@rigour-labs/cli 6.13.0-rc.2 → 6.13.0-rc.4

package/dist/commands/doctor.js

@@ -4,6 +4,7 @@ import fs from 'fs';
 import { execFileSync } from 'child_process';
 import { cleanContextCache, deadCacheRows, loadSettings, resolveDeepOptions, getCachedModel, legacyStateNote, rigourUserDir, SidecarProvider } from '@rigour-labs/core';
 import { checkRepoSetup } from './repo-setup.js';
+import { configMigrations } from './setup-migrations.js';
 import { selfTestCommand, selfTestGitPushHook } from './hooks-git.js';
 import { semanticStatusLine } from './semantic.js';
 function runText(command, args) {
@@ -147,6 +148,11 @@ export async function printRepoSetup(cwd) {
         if (check.fix && check.state !== 'working')
             console.log(chalk.dim(`      fix: ${check.fix}`));
     }
+    // Settings an older Rigour wrote that no longer mean what they say: loud, since nothing else reports them.
+    for (const migration of configMigrations(cwd)) {
+        console.log(`  ${chalk.red('✘')} ${chalk.red(migration.problem)}`);
+        console.log(chalk.dim(`      fix: ${migration.automatic ? 'rigour setup' : 'edit rigour.yml'}`));
+    }
     console.log('');
 }
 const GB = 1024 ** 3;

package/dist/commands/hooks.js

@@ -748,9 +748,15 @@ export async function hooksCheckCommand(cwd, options = {}) {
         ? parseStdinFiles(rawStdin)
         : (options.files ?? '').split(',').map(f => f.trim()).filter(Boolean);
     if (files.length === 0) {
-        // Nothing was checked: never report pass, or a hook wired to the wrong input looks healthy.
-        if (!cursorMode)
+        // The old edit hook passes "$TOOL_INPUT_file_path", which the agent never sets: an empty --files. Say so on every
+        // edit, with a non-zero exit the agent shows the person, until it is migrated; it never blocks the edit.
+        if (!options.stdin && options.files !== undefined) {
+            process.stderr.write('[rigour] This edit hook is the old form: it passes a variable the agent never sets, so no edit is checked. Run: rigour setup\n');
+            process.exitCode = 1;
+        }
+        else if (!cursorMode)
             process.stderr.write('[rigour] hooks check: no file in the hook input, nothing checked\n');
+        // Nothing was checked: never report pass, or a hook wired to the wrong input looks healthy.
         process.stdout.write(JSON.stringify(cursorMode ? { continue: true } : { status: 'skipped', reason: 'no files', failures: [], duration_ms: 0 }));
         return;
     }

package/dist/commands/learn-reviews.js

@@ -41,7 +41,7 @@ export async function learnReviewsCommand(cwd, options) {
         });
         if (options.json)
             return void console.log(JSON.stringify(result, null, 2));
-        console.log(chalk.green(`✔ ${options.pr ? `PR #${options.pr}` : `${result.prs} merged PR(s)`}: ${result.candidates.person + result.candidates.bot} new candidate point(s) (${result.candidates.person} under people's logins, ${result.candidates.bot} from review bots); ${result.actedOn} of ${result.comments} review comment(s) acted on before the merge (recorded, not evidence).`));
+        console.log(chalk.green(`✔ ${options.pr ? `PR #${options.pr}` : `${result.prs} merged PR(s)`}: ${result.candidates.person + result.candidates.bot} new candidate point(s) (${result.candidates.person} under people's logins, ${result.candidates.bot} from review bots), ${skippedCount(result.skipped)} skipped: not a request${skippedWhy(result.skipped)}; ${result.actedOn} of ${result.comments} review comment(s) acted on before the merge (recorded, not evidence).`));
         const p = result.promoted;
         console.log(`  Lessons on evidence: ${result.verified} (outcome ${p.outcome}, a person's edit of agent work ${p.correction}, a person's decision ${p.person}, recurrence across authors ${p.recurrence}${p.legacy ? `, from before evidence ${p.legacy}` : ''}); ${result.heldBack} held back by counter-evidence; ${result.rejected} rejected.`);
         if (result.rules !== undefined)
@@ -58,6 +58,15 @@ async function reader(cwd, account) {
     const { token, as } = await githubReader(cwd, account, defaultExec);
     return { token, readAs: as };
 }
+/** Points that asked for nothing, in all. */
+function skippedCount(skipped) {
+    return Object.values(skipped).reduce((n, k) => n + (k ?? 0), 0);
+}
+/** Why they were skipped, when any were: ` (describes the change 4, review tool status 3)`. */
+function skippedWhy(skipped) {
+    const parts = Object.entries(skipped).filter(([, n]) => n).sort((a, b) => b[1] - a[1]).map(([why, n]) => `${why} ${n}`);
+    return parts.length ? ` (${parts.join(', ')})` : '';
+}
 function list(cwd, json, includeBots) {
     const all = readLessons(cwd);
     if (json)

package/dist/commands/repo-setup.js

@@ -8,6 +8,7 @@ import path from 'path';
 import { getContextEvents } from '@rigour-labs/core';
 import { resolveMCPServerConfig } from './init.js';
 import { agentHome, enabledHere } from './personal.js';
+import { isOldEditHook } from './setup-migrations.js';
 import { checkoutRoots, eventsAcross } from './studio-checkouts.js';
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
 export async function checkRepoSetup(cwd, now = new Date(), toolCalls) {
@@ -50,9 +51,10 @@ function editCheck(agents, now, events) {
     const name = wired.length ? `Checks ${listOf(wired.map(a => a.name))} as it writes` : 'Checks your agent as it writes';
     if (wired.length === 0)
         return { id: 'edit', name, state: 'missing', detail: 'No edit hook configured', fix: 'rigour setup' };
-    const broken = wired.find(a => a.config.includes('TOOL_INPUT_file_path'));
+    const broken = wired.find(a => isOldEditHook(a.config));
     if (broken) {
-        return { id: 'edit', name, state: 'broken', detail: `The ${broken.name} hook reads a variable the agent never sets, so it checks nothing`, fix: 'rigour hooks init --force' };
+        // setup rewrites Rigour's own entries where they live (the project, or the machine for a personal install).
+        return { id: 'edit', name, state: 'broken', detail: `The ${broken.name} hook is the old form: it reads a variable the agent never sets, so no edit is checked`, fix: 'rigour setup' };
     }
     return fired('edit', name, events.filter(e => e.type === 'hook_check'), now, 'edit checks');
 }

package/dist/commands/review-summary.d.ts

@@ -1,4 +1,4 @@
-import type { Failure } from '@rigour-labs/core';
+import { type Failure } from '@rigour-labs/core';
 type Severity = 'critical' | 'high' | 'medium' | 'low';
 export interface CiFinding {
     rule: string;

package/dist/commands/review-summary.js

@@ -1,10 +1,12 @@
+import { shownSeverity } from '@rigour-labs/core';
 const SEVERITIES = ['critical', 'high', 'medium', 'low'];
 const MAX_FINDINGS = 5;
 function safeLabel(value, max = 120) {
     return value.replace(/[^a-zA-Z0-9_./: -]/g, '_').slice(0, max);
 }
 function severityOf(failure) {
-    return SEVERITIES.includes(failure.severity) ? failure.severity : 'medium';
+    const shown = shownSeverity(failure);
+    return SEVERITIES.includes(shown) ? shown : 'medium';
 }
 function guidance(rule) {
     if (rule === 'logic-drift')

package/dist/commands/setup-migrations.d.ts

@@ -0,0 +1,12 @@
+/** The edit hook older `rigour hooks init` wrote: it passes a variable the agent never sets, so no edit is checked. */
+export declare function isOldEditHook(config: string): boolean;
+export interface ConfigMigration {
+    id: 'preset-security-block' | 'security-deprecated-default';
+    /** What is wrong, in a sentence a person acts on. */
+    problem: string;
+    /** True when `rigour setup` changes the file; false when only a person can decide. */
+    automatic: boolean;
+}
+export declare function configMigrations(cwd: string): ConfigMigration[];
+/** Applies the automatic migrations to rigour.yml, keeping its comments and order; returns what it changed. */
+export declare function applyConfigMigrations(cwd: string): string[];

package/dist/commands/setup-migrations.js

@@ -0,0 +1,62 @@
+/**
+ * What an older Rigour left in this repository that no longer does what it says: an edit hook that checks nothing,
+ * and a rigour.yml written before a default changed. `rigour doctor` and `rigour setup` report them; `rigour setup`
+ * fixes the ones that only restore what the team had, and leaves a team's possible choice for a person to decide.
+ */
+import fs from 'fs';
+import path from 'path';
+import yaml from 'yaml';
+import { TEMPLATES } from '@rigour-labs/core';
+/** The edit hook older `rigour hooks init` wrote: it passes a variable the agent never sets, so no edit is checked. */
+export function isOldEditHook(config) {
+    return config.includes('TOOL_INPUT_file_path');
+}
+/** The presets that block on every security finding (`gates.security.block`), read from the presets themselves. */
+function blockingPresets() {
+    return new Set(TEMPLATES.filter(t => t.config.gates?.security?.block === true).map(t => t.name));
+}
+function readConfig(cwd) {
+    const file = path.join(cwd, 'rigour.yml');
+    if (!fs.existsSync(file))
+        return undefined;
+    const doc = yaml.parseDocument(fs.readFileSync(file, 'utf8'));
+    return doc.errors.length ? undefined : doc;
+}
+export function configMigrations(cwd) {
+    const doc = readConfig(cwd);
+    if (!doc)
+        return [];
+    const found = [];
+    const preset = doc.get('preset');
+    if (typeof preset === 'string' && blockingPresets().has(preset) && doc.getIn(['gates', 'security', 'block']) === undefined) {
+        found.push({
+            id: 'preset-security-block',
+            problem: `rigour.yml was made from the ${preset} preset, which blocks on every security finding, but it predates gates.security.block: security findings are shown as notes here, not blocks`,
+            automatic: true,
+        });
+    }
+    if (doc.getIn(['gates', 'deprecated_apis', 'block_security_deprecated']) === true) {
+        found.push({
+            id: 'security-deprecated-default',
+            problem: 'rigour.yml sets gates.deprecated_apis.block_security_deprecated: true, which older rigour init wrote for everyone: an API deprecated for security reasons (md5 for a cache key, shell=True with a constant) blocks here. Keep it if your team chose it; otherwise delete the line',
+            automatic: false,
+        });
+    }
+    return found;
+}
+/** Applies the automatic migrations to rigour.yml, keeping its comments and order; returns what it changed. */
+export function applyConfigMigrations(cwd) {
+    const due = configMigrations(cwd).filter(m => m.automatic);
+    const doc = due.length ? readConfig(cwd) : undefined;
+    if (!doc)
+        return [];
+    const done = [];
+    for (const migration of due) {
+        if (migration.id === 'preset-security-block') {
+            doc.setIn(['gates', 'security', 'block'], true);
+            done.push(`rigour.yml: gates.security.block: true, as the ${String(doc.get('preset'))} preset sets it (security findings block again)`);
+        }
+    }
+    fs.writeFileSync(path.join(cwd, 'rigour.yml'), doc.toString());
+    return done;
+}

package/dist/commands/setup.js

@@ -22,6 +22,7 @@ import { hooksInitCommand, installMachineHooks, pinnedCliCommand } from './hooks
 import { initCommand, resolveMCPServerConfig } from './init.js';
 import { writeAgentInstructions } from './init-handshake.js';
 import { disableHere, enableHere, registerUserMcp } from './personal.js';
+import { applyConfigMigrations } from './setup-migrations.js';
 import { setupSemantic } from './semantic.js';
 const AGENT_NAME = { claude: 'Claude Code', cursor: 'Cursor', cline: 'Cline', windsurf: 'Windsurf' };
 export async function setupCommand(cwd = process.cwd(), options = {}) {
@@ -31,6 +32,8 @@ export async function setupCommand(cwd = process.cwd(), options = {}) {
         await teamSetup(cwd, options);
     else
         await personalSetup(cwd);
+    for (const change of applyConfigMigrations(cwd))
+        console.log(chalk.green(`✔ Migrated ${change}`));
     if (options.semantic !== false)
         await setupSemantic(cwd);
     await printRepoSetup(cwd);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/cli",
-  "version": "6.13.0-rc.2",
+  "version": "6.13.0-rc.4",
   "description": "Code review that happens while your agent writes: deterministic checks on the lines it changed, quiet unless it can prove a defect, and learning from your team's fixes and dismissals. Works with Claude Code, Cursor, Codex, Cline and Windsurf.",
   "engines": {
     "node": ">=22.13"
@@ -59,13 +59,13 @@
     "inquirer": "9.2.16",
     "ora": "^8.0.1",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "6.13.0-rc.2"
+    "@rigour-labs/core": "6.13.0-rc.4"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",
     "@types/inquirer": "9.0.7",
     "@types/node": "^25.0.3",
-    "@rigour-labs/studio": "6.13.0-rc.2"
+    "@rigour-labs/studio": "6.13.0-rc.4"
   },
   "scripts": {
     "build": "tsc && pnpm bundle-studio",