@rigour-labs/cli 6.8.0 → 6.8.1-rc.1

package/dist/commands/personal.test.js

@@ -1,191 +0,0 @@
-import { execFileSync, spawnSync } from 'child_process';
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { asUserLevel, disableHere, enabledHere, enableHere } from './personal.js';
-import { setupCommand } from './setup.js';
-import { uninstall } from './uninstall.js';
-let repo;
-let home;
-let bin;
-const saved = { RIGOUR_AGENT_HOME: process.env.RIGOUR_AGENT_HOME, RIGOUR_CLAUDE_CLI: process.env.RIGOUR_CLAUDE_CLI, RIGOUR_HOME: process.env.RIGOUR_HOME };
-const git = (...args) => execFileSync('git', ['-C', repo, ...args], { encoding: 'utf8' }).trim();
-const atHome = (rel) => path.join(home, rel);
-const unix = process.platform !== 'win32';
-/** A `claude` CLI that keeps its MCP servers in a file, so add/get/remove behave like the real one. */
-function fakeClaude() {
-    const servers = path.join(bin, 'claude-mcp.txt');
-    fs.writeFileSync(path.join(bin, 'claude'), `#!/bin/sh
-echo "$@" >> "${path.join(bin, 'claude-calls.log')}"
-case "$1 $2" in
-  "--version "*) echo "9.9.9 (Claude Code)"; exit 0 ;;
-  "mcp get") grep -qx "$3" "${servers}" 2>/dev/null; exit $? ;;
-  "mcp add") echo "$5" >> "${servers}"; exit 0 ;;
-  "mcp remove") : > "${servers}"; exit 0 ;;
-esac
-exit 1
-`, { mode: 0o755 });
-    process.env.RIGOUR_CLAUDE_CLI = path.join(bin, 'claude');
-    return path.join(bin, 'claude-calls.log');
-}
-beforeEach(() => {
-    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'personal-repo-'));
-    home = fs.mkdtempSync(path.join(os.tmpdir(), 'personal-home-'));
-    bin = fs.mkdtempSync(path.join(os.tmpdir(), 'personal-bin-'));
-    // The agents' home and Rigour's own, both throwaway (os.homedir() would ignore a HOME set here).
-    process.env.RIGOUR_AGENT_HOME = home;
-    process.env.RIGOUR_HOME = home;
-    git('init', '-q', '-b', 'main');
-    git('config', 'core.hooksPath', '.git/hooks');
-    git('config', 'user.email', 't@example.com');
-    git('config', 'user.name', 't');
-    git('config', 'commit.gpgsign', 'false');
-    fs.writeFileSync(path.join(repo, 'package.json'), JSON.stringify({ name: 'app' }));
-    fs.writeFileSync(path.join(repo, 'a.ts'), 'export const a = 1;\n');
-    git('add', '-A');
-    git('commit', '-qm', 'init');
-    vi.spyOn(console, 'log').mockImplementation(() => undefined);
-    vi.spyOn(console, 'error').mockImplementation(() => undefined);
-    vi.spyOn(console, 'warn').mockImplementation(() => undefined);
-});
-afterEach(() => {
-    vi.restoreAllMocks();
-    for (const [key, value] of Object.entries(saved)) {
-        if (value === undefined)
-            delete process.env[key];
-        else
-            process.env[key] = value;
-    }
-    for (const dir of [repo, home, bin])
-        fs.rmSync(dir, { recursive: true, force: true });
-});
-describe('the switch for a repository', () => {
-    it('lives in the git directory, shared by worktrees, and puts .rigour/ in info/exclude once', () => {
-        expect(enabledHere(repo)).toBe(false);
-        enableHere(repo);
-        enableHere(repo);
-        expect(enabledHere(repo)).toBe(true);
-        expect(fs.readFileSync(path.join(repo, '.git/info/exclude'), 'utf8').split('\n').filter(l => l === '.rigour/')).toHaveLength(1);
-        const worktree = path.join(os.tmpdir(), `personal-wt-${process.pid}`);
-        git('worktree', 'add', '-q', '--detach', worktree);
-        try {
-            expect(enabledHere(worktree)).toBe(true);
-        }
-        finally {
-            git('worktree', 'remove', '--force', worktree);
-        }
-        disableHere(repo, true);
-        expect(enabledHere(repo)).toBe(false);
-        expect(fs.readFileSync(path.join(repo, '.git/info/exclude'), 'utf8')).not.toContain('.rigour/');
-    });
-});
-describe.skipIf(!unix)('the guard on a machine-level hook', () => {
-    /** The command a project Stop hook becomes in the user-level Claude settings. */
-    const guarded = (command) => JSON.parse(asUserLevel({ path: '.claude/settings.json', content: JSON.stringify({ hooks: { Stop: [{ hooks: [{ type: 'command', command }] }] } }) }).content).hooks.Stop[0].hooks[0].command;
-    const run = (command) => spawnSync('sh', ['-c', command], { cwd: repo, input: 'payload', encoding: 'utf8', env: { ...process.env, CLAUDE_PROJECT_DIR: '' } });
-    it('runs the command only in a repository switched on, with stdin passed through, even for a quoted command', () => {
-        const command = guarded(`sh -c 'printf "ran:"; cat'`);
-        expect(run(command).stdout).toBe('');
-        expect(run(command).status).toBe(0);
-        enableHere(repo);
-        expect(run(command).stdout).toBe('ran:payload');
-        const outside = spawnSync('sh', ['-c', command], { cwd: os.tmpdir(), input: 'x', encoding: 'utf8' });
-        expect(outside).toMatchObject({ status: 0, stdout: '' });
-    });
-    it('turns each project hook file into its agent\'s user-level twin, every command guarded', () => {
-        const claude = asUserLevel({ path: '.claude/settings.json', content: JSON.stringify({ hooks: { Stop: [{ hooks: [{ type: 'command', command: 'npx rigour hooks stop' }] }] } }) });
-        expect(claude.path).toBe('.claude/settings.json');
-        expect(JSON.parse(claude.content).hooks.Stop[0].hooks[0].command).toMatch(/^sh -c '.*rigour-enabled.*exec npx rigour hooks stop'$/);
-        expect(asUserLevel({ path: '.windsurf/hooks.json', content: '{}' }).path).toBe('.codeium/windsurf/hooks.json');
-        const cline = asUserLevel({ path: '.clinerules/hooks/PostToolUse', content: '#!/usr/bin/env node\nprocess.stdout.write("ran");\n' });
-        expect(cline.path).toBe('Documents/Cline/Hooks/PostToolUse');
-        fs.writeFileSync(path.join(bin, 'hook.js'), cline.content);
-        expect(spawnSync(process.execPath, [path.join(bin, 'hook.js')], { cwd: repo, encoding: 'utf8' }).stdout).toBe('{}');
-        enableHere(repo);
-        expect(spawnSync(process.execPath, [path.join(bin, 'hook.js')], { cwd: repo, encoding: 'utf8' }).stdout).toBe('ran');
-    });
-});
-describe.skipIf(!unix)('rigour setup, personal', () => {
-    it('leaves the working tree untouched, installs machine hooks into the configs the person has, and comes back out exactly', async () => {
-        const calls = fakeClaude();
-        const ownSettings = { permissions: { allow: ['Bash(ls)'] }, hooks: { PostToolUse: [{ matcher: 'Write', hooks: [{ type: 'command', command: 'npm run format' }] }] } };
-        fs.mkdirSync(atHome('.claude'), { recursive: true });
-        fs.writeFileSync(atHome('.claude/settings.json'), JSON.stringify(ownSettings));
-        fs.mkdirSync(atHome('.cursor')); // Cursor is installed here; Windsurf and Cline are not
-        await setupCommand(repo, { semantic: false });
-        expect(git('status', '--porcelain', '--untracked-files=all')).toBe(''); // nothing in the working tree
-        expect(enabledHere(repo)).toBe(true);
-        expect(fs.readFileSync(path.join(repo, '.git/hooks/pre-push'), 'utf8')).toContain('hooks push --git');
-        const settings = JSON.parse(fs.readFileSync(atHome('.claude/settings.json'), 'utf8'));
-        expect(settings.permissions).toEqual(ownSettings.permissions);
-        const commands = JSON.stringify(settings.hooks);
-        expect(commands).toContain('npm run format');
-        expect(commands).toContain('rigour-enabled'); // every Rigour hook is guarded
-        for (const rel of ['.cursor/hooks.json', '.cursor/mcp.json'])
-            expect(fs.existsSync(atHome(rel)), rel).toBe(true);
-        for (const rel of ['.codeium', 'Documents'])
-            expect(fs.existsSync(atHome(rel)), rel).toBe(false); // nothing for an agent that is not installed
-        expect(fs.readFileSync(calls, 'utf8')).toMatch(/^mcp add --scope user rigour -- /m);
-        // Setting up a second repository reuses the machine install: one Rigour entry per event, not two.
-        await setupCommand(repo, { semantic: false });
-        const again = JSON.parse(fs.readFileSync(atHome('.claude/settings.json'), 'utf8'));
-        expect(again.hooks.Stop).toHaveLength(1);
-        // This repository off: the machine hooks stay, silent here now.
-        uninstall(repo);
-        expect(enabledHere(repo)).toBe(false);
-        expect(fs.existsSync(path.join(repo, '.git/hooks/pre-push'))).toBe(false);
-        expect(fs.existsSync(atHome('.cursor/hooks.json'))).toBe(true);
-        // Off the machine: the person's own settings are back as they were.
-        uninstall(repo, { machine: true });
-        expect(JSON.parse(fs.readFileSync(atHome('.claude/settings.json'), 'utf8'))).toEqual(ownSettings);
-        for (const rel of ['.cursor/hooks.json', '.codeium/windsurf/hooks.json', 'Documents/Cline/Hooks/PostToolUse', '.cursor/mcp.json']) {
-            expect(fs.existsSync(atHome(rel))).toBe(false);
-        }
-        expect(fs.readFileSync(calls, 'utf8')).toMatch(/^mcp remove --scope user rigour$/m);
-        expect(git('status', '--porcelain', '--untracked-files=all')).toBe('');
-    });
-});
-describe('rigour setup --team', () => {
-    it('commits the configuration, without instruction files or empty documents unless asked', async () => {
-        await setupCommand(repo, { semantic: false, team: true });
-        expect(fs.existsSync(path.join(repo, 'rigour.yml'))).toBe(true);
-        expect(fs.readFileSync(path.join(repo, '.claude/settings.json'), 'utf8')).toContain('hooks check');
-        for (const rel of ['CLAUDE.md', 'AGENTS.md', 'docs/AGENT_INSTRUCTIONS.md', 'docs/SPEC.md', 'docs/ARCH.md'])
-            expect(fs.existsSync(path.join(repo, rel))).toBe(false);
-        expect(enabledHere(repo)).toBe(false); // machine hooks stay silent beside the committed ones
-    });
-    it('writes instruction files where the project has none when asked', async () => {
-        await setupCommand(repo, { semantic: false, team: true, instructions: true });
-        expect(fs.existsSync(path.join(repo, 'CLAUDE.md'))).toBe(true);
-    });
-    it("leaves a teammate's clone exactly as committed, and still writes instructions when asked", async () => {
-        await setupCommand(repo, { semantic: false, team: true });
-        git('add', '-A');
-        git('commit', '-qm', 'adopt rigour');
-        await setupCommand(repo, { semantic: false }); // a teammate after cloning: rigour.yml is tracked
-        expect(git('status', '--porcelain')).toBe(''); // no committed file changed
-        expect(fs.readFileSync(path.join(repo, '.git/hooks/pre-push'), 'utf8')).toContain('hooks push --git');
-        await setupCommand(repo, { semantic: false, instructions: true });
-        expect(fs.readFileSync(path.join(repo, 'CLAUDE.md'), 'utf8')).toBe('@AGENTS.md\n');
-    });
-    it('keeps a .cursor/mcp.json that is not valid JSON', async () => {
-        fs.mkdirSync(path.join(repo, '.cursor'));
-        fs.writeFileSync(path.join(repo, '.cursor/mcp.json'), '{ not json');
-        await setupCommand(repo, { semantic: false, team: true });
-        expect(fs.readFileSync(path.join(repo, '.cursor/mcp.json'), 'utf8')).toBe('{ not json');
-    });
-});
-describe('rigour setup, personal, with git hooks kept in the repository', () => {
-    it('leaves a committed hooks folder (Husky) alone and says what to add', async () => {
-        fs.mkdirSync(path.join(repo, '.husky'));
-        fs.writeFileSync(path.join(repo, '.husky/pre-push'), 'npm test\n');
-        git('add', '-A');
-        git('commit', '-qm', 'husky');
-        git('config', 'core.hooksPath', '.husky');
-        await setupCommand(repo, { semantic: false });
-        expect(fs.readFileSync(path.join(repo, '.husky/pre-push'), 'utf8')).toBe('npm test\n');
-        expect(git('status', '--porcelain', '--untracked-files=all')).toBe('');
-        expect(vi.mocked(console.log).mock.calls.flat().join('\n')).toContain('hooks push --git "$@" || exit $?');
-    });
-});

package/dist/commands/repo-setup.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/commands/repo-setup.test.js

@@ -1,47 +0,0 @@
-import { execFileSync } from 'child_process';
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { checkRepoSetup } from './repo-setup.js';
-let cwd;
-const write = (rel, body) => { fs.mkdirSync(path.dirname(path.join(cwd, rel)), { recursive: true }); fs.writeFileSync(path.join(cwd, rel), body); };
-beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'setup-')); });
-afterEach(() => fs.rmSync(cwd, { recursive: true, force: true }));
-const now = new Date('2026-10-09T12:00:00Z');
-const byId = async (id) => (await checkRepoSetup(cwd, now, [])).find(c => c.id === id);
-describe('checkRepoSetup', () => {
-    it('says working only when the hook fired this week, not because a file exists', async () => {
-        write('.claude/settings.json', JSON.stringify({ hooks: { PostToolUse: [{ hooks: [{ command: 'rigour hooks check --stdin' }] }] } }));
-        expect(await byId('edit')).toMatchObject({ state: 'set up', detail: 'Configured; has not fired here yet' });
-        write('.rigour/events.jsonl', JSON.stringify({ type: 'hook_check', timestamp: '2026-10-09T11:50:00Z' }) + '\n');
-        expect(await byId('edit')).toMatchObject({ state: 'working', detail: '1 edit check this week · last 10 min ago' });
-    });
-    it('calls out the old hook that checked nothing', async () => {
-        write('.claude/settings.json', 'rigour hooks check --files "$TOOL_INPUT_file_path"');
-        expect(await byId('edit')).toMatchObject({ state: 'broken', fix: 'rigour hooks init --force' });
-    });
-    it('finds the PR workflow and reports what is missing', async () => {
-        expect((await byId('pr')).state).toBe('missing');
-        expect((await byId('config')).state).toBe('missing');
-        write('.github/workflows/review.yml', 'steps:\n  - uses: rigour-labs/rigour@v6\n');
-        expect(await byId('pr')).toMatchObject({ state: 'set up', detail: '.github/workflows/review.yml' });
-    });
-    it('counts what agents did in every worktree of the repository', async () => {
-        const git = (...args) => execFileSync('git', ['-C', cwd, ...args], { encoding: 'utf8' });
-        git('init', '-q', '-b', 'main');
-        git('-c', 'user.email=t@example.com', '-c', 'user.name=t', 'commit', '-q', '--allow-empty', '-m', 'init');
-        const tree = path.join(cwd, 'wt');
-        git('worktree', 'add', '-q', tree);
-        write('.claude/settings.json', 'rigour hooks check --stdin; rigour hooks stop --tool claude');
-        fs.mkdirSync(path.join(tree, '.rigour'));
-        fs.writeFileSync(path.join(tree, '.rigour', 'events.jsonl'), JSON.stringify({ type: 'stop_review', timestamp: '2026-10-09T11:00:00Z' }) + '\n');
-        expect(await byId('stop')).toMatchObject({ state: 'working', detail: '1 finish check this week · last 1 h ago' });
-    });
-    it("counts the MCP server's tool calls, not the CLI's own events", async () => {
-        write('.rigour/events.jsonl', JSON.stringify({ type: 'tool_call', tool: 'rigour_init', timestamp: '2026-10-09T11:00:00Z' }) + '\n');
-        expect((await checkRepoSetup(cwd, now, [])).find(c => c.id === 'mcp').state).toBe('missing');
-        const call = { toolName: 'rigour_review', cacheStatus: 'none', candidateTokens: 0, returnedTokens: 0, createdAt: Date.parse('2026-10-09T11:30:00Z') };
-        expect((await checkRepoSetup(cwd, now, [call])).find(c => c.id === 'mcp')).toMatchObject({ state: 'working', detail: '1 tool call this week · last 30 min ago' });
-    });
-});

package/dist/commands/review-checked.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/commands/review-checked.test.js

@@ -1,50 +0,0 @@
-import { execFileSync } from 'child_process';
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { whatWasChecked } from './review-checked.js';
-let repo;
-const git = (...args) => execFileSync('git', ['-C', repo, ...args], { encoding: 'utf8' }).trim();
-const result = { report: { summary: { 'hallucinated-imports': 'PASS', 'unused-exports': 'FAIL' } } };
-beforeEach(() => {
-    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'checked-'));
-    git('init', '-q', '-b', 'main');
-    git('config', 'user.email', 't@example.com');
-    git('config', 'user.name', 't');
-    git('config', 'commit.gpgsign', 'false');
-    fs.writeFileSync(path.join(repo, 'a.ts'), 'export const a = 1;\n');
-    git('add', '-A');
-    git('commit', '-qm', 'init');
-});
-afterEach(() => { fs.rmSync(repo, { recursive: true, force: true }); });
-describe('what a review checked', () => {
-    it('names the commits compared, whether uncommitted work was in it, the settings and every check', () => {
-        const base = git('rev-parse', 'HEAD');
-        git('checkout', '-q', '-b', 'feature');
-        fs.writeFileSync(path.join(repo, 'a.ts'), 'export const a = 2;\n');
-        git('commit', '-qam', 'change');
-        fs.writeFileSync(path.join(repo, 'a.ts'), 'export const a = 3;\n'); // not committed
-        expect(whatWasChecked(repo, { base: 'main' }, undefined, result)).toMatchObject({
-            rigour_version: expect.stringMatching(/^\d+\.\d+\.\d+/),
-            base: 'main',
-            base_sha: base,
-            head_sha: git('rev-parse', 'HEAD'),
-            uncommitted: true,
-            config: 'defaults',
-            checks: { 'hallucinated-imports': 'PASS', 'unused-exports': 'FAIL' },
-        });
-    });
-    it('says which rigour.yml it read: the working tree, the base for an independent review, or a file named by -c', () => {
-        fs.writeFileSync(path.join(repo, 'rigour.yml'), 'gates: {}\n');
-        expect(whatWasChecked(repo, {}, undefined, result)).toMatchObject({ base: null, base_sha: git('rev-parse', 'HEAD'), uncommitted: false, config: 'rigour.yml' });
-        const base = git('rev-parse', 'HEAD'); // rigour.yml is not committed there
-        expect(whatWasChecked(repo, { base: 'main' }, base, result).config).toBe('defaults');
-        git('add', '-A');
-        git('commit', '-qm', 'config');
-        expect(whatWasChecked(repo, { base: 'main' }, git('rev-parse', 'HEAD'), result).config).toBe(`rigour.yml at ${git('rev-parse', 'HEAD')}`);
-        fs.mkdirSync(path.join(repo, 'ci'));
-        fs.writeFileSync(path.join(repo, 'ci/strict.yml'), 'gates: {}\n');
-        expect(whatWasChecked(repo, { config: 'ci/strict.yml' }, undefined, result).config).toBe('ci/strict.yml');
-    });
-});

package/dist/commands/review-diff-tests.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/commands/review-diff-tests.test.js

@@ -1,20 +0,0 @@
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { reviewCommand } from './review.js';
-describe('rigour review --diff-tests', () => {
-    let dir;
-    afterEach(() => { if (dir)
-        fs.rmSync(dir, { recursive: true, force: true }); dir = undefined; vi.restoreAllMocks(); });
-    it('refuses to run without a model that can propose test inputs', async () => {
-        dir = fs.mkdtempSync(path.join(os.tmpdir(), 'diff-tests-cli-'));
-        fs.writeFileSync(path.join(dir, 'change.diff'), '');
-        const out = [];
-        vi.spyOn(console, 'log').mockImplementation((line) => { out.push(line); });
-        const exit = vi.spyOn(process, 'exit').mockImplementation(((code) => { throw new Error(`exit ${code}`); }));
-        await expect(reviewCommand(dir, { json: true, diff: 'change.diff', deep: true, diffTests: true })).rejects.toThrow('exit 2');
-        expect(exit).toHaveBeenCalledWith(2);
-        expect(JSON.parse(out[0])).toEqual({ error: 'INPUT_ERROR', message: expect.stringContaining('--diff-tests needs a model') });
-    });
-});

package/dist/commands/review-human.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/commands/review-human.test.js

@@ -1,94 +0,0 @@
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { printHuman } from './review-human.js';
-let dir;
-let out;
-beforeEach(() => {
-    dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rigour-human-'));
-    out = [];
-    vi.spyOn(console, 'log').mockImplementation((...args) => void out.push(args.join(' ')));
-});
-afterEach(() => {
-    vi.restoreAllMocks();
-    fs.rmSync(dir, { recursive: true, force: true });
-});
-const finding = (n, over = {}) => ({
-    id: 'unused-export', title: `export f${n} is used nowhere`, details: '', files: ['src/a.ts'], line: n, hint: 'Remove the export.', ...over,
-});
-const result = (over = {}) => ({
-    status: 'PASS', findings: [], fileFindings: [], contextFindings: [], advisory: [], muted: 0, dismissed: 0, dismissedByGate: {},
-    unlocated: 0, excludedOutsideChangedLines: 0, preexisting: 0, changedLines: { 'src/a.ts': new Set([1]), 'src/b.ts': new Set([2]) },
-    report: { status: 'PASS', failures: [] }, gateErrors: [], controlFilesChanged: [], hints: [], ...over,
-});
-const receipt = (over = {}) => ({
-    functions: 3, reviewed: 0, changedSinceReview: 0, lowRisk: 1, notCovered: [{ file: 'src/a.ts', function: 'f', start: 1, score: 4 }],
-    reviewers: {}, otherFiles: 0, setAside: 0, ...over,
-});
-const show = (r, over = {}) => {
-    printHuman(r, { cwd: dir, scope: 'this branch against main', commits: 10, ms: 3200, receipt: null, ...over });
-    return out.join('\n');
-};
-describe('rigour review, as a person reads it', () => {
-    it('says what it reviewed, then the verdict', () => {
-        const text = show(result());
-        expect(text).toContain('Rigour reviewed this branch against main: 10 commits, 2 files, 3 s.');
-        expect(text).toContain('✔ Nothing to fix in what this changed.');
-    });
-    it('lists at most five findings with where, what and the fix, and points at the rest', () => {
-        const text = show(result({ status: 'FAIL', findings: [1, 2, 3, 4, 5, 6, 7].map(n => finding(n)) }));
-        expect(text).toContain('✘ 7 things to fix before this is ready');
-        expect(text).toContain('src/a.ts:5  export f5 is used nowhere');
-        expect(text).not.toContain('export f6');
-        expect(text).toContain('→ Remove the export.');
-        expect(text).toContain('rigour dismiss');
-        expect(text).toContain('…and 2 more: rigour review --all');
-    });
-    it('lists every finding with --all', () => {
-        const text = show(result({ status: 'FAIL', findings: [1, 2, 3, 4, 5, 6, 7].map(n => finding(n)) }), { all: true });
-        expect(text).toContain('export f7 is used nowhere');
-        expect(text).not.toContain('--all');
-    });
-    it('is not finished, with the project\'s own install command, when the type checks need dependencies', () => {
-        fs.writeFileSync(path.join(dir, 'pnpm-lock.yaml'), '');
-        const text = show(result({ status: 'ERROR', gateErrors: ['typed-checks-unavailable'], typedError: "tsconfig.json cannot be loaded: File 'x' not found." }));
-        expect(text).toContain('⚠ Not finished: the type checks need your dependencies installed');
-        expect(text).toContain('Run pnpm install, then rigour review again. Everything else found nothing.');
-        expect(text).not.toContain('Nothing to fix');
-    });
-    it('names a check that could not run for another reason', () => {
-        fs.mkdirSync(path.join(dir, 'node_modules'));
-        const text = show(result({ status: 'ERROR', gateErrors: ['typed-checks-unavailable'], typedError: 'tsconfig.json cannot be loaded: bad JSON' }));
-        expect(text).toContain('⚠ Not finished: typed-checks-unavailable could not run (tsconfig.json cannot be loaded: bad JSON)');
-    });
-    it('keeps notes and old-code issues to one quiet line each', () => {
-        const text = show(result({ advisory: [finding(1)], fileFindings: [finding(2)], preexisting: 12, excludedOutsideChangedLines: 3 }));
-        expect(text).toContain('Also seen, never blocking: 2 notes (rigour review --notes)');
-        expect(text).toContain('Not shown: 15 issues the code already had before this change');
-        expect(text).not.toContain('export f1');
-        expect(show(result({ advisory: [finding(1)] }), { notes: true })).toContain('src/a.ts:1  export f1 is used nowhere');
-    });
-    it('counts the hints a person should confirm, and lists them with --notes', () => {
-        const hint = 'nested-scan src/a.ts:9: match() scans its `rows` argument and is called inside a loop; confirm the sizes or index the inner collection once';
-        expect(show(result({ hints: [hint] }))).toContain('To confirm by hand: 1 hint (rigour review --notes)');
-        out = [];
-        expect(show(result({ hints: [hint] }), { notes: true })).toContain(`  ${hint}`);
-    });
-    it('hides the receipt until agents have reviewed something, unless asked', () => {
-        expect(show(result(), { receipt: receipt() })).not.toContain('Quality receipt');
-        out = [];
-        expect(show(result(), { receipt: receipt(), showReceipt: true })).toContain('Quality receipt');
-        out = [];
-        expect(show(result(), { receipt: receipt({ reviewed: 1 }) })).toContain('Quality receipt');
-    });
-    it('offers setup once, only where Rigour is not set up', () => {
-        expect(show(result())).toContain('Next: rigour setup checks this while your agent works and before every push.');
-        out = [];
-        fs.writeFileSync(path.join(dir, 'rigour.yml'), 'version: 1\n');
-        expect(show(result())).not.toContain('Next:');
-    });
-    it('says so when there is nothing to review', () => {
-        expect(show(result({ report: null }))).toBe('No changes to review.');
-    });
-});

package/dist/commands/review-post.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/commands/review-post.test.js

@@ -1,157 +0,0 @@
-import { buildRecord } from '@rigour-labs/core';
-import { describe, expect, it } from 'vitest';
-import { findingKey, postReview, rankFindings, receiptLines, summaryBody } from './review-post.js';
-const target = { token: 't', repo: 'acme/app', pr: 7, sha: 'abc123' };
-const BOT = { login: 'github-actions[bot]' };
-function finding(over) {
-    return { id: 'x', gate: 'Gate', severity: 'medium', provenance: 'traditional', message: 'm', file: 'src/a.ts', line: 10, ...over };
-}
-/** A GitHub that remembers comments, and refuses inline reviews when told to. */
-function fakeGitHub(state, refuseInline = false) {
-    const calls = [];
-    const fetchImpl = async (url, init = {}) => {
-        const path = url.replace('https://api.github.com/repos/acme/app', '').replace(/\?.*$/, '');
-        const method = init.method ?? 'GET';
-        const body = init.body ? JSON.parse(init.body) : undefined;
-        calls.push({ method, path, body });
-        const reply = (ok, json = {}) => ({ ok, status: ok ? 200 : 422, json: async () => json, text: async () => '' });
-        const query = new URL(url).searchParams;
-        const page = (items) => {
-            const size = Number(query.get('per_page') ?? 30);
-            const from = (Number(query.get('page') ?? 1) - 1) * size;
-            return items.slice(from, from + size);
-        };
-        if (method === 'GET' && path === '/pulls/7/comments')
-            return reply(true, page(state.review));
-        if (method === 'GET' && path === '/issues/7/comments')
-            return reply(true, page(state.issue));
-        if (method === 'POST' && path === '/pulls/7/reviews') {
-            if (refuseInline)
-                return reply(false);
-            state.review.push(...body.comments.map((c) => ({ body: c.body, user: BOT })));
-            return reply(true);
-        }
-        if (method === 'POST' && path === '/issues/7/comments') {
-            state.issue.push({ id: state.issue.length + 1, body: body.body, user: BOT });
-            return reply(true);
-        }
-        const patched = method === 'PATCH' && state.issue.find(c => path === `/issues/comments/${c.id}`);
-        if (patched) {
-            patched.body = body.body;
-            return reply(true);
-        }
-        return reply(false);
-    };
-    return { fetchImpl, calls };
-}
-const report = {
-    status: 'FAIL',
-    failures: [
-        finding({ gate: 'Style', severity: 'low', message: 'naming' }),
-        finding({ gate: 'Race', severity: 'high', provenance: 'deep-analysis', message: 'check-then-act', line: 30, anchor_line: 32 }),
-        finding({ gate: 'Leak', severity: 'high', provenance: 'security', message: 'token in log' }),
-        finding({ gate: 'NoLine', line: null }),
-    ],
-    deep: { model: 'anthropic/claude-sonnet-5.5', cost_usd: 0.0421, router: { routed: 3, functions: 11, already_reviewed: 2 } },
-};
-describe('the summary with a review record', () => {
-    it('carries the record: blocks, should-fixes, counts, judges and the hash', () => {
-        const record = buildRecord({ head: 'abcdef0123456789', base: '0123456789abcdef', scope: 'full', verdict: { prior_points: [], redundant: [], reads: [], scans: [], merge_impact: [], findings: [], carried: [], resolved_previous: [] },
-            accounted: { open: [{ id: 'i1', kind: 'finding', class: 'correctness', file: 'src/job.ts', line: 2, issue: 'returns before the lock' }], advisory: [], unverified: [], notes: [], resolved: [], answerInReply: [], disputed: [], dismissed: [] },
-            judges: [{ reviewer: 'claude', cost_usd: 0.5 }], lessonsServed: 0, humanReviews: 0 });
-        const body = summaryBody({ ...report, reviewer: { record } }, 1, 1, 0);
-        expect(body).toContain('**Review record** · 1 blocking · 0 should-fix');
-        expect(body).toContain('- **Blocking** `src/job.ts:2` returns before the lock');
-        expect(body).toContain(`Integrity \`${record.integrity.slice(0, 16)}\``);
-        expect(summaryBody(report, 1, 1, 0)).not.toContain('Review record');
-    });
-});
-describe('rankFindings', () => {
-    it('puts severity first, then the most provable source', () => {
-        expect(rankFindings(report.failures).map(f => f.gate)).toEqual(['Leak', 'Race', 'NoLine', 'Style']);
-    });
-});
-describe('postReview', () => {
-    it('posts at most two inline comments on their anchor lines, and one summary', async () => {
-        const state = { review: [], issue: [] };
-        const { fetchImpl, calls } = fakeGitHub(state);
-        const result = await postReview(report, target, 2, fetchImpl);
-        const review = calls.find(c => c.path === '/pulls/7/reviews').body;
-        expect(review.commit_id).toBe('abc123');
-        expect(review.comments.map((c) => [c.path, c.line])).toEqual([['src/a.ts', 10], ['src/a.ts', 32]]);
-        expect(review.comments[1].body).toContain('root cause at line 30');
-        expect(result).toMatchObject({ inline: 2, summaryUpdated: true });
-        expect(state.issue[0].body).toContain('2 already reviewed before the PR');
-        expect(state.issue[0].body).toContain('cost $0.042');
-    });
-    it('never re-posts a finding on the next push, and edits the summary instead of adding one', async () => {
-        const state = { review: [], issue: [] };
-        await postReview(report, target, 2, fakeGitHub(state).fetchImpl);
-        const { fetchImpl, calls } = fakeGitHub(state);
-        const second = await postReview(report, target, 2, fetchImpl);
-        const reposted = calls.find(c => c.path === '/pulls/7/reviews').body.comments;
-        // Leak and Race went out on the first push; only Style is new.
-        expect(reposted).toHaveLength(1);
-        expect(reposted[0].body).toContain(findingKey(report.failures[0]));
-        expect(second.skippedAlreadyPosted).toBe(2);
-        expect(calls.some(c => c.method === 'PATCH')).toBe(true);
-        expect(state.issue).toHaveLength(1);
-    });
-    it('finds its summary on a later page of a long conversation, and edits it instead of adding one', async () => {
-        const chatter = Array.from({ length: 150 }, (_, i) => ({ id: i + 1, body: `comment ${i}`, user: { login: 'someone' } }));
-        chatter[120] = { id: 121, body: '<!-- rigour:summary -->\nold', user: BOT };
-        const state = { review: [], issue: chatter };
-        const { fetchImpl, calls } = fakeGitHub(state);
-        await postReview(report, target, 2, fetchImpl);
-        expect(calls.filter(c => c.method === 'POST' && c.path === '/issues/7/comments')).toHaveLength(0);
-        expect(calls.some(c => c.method === 'PATCH' && c.path === '/issues/comments/121')).toBe(true);
-    });
-    it('still posts the summary when GitHub refuses an inline comment', async () => {
-        const state = { review: [], issue: [] };
-        const result = await postReview(report, target, 2, fakeGitHub(state, true).fetchImpl);
-        expect(result).toMatchObject({ inline: 0, summaryUpdated: true });
-        expect(state.issue[0].body).toContain('0 posted inline now');
-    });
-    it('trusts only its own comments: a marker or summary written by anyone else changes nothing', async () => {
-        const author = { login: 'pr-author' };
-        const forged = report.failures.map(f => ({ body: `<!-- rigour:finding:${findingKey(f)} -->`, user: author }));
-        const state = { review: forged, issue: [{ id: 1, body: '<!-- rigour:summary -->', user: author }] };
-        const { fetchImpl, calls } = fakeGitHub(state);
-        const result = await postReview(report, target, 2, fetchImpl);
-        expect(result).toMatchObject({ inline: 2, skippedAlreadyPosted: 0 });
-        expect(calls.some(c => c.method === 'PATCH')).toBe(false);
-        expect(state.issue.find(c => c.user === BOT)?.body).toContain('Rigour review: FAIL');
-    });
-    it('says when findings were dismissed and when the PR edits Rigour settings', async () => {
-        const state = { review: [], issue: [] };
-        await postReview({ status: 'PASS', failures: [], dismissed: 1, control_files_changed: ['.rigour/dismissed.json'] }, target, 2, fakeGitHub(state).fetchImpl);
-        expect(state.issue[0].body).toContain('1 finding(s) on changed lines were dismissed');
-        expect(state.issue[0].body).toContain('`.rigour/dismissed.json`');
-    });
-    it('shows the quality receipt: what was reviewed before the PR and what was not', () => {
-        const lines = receiptLines({
-            functions: 12, reviewed: 7, changed_since_review: 1, low_risk: 3, set_aside: 0,
-            not_covered: [
-                { file: 'src/refund.ts', function: 'issueRefund', line: 40, changed_since_review: true },
-                { file: 'src/pay.ts', function: 'formatTotal', line: 3, changed_since_review: false, lesson: 'Format money from integer cents.' },
-            ],
-        });
-        expect(lines[0]).toBe('**Quality receipt:** 12 changed functions · 7 reviewed before this PR · 1 changed after review · 3 low risk · **2 not covered**');
-        expect(lines.slice(1)).toEqual([
-            '- `issueRefund` in `src/refund.ts:40`: changed after its review',
-            '- `formatTotal` in `src/pay.ts:3`: matches a team lesson: Format money from integer cents.',
-        ]);
-        expect(receiptLines({ functions: 2, reviewed: 0, changed_since_review: 0, low_risk: 0, set_aside: 2, not_covered: [] })[1]).toContain('not counted: this check is independent');
-    });
-});
-describe('reviewPostCommand', () => {
-    it('says why when the review did not run, and posts nothing', async () => {
-        const { reviewPostCommand } = await import('./review-post.js');
-        const fs = await import('fs');
-        const os = await import('os');
-        const path = await import('path');
-        const file = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'post-')), 'report.json');
-        fs.writeFileSync(file, JSON.stringify({ error: 'rigour.yml: gates.ast.complexity: Expected number' }));
-        await expect(reviewPostCommand({ report: file })).rejects.toThrow('The review did not run, so there is nothing to post: rigour.yml: gates.ast.complexity');
-    });
-});

package/dist/commands/review-pr-body.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/commands/review-pr-body.test.js

@@ -1,19 +0,0 @@
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterEach, describe, expect, it } from 'vitest';
-import { readPrBody } from './review.js';
-let dir;
-afterEach(() => { if (dir)
-    fs.rmSync(dir, { recursive: true, force: true }); dir = undefined; });
-describe('readPrBody', () => {
-    it('prefers --pr-body, else reads the pull request of a GitHub Actions event, else nothing', () => {
-        dir = fs.mkdtempSync(path.join(os.tmpdir(), 'pr-body-'));
-        fs.writeFileSync(path.join(dir, 'body.md'), 'Fix the redirect loop.');
-        fs.writeFileSync(path.join(dir, 'event.json'), JSON.stringify({ pull_request: { title: 'fix: encode spaces', body: 'Paths with spaces looped.' } }));
-        const event = { GITHUB_EVENT_PATH: path.join(dir, 'event.json') };
-        expect(readPrBody(dir, { prBody: 'body.md' }, event)).toBe('Fix the redirect loop.');
-        expect(readPrBody(dir, {}, event)).toBe('fix: encode spaces\n\nPaths with spaces looped.');
-        expect(readPrBody(dir, {}, {})).toBeUndefined();
-    });
-});

package/dist/commands/review-receipt.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/commands/review-receipt.test.js

@@ -1,16 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { receiptFor, receiptSummary } from './review-receipt.js';
-const receipt = (over) => ({
-    functions: 4, reviewed: 1, changedSinceReview: 0, lowRisk: 2, notCovered: [], reviewers: {}, otherFiles: 0, setAside: 0, ...over,
-});
-describe('quality receipt line', () => {
-    it('counts what is known, and mentions changes after review only when there are some', () => {
-        expect(receiptSummary(receipt({}))).toBe('4 changed functions · 1 reviewed before this · 2 low risk · 0 not covered');
-        const gap = { file: 'a.ts', function: 'f', start: 3, score: 4, changedSinceReview: true };
-        expect(receiptSummary(receipt({ functions: 1, reviewed: 0, lowRisk: 0, changedSinceReview: 1, notCovered: [gap] })))
-            .toBe('1 changed function · 0 reviewed before this · 1 changed after review · 0 low risk · 1 not covered');
-    });
-    it('has no receipt without a diff', () => {
-        expect(receiptFor(process.cwd(), undefined, { gates: {} }, false)).toBeNull();
-    });
-});

package/dist/commands/review-reviewer.test.d.ts

@@ -1 +0,0 @@
-export {};