@rigour-labs/core 6.2.3 → 6.2.4

package/dist/gates/hallucinated-imports/index.js

@@ -48,21 +48,25 @@ export class HallucinatedImportsGate extends Gate {
         const hallucinated = [];
         const defaultPatterns = ['**/*.{ts,js,tsx,jsx,py,go,rb,cs,rs,java,kt}'];
         const scanPatterns = context.patterns || defaultPatterns;
+        const ignore = [...(context.ignore || []), '**/node_modules/**', '**/dist/**', '**/build/**',
+            '**/examples/**', '**/studio-dist/**', '**/.next/**', '**/coverage/**',
+            '**/*.test.*', '**/*.spec.*', '**/__tests__/**',
+            '**/.venv/**', '**/venv/**', '**/vendor/**', '**/bin/Debug/**', '**/bin/Release/**', '**/obj/**',
+            '**/target/debug/**', '**/target/release/**', '**/out/**', '**/.gradle/**', '**/gradle/**'];
         const files = await FileScanner.findFiles({
             cwd: context.cwd,
             patterns: scanPatterns,
-            ignore: [...(context.ignore || []), '**/node_modules/**', '**/dist/**', '**/build/**',
-                '**/examples/**',
-                '**/studio-dist/**', '**/.next/**', '**/coverage/**',
-                '**/*.test.*', '**/*.spec.*', '**/__tests__/**',
-                '**/.venv/**', '**/venv/**', '**/vendor/**', '**/bin/Debug/**', '**/bin/Release/**', '**/obj/**',
-                '**/target/debug/**', '**/target/release/**',
-                '**/out/**', '**/.gradle/**', '**/gradle/**'],
+            ignore,
         });
         const analyzableFiles = files.filter(file => !this.shouldSkipFile(file));
         Logger.info(`Hallucinated Imports: Scanning ${analyzableFiles.length} files`);
-        const projectFiles = new Set(analyzableFiles.map(f => f.replace(/\\/g, '/')));
-        const allProjectFiles = new Set(files.map(f => f.replace(/\\/g, '/')));
+        // A scoped review scans changed files, but relative imports may point
+        // to unchanged files. Resolve against the project, not the edit set.
+        const resolutionFiles = context.patterns
+            ? await FileScanner.findFiles({ cwd: context.cwd, patterns: defaultPatterns, ignore })
+            : files;
+        const projectFiles = new Set(resolutionFiles.map(f => f.replace(/\\/g, '/')));
+        const allProjectFiles = projectFiles;
         const packageJson = await loadPackageJson(context.cwd);
         const rootDeps = new Set([
             ...Object.keys(packageJson?.dependencies || {}),

package/dist/gates/hallucinated-imports.test.js

@@ -264,6 +264,16 @@ describe('HallucinatedImportsGate — JS/TS Node builtins', () => {
         mockReaddirSync.mockReturnValue([]);
         gate = new HallucinatedImportsGate({ enabled: true });
     });
+    it('resolves changed-file imports against unchanged project files', async () => {
+        FileScanner.findFiles
+            .mockResolvedValueOnce(['src/feature.ts'])
+            .mockResolvedValueOnce(['src/feature.ts', 'src/types.ts']);
+        mockReadFile.mockResolvedValue("import type { Value } from './types.js';\n");
+        mockPathExists.mockResolvedValue(false);
+        const failures = await gate.run({ ...context, patterns: ['src/feature.ts'] });
+        expect(failures).toEqual([]);
+        expect(FileScanner.findFiles).toHaveBeenCalledTimes(2);
+    });
     it('should NOT flag Node.js built-in modules', async () => {
         const jsContent = `
 import fs from 'fs';

package/dist/gates/js-style-context.d.ts

@@ -0,0 +1,3 @@
+import { type NamingPattern } from './language-adapters/types.js';
+/** Extract comparable JS/TS names, excluding framework-defined identifiers. */
+export declare function extractComparableJsNames(content: string, file: string): NamingPattern[];

package/dist/gates/js-style-context.js

@@ -0,0 +1,65 @@
+import ts from 'typescript';
+import { classifyCasing } from './language-adapters/types.js';
+const HTTP_METHODS = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']);
+function isNextRoute(file) {
+    return /(?:^|\/)app(?:\/[^/]+)*\/route\.[cm]?[jt]sx?$/.test(file.replace(/\\/g, '/'));
+}
+function exported(node) {
+    return ts.canHaveModifiers(node)
+        && Boolean(ts.getModifiers(node)?.some(modifier => modifier.kind === ts.SyntaxKind.ExportKeyword));
+}
+function containsJsx(node) {
+    let found = false;
+    const visit = (child) => {
+        if (ts.isJsxElement(child) || ts.isJsxSelfClosingElement(child) || ts.isJsxFragment(child)) {
+            found = true;
+            return;
+        }
+        if (!found)
+            ts.forEachChild(child, visit);
+    };
+    ts.forEachChild(node, visit);
+    return found;
+}
+function isComponent(name, node, file) {
+    return /\.[jt]sx$/.test(file) && /^[A-Z]/.test(name) && containsJsx(node);
+}
+function isModuleConstant(declaration) {
+    const list = declaration.parent;
+    return ts.isVariableDeclarationList(list)
+        && (list.flags & ts.NodeFlags.Const) !== 0
+        && ts.isVariableStatement(list.parent)
+        && ts.isSourceFile(list.parent.parent);
+}
+function isFunctionValue(initializer) {
+    return Boolean(initializer && (ts.isArrowFunction(initializer) || ts.isFunctionExpression(initializer)));
+}
+/** Extract comparable JS/TS names, excluding framework-defined identifiers. */
+export function extractComparableJsNames(content, file) {
+    const kind = /\.[jt]sx$/.test(file) ? ts.ScriptKind.TSX : /\.[cm]?ts$/.test(file) ? ts.ScriptKind.TS : ts.ScriptKind.JS;
+    const source = ts.createSourceFile(file, content, ts.ScriptTarget.Latest, true, kind);
+    const patterns = [];
+    const route = isNextRoute(file);
+    const visit = (node) => {
+        if (ts.isFunctionDeclaration(node) && node.name) {
+            const name = node.name.text;
+            if (!(route && exported(node) && HTTP_METHODS.has(name)) && !isComponent(name, node, file)) {
+                patterns.push({ name, kind: 'function', convention: classifyCasing(name) });
+            }
+        }
+        if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name)) {
+            const name = node.name.text;
+            const fn = isFunctionValue(node.initializer);
+            const statement = node.parent.parent;
+            const routeExport = route && HTTP_METHODS.has(name) && ts.isVariableStatement(statement) && exported(statement);
+            const component = fn && isComponent(name, node.initializer, file);
+            const conventionalConstant = !fn && isModuleConstant(node) && classifyCasing(name) === 'SCREAMING_SNAKE';
+            if (!routeExport && !component && !conventionalConstant) {
+                patterns.push({ name, kind: fn ? 'function' : 'variable', convention: classifyCasing(name) });
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return patterns;
+}

package/dist/gates/js-style-context.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/js-style-context.test.js

@@ -0,0 +1,35 @@
+import { describe, expect, it } from 'vitest';
+import { extractComparableJsNames } from './js-style-context.js';
+describe('context-aware JS naming', () => {
+    it('excludes exported Next route methods only inside app route files', () => {
+        const code = `
+            export async function GET() { return Response.json({}); }
+            export const POST = async () => Response.json({});
+            function GET_HELPER() { return 1; }
+        `;
+        expect(extractComparableJsNames(code, 'src/app/api/items/route.ts').map(item => item.name))
+            .toEqual(['GET_HELPER']);
+        expect(extractComparableJsNames(code, 'src/lib/route.ts').map(item => item.name))
+            .toEqual(['GET', 'POST', 'GET_HELPER']);
+    });
+    it('excludes JSX-returning components but keeps ordinary PascalCase functions', () => {
+        const code = `
+            export function StepReview() { return <section />; }
+            const WizardField = () => <input />;
+            function ParseValue() { return 1; }
+        `;
+        expect(extractComparableJsNames(code, 'src/components/WizardField.tsx').map(item => item.name))
+            .toEqual(['ParseValue']);
+    });
+    it('excludes module constants but keeps unconventional local variables', () => {
+        const code = `
+            const EMAIL_TEMPLATE = 'hello';
+            function sendMessage() {
+                const LOCAL_VALUE = 1;
+                return LOCAL_VALUE;
+            }
+        `;
+        expect(extractComparableJsNames(code, 'src/lib/template.ts').map(item => item.name))
+            .toEqual(['sendMessage', 'LOCAL_VALUE']);
+    });
+});

package/dist/gates/logic-drift-git-base.d.ts

@@ -0,0 +1,7 @@
+export interface GitLogicBase {
+    changedFiles: Set<string>;
+    readAtBase: (file: string) => string | null;
+}
+export declare function isGitWorktree(cwd: string): boolean;
+/** Use a fixed commit for the entire scan; never move the baseline on read. */
+export declare function resolveGitLogicBase(cwd: string): GitLogicBase | null;

package/dist/gates/logic-drift-git-base.js

@@ -0,0 +1,41 @@
+import { execFileSync } from 'node:child_process';
+export function isGitWorktree(cwd) {
+    return git(cwd, ['rev-parse', '--is-inside-work-tree'])?.trim() === 'true';
+}
+function git(cwd, args) {
+    try {
+        return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 16 * 1024 * 1024 });
+    }
+    catch {
+        return null;
+    }
+}
+/** Use a fixed commit for the entire scan; never move the baseline on read. */
+export function resolveGitLogicBase(cwd) {
+    // Git reports the path relative to the worktree root without relying on
+    // platform-specific path casing or Windows short-name expansion.
+    const prefix = git(cwd, ['rev-parse', '--show-prefix']);
+    if (prefix === null || prefix.trim())
+        return null;
+    const currentBranch = git(cwd, ['symbolic-ref', '--quiet', '--short', 'HEAD'])?.trim();
+    const candidates = [
+        process.env.GITHUB_BASE_REF ? `refs/remotes/origin/${process.env.GITHUB_BASE_REF}` : '',
+        'refs/remotes/origin/main', 'refs/heads/main',
+        'refs/remotes/origin/master', 'refs/heads/master',
+    ].filter(Boolean);
+    const mainRef = candidates.find(ref => git(cwd, ['rev-parse', '--verify', '--quiet', ref])?.trim());
+    if (!mainRef)
+        return null;
+    const base = currentBranch === 'main' || currentBranch === 'master'
+        ? git(cwd, ['rev-parse', 'HEAD'])?.trim()
+        : git(cwd, ['merge-base', 'HEAD', mainRef])?.trim();
+    if (!base)
+        return null;
+    const diff = git(cwd, ['diff', '--name-only', '-z', '--diff-filter=ACMR', base, '--']);
+    if (diff === null)
+        return null;
+    return {
+        changedFiles: new Set(diff.split('\0').filter(Boolean)),
+        readAtBase: file => git(cwd, ['show', `${base}:${file}`]),
+    };
+}

package/dist/gates/logic-drift.d.ts

@@ -12,9 +12,9 @@
  * - Tests might still pass (if they don't cover edge cases)
  * - The change looks intentional ("AI refactored the function")
  *
- * Strategy: Collect baselines for critical functions, then detect
- * mutations between scans. This foundation enables future LLM-powered
- * deeper analysis (feeding baselines into DriftBench training).
+ * Strategy: Compare changed functions against the Git main merge base.
+ * Repeated scans of the same change must report the same review signals.
+ * Non-Git projects retain the legacy local baseline behavior.
  */
 import { Gate, GateContext } from './base.js';
 import { Failure, Provenance } from '../types/index.js';

package/dist/gates/logic-drift.js

@@ -12,15 +12,16 @@
  * - Tests might still pass (if they don't cover edge cases)
  * - The change looks intentional ("AI refactored the function")
  *
- * Strategy: Collect baselines for critical functions, then detect
- * mutations between scans. This foundation enables future LLM-powered
- * deeper analysis (feeding baselines into DriftBench training).
+ * Strategy: Compare changed functions against the Git main merge base.
+ * Repeated scans of the same change must report the same review signals.
+ * Non-Git projects retain the legacy local baseline behavior.
  */
 import { Gate } from './base.js';
 import { FileScanner } from '../utils/scanner.js';
 import { Logger } from '../utils/logger.js';
 import { languageAdapters } from './language-adapters/index.js';
 import { extractCallSequence, isDangerousMutation } from './logic-drift-extractors.js';
+import { isGitWorktree, resolveGitLogicBase } from './logic-drift-git-base.js';
 import fs from 'fs-extra';
 import path from 'path';
 import crypto from 'crypto';
@@ -50,16 +51,35 @@ export class LogicDriftGate extends Gate {
         });
         if (files.length === 0)
             return [];
+        // In Git worktrees, compare only files changed from an immutable base.
+        const gitBase = resolveGitLogicBase(context.cwd);
+        if (!gitBase && isGitWorktree(context.cwd)) {
+            Logger.info('Logic Drift: no main reference available; comparison unavailable');
+            return [];
+        }
+        const scanFiles = gitBase ? files.filter(file => gitBase.changedFiles.has(file)) : files;
+        if (gitBase && scanFiles.length === 0)
+            return [];
         // Extract current function baselines
         const currentFunctions = [];
-        const contents = await FileScanner.readFiles(context.cwd, files, context.fileCache);
+        const contents = await FileScanner.readFiles(context.cwd, scanFiles, context.fileCache);
         for (const [file, content] of contents) {
             const extracted = this.extractFunctionBaselines(content, file);
             currentFunctions.push(...extracted);
         }
-        // Load previous baseline
+        // Git is authoritative when present; old local snapshots are fallback
+        // only for projects without an available Git main reference.
         let previousBaseline = null;
-        if (await fs.pathExists(baselinePath)) {
+        if (gitBase) {
+            const functions = [];
+            for (const file of scanFiles) {
+                const content = gitBase.readAtBase(file);
+                if (content !== null)
+                    functions.push(...this.extractFunctionBaselines(content, file));
+            }
+            previousBaseline = { functions, createdAt: '', lastUpdated: '', scanCount: 0 };
+        }
+        else if (await fs.pathExists(baselinePath)) {
             try {
                 const raw = await fs.readJson(baselinePath);
                 // Validate baseline has required structure
@@ -131,7 +151,8 @@ export class LogicDriftGate extends Gate {
             lastUpdated: new Date().toISOString(),
             scanCount: previousBaseline.scanCount + 1,
         };
-        await fs.writeJson(baselinePath, updatedBaseline, { spaces: 2 });
+        if (!gitBase)
+            await fs.writeJson(baselinePath, updatedBaseline, { spaces: 2 });
         if (failures.length > 0) {
             Logger.info(`Logic Drift: Found ${failures.length} logic mutations`);
         }
@@ -146,7 +167,12 @@ export class LogicDriftGate extends Gate {
         }
         const skipKeywords = new Set(['if', 'for', 'while', 'switch', 'catch', 'constructor', 'else', 'elif', 'elsif', 'rescue']);
         const functions = adapter.extractFunctions(content, file);
+        const seen = new Set();
         for (const fn of functions) {
+            const identity = `${fn.name}:${fn.startLine}`;
+            if (seen.has(identity))
+                continue;
+            seen.add(identity);
             // Skip control flow keywords
             if (skipKeywords.has(fn.name))
                 continue;

package/dist/gates/logic-drift.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/logic-drift.test.js

@@ -0,0 +1,45 @@
+import { execFileSync } from 'node:child_process';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { LogicDriftGate } from './logic-drift.js';
+describe('LogicDriftGate Git baseline', () => {
+    let cwd;
+    const git = (...args) => execFileSync('git', args, { cwd, stdio: 'pipe' });
+    beforeEach(() => {
+        cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'logic-drift-'));
+        git('init', '-q', '-b', 'main');
+        git('config', 'user.name', 'Rigour Test');
+        git('config', 'user.email', 'test@example.invalid');
+        fs.mkdirSync(path.join(cwd, 'src'));
+        fs.writeFileSync(path.join(cwd, 'src/rules.ts'), 'export function eligible(score: number) { return score >= 10; }\n');
+        git('add', '.');
+        git('commit', '-qm', 'base');
+    });
+    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+    it('reports a branch mutation consistently and clears it after merge', async () => {
+        const gate = new LogicDriftGate();
+        expect(await gate.run({ cwd })).toEqual([]);
+        git('switch', '-q', '-c', 'feature');
+        fs.writeFileSync(path.join(cwd, 'src/rules.ts'), 'export function eligible(score: number) { return score > 10; }\n');
+        const first = await gate.run({ cwd });
+        const second = await gate.run({ cwd });
+        expect(first).toEqual(second);
+        expect(first).toHaveLength(1);
+        expect(first.some(finding => finding.details.includes("'>=' to '>'"))).toBe(true);
+        expect(fs.existsSync(path.join(cwd, '.rigour/logic-baseline.json'))).toBe(false);
+        git('add', '.');
+        git('commit', '-qm', 'change boundary');
+        git('switch', '-q', 'main');
+        git('merge', '-q', '--ff-only', 'feature');
+        expect(await gate.run({ cwd })).toEqual([]);
+    }, 30_000);
+    it('does not use a moving local snapshot when Git has no main reference', async () => {
+        git('switch', '-q', '-c', 'feature');
+        git('branch', '-D', 'main');
+        const gate = new LogicDriftGate();
+        expect(await gate.run({ cwd })).toEqual([]);
+        expect(fs.existsSync(path.join(cwd, '.rigour/logic-baseline.json'))).toBe(false);
+    });
+});

package/dist/gates/security-command-execution.d.ts

@@ -0,0 +1,5 @@
+export interface UnsafeShellCall {
+    line: number;
+    text: string;
+}
+export declare function findUnsafeShellCalls(content: string, file: string): UnsafeShellCall[];

package/dist/gates/security-command-execution.js

@@ -0,0 +1,123 @@
+import ts from 'typescript';
+const SHELL_MODULES = new Set(['child_process', 'node:child_process']);
+const EXEC_METHODS = new Set(['exec', 'execSync']);
+const SPAWN_METHODS = new Set(['spawn', 'spawnSync']);
+const USER_INPUT = /\b(?:req|request|query|params|body|input|user|argv)\b|process\.env/;
+function shellModule(node) {
+    return ts.isStringLiteral(node) && SHELL_MODULES.has(node.text);
+}
+function isShellRequire(node) {
+    return ts.isCallExpression(node)
+        && ts.isIdentifier(node.expression)
+        && node.expression.text === 'require'
+        && node.arguments.length === 1
+        && shellModule(node.arguments[0]);
+}
+function collectBindings(source) {
+    const bindings = { functions: new Map(), namespaces: new Set() };
+    for (const statement of source.statements) {
+        if (ts.isImportDeclaration(statement) && shellModule(statement.moduleSpecifier)) {
+            const clause = statement.importClause;
+            if (clause?.name)
+                bindings.namespaces.add(clause.name.text);
+            const named = clause?.namedBindings;
+            if (named && ts.isNamespaceImport(named))
+                bindings.namespaces.add(named.name.text);
+            if (named && ts.isNamedImports(named)) {
+                for (const element of named.elements) {
+                    const exported = element.propertyName?.text ?? element.name.text;
+                    if (EXEC_METHODS.has(exported) || SPAWN_METHODS.has(exported)) {
+                        bindings.functions.set(element.name.text, exported);
+                    }
+                }
+            }
+        }
+        if (!ts.isVariableStatement(statement))
+            continue;
+        for (const declaration of statement.declarationList.declarations) {
+            const initializer = declaration.initializer;
+            if (!initializer)
+                continue;
+            if (isShellRequire(initializer)) {
+                if (ts.isIdentifier(declaration.name))
+                    bindings.namespaces.add(declaration.name.text);
+                if (ts.isObjectBindingPattern(declaration.name)) {
+                    for (const element of declaration.name.elements) {
+                        const exported = element.propertyName?.getText(source) ?? element.name.getText(source);
+                        if ((EXEC_METHODS.has(exported) || SPAWN_METHODS.has(exported)) && ts.isIdentifier(element.name)) {
+                            bindings.functions.set(element.name.text, exported);
+                        }
+                    }
+                }
+            }
+            else if (ts.isPropertyAccessExpression(initializer) && isShellRequire(initializer.expression)
+                && ts.isIdentifier(declaration.name)) {
+                bindings.functions.set(declaration.name.text, initializer.name.text);
+            }
+        }
+    }
+    return bindings;
+}
+function shadowsImportedName(node, name) {
+    for (let scope = node.parent; scope && !ts.isSourceFile(scope); scope = scope.parent) {
+        if (ts.isFunctionLike(scope) && scope.parameters.some(param => ts.isIdentifier(param.name) && param.name.text === name)) {
+            return true;
+        }
+        if (!ts.isBlock(scope))
+            continue;
+        for (const statement of scope.statements) {
+            if (ts.isFunctionDeclaration(statement) && statement.name?.text === name)
+                return true;
+            if (!ts.isVariableStatement(statement))
+                continue;
+            if (statement.declarationList.declarations.some(decl => ts.isIdentifier(decl.name) && decl.name.text === name)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+function shellMethod(call, bindings) {
+    const expression = call.expression;
+    if (ts.isIdentifier(expression)) {
+        return shadowsImportedName(call, expression.text) ? undefined : bindings.functions.get(expression.text);
+    }
+    if (ts.isPropertyAccessExpression(expression)) {
+        const receiver = expression.expression;
+        if (isShellRequire(receiver))
+            return expression.name.text;
+        if (ts.isIdentifier(receiver) && bindings.namespaces.has(receiver.text)
+            && !shadowsImportedName(call, receiver.text))
+            return expression.name.text;
+    }
+    return undefined;
+}
+function shellEnabled(call) {
+    return call.arguments.some(arg => ts.isObjectLiteralExpression(arg)
+        && arg.properties.some(prop => ts.isPropertyAssignment(prop)
+            && (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name))
+            && prop.name.text === 'shell'
+            && prop.initializer.kind === ts.SyntaxKind.TrueKeyword));
+}
+function taintedArgument(call, source) {
+    return call.arguments.some(arg => USER_INPUT.test(arg.getText(source)));
+}
+export function findUnsafeShellCalls(content, file) {
+    const kind = file.endsWith('.ts') ? ts.ScriptKind.TS : ts.ScriptKind.JS;
+    const source = ts.createSourceFile(file, content, ts.ScriptTarget.Latest, true, kind);
+    const bindings = collectBindings(source);
+    const calls = [];
+    const visit = (node) => {
+        if (ts.isCallExpression(node)) {
+            const method = shellMethod(node, bindings);
+            const executesShell = method && (EXEC_METHODS.has(method) || (SPAWN_METHODS.has(method) && shellEnabled(node)));
+            if (executesShell && taintedArgument(node, source)) {
+                calls.push({ line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+                    text: node.getText(source).slice(0, 120) });
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return calls;
+}

package/dist/gates/security-patterns-data.js

@@ -98,23 +98,7 @@ export const VULNERABILITY_PATTERNS = [
         cwe: 'CWE-338',
         languages: ['ts', 'js', 'tsx', 'jsx']
     },
-    // Command Injection
-    {
-        type: 'command_injection',
-        regex: /(?:exec|execSync|spawn|spawnSync)\s*\(\s*(?:`[^`]*\$\{[^}]*(?:req\.|query|params|body|input|user|argv|process\.env)[^}]*\}[^`]*`|[^)]*(?:req\.|query|params|body|input|user|argv|process\.env)[^)]*)\)/g,
-        severity: 'critical',
-        description: 'Potential command injection: shell execution with user input',
-        cwe: 'CWE-78',
-        languages: ['ts', 'js']
-    },
-    {
-        type: 'command_injection',
-        regex: /child_process.*\s*\.\s*(?:exec|spawn)\s*\([^)]*(?:req\.|query|params|body|input|user|argv|process\.env)/g,
-        severity: 'high',
-        description: 'child_process usage detected (verify input sanitization)',
-        cwe: 'CWE-78',
-        languages: ['ts', 'js']
-    },
+    // JavaScript shell calls are checked with receiver-aware syntax analysis.
     // Python subprocess command injection
     {
         type: 'command_injection',

package/dist/gates/security-patterns.d.ts

@@ -61,11 +61,6 @@ export declare class SecurityPatternsGate extends Gate {
      * Known sanitizers: DOMPurify.sanitize(), sanitize(), xss(), escapeHtml(), htmlEncode().
      */
     private isSanitizedAssignment;
-    /**
-     * Check if a shell execution call is using { shell: false } option (safe pattern).
-     * Also, spawn() without { shell: true } is safe by default — don't flag it.
-     */
-    private isSafeShellCall;
 }
 /**
  * Quick helper to check a single file for security issues

package/dist/gates/security-patterns.js

@@ -16,6 +16,7 @@ import { Gate } from './base.js';
 import { FileScanner } from '../utils/scanner.js';
 import { Logger } from '../utils/logger.js';
 import { VULNERABILITY_PATTERNS } from './security-patterns-data.js';
+import { findUnsafeShellCalls } from './security-command-execution.js';
 import fs from 'fs-extra';
 import path from 'path';
 export class SecurityPatternsGate extends Gate {
@@ -127,7 +128,16 @@ export class SecurityPatternsGate extends Gate {
         return false;
     }
     scanFileForVulnerabilities(content, file, ext, vulnerabilities) {
-        const lines = content.split('\n');
+        if (ext === 'ts' || ext === 'js') {
+            for (const call of findUnsafeShellCalls(content, file)) {
+                vulnerabilities.push({
+                    type: 'command_injection', severity: 'critical', file,
+                    line: call.line, match: call.text,
+                    description: 'Potential command injection: shell execution with user input',
+                    cwe: 'CWE-78',
+                });
+            }
+        }
         for (const pattern of VULNERABILITY_PATTERNS) {
             // Check if pattern applies to this file type
             if (!pattern.languages.includes('*') && !pattern.languages.includes(ext)) {
@@ -145,10 +155,6 @@ export class SecurityPatternsGate extends Gate {
                 if (pattern.type === 'xss' && this.isSanitizedAssignment(match[0])) {
                     continue;
                 }
-                // For command_injection: check if spawn/exec uses { shell: false } (safe)
-                if (pattern.type === 'command_injection' && this.isSafeShellCall(match[0], content, match.index)) {
-                    continue;
-                }
                 // Find line number
                 const beforeMatch = content.slice(0, match.index);
                 const lineNumber = beforeMatch.split('\n').length;
@@ -244,20 +250,6 @@ export class SecurityPatternsGate extends Gate {
         const rhs = matchText.includes('=') ? matchText.split('=').slice(1).join('=') : matchText;
         return sanitizers.some(s => rhs.toLowerCase().includes(s.toLowerCase()));
     }
-    /**
-     * Check if a shell execution call is using { shell: false } option (safe pattern).
-     * Also, spawn() without { shell: true } is safe by default — don't flag it.
-     */
-    isSafeShellCall(matchText, fullContent, matchIndex) {
-        // Check surrounding context (100 chars after match) for shell: false
-        const context = fullContent.slice(matchIndex, matchIndex + matchText.length + 100);
-        if (/shell\s*:\s*false/.test(context))
-            return true;
-        // spawn() without shell: true is safe by default
-        if (/\bspawn(?:Sync)?\s*\(/.test(matchText) && !/shell\s*:\s*true/.test(context))
-            return true;
-        return false;
-    }
 }
 /**
  * Quick helper to check a single file for security issues

package/dist/gates/security-patterns.test.js

@@ -105,14 +105,49 @@ describe('SecurityPatternsGate', () => {
         });
     });
     describe('command injection detection', () => {
-        it('should detect exec with user input', async () => {
+        it('detects imported shell execution with user input', async () => {
             const filePath = path.join(testDir, 'shell.ts');
             fs.writeFileSync(filePath, `
-                exec(\`ls \${req.query.path}\`);
+                import { exec as runShell } from 'node:child_process';
+                runShell(\`ls \${req.query.path}\`);
             `);
             const vulns = await checkSecurityPatterns(filePath);
             expect(vulns.some(v => v.type === 'command_injection')).toBe(true);
         });
+        it('does not treat RegExp.exec or unrelated methods as shell execution', async () => {
+            const filePath = path.join(testDir, 'template.ts');
+            fs.writeFileSync(filePath, `
+                const separator = HB_ELSE.exec(body);
+                const other = LIQUID_BRANCH.exec(user);
+                const local = { exec(value: string) { return value; } };
+                local.exec(request.body);
+            `);
+            const vulns = await checkSecurityPatterns(filePath);
+            expect(vulns.filter(v => v.type === 'command_injection')).toEqual([]);
+        });
+        it('detects namespace, require, and shell-enabled spawn calls', async () => {
+            const filePath = path.join(testDir, 'shell.js');
+            fs.writeFileSync(filePath, `
+                const cp = require('child_process');
+                const { exec: runShell } = require('node:child_process');
+                cp.exec(req.body.command);
+                runShell(user.command);
+                cp.spawn(process.env.SHELL, [input], { shell: true });
+                cp.spawn(process.env.SHELL, [input]);
+            `);
+            const vulns = await checkSecurityPatterns(filePath);
+            expect(vulns.filter(v => v.type === 'command_injection')).toHaveLength(3);
+        });
+        it('does not use an imported shell binding shadowed by a parameter', async () => {
+            const filePath = path.join(testDir, 'shadow.ts');
+            fs.writeFileSync(filePath, `
+                import { exec } from 'child_process';
+                function parse(exec: RegExp) { return exec.exec(body); }
+                function run(exec: (value: string) => void) { exec(user); }
+            `);
+            const vulns = await checkSecurityPatterns(filePath);
+            expect(vulns.filter(v => v.type === 'command_injection')).toEqual([]);
+        });
     });
     describe('severity filtering', () => {
         it('should block on high severity by default', async () => {

package/dist/gates/style-drift.d.ts

@@ -6,10 +6,8 @@
  * style which may differ from the project norm.
  *
  * What it checks:
- * 1. Naming conventions — camelCase vs snake_case vs PascalCase consistency
+ * 1. Naming conventions — compare names with the same language conventions
  * 2. Error handling patterns — try-catch vs .catch()/except/rescue consistency
- * 3. Import style — named vs default vs wildcard import consistency
- * 4. Quote style — single vs double quote consistency
  *
  * How it works:
  * 1. First scan: sample source files → compute per-language style fingerprints → store baseline
@@ -17,7 +15,9 @@
  * 3. If a file deviates >25% on any dimension → flag as style drift
  *
  * Baselines are per-language to avoid cross-language contamination
- * (e.g., Python snake_case shouldn't flag JS camelCase).
+ * (e.g., Python snake_case should not flag JS camelCase).
+ * JS names mandated by frameworks are excluded from style comparison, and
+ * imports are never compared by a language-wide named/default ratio.
  */
 import { Gate, GateContext } from './base.js';
 import { Failure, Provenance } from '../types/index.js';

package/dist/gates/style-drift.js

@@ -6,10 +6,8 @@
  * style which may differ from the project norm.
  *
  * What it checks:
- * 1. Naming conventions — camelCase vs snake_case vs PascalCase consistency
+ * 1. Naming conventions — compare names with the same language conventions
  * 2. Error handling patterns — try-catch vs .catch()/except/rescue consistency
- * 3. Import style — named vs default vs wildcard import consistency
- * 4. Quote style — single vs double quote consistency
  *
  * How it works:
  * 1. First scan: sample source files → compute per-language style fingerprints → store baseline
@@ -17,12 +15,15 @@
  * 3. If a file deviates >25% on any dimension → flag as style drift
  *
  * Baselines are per-language to avoid cross-language contamination
- * (e.g., Python snake_case shouldn't flag JS camelCase).
+ * (e.g., Python snake_case should not flag JS camelCase).
+ * JS names mandated by frameworks are excluded from style comparison, and
+ * imports are never compared by a language-wide named/default ratio.
  */
 import { Gate } from './base.js';
 import { FileScanner } from '../utils/scanner.js';
 import { Logger } from '../utils/logger.js';
 import { languageAdapters } from './language-adapters/index.js';
+import { extractComparableJsNames } from './js-style-context.js';
 import { TRY_CATCH_PATTERN, CATCH_PATTERN, RESULT_TYPE_PATTERN, NAMED_IMPORT_PATTERN, WILDCARD_IMPORT_PATTERN, SIDE_EFFECT_IMPORT_PATTERN, DEFAULT_IMPORT_PATTERN, countQuotes, } from './style-drift-rules.js';
 import fs from 'fs-extra';
 import path from 'path';
@@ -67,7 +68,7 @@ export class StyleDriftGate extends Gate {
             try {
                 const raw = await fs.readJson(baselinePath);
                 // Handle migration from old single-fingerprint format
-                if (raw.version === 2) {
+                if (raw.version === 3) {
                     baseline = raw;
                 }
                 else {
@@ -116,7 +117,7 @@ export class StyleDriftGate extends Gate {
         const baseline = {
             languages: {},
             createdAt: new Date().toISOString(),
-            version: 2,
+            version: 3,
         };
         for (const [langId, langFiles] of filesByLang) {
             // Sample up to sample_size files per language
@@ -157,7 +158,9 @@ export class StyleDriftGate extends Gate {
         const adapter = languageAdapters.getAdapter(filePath);
         // ── Naming conventions (via adapter) ──
         if (adapter) {
-            const namingPatterns = adapter.extractNamingPatterns(content);
+            const namingPatterns = adapter.id === 'js'
+                ? extractComparableJsNames(content, filePath)
+                : adapter.extractNamingPatterns(content);
             for (const pattern of namingPatterns) {
                 if (pattern.kind === 'function' || pattern.kind === 'method') {
                     fp.naming.functions[pattern.convention]++;
@@ -244,15 +247,8 @@ export class StyleDriftGate extends Gate {
                 suggestion: `Use ${errDev.baselinePredominant} error handling pattern to match project conventions.`,
             });
         }
-        const impDev = this.distributionDeviation(file.importStyle, baseline.importStyle);
-        if (impDev.score > 0 && this.hasSignificantData(file.importStyle)) {
-            deviations.push({
-                dimension: 'import style',
-                score: impDev.score,
-                detail: `file uses ${impDev.filePredominant}, project uses ${impDev.baselinePredominant}`,
-                suggestion: `Use ${impDev.baselinePredominant} imports to match project conventions.`,
-            });
-        }
+        // Import form depends on the imported module's exports. A language-wide
+        // named/default ratio cannot establish a valid replacement.
         return deviations;
     }
     distributionDeviation(file, baseline) {

package/dist/gates/style-drift.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/style-drift.test.js

@@ -0,0 +1,26 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { StyleDriftGate } from './style-drift.js';
+describe('StyleDriftGate', () => {
+    let cwd;
+    beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'style-drift-')); });
+    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+    it('does not compare default imports against unrelated named imports', async () => {
+        const src = path.join(cwd, 'src');
+        fs.mkdirSync(src);
+        for (let i = 0; i < 5; i++) {
+            fs.writeFileSync(path.join(src, `named${i}.ts`), `import { value } from './shared';\nexport function helper${i}() { return value; }\n`);
+        }
+        fs.writeFileSync(path.join(src, 'mui.ts'), [
+            "import Box from '@mui/material/Box';",
+            "import TextField from '@mui/material/TextField';",
+            "import Button from '@mui/material/Button';",
+        ].join('\n'));
+        const gate = new StyleDriftGate();
+        expect(await gate.run({ cwd })).toEqual([]);
+        const findings = await gate.run({ cwd });
+        expect(findings.some(finding => finding.details.includes('import style'))).toBe(false);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.2.3",
+  "version": "6.2.4",
   "description": "AI-native quality gate engine with local Bayesian learning. AST analysis, drift detection, Fix Packet generation, and agent self-healing across TypeScript, JavaScript, Python, Go, Ruby, and C#.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -67,11 +67,11 @@
     "pg": "^8.16.3",
     "sqlite3": "^5.1.7",
     "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-x64": "6.2.3",
-    "@rigour-labs/brain-darwin-arm64": "6.2.3",
-    "@rigour-labs/brain-linux-arm64": "6.2.3",
-    "@rigour-labs/brain-win-x64": "6.2.3",
-    "@rigour-labs/brain-linux-x64": "6.2.3"
+    "@rigour-labs/brain-darwin-arm64": "6.2.4",
+    "@rigour-labs/brain-darwin-x64": "6.2.4",
+    "@rigour-labs/brain-linux-x64": "6.2.4",
+    "@rigour-labs/brain-win-x64": "6.2.4",
+    "@rigour-labs/brain-linux-arm64": "6.2.4"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",