@rigour-labs/core 5.2.9 → 5.3.1

package/dist/hooks/dlp-confidence.js

@@ -0,0 +1,302 @@
+const UNCONDITIONAL_BLOCK_TYPES = new Set([
+    'private_key',
+    'private_key_full',
+    'gcp_service_account',
+    'bearer_token',
+    'jwt_token',
+]);
+const PROVIDER_BLOCK_TYPES = new Set([
+    'aws_secret_key',
+    'azure_key',
+    'anthropic_key',
+    'slack_token',
+    'sendgrid_key',
+]);
+const PROVIDER_TYPES = new Set([
+    'aws_access_key',
+    'openai_key',
+    'github_token',
+    'stripe_key',
+    'twilio_key',
+]);
+const GENERIC_TYPES = new Set([
+    'password_assignment',
+    'env_variable',
+    'ci_secret',
+    'base64_secret',
+    'hex_secret',
+    'high_entropy_secret',
+    'custom_pattern',
+]);
+export function classifyDLPDetection(detection, input) {
+    const context = getDetectionContext(detection, input);
+    const value = extractDetectionValue(detection);
+    const reasons = new Set();
+    if (UNCONDITIONAL_BLOCK_TYPES.has(detection.type)) {
+        reasons.add('sensitive_secret_type');
+        return verdict(98, 'block', reasons);
+    }
+    if (isCommentLine(context.line) && !UNCONDITIONAL_BLOCK_TYPES.has(detection.type)) {
+        reasons.add('comment_context');
+        return verdict(15, 'allow', reasons);
+    }
+    const safe = safeValueVerdict(detection, value, context, reasons);
+    if (safe)
+        return safe;
+    if (GENERIC_TYPES.has(detection.type)) {
+        return classifyGenericSecret(detection, value, context, reasons);
+    }
+    let confidence = baseConfidence(detection.type);
+    addPositiveSignals(detection, value, reasons);
+    addContextSignals(context, value, reasons);
+    confidence += confidenceAdjustment(reasons);
+    const contextual = contextualAllowVerdict(detection, value, context, confidence, reasons);
+    if (contextual)
+        return contextual;
+    if (PROVIDER_BLOCK_TYPES.has(detection.type)) {
+        return verdict(confidence, confidence >= 80 ? 'block' : 'warn', reasons);
+    }
+    if (PROVIDER_TYPES.has(detection.type)) {
+        if (isDocumentationContext(context.before, context.line) && !isHighEntropy(value)) {
+            reasons.add('docs_context');
+            return verdict(25, 'allow', reasons);
+        }
+        return verdict(confidence, confidence >= 80 ? 'block' : 'warn', reasons);
+    }
+    if (detection.type === 'database_url' || detection.type === 'credentials_in_url') {
+        if (isLocalDatabaseUrl(value) || isLocalDatabaseUrl(context.line)) {
+            reasons.add('localhost_only');
+            return verdict(22, 'allow', reasons);
+        }
+        return verdict(confidence, confidence >= 80 ? 'block' : 'warn', reasons);
+    }
+    return verdict(confidence, confidence >= 80 ? 'block' : 'warn', reasons);
+}
+function classifyGenericSecret(detection, value, context, reasons) {
+    if (detection.type === 'custom_pattern') {
+        reasons.add('secret_assignment');
+        return verdict(55, 'warn', reasons);
+    }
+    if (isSafePlaceholder(detection.type, value, context)) {
+        reasons.add('safe_example_value');
+        return verdict(18, 'allow', reasons);
+    }
+    if (isSafeContext(context, value)) {
+        reasons.add('safe_context');
+        return verdict(25, 'allow', reasons);
+    }
+    if (isHighEntropy(value) && value.length >= 24) {
+        reasons.add('high_entropy');
+        reasons.add('secret_assignment');
+        return verdict(72, 'warn', reasons);
+    }
+    reasons.add('secret_assignment');
+    return verdict(25, 'allow', reasons);
+}
+function safeValueVerdict(detection, value, context, reasons) {
+    if (isEnvReference(value) || isHashLine(context.line)) {
+        reasons.add('safe_reference_value');
+        return verdict(18, 'allow', reasons);
+    }
+    if (isSafePlaceholder(detection.type, value, context)) {
+        reasons.add('safe_example_value');
+        return verdict(18, 'allow', reasons);
+    }
+    if (isPublicOrDevCredential(detection.type, value, context)) {
+        reasons.add('public_or_test_key');
+        return verdict(18, 'allow', reasons);
+    }
+    if (isLivePublishableStripeKey(detection.type, value)) {
+        reasons.add('public_live_key');
+        return verdict(45, 'warn', reasons);
+    }
+}
+function contextualAllowVerdict(detection, value, context, confidence, reasons) {
+    if (isSafeContext(context, value) && !isHighEntropySecret(detection.type, value)) {
+        reasons.add('safe_context');
+        return verdict(Math.min(confidence, 30), 'allow', reasons);
+    }
+    return commandOrLocalVerdict(detection, value, context, reasons);
+}
+function commandOrLocalVerdict(detection, value, context, reasons) {
+    if (detection.type === 'ssh_credentials' && !hasSensitiveSshOptions(context.line)) {
+        reasons.add('ssh_alias_or_host');
+        return verdict(25, 'allow', reasons);
+    }
+    if (isLocalDatabaseUrl(value) || isLocalDatabaseUrl(context.line)) {
+        reasons.add('localhost_only');
+        return verdict(22, 'allow', reasons);
+    }
+}
+function baseConfidence(type) {
+    if (PROVIDER_BLOCK_TYPES.has(type))
+        return 92;
+    if (PROVIDER_TYPES.has(type))
+        return 78;
+    if (GENERIC_TYPES.has(type))
+        return 40;
+    if (type === 'database_url' || type === 'credentials_in_url')
+        return 82;
+    if (type === 'ssh_credentials')
+        return 35;
+    return 50;
+}
+function addPositiveSignals(detection, value, reasons) {
+    if (PROVIDER_TYPES.has(detection.type) || PROVIDER_BLOCK_TYPES.has(detection.type)) {
+        reasons.add('provider_pattern');
+    }
+    if (GENERIC_TYPES.has(detection.type)) {
+        reasons.add('secret_assignment');
+    }
+    if (isHighEntropy(value)) {
+        reasons.add('high_entropy');
+    }
+    if (value.length >= 32) {
+        reasons.add('long_token');
+    }
+}
+function addContextSignals(context, value, reasons) {
+    if (isDocumentationContext(context.before, context.line))
+        reasons.add('docs_context');
+    if (isCommentLine(context.line))
+        reasons.add('comment_context');
+    if (isBuildLogLine(context.line))
+        reasons.add('build_log_context');
+    if (isSafePlaceholderValue(value))
+        reasons.add('known_placeholder');
+    if (isEnvReference(value))
+        reasons.add('env_reference');
+    if (isHashLine(context.line))
+        reasons.add('checksum_or_hash');
+}
+function confidenceAdjustment(reasons) {
+    const weights = {
+        provider_pattern: 12,
+        secret_assignment: 6,
+        high_entropy: 16,
+        long_token: 6,
+        docs_context: -35,
+        comment_context: -40,
+        build_log_context: -30,
+        known_placeholder: -45,
+        env_reference: -45,
+        checksum_or_hash: -50,
+    };
+    return [...reasons].reduce((sum, reason) => sum + (weights[reason] ?? 0), 0);
+}
+function getDetectionContext(detection, input) {
+    const start = detection.position?.start ?? 0;
+    const end = detection.position?.end ?? detection.match.length;
+    const lineStart = input.lastIndexOf('\n', start) + 1;
+    const lineEnd = input.indexOf('\n', end);
+    const beforeStart = Math.max(0, start - 300);
+    return {
+        line: input.slice(lineStart, lineEnd === -1 ? undefined : lineEnd).trim(),
+        before: input.slice(beforeStart, start),
+    };
+}
+function extractDetectionValue(detection) {
+    const assignment = detection.match.match(/[:=]\s*['"]?(.+?)['"]?\s*$/);
+    const value = assignment?.[1] ?? detection.match;
+    return value.replace(/^['"`]+|['"`;]+$/g, '');
+}
+function isPublicOrDevCredential(type, value, context) {
+    if (/^pk_test_/i.test(value))
+        return true;
+    if (!PROVIDER_TYPES.has(type))
+        return false;
+    return isSafeProviderExample(value, context);
+}
+function isSafeContext(context, value) {
+    return isDocumentationContext(context.before, context.line)
+        || isBuildLogLine(context.line)
+        || isSafePlaceholderValue(value)
+        || isEnvReference(value)
+        || isHashLine(context.line);
+}
+function isDocumentationContext(before, line) {
+    const text = before + '\n' + line;
+    return /(?:example|sample|placeholder|fake|dummy|test fixture|fixture|docs?|readme|tutorial|settings\.json|cursor\.apiKey|env var|process\.env)/i.test(text);
+}
+function isCommentLine(line) {
+    return /^\s*(?:\/\/|#|\*|<!--)/.test(line);
+}
+function isBuildLogLine(line) {
+    return /^npm\s+(?:notice|warn|WARN|ERR!)/i.test(line)
+        || /^#\d+\s+[\d.]+\s/.test(line)
+        || /\b(?:missing|undefined|not set|not found|required)\b/i.test(line);
+}
+function isHashLine(line) {
+    return /(?:digest|hash|checksum|sha256|sha1|md5)\s*[:=]/i.test(line);
+}
+function isSafePlaceholder(type, value, context) {
+    if (isSafePlaceholderValue(value))
+        return true;
+    if (isPlaceholderCredentialUrl(value) || isPlaceholderCredentialUrl(context.line))
+        return true;
+    if (GENERIC_TYPES.has(type) && isGenericPlaceholderValue(value))
+        return true;
+    return PROVIDER_TYPES.has(type) && isSafeProviderExample(value, context);
+}
+function isSafePlaceholderValue(value) {
+    return /^(?:example|placeholder|dummy|fake|sample|changeme|replace[_-]?me|password123|secret123|correct horse battery staple)$/i.test(value)
+        || /^(?:your[_-]?)?(?:api[_-]?)?key[_-]?here$/i.test(value)
+        || /^not-a-real/i.test(value)
+        || /^super-secret-client-id-string$/i.test(value)
+        || /^x{8,}$/i.test(value)
+        || /^test[_-]/i.test(value)
+        || /^dev[_-]/i.test(value)
+        || /^mock[_-]/i.test(value)
+        || /^stub[_-]/i.test(value)
+        || value === 'abcdefghijklmnopqrstuvwxyz'
+        || /EXAMPLE(?:KEY)?$/i.test(value);
+}
+function isGenericPlaceholderValue(value) {
+    return /(?:example|placeholder|dummy|fake|sample|your[_-]|replace[_-]?me|not-a-real)/i.test(value);
+}
+function isSafeProviderExample(value, context) {
+    return isDocumentationContext(context.before, context.line) && isSafePlaceholderValue(value);
+}
+function isPlaceholderCredentialUrl(value) {
+    const match = value.match(/^[a-z][a-z0-9+.-]*:\/\/[^:@/\s]+:([^@/\s]+)@/i);
+    return match !== null && isSafePlaceholderValue(decodeURIComponent(match[1]));
+}
+function isLivePublishableStripeKey(type, value) {
+    return type === 'stripe_key' && /^pk_live_/i.test(value);
+}
+function isEnvReference(value) {
+    return /^\$\{?[A-Z][A-Z0-9_]+\}?$/.test(value)
+        || /^process\.env\.[A-Z][A-Z0-9_]+$/.test(value);
+}
+function isHighEntropySecret(type, value) {
+    return type === 'high_entropy_secret' || (value.length >= 24 && isHighEntropy(value));
+}
+function isHighEntropy(value) {
+    if (value.length < 24)
+        return false;
+    const freq = {};
+    for (const char of value)
+        freq[char] = (freq[char] || 0) + 1;
+    return Object.values(freq).reduce((sum, count) => {
+        const probability = count / value.length;
+        return sum - probability * Math.log2(probability);
+    }, 0) > 4.5;
+}
+function hasSensitiveSshOptions(line) {
+    return /\b(?:-i|IdentityFile)\b/.test(line) || /\bpassword\b/i.test(line);
+}
+function isLocalDatabaseUrl(value) {
+    const hasDbScheme = /(?:^|=)(?:postgres(?:ql)?|mysql|mariadb|mssql|mongodb(?:\+srv)?|redis|rediss|amqp|amqps):\/\//i.test(value);
+    if (!hasDbScheme)
+        return false;
+    if (/@(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])(?::|\/|$)/i.test(value))
+        return true;
+    return /:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])(?::|\/|$)/i.test(value);
+}
+function verdict(confidence, decision, reasons) {
+    return {
+        confidence: Math.max(0, Math.min(99, Math.round(confidence))),
+        decision,
+        reason_codes: [...reasons].sort(),
+    };
+}

package/dist/hooks/dlp-confidence.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/hooks/dlp-confidence.test.js

@@ -0,0 +1,51 @@
+import { describe, expect, it } from 'vitest';
+import { createDLPAuditEntry, formatDLPAlert, scanInputForCredentials, } from './input-validator.js';
+describe('DLP confidence engine', () => {
+    it('allows explicit example password assignments', () => {
+        const result = scanInputForCredentials('password = "examplepassword"');
+        expect(result.status).toBe('clean');
+        expect(result.allowed_detections?.[0].decision).toBe('allow');
+    });
+    it('warns on high-entropy values even with api_key label', () => {
+        const result = scanInputForCredentials('api_key: "abcdefZ9y8X7w6V5u4T3s2R1q0P9o8N7m6"');
+        expect(result.status).toBe('warning');
+        expect(result.detections[0].decision).toBe('warn');
+    });
+    it('allows localhost database URLs with placeholder credentials', () => {
+        const result = scanInputForCredentials('DATABASE_URL=postgresql://user:password@localhost:5432/db');
+        expect(result.status).toBe('clean');
+    });
+    it('warns for live Stripe publishable keys', () => {
+        const result = scanInputForCredentials('STRIPE_PUBLIC_KEY=pk_live_123456789012345678901234');
+        expect(result.status).toBe('warning');
+        expect(result.detections[0].decision).toBe('warn');
+        expect(result.detections[0].reason_codes).toContain('public_live_key');
+    });
+    it('allows provider keys in comments (reduced false positives)', () => {
+        const result = scanInputForCredentials('// AWS_ACCESS_KEY_ID=AKIAZ9Y8X7W6V5U4T3Q2');
+        expect(result.status).toBe('clean');
+    });
+    it('allows GitHub tokens in comments', () => {
+        const result = scanInputForCredentials('// ghp_Z9Y8X7W6V5U4T3S2R1Q0P9O8N7M6B5C4A3D2');
+        expect(result.status).toBe('clean');
+    });
+    it('blocks JWT tokens in comments', () => {
+        const jwt = '// token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJwcm9kLXVzZXIiLCJpc3MiOiJhdXRoLXNlcnZpY2UifQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';
+        const result = scanInputForCredentials(jwt);
+        expect(result.status).toBe('blocked');
+        expect(result.detections.some(d => d.type === 'jwt_token')).toBe(true);
+    });
+    it('shows allowed safe values in clean output', () => {
+        const result = scanInputForCredentials('api_key: "abcdefghijklmnopqrstuvwxyz"');
+        const alert = formatDLPAlert(result);
+        expect(alert).toContain('allowed 1 sample or safe credential-like value');
+    });
+    it('includes allowed detections without raw values in audit log', () => {
+        const result = scanInputForCredentials('api_key: "abcdefghijklmnopqrstuvwxyz"');
+        const entry = createDLPAuditEntry(result, { agent: 'claude' });
+        const allowed = entry.allowed_detections;
+        expect(allowed).toHaveLength(1);
+        expect(allowed[0].decision).toBe('allow');
+        expect(allowed[0].match).toBeUndefined();
+    });
+});

package/dist/hooks/dlp-feedback.d.ts

@@ -0,0 +1,48 @@
+export interface DLPFeedbackEntry {
+    fingerprint: string;
+    type: string;
+    shape: string;
+    hits: number;
+    lastSeenAt: string;
+    source: 'hook' | 'cli' | 'mcp';
+}
+export interface DLPFeedbackStore {
+    version: 1;
+    entries: DLPFeedbackEntry[];
+}
+export interface DLPBlockManifest {
+    timestamp: string;
+    detections: Array<{
+        type: string;
+        match: string;
+        fingerprint: string;
+        shape: string;
+    }>;
+}
+/** Normalize a matched value to a shape for learning (preserves structure, not secret content). */
+export declare function shapeValue(value: string): string;
+export declare function fingerprintDetection(type: string, match: string, line?: string): string;
+/** Stable fingerprint for hook-learned false positives (type + value shape only). */
+export declare function feedbackFingerprint(type: string, match: string): string;
+export declare function lastBlockPath(cwd: string): string;
+export declare function recordDLPFeedback(cwd: string, entry: {
+    type: string;
+    match: string;
+    line?: string;
+    source?: DLPFeedbackEntry['source'];
+}): Promise<string>;
+export declare function isLearnedAllow(cwd: string | undefined, type: string, match: string, _line?: string): Promise<boolean>;
+export declare function isLearnedAllowSync(store: DLPFeedbackStore, type: string, match: string, _line?: string): boolean;
+export declare function loadDLPFeedbackStore(cwd: string): Promise<DLPFeedbackStore>;
+export declare function getLearnedAllowCount(cwd: string): Promise<number>;
+/** Synchronous load for hot-path DLP scanning (<50ms budget). */
+export declare function loadDLPFeedbackStoreSync(cwd: string): DLPFeedbackStore;
+export declare function writeDLPBlockManifest(cwd: string, detections: Array<{
+    type: string;
+    match: string;
+    position?: {
+        start: number;
+        end: number;
+    };
+}>, input: string): Promise<void>;
+export declare function allowLastDLPBlock(cwd: string, source?: DLPFeedbackEntry['source']): Promise<number>;

package/dist/hooks/dlp-feedback.js

@@ -0,0 +1,174 @@
+/**
+ * DLP feedback learning — reduces false positives over time from hook-driven user corrections.
+ * Fingerprints are stored per-project in .rigour/dlp-feedback.json.
+ */
+import { createHash } from 'crypto';
+import fs from 'fs-extra';
+import path from 'path';
+/** Normalize a matched value to a shape for learning (preserves structure, not secret content). */
+export function shapeValue(value) {
+    return value
+        .replace(/[A-Za-z0-9]{8,}/g, '<TOKEN>')
+        .replace(/\d{4,}/g, '<NUM>')
+        .slice(0, 120);
+}
+export function fingerprintDetection(type, match, line) {
+    const value = extractValueShape(match);
+    const raw = line
+        ? `${type}|${value}|${shapeValue(line)}`
+        : `${type}|${value}`;
+    return createHash('sha256').update(raw).digest('hex').slice(0, 24);
+}
+/** Stable fingerprint for hook-learned false positives (type + value shape only). */
+export function feedbackFingerprint(type, match) {
+    const value = extractValueShape(match);
+    return createHash('sha256').update(`${type}|${value}`).digest('hex').slice(0, 24);
+}
+function extractValueShape(match) {
+    const assignment = match.match(/[:=]\s*['"]?(.+?)['"]?\s*$/);
+    const value = assignment?.[1] ?? match;
+    return shapeValue(value.replace(/^['"`]+|['"`;]+$/g, ''));
+}
+function feedbackPath(cwd) {
+    return path.join(cwd, '.rigour', 'dlp-feedback.json');
+}
+export function lastBlockPath(cwd) {
+    return path.join(cwd, '.rigour', 'dlp-last-block.json');
+}
+async function loadStore(cwd) {
+    const filePath = feedbackPath(cwd);
+    if (!await fs.pathExists(filePath)) {
+        return { version: 1, entries: [] };
+    }
+    try {
+        const data = await fs.readJson(filePath);
+        if (data?.version === 1 && Array.isArray(data.entries))
+            return data;
+    }
+    catch {
+        // corrupt — reset
+    }
+    return { version: 1, entries: [] };
+}
+async function saveStore(cwd, store) {
+    await fs.ensureDir(path.dirname(feedbackPath(cwd)));
+    await fs.writeJson(feedbackPath(cwd), store, { spaces: 2 });
+}
+export async function recordDLPFeedback(cwd, entry) {
+    const fingerprint = feedbackFingerprint(entry.type, entry.match);
+    const shape = extractValueShape(entry.match);
+    const store = await loadStore(cwd);
+    const existing = store.entries.find(e => e.fingerprint === fingerprint);
+    const now = new Date().toISOString();
+    if (existing) {
+        existing.hits += 1;
+        existing.lastSeenAt = now;
+    }
+    else {
+        store.entries.push({
+            fingerprint,
+            type: entry.type,
+            shape,
+            hits: 1,
+            lastSeenAt: now,
+            source: entry.source ?? 'hook',
+        });
+    }
+    if (store.entries.length > 500) {
+        store.entries.sort((a, b) => b.hits - a.hits || b.lastSeenAt.localeCompare(a.lastSeenAt));
+        store.entries = store.entries.slice(0, 500);
+    }
+    await saveStore(cwd, store);
+    return fingerprint;
+}
+export async function isLearnedAllow(cwd, type, match, _line) {
+    if (!cwd)
+        return false;
+    const store = await loadStore(cwd);
+    return isLearnedAllowSync(store, type, match);
+}
+export function isLearnedAllowSync(store, type, match, _line) {
+    const fingerprint = feedbackFingerprint(type, match);
+    return store.entries.some(e => e.fingerprint === fingerprint);
+}
+export async function loadDLPFeedbackStore(cwd) {
+    return loadStore(cwd);
+}
+export async function getLearnedAllowCount(cwd) {
+    const store = await loadStore(cwd);
+    return store.entries.length;
+}
+/** Synchronous load for hot-path DLP scanning (<50ms budget). */
+export function loadDLPFeedbackStoreSync(cwd) {
+    const filePath = feedbackPath(cwd);
+    try {
+        if (!fs.existsSync(filePath)) {
+            return { version: 1, entries: [] };
+        }
+        const data = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+        if (data?.version === 1 && Array.isArray(data.entries))
+            return data;
+    }
+    catch {
+        // corrupt
+    }
+    return { version: 1, entries: [] };
+}
+function getLineAt(input, start) {
+    const lineStart = input.lastIndexOf('\n', start) + 1;
+    const lineEnd = input.indexOf('\n', start);
+    return input.slice(lineStart, lineEnd === -1 ? undefined : lineEnd).trim();
+}
+export async function writeDLPBlockManifest(cwd, detections, input) {
+    const seen = new Set();
+    const manifestDetections = [];
+    for (const d of detections) {
+        const fp = feedbackFingerprint(d.type, d.match);
+        if (seen.has(fp))
+            continue;
+        seen.add(fp);
+        manifestDetections.push({
+            type: d.type,
+            match: d.match.slice(0, 80),
+            fingerprint: fp,
+            shape: extractValueShape(d.match),
+        });
+    }
+    const manifest = {
+        timestamp: new Date().toISOString(),
+        detections: manifestDetections,
+    };
+    await fs.ensureDir(path.dirname(lastBlockPath(cwd)));
+    await fs.writeJson(lastBlockPath(cwd), manifest, { spaces: 2 });
+}
+export async function allowLastDLPBlock(cwd, source = 'hook') {
+    const manifestPath = lastBlockPath(cwd);
+    if (!await fs.pathExists(manifestPath))
+        return 0;
+    const manifest = await fs.readJson(manifestPath);
+    const store = await loadStore(cwd);
+    const now = new Date().toISOString();
+    let count = 0;
+    for (const d of manifest.detections ?? []) {
+        const existing = store.entries.find(e => e.fingerprint === d.fingerprint);
+        if (existing) {
+            existing.hits += 1;
+            existing.lastSeenAt = now;
+        }
+        else {
+            store.entries.push({
+                fingerprint: d.fingerprint,
+                type: d.type,
+                shape: d.shape,
+                hits: 1,
+                lastSeenAt: now,
+                source,
+            });
+        }
+        count++;
+    }
+    if (count > 0) {
+        await saveStore(cwd, store);
+    }
+    return count;
+}

package/dist/hooks/dlp-feedback.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/hooks/dlp-feedback.test.js

@@ -0,0 +1,39 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import path from 'path';
+import os from 'os';
+import fs from 'fs-extra';
+import { recordDLPFeedback, feedbackFingerprint, loadDLPFeedbackStoreSync, isLearnedAllowSync, writeDLPBlockManifest, allowLastDLPBlock, } from './dlp-feedback.js';
+import { scanInputForCredentials } from './input-validator.js';
+describe('DLP feedback learning', () => {
+    const testCwd = path.join(os.tmpdir(), `rigour-dlp-fb-${Date.now()}`);
+    beforeEach(async () => {
+        await fs.ensureDir(path.join(testCwd, '.rigour'));
+    });
+    afterEach(async () => {
+        await fs.remove(testCwd);
+    });
+    it('produces stable fingerprints for same shape', () => {
+        const a = feedbackFingerprint('password_assignment', 'api_key = "your-key-here"');
+        const b = feedbackFingerprint('password_assignment', 'api_key = "your-key-here"');
+        expect(a).toBe(b);
+    });
+    it('records and applies learned false positives', async () => {
+        const match = 'api_key = "Z9y8X7w6V5u4T3s2R1q0P9o8N7m6B5c4"';
+        await recordDLPFeedback(testCwd, { type: 'password_assignment', match, source: 'hook' });
+        const store = loadDLPFeedbackStoreSync(testCwd);
+        expect(isLearnedAllowSync(store, 'password_assignment', match)).toBe(true);
+        const result = scanInputForCredentials(match, { cwd: testCwd });
+        expect(result.status).toBe('clean');
+        expect(result.allowed_detections?.[0].reason_codes).toContain('learned_false_positive');
+    });
+    it('allowLastDLPBlock learns from manifest', async () => {
+        const text = 'api_key = "Z9y8X7w6V5u4T3s2R1q0P9o8N7m6B5c4"';
+        const blocked = scanInputForCredentials(text, { cwd: testCwd, block_on_detection: true });
+        expect(blocked.status).toBe('warning');
+        await writeDLPBlockManifest(testCwd, blocked.detections, text);
+        const learned = await allowLastDLPBlock(testCwd, 'hook');
+        expect(learned).toBeGreaterThan(0);
+        const retry = scanInputForCredentials(text, { cwd: testCwd });
+        expect(retry.status).toBe('clean');
+    });
+});

package/dist/hooks/index.d.ts

@@ -8,5 +8,7 @@ export type { HookTool, HookConfig, HookCheckerResult } from './types.js';
 export { DEFAULT_HOOK_CONFIG, FAST_GATE_IDS } from './types.js';
 export { scanInputForCredentials, formatDLPAlert, createDLPAuditEntry } from './input-validator.js';
 export type { CredentialDetection, InputValidationResult, InputValidationConfig } from './input-validator.js';
+export { recordDLPFeedback, allowLastDLPBlock, writeDLPBlockManifest, getLearnedAllowCount, loadDLPFeedbackStore, loadDLPFeedbackStoreSync, fingerprintDetection, } from './dlp-feedback.js';
+export type { DLPFeedbackEntry, DLPFeedbackStore, DLPBlockManifest } from './dlp-feedback.js';
 export { generateDLPHookFiles } from './dlp-templates.js';
 export type { GeneratedDLPHookFile } from './dlp-templates.js';

package/dist/hooks/index.js

@@ -7,4 +7,5 @@ export { generateHookFiles } from './templates.js';
 export { DEFAULT_HOOK_CONFIG, FAST_GATE_IDS } from './types.js';
 // DLP (Data Loss Prevention) — v4.2.0
 export { scanInputForCredentials, formatDLPAlert, createDLPAuditEntry } from './input-validator.js';
+export { recordDLPFeedback, allowLastDLPBlock, writeDLPBlockManifest, getLearnedAllowCount, loadDLPFeedbackStore, loadDLPFeedbackStoreSync, fingerprintDetection, } from './dlp-feedback.js';
 export { generateDLPHookFiles } from './dlp-templates.js';

package/dist/hooks/input-validator.d.ts

@@ -28,10 +28,14 @@ export interface CredentialDetection {
         start: number;
         end: number;
     };
+    confidence?: number;
+    decision?: 'block' | 'warn' | 'allow';
+    reason_codes?: string[];
 }
 export interface InputValidationResult {
     status: 'clean' | 'blocked' | 'warning';
     detections: CredentialDetection[];
+    allowed_detections?: CredentialDetection[];
     duration_ms: number;
     scanned_length: number;
 }
@@ -46,6 +50,10 @@ export interface InputValidationConfig {
     ignore_patterns?: string[];
     /** Log blocked inputs to audit trail */
     audit_log?: boolean;
+    /** Project root for learned false-positive feedback (.rigour/dlp-feedback.json) */
+    cwd?: string;
+    /** Apply learned hook feedback to reduce repeat false positives (default true when cwd set) */
+    use_learned_feedback?: boolean;
 }
 /**
  * Scan input text for credential patterns.