@rigour-labs/core 6.2.2 → 6.2.3

package/dist/gates/frontend-secret-exposure.js

@@ -51,12 +51,20 @@ export class FrontendSecretExposureGate extends Gate {
                 '(^|/)views/',
                 '(^|/)public/',
             ],
-            server_path_patterns: config.server_path_patterns ?? [
+            // Built-in server locations remain safe when older config files
+            // provide their own list; custom patterns extend this baseline.
+            server_path_patterns: [
                 '(^|/)pages/api/',
                 '(^|/)src/pages/api/',
                 '(^|/)app/api/',
                 '(^|/)src/app/api/',
+                '(^|/)scripts/',
+                '(^|/)e2e/',
+                '(^|/)tests/',
+                '(^|/)server/',
+                '(^|/)(?:playwright|vitest|vite|jest|next|webpack|eslint|prettier|tailwind|postcss|babel|tsup|rollup)\\.config\\.[cm]?[jt]s$',
                 '\\.server\\.(?:ts|tsx|js|jsx|mjs|cjs)$',
+                ...(config.server_path_patterns ?? []),
             ],
             allowlist_env_names: config.allowlist_env_names ?? [],
         };
@@ -81,7 +89,7 @@ export class FrontendSecretExposureGate extends Gate {
             ],
         });
         // Skip test/fixture files — they routinely use dummy keys
-        const sourceFiles = files.filter(f => !this.isTestFile(f));
+        const sourceFiles = files.filter(f => /\.(?:[cm]?[jt]s|[jt]sx|vue|svelte)$/i.test(f) && !this.isTestFile(f));
         Logger.info(`Frontend Secret Exposure Gate: scanning ${sourceFiles.length} files`);
         const exposures = [];
         for (const file of sourceFiles) {

package/dist/gates/frontend-secret-exposure.test.js

@@ -70,6 +70,22 @@ describe('FrontendSecretExposureGate', () => {
         const failures = await gate.run({ cwd: testDir });
         expect(failures).toHaveLength(0);
     });
+    it('does not treat server scripts or test configuration as browser bundles', async () => {
+        for (const file of ['scripts/migrate.mjs', 'e2e/session.ts', 'tests/helpers/db.ts', 'playwright.config.ts']) {
+            const filePath = path.join(testDir, file);
+            fs.mkdirSync(path.dirname(filePath), { recursive: true });
+            fs.writeFileSync(filePath, 'export const key = process.env.SESSION_SECRET;');
+        }
+        const gate = new FrontendSecretExposureGate({ server_path_patterns: ['(^|/)pages/api/'] });
+        expect(await gate.run({ cwd: testDir })).toHaveLength(0);
+    });
+    it('ignores shell files even when a broad project scan passes them in', async () => {
+        const shellPath = path.join(testDir, 'scripts/rigour-nmc.sh');
+        fs.mkdirSync(path.dirname(shellPath), { recursive: true });
+        fs.writeFileSync(shellPath, 'node -e "process.env.RIGOUR_NMC_DATABASE_URL"');
+        const gate = new FrontendSecretExposureGate();
+        expect(await gate.run({ cwd: testDir, patterns: ['**/*'] })).toHaveLength(0);
+    });
     it('respects explicit allowlist env names', async () => {
         const filePath = path.join(testDir, 'src/views/App.tsx');
         fs.mkdirSync(path.dirname(filePath), { recursive: true });

package/dist/gates/hallucinated-imports/index.js

@@ -152,7 +152,7 @@ export class HallucinatedImportsGate extends Gate {
                 `${resolvedPath}/index`,
             ];
         }
-        else if (extension) {
+        else if (extension && sourceExtensions.includes(extension)) {
             candidates = [resolvedPath, `${resolvedPath}/index`];
         }
         else {
@@ -165,7 +165,8 @@ export class HallucinatedImportsGate extends Gate {
     }
     shouldSkipFile(file) {
         const normalized = file.replace(/\\/g, '/');
-        return (normalized.includes('/examples/') ||
+        return (/(^|\/)next-env\.d\.ts$/.test(normalized) ||
+            normalized.includes('/examples/') ||
             normalized.includes('/studio-dist/') ||
             normalized.includes('/__tests__/') ||
             /\.test\.[^.]+$/i.test(normalized) ||

package/dist/gates/hallucinated-imports.test.js

@@ -470,6 +470,30 @@ import { helper } from './utils.js';
         const failures = await gate.run(context);
         expect(failures).toHaveLength(0);
     });
+    it('resolves dotted TypeScript basenames without hiding missing imports', async () => {
+        const source = `
+import './adapter.cli';
+import './database.types';
+import './missing.cli';
+`;
+        FileScanner.findFiles.mockResolvedValue([
+            'src/main.ts', 'src/adapter.cli.ts', 'src/database.types.ts',
+        ]);
+        mockReadFile.mockImplementation(async (p) => p.replace(/\\/g, '/').endsWith('/src/main.ts') ? source : 'export const value = 1;');
+        mockPathExists.mockImplementation(async (p) => p.replace(/\\/g, '/') === '/tmp/test-node-project/package.json');
+        mockReadJson.mockResolvedValue({ dependencies: {}, devDependencies: {} });
+        const failures = await gate.run(context);
+        expect(failures).toHaveLength(1);
+        expect(failures[0].details).toContain('./missing.cli');
+        expect(failures[0].details).not.toContain('./adapter.cli');
+        expect(failures[0].details).not.toContain('./database.types');
+    });
+    it('ignores the generated Next.js environment declaration', async () => {
+        FileScanner.findFiles.mockResolvedValue(['next-env.d.ts']);
+        mockReadFile.mockResolvedValue("import './.next/dev/types/routes.d.ts';");
+        const failures = await gate.run(context);
+        expect(failures).toHaveLength(0);
+    });
 });
 describe('HallucinatedImportsGate — ignore generated/test artifacts', () => {
     let gate;

package/dist/services/score-history.test.js

@@ -34,6 +34,14 @@ describe('getScoreTrend', () => {
             previousAvg: 94,
         });
     });
+    it('labels 41 → 41 → 41 → 41 → 52 as improving', () => {
+        writeScores([41, 41, 41, 41, 52]);
+        expect(getScoreTrend(testDir)).toMatchObject({
+            direction: 'improving',
+            visibleDelta: 11,
+            recentScores: [41, 41, 41, 41, 52],
+        });
+    });
     it('labels a falling displayed series as degrading', () => {
         writeScores([80, 75, 70, 64, 59]);
         expect(getScoreTrend(testDir)).toMatchObject({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.2.2",
+  "version": "6.2.3",
   "description": "AI-native quality gate engine with local Bayesian learning. AST analysis, drift detection, Fix Packet generation, and agent self-healing across TypeScript, JavaScript, Python, Go, Ruby, and C#.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -67,11 +67,11 @@
     "pg": "^8.16.3",
     "sqlite3": "^5.1.7",
     "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-x64": "6.2.2",
-    "@rigour-labs/brain-darwin-arm64": "6.2.2",
-    "@rigour-labs/brain-linux-arm64": "6.2.2",
-    "@rigour-labs/brain-win-x64": "6.2.2",
-    "@rigour-labs/brain-linux-x64": "6.2.2"
+    "@rigour-labs/brain-darwin-x64": "6.2.3",
+    "@rigour-labs/brain-darwin-arm64": "6.2.3",
+    "@rigour-labs/brain-linux-arm64": "6.2.3",
+    "@rigour-labs/brain-win-x64": "6.2.3",
+    "@rigour-labs/brain-linux-x64": "6.2.3"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",