@rigour-labs/cli 7.0.0-rc.3 → 7.0.0-rc.5

package/dist/commands/doctor.js

@@ -151,7 +151,7 @@ export async function printRepoSetup(cwd) {
     // Settings an older Rigour wrote that no longer mean what they say: loud, since nothing else reports them.
     for (const migration of configMigrations(cwd)) {
         console.log(`  ${chalk.red('✘')} ${chalk.red(migration.problem)}`);
-        console.log(chalk.dim(`      fix: ${migration.automatic ? 'rigour setup' : 'edit rigour.yml'}`));
+        console.log(chalk.dim(`      fix: ${migration.automatic ? 'rigour setup --team' : 'edit rigour.yml'}`));
     }
     console.log('');
 }

package/dist/commands/hooks.d.ts

@@ -34,6 +34,8 @@ export interface HooksCheckOptions {
 }
 /** This CLI, pinned to its version, as a hook runs it (`npx --yes @rigour-labs/cli@6.6.6`). */
 export declare function pinnedCliCommand(): string;
+/** Every project file Rigour's hooks are written to, for every agent: what a team commits when it installs Rigour. */
+export declare function projectHookPaths(): string[];
 /**
  * The personal install's agent hooks, once per machine (personal.ts): every agent's user-level
  * config, each command guarded so it runs only in a repository switched on with `rigour setup`.

package/dist/commands/hooks.js

@@ -382,6 +382,11 @@ const GENERATORS = {
     cline: generateClineHooks,
     windsurf: generateWindsurfHooks,
 };
+/** Every project file Rigour's hooks are written to, for every agent: what a team commits when it installs Rigour. */
+export function projectHookPaths() {
+    const checker = resolveCheckerCommand();
+    return [...new Set(Object.keys(GENERATORS).flatMap(tool => GENERATORS[tool](checker, true).map(file => file.path)))];
+}
 // ── File writing ─────────────────────────────────────────────────────
 function printDryRun(files) {
     console.log(chalk.cyan('\nDry run — files that would be created:\n'));

package/dist/commands/repo-setup.js

@@ -32,11 +32,13 @@ export async function checkRepoSetup(cwd, now = new Date(), toolCalls, installed
         { name: 'Windsurf', config: read('.windsurf/hooks.json') + home('.codeium/windsurf/hooks.json') },
     ].filter(a => a.config);
     const mcpConfig = read('.mcp.json') + read('.cursor/mcp.json') + home('.claude.json') + home('.cursor/mcp.json');
-    const version = versionCheck(agents.map(a => a.config).join('\n'), mcpConfig, installed);
+    // The repository's own committed install: only `rigour setup --team` changes it (a plain setup leaves it as committed).
+    const setup = !personal && /rigour/i.test(agents.map(a => a.config).join('\n')) ? 'rigour setup --team' : 'rigour setup';
+    const version = versionCheck(agents.map(a => a.config).join('\n'), mcpConfig, installed, setup);
     return [
         configCheck(cwd, personal),
-        editCheck(agents, now, events),
-        stopCheck(agents.map(a => a.config).join('\n'), now, events),
+        editCheck(agents, now, events, setup),
+        stopCheck(agents.map(a => a.config).join('\n'), now, events, setup),
         mcpCheck(mcpConfig, now, calls),
         ...(version ? [version] : []),
         prCheck(cwd),
@@ -47,7 +49,7 @@ export async function checkRepoSetup(cwd, now = new Date(), toolCalls, installed
  * (`@rigour-labs/cli@6.12.4`), so an upgrade reaches them only when `rigour setup` rewrites the pin.
  * Nothing to say when nothing pins a version (a source checkout runs its own build).
  */
-function versionCheck(hooks, mcp, installed) {
+function versionCheck(hooks, mcp, installed, setup) {
     const pins = (text, pkg) => [...new Set([...text.matchAll(new RegExp(`@rigour-labs/${pkg}@([0-9A-Za-z.-]+)`, 'g'))].map(m => m[1]))];
     const hookPins = pins(hooks, 'cli');
     const mcpPins = pins(mcp, 'mcp');
@@ -62,7 +64,7 @@ function versionCheck(hooks, mcp, installed) {
         ...mcpPins.filter(v => v !== installed).map(v => (/^\d+$/.test(v) || v === 'latest' ? `the MCP server floats on @${v}` : `the MCP server runs ${v}`)),
     ];
     return stale.length
-        ? { id: 'version', name, state: 'broken', detail: `${stale.join(', ')}; installed is ${installed}`, fix: 'rigour setup' }
+        ? { id: 'version', name, state: 'broken', detail: `${stale.join(', ')}; installed is ${installed}`, fix: setup }
         : { id: 'version', name, state: 'working', detail: installed };
 }
 function configCheck(cwd, personal) {
@@ -73,22 +75,22 @@ function configCheck(cwd, personal) {
         : { id: 'config', name: 'Project settings', state: 'missing', detail: 'No rigour.yml: Rigour uses its defaults', fix: 'rigour setup' };
 }
 /** One check for every agent's edit hook: events do not say which agent fired them, so counts are not split. */
-function editCheck(agents, now, events) {
+function editCheck(agents, now, events, setup) {
     const wired = agents.filter(a => a.config.includes('hooks check'));
     const name = wired.length ? `Checks ${listOf(wired.map(a => a.name))} as it writes` : 'Checks your agent as it writes';
     if (wired.length === 0)
-        return { id: 'edit', name, state: 'missing', detail: 'No edit hook configured', fix: 'rigour setup' };
+        return { id: 'edit', name, state: 'missing', detail: 'No edit hook configured', fix: setup };
     const broken = wired.find(a => isOldEditHook(a.config));
     if (broken) {
         // setup rewrites Rigour's own entries where they live (the project, or the machine for a personal install).
-        return { id: 'edit', name, state: 'broken', detail: `The ${broken.name} hook is the old form: it reads a variable the agent never sets, so no edit is checked`, fix: 'rigour setup' };
+        return { id: 'edit', name, state: 'broken', detail: `The ${broken.name} hook is the old form: it reads a variable the agent never sets, so no edit is checked`, fix: setup };
     }
     return fired('edit', name, events.filter(e => e.type === 'hook_check'), now, 'edit checks');
 }
-function stopCheck(config, now, events) {
+function stopCheck(config, now, events, setup) {
     const name = 'Stops an agent finishing with a known bug';
     if (!config.includes('hooks stop'))
-        return { id: 'stop', name, state: 'missing', detail: 'No stop hook configured', fix: 'rigour setup' };
+        return { id: 'stop', name, state: 'missing', detail: 'No stop hook configured', fix: setup };
     return fired('stop', name, events.filter(e => e.type === 'stop_review'), now, 'finish checks');
 }
 function mcpCheck(mcpJson, now, calls) {

package/dist/commands/setup.js

@@ -5,9 +5,10 @@
  * at user level, guarded so they run only where Rigour is switched on; this repository is switched
  * on inside its git directory (personal.ts). For trying Rigour, or using it alone.
  *
- * Team (`--team`, or a repository that already commits a rigour.yml): rigour.yml, the project's
- * agent hooks and its MCP server are written into the repository, so everyone who clones gets the
- * same gate. Agent instruction files only with `--instructions`.
+ * Team (`--team`): rigour.yml, the project's agent hooks and its MCP server are written into the
+ * repository, so everyone who clones gets the same gate. Agent instruction files only with
+ * `--instructions`. Only `--team` ever writes into the working tree: in a repository that commits its
+ * own Rigour hooks, a plain `rigour setup` leaves every file as committed (the team's install runs).
  *
  * Both install semantic search once per machine (semantic.ts) unless --no-semantic, end with the
  * same checks as `rigour doctor`, and are taken back out by `rigour uninstall`.
@@ -18,22 +19,36 @@ import fs from 'fs';
 import path from 'path';
 import { printRepoSetup } from './doctor.js';
 import { installGitPushHook } from './hooks-git.js';
-import { hooksInitCommand, installMachineHooks, pinnedCliCommand } from './hooks.js';
+import { hooksInitCommand, installMachineHooks, pinnedCliCommand, projectHookPaths } from './hooks.js';
 import { initCommand, registerProjectMcp, resolveMCPServerConfig } from './init.js';
 import { writeAgentInstructions } from './init-handshake.js';
 import { disableHere, enableHere, registerUserMcp } from './personal.js';
-import { applyConfigMigrations } from './setup-migrations.js';
+import { applyConfigMigrations, isOldEditHook } from './setup-migrations.js';
+import { getCliVersion } from '../utils/cli-version.js';
 import { setupSemantic } from './semantic.js';
 const AGENT_NAME = { claude: 'Claude Code', cursor: 'Cursor', cline: 'Cline', windsurf: 'Windsurf' };
 export async function setupCommand(cwd = process.cwd(), options = {}) {
-    const team = options.team || committedConfig(cwd);
-    console.log(chalk.bold.cyan(`\nRigour setup (${team ? 'team: committed to this repository' : 'personal: nothing in your working tree'})\n`));
-    if (team)
+    const team = !!options.team;
+    const committed = team ? [] : committedRigourHooks(cwd);
+    const mode = team ? 'team: committed to this repository' : committed.length ? "the team's install: nothing in your working tree" : 'personal: nothing in your working tree';
+    console.log(chalk.bold.cyan(`\nRigour setup (${mode})\n`));
+    if (team) {
+        const touched = trackedFiles(cwd, ['rigour.yml', ...rigourInstallPaths()]);
+        if (touched.length)
+            console.log(chalk.yellow(`Writes into these committed files (commit the result so everyone gets it): ${touched.join(', ')}\n`));
         await teamSetup(cwd, options);
-    else
+    }
+    else if (committed.length)
+        await leaveTeamInstall(cwd, committed, !!options.instructions);
+    else {
+        if (trackedFiles(cwd, ['rigour.yml']).length)
+            console.log(chalk.dim('This repository commits rigour.yml; `rigour setup --team` commits hooks for everyone. This setup is yours alone.\n'));
         await personalSetup(cwd, options.brief !== false);
-    for (const change of applyConfigMigrations(cwd))
-        console.log(chalk.green(`✔ Migrated ${change}`));
+    }
+    // rigour.yml is the team's file: only --team changes it (doctor's checks below name what is due).
+    if (team)
+        for (const change of applyConfigMigrations(cwd))
+            console.log(chalk.green(`✔ Migrated ${change}`));
     if (options.semantic !== false)
         await setupSemantic(cwd);
     await printRepoSetup(cwd);
@@ -75,7 +90,53 @@ async function teamSetup(cwd, options) {
     else
         await initCommand(cwd, { instructions: options.instructions, brief: options.brief !== false });
 }
-/** A rigour.yml the repository tracks: the team has adopted Rigour, so setup completes their install. */
-function committedConfig(cwd) {
-    return spawnSync('git', ['ls-files', '--error-unmatch', 'rigour.yml'], { cwd, encoding: 'utf8' }).status === 0;
+/**
+ * The team's install, as committed here: tracked project hook and MCP files that run Rigour. Their agents already run
+ * them, so a person's setup changes none of them, and personal hooks beside them would run every check twice.
+ */
+async function leaveTeamInstall(cwd, committed, instructions) {
+    disableHere(cwd, false);
+    const text = committed.map(file => fs.readFileSync(path.join(cwd, file), 'utf8')).join('\n');
+    const pins = [...new Set([...text.matchAll(/@rigour-labs\/cli@([0-9A-Za-z.-]+)/g)].map(m => m[1]))];
+    const installed = getCliVersion();
+    const stale = pins.filter(pin => pin !== installed);
+    console.log(chalk.green('✔ This repository commits its own Rigour install, and your agents run it. Left as committed:'));
+    for (const file of committed)
+        console.log(chalk.dim(`    ${file}`));
+    if (stale.length) {
+        // The committed pin is what the agents run: name it, and what it costs, since this setup does not move it.
+        const caveat = isOldEditHook(text) ? ' (its edit hook checks nothing)' : '';
+        console.log(chalk.yellow(`  These hooks pin Rigour ${pins.join(', ')}; they keep running that version${caveat} until someone runs \`rigour setup --team\` and commits the result. Installed here: ${installed}.`));
+    }
+    else
+        console.log(chalk.dim('  To change it for everyone: rigour setup --team, then commit the result.'));
+    // This clone's own: git's pre-push hook lives in the git directory, never in the working tree.
+    const push = installGitPushHook(cwd, pinnedCliCommand(), { workingTree: false });
+    if (push.action === 'managed elsewhere')
+        console.log(chalk.yellow(`Git pre-push hooks are managed outside this repository (${push.path}); add: ${pinnedCliCommand()} hooks push --git "$@" || exit $?`));
+    else if (push.action !== 'no repository')
+        console.log(chalk.green(`✔ Push gate: git's pre-push hook (${push.action}); the only thing installed here`));
+    // Asked for by name: written only where the repository has none, so no committed file changes.
+    if (instructions)
+        await writeAgentInstructions(cwd);
+}
+/** Where a team's Rigour install lives in the repository: the project hook and MCP configs. */
+function rigourInstallPaths() {
+    return [...projectHookPaths(), '.mcp.json', '.cursor/mcp.json'];
+}
+/** Which of these paths git tracks here. */
+function trackedFiles(cwd, paths) {
+    const tracked = spawnSync('git', ['ls-files', '--', ...paths], { cwd, encoding: 'utf8' });
+    return tracked.status === 0 ? tracked.stdout.split('\n').filter(Boolean) : [];
+}
+/** The tracked files of a team's Rigour install: project hook and MCP configs that name Rigour. */
+function committedRigourHooks(cwd) {
+    return trackedFiles(cwd, rigourInstallPaths()).filter(file => {
+        try {
+            return /rigour/i.test(fs.readFileSync(path.join(cwd, file), 'utf8'));
+        }
+        catch {
+            return false;
+        }
+    });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/cli",
-  "version": "7.0.0-rc.3",
+  "version": "7.0.0-rc.5",
   "description": "Code review that happens while your agent writes: deterministic checks on the lines it changed, quiet unless it can prove a defect, and learning from your team's fixes and dismissals. Works with Claude Code, Cursor, Codex, Cline and Windsurf.",
   "engines": {
     "node": ">=22.13"
@@ -59,12 +59,12 @@
     "globby": "^14.0.1",
     "ora": "^8.0.1",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "7.0.0-rc.3"
+    "@rigour-labs/core": "7.0.0-rc.5"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",
     "@types/node": "^25.0.3",
-    "@rigour-labs/studio": "7.0.0-rc.3"
+    "@rigour-labs/studio": "7.0.0-rc.5"
   },
   "scripts": {
     "build": "tsc && pnpm bundle-studio",