@rigour-labs/core 6.10.0-rc.1 → 6.10.0

package/dist/hooks/checker.js

@@ -11,6 +11,8 @@ import fs from 'fs-extra';
 import path from 'path';
 import yaml from 'yaml';
 import { ConfigSchema } from '../types/index.js';
+import { codeOffsets } from '../utils/code-mask.js';
+import { resolveTsPathTarget } from '../gates/hallucinated-imports/ts-path-target.js';
 import { scanInputForCredentials } from './input-validator.js';
 import { evaluateWriteScope, loadAgentScopesFromDisk } from '../firewall/scope-enforcement.js';
 const JS_TS_PATTERN = /\.(ts|tsx|js|jsx|mts|mjs)$/;
@@ -57,7 +59,7 @@ async function resolveFile(filePath, cwd) {
 /**
  * Run all fast gates on a single file's content.
  */
-function checkFile(content, relPath, cwd, config) {
+async function checkFile(content, relPath, cwd, config) {
     const failures = [];
     const lines = content.split('\n');
     // Gate 0a: Protected paths — BLOCK writes to .github/, rigour.yml, etc.
@@ -77,7 +79,7 @@ function checkFile(content, relPath, cwd, config) {
     const isJsTs = JS_TS_PATTERN.test(relPath);
     // Gate 2: Hallucinated imports (JS/TS only)
     if (isJsTs) {
-        checkHallucinatedImports(content, relPath, cwd, failures);
+        await checkHallucinatedImports(content, relPath, cwd, failures);
     }
     // Gate 3: Promise safety (JS/TS only)
     if (isJsTs) {
@@ -131,7 +133,7 @@ export async function runHookChecker(options) {
                     continue;
                 }
             }
-            const fileFailures = checkFile(resolved.content, resolved.relPath, cwd, config);
+            const fileFailures = await checkFile(resolved.content, resolved.relPath, cwd, config);
             failures.push(...fileFailures);
         }
         if (timedOut) {
@@ -163,28 +165,24 @@ export async function runHookChecker(options) {
     }
 }
 /**
- * Check for imports of non-existent relative files.
+ * Check for imports of non-existent relative files, resolved by the same rule as the review's hallucinated-imports gate
+ * (ts-path-target.ts): an extensionless path with any source extension or as a folder's index, and a TypeScript ESM
+ * specifier naming the emitted file (`./b.js` for `b.ts` or `b.tsx`, `.mjs` for `.mts`, `.cjs` for `.cts`).
  */
-function checkHallucinatedImports(content, relPath, cwd, failures) {
+async function checkHallucinatedImports(content, relPath, cwd, failures) {
     const importRegex = /(?:import\s+.*\s+from\s+['"]([^'"]+)['"]|require\s*\(\s*['"]([^'"]+)['"]\s*\))/g;
+    // An import written inside a string (a template, a fixture) or a comment is text, not an import.
+    const isCode = codeOffsets(content, path.extname(relPath).slice(1));
     let match;
     while ((match = importRegex.exec(content)) !== null) {
+        if (!isCode(match.index))
+            continue;
         const specifier = match[1] || match[2];
         if (!specifier || !specifier.startsWith('.')) {
             continue;
         }
         const dir = path.dirname(path.join(cwd, relPath));
-        const resolved = path.resolve(dir, specifier);
-        const extensions = ['', '.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs', '/index.ts', '/index.js'];
-        const exists = extensions.some(ext => {
-            try {
-                return fs.existsSync(resolved + ext);
-            }
-            catch {
-                return false;
-            }
-        });
-        if (!exists) {
+        if (!await resolveTsPathTarget(dir, specifier, cwd, new Set())) {
             const lineNum = content.substring(0, match.index).split('\n').length;
             failures.push({
                 gate: 'hallucinated-imports',

package/dist/index.d.ts

@@ -53,7 +53,7 @@ export { recordAgentWrites, captureHumanEdits } from './review-learning/human-ed
 export { readRepoRules, rulesForDiff, rulesSection, splitRules, type RepoRule } from './review-learning/repo-rules.js';
 export { diffFromGit, GitDiffError, type DiffSource } from './review/git-diff.js';
 export { checkPrecisions, checkId, precisionOf, isMuted, readOutcomes, MUTE_MIN_OUTCOMES, MUTE_BELOW, type CheckPrecision, type CheckOutcome } from './review/check-outcomes.js';
-export { recordReviewOutcome, listResolvedFixes, removeResolvedFix, openFindingCount, listOpenFindings, type ResolvedFix, type FixCapture } from './review/agent-fixes.js';
+export { recordReviewOutcome, recheckOpenFindings, listResolvedFixes, removeResolvedFix, openFindingCount, listOpenFindings, type ResolvedFix, type FixCapture } from './review/agent-fixes.js';
 export { appendStory, readStories, compactDiff, STORIES_FILE, type Story, type CatchStage } from './review/stories.js';
 export { recordLessonsServed, recordPrCatches, recordReuseSuggested, type LessonChannel } from './review/learning-events.js';
 export { computeEffectiveness, readAgentEvents, appendAgentEvent, findingKeys, type AgentEvent, type ReviewEffectiveness } from './review/effectiveness.js';

package/dist/index.js

@@ -51,7 +51,7 @@ export { recordAgentWrites, captureHumanEdits } from './review-learning/human-ed
 export { readRepoRules, rulesForDiff, rulesSection, splitRules } from './review-learning/repo-rules.js';
 export { diffFromGit, GitDiffError } from './review/git-diff.js';
 export { checkPrecisions, checkId, precisionOf, isMuted, readOutcomes, MUTE_MIN_OUTCOMES, MUTE_BELOW } from './review/check-outcomes.js';
-export { recordReviewOutcome, listResolvedFixes, removeResolvedFix, openFindingCount, listOpenFindings } from './review/agent-fixes.js';
+export { recordReviewOutcome, recheckOpenFindings, listResolvedFixes, removeResolvedFix, openFindingCount, listOpenFindings } from './review/agent-fixes.js';
 export { appendStory, readStories, compactDiff, STORIES_FILE } from './review/stories.js';
 export { recordLessonsServed, recordPrCatches, recordReuseSuggested } from './review/learning-events.js';
 export { computeEffectiveness, readAgentEvents, appendAgentEvent, findingKeys } from './review/effectiveness.js';

package/dist/review/agent-fixes.d.ts

@@ -12,6 +12,8 @@ interface OpenFinding {
     stage?: CatchStage;
     /** Its dismissal key (quiet.ts): a finding someone dismissed was not fixed. */
     key?: string;
+    /** The version of the checks that reported it (CHECKER_VERSION); absent in entries captured before it was kept. */
+    checker?: string;
 }
 export interface ResolvedFix {
     id: string;
@@ -31,12 +33,25 @@ export interface FixCapture {
     resolved: number;
     /** The fixes this review resolved, for turning into lessons (storage/fix-lessons.ts). */
     fixes: ResolvedFix[];
+    /** Findings another version of the checks opened that this one no longer reports: closed, never credited as fixes. */
+    checkerChanged: number;
 }
 /**
  * Record a review's findings: open new ones, resolve open ones the review no longer reports.
  * Each resolved fix is also kept as a story, credited to the stage that first reported it.
  */
 export declare function recordReviewOutcome(cwd: string, findings: Failure[], reviewedFiles: string[], stage?: CatchStage): FixCapture;
+/**
+ * Re-checks, in place, the findings another version of the checks opened at `stage` (with `all`, every one open at
+ * it), with `check` (this version's, for that stage): what it still reports stays open, now as its own. What it no
+ * longer reports closes: one another version opened as checker-changed, never a fix; one this version opened the way
+ * any review resolves it (a fix when its file changed since, creditFix). Runs nothing when no such finding is open.
+ */
+export declare function recheckOpenFindings(cwd: string, stage: CatchStage, check: (files: string[]) => Promise<Failure[]>, all?: boolean): Promise<{
+    closed: number;
+    kept: number;
+    fixed: number;
+}>;
 export declare function listResolvedFixes(cwd: string): ResolvedFix[];
 export declare function removeResolvedFix(cwd: string, id: string): void;
 export declare function openFindingCount(cwd: string): number;

package/dist/review/agent-fixes.js

@@ -9,6 +9,10 @@
  *
  * A finding only counts as resolved when its file was part of the review that
  * no longer reports it: a file committed out of the working tree was not fixed.
+ *
+ * Nor is a finding an older version of Rigour's checks reported: when the checks change (an upgrade), a finding they
+ * no longer report closes as "checker changed", never as a fix, with no story and no outcome. Otherwise a false
+ * finding the old checks made would be credited to the agent the first time it edited the file.
  */
 import crypto from 'crypto';
 import fs from 'fs';
@@ -19,6 +23,18 @@ import { dismissedKeys, findingKey } from './quiet.js';
 const DIR = path.join('.rigour', 'agent-fixes');
 const MAX_FILE_BYTES = 200_000;
 const OPEN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+/** The version of Rigour's checks: the core package's own. A finding another version opened is never credited as a fix. */
+const CHECKER_VERSION = coreVersion();
+function coreVersion() {
+    try {
+        return JSON.parse(fs.readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version ?? 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+/** Whether another version of the checks opened it. */
+const stale = (entry) => entry.checker !== CHECKER_VERSION;
 /**
  * Record a review's findings: open new ones, resolve open ones the review no longer reports.
  * Each resolved fix is also kept as a story, credited to the stage that first reported it.
@@ -26,21 +42,21 @@ const OPEN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 export function recordReviewOutcome(cwd, findings, reviewedFiles, stage = 'review') {
     const open = readOpen(cwd);
     const current = new Map(findings.flatMap(f => (f.files?.[0] ? [[`${f.id}:${f.files[0]}`, f]] : [])));
-    const fixes = resolveGone(cwd, open, current, new Set(reviewedFiles));
-    for (const fix of fixes) {
-        appendStory(cwd, { at: fix.resolvedAt, openedAt: fix.openedAt, stage: fix.stage ?? stage, file: fix.file, rule: fix.rule, title: fix.title ?? fix.rule, details: fix.details, diff: compactDiff(fix.before, fix.after) });
-    }
+    const { resolved: fixes, checkerChanged } = resolveGone(cwd, open, current, new Set(reviewedFiles), stage);
     const opened = openNew(cwd, open, current, stage);
     writeOpen(cwd, open);
-    return { opened, resolved: fixes.length, fixes };
+    return { opened, resolved: fixes.length, fixes, checkerChanged };
 }
 /** Open findings this review no longer reports: resolved when their file was reviewed and changed. */
-function resolveGone(cwd, open, current, reviewed) {
+function resolveGone(cwd, open, current, reviewed, stage) {
     const resolved = [];
+    let checkerChanged = 0;
     const dismissed = dismissedKeys(cwd);
     for (const [key, entry] of Object.entries(open)) {
-        if (current.has(key))
+        if (current.has(key)) {
+            entry.checker = CHECKER_VERSION; // still reported by these checks: theirs now
             continue;
+        }
         if (entry.key && dismissed.has(entry.key)) {
             delete open[key]; // gone because a person dismissed it, not because anyone fixed it
             continue;
@@ -50,14 +66,60 @@ function resolveGone(cwd, open, current, reviewed) {
                 delete open[key];
             continue;
         }
-        const after = readSmall(cwd, entry.file);
-        if (after !== null && after !== entry.before) {
-            resolved.push(writeResolved(cwd, entry, after));
-            recordOutcome(cwd, checkId({ rule: entry.rule, title: entry.title }), 'fixed');
+        if (stale(entry)) {
+            delete open[key]; // the checks changed, not the code: no fix, no story, no outcome
+            checkerChanged++;
+            continue;
+        }
+        const fix = creditFix(cwd, entry, stage);
+        if (fix)
+            resolved.push(fix);
+        delete open[key];
+    }
+    return { resolved, checkerChanged };
+}
+/**
+ * A finding these checks reported and no longer do, in a file that changed since: the agent's fix, kept with its before
+ * and after, a story credited to the stage that first reported it, and a `fixed` outcome. A file unchanged since is no
+ * fix (the finding vanished without an edit): undefined.
+ */
+function creditFix(cwd, entry, stage) {
+    const after = readSmall(cwd, entry.file);
+    if (after === null || after === entry.before)
+        return undefined;
+    const fix = writeResolved(cwd, entry, after);
+    recordOutcome(cwd, checkId({ rule: entry.rule, title: entry.title }), 'fixed');
+    appendStory(cwd, { at: fix.resolvedAt, openedAt: fix.openedAt, stage: fix.stage ?? stage, file: fix.file, rule: fix.rule, title: fix.title ?? fix.rule, details: fix.details, diff: compactDiff(fix.before, fix.after) });
+    return fix;
+}
+/**
+ * Re-checks, in place, the findings another version of the checks opened at `stage` (with `all`, every one open at
+ * it), with `check` (this version's, for that stage): what it still reports stays open, now as its own. What it no
+ * longer reports closes: one another version opened as checker-changed, never a fix; one this version opened the way
+ * any review resolves it (a fix when its file changed since, creditFix). Runs nothing when no such finding is open.
+ */
+export async function recheckOpenFindings(cwd, stage, check, all = false) {
+    const open = readOpen(cwd);
+    const old = Object.entries(open).filter(([, entry]) => (all || stale(entry)) && entry.stage === stage);
+    if (old.length === 0)
+        return { closed: 0, kept: 0, fixed: 0 };
+    const files = [...new Set(old.map(([, entry]) => entry.file))].filter(file => fs.existsSync(path.join(cwd, file)));
+    const reported = new Set((await check(files)).flatMap(f => (f.files?.[0] ? [`${f.id}:${f.files[0]}`] : [])));
+    let closed = 0;
+    let fixed = 0;
+    for (const [key, entry] of old) {
+        if (reported.has(key)) {
+            entry.checker = CHECKER_VERSION;
+            continue;
         }
+        if (!stale(entry) && creditFix(cwd, entry, stage))
+            fixed++;
+        else
+            closed++;
         delete open[key];
     }
-    return resolved;
+    writeOpen(cwd, open);
+    return { closed, kept: old.length - closed - fixed, fixed };
 }
 function openNew(cwd, open, current, stage) {
     let opened = 0;
@@ -68,7 +130,7 @@ function openNew(cwd, open, current, stage) {
         const before = readSmall(cwd, file);
         if (before === null)
             continue;
-        open[key] = { file, rule: finding.id, title: finding.title, details: finding.details, before, openedAt: new Date().toISOString(), stage, key: findingKey(finding) };
+        open[key] = { file, rule: finding.id, title: finding.title, details: finding.details, before, openedAt: new Date().toISOString(), stage, key: findingKey(finding), checker: CHECKER_VERSION };
         opened++;
     }
     return opened;

package/dist/utils/code-mask.d.ts

@@ -7,9 +7,11 @@
  * a string. Every line starts as code: nothing carries to the next line, so a regex literal holding a quote (`/"/`) or
  * an unclosed quote affects only its own line and can never hide a real call below it.
  *
+ * In the C family, a line that starts with `/*` or `*` is a block comment's line (the JSDoc shape) and is all comment.
+ *
  * Two limits, both narrowing a false positive and never losing a match the gates made before:
- * - a string or a block comment spanning lines (a Python `"""` docstring, a multi-line template literal, `/* … *\/`)
- *   is read as code past its first line, as before;
+ * - a string or a block comment spanning lines (a Python `"""` docstring, a multi-line template literal, a block
+ *   comment whose lines do not start with `*`) is read as code past its first line, as before;
  * - code inside a string interpolation (Python `f"{…}"`, JS `${…}`, Ruby `#{…}`) is string, so a call written inside
  *   one does not count as a call.
  */

package/dist/utils/code-mask.js

@@ -7,9 +7,11 @@
  * a string. Every line starts as code: nothing carries to the next line, so a regex literal holding a quote (`/"/`) or
  * an unclosed quote affects only its own line and can never hide a real call below it.
  *
+ * In the C family, a line that starts with `/*` or `*` is a block comment's line (the JSDoc shape) and is all comment.
+ *
  * Two limits, both narrowing a false positive and never losing a match the gates made before:
- * - a string or a block comment spanning lines (a Python `"""` docstring, a multi-line template literal, `/* … *\/`)
- *   is read as code past its first line, as before;
+ * - a string or a block comment spanning lines (a Python `"""` docstring, a multi-line template literal, a block
+ *   comment whose lines do not start with `*`) is read as code past its first line, as before;
  * - code inside a string interpolation (Python `f"{…}"`, JS `${…}`, Ruby `#{…}`) is string, so a call written inside
  *   one does not count as a call.
  */
@@ -22,6 +24,8 @@ const HASH_COMMENTS = new Set(['py', 'rb', 'sh', 'bash', 'zsh', 'yml', 'yaml', '
 /** For one line, whether column `col` is code. `ext` is the file's extension, which decides the comment marker. */
 export function codeColumns(line, ext) {
     const hash = HASH_COMMENTS.has(ext.toLowerCase());
+    if (!hash && /^\s*(\/\*|\*)/.test(line))
+        return () => false;
     const masked = new Uint8Array(line.length);
     for (let i = 0; i < line.length; i++) {
         const c = line[i];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.10.0-rc.1",
+  "version": "6.10.0",
   "description": "Rigour's review engine: deterministic gates on changed lines, rules and lessons learned from your team's fixes, and per-check precision from what you fix versus dismiss, across TypeScript, JavaScript, Python, Go, Ruby and C#.",
   "engines": {
     "node": ">=22.13"
@@ -75,11 +75,11 @@
     "@anthropic-ai/sdk": "^0.132.1",
     "pg": "^8.16.3",
     "openai": "^5.23.2",
-    "@rigour-labs/brain-darwin-x64": "6.10.0-rc.1",
-    "@rigour-labs/brain-darwin-arm64": "6.10.0-rc.1",
-    "@rigour-labs/brain-linux-x64": "6.10.0-rc.1",
-    "@rigour-labs/brain-linux-arm64": "6.10.0-rc.1",
-    "@rigour-labs/brain-win-x64": "6.10.0-rc.1"
+    "@rigour-labs/brain-darwin-x64": "6.10.0",
+    "@rigour-labs/brain-darwin-arm64": "6.10.0",
+    "@rigour-labs/brain-linux-arm64": "6.10.0",
+    "@rigour-labs/brain-linux-x64": "6.10.0",
+    "@rigour-labs/brain-win-x64": "6.10.0"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",