@rigour-labs/core 5.5.4 → 6.0.0

package/dist/firewall/transaction.js

@@ -0,0 +1,216 @@
+/**
+ * Transactional execution — worktree START → verify → COMMIT | DISCARD.
+ */
+import { randomUUID } from 'crypto';
+import fs from 'fs-extra';
+import path from 'path';
+import { execa } from 'execa';
+import { hashPolicy } from './policy-hash.js';
+import { assertWritesInScope } from './scope-enforcement.js';
+const DEFAULT_BUDGETS = {
+    maxFiles: 20,
+    maxRetries: 3,
+    maxDurationMs: 30 * 60 * 1000,
+};
+export class TransactionRunner {
+    cwd;
+    record;
+    constructor(cwd, opts) {
+        this.cwd = cwd;
+        const budgets = { ...DEFAULT_BUDGETS, ...opts.budgets };
+        this.record = {
+            id: randomUUID(),
+            agentId: opts.agentId,
+            scope: opts.scope,
+            status: 'START',
+            budgets,
+            filesChanged: [],
+            capabilitiesIssued: [],
+            decisions: [],
+            startedAt: new Date().toISOString(),
+            policyHash: opts.policyHash ?? hashPolicy({ scope: opts.scope, budgets }),
+        };
+    }
+    static fromRecord(cwd, record) {
+        const runner = new TransactionRunner(cwd, {
+            agentId: record.agentId,
+            scope: record.scope,
+            budgets: record.budgets,
+            policyHash: record.policyHash,
+        });
+        runner.record = { ...record, decisions: [...record.decisions], filesChanged: [...record.filesChanged] };
+        return runner;
+    }
+    getRecord() {
+        return { ...this.record, decisions: [...this.record.decisions], filesChanged: [...this.record.filesChanged] };
+    }
+    setStatus(status) {
+        this.record.status = status;
+    }
+    addDecision(ev) {
+        this.record.decisions.push(ev);
+    }
+    /**
+     * Create an ephemeral git worktree for isolated writes.
+     */
+    async start() {
+        const worktreesRoot = path.join(this.cwd, '.rigour', 'worktrees');
+        await fs.ensureDir(worktreesRoot);
+        const worktreePath = path.join(worktreesRoot, this.record.id);
+        const branch = `rigour-tx-${this.record.id.slice(0, 8)}`;
+        try {
+            await execa('git', ['rev-parse', '--is-inside-work-tree'], { cwd: this.cwd });
+            await execa('git', ['worktree', 'add', '-b', branch, worktreePath, 'HEAD'], {
+                cwd: this.cwd,
+                shell: false,
+            });
+            this.record.worktreePath = worktreePath;
+        }
+        catch {
+            // Fallback: copy-less sandbox dir (no git) — still tracks commit/discard via marker
+            await fs.ensureDir(worktreePath);
+            this.record.worktreePath = worktreePath;
+            await fs.writeJson(path.join(worktreePath, '.rigour-tx.json'), {
+                id: this.record.id,
+                base: this.cwd,
+            });
+        }
+        this.setStatus('RUNNING');
+        await this.persist();
+        return this.getRecord();
+    }
+    async noteFileChange(relPath) {
+        const scopeEv = await assertWritesInScope(this.cwd, [relPath], this.record.agentId);
+        this.addDecision(scopeEv);
+        if (scopeEv.decision !== 'allow') {
+            return scopeEv;
+        }
+        if (!this.record.filesChanged.includes(relPath)) {
+            this.record.filesChanged.push(relPath);
+        }
+        if (this.record.filesChanged.length > this.record.budgets.maxFiles) {
+            const deny = {
+                decision: 'deny',
+                reason: `File budget exceeded (${this.record.budgets.maxFiles})`,
+                ruleId: 'budget.files',
+                policyHash: this.record.policyHash,
+                timestamp: new Date().toISOString(),
+            };
+            this.addDecision(deny);
+            return deny;
+        }
+        const elapsed = Date.now() - Date.parse(this.record.startedAt);
+        if (elapsed > this.record.budgets.maxDurationMs) {
+            const deny = {
+                decision: 'deny',
+                reason: 'Time budget exceeded',
+                ruleId: 'budget.time',
+                policyHash: this.record.policyHash,
+                timestamp: new Date().toISOString(),
+            };
+            this.addDecision(deny);
+            return deny;
+        }
+        await this.persist();
+        return scopeEv;
+    }
+    async syncWorktreeChanges() {
+        const root = this.record.worktreePath || this.cwd;
+        const files = await listChangedFiles(root);
+        for (const f of files) {
+            const ev = await this.noteFileChange(f);
+            if (ev.decision !== 'allow') {
+                throw Object.assign(new Error(ev.reason), { evaluation: ev, code: 'FIREWALL_DENY' });
+            }
+        }
+        return [...this.record.filesChanged];
+    }
+    getWorktreePath() {
+        return this.record.worktreePath;
+    }
+    async verify(runGates) {
+        this.setStatus('VERIFYING');
+        const gateResults = await runGates();
+        await this.persist();
+        return { ok: gateResults.status === 'PASS', gateResults };
+    }
+    async commit() {
+        this.setStatus('COMMIT');
+        this.record.finishedAt = new Date().toISOString();
+        // Worktree branch is left for operator merge; attestation binds treeDigest/commitSha
+        await this.persist();
+        return this.getRecord();
+    }
+    async discard() {
+        this.setStatus('DISCARD');
+        this.record.finishedAt = new Date().toISOString();
+        const wt = this.record.worktreePath;
+        if (wt && await fs.pathExists(wt)) {
+            try {
+                await execa('git', ['worktree', 'remove', '--force', wt], { cwd: this.cwd, shell: false });
+            }
+            catch {
+                await fs.remove(wt);
+            }
+            try {
+                const branch = `rigour-tx-${this.record.id.slice(0, 8)}`;
+                await execa('git', ['branch', '-D', branch], { cwd: this.cwd, shell: false, reject: false });
+            }
+            catch {
+                // ignore
+            }
+        }
+        await this.persist();
+        return this.getRecord();
+    }
+    async persist() {
+        const dir = path.join(this.cwd, '.rigour', 'transactions');
+        await fs.ensureDir(dir);
+        await fs.writeJson(path.join(dir, `${this.record.id}.json`), this.record, { spaces: 2 });
+        await fs.writeJson(path.join(this.cwd, '.rigour', 'transaction-current.json'), this.record, { spaces: 2 });
+    }
+}
+export async function listChangedFiles(dir) {
+    try {
+        const { stdout: diffOut } = await execa('git', ['diff', '--name-only', 'HEAD'], {
+            cwd: dir,
+            shell: false,
+        });
+        const { stdout: untrackedOut } = await execa('git', ['ls-files', '--others', '--exclude-standard'], { cwd: dir, shell: false });
+        const files = [
+            ...diffOut.split('\n'),
+            ...untrackedOut.split('\n'),
+        ].map(s => s.trim()).filter(Boolean);
+        return [...new Set(files)];
+    }
+    catch {
+        return [];
+    }
+}
+export async function loadCurrentTransaction(cwd) {
+    const p = path.join(cwd, '.rigour', 'transaction-current.json');
+    if (!(await fs.pathExists(p)))
+        return null;
+    try {
+        return await fs.readJson(p);
+    }
+    catch {
+        return null;
+    }
+}
+export async function listTransactions(cwd) {
+    const dir = path.join(cwd, '.rigour', 'transactions');
+    if (!(await fs.pathExists(dir)))
+        return [];
+    const files = (await fs.readdir(dir)).filter(f => f.endsWith('.json'));
+    const out = [];
+    for (const f of files) {
+        try {
+            out.push(await fs.readJson(path.join(dir, f)));
+        }
+        catch {
+            // skip
+        }
+    }
+    return out.sort((a, b) => b.startedAt.localeCompare(a.startedAt));
+}

package/dist/firewall/typed-command.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Typed / argv-allowlisted command runner.
+ * Replaces unrestricted shell:true for agent-facing execution.
+ */
+import type { PolicyEvaluation, TypedCommand } from './types.js';
+/**
+ * Conservative allowlist — no general interpreters (node/python/npx) that accept -e/-c.
+ */
+export declare const DEFAULT_ALLOWED_BINS: Set<string>;
+export declare function parseCommandLine(command: string): TypedCommand | null;
+export declare function evaluateTypedCommand(command: string, allowedBins?: Set<string>): PolicyEvaluation;
+export declare function runTypedCommand(command: string, cwd: string, allowedBins?: Set<string>): Promise<{
+    stdout: string;
+    stderr: string;
+    evaluation: PolicyEvaluation;
+}>;

package/dist/firewall/typed-command.js

@@ -0,0 +1,129 @@
+/**
+ * Typed / argv-allowlisted command runner.
+ * Replaces unrestricted shell:true for agent-facing execution.
+ */
+import { execa } from 'execa';
+import { hashPolicy } from './policy-hash.js';
+/**
+ * Conservative allowlist — no general interpreters (node/python/npx) that accept -e/-c.
+ */
+export const DEFAULT_ALLOWED_BINS = new Set([
+    'npm',
+    'pnpm',
+    'yarn',
+    'tsc',
+    'vitest',
+    'jest',
+    'pytest',
+    'go',
+    'cargo',
+    'git',
+    'rigour',
+    'echo',
+    'cat',
+    'ls',
+    'pwd',
+    'true',
+    'false',
+]);
+const DENY_ARG_PATTERNS = [
+    /rm\s+-rf/i,
+    /--force/i,
+    /push\s+--force/i,
+    /force-with-lease/i,
+    /curl.*(-d|--data)/i,
+    /wget\s/i,
+    /(^|\s)-e(\s|=|$)/,
+    /(^|\s)--eval(\s|=|$)/,
+    /\bnpm\s+exec\b/i,
+    /\bnpx\b/i,
+    /\byarn\s+dlx\b/i,
+    /\bpnpm\s+dlx\b/i,
+];
+const GIT_DENY_SUBCOMMANDS = new Set(['push', 'reset', 'clean', 'rebase', 'filter-branch']);
+export function parseCommandLine(command) {
+    const trimmed = command.trim();
+    if (!trimmed)
+        return null;
+    if (/[;|&`$<>]/.test(trimmed) || trimmed.includes('\n')) {
+        return null;
+    }
+    const parts = trimmed.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g);
+    if (!parts || parts.length === 0)
+        return null;
+    const unquote = (s) => {
+        if ((s.startsWith('"') && s.endsWith('"')) || (s.startsWith("'") && s.endsWith("'"))) {
+            return s.slice(1, -1);
+        }
+        return s;
+    };
+    const [bin, ...args] = parts.map(unquote);
+    return { bin, args };
+}
+export function evaluateTypedCommand(command, allowedBins = DEFAULT_ALLOWED_BINS) {
+    const policyHash = hashPolicy({ allowedBins: [...allowedBins].sort() });
+    const parsed = parseCommandLine(command);
+    if (!parsed) {
+        return {
+            decision: 'deny',
+            reason: 'Command contains shell metacharacters or could not be parsed as argv',
+            ruleId: 'shell.no-meta',
+            policyHash,
+            timestamp: new Date().toISOString(),
+        };
+    }
+    const binBase = parsed.bin.split(/[/\\]/).pop() || parsed.bin;
+    if (!allowedBins.has(binBase) && !allowedBins.has(parsed.bin)) {
+        return {
+            decision: 'deny',
+            reason: `Binary "${binBase}" is not on the allowlist`,
+            ruleId: 'shell.allowlist',
+            policyHash,
+            timestamp: new Date().toISOString(),
+        };
+    }
+    const full = `${parsed.bin} ${parsed.args.join(' ')}`;
+    for (const re of DENY_ARG_PATTERNS) {
+        if (re.test(full)) {
+            return {
+                decision: 'deny',
+                reason: `Command matched deny pattern: ${re}`,
+                ruleId: 'shell.deny-pattern',
+                policyHash,
+                timestamp: new Date().toISOString(),
+            };
+        }
+    }
+    if (binBase === 'git') {
+        const sub = parsed.args.find(a => !a.startsWith('-'));
+        if (sub && GIT_DENY_SUBCOMMANDS.has(sub)) {
+            return {
+                decision: 'deny',
+                reason: `git ${sub} requires explicit capability (destructive git mutation)`,
+                ruleId: 'git.destructive',
+                policyHash,
+                timestamp: new Date().toISOString(),
+            };
+        }
+    }
+    return {
+        decision: 'allow',
+        reason: `Allowlisted binary ${binBase}`,
+        ruleId: 'shell.allow',
+        policyHash,
+        timestamp: new Date().toISOString(),
+    };
+}
+export async function runTypedCommand(command, cwd, allowedBins) {
+    const evaluation = evaluateTypedCommand(command, allowedBins);
+    if (evaluation.decision !== 'allow') {
+        throw Object.assign(new Error(evaluation.reason), { evaluation, code: 'FIREWALL_DENY' });
+    }
+    const parsed = parseCommandLine(command);
+    const { stdout, stderr } = await execa(parsed.bin, parsed.args, {
+        cwd,
+        shell: false,
+        reject: false,
+    });
+    return { stdout: stdout ?? '', stderr: stderr ?? '', evaluation };
+}

package/dist/firewall/types.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Agent Transaction Firewall — shared types.
+ * Deterministic allow/deny decisions; no LLM on the hot path.
+ */
+export type FirewallDecision = 'allow' | 'deny' | 'timeout-deny' | 'scope-violation';
+export type CapabilityAction = 'filesystem.write' | 'filesystem.read' | 'shell.exec' | 'mcp.call' | 'git.mutate' | 'secret.lease' | 'network.egress' | 'deploy';
+export interface CapabilityGrant {
+    id: string;
+    action: CapabilityAction;
+    resource: string;
+    constraints?: Record<string, unknown>;
+    expiresAt: number;
+    agentId?: string;
+    taskId?: string;
+    policyHash: string;
+    used: boolean;
+}
+export interface PolicyEvaluation {
+    decision: FirewallDecision;
+    reason: string;
+    ruleId?: string;
+    capabilityId?: string;
+    policyHash: string;
+    timestamp: string;
+}
+export interface TypedCommand {
+    bin: string;
+    args: string[];
+    cwd?: string;
+}
+export interface TransactionBudgets {
+    maxFiles: number;
+    maxRetries: number;
+    maxDurationMs: number;
+    maxCostUsd?: number;
+}
+export type TransactionStatus = 'START' | 'RUNNING' | 'VERIFYING' | 'COMMIT' | 'DISCARD';
+export interface TransactionRecord {
+    id: string;
+    agentId?: string;
+    scope: string[];
+    status: TransactionStatus;
+    worktreePath?: string;
+    budgets: TransactionBudgets;
+    filesChanged: string[];
+    capabilitiesIssued: string[];
+    decisions: PolicyEvaluation[];
+    startedAt: string;
+    finishedAt?: string;
+    policyHash: string;
+}
+export interface AttestationBundle {
+    version: 1;
+    transactionId: string;
+    agentId?: string;
+    userId?: string;
+    scope: string[];
+    policyHash: string;
+    capabilities: string[];
+    filesUsed: string[];
+    toolsUsed: string[];
+    gateResults: {
+        status: string;
+        score?: number;
+        failedGates: string[];
+    };
+    overrides: string[];
+    artifactDigest: string;
+    /** git commit SHA at attestation time */
+    commitSha?: string;
+    /** git tree object id (HEAD^{tree}) */
+    treeDigest?: string;
+    signedAt: string;
+    signature: string;
+}
+export interface AdversarialCase {
+    id: string;
+    description: string;
+    proposedAction: {
+        action: CapabilityAction;
+        resource: string;
+        args?: Record<string, unknown>;
+        command?: string;
+    };
+    expectedDecision: FirewallDecision;
+    agentScope?: string[];
+    allowlist?: string[];
+}
+export interface AdversarialCaseResult {
+    caseId: string;
+    expected: FirewallDecision;
+    actual: FirewallDecision;
+    passed: boolean;
+    reason: string;
+    suggestedRule?: string;
+}

package/dist/firewall/types.js

@@ -0,0 +1,5 @@
+/**
+ * Agent Transaction Firewall — shared types.
+ * Deterministic allow/deny decisions; no LLM on the hot path.
+ */
+export {};

package/dist/hooks/checker.d.ts

@@ -13,6 +13,8 @@ interface CheckerOptions {
     files: string[];
     timeout_ms?: number;
     block_on_failure?: boolean;
+    /** Bound writer identity — required when agent scopes are registered */
+    agentId?: string;
 }
 /**
  * Run fast gates on a set of files.

package/dist/hooks/checker.js

@@ -12,6 +12,7 @@ import path from 'path';
 import yaml from 'yaml';
 import { ConfigSchema } from '../types/index.js';
 import { scanInputForCredentials } from './input-validator.js';
+import { evaluateWriteScope, loadAgentScopesFromDisk } from '../firewall/scope-enforcement.js';
 const JS_TS_PATTERN = /\.(ts|tsx|js|jsx|mts|mjs)$/;
 /**
  * Check if a file matches any ignore pattern from rigour.yml.
@@ -92,14 +93,17 @@ function checkFile(content, relPath, cwd, config) {
  */
 export async function runHookChecker(options) {
     const start = Date.now();
-    const { cwd, files, timeout_ms = 5000 } = options;
+    const { cwd, files, timeout_ms = 5000, agentId } = options;
     const failures = [];
+    let timedOut = false;
     try {
         const config = await loadConfig(cwd);
         const deadline = start + timeout_ms;
         const ignorePatterns = config.ignore ?? [];
+        const agentScopes = await loadAgentScopesFromDisk(cwd);
         for (const filePath of files) {
             if (Date.now() > deadline) {
+                timedOut = true;
                 break;
             }
             const resolved = await resolveFile(filePath, cwd);
@@ -110,9 +114,29 @@ export async function runHookChecker(options) {
             if (isIgnored(resolved.relPath, ignorePatterns)) {
                 continue;
             }
+            if (agentScopes.length > 0) {
+                const scopeEv = evaluateWriteScope(cwd, resolved.relPath, agentScopes, agentId);
+                if (scopeEv.decision !== 'allow') {
+                    failures.push({
+                        gate: 'agent-scope',
+                        file: resolved.relPath,
+                        message: scopeEv.reason,
+                        severity: 'critical',
+                    });
+                    continue;
+                }
+            }
             const fileFailures = checkFile(resolved.content, resolved.relPath, cwd, config);
             failures.push(...fileFailures);
         }
+        if (timedOut) {
+            failures.push({
+                gate: 'hook-timeout',
+                file: '',
+                message: `Hook checker exceeded ${timeout_ms}ms before all files were scanned (fail-closed)`,
+                severity: 'critical',
+            });
+        }
         return {
             status: failures.length > 0 ? 'fail' : 'pass',
             failures,

package/dist/hooks/standalone-checker.js

@@ -89,7 +89,11 @@ async function main() {
         process.stdout.write(EMPTY_RESULT);
         return;
     }
-    const result = await runHookChecker({ cwd, files });
+    const result = await runHookChecker({
+        cwd,
+        files,
+        agentId: process.env.RIGOUR_AGENT_ID || undefined,
+    });
     process.stdout.write(JSON.stringify(result));
     if (result.status === 'fail') {
         logFailures(result.failures);

package/dist/hooks/templates.js

@@ -82,6 +82,7 @@ process.stdin.on('end', async () => {
         const result = await runHookChecker({
             cwd: process.cwd(),
             files: [payload.file_path],
+            agentId: process.env.RIGOUR_AGENT_ID || undefined,
         });
 
         // Write result to stdout for Cursor to consume
@@ -148,6 +149,7 @@ process.stdin.on('end', async () => {
         const result = await runHookChecker({
             cwd: process.cwd(),
             files: [filePath],
+            agentId: process.env.RIGOUR_AGENT_ID || undefined,
         });
 
         if (result.status === 'fail') {
@@ -206,6 +208,7 @@ process.stdin.on('end', async () => {
         const result = await runHookChecker({
             cwd: process.cwd(),
             files: [payload.file_path],
+            agentId: process.env.RIGOUR_AGENT_ID || undefined,
         });
 
         if (result.status === 'fail') {

package/dist/index.d.ts

@@ -36,4 +36,5 @@ export * from './context/cache-engine.js';
 export * from './context/context-session.js';
 export * from './context/index-bridge.js';
 export * from './services/context-telemetry-service.js';
+export * from './firewall/index.js';
 export { recordContextEvent, recordModelUsage, recordCheckpointMetric, getContextEvents, getModelUsages, getCheckpointMetrics, } from './storage/index.js';

package/dist/index.js

@@ -37,6 +37,7 @@ export * from './context/cache-engine.js';
 export * from './context/context-session.js';
 export * from './context/index-bridge.js';
 export * from './services/context-telemetry-service.js';
+export * from './firewall/index.js';
 export { recordContextEvent, recordModelUsage, recordCheckpointMetric, getContextEvents, getModelUsages, getCheckpointMetrics, } from './storage/index.js';
 // Pattern Index is intentionally NOT exported here to prevent
 // native dependency issues (sharp/transformers) from leaking into

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "5.5.4",
+  "version": "6.0.0",
   "description": "AI-native quality gate engine with local Bayesian learning. AST analysis, drift detection, Fix Packet generation, and agent self-healing across TypeScript, JavaScript, Python, Go, Ruby, and C#.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -66,11 +66,11 @@
     "@xenova/transformers": "^2.17.2",
     "sqlite3": "^5.1.7",
     "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-arm64": "5.5.4",
-    "@rigour-labs/brain-darwin-x64": "5.5.4",
-    "@rigour-labs/brain-linux-arm64": "5.5.4",
-    "@rigour-labs/brain-linux-x64": "5.5.4",
-    "@rigour-labs/brain-win-x64": "5.5.4"
+    "@rigour-labs/brain-darwin-arm64": "6.0.0",
+    "@rigour-labs/brain-linux-arm64": "6.0.0",
+    "@rigour-labs/brain-darwin-x64": "6.0.0",
+    "@rigour-labs/brain-win-x64": "6.0.0",
+    "@rigour-labs/brain-linux-x64": "6.0.0"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",