@rigour-labs/core 6.0.0 → 6.1.0-beta.1

package/dist/storage/lessons.js

@@ -0,0 +1,322 @@
+import { createHash, randomUUID } from 'crypto';
+import fs from 'fs-extra';
+import path from 'path';
+import { openDatabase } from './db.js';
+import { decryptLocalPayload, encryptLocalPayload } from './local-encryption.js';
+import { loadTeamConfiguration } from './team-store.js';
+export function shouldValidateInteractionLesson(evidence, verifiedSuccessfulOutcomes = 0) {
+    return evidence.outcome === 'success'
+        && Boolean(evidence.reusableClaim?.trim())
+        && (evidence.deterministic === true || verifiedSuccessfulOutcomes >= 3);
+}
+export async function recordInteractionEvidence(cwd, evidence) {
+    const db = await openDatabase();
+    if (!db)
+        return null;
+    try {
+        const repositoryId = await getRepositoryId(cwd);
+        await registerRepository(db, cwd, repositoryId);
+        const config = await loadTeamConfiguration();
+        const id = `observation-${randomUUID()}`;
+        await db.run(`INSERT INTO interaction_events (
+                id, repository_id, actor_id, task_id, session_id, request_id,
+                tool_name, phase, outcome, deterministic, evidence_json, created_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, id, repositoryId, config?.actorId || process.env.RIGOUR_ACTOR_ID || null, evidence.taskId || null, evidence.sessionId || null, evidence.requestId, evidence.tool, evidence.phase || 'response', evidence.outcome, evidence.deterministic ? 1 : 0, await encryptLocalPayload({ files: evidence.files || [], summary: evidence.summary }), Date.now());
+        return id;
+    }
+    finally {
+        await db.close();
+    }
+}
+export async function countInteractionEvidence(cwd) {
+    const db = await openDatabase();
+    if (!db)
+        return 0;
+    try {
+        const repositoryId = await getRepositoryId(cwd);
+        const row = await db.get('SELECT COUNT(*) AS count FROM interaction_events WHERE repository_id = ?', repositoryId);
+        return Number(row?.count || 0);
+    }
+    finally {
+        await db.close();
+    }
+}
+function normalizeRemote(remote) {
+    return remote.trim().replace(/^git@([^:]+):/, 'https://$1/').replace(/\.git$/, '').toLowerCase();
+}
+async function readGitConfig(cwd) {
+    const dotGit = path.join(cwd, '.git');
+    const stat = await fs.stat(dotGit);
+    if (stat.isDirectory())
+        return fs.readFile(path.join(dotGit, 'config'), 'utf8');
+    const pointer = await fs.readFile(dotGit, 'utf8');
+    const match = pointer.match(/^gitdir:\s*(.+)$/m);
+    if (!match)
+        throw new Error('Invalid Git directory pointer.');
+    const gitDir = path.resolve(cwd, match[1].trim());
+    try {
+        return await fs.readFile(path.join(gitDir, 'config'), 'utf8');
+    }
+    catch {
+        // Linked worktrees usually keep the shared remote configuration here.
+        const commonDir = (await fs.readFile(path.join(gitDir, 'commondir'), 'utf8')).trim();
+        return fs.readFile(path.resolve(gitDir, commonDir, 'config'), 'utf8');
+    }
+}
+export async function getRepositoryId(cwd) {
+    let identity = path.resolve(cwd);
+    try {
+        const config = await readGitConfig(cwd);
+        const remote = config.match(/\[remote\s+"origin"\][\s\S]*?url\s*=\s*([^\n]+)/)?.[1];
+        if (remote)
+            identity = normalizeRemote(remote);
+    }
+    catch {
+        // Non-git workspaces retain a stable path-derived local identity.
+    }
+    return createHash('sha256').update(identity).digest('hex');
+}
+async function registerRepository(db, cwd, repositoryId) {
+    let canonicalUri = path.resolve(cwd);
+    try {
+        const config = await readGitConfig(cwd);
+        const remote = config.match(/\[remote\s+"origin"\][\s\S]*?url\s*=\s*([^\n]+)/)?.[1];
+        if (remote)
+            canonicalUri = normalizeRemote(remote);
+    }
+    catch {
+        // Non-git workspaces use their resolved path as the canonical local identity.
+    }
+    const remoteName = canonicalUri.split('/').filter(Boolean).at(-1);
+    await db.run(`INSERT INTO repositories (id, canonical_uri, display_name, last_seen) VALUES (?, ?, ?, ?)
+         ON CONFLICT(id) DO UPDATE SET canonical_uri=excluded.canonical_uri,
+             display_name=excluded.display_name, last_seen=excluded.last_seen`, repositoryId, canonicalUri, remoteName || path.basename(cwd), Date.now());
+}
+async function rowToLesson(row) {
+    return {
+        id: String(row.id),
+        repositoryId: String(row.repository_id),
+        actorId: row.actor_id ? String(row.actor_id) : undefined,
+        teamId: row.team_id ? String(row.team_id) : undefined,
+        visibility: row.visibility,
+        state: row.state,
+        kind: String(row.kind),
+        subject: String(row.subject),
+        evidence: await decryptLocalPayload(String(row.evidence_json)),
+        confidence: Number(row.confidence),
+        source: String(row.source),
+        supersedesId: row.supersedes_id ? String(row.supersedes_id) : undefined,
+        createdAt: Number(row.created_at),
+        updatedAt: Number(row.updated_at),
+        repositoryName: row.repository_name ? String(row.repository_name) : undefined,
+    };
+}
+export async function recordInteractionLesson(cwd, evidence) {
+    const db = await openDatabase();
+    if (!db)
+        return null;
+    try {
+        const repositoryId = await getRepositoryId(cwd);
+        await registerRepository(db, cwd, repositoryId);
+        const id = `lesson-${randomUUID()}`;
+        const now = Date.now();
+        const verifiedSuccess = shouldValidateInteractionLesson(evidence, evidence.verifiedOutcome ? 3 : 0);
+        const confidence = verifiedSuccess ? 0.8 : 0.3;
+        const state = confidence >= 0.8 ? 'validated' : 'candidate';
+        const config = await loadTeamConfiguration();
+        const actorId = config?.actorId || process.env.RIGOUR_ACTOR_ID || null;
+        const priorRow = await db.get(`SELECT * FROM lessons
+             WHERE repository_id = ? AND actor_id IS ? AND visibility = 'personal'
+               AND state = 'candidate' AND kind = 'interaction' AND subject = ?
+             ORDER BY updated_at DESC LIMIT 1`, repositoryId, actorId, evidence.reusableClaim?.trim() || `interaction:${evidence.tool}`);
+        if (priorRow) {
+            const prior = await rowToLesson(priorRow);
+            const previousSuccesses = Number(prior.evidence.successfulOutcomes ?? 0);
+            const successfulOutcomes = previousSuccesses + (evidence.outcome === 'success' ? 1 : 0);
+            const previousVerified = Number(prior.evidence.verifiedSuccessfulOutcomes ?? 0);
+            const verifiedSuccessfulOutcomes = previousVerified + (evidence.verifiedOutcome && evidence.outcome === 'success' ? 1 : 0);
+            const repeatedValidation = shouldValidateInteractionLesson(evidence, verifiedSuccessfulOutcomes);
+            const mergedEvidence = {
+                ...evidence,
+                observationCount: Number(prior.evidence.observationCount ?? 1) + 1,
+                successfulOutcomes,
+                verifiedSuccessfulOutcomes,
+                previousRequestId: prior.evidence.requestId,
+            };
+            const updated = {
+                ...prior,
+                state: repeatedValidation ? 'validated' : 'candidate',
+                evidence: mergedEvidence,
+                confidence: repeatedValidation ? 0.8 : Math.min(0.7, prior.confidence + 0.15),
+                updatedAt: now,
+            };
+            await db.run('UPDATE lessons SET state = ?, evidence_json = ?, confidence = ?, updated_at = ? WHERE id = ?', updated.state, await encryptLocalPayload(updated.evidence), updated.confidence, updated.updatedAt, updated.id);
+            if (config)
+                await queueLessonSync(db, updated, now);
+            return prior.id;
+        }
+        const storedEvidence = {
+            ...evidence,
+            observationCount: 1,
+            successfulOutcomes: evidence.outcome === 'success' ? 1 : 0,
+            verifiedSuccessfulOutcomes: evidence.verifiedOutcome && evidence.outcome === 'success' ? 1 : 0,
+        };
+        const encryptedEvidence = await encryptLocalPayload(storedEvidence);
+        await db.run(`INSERT INTO lessons (
+                id, repository_id, actor_id, team_id, visibility, state, kind, subject,
+                evidence_json, confidence, source, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, 'personal', ?, 'interaction', ?, ?, ?, 'mcp', ?, ?)`, id, repositoryId, actorId, config?.teamId || process.env.RIGOUR_TEAM_ID || null, state, evidence.reusableClaim?.trim() || `interaction:${evidence.tool}`, encryptedEvidence, confidence, now, now);
+        if (config) {
+            const personal = await txSafeLesson(db, id);
+            if (personal)
+                await queueLessonSync(db, personal, now);
+        }
+        return id;
+    }
+    finally {
+        await db.close();
+    }
+}
+async function queueLessonSync(db, lesson, now) {
+    await db.run(`INSERT INTO sync_outbox (id, operation, entity_type, entity_id, payload_json, created_at)
+         VALUES (?, 'upsert', 'lesson', ?, ?, ?)`, `outbox-${randomUUID()}`, lesson.id, await encryptLocalPayload(lesson), now);
+}
+export async function listLessons(cwd, limit = 100) {
+    let db;
+    try {
+        db = await openDatabase();
+    }
+    catch {
+        return [];
+    }
+    if (!db)
+        return [];
+    try {
+        const repositoryId = await getRepositoryId(cwd);
+        await registerRepository(db, cwd, repositoryId);
+        const rows = await db.all(`SELECT lessons.*, repositories.display_name AS repository_name
+             FROM lessons LEFT JOIN repositories ON repositories.id = lessons.repository_id
+             WHERE repository_id = ?
+             ORDER BY updated_at DESC LIMIT ?`, repositoryId, limit);
+        return await Promise.all(rows.map(rowToLesson));
+    }
+    finally {
+        await db.close();
+    }
+}
+/**
+ * Returns the evidence visible to the current workspace for exploration. Cross-repository
+ * records are candidates only; getApplicableLessons remains the enforcement boundary.
+ */
+export async function listKnowledgeLessons(cwd, limit = 500) {
+    let db;
+    try {
+        db = await openDatabase();
+    }
+    catch {
+        return [];
+    }
+    if (!db)
+        return [];
+    try {
+        const repositoryId = await getRepositoryId(cwd);
+        await registerRepository(db, cwd, repositoryId);
+        const config = await loadTeamConfiguration();
+        const rows = config
+            ? await db.all(`SELECT lessons.*, repositories.display_name AS repository_name
+                 FROM lessons LEFT JOIN repositories ON repositories.id = lessons.repository_id
+                 WHERE lessons.repository_id = ?
+                    OR (lessons.visibility = 'personal' AND lessons.actor_id = ?)
+                    OR (lessons.visibility = 'team' AND lessons.team_id = ? AND lessons.state = 'promoted')
+                 ORDER BY lessons.updated_at DESC LIMIT ?`, repositoryId, config.actorId, config.teamId, limit)
+            : await db.all(`SELECT lessons.*, repositories.display_name AS repository_name
+                 FROM lessons LEFT JOIN repositories ON repositories.id = lessons.repository_id
+                 WHERE lessons.repository_id = ?
+                    OR (lessons.visibility = 'personal' AND lessons.actor_id IS NULL)
+                 ORDER BY lessons.updated_at DESC LIMIT ?`, repositoryId, limit);
+        return await Promise.all(rows.map(rowToLesson));
+    }
+    finally {
+        await db.close();
+    }
+}
+export async function getApplicableLessons(cwd, actorId, teamId) {
+    const repositoryId = await getRepositoryId(cwd);
+    const all = await listKnowledgeLessons(cwd, 500);
+    const applicable = all
+        .filter(lesson => lesson.state === 'validated' || lesson.state === 'promoted')
+        .filter(lesson => lesson.visibility === 'team' || !actorId || !lesson.actorId || lesson.actorId === actorId)
+        .filter(lesson => !teamId || !lesson.teamId || lesson.teamId === teamId)
+        .map(lesson => {
+        const priority = lesson.repositoryId === repositoryId ? 1 : lesson.visibility === 'personal' ? 2 : 3;
+        return { ...lesson, priority, provenance: `${lesson.visibility}:${lesson.source}:${lesson.id}` };
+    })
+        .sort((a, b) => a.priority - b.priority || b.confidence - a.confidence);
+    const bySubject = new Map();
+    for (const lesson of applicable)
+        bySubject.set(lesson.subject, [...(bySubject.get(lesson.subject) ?? []), lesson]);
+    const conflicts = [...bySubject.entries()]
+        .filter(([, lessons]) => new Set(lessons.map(lesson => JSON.stringify(lesson.evidence))).size > 1)
+        .map(([subject, lessons]) => ({ subject, lessonIds: lessons.map(lesson => lesson.id) }));
+    return { lessons: applicable, conflicts };
+}
+export async function transitionLesson(id, state, options = {}) {
+    const db = await openDatabase();
+    if (!db)
+        return false;
+    const now = Date.now();
+    try {
+        return await db.transaction(async (tx) => {
+            const existing = await tx.get('SELECT * FROM lessons WHERE id = ?', id);
+            if (!existing)
+                return false;
+            const visibility = options.visibility ?? existing.visibility;
+            if (state === 'promoted' && visibility === 'team') {
+                const teamConfig = await loadTeamConfiguration();
+                if (!teamConfig) {
+                    throw new Error('Configure PostgreSQL team mode before publishing a team lesson.');
+                }
+                const source = await rowToLesson(existing);
+                const publishedId = `lesson-${randomUUID()}`;
+                const published = {
+                    ...source,
+                    id: publishedId,
+                    actorId: source.actorId || teamConfig.actorId,
+                    teamId: teamConfig.teamId,
+                    visibility: 'team',
+                    state: 'promoted',
+                    source: `published:${source.id}`,
+                    createdAt: now,
+                    updatedAt: now,
+                };
+                await tx.run(`INSERT INTO lessons (
+                        id, repository_id, actor_id, team_id, visibility, state, kind, subject,
+                        evidence_json, confidence, source, supersedes_id, created_at, updated_at
+                    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, published.id, published.repositoryId, published.actorId || null, published.teamId || null, published.visibility, published.state, published.kind, published.subject, await encryptLocalPayload(published.evidence), published.confidence, published.source, published.supersedesId || null, published.createdAt, published.updatedAt);
+                if (options.queueSync) {
+                    await tx.run(`INSERT INTO sync_outbox (id, operation, entity_type, entity_id, payload_json, created_at)
+                         VALUES (?, 'upsert', 'lesson', ?, ?, ?)`, `outbox-${randomUUID()}`, published.id, await encryptLocalPayload(published), now);
+                }
+                await tx.run("DELETE FROM context_cache WHERE cache_type = 'semantic'");
+                return true;
+            }
+            const result = await tx.run('UPDATE lessons SET state = ?, visibility = ?, updated_at = ? WHERE id = ?', state, visibility, now, id);
+            if (result.changes > 0)
+                await tx.run("DELETE FROM context_cache WHERE cache_type = 'semantic'");
+            if (result.changes > 0 && options.queueSync && visibility === 'team') {
+                const payload = { ...await rowToLesson(existing), state, visibility, updatedAt: now };
+                await tx.run(`INSERT INTO sync_outbox (
+                        id, operation, entity_type, entity_id, payload_json, created_at
+                    ) VALUES (?, 'upsert', 'lesson', ?, ?, ?)`, `outbox-${randomUUID()}`, id, await encryptLocalPayload(payload), now);
+            }
+            return result.changes > 0;
+        });
+    }
+    finally {
+        await db.close();
+    }
+}
+async function txSafeLesson(db, id) {
+    const row = await db.get('SELECT * FROM lessons WHERE id = ?', id);
+    return row ? rowToLesson(row) : null;
+}

package/dist/storage/lessons.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/storage/lessons.test.js

@@ -0,0 +1,50 @@
+import fs from 'fs-extra';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { getRepositoryId, shouldValidateInteractionLesson } from './lessons.js';
+const roots = [];
+afterEach(async () => { await Promise.all(roots.splice(0).map((root) => fs.remove(root))); });
+describe('getRepositoryId', () => {
+    it('uses normalized origin identity instead of a basename', async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), 'rigour-repo-id-'));
+        roots.push(root);
+        await fs.ensureDir(path.join(root, '.git'));
+        await fs.writeFile(path.join(root, '.git', 'config'), '[remote "origin"]\nurl = git@github.com:Rigour-Labs/Rigour.git\n');
+        const first = await getRepositoryId(root);
+        const second = await getRepositoryId(path.join(root, '..', path.basename(root)));
+        expect(first).toBe(second);
+        expect(first).toHaveLength(64);
+    });
+    it('uses the shared origin identity from a linked worktree', async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), 'rigour-worktree-id-'));
+        roots.push(root);
+        const common = path.join(root, 'common');
+        const linkedGit = path.join(common, 'worktrees', 'feature');
+        const worktree = path.join(root, 'checkout');
+        await fs.ensureDir(linkedGit);
+        await fs.ensureDir(worktree);
+        await fs.writeFile(path.join(worktree, '.git'), `gitdir: ${linkedGit}\n`);
+        await fs.writeFile(path.join(linkedGit, 'commondir'), '../..\n');
+        await fs.writeFile(path.join(common, 'config'), '[remote "origin"]\nurl = https://github.com/rigour-labs/rigour.git\n');
+        const regular = path.join(root, 'regular');
+        await fs.ensureDir(path.join(regular, '.git'));
+        await fs.writeFile(path.join(regular, '.git', 'config'), '[remote "origin"]\nurl = git@github.com:Rigour-Labs/Rigour.git\n');
+        expect(await getRepositoryId(worktree)).toBe(await getRepositoryId(regular));
+        expect(await getRepositoryId(worktree)).toHaveLength(64);
+    });
+});
+describe('interaction lesson validation', () => {
+    const evidence = { tool: 'rigour_context_scope', outcome: 'success', requestId: 'req-1' };
+    it('keeps repeated unverified interaction as evidence only', () => {
+        expect(shouldValidateInteractionLesson(evidence, 0)).toBe(false);
+        expect(shouldValidateInteractionLesson(evidence, 2)).toBe(false);
+    });
+    it('validates deterministic or repeatedly verified outcomes', () => {
+        expect(shouldValidateInteractionLesson({ ...evidence, deterministic: true, reusableClaim: 'Use scoped retrieval before edits.' }, 0)).toBe(true);
+        expect(shouldValidateInteractionLesson({ ...evidence, verifiedOutcome: true, reusableClaim: 'Run the focused test suite.' }, 3)).toBe(true);
+    });
+    it('does not turn a successful tool call into reusable knowledge', () => {
+        expect(shouldValidateInteractionLesson({ ...evidence, deterministic: true }, 3)).toBe(false);
+    });
+});

package/dist/storage/local-encryption.d.ts

@@ -0,0 +1,2 @@
+export declare function encryptLocalPayload(value: unknown): Promise<string>;
+export declare function decryptLocalPayload<T>(value: string): Promise<T>;

package/dist/storage/local-encryption.js

@@ -0,0 +1,41 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';
+import fs from 'fs-extra';
+import os from 'os';
+import path from 'path';
+const KEY_PATH = path.join(os.homedir(), '.rigour', 'team-cache.key');
+async function getKey() {
+    const configured = process.env.RIGOUR_LOCAL_CACHE_KEY;
+    if (configured) {
+        const key = Buffer.from(configured, 'base64');
+        if (key.length !== 32)
+            throw new Error('RIGOUR_LOCAL_CACHE_KEY must be a base64-encoded 32-byte key.');
+        return key;
+    }
+    try {
+        const key = Buffer.from((await fs.readFile(KEY_PATH, 'utf8')).trim(), 'base64');
+        if (key.length === 32)
+            return key;
+    }
+    catch { /* create below */ }
+    const key = randomBytes(32);
+    await fs.ensureDir(path.dirname(KEY_PATH));
+    await fs.writeFile(KEY_PATH, key.toString('base64'), { mode: 0o600 });
+    await fs.chmod(KEY_PATH, 0o600);
+    return key;
+}
+export async function encryptLocalPayload(value) {
+    const key = await getKey();
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    const ciphertext = Buffer.concat([cipher.update(JSON.stringify(value), 'utf8'), cipher.final()]);
+    return `enc:v1:${iv.toString('base64')}:${cipher.getAuthTag().toString('base64')}:${ciphertext.toString('base64')}`;
+}
+export async function decryptLocalPayload(value) {
+    if (!value.startsWith('enc:v1:'))
+        return JSON.parse(value);
+    const [, , ivValue, tagValue, ciphertextValue] = value.split(':');
+    const decipher = createDecipheriv('aes-256-gcm', await getKey(), Buffer.from(ivValue, 'base64'));
+    decipher.setAuthTag(Buffer.from(tagValue, 'base64'));
+    const plaintext = Buffer.concat([decipher.update(Buffer.from(ciphertextValue, 'base64')), decipher.final()]);
+    return JSON.parse(plaintext.toString('utf8'));
+}

package/dist/storage/team-store.d.ts

@@ -0,0 +1,75 @@
+export interface TeamConfiguration {
+    organizationId: string;
+    teamId: string;
+    actorId: string;
+    databaseUrl?: string;
+    semantic?: TeamSemanticConfiguration;
+}
+export interface TeamSemanticConfiguration {
+    provider: 'pgvector';
+    model: 'Xenova/all-MiniLM-L6-v2';
+    dimensions: 384;
+}
+export interface TeamModeStatus {
+    mode: 'local' | 'team';
+    connectivity: 'local' | 'online' | 'offline';
+    organizationId?: string;
+    teamId?: string;
+    actorId?: string;
+    queuedChanges: number;
+    message: string;
+    semantic?: {
+        provider: 'pgvector';
+        status: 'ready' | 'degraded';
+        extensionVersion?: string;
+        model: string;
+        dimensions: number;
+        indexedLessons?: number;
+        missingLessons?: number;
+        message?: string;
+    };
+}
+export interface TeamDoctorResult extends TeamModeStatus {
+    schemaVersion?: number;
+    databaseRole?: string;
+    permissions?: string[];
+}
+export interface SemanticKnowledgeCandidate {
+    lessonId: string;
+    repositoryId: string;
+    subject: string;
+    visibility: string;
+    state: string;
+    confidence: number;
+    similarity: number;
+    provenance: string;
+}
+export interface SemanticKnowledgeResult {
+    status: 'disabled' | 'ready' | 'degraded';
+    provider?: 'pgvector';
+    model?: string;
+    candidates: SemanticKnowledgeCandidate[];
+    message?: string;
+}
+export declare const TEAM_CONFIG_PATH: string;
+export declare function validateTeamDatabaseUrl(databaseUrl: string): void;
+export declare function loadTeamConfiguration(): Promise<TeamConfiguration | null>;
+export declare function saveTeamConfiguration(config: TeamConfiguration): Promise<void>;
+export declare function initializeTeamSchema(databaseUrl: string, options?: {
+    pgvector?: boolean;
+}): Promise<void>;
+export declare function getTeamModeStatus(): Promise<TeamModeStatus>;
+export declare function doctorTeamConnection(config?: TeamConfiguration): Promise<TeamDoctorResult>;
+export declare function syncTeamOutbox(options?: {
+    dryRun?: boolean;
+}): Promise<{
+    pending: number;
+    synced: number;
+    pulled: number;
+}>;
+export declare function backfillTeamEmbeddings(limit?: number): Promise<{
+    eligible: number;
+    embedded: number;
+    skipped: number;
+}>;
+export declare function searchTeamKnowledge(query: string, limit?: number): Promise<SemanticKnowledgeResult>;