@rigour-labs/cli 5.5.4 → 6.1.0-beta.1

package/dist/commands/studio.js

@@ -4,8 +4,11 @@ import os from 'os';
 import chalk from 'chalk';
 import { execa } from 'execa';
 import fs from 'fs-extra';
+import { createReadStream, promises as nativeFs } from 'fs';
+import readline from 'readline';
 import http from 'http';
 import { randomUUID } from 'crypto';
+import { normalizeAgentSession } from './studio-contracts.js';
 function sendJson(res, status, body) {
     res.writeHead(status, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify(body));
@@ -20,6 +23,44 @@ async function readJsonIfExists(filePath) {
         return null;
     }
 }
+async function readRecentLines(filePath, limit) {
+    const stat = await nativeFs.stat(filePath);
+    const bytes = Math.min(stat.size, 512 * 1024);
+    const handle = await nativeFs.open(filePath, 'r');
+    try {
+        const buffer = Buffer.alloc(bytes);
+        await handle.read(buffer, 0, bytes, stat.size - bytes);
+        return buffer.toString('utf8').split('\n').filter(line => line.trim()).slice(-limit);
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function readEventPage(filePath, limit, before) {
+    if (!(await fs.pathExists(filePath)))
+        return { events: [], hasMore: false };
+    const ring = [];
+    let matching = 0;
+    const lines = readline.createInterface({ input: createReadStream(filePath), crlfDelay: Infinity });
+    for await (const line of lines) {
+        if (!line.trim())
+            continue;
+        try {
+            const event = JSON.parse(line);
+            const timestamp = Date.parse(event.timestamp ?? event.createdAt ?? 0);
+            if (before && (!Number.isFinite(timestamp) || timestamp >= before))
+                continue;
+            matching++;
+            ring.push(event);
+            if (ring.length > limit)
+                ring.shift();
+        }
+        catch {
+            // Malformed historical lines are ignored without hiding the remaining ledger.
+        }
+    }
+    return { events: ring.reverse(), hasMore: matching > limit };
+}
 async function mergeMemoryStores(cwd) {
     const sources = [];
     const memories = {};
@@ -72,7 +113,7 @@ async function synthesizeAgents(cwd, checkpoints) {
     const sessionPath = path.join(cwd, '.rigour/agent-session.json');
     const session = await readJsonIfExists(sessionPath);
     if (session?.agents?.length) {
-        return session;
+        return normalizeAgentSession(session);
     }
     const byAgent = new Map();
     for (const cp of checkpoints) {
@@ -94,13 +135,13 @@ async function synthesizeAgents(cwd, checkpoints) {
         }
     }
     const agents = [...byAgent.values()];
-    return {
+    return normalizeAgentSession({
         sessionId: agents.length ? 'derived-from-checkpoints' : 'inactive',
         agents,
         status: agents.length ? 'completed' : 'inactive',
         createdAt: agents[0]?.registeredAt || new Date().toISOString(),
         derived: true,
-    };
+    });
 }
 async function handleApiRequest(req, res, url, ctx) {
     if (!url.pathname.startsWith('/api'))
@@ -112,6 +153,7 @@ async function handleApiRequest(req, res, url, ctx) {
     }
     res.setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS, POST, DELETE');
     res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+    res.setHeader('X-Rigour-Api-Version', '1');
     if (req.method === 'OPTIONS') {
         res.writeHead(204);
         res.end();
@@ -124,30 +166,35 @@ async function handleApiRequest(req, res, url, ctx) {
             'Cache-Control': 'no-cache',
             Connection: 'keep-alive',
         });
+        res.write(': connected\n\n');
         if (await fs.pathExists(eventsPath)) {
-            const content = await fs.readFile(eventsPath, 'utf8');
-            const lines = content.split('\n').filter((l) => l.trim());
-            // Send recent history only — full 77MB dumps freeze the UI
-            for (const line of lines.slice(-200)) {
+            for (const line of await readRecentLines(eventsPath, 200)) {
                 res.write(`data: ${line}\n\n`);
             }
         }
         await fs.ensureDir(path.dirname(eventsPath));
-        const watcher = fs.watch(path.dirname(eventsPath), async (_eventType, filename) => {
-            if (filename === 'events.jsonl') {
-                try {
-                    const content = await fs.readFile(eventsPath, 'utf8');
-                    const lines = content.split('\n').filter((l) => l.trim());
-                    const lastLine = lines[lines.length - 1];
-                    if (lastLine)
-                        res.write(`data: ${lastLine}\n\n`);
-                }
-                catch {
-                    // ignore transient reads
-                }
+        let lastModified = (await fs.pathExists(eventsPath)) ? (await fs.stat(eventsPath)).mtimeMs : 0;
+        let ticks = 0;
+        const poller = setInterval(async () => {
+            try {
+                ticks++;
+                if (ticks % 15 === 0)
+                    res.write(': heartbeat\n\n');
+                if (!(await fs.pathExists(eventsPath)))
+                    return;
+                const stat = await fs.stat(eventsPath);
+                if (stat.mtimeMs <= lastModified)
+                    return;
+                lastModified = stat.mtimeMs;
+                const lastLine = (await readRecentLines(eventsPath, 1)).at(-1);
+                if (lastLine)
+                    res.write(`data: ${lastLine}\n\n`);
             }
-        });
-        req.on('close', () => watcher.close());
+            catch {
+                // A transient read failure must not terminate the event stream.
+            }
+        }, 1_000);
+        req.on('close', () => clearInterval(poller));
         return true;
     }
     if (url.pathname === '/api/file') {
@@ -158,13 +205,21 @@ async function handleApiRequest(req, res, url, ctx) {
             return true;
         }
         const absolutePath = path.resolve(cwd, filePath);
-        if (!absolutePath.startsWith(cwd)) {
+        const relativePath = path.relative(path.resolve(cwd), absolutePath);
+        if (!relativePath || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath)) {
             res.writeHead(403);
             res.end('Forbidden');
             return true;
         }
         try {
-            const content = await fs.readFile(absolutePath, 'utf8');
+            const [realRoot, realFile] = await Promise.all([fs.realpath(cwd), fs.realpath(absolutePath)]);
+            const realRelative = path.relative(realRoot, realFile);
+            if (!realRelative || realRelative.startsWith(`..${path.sep}`) || path.isAbsolute(realRelative)) {
+                res.writeHead(403);
+                res.end('Forbidden');
+                return true;
+            }
+            const content = await fs.readFile(realFile, 'utf8');
             res.writeHead(200, { 'Content-Type': 'text/plain' });
             res.end(content);
         }
@@ -267,6 +322,109 @@ async function handleApiRequest(req, res, url, ctx) {
         }
         return true;
     }
+    if (url.pathname === '/api/health') {
+        try {
+            const { getSystemHealth } = await import('@rigour-labs/core');
+            sendJson(res, 200, await getSystemHealth(cwd));
+        }
+        catch (e) {
+            sendJson(res, 503, { schemaVersion: 1, generatedAt: new Date().toISOString(), error: e.message });
+        }
+        return true;
+    }
+    if (url.pathname === '/api/lessons' && req.method === 'GET') {
+        try {
+            const { listLessons, loadTeamConfiguration } = await import('@rigour-labs/core');
+            const [lessons, teamConfiguration] = await Promise.all([
+                listLessons(cwd),
+                loadTeamConfiguration(),
+            ]);
+            sendJson(res, 200, { schemaVersion: 1, lessons, teamConfigured: Boolean(teamConfiguration) });
+        }
+        catch (e) {
+            sendJson(res, 500, { schemaVersion: 1, lessons: [], teamConfigured: false, error: e.message });
+        }
+        return true;
+    }
+    if (url.pathname === '/api/lessons' && req.method === 'POST') {
+        let body = '';
+        req.on('data', (chunk) => (body += chunk));
+        req.on('end', async () => {
+            try {
+                const payload = JSON.parse(body || '{}');
+                const allowedStates = new Set(['validated', 'promoted', 'rejected', 'superseded']);
+                if (typeof payload.id !== 'string' || !allowedStates.has(payload.state)) {
+                    sendJson(res, 400, { error: 'A lesson id and valid target state are required.' });
+                    return;
+                }
+                const { transitionLesson } = await import('@rigour-labs/core');
+                const publishing = payload.state === 'promoted';
+                const changed = await transitionLesson(payload.id, payload.state, {
+                    visibility: publishing ? 'team' : undefined,
+                    queueSync: publishing,
+                });
+                sendJson(res, changed ? 200 : 404, { success: changed });
+            }
+            catch (e) {
+                sendJson(res, 400, { error: e.message });
+            }
+        });
+        return true;
+    }
+    if (url.pathname === '/api/agent-history') {
+        try {
+            const requested = Number(url.searchParams.get('limit') ?? 250);
+            const limit = Math.max(1, Math.min(500, Number.isFinite(requested) ? requested : 250));
+            const beforeValue = Number(url.searchParams.get('before'));
+            const before = Number.isFinite(beforeValue) && beforeValue > 0 ? beforeValue : undefined;
+            const page = await readEventPage(eventsPath, limit, before);
+            const { buildAgentRuns, normalizeAgentEvents } = await import('@rigour-labs/core');
+            const events = normalizeAgentEvents(page.events);
+            sendJson(res, 200, {
+                schemaVersion: 1,
+                events,
+                runs: buildAgentRuns(events),
+                hasMore: page.hasMore,
+                nextBefore: events.length ? Date.parse(events.at(-1).timestamp) : null,
+            });
+        }
+        catch (e) {
+            sendJson(res, 500, { schemaVersion: 1, events: [], runs: [], hasMore: false, error: e.message });
+        }
+        return true;
+    }
+    if (url.pathname === '/api/knowledge-graph') {
+        try {
+            const { buildAgentRuns, buildEngineeringKnowledgeGraph, getRepositoryId, listKnowledgeLessons, normalizeAgentEvents } = await import('@rigour-labs/core');
+            const [page, dependencyGraph, lessons, repositoryId, patternIndex, memory] = await Promise.all([
+                readEventPage(eventsPath, 2_000),
+                readJsonIfExists(path.join(cwd, '.rigour/dependency-graph.json')),
+                listKnowledgeLessons(cwd).catch(() => []),
+                getRepositoryId(cwd),
+                readJsonIfExists(path.join(cwd, '.rigour/patterns.json')),
+                mergeMemoryStores(cwd),
+            ]);
+            const events = normalizeAgentEvents(page.events);
+            sendJson(res, 200, buildEngineeringKnowledgeGraph({
+                repository: { id: repositoryId, name: path.basename(cwd) },
+                dependencyGraph,
+                events,
+                runs: buildAgentRuns(events),
+                lessons,
+                patterns: Array.isArray(patternIndex?.patterns) ? patternIndex.patterns : [],
+                memories: Object.entries(memory.memories).map(([id, value]) => ({
+                    id,
+                    label: id,
+                    source: value?.source,
+                    detail: value?.type || value?.category || 'retained memory',
+                })),
+            }));
+        }
+        catch (e) {
+            sendJson(res, 500, { schemaVersion: 1, nodes: [], edges: [], counts: {}, truncated: false, error: e.message });
+        }
+        return true;
+    }
     if (url.pathname === '/api/index-stats') {
         try {
             const indexPath = path.join(cwd, '.rigour/patterns.json');
@@ -405,7 +563,7 @@ async function handleApiRequest(req, res, url, ctx) {
     if (url.pathname === '/api/drift') {
         try {
             const { generateTemporalDriftReport } = await import('@rigour-labs/core');
-            const report = generateTemporalDriftReport(cwd);
+            const report = await generateTemporalDriftReport(cwd);
             sendJson(res, 200, report || { totalScans: 0 });
         }
         catch {
@@ -719,12 +877,97 @@ async function handleApiRequest(req, res, url, ctx) {
         });
         return true;
     }
+    if (url.pathname === '/api/firewall') {
+        try {
+            const { loadCurrentTransaction, listTransactions, loadLatestAttestation, verifyAttestation, } = await import('@rigour-labs/core');
+            const current = await loadCurrentTransaction(cwd);
+            const transactions = await listTransactions(cwd);
+            const attestation = await loadLatestAttestation(cwd);
+            const attestationValid = attestation ? await verifyAttestation(cwd, attestation) : false;
+            const advPath = path.join(cwd, '.rigour/adversarial-report.json');
+            const adversarial = await fs.pathExists(advPath) ? await fs.readJson(advPath) : null;
+            const decisionsPath = path.join(cwd, '.rigour/firewall-decisions.jsonl');
+            let decisions = [];
+            if (await fs.pathExists(decisionsPath)) {
+                const content = await fs.readFile(decisionsPath, 'utf8');
+                decisions = content
+                    .split('\n')
+                    .filter((l) => l.trim())
+                    .slice(-100)
+                    .map((l) => {
+                    try {
+                        return JSON.parse(l);
+                    }
+                    catch {
+                        return null;
+                    }
+                })
+                    .filter(Boolean)
+                    .reverse();
+            }
+            let recentDenies = [];
+            if (await fs.pathExists(eventsPath)) {
+                const content = await fs.readFile(eventsPath, 'utf8');
+                recentDenies = content
+                    .split('\n')
+                    .filter((l) => l.trim())
+                    .map((l) => {
+                    try {
+                        return JSON.parse(l);
+                    }
+                    catch {
+                        return null;
+                    }
+                })
+                    .filter((e) => e && (e.type === 'firewall_deny' || e.decision === 'timeout-deny' || e.decision === 'deny'))
+                    .slice(-50)
+                    .reverse();
+            }
+            const hooksPresent = (await fs.pathExists(path.join(cwd, '.cursor/hooks.json'))) ||
+                (await fs.pathExists(path.join(cwd, '.claude/settings.json'))) ||
+                (await fs.pathExists(path.join(cwd, '.clinerules'))) ||
+                (await fs.pathExists(path.join(cwd, '.windsurf/hooks.json')));
+            const agentScopesPath = path.join(cwd, '.rigour/agent-session.json');
+            const agentSession = await fs.pathExists(agentScopesPath) ? await fs.readJson(agentScopesPath) : null;
+            const scopeActive = Array.isArray(agentSession?.agents) && agentSession.agents.length > 0;
+            const typedSeen = recentDenies.some((e) => e.ruleId?.startsWith?.('shell.') || e.tool === 'rigour_run');
+            const gatewayWired = false; // McpGateway not yet the MCP proxy path
+            sendJson(res, 200, {
+                current,
+                transactions: transactions.slice(0, 20),
+                attestation,
+                attestationValid,
+                adversarial,
+                decisions,
+                recentDenies,
+                failClosed: true,
+                mediation: {
+                    status: gatewayWired && hooksPresent ? 'full' : 'partial',
+                    typedCommands: typedSeen || hooksPresent ? 'rigour_run_only' : 'not_observed',
+                    scopeEnforcement: scopeActive ? 'requires_agent_id' : 'inactive',
+                    arbitration: 'fail-closed',
+                    hooksInstalled: hooksPresent,
+                    mcpGateway: gatewayWired,
+                },
+            });
+        }
+        catch (e) {
+            sendJson(res, 500, { error: e.message });
+        }
+        return true;
+    }
     if (url.pathname === '/api/arbitrate' && req.method === 'POST') {
         let body = '';
         req.on('data', (chunk) => (body += chunk));
         req.on('end', async () => {
             try {
                 const decision = JSON.parse(body);
+                const { consumeArbitrationToken } = await import('@rigour-labs/core');
+                const ok = await consumeArbitrationToken(cwd, decision.requestId, decision.token);
+                if (!ok) {
+                    sendJson(res, 403, { error: 'Invalid or missing arbitration token (one-time, fail-closed)' });
+                    return;
+                }
                 const logEntry = JSON.stringify({
                     id: randomUUID(),
                     timestamp: new Date().toISOString(),
@@ -801,6 +1044,18 @@ export const studioCommand = new Command('studio')
         `http://127.0.0.1:${studioPort}`,
     ]);
     const ctx = { cwd, eventsPath, allowedOrigins };
+    const { ensureAutomaticIndex, loadTeamConfiguration, syncTeamOutbox } = await import('@rigour-labs/core');
+    void ensureAutomaticIndex(cwd).catch((error) => {
+        console.warn(chalk.yellow(`Structural index is degraded: ${error instanceof Error ? error.message : String(error)}`));
+    });
+    const syncTimer = setInterval(() => {
+        void loadTeamConfiguration().then((config) => {
+            if (config)
+                return syncTeamOutbox().catch(() => undefined);
+            return undefined;
+        });
+    }, 30_000);
+    syncTimer.unref();
     console.log(chalk.bold.cyan('\n🛡️ Launching Rigour Studio...'));
     console.log(chalk.gray(`Project Root: ${cwd}`));
     const configPath = path.join(cwd, 'rigour.yml');

package/dist/commands/team.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare const teamCommand: Command;

package/dist/commands/team.js

@@ -0,0 +1,78 @@
+import chalk from 'chalk';
+import { Command } from 'commander';
+import { backfillTeamEmbeddings, doctorTeamConnection, initializeTeamSchema, saveTeamConfiguration, searchTeamKnowledge, syncTeamOutbox, } from '@rigour-labs/core';
+export const teamCommand = new Command('team').description('Configure and diagnose PostgreSQL team learning');
+teamCommand
+    .command('init-schema')
+    .description('Initialize the PostgreSQL team schema with an administrator connection')
+    .requiredOption('--database-url <url>', 'Administrator PostgreSQL URL; remote databases must require TLS')
+    .option('--pgvector', 'Enable the optional pgvector semantic knowledge index')
+    .action(async (options) => {
+    await initializeTeamSchema(options.databaseUrl, { pgvector: Boolean(options.pgvector) });
+    console.log(chalk.green(`Rigour team schema initialized${options.pgvector ? ' with pgvector' : ''}.`));
+});
+teamCommand
+    .command('configure')
+    .description('Configure a provisioned PostgreSQL team database')
+    .requiredOption('--database-url <url>', 'PostgreSQL URL; remote databases must require TLS')
+    .requiredOption('--organization <id>', 'Organization identifier')
+    .requiredOption('--team <id>', 'Team identifier')
+    .requiredOption('--actor <id>', 'Actor identifier provisioned for the database role')
+    .option('--initialize-schema', 'Create or update the Rigour schema (administrator only)')
+    .option('--pgvector', 'Use pgvector to rank team knowledge semantically')
+    .action(async (options) => {
+    if (options.initializeSchema)
+        await initializeTeamSchema(options.databaseUrl, { pgvector: Boolean(options.pgvector) });
+    const config = {
+        databaseUrl: options.databaseUrl,
+        organizationId: options.organization,
+        teamId: options.team,
+        actorId: options.actor,
+        semantic: options.pgvector ? {
+            provider: 'pgvector',
+            model: 'Xenova/all-MiniLM-L6-v2',
+            dimensions: 384,
+        } : undefined,
+    };
+    const result = await doctorTeamConnection(config);
+    await saveTeamConfiguration(config);
+    console.log(chalk.green(result.message));
+});
+teamCommand
+    .command('doctor')
+    .description('Verify team database TLS, schema, role, and membership')
+    .action(async () => {
+    const result = await doctorTeamConnection();
+    console.log(JSON.stringify(result, null, 2));
+    if (result.connectivity === 'offline')
+        process.exitCode = 1;
+});
+teamCommand
+    .command('semantic-backfill')
+    .description('Embed existing validated knowledge owned by the configured actor')
+    .option('--limit <count>', 'Maximum lessons to embed in this run', '200')
+    .action(async (options) => {
+    const limit = Number.parseInt(options.limit, 10);
+    if (!Number.isInteger(limit) || limit < 1)
+        throw new Error('--limit must be a positive integer.');
+    console.log(JSON.stringify(await backfillTeamEmbeddings(limit), null, 2));
+});
+teamCommand
+    .command('semantic-search')
+    .description('Diagnose advisory cross-repository knowledge recall')
+    .argument('<query>', 'Natural-language engineering question')
+    .option('--limit <count>', 'Maximum candidates to return', '8')
+    .action(async (query, options) => {
+    const limit = Number.parseInt(options.limit, 10);
+    if (!Number.isInteger(limit) || limit < 1 || limit > 25)
+        throw new Error('--limit must be between 1 and 25.');
+    console.log(JSON.stringify(await searchTeamKnowledge(query, limit), null, 2));
+});
+teamCommand
+    .command('sync')
+    .description('Synchronize approved team lessons from the offline outbox')
+    .option('--dry-run', 'Report pending records without sending them')
+    .action(async (options) => {
+    const result = await syncTeamOutbox({ dryRun: Boolean(options.dryRun) });
+    console.log(JSON.stringify(result, null, 2));
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/cli",
-  "version": "5.5.4",
+  "version": "6.1.0-beta.1",
   "description": "AI-native quality gates with local LLM analysis. Forces AI agents (Claude, Cursor, Copilot, Cline, Windsurf) to meet engineering standards. Bayesian Brain learns your codebase. Zero config: npx rigour-scan.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -53,12 +53,13 @@
     "inquirer": "9.2.16",
     "ora": "^8.0.1",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "5.5.4"
+    "@rigour-labs/core": "6.1.0-beta.1"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",
     "@types/inquirer": "9.0.7",
-    "@types/node": "^25.0.3"
+    "@types/node": "^25.0.3",
+    "@rigour-labs/studio": "6.1.0-beta.1"
   },
   "scripts": {
     "build": "tsc && pnpm bundle-studio",