@rigour-labs/core 6.11.1 → 6.11.2

package/dist/gates/hallucinated-imports/index.d.ts

@@ -24,6 +24,8 @@ export interface HallucinatedImport {
     importPath: string;
     type: 'relative' | 'package' | 'python' | 'go' | 'ruby' | 'csharp' | 'rust' | 'java' | 'kotlin';
     reason: string;
+    /** The resolver could not read what the file may import (no manifest found): a note, never a block. */
+    uncertain?: boolean;
 }
 export interface HallucinatedImportsConfig {
     enabled?: boolean;

package/dist/gates/hallucinated-imports/index.js

@@ -123,14 +123,24 @@ export class HallucinatedImportsGate extends Gate {
             }
             catch (e) { }
         }
+        // One finding per file; an import the resolver could not check against a manifest is a separate note.
         const byFile = new Map();
         for (const h of hallucinated) {
-            const existing = byFile.get(h.file) || [];
+            const key = `${h.uncertain ? 'note' : 'block'}\u0000${h.file}`;
+            const existing = byFile.get(key) || [];
             existing.push(h);
-            byFile.set(h.file, existing);
+            byFile.set(key, existing);
         }
-        for (const [file, imports] of byFile) {
+        for (const imports of byFile.values()) {
+            const file = imports[0].file;
             const details = imports.map(i => `  L${i.line}: import '${i.importPath}' — ${i.reason}`).join('\n');
+            if (imports[0].uncertain) {
+                failures.push({
+                    ...this.createFailure(`Imports that could not be checked in ${file} (no manifest found for it):\n${details}`, [file], 'Rigour found no manifest (Cargo.toml) for this file, so it cannot tell whether these are declared. Check them, or add the manifest.', 'Hallucinated Imports', imports[0].line, undefined, 'low'),
+                    advisory: true,
+                });
+                continue;
+            }
             failures.push(this.createFailure(`Hallucinated imports in ${file}:\n${details}`, [file], `These imports reference modules that don't exist. Remove or replace with real modules. AI models often "hallucinate" package names or file paths.`, 'Hallucinated Imports', imports[0].line, undefined, 'critical'));
         }
         return failures;

package/dist/gates/hallucinated-imports-lang.d.ts

@@ -16,7 +16,6 @@ export declare function loadNuGetPackages(cwd: string): Set<string>;
  */
 export declare function loadNuGetPackagesForFile(file: string, cwd: string): Set<string>;
 export declare function checkRustImports(content: string, file: string, cwd: string, projectFiles: Set<string>, hallucinated: HallucinatedImport[]): void;
-export declare function loadCargoDeps(cwd: string): Set<string>;
 export declare function checkJavaKotlinImports(content: string, file: string, ext: string, cwd: string, projectFiles: Set<string>, hallucinated: HallucinatedImport[]): void;
 export declare function loadJavaDeps(cwd: string): Set<string>;
 /**

package/dist/gates/hallucinated-imports-lang.js

@@ -10,6 +10,8 @@ export function checkGoImports(content, file, cwd, projectFiles, hallucinated) {
     let inImportBlock = false;
     // Find go.mod by walking up from the Go file's directory (monorepo support).
     let modulePath = null;
+    let moduleDir = ''; // where go.mod sits, relative to the repository root
+    const requiredModules = []; // `require` entries: another module, even under the module's own prefix
     const replaceModules = new Set(); // Modules with local replace directives
     const fileAbsDir = path.dirname(path.resolve(cwd, file));
     const rootDir = path.resolve(cwd);
@@ -22,6 +24,16 @@ export function checkGoImports(content, file, cwd, projectFiles, hallucinated) {
                 const moduleMatch = goMod.match(/^module\s+(\S+)/m);
                 if (moduleMatch) {
                     modulePath = moduleMatch[1];
+                    moduleDir = path.relative(rootDir, searchDir).replace(/\\/g, '/');
+                }
+                for (const m of goMod.matchAll(/^require\s+([^\s(]\S*)\s+\S+/gm))
+                    requiredModules.push(m[1]);
+                for (const block of goMod.matchAll(/^require\s*\(([\s\S]*?)^\)/gm)) {
+                    for (const entry of block[1].split('\n')) {
+                        const m = entry.trim().match(/^([^\s/][^\s]*)\s+\S+/);
+                        if (m)
+                            requiredModules.push(m[1]);
+                    }
                 }
                 // Parse replace directives: replace github.com/foo/bar => ../local-bar
                 // These modules are valid even without being in go.sum
@@ -94,10 +106,16 @@ export function checkGoImports(content, file, cwd, projectFiles, hallucinated) {
         // 1. Skip Go standard library — comprehensive list
         if (isGoStdlib(importPath))
             continue;
-        // 2. If we have a module path, check project-relative imports FIRST
+        // 1b. A module go.mod requires is another module, even under this module's own path
+        //     (tailscale.com requiring tailscale.com/client/tailscale/v2): resolved by the module system.
+        if (requiredModules.some(m => importPath === m || importPath.startsWith(m + '/')))
+            continue;
+        // 2. If we have a module path, check project-relative imports FIRST: the package's own folder must hold Go files.
         if (modulePath && importPath.startsWith(modulePath + '/')) {
             const relPath = importPath.slice(modulePath.length + 1);
-            const hasMatchingFile = [...projectFiles].some(f => f.endsWith('.go') && f.startsWith(relPath));
+            const packageDir = moduleDir ? `${moduleDir}/${relPath}` : relPath;
+            // On disk, not in the scanned file list: that list leaves out folders like `build/` that a Go package may be.
+            const hasMatchingFile = goPackageExists(path.join(rootDir, ...packageDir.split('/')));
             if (!hasMatchingFile) {
                 hallucinated.push({
                     file, line: i + 1, importPath, type: 'go',
@@ -137,6 +155,15 @@ export function checkGoImports(content, file, cwd, projectFiles, hallucinated) {
         //    without go.mod context we can't verify, so skip to avoid false positives
     }
 }
+/** A Go package: a folder holding at least one .go file. */
+function goPackageExists(dir) {
+    try {
+        return fs.readdirSync(dir).some(entry => String(entry).endsWith('.go'));
+    }
+    catch {
+        return false;
+    }
+}
 export function checkRubyImports(content, file, cwd, projectFiles, hallucinated) {
     const lines = content.split('\n');
     // Parse Gemfile for known gem dependencies
@@ -384,125 +411,182 @@ export function loadNuGetPackagesForFile(file, cwd) {
 }
 export function checkRustImports(content, file, cwd, projectFiles, hallucinated) {
     const lines = content.split('\n');
-    const cargoDeps = loadCargoDeps(cwd);
+    // The file's own crate manifest and its workspace: what this crate may name. With no Cargo.toml found, nothing
+    // here can be proven missing, so an unresolved name is a note (`uncertain`), never a block.
+    const manifest = rustManifestFor(cwd, file);
+    // Items in scope by name: `use log::x` after `mod log;` names the module, not a crate (Rust 2018 paths).
+    const local = rustLocalNames(content);
+    const where = manifest.found ? 'its Cargo.toml' : 'any Cargo.toml found';
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i].trim();
         if (line.startsWith('//') || line.startsWith('/*'))
             continue;
-        // extern crate foo;
+        // extern crate foo;  (pre-2018: the crate must be declared, and then `use foo::` names it)
         const externMatch = line.match(/^extern\s+crate\s+(\w+)/);
         if (externMatch) {
             const crateName = externMatch[1];
-            if (isRustStdCrate(crateName))
-                continue;
-            if (cargoDeps.has(crateName))
+            if (isRustStdCrate(crateName) || manifest.deps.has(crateName))
                 continue;
             hallucinated.push({
                 file, line: i + 1, importPath: crateName, type: 'rust',
-                reason: `extern crate '${crateName}' — not in Cargo.toml or Rust std`,
+                reason: `extern crate '${crateName}' — not in ${where} or Rust std`,
+                ...(manifest.found ? {} : { uncertain: true }),
             });
             continue;
         }
-        // use foo::bar::baz;  or  use foo::{bar, baz};
-        const useMatch = line.match(/^(?:pub\s+)?use\s+(\w+)::/);
+        // use foo::bar;  use ::foo::bar;  pub(crate) use foo::{bar, baz};  Only the first segment can be a crate.
+        const useMatch = line.match(/^(?:pub(?:\([^)]*\))?\s+)?use\s+(?:::)?(\w+)::/);
         if (useMatch) {
             const crateName = useMatch[1];
-            if (isRustStdCrate(crateName))
+            // Path keywords, std, declared crates, and names the file itself brings into scope.
+            if (['crate', 'self', 'super', 'Self'].includes(crateName))
                 continue;
-            if (cargoDeps.has(crateName))
-                continue;
-            // 'crate' and 'self' and 'super' are Rust path keywords
-            if (['crate', 'self', 'super'].includes(crateName))
+            if (isRustStdCrate(crateName) || manifest.deps.has(crateName) || local.has(crateName))
                 continue;
             hallucinated.push({
                 file, line: i + 1, importPath: crateName, type: 'rust',
-                reason: `use ${crateName}:: — crate not in Cargo.toml or Rust std`,
+                reason: `use ${crateName}:: — crate not in ${where} or Rust std`,
+                ...(manifest.found ? {} : { uncertain: true }),
             });
         }
     }
 }
-export function loadCargoDeps(cwd) {
-    const deps = new Set();
-    const parseCargoToml = (filePath) => {
-        try {
-            if (!fs.pathExistsSync(filePath))
-                return;
-            const content = fs.readFileSync(filePath, 'utf-8');
-            // Parse ALL dependency sections: [dependencies], [dev-dependencies], [build-dependencies]
-            // Also handle [target.'cfg(...)'.dependencies]
-            let inDeps = false;
-            for (const line of content.split('\n')) {
-                const trimmed = line.trim();
-                // Match any dependencies section header
-                if (/^\[(?:(?:dev|build)-)?dependencies(?:\.]|\])/.test(trimmed) ||
-                    /^\[target\.[^\]]*\.(?:(?:dev|build)-)?dependencies\]/.test(trimmed) ||
-                    /^\[workspace\.dependencies\]/.test(trimmed)) {
-                    inDeps = true;
-                    continue;
-                }
-                if (/^\[/.test(trimmed) && inDeps) {
-                    inDeps = false;
-                    continue;
-                }
-                if (inDeps) {
-                    const m = trimmed.match(/^([\w][\w-]*)\s*=/);
-                    if (m)
-                        deps.add(m[1].replace(/-/g, '_')); // Rust uses _ in code for - in Cargo
-                }
-            }
-            // Handle [dependencies.foo] format (inline table)
-            const inlineDepPattern = /^\[(?:(?:dev|build)-)?dependencies\.([\w][\w-]*)\]/gm;
-            let dm;
-            while ((dm = inlineDepPattern.exec(content)) !== null) {
-                deps.add(dm[1].replace(/-/g, '_'));
-            }
-            // Handle [features] section — optional deps are valid when feature is enabled
-            let inFeatures = false;
-            for (const line of content.split('\n')) {
-                const trimmed = line.trim();
-                if (trimmed === '[features]') {
-                    inFeatures = true;
-                    continue;
-                }
-                if (/^\[/.test(trimmed) && inFeatures) {
-                    inFeatures = false;
-                    continue;
-                }
-                if (inFeatures) {
-                    // Features reference dep names: feature = ["dep:foo", "bar/feature"]
-                    const depRefs = trimmed.match(/"dep:(\w[\w-]*)"/g);
-                    if (depRefs) {
-                        for (const ref of depRefs) {
-                            const name = ref.match(/"dep:(\w[\w-]*)"/)?.[1];
-                            if (name)
-                                deps.add(name.replace(/-/g, '_'));
-                        }
-                    }
-                }
+/** Names a Rust file declares or brings into scope itself: modules, types, functions, `extern crate`, `as` aliases and the last segment of a plain `use`. */
+function rustLocalNames(content) {
+    const names = new Set();
+    const declared = /^\s*(?:pub(?:\([^)]*\))?\s+)?(?:(?:unsafe|async|const|extern(?:\s+"[^"]*")?)\s+)*(?:mod|struct|enum|union|trait|type|fn|const|static|macro_rules!)\s+(\w+)/gm;
+    for (const m of content.matchAll(declared))
+        names.add(m[1]);
+    for (const m of content.matchAll(/^\s*extern\s+crate\s+(\w+)(?:\s+as\s+(\w+))?/gm)) {
+        names.add(m[1]);
+        if (m[2])
+            names.add(m[2]);
+    }
+    for (const m of content.matchAll(/\bas\s+(\w+)\s*[;,}]/g))
+        names.add(m[1]);
+    // `use serde::de;` brings `de` into this file's scope (only this file's: it never becomes a crate name).
+    for (const m of content.matchAll(/^\s*(?:pub(?:\([^)]*\))?\s+)?use\s+[\w:]+::(\w+)\s*;/gm))
+        names.add(m[1]);
+    return names;
+}
+/**
+ * What a Rust file's crate may name: every dependency section of the nearest Cargo.toml from the file up to the
+ * repository root (its crate) and that crate's own name (integration tests and examples use it); then, from the
+ * nearest `[workspace]` at or above it, the shared dependencies and every member's name. `found` is false when no
+ * Cargo.toml was found at all.
+ */
+function rustManifestFor(cwd, file) {
+    const root = path.resolve(cwd);
+    const crate = crateManifest(root, path.dirname(path.resolve(root, file)));
+    const deps = new Set(crate ? cargoNames(crate) : []);
+    const workspace = workspaceManifest(crate ? path.dirname(crate) : root);
+    if (workspace) {
+        for (const name of cargoNames(workspace.file))
+            deps.add(name);
+        for (const member of workspaceMembers(path.dirname(workspace.file), workspace.text))
+            for (const name of cargoNames(member, true))
+                deps.add(name);
+    }
+    return { found: !!crate || !!workspace, deps };
+}
+/** The nearest Cargo.toml from `dir` up to the repository root: the file's own crate. */
+function crateManifest(root, dir) {
+    for (; dir.startsWith(root); dir = path.dirname(dir)) {
+        const candidate = path.join(dir, 'Cargo.toml');
+        if (fs.pathExistsSync(candidate))
+            return candidate;
+        if (dir === root || path.dirname(dir) === dir)
+            return undefined;
+    }
+    return undefined;
+}
+/** The nearest Cargo.toml with `[workspace]` at or above `dir`. */
+function workspaceManifest(dir) {
+    for (;; dir = path.dirname(dir)) {
+        const file = path.join(dir, 'Cargo.toml');
+        const text = readText(file);
+        if (text?.includes('[workspace]'))
+            return { file, text };
+        if (path.dirname(dir) === dir)
+            return undefined;
+    }
+}
+function readText(file) {
+    try {
+        return fs.pathExistsSync(file) ? fs.readFileSync(file, 'utf-8') : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A workspace's member manifests: `members = ["crates/a", "crates/*"]`, a trailing `/*` listing that folder. */
+function workspaceMembers(dir, text) {
+    const list = /members\s*=\s*\[([^\]]*)\]/.exec(text)?.[1] ?? '';
+    const out = [];
+    for (const m of list.matchAll(/"([^"]+)"/g)) {
+        const member = m[1];
+        if (member.endsWith('/*')) {
+            const parent = path.join(dir, member.slice(0, -2));
+            try {
+                for (const entry of fs.readdirSync(parent))
+                    out.push(path.join(parent, String(entry), 'Cargo.toml'));
             }
+            catch { /* none */ }
         }
-        catch { /* skip */ }
-    };
-    // Parse the Cargo.toml in the working directory
-    parseCargoToml(path.join(cwd, 'Cargo.toml'));
-    // Walk up to find workspace Cargo.toml
-    let searchDir = cwd;
-    const rootDir = path.parse(cwd).root;
-    while (searchDir !== rootDir) {
-        const parentCargoPath = path.join(searchDir, 'Cargo.toml');
-        if (fs.pathExistsSync(parentCargoPath)) {
-            const content = fs.readFileSync(parentCargoPath, 'utf-8');
-            if (content.includes('[workspace]')) {
-                parseCargoToml(parentCargoPath);
-                break;
-            }
+        else
+            out.push(path.join(dir, member, 'Cargo.toml'));
+    }
+    return out;
+}
+/** Names a Cargo.toml makes nameable in code (`-` read as `_`); `ownOnly`: just its [package] and [lib] names. */
+function cargoNames(file, ownOnly = false) {
+    const text = readText(file);
+    if (!text)
+        return new Set();
+    const names = ownOnly ? new Set() : cargoDepsOf(text);
+    for (const section of ['package', 'lib']) {
+        const body = new RegExp(`^\\[${section}\\]\\s*$([\\s\\S]*?)(?=^\\[|(?![\\s\\S]))`, 'm').exec(text)?.[1] ?? '';
+        const name = /^\s*name\s*=\s*"([^"]+)"/m.exec(body)?.[1];
+        if (name)
+            names.add(name.replace(/-/g, '_'));
+    }
+    return names;
+}
+/** Every name a Cargo.toml's dependency sections declare: [dependencies], dev, build, target-specific, [workspace.dependencies], `[dependencies.foo]` and `dep:` features; `-` read as `_`. */
+function cargoDepsOf(content) {
+    const deps = new Set([...sectionDeps(content), ...tableDeps(content), ...featureDeps(content)]);
+    return new Set([...deps].map(name => name.replace(/-/g, '_'))); // Rust uses _ in code for - in Cargo
+}
+/** Keys of every dependency section: [dependencies], [dev-dependencies], [build-dependencies], target-specific and the workspace's. */
+function sectionDeps(content) {
+    const names = [];
+    let inDeps = false;
+    for (const line of content.split('\n')) {
+        const trimmed = line.trim();
+        if (/^\[(?:(?:dev|build)-)?dependencies(?:\.]|\])/.test(trimmed) ||
+            /^\[target\.[^\]]*\.(?:(?:dev|build)-)?dependencies\]/.test(trimmed) ||
+            /^\[workspace\.dependencies\]/.test(trimmed)) {
+            inDeps = true;
+            continue;
         }
-        const parent = path.dirname(searchDir);
-        if (parent === searchDir)
-            break;
-        searchDir = parent;
+        if (/^\[/.test(trimmed)) {
+            inDeps = false;
+            continue;
+        }
+        const m = inDeps ? trimmed.match(/^([\w][\w-]*)\s*=/) : null;
+        if (m)
+            names.push(m[1]);
     }
-    return deps;
+    return names;
+}
+/** `[dependencies.foo]` tables. */
+function tableDeps(content) {
+    return [...content.matchAll(/^\[(?:(?:dev|build)-)?dependencies\.([\w][\w-]*)\]/gm)].map(m => m[1]);
+}
+/** Optional dependencies a feature enables (`"dep:foo"` in [features]). */
+function featureDeps(content) {
+    const features = /^\[features\]\s*$([\s\S]*?)(?=^\[|(?![\s\S]))/m.exec(content)?.[1] ?? '';
+    return [...features.matchAll(/"dep:(\w[\w-]*)"/g)].map(m => m[1]);
 }
 export function checkJavaKotlinImports(content, file, ext, cwd, projectFiles, hallucinated) {
     const lines = content.split('\n');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.11.1",
+  "version": "6.11.2",
   "description": "Rigour's review engine: deterministic gates on changed lines, rules and lessons learned from your team's fixes, and per-check precision from what you fix versus dismiss, across TypeScript, JavaScript, Python, Go, Ruby and C#.",
   "engines": {
     "node": ">=22.13"
@@ -75,11 +75,11 @@
     "@anthropic-ai/sdk": "^0.132.1",
     "pg": "^8.16.3",
     "openai": "^5.23.2",
-    "@rigour-labs/brain-darwin-x64": "6.11.1",
-    "@rigour-labs/brain-linux-x64": "6.11.1",
-    "@rigour-labs/brain-linux-arm64": "6.11.1",
-    "@rigour-labs/brain-win-x64": "6.11.1",
-    "@rigour-labs/brain-darwin-arm64": "6.11.1"
+    "@rigour-labs/brain-darwin-arm64": "6.11.2",
+    "@rigour-labs/brain-linux-arm64": "6.11.2",
+    "@rigour-labs/brain-linux-x64": "6.11.2",
+    "@rigour-labs/brain-win-x64": "6.11.2",
+    "@rigour-labs/brain-darwin-x64": "6.11.2"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",