@rigour-labs/cli 7.0.0-rc.1 → 7.0.0-rc.11

package/dist/commands/setup.js

@@ -5,9 +5,10 @@
  * at user level, guarded so they run only where Rigour is switched on; this repository is switched
  * on inside its git directory (personal.ts). For trying Rigour, or using it alone.
  *
- * Team (`--team`, or a repository that already commits a rigour.yml): rigour.yml, the project's
- * agent hooks and its MCP server are written into the repository, so everyone who clones gets the
- * same gate. Agent instruction files only with `--instructions`.
+ * Team (`--team`): rigour.yml, the project's agent hooks and its MCP server are written into the
+ * repository, so everyone who clones gets the same gate. Agent instruction files only with
+ * `--instructions`. Only `--team` ever writes into the working tree: in a repository that commits its
+ * own Rigour hooks, a plain `rigour setup` leaves every file as committed (the team's install runs).
  *
  * Both install semantic search once per machine (semantic.ts) unless --no-semantic, end with the
  * same checks as `rigour doctor`, and are taken back out by `rigour uninstall`.
@@ -18,22 +19,40 @@ import fs from 'fs';
 import path from 'path';
 import { printRepoSetup } from './doctor.js';
 import { installGitPushHook } from './hooks-git.js';
-import { hooksInitCommand, installMachineHooks, pinnedCliCommand } from './hooks.js';
+import { hooksInitCommand, installMachineHooks, pinnedCliCommand, projectHookPaths } from './hooks.js';
 import { initCommand, registerProjectMcp, resolveMCPServerConfig } from './init.js';
 import { writeAgentInstructions } from './init-handshake.js';
 import { disableHere, enableHere, registerUserMcp } from './personal.js';
-import { applyConfigMigrations } from './setup-migrations.js';
+import { applyConfigMigrations, isOldEditHook } from './setup-migrations.js';
+import { getCliVersion } from '../utils/cli-version.js';
 import { setupSemantic } from './semantic.js';
+import { setReportOnlyHere, TEAM_REQUIRES_BLOCKING } from './report-only.js';
+import yaml from 'yaml';
 const AGENT_NAME = { claude: 'Claude Code', cursor: 'Cursor', cline: 'Cline', windsurf: 'Windsurf' };
 export async function setupCommand(cwd = process.cwd(), options = {}) {
-    const team = options.team || committedConfig(cwd);
-    console.log(chalk.bold.cyan(`\nRigour setup (${team ? 'team: committed to this repository' : 'personal: nothing in your working tree'})\n`));
-    if (team)
+    const team = !!options.team;
+    const committed = team ? [] : committedRigourHooks(cwd);
+    const mode = team ? 'team: committed to this repository' : committed.length ? "the team's install: nothing in your working tree" : 'personal: nothing in your working tree';
+    console.log(chalk.bold.cyan(`\nRigour setup (${mode})\n`));
+    if (team) {
+        const touched = trackedFiles(cwd, ['rigour.yml', ...rigourInstallPaths()]);
+        if (touched.length)
+            console.log(chalk.yellow(`Writes into these committed files (commit the result so everyone gets it): ${touched.join(', ')}\n`));
         await teamSetup(cwd, options);
-    else
+    }
+    else if (committed.length)
+        await leaveTeamInstall(cwd, committed, !!options.instructions);
+    else {
+        if (trackedFiles(cwd, ['rigour.yml']).length)
+            console.log(chalk.dim('This repository commits rigour.yml; `rigour setup --team` commits hooks for everyone. This setup is yours alone.\n'));
         await personalSetup(cwd, options.brief !== false);
-    for (const change of applyConfigMigrations(cwd))
-        console.log(chalk.green(`✔ Migrated ${change}`));
+    }
+    // rigour.yml is the team's file: only --team changes it (doctor's checks below name what is due).
+    if (team)
+        for (const change of applyConfigMigrations(cwd))
+            console.log(chalk.green(`✔ Migrated ${change}`));
+    if (options.reportOnly || options.block)
+        setGateMode(cwd, team, !!options.reportOnly);
     if (options.semantic !== false)
         await setupSemantic(cwd);
     await printRepoSetup(cwd);
@@ -75,7 +94,74 @@ async function teamSetup(cwd, options) {
     else
         await initCommand(cwd, { instructions: options.instructions, brief: options.brief !== false });
 }
-/** A rigour.yml the repository tracks: the team has adopted Rigour, so setup completes their install. */
-function committedConfig(cwd) {
-    return spawnSync('git', ['ls-files', '--error-unmatch', 'rigour.yml'], { cwd, encoding: 'utf8' }).status === 0;
+/**
+ * Report-only or blocking, for this repository: the person's switch in the git directory, and with --team the team's
+ * in rigour.yml (`hooks.report_only`: true, or false with --block), so everyone who clones starts the same way.
+ */
+function setGateMode(cwd, team, report) {
+    setReportOnlyHere(cwd, report);
+    const file = path.join(cwd, 'rigour.yml');
+    if (!team && report && fs.existsSync(file) && yaml.parse(fs.readFileSync(file, 'utf8'))?.hooks?.report_only === false) {
+        console.log(chalk.yellow(TEAM_REQUIRES_BLOCKING));
+        return;
+    }
+    if (team && fs.existsSync(file)) {
+        const doc = yaml.parseDocument(fs.readFileSync(file, 'utf8'));
+        // A team that turns blocking on means block: an explicit false, the floor no person's switch lowers.
+        doc.setIn(['hooks', 'report_only'], report);
+        fs.writeFileSync(file, doc.toString());
+    }
+    console.log(report
+        ? chalk.green(`✔ Report only: the edit check, the stop review and the push gate say what they would block and block nothing${team ? ' (hooks.report_only in rigour.yml)' : ''}. A real credential is still refused. Make them block: rigour setup${team ? ' --team' : ''} --block`)
+        : chalk.green('✔ The edit check, the stop review and the push gate block again.'));
+}
+/**
+ * The team's install, as committed here: tracked project hook and MCP files that run Rigour. Their agents already run
+ * them, so a person's setup changes none of them, and personal hooks beside them would run every check twice.
+ */
+async function leaveTeamInstall(cwd, committed, instructions) {
+    disableHere(cwd, false);
+    const text = committed.map(file => fs.readFileSync(path.join(cwd, file), 'utf8')).join('\n');
+    const pins = [...new Set([...text.matchAll(/@rigour-labs\/cli@([0-9A-Za-z.-]+)/g)].map(m => m[1]))];
+    const installed = getCliVersion();
+    const stale = pins.filter(pin => pin !== installed);
+    console.log(chalk.green('✔ This repository commits its own Rigour install, and your agents run it. Left as committed:'));
+    for (const file of committed)
+        console.log(chalk.dim(`    ${file}`));
+    if (stale.length) {
+        // The committed pin is what the agents run: name it, and what it costs, since this setup does not move it.
+        const caveat = isOldEditHook(text) ? ' (its edit hook checks nothing)' : '';
+        console.log(chalk.yellow(`  These hooks pin Rigour ${pins.join(', ')}; they keep running that version${caveat} until someone runs \`rigour setup --team\` and commits the result. Installed here: ${installed}.`));
+    }
+    else
+        console.log(chalk.dim('  To change it for everyone: rigour setup --team, then commit the result.'));
+    // This clone's own: git's pre-push hook lives in the git directory, never in the working tree.
+    const push = installGitPushHook(cwd, pinnedCliCommand(), { workingTree: false });
+    if (push.action === 'managed elsewhere')
+        console.log(chalk.yellow(`Git pre-push hooks are managed outside this repository (${push.path}); add: ${pinnedCliCommand()} hooks push --git "$@" || exit $?`));
+    else if (push.action !== 'no repository')
+        console.log(chalk.green(`✔ Push gate: git's pre-push hook (${push.action}); the only thing installed here`));
+    // Asked for by name: written only where the repository has none, so no committed file changes.
+    if (instructions)
+        await writeAgentInstructions(cwd);
+}
+/** Where a team's Rigour install lives in the repository: the project hook and MCP configs. */
+function rigourInstallPaths() {
+    return [...projectHookPaths(), '.mcp.json', '.cursor/mcp.json'];
+}
+/** Which of these paths git tracks here. */
+function trackedFiles(cwd, paths) {
+    const tracked = spawnSync('git', ['ls-files', '--', ...paths], { cwd, encoding: 'utf8' });
+    return tracked.status === 0 ? tracked.stdout.split('\n').filter(Boolean) : [];
+}
+/** The tracked files of a team's Rigour install: project hook and MCP configs that name Rigour. */
+function committedRigourHooks(cwd) {
+    return trackedFiles(cwd, rigourInstallPaths()).filter(file => {
+        try {
+            return /rigour/i.test(fs.readFileSync(path.join(cwd, file), 'utf8'));
+        }
+        catch {
+            return false;
+        }
+    });
 }

package/dist/commands/shell-writes.d.ts

@@ -0,0 +1,13 @@
+/** The call's id in the hook payload: Claude Code's tool_use_id, else the session's. */
+export declare function toolCallId(payload: {
+    tool_use_id?: unknown;
+    session_id?: unknown;
+    conversation_id?: unknown;
+}): string | undefined;
+/** Before the call: when it started. */
+export declare function recordToolStart(repo: string, id: string, now?: number): void;
+/**
+ * After the call: the files it wrote (absolute paths), changed or new in the working tree and written since it started.
+ * Undefined when no start was recorded for it (the hook before the call did not run). The record is used once.
+ */
+export declare function filesWrittenSince(repo: string, id: string): string[] | undefined;

package/dist/commands/shell-writes.js

@@ -0,0 +1,65 @@
+/**
+ * The files a shell command wrote, so the edit check sees writes an agent makes through its shell (a heredoc, a
+ * redirect, `sed -i`, `gofmt -w`) as it sees an Edit. Found without reading the command: the hook before the call
+ * records when it started, and the hook after it asks git which files are changed or new and were written since then.
+ */
+import { spawnSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+import { repoStateDir } from '@rigour-labs/core';
+/** A file's mtime and the call's start come from two clocks a few milliseconds apart: this much earlier still counts. */
+const CLOCK_SLACK_MS = 50;
+/** The call's id in the hook payload: Claude Code's tool_use_id, else the session's. */
+export function toolCallId(payload) {
+    const id = payload.tool_use_id ?? payload.session_id ?? payload.conversation_id;
+    return typeof id === 'string' && /^[\w.:-]{1,200}$/.test(id) ? id : undefined;
+}
+function startFile(repo, id) {
+    return path.join(repoStateDir(repo), 'tool-calls', id);
+}
+/** Before the call: when it started. */
+export function recordToolStart(repo, id, now = Date.now()) {
+    const file = startFile(repo, id);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, String(now));
+}
+/**
+ * After the call: the files it wrote (absolute paths), changed or new in the working tree and written since it started.
+ * Undefined when no start was recorded for it (the hook before the call did not run). The record is used once.
+ */
+export function filesWrittenSince(repo, id) {
+    const file = startFile(repo, id);
+    let start;
+    try {
+        start = Number(fs.readFileSync(file, 'utf8'));
+        fs.rmSync(file, { force: true });
+    }
+    catch {
+        return undefined;
+    }
+    const status = spawnSync('git', ['status', '--porcelain=v1', '-z', '--untracked-files=all'], { cwd: repo, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+    if (status.status !== 0)
+        return [];
+    const written = [];
+    const entries = status.stdout.split('\0');
+    for (let i = 0; i < entries.length; i++) {
+        const entry = entries[i];
+        if (entry.length < 4)
+            continue;
+        const code = entry.slice(0, 2);
+        if (code[0] === 'R' || code[0] === 'C')
+            i++; // a rename's old path follows; the entry holds the new one
+        if (code.includes('D'))
+            continue;
+        const full = path.join(repo, entry.slice(3));
+        try {
+            const stat = fs.statSync(full);
+            if (stat.isFile() && stat.mtimeMs >= start - CLOCK_SLACK_MS)
+                written.push(full);
+        }
+        catch {
+            // gone since git listed it
+        }
+    }
+    return written;
+}

package/dist/commands/studio-learning.d.ts

@@ -50,6 +50,8 @@ export interface LessonJourney {
     };
     /** A candidate only review bots raised, nothing waiting on a person (core quietBotCandidate): hidden until a person asks to see bot points. */
     fromBots?: true;
+    /** A person's last decision on a review lesson (promoted, rejected, not a rule) can be taken back to a candidate (core takeBackable). */
+    canTakeBack?: true;
     /**
      * Teammates' decisions on a review lesson, received from the team database (core team-decisions.ts): each with the
      * teammate's display name and when the team database got it; and, when a later team decision settled the lesson

package/dist/commands/studio-learning.js

@@ -7,7 +7,7 @@
  * lesson's subject prefix). Counts that Rigour cannot know here are null, never 0: PR catches
  * recorded on another machine (CI) never reach this one.
  */
-import { acceptSuggestedText, scopeLesson, decideCompiledCheck, decideLesson, fixLessonPrefix, proposeCompiledChecks, readCompiledChecks, suspension, localOutcomeMetrics, pendingDecision, quietBotCandidate, listKnowledgeLessons, readLessons, lastDecision, readTeamDecisionCache } from '@rigour-labs/core';
+import { acceptSuggestedText, scopeLesson, decideCompiledCheck, decideLesson, fixLessonPrefix, proposeCompiledChecks, readCompiledChecks, suspension, localOutcomeMetrics, pendingDecision, quietBotCandidate, listKnowledgeLessons, readLessons, lastDecision, takeBackable, readTeamDecisionCache } from '@rigour-labs/core';
 import { decider } from './git-identity.js';
 import { checkoutRoots, eventsAcross, storiesAcross } from './studio-checkouts.js';
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
@@ -53,6 +53,7 @@ export function buildLearning(input) {
             ...(l.suggestedText ? { suggestedText: { text: l.suggestedText, why: l.suggestedWhy ?? 'reworded' } } : {}),
             reach: { scope: l.scope ?? 'file', hasFile: !!l.file },
             ...(quietBotCandidate(l) ? { fromBots: true } : {}),
+            ...(takeBackable(l) ? { canTakeBack: true } : {}),
         })),
         // Lessons back to a candidate when outcomes stopped promoting come first: a person decides each once.
     ].sort((a, b) => Number(!!b.reclassified) - Number(!!a.reclassified) || b.learnedAt.localeCompare(a.learnedAt))
@@ -107,6 +108,7 @@ function decisionFor(lesson) {
 function studioWhy(why) {
     return typeof why === 'string' && why.trim() ? why.trim() : 'decided in Studio';
 }
+const REVIEW_DECISIONS = new Set(['accepted', 'rejected', 'dismissed', 'not-a-rule', 'took-back']);
 /** A person's decision on a review lesson from Studio, recorded as `rigour learn-reviews --promote / --reject` records it: with their git email, and final. */
 export function decideReviewLesson(cwd, body) {
     const { id, decision, why } = (body ?? {});
@@ -116,8 +118,8 @@ export function decideReviewLesson(cwd, body) {
         return rewordFromStudio(cwd, id);
     if (decision === 'scope')
         return scopeFromStudio(cwd, id, body.to, why);
-    if (decision !== 'accepted' && decision !== 'rejected' && decision !== 'dismissed')
-        throw new Error('decision is accepted, rejected, dismissed, reworded or scope');
+    if (!REVIEW_DECISIONS.has(decision))
+        throw new Error('decision is accepted, rejected, dismissed, not-a-rule, took-back, reworded or scope');
     const lesson = decideLesson(cwd, id, decision, decider(cwd), studioWhy(why));
     if (!lesson)
         throw new Error(`no review lesson ${id}`);

package/dist/commands/team.js

@@ -98,8 +98,14 @@ teamCommand
     .description("Send queued lessons from the team's repositories, and your decisions on this repository's review lessons; receive the team's")
     .option('--dry-run', 'Report pending records without sending them')
     .action(async (options) => {
-    const result = await syncTeamOutbox({ dryRun: Boolean(options.dryRun), cwd: process.cwd() });
-    console.log(JSON.stringify(result, null, 2));
+    try {
+        console.log(JSON.stringify(await syncTeamOutbox({ dryRun: Boolean(options.dryRun), cwd: process.cwd() }), null, 2));
+    }
+    catch (error) {
+        // One line, with the fix when there is one; never the database driver's stack.
+        console.error(chalk.red(`Team sync failed: ${error instanceof Error ? error.message : String(error)}`));
+        process.exitCode = 1;
+    }
 });
 /** Initialize the schema, or print why it failed (with the fix) and set exit code 1. */
 async function initializeSchemaOrReport(databaseUrl, pgvector) {

package/dist/commands/uninstall.js

@@ -22,6 +22,7 @@ import fs from 'fs';
 import path from 'path';
 import { APPENDED_COMMENT } from './hooks-git.js';
 import { disableHere, enabledHere, uninstallMachine } from './personal.js';
+import { setReportOnlyHere } from './report-only.js';
 import { isEmptyConfig, isRigourScript, readInstallRecord, unchangedSinceInstall, withoutRigour } from './install-record.js';
 import { GITIGNORE_PATTERNS } from './init.js';
 const CONFIGS = ['.claude/settings.json', '.cursor/hooks.json', '.windsurf/hooks.json', '.cursor/mcp.json', '.mcp.json'];
@@ -78,7 +79,7 @@ export function uninstall(cwd, options = {}) {
     gitHook(cwd, act, report);
     // A personal install: the switch inside the git directory (and its exclude line, with .rigour/ itself).
     if (enabledHere(cwd))
-        act('switch Rigour off for this repository (personal install)', () => disableHere(cwd, !!options.all));
+        act('switch Rigour off for this repository (personal install)', () => { disableHere(cwd, !!options.all); setReportOnlyHere(cwd, false); });
     else if (options.all && !options.dryRun)
         disableHere(cwd, true);
     if (options.machine)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/cli",
-  "version": "7.0.0-rc.1",
+  "version": "7.0.0-rc.11",
   "description": "Code review that happens while your agent writes: deterministic checks on the lines it changed, quiet unless it can prove a defect, and learning from your team's fixes and dismissals. Works with Claude Code, Cursor, Codex, Cline and Windsurf.",
   "engines": {
     "node": ">=22.13"
@@ -59,12 +59,12 @@
     "globby": "^14.0.1",
     "ora": "^8.0.1",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "7.0.0-rc.1"
+    "@rigour-labs/core": "7.0.0-rc.11"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",
     "@types/node": "^25.0.3",
-    "@rigour-labs/studio": "7.0.0-rc.1"
+    "@rigour-labs/studio": "7.0.0-rc.11"
   },
   "scripts": {
     "build": "tsc && pnpm bundle-studio",