19,8 @@ import { deepStatsCommand } from './commands/deep-stats.js';
 import { reviewCommand } from './commands/review.js';
 import { checkPatternCommand } from './commands/check-pattern.js';
 import { securityAuditCommand } from './commands/security-audit.js';
+import { firewallTransactCommand, firewallAdversarialCommand, firewallAdmitCommand, firewallStatusCommand } from './commands/firewall.js';
+import { teamCommand } from './commands/team.js';
 import { checkForUpdates } from './utils/version.js';
 import { getCliVersion } from './utils/cli-version.js';
 import chalk from 'chalk';
@@ -28,6 +30,7 @@ program.addCommand(indexCommand);
 program.addCommand(studioCommand);
 program.addCommand(brainCommand);
 program.addCommand(deepStatsCommand);
+program.addCommand(teamCommand);
 program
     .name('rigour')
     .description('🛡️ Rigour: The Quality Gate Loop for AI-Assisted Engineering')
@@ -363,6 +366,28 @@ settingsCmd
     .command('path')
     .description('Show settings file path')
     .action(async () => { await settingsPathCommand(); });
+const firewallCmd = program
+    .command('firewall')
+    .description('Agent Transaction Firewall — mediate, attest, and prove damage bounds');
+firewallCmd
+    .command('status')
+    .description('Show transaction, attestation, and adversarial status')
+    .action(async () => { await firewallStatusCommand(process.cwd()); });
+firewallCmd
+    .command('transact')
+    .description('Start a mediated transaction, verify gates, COMMIT or DISCARD')
+    .option('--agent <id>', 'Agent id for scope binding')
+    .option('--scope <globs>', 'Comma-separated allowed path globs', '**/*')
+    .option('--discard', 'Discard the current transaction worktree')
+    .action(async (options) => { await firewallTransactCommand(process.cwd(), options); });
+firewallCmd
+    .command('adversarial')
+    .description('Replay deterministic adversarial corpus against the firewall kernel')
+    .action(async () => { await firewallAdversarialCommand(process.cwd()); });
+firewallCmd
+    .command('admit')
+    .description('CI admission: require valid signed attestation with PASS gates')
+    .action(async () => { await firewallAdmitCommand(process.cwd()); });
 // Check for updates before parsing (non-blocking)
 (async () => {
     try {

package/dist/commands/firewall.d.ts

@@ -0,0 +1,9 @@
+export declare function firewallTransactCommand(cwd: string, options: {
+    agent?: string;
+    scope?: string;
+    discard?: boolean;
+    commit?: boolean;
+}): Promise<void>;
+export declare function firewallAdversarialCommand(cwd: string): Promise<void>;
+export declare function firewallAdmitCommand(cwd: string): Promise<void>;
+export declare function firewallStatusCommand(cwd: string): Promise<void>;

package/dist/commands/firewall.js

@@ -0,0 +1,106 @@
+/**
+ * Firewall CLI — transact, adversarial replay, CI admit.
+ */
+import chalk from 'chalk';
+import fs from 'fs-extra';
+import path from 'path';
+import yaml from 'yaml';
+import { TransactionRunner, runAdversarialCorpus, persistAdversarialReport, createAttestation, admitForCi, loadLatestAttestation, verifyAttestation, loadCurrentTransaction, listTransactions, GateRunner, ConfigSchema, loadAgentScopesFromDisk, } from '@rigour-labs/core';
+export async function firewallTransactCommand(cwd, options) {
+    if (options.discard) {
+        const current = await loadCurrentTransaction(cwd);
+        if (!current) {
+            console.error(chalk.red('No current transaction to discard'));
+            process.exit(1);
+        }
+        const discarded = await TransactionRunner.fromRecord(cwd, current).discard();
+        console.log(chalk.yellow(`DISCARD ${discarded.id}`));
+        return;
+    }
+    const registered = await loadAgentScopesFromDisk(cwd);
+    if (registered.length > 0 && !options.agent) {
+        console.error(chalk.red('Agent scopes are registered — pass --agent <id> to bind the writer (fail-closed)'));
+        process.exit(1);
+    }
+    const scope = (options.scope || '**/*').split(',').map(s => s.trim()).filter(Boolean);
+    const tx = new TransactionRunner(cwd, { agentId: options.agent, scope });
+    const started = await tx.start();
+    console.log(chalk.cyan(`START transaction ${started.id}`));
+    const gateCwd = started.worktreePath || cwd;
+    if (started.worktreePath) {
+        console.log(chalk.dim(`Worktree: ${started.worktreePath}`));
+    }
+    try {
+        await tx.syncWorktreeChanges();
+    }
+    catch (e) {
+        await tx.discard();
+        console.error(chalk.red(`DISCARD — scope/budget: ${e.message}`));
+        process.exit(1);
+    }
+    const configPath = path.join(cwd, 'rigour.yml');
+    let config = ConfigSchema.parse({ version: 1 });
+    if (await fs.pathExists(configPath)) {
+        config = ConfigSchema.parse(yaml.parse(await fs.readFile(configPath, 'utf-8')));
+    }
+    const runner = new GateRunner(config);
+    const { ok, gateResults } = await tx.verify(async () => {
+        const report = await runner.run(gateCwd);
+        const failedGates = [...new Set(report.failures.map(f => f.id))];
+        return { status: report.status, failedGates, score: report.stats.score };
+    });
+    if (!ok) {
+        const discarded = await tx.discard();
+        console.log(chalk.red(`DISCARD ${discarded.id} — gates ${gateResults.status}`));
+        process.exit(1);
+    }
+    const committed = await tx.commit();
+    const attestation = await createAttestation(cwd, {
+        transaction: committed,
+        gateResults: {
+            status: gateResults.status,
+            score: gateResults.score,
+            failedGates: gateResults.failedGates,
+        },
+        verifyRoot: gateCwd,
+    });
+    console.log(chalk.green(`COMMIT ${committed.id}`));
+    console.log(chalk.green(`Attestation ${attestation.signature.slice(0, 12)}… tree=${(attestation.treeDigest || '').slice(0, 12)} policy=${attestation.policyHash}`));
+}
+export async function firewallAdversarialCommand(cwd) {
+    const report = runAdversarialCorpus();
+    const out = await persistAdversarialReport(cwd, report);
+    console.log(chalk.bold(`Adversarial replay: ${report.passed} passed, ${report.failed} failed`));
+    for (const r of report.results) {
+        const mark = r.passed ? chalk.green('PASS') : chalk.red('FAIL');
+        console.log(`  ${mark} ${r.caseId}: expected=${r.expected} actual=${r.actual} — ${r.reason}`);
+        if (r.suggestedRule) {
+            console.log(chalk.yellow('    suggested regression:\n') + chalk.dim(r.suggestedRule));
+        }
+    }
+    console.log(chalk.dim(`Report: ${out}`));
+    if (report.failed > 0)
+        process.exit(1);
+}
+export async function firewallAdmitCommand(cwd) {
+    const result = await admitForCi(cwd);
+    if (!result.admit) {
+        console.error(chalk.red(`ADMIT DENIED: ${result.reason}`));
+        process.exit(1);
+    }
+    const bundle = await loadLatestAttestation(cwd);
+    const valid = bundle ? await verifyAttestation(cwd, bundle) : false;
+    console.log(chalk.green(`ADMIT OK: ${result.reason} (signature ${valid ? 'valid' : 'n/a'})`));
+}
+export async function firewallStatusCommand(cwd) {
+    const current = await loadCurrentTransaction(cwd);
+    const txs = await listTransactions(cwd);
+    const attestation = await loadLatestAttestation(cwd);
+    const advPath = path.join(cwd, '.rigour', 'adversarial-report.json');
+    const adv = await fs.pathExists(advPath) ? await fs.readJson(advPath) : null;
+    console.log(chalk.bold('Firewall status'));
+    console.log(`  Current TX: ${current ? `${current.id} (${current.status})` : 'none'}`);
+    console.log(`  Transactions: ${txs.length}`);
+    console.log(`  Attestation: ${attestation ? `${attestation.transactionId} gates=${attestation.gateResults.status}` : 'none'}`);
+    console.log(`  Adversarial: ${adv ? `${adv.passed} pass / ${adv.failed} fail` : 'not run'}`);
+}

package/dist/commands/hooks.js

@@ -18,7 +18,7 @@ import path from 'path';
 import chalk from 'chalk';
 import { randomUUID } from 'crypto';
 import { fileURLToPath } from 'url';
-import { runHookChecker, scanInputForCredentials, formatDLPAlert, createDLPAuditEntry, writeDLPBlockManifest, allowLastDLPBlock } from '@rigour-labs/core';
+import { allowLastDLPBlock, createDLPAuditEntry, formatDLPAlert, recordInteractionEvidence, recordInteractionLesson, runHookChecker, scanInputForCredentials, updateAutomaticIndexForFiles, writeDLPBlockManifest, } from '@rigour-labs/core';
 function getHookCliVersion() {
     const thisDir = path.dirname(fileURLToPath(import.meta.url));
     const packagePath = path.resolve(thisDir, '../../package.json');
@@ -648,7 +648,28 @@ export async function hooksCheckCommand(cwd, options = {}) {
         cwd,
         files,
         timeout_ms: Number.isFinite(timeout) ? timeout : 5000,
+        agentId: options.agent || process.env.RIGOUR_AGENT_ID,
     });
+    const requestId = randomUUID();
+    const outcome = result.status === 'pass' ? 'success' : result.status === 'fail' ? 'rejected' : 'error';
+    await Promise.allSettled([
+        updateAutomaticIndexForFiles(cwd, files),
+        recordInteractionEvidence(cwd, {
+            tool: 'rigour_hooks_check', requestId, phase: 'response', outcome,
+            deterministic: result.status === 'pass', agentId: options.agent || process.env.RIGOUR_AGENT_ID,
+            files, summary: `${result.failures.length} finding(s)`,
+        }),
+        recordInteractionLesson(cwd, {
+            tool: 'rigour_hooks_check', requestId, outcome,
+            deterministic: result.status === 'pass', agentId: options.agent || process.env.RIGOUR_AGENT_ID,
+            files, summary: `${result.failures.length} finding(s)`,
+        }),
+        logStudioEvent(cwd, {
+            type: 'hook_check', requestId, outcome, status: result.status,
+            agentId: options.agent || process.env.RIGOUR_AGENT_ID,
+            files, summary: `${files.length} file(s), ${result.failures.length} finding(s)`,
+        }),
+    ]);
     // Return Cursor-compatible format if detected as Cursor hook
     if (cursorMode) {
         if (result.status === 'fail') {

package/dist/commands/index.js

@@ -30,7 +30,7 @@ async function logStudioEvent(cwd, event) {
 // native dependency issues from affecting the rest of the CLI.
 export const indexCommand = new Command('index')
     .description('Build or update the pattern index for the current project')
-    .option('-s, --semantic', 'Generate semantic embeddings for better matching (requires Transformers.js)', false)
+    .option('--no-semantic', 'Skip local semantic embeddings and build only the structural index')
     .option('-f, --force', 'Force a full rebuild of the index', false)
     .option('-o, --output <path>', 'Custom path for the index file')
     .action(async (options) => {

package/dist/commands/studio-contracts.d.ts

@@ -0,0 +1,20 @@
+export type AgentStatus = 'active' | 'idle' | 'completed';
+export type AgentSessionStatus = AgentStatus | 'aborted' | 'inactive';
+export interface StudioAgent {
+    agentId: string;
+    taskScope: string[];
+    registeredAt: string;
+    lastCheckpoint?: string;
+    status: AgentStatus;
+}
+export interface StudioAgentSession {
+    schemaVersion: 1;
+    sessionId: string;
+    agents: StudioAgent[];
+    status: AgentSessionStatus;
+    createdAt: string;
+    derived: boolean;
+    dataQuality: 'valid' | 'degraded';
+    warnings: string[];
+}
+export declare function normalizeAgentSession(input: unknown, now?: string): StudioAgentSession;

package/dist/commands/studio-contracts.js

@@ -0,0 +1,78 @@
+const AGENT_STATUSES = new Set(['active', 'idle', 'completed']);
+const SESSION_STATUSES = new Set([
+    'active',
+    'idle',
+    'completed',
+    'aborted',
+    'inactive',
+]);
+function record(value) {
+    return value && typeof value === 'object' ? value : {};
+}
+function validDate(value, fallback) {
+    if (typeof value !== 'string' && typeof value !== 'number')
+        return fallback;
+    const date = new Date(value);
+    return Number.isNaN(date.getTime()) ? fallback : date.toISOString();
+}
+function inferSessionStatus(agents) {
+    if (agents.length === 0)
+        return 'inactive';
+    if (agents.some((agent) => agent.status === 'active'))
+        return 'active';
+    if (agents.some((agent) => agent.status === 'idle'))
+        return 'idle';
+    return 'completed';
+}
+export function normalizeAgentSession(input, now = new Date().toISOString()) {
+    const source = record(input);
+    const warnings = [];
+    const rawAgents = Array.isArray(source.agents) ? source.agents : [];
+    if (!Array.isArray(source.agents) && source.agents !== undefined) {
+        warnings.push('Ignored invalid agents collection.');
+    }
+    const agents = rawAgents.map((value, index) => {
+        const raw = record(value);
+        const agentId = typeof raw.agentId === 'string' && raw.agentId.trim()
+            ? raw.agentId.trim()
+            : `unknown-agent-${index + 1}`;
+        if (agentId.startsWith('unknown-agent-'))
+            warnings.push(`Agent ${index + 1} had no identifier.`);
+        const taskScope = Array.isArray(raw.taskScope)
+            ? raw.taskScope.filter((scope) => typeof scope === 'string' && scope.length > 0)
+            : [];
+        if (!Array.isArray(raw.taskScope) && raw.taskScope !== undefined) {
+            warnings.push(`Agent ${agentId} had an invalid scope.`);
+        }
+        const status = typeof raw.status === 'string' && AGENT_STATUSES.has(raw.status)
+            ? raw.status
+            : 'idle';
+        if (status === 'idle' && raw.status !== 'idle')
+            warnings.push(`Agent ${agentId} had no valid status.`);
+        const registeredAt = validDate(raw.registeredAt, now);
+        const lastCheckpoint = raw.lastCheckpoint === undefined
+            ? undefined
+            : validDate(raw.lastCheckpoint, registeredAt);
+        return { agentId, taskScope, registeredAt, lastCheckpoint, status };
+    });
+    const requestedStatus = typeof source.status === 'string'
+        ? source.status
+        : undefined;
+    const status = requestedStatus && SESSION_STATUSES.has(requestedStatus)
+        ? requestedStatus
+        : inferSessionStatus(agents);
+    if (requestedStatus !== status)
+        warnings.push('Session status was inferred from agent activity.');
+    return {
+        schemaVersion: 1,
+        sessionId: typeof source.sessionId === 'string' && source.sessionId.trim()
+            ? source.sessionId
+            : agents.length > 0 ? 'legacy-session' : 'inactive',
+        agents,
+        status,
+        createdAt: validDate(source.createdAt, agents[0]?.registeredAt ?? now),
+        derived: Boolean(source.derived),
+        dataQuality: warnings.length > 0 ? 'degraded' : 'valid',
+        warnings,
+    };
+}

package/dist/commands/studio-contracts.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/studio-contracts.test.js

@@ -0,0 +1,33 @@
+import { describe, expect, it } from 'vitest';
+import { normalizeAgentSession } from './studio-contracts.js';
+describe('normalizeAgentSession', () => {
+    it('repairs a legacy session without status', () => {
+        const session = normalizeAgentSession({
+            sessionId: 'legacy',
+            agents: [{ agentId: 'agent-1', taskScope: ['src/**'], registeredAt: '2026-09-10T00:00:00Z' }],
+        }, '2026-09-10T01:00:00.000Z');
+        expect(session.status).toBe('idle');
+        expect(session.agents[0].status).toBe('idle');
+        expect(session.dataQuality).toBe('degraded');
+        expect(session.warnings).toContain('Session status was inferred from agent activity.');
+    });
+    it('returns an inactive contract for malformed input', () => {
+        expect(normalizeAgentSession({ agents: 'broken' }).status).toBe('inactive');
+        expect(normalizeAgentSession(null).agents).toEqual([]);
+    });
+    it('preserves valid current sessions', () => {
+        const session = normalizeAgentSession({
+            sessionId: 'session-1',
+            status: 'active',
+            createdAt: '2026-09-10T00:00:00Z',
+            agents: [{
+                    agentId: 'agent-1',
+                    taskScope: ['src/**'],
+                    registeredAt: '2026-09-10T00:00:00Z',
+                    status: 'active',
+                }],
+        });
+        expect(session.dataQuality).toBe('valid');
+        expect(session.status).toBe('active');
+    });
+});