@rigour-labs/cli 7.0.0-rc.10 → 7.0.0-rc.12

package/dist/commands/hooks-push.d.ts

@@ -27,3 +27,5 @@ export declare function pushGate(dir: string): Promise<PushGateResult>;
 export declare function isPush(command: string): boolean;
 /** The directory the push runs in: `cd <dir> && git push` or `git -C <dir> push`. */
 export declare function pushTarget(command: string): string | undefined;
+/** The repository a directory is in, or undefined outside one. */
+export declare function repositoryOf(dir: string): string | undefined;

package/dist/commands/hooks-push.js

@@ -18,9 +18,15 @@ import os from 'os';
 import path from 'path';
 import { appendTaskEvent, branchBase, branchFailures, captureHumanEdits, diffFromGit, hookGoalDescription, itemLine, recordGoal, mergeBaseOf, resolveReviewer, reviewChange, reviewerCapReached, reviewerInputs, reviewerBlocks, runReviewer, runToolchain, startBackgroundReview, } from '@rigour-labs/core';
 import { loadHookConfig } from './hooks-stop.js';
+import { recordToolStart, toolCallId } from './shell-writes.js';
 import { REPORT_ONLY_PREFIX, reportOnly } from './report-only.js';
 export async function hooksPushCommand(stdin, fallbackCwd) {
     const payload = parse(stdin);
+    // Every shell call: when it started, so the edit check after it finds the files it wrote (shell-writes.ts).
+    const started = repositoryOf(payload.cwd ?? fallbackCwd);
+    const call = toolCallId(payload);
+    if (started && call)
+        recordToolStart(started, call);
     const command = String(payload.tool_input?.command ?? '');
     if (!isPush(command))
         return { exitCode: 0, message: '' };
@@ -147,7 +153,8 @@ export function pushTarget(command) {
     const dir = match?.slice(1).find(Boolean);
     return dir?.replace(/^~(?=\/|$)/, os.homedir());
 }
-function repositoryOf(dir) {
+/** The repository a directory is in, or undefined outside one. */
+export function repositoryOf(dir) {
     const result = spawnSync('git', ['rev-parse', '--show-toplevel'], { cwd: dir, encoding: 'utf8' });
     return result.status === 0 ? result.stdout.trim() : undefined;
 }

package/dist/commands/hooks.js

@@ -22,6 +22,8 @@ import { agentHome, asUserLevel, installedAgents } from './personal.js';
 import { hookStdin } from './hook-input.js';
 import { loadHookConfig } from './hooks-stop.js';
 import { REPORT_ONLY_PREFIX, reportOnly } from './report-only.js';
+import { filesWrittenSince, toolCallId } from './shell-writes.js';
+import { repositoryOf } from './hooks-push.js';
 function getHookCliVersion() {
     const thisDir = path.dirname(fileURLToPath(import.meta.url));
     const packagePath = path.resolve(thisDir, '../../package.json');
@@ -160,8 +162,9 @@ function generateClaudeHooks(checker, block, dlp = true, brief = false) {
     const blockFlag = block ? ' --block' : '';
     const checkerCommand = checkerToShellCommand(checker);
     const hooks = {
+        // Every write is checked, whichever tool made it: a shell command's writes too (shell-writes.ts).
         PostToolUse: [{
-                matcher: "Write|Edit|MultiEdit",
+                matcher: "Write|Edit|MultiEdit|NotebookEdit|Bash",
                 hooks: [{
                         type: "command",
                         command: `${checkerCommand} --stdin${blockFlag}`,
@@ -582,6 +585,8 @@ export function parseStdinFiles(input) {
             if (typeof ti === 'object' && ti !== null) {
                 if (ti.file_path)
                     return [ti.file_path];
+                if (ti.notebook_path)
+                    return [ti.notebook_path]; // Claude Code NotebookEdit
                 if (ti.path)
                     return [ti.path];
             }
@@ -767,6 +772,7 @@ export async function hooksCheckCommand(cwd, options = {}) {
     let rawStdin = '';
     let cursorMode = false;
     let hookSession;
+    let shellWrites;
     if (options.stdin) {
         rawStdin = await hookStdin();
         // Detect Cursor/IDE hook payload format
@@ -781,15 +787,24 @@ export async function hooksCheckCommand(cwd, options = {}) {
                 recordSessionBaseline(cwd, session);
                 hookSession = session;
             }
+            // A shell call: the files it wrote, found from the working tree, not the command (shell-writes.ts).
+            if (payload.tool_name === 'Bash') {
+                const repo = repositoryOf(typeof payload.cwd === 'string' ? payload.cwd : cwd);
+                const call = toolCallId(payload);
+                shellWrites = repo && call ? filesWrittenSince(repo, call) ?? [] : [];
+            }
         }
         catch (parseErr) {
             // Not valid JSON — log for debugging (stderr only, stdout must stay clean)
             process.stderr.write(`[rigour-hook-debug] stdin JSON parse failed: ${parseErr?.message?.slice(0, 100)}\n`);
         }
     }
-    const files = options.stdin
+    // A shell call that wrote nothing: nothing to check, and nothing to say.
+    if (shellWrites && shellWrites.length === 0)
+        return;
+    const files = shellWrites ?? (options.stdin
         ? parseStdinFiles(rawStdin)
-        : (options.files ?? '').split(',').map(f => f.trim()).filter(Boolean);
+        : (options.files ?? '').split(',').map(f => f.trim()).filter(Boolean));
     if (files.length === 0) {
         // The old edit hook passes "$TOOL_INPUT_file_path", which the agent never sets: an empty --files. Say so on every
         // edit, with a non-zero exit the agent shows the person, until it is migrated; it never blocks the edit.

package/dist/commands/install-record.d.ts

@@ -8,6 +8,8 @@ export declare function recordCreated(cwd: string, relPath: string, content: str
 export declare function unchangedSinceInstall(record: InstallRecord, relPath: string, content: string): boolean;
 /** A server entry Rigour wrote (npx of its MCP package), which setup may re-pin; one the person changed is theirs. */
 export declare function isRigourMcpEntry(entry: unknown): boolean;
+/** Whether an MCP server entry, or `claude mcp get`'s description of one, runs Rigour's server: the package, or a checkout's build. */
+export declare function namesRigourMcp(entry: unknown): boolean;
 /** A hook script Rigour wrote (the Cline hooks): it names Rigour in its header or runs the Rigour CLI. */
 export declare function isRigourScript(text: string): boolean;
 /**

package/dist/commands/install-record.js

@@ -38,6 +38,11 @@ export function isRigourMcpEntry(entry) {
     const e = entry;
     return e?.command === 'npx' && Array.isArray(e.args) && e.args.some(a => typeof a === 'string' && a.startsWith('@rigour-labs/mcp'));
 }
+/** Whether an MCP server entry, or `claude mcp get`'s description of one, runs Rigour's server: the package, or a checkout's build. */
+export function namesRigourMcp(entry) {
+    const text = typeof entry === 'string' ? entry : JSON.stringify(entry ?? '');
+    return /@rigour-labs\/mcp|rigour-mcp[\\/]+dist/.test(text);
+}
 /** A hook script Rigour wrote (the Cline hooks): it names Rigour in its header or runs the Rigour CLI. */
 export function isRigourScript(text) {
     return /hook for Rigour|@rigour-labs\/cli/.test(text) || isRigourCommand(text);

package/dist/commands/personal.d.ts

@@ -24,7 +24,10 @@ export declare function asUserLevel<T extends {
     path: string;
     content: string;
 }>(file: T): T;
-export type McpState = 'added' | 'updated' | 'present' | 'removed' | 'absent' | 'no CLI';
+/** `taken`: a user-level server named rigour that is not Rigour's; Rigour's is not registered over it. */
+export type McpState = 'added' | 'updated' | 'present' | 'removed' | 'absent' | 'no CLI' | 'taken';
+/** What setup and doctor say when another server holds the name. */
+export declare const MCP_NAME_TAKEN = "a user-level MCP server named rigour exists and is not Rigour's; rename it, then run rigour setup again";
 /**
  * The Rigour MCP server at user level: Claude Code through its own `claude mcp add --scope user`
  * (its state file is Claude's, not Rigour's to edit), Cursor merged into `~/.cursor/mcp.json`.

package/dist/commands/personal.js

@@ -16,7 +16,7 @@ import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import { rigourUserDir } from '@rigour-labs/core';
-import { isEmptyConfig, isRigourMcpEntry, readInstallRecord, recordCreated, unchangedSinceInstall, withoutRigour } from './install-record.js';
+import { isEmptyConfig, isRigourMcpEntry, namesRigourMcp, readInstallRecord, recordCreated, unchangedSinceInstall, withoutRigour } from './install-record.js';
 const MARKER = 'rigour-enabled';
 /**
  * Where the agents keep their user-level configs: RIGOUR_AGENT_HOME when set (tests, a sandbox),
@@ -136,6 +136,8 @@ export function asUserLevel(file) {
     };
     return { ...file, path: target, content: JSON.stringify(guard(JSON.parse(file.content)), null, 4) };
 }
+/** What setup and doctor say when another server holds the name. */
+export const MCP_NAME_TAKEN = "a user-level MCP server named rigour exists and is not Rigour's; rename it, then run rigour setup again";
 /**
  * The Rigour MCP server at user level: Claude Code through its own `claude mcp add --scope user`
  * (its state file is Claude's, not Rigour's to edit), Cursor merged into `~/.cursor/mcp.json`.
@@ -147,6 +149,9 @@ export function registerUserMcp(server) {
         const get = claude(['mcp', 'get', 'rigour']);
         if (!get.ok)
             state = add() ? 'added' : 'no CLI';
+        // Another server holds the name: Rigour's is not registered over it, and the person is told.
+        else if (!namesRigourMcp(get.stdout))
+            state = 'taken';
         // Rigour's own registration at another version is moved to this one, as the hooks are; one the person changed stays.
         else if (/@rigour-labs\/mcp/.test(get.stdout) && !get.stdout.includes(server.args[server.args.length - 1])) {
             claude(['mcp', 'remove', '--scope', 'user', 'rigour']);
@@ -169,6 +174,8 @@ export function registerUserMcp(server) {
         }
     }
     const current = config?.mcpServers?.rigour;
+    if (current && !namesRigourMcp(current))
+        return { claude: state, cursor: 'taken' };
     if (current && (JSON.stringify(current) === JSON.stringify(server) || !isRigourMcpEntry(current)))
         return { claude: state, cursor: 'present' };
     config.mcpServers = { ...(config.mcpServers ?? {}), rigour: server };

package/dist/commands/repo-setup.js

@@ -7,7 +7,8 @@ import fs from 'fs';
 import path from 'path';
 import { getContextEvents } from '@rigour-labs/core';
 import { resolveMCPServerConfig } from './init.js';
-import { agentHome, enabledHere } from './personal.js';
+import { agentHome, enabledHere, MCP_NAME_TAKEN } from './personal.js';
+import { namesRigourMcp } from './install-record.js';
 import { isOldEditHook } from './setup-migrations.js';
 import { getCliVersion } from '../utils/cli-version.js';
 import { checkoutRoots, eventsAcross } from './studio-checkouts.js';
@@ -39,7 +40,7 @@ export async function checkRepoSetup(cwd, now = new Date(), toolCalls, installed
         configCheck(cwd, personal),
         editCheck(agents, now, events, setup),
         stopCheck(agents.map(a => a.config).join('\n'), now, events, setup),
-        mcpCheck(mcpConfig, now, calls),
+        mcpCheck(mcpConfig, now, calls, nameTaken(readFrom(agentHome()))),
         ...(version ? [version] : []),
         prCheck(cwd),
     ];
@@ -93,8 +94,24 @@ function stopCheck(config, now, events, setup) {
         return { id: 'stop', name, state: 'missing', detail: 'No stop hook configured', fix: setup };
     return fired('stop', name, events.filter(e => e.type === 'stop_review'), now, 'finish checks');
 }
-function mcpCheck(mcpJson, now, calls) {
+/** Which agent's user-level config holds a server named rigour that is not Rigour's (personal.ts MCP_NAME_TAKEN). */
+function nameTaken(home) {
+    for (const [agent, rel] of [['Claude Code', '.claude.json'], ['Cursor', '.cursor/mcp.json']]) {
+        try {
+            const entry = JSON.parse(home(rel) || '{}')?.mcpServers?.rigour;
+            if (entry && !namesRigourMcp(entry))
+                return agent;
+        }
+        catch {
+            // not JSON: not Rigour's to judge
+        }
+    }
+    return undefined;
+}
+function mcpCheck(mcpJson, now, calls, taken) {
     const name = 'Rigour tools for agents (MCP)';
+    if (taken)
+        return { id: 'mcp', name, state: 'broken', detail: `${taken}: ${MCP_NAME_TAKEN}`, fix: 'rename the other server, then rigour setup' };
     if (!mcpJson.includes('rigour') && calls.length === 0) {
         return { id: 'mcp', name, state: 'missing', detail: 'Agents cannot ask Rigour for review tasks or lessons', fix: `claude mcp add --scope user rigour -- ${[resolveMCPServerConfig().command, ...resolveMCPServerConfig().args].join(' ')}` };
     }

package/dist/commands/setup.js

@@ -22,7 +22,7 @@ import { installGitPushHook } from './hooks-git.js';
 import { hooksInitCommand, installMachineHooks, pinnedCliCommand, projectHookPaths } from './hooks.js';
 import { initCommand, registerProjectMcp, resolveMCPServerConfig } from './init.js';
 import { writeAgentInstructions } from './init-handshake.js';
-import { disableHere, enableHere, registerUserMcp } from './personal.js';
+import { disableHere, enableHere, MCP_NAME_TAKEN, registerUserMcp } from './personal.js';
 import { applyConfigMigrations, isOldEditHook } from './setup-migrations.js';
 import { getCliVersion } from '../utils/cli-version.js';
 import { setupSemantic } from './semantic.js';
@@ -80,6 +80,9 @@ async function personalSetup(cwd, brief) {
         console.log(chalk.yellow(`Claude Code MCP: add it with ${chalk.cyan(`claude mcp add --scope user rigour -- ${[resolveMCPServerConfig().command, ...resolveMCPServerConfig().args].join(' ')}`)}`));
     else
         console.log(chalk.green(`✔ Rigour tools for agents (MCP): Claude Code ${mcp.claude}, Cursor ${mcp.cursor}`));
+    for (const [agent, state] of [['Claude Code', mcp.claude], ['Cursor', mcp.cursor]])
+        if (state === 'taken')
+            console.log(chalk.yellow(`${agent}: ${MCP_NAME_TAKEN}.`));
 }
 async function teamSetup(cwd, options) {
     // A personal switch here would run the machine hooks beside the committed ones.

package/dist/commands/shell-writes.d.ts

@@ -0,0 +1,13 @@
+/** The call's id in the hook payload: Claude Code's tool_use_id, else the session's. */
+export declare function toolCallId(payload: {
+    tool_use_id?: unknown;
+    session_id?: unknown;
+    conversation_id?: unknown;
+}): string | undefined;
+/** Before the call: when it started. */
+export declare function recordToolStart(repo: string, id: string, now?: number): void;
+/**
+ * After the call: the files it wrote (absolute paths), changed or new in the working tree and written since it started.
+ * Undefined when no start was recorded for it (the hook before the call did not run). The record is used once.
+ */
+export declare function filesWrittenSince(repo: string, id: string): string[] | undefined;

package/dist/commands/shell-writes.js

@@ -0,0 +1,65 @@
+/**
+ * The files a shell command wrote, so the edit check sees writes an agent makes through its shell (a heredoc, a
+ * redirect, `sed -i`, `gofmt -w`) as it sees an Edit. Found without reading the command: the hook before the call
+ * records when it started, and the hook after it asks git which files are changed or new and were written since then.
+ */
+import { spawnSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+import { repoStateDir } from '@rigour-labs/core';
+/** A file's mtime and the call's start come from two clocks a few milliseconds apart: this much earlier still counts. */
+const CLOCK_SLACK_MS = 50;
+/** The call's id in the hook payload: Claude Code's tool_use_id, else the session's. */
+export function toolCallId(payload) {
+    const id = payload.tool_use_id ?? payload.session_id ?? payload.conversation_id;
+    return typeof id === 'string' && /^[\w.:-]{1,200}$/.test(id) ? id : undefined;
+}
+function startFile(repo, id) {
+    return path.join(repoStateDir(repo), 'tool-calls', id);
+}
+/** Before the call: when it started. */
+export function recordToolStart(repo, id, now = Date.now()) {
+    const file = startFile(repo, id);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, String(now));
+}
+/**
+ * After the call: the files it wrote (absolute paths), changed or new in the working tree and written since it started.
+ * Undefined when no start was recorded for it (the hook before the call did not run). The record is used once.
+ */
+export function filesWrittenSince(repo, id) {
+    const file = startFile(repo, id);
+    let start;
+    try {
+        start = Number(fs.readFileSync(file, 'utf8'));
+        fs.rmSync(file, { force: true });
+    }
+    catch {
+        return undefined;
+    }
+    const status = spawnSync('git', ['status', '--porcelain=v1', '-z', '--untracked-files=all'], { cwd: repo, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+    if (status.status !== 0)
+        return [];
+    const written = [];
+    const entries = status.stdout.split('\0');
+    for (let i = 0; i < entries.length; i++) {
+        const entry = entries[i];
+        if (entry.length < 4)
+            continue;
+        const code = entry.slice(0, 2);
+        if (code[0] === 'R' || code[0] === 'C')
+            i++; // a rename's old path follows; the entry holds the new one
+        if (code.includes('D'))
+            continue;
+        const full = path.join(repo, entry.slice(3));
+        try {
+            const stat = fs.statSync(full);
+            if (stat.isFile() && stat.mtimeMs >= start - CLOCK_SLACK_MS)
+                written.push(full);
+        }
+        catch {
+            // gone since git listed it
+        }
+    }
+    return written;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/cli",
-  "version": "7.0.0-rc.10",
+  "version": "7.0.0-rc.12",
   "description": "Code review that happens while your agent writes: deterministic checks on the lines it changed, quiet unless it can prove a defect, and learning from your team's fixes and dismissals. Works with Claude Code, Cursor, Codex, Cline and Windsurf.",
   "engines": {
     "node": ">=22.13"
@@ -59,12 +59,12 @@
     "globby": "^14.0.1",
     "ora": "^8.0.1",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "7.0.0-rc.10"
+    "@rigour-labs/core": "7.0.0-rc.12"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",
     "@types/node": "^25.0.3",
-    "@rigour-labs/studio": "7.0.0-rc.10"
+    "@rigour-labs/studio": "7.0.0-rc.12"
   },
   "scripts": {
     "build": "tsc && pnpm bundle-studio",