@rigour-labs/core 6.2.3 → 6.2.5

package/dist/deep/code-context.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Source context for code-aware review of scoped files.
+ *
+ * The facts-only prompt gives the model signatures and counts; defects such
+ * as an unbounded read, a missing fetch option or a wrong response header
+ * live in function bodies. For a scoped run each file is sent with its
+ * numbered source. Files over the budget are cut into function/class
+ * segments (the ones around changed lines first when a diff is known), and
+ * every segment that does not fit is listed as omitted rather than dropped.
+ */
+import type { FileFacts } from './fact-extractor.js';
+export type LineRange = [start: number, end: number];
+export interface CodeContext {
+    file: string;
+    language: string;
+    /** Prompt block: header plus numbered source. */
+    text: string;
+    /** 1-based inclusive line ranges whose source was sent. */
+    ranges: LineRange[];
+    /** Raw source that was sent, for identifier verification. */
+    source: string;
+}
+export interface CodeContextOptions {
+    maxChars: number;
+    /** Changed line numbers (from a diff); their enclosing segments go first. */
+    focusLines?: number[];
+}
+export declare function buildCodeContext(facts: FileFacts, content: string, options: CodeContextOptions): CodeContext;

package/dist/deep/code-context.js

@@ -0,0 +1,93 @@
+export function buildCodeContext(facts, content, options) {
+    const lines = content.split('\n');
+    const header = `FILE: ${facts.path} (${facts.language}, ${lines.length} lines)`;
+    const whole = [1, lines.length];
+    const wholeText = renderRange(lines, whole);
+    if (header.length + wholeText.length <= options.maxChars) {
+        return { file: facts.path, language: facts.language, text: `${header}\n${wholeText}`, ranges: [whole], source: content };
+    }
+    const segments = orderSegments(segmentsFor(facts, lines.length), options.focusLines);
+    const parts = [header];
+    const ranges = [];
+    const omitted = [];
+    let used = header.length;
+    for (const segment of segments) {
+        const text = renderRange(lines, segment.range);
+        const remaining = options.maxChars - used;
+        if (text.length <= remaining) {
+            parts.push(text);
+            ranges.push(segment.range);
+            used += text.length + 1;
+        }
+        else if (ranges.length === 0 && remaining > 200) {
+            const truncated = truncateRange(lines, segment.range, remaining);
+            parts.push(truncated.text);
+            ranges.push(truncated.range);
+            used += truncated.text.length + 1;
+        }
+        else {
+            omitted.push(`${segment.label} (lines ${segment.range[0]}-${segment.range[1]})`);
+        }
+    }
+    if (omitted.length > 0)
+        parts.push(`… omitted for size: ${omitted.join(', ')}`);
+    return {
+        file: facts.path,
+        language: facts.language,
+        text: parts.join('\n'),
+        ranges,
+        source: ranges.map(([s, e]) => lines.slice(s - 1, e).join('\n')).join('\n'),
+    };
+}
+function segmentsFor(facts, lineCount) {
+    const segments = [
+        ...facts.classes.map(c => ({ label: `class ${c.name}`, range: [c.lineStart, c.lineEnd] })),
+        ...facts.functions.map(f => ({ label: `function ${f.name}`, range: [f.lineStart, f.lineEnd] })),
+    ]
+        .map(s => ({ ...s, range: clampRange(s.range, lineCount) }))
+        .sort((a, b) => a.range[0] - b.range[0]);
+    // Drop segments nested inside an earlier one (methods inside a class).
+    const outer = [];
+    for (const segment of segments) {
+        const last = outer[outer.length - 1];
+        if (last && segment.range[1] <= last.range[1])
+            continue;
+        outer.push(segment);
+    }
+    return outer.length > 0 ? outer : [{ label: 'file', range: [1, lineCount] }];
+}
+function orderSegments(segments, focusLines) {
+    if (!focusLines || focusLines.length === 0)
+        return segments;
+    const touches = (s) => focusLines.some(l => l >= s.range[0] && l <= s.range[1]);
+    return [...segments.filter(touches), ...segments.filter(s => !touches(s))];
+}
+function clampRange([start, end], lineCount) {
+    const s = Math.max(1, Math.min(start, lineCount));
+    return [s, Math.max(s, Math.min(end, lineCount))];
+}
+function renderRange(lines, [start, end]) {
+    const width = String(end).length;
+    return lines
+        .slice(start - 1, end)
+        .map((line, i) => `${String(start + i).padStart(width)}| ${line}`)
+        .join('\n');
+}
+function truncateRange(lines, [start, end], maxChars) {
+    const width = String(end).length;
+    const budget = maxChars - 40;
+    const kept = [];
+    let used = 0;
+    let last = start - 1;
+    while (last < end) {
+        const rendered = `${String(last + 1).padStart(width)}| ${lines[last]}`;
+        if (kept.length > 0 && used + rendered.length + 1 > budget)
+            break;
+        kept.push(rendered);
+        used += rendered.length + 1;
+        last++;
+    }
+    const omitted = end - last;
+    const text = kept.join('\n') + (omitted > 0 ? `\n… [${omitted} lines omitted]` : '');
+    return { text, range: [start, last] };
+}

package/dist/deep/code-context.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deep/code-context.test.js

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest';
+import { buildCodeContext } from './code-context.js';
+function fn(name, lineStart, lineEnd) {
+    return {
+        name, lineStart, lineEnd, lineCount: lineEnd - lineStart + 1, paramCount: 0, params: [],
+        maxNesting: 1, hasReturn: true, isAsync: false, isExported: true,
+    };
+}
+function facts(path, functions) {
+    return {
+        path, language: 'typescript', lineCount: 0, classes: [], functions, imports: [], exports: [],
+        errorHandling: [], testAssertions: 0, hasTests: false,
+    };
+}
+const source = (n) => Array.from({ length: n }, (_, i) => `const line${i + 1} = ${i + 1};`).join('\n');
+describe('buildCodeContext', () => {
+    it('sends a small file whole, with line numbers', () => {
+        const ctx = buildCodeContext(facts('src/a.ts', []), 'const a = 1;\nexport { a };', { maxChars: 10_000 });
+        expect(ctx.text).toBe('FILE: src/a.ts (typescript, 2 lines)\n1| const a = 1;\n2| export { a };');
+        expect(ctx.ranges).toEqual([[1, 2]]);
+        expect(ctx.source).toContain('export { a }');
+    });
+    it('cuts a large file into function segments and names what it omitted', () => {
+        const content = source(300);
+        const ctx = buildCodeContext(facts('src/big.ts', [fn('first', 1, 100), fn('second', 101, 200), fn('third', 201, 300)]), content, { maxChars: 4_000 });
+        expect(ctx.ranges[0]).toEqual([1, 100]);
+        expect(ctx.text).toMatch(/omitted for size: .*function second \(lines 101-200\)/);
+        expect(ctx.text).toContain('function third (lines 201-300)');
+        expect(ctx.source).not.toContain('line150 ');
+    });
+    it('puts the segment around changed lines first', () => {
+        const content = source(300);
+        const ctx = buildCodeContext(facts('src/big.ts', [fn('first', 1, 100), fn('second', 101, 200), fn('third', 201, 300)]), content, {
+            maxChars: 4_000, focusLines: [250],
+        });
+        expect(ctx.ranges[0]).toEqual([201, 300]);
+        expect(ctx.text).toContain('function first (lines 1-100)');
+    });
+    it('truncates a single oversized function explicitly instead of dropping it', () => {
+        const content = source(2_000);
+        const ctx = buildCodeContext(facts('src/huge.ts', [fn('huge', 1, 2_000)]), content, { maxChars: 2_000 });
+        expect(ctx.ranges).toHaveLength(1);
+        expect(ctx.ranges[0][0]).toBe(1);
+        expect(ctx.ranges[0][1]).toBeLessThan(2_000);
+        expect(ctx.text).toMatch(/… \[\d+ lines omitted\]$/);
+        expect(ctx.text.length).toBeLessThanOrEqual(2_000);
+    });
+});

package/dist/deep/code-pass.d.ts

@@ -0,0 +1,15 @@
+import type { InferenceProvider } from '../inference/types.js';
+import type { FileFacts } from './fact-extractor.js';
+import { type CodeContext } from './code-context.js';
+import type { PassConfig, PassResult } from './facts-pass.js';
+export interface CodePassConfig extends PassConfig {
+    cwd: string;
+    /** Character budget for one file's source in the prompt. */
+    maxSourceChars: number;
+    /** Changed lines per file (cwd-relative path → line numbers). */
+    focusLines?: Record<string, number[]>;
+}
+export interface CodePassResult extends PassResult {
+    contexts: CodeContext[];
+}
+export declare function runCodePass(provider: InferenceProvider, facts: FileFacts[], config: CodePassConfig): Promise<CodePassResult>;

package/dist/deep/code-pass.js

@@ -0,0 +1,44 @@
+/**
+ * Code pass: per-file review of scoped files with their numbered source.
+ * Used for `rigour check <paths> --deep` and `rigour review --deep`.
+ */
+import path from 'path';
+import fs from 'fs-extra';
+import { buildCodeContext } from './code-context.js';
+import { buildCodeReviewPrompt } from './code-review-prompt.js';
+import { parseFindings } from './parse-findings.js';
+import { Logger } from '../utils/logger.js';
+export async function runCodePass(provider, facts, config) {
+    const result = { findings: [], chunksTotal: facts.length, chunksFailed: 0, contexts: [] };
+    for (let i = 0; i < facts.length; i++) {
+        const file = facts[i];
+        config.onProgress?.(`  Reviewing ${file.path} (${i + 1}/${facts.length})...`);
+        let context;
+        try {
+            const content = await fs.readFile(path.join(config.cwd, file.path), 'utf-8');
+            context = buildCodeContext(file, content, {
+                maxChars: config.maxSourceChars,
+                focusLines: config.focusLines?.[file.path],
+            });
+        }
+        catch (error) {
+            recordFailure(result, `${file.path}: ${error.message}`, config);
+            continue;
+        }
+        result.contexts.push(context);
+        try {
+            const response = await provider.analyze(buildCodeReviewPrompt(context), config.inference);
+            result.findings.push(...parseFindings(response));
+        }
+        catch (error) {
+            recordFailure(result, `${file.path}: ${error.message}`, config);
+        }
+    }
+    return result;
+}
+function recordFailure(result, message, config) {
+    result.chunksFailed++;
+    result.firstError ??= message;
+    Logger.warn(`Code review failed for ${message}`);
+    config.onProgress?.(`  ⚠ ${message}`);
+}

package/dist/deep/code-review-prompt.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Prompt for code-aware review of scoped files.
+ *
+ * Unlike the facts prompt, the model sees numbered source and is asked for
+ * defects it can point to at a line. Categories are a general review
+ * taxonomy; they must not be tuned to any specific benchmark bug.
+ */
+import type { CodeContext } from './code-context.js';
+/**
+ * Review categories: `key` is the category the model reports, `focus` is
+ * the one-line instruction for what to look for.
+ */
+export declare const REVIEW_CATEGORIES: ReadonlyArray<{
+    key: string;
+    focus: string;
+}>;
+export declare function buildCodeReviewPrompt(context: CodeContext): string;

package/dist/deep/code-review-prompt.js

@@ -0,0 +1,30 @@
+/**
+ * Review categories: `key` is the category the model reports, `focus` is
+ * the one-line instruction for what to look for.
+ */
+export const REVIEW_CATEGORIES = [
+    { key: 'correctness', focus: 'logic that returns or does the wrong thing: wrong conditions, off-by-one, wrong variable, unhandled case' },
+    { key: 'scalability', focus: 'work, memory or request count that grows with data size without a bound' },
+    { key: 'security', focus: 'untrusted input reaching sensitive operations, secrets exposed or sent where they should not go, missing authorization' },
+    { key: 'error_handling', focus: 'failures that are swallowed, crash more than they should, or leave state inconsistent' },
+    { key: 'state_and_caching', focus: 'stale, shared or cached state that can serve the wrong result' },
+    { key: 'api_misuse', focus: 'a library, framework or protocol used against its documented contract' },
+    { key: 'consistency', focus: 'code, messages or output that contradict what the data or other code actually does' },
+];
+const REVIEW_RULES = `RULES:
+1. Report only defects you can point to in the source shown, with its line number.
+2. A defect is behaviour that is wrong, unsafe or will fail in production. Do not report style, naming, formatting or missing comments.
+3. Put identifiers from the code in backticks in the description, spelled exactly as in the source.
+4. If you find nothing concrete, return {"findings": []}. An empty list is a good answer.
+5. confidence: 0.9+ only when the defect is certain from the code shown; 0.5-0.7 when it depends on how callers use it.
+6. Respond ONLY with JSON: {"findings":[{"category","severity","file","line","description","suggestion","confidence"}]}.`;
+export function buildCodeReviewPrompt(context) {
+    const categories = REVIEW_CATEGORIES.map(c => `- ${c.key}: ${c.focus}`).join('\n');
+    return [
+        'You are a senior engineer reviewing a change before it ships. Read the source and report real defects.',
+        `CATEGORIES:\n${categories}`,
+        REVIEW_RULES,
+        `SOURCE (line numbers on the left):\n${context.text}`,
+        `Review ${context.file}. Return findings as JSON.`,
+    ].join('\n\n');
+}

package/dist/deep/code-review-prompt.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deep/code-review-prompt.test.js

@@ -0,0 +1,20 @@
+import { describe, expect, it } from 'vitest';
+import { buildCodeReviewPrompt, REVIEW_CATEGORIES } from './code-review-prompt.js';
+const context = { file: 'src/a.ts', language: 'typescript', text: 'FILE: src/a.ts\n1| export const a = 1;', ranges: [[1, 1]], source: '' };
+describe('buildCodeReviewPrompt', () => {
+    it('includes every category, the rules and the numbered source', () => {
+        const prompt = buildCodeReviewPrompt(context);
+        for (const c of REVIEW_CATEGORIES)
+            expect(prompt).toContain(`- ${c.key}: ${c.focus}`);
+        expect(prompt).toContain('Report only defects you can point to');
+        expect(prompt).toContain('1| export const a = 1;');
+        expect(prompt).toContain('Review src/a.ts');
+    });
+    it('allows an empty answer so the model is not pushed to invent findings', () => {
+        expect(buildCodeReviewPrompt(context)).toContain('{"findings": []}');
+    });
+    it('uses unique category keys', () => {
+        const keys = REVIEW_CATEGORIES.map(c => c.key);
+        expect(new Set(keys).size).toBe(keys.length);
+    });
+});

package/dist/deep/code-verifier.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Verification for code-aware findings.
+ *
+ * A finding survives only if it is about code the model was actually shown:
+ * the file was sent, it cites a line inside a sent range, and every
+ * backticked identifier in the description appears in the sent source.
+ * This keeps the "AST grounds the LLM" guarantee when the prompt carries
+ * source instead of facts.
+ *
+ * A line is required. In a backtest of 120 local runs every line-less
+ * finding was generic ("does not handle null input") or not a defect at
+ * all ("the code is well-structured"), and nothing can be verified about it.
+ */
+import type { DeepFinding } from '../inference/types.js';
+import type { CodeContext } from './code-context.js';
+import type { VerifiedFinding } from './verifier.js';
+export declare function verifyCodeFindings(findings: DeepFinding[], contexts: CodeContext[]): VerifiedFinding[];
+/** Backticked, identifier-like tokens (skips quoted prose and code fragments). */
+export declare function quotedIdentifiers(text: string): string[];

package/dist/deep/code-verifier.js

@@ -0,0 +1,48 @@
+const MIN_CONFIDENCE = 0.3;
+export function verifyCodeFindings(findings, contexts) {
+    const verified = [];
+    for (const finding of findings) {
+        const context = findContext(finding.file, contexts);
+        if (!context)
+            continue;
+        const note = rejectionReason(finding, context);
+        if (note)
+            continue;
+        verified.push({ ...finding, file: context.file, verified: true, verificationNotes: 'grounded in sent source' });
+    }
+    return verified;
+}
+function rejectionReason(finding, context) {
+    if (finding.confidence < MIN_CONFIDENCE)
+        return 'low confidence';
+    const line = typeof finding.line === 'number' && finding.line > 0 ? finding.line : null;
+    if (line === null)
+        return 'no line';
+    if (!context.ranges.some(([s, e]) => line >= s && line <= e))
+        return 'line outside sent source';
+    const missing = quotedIdentifiers(finding.description).find(id => !context.source.includes(id));
+    if (missing)
+        return `identifier \`${missing}\` not in sent source`;
+    return null;
+}
+/** Backticked, identifier-like tokens (skips quoted prose and code fragments). */
+export function quotedIdentifiers(text) {
+    const ids = [];
+    for (const match of text.matchAll(/`([^`\n]+)`/g)) {
+        const token = match[1].trim();
+        if (/^[A-Za-z_$][\w$.]*(\(\))?$/.test(token))
+            ids.push(token.replace(/\(\)$/, ''));
+    }
+    return ids;
+}
+function findContext(file, contexts) {
+    const normalized = file.replace(/\\/g, '/').replace(/^\.\//, '');
+    const exact = contexts.find(c => c.file === normalized);
+    if (exact)
+        return exact;
+    const bySuffix = contexts.filter(c => c.file.endsWith('/' + normalized) || normalized.endsWith('/' + c.file));
+    if (bySuffix.length === 1)
+        return bySuffix[0];
+    // A single-file review may be reported by basename only.
+    return contexts.length === 1 && contexts[0].file.split('/').pop() === normalized.split('/').pop() ? contexts[0] : null;
+}

package/dist/deep/code-verifier.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deep/code-verifier.test.js

@@ -0,0 +1,46 @@
+import { describe, expect, it } from 'vitest';
+import { quotedIdentifiers, verifyCodeFindings } from './code-verifier.js';
+const context = {
+    file: 'src/api/report.ts',
+    language: 'typescript',
+    text: '',
+    ranges: [[10, 40]],
+    source: 'export async function loadReport(days) {\n  const rows = await fetchAll(days);\n}',
+};
+function finding(overrides) {
+    return {
+        category: 'scalability', severity: 'high', file: 'src/api/report.ts', line: 12,
+        description: '`fetchAll` loads every row for the window into memory.', suggestion: 'Aggregate in the database.',
+        confidence: 0.8, ...overrides,
+    };
+}
+describe('verifyCodeFindings', () => {
+    it('keeps a finding grounded in the sent source', () => {
+        const [kept] = verifyCodeFindings([finding({})], [context]);
+        expect(kept).toMatchObject({ file: 'src/api/report.ts', verified: true });
+    });
+    it('resolves a basename-only file for a single-file review', () => {
+        expect(verifyCodeFindings([finding({ file: 'report.ts' })], [context])).toHaveLength(1);
+    });
+    it('drops findings for files that were not sent', () => {
+        expect(verifyCodeFindings([finding({ file: 'src/other.ts' })], [context])).toHaveLength(0);
+    });
+    it('drops findings whose line is outside the sent ranges', () => {
+        expect(verifyCodeFindings([finding({ line: 80 })], [context])).toHaveLength(0);
+    });
+    it('drops findings that cite an identifier the model was never shown', () => {
+        expect(verifyCodeFindings([finding({ description: '`fetchEverything` has no limit.' })], [context])).toHaveLength(0);
+    });
+    it('drops findings that cite no line, however confident', () => {
+        expect(verifyCodeFindings([finding({ line: undefined, confidence: 0.9 })], [context])).toHaveLength(0);
+        expect(verifyCodeFindings([finding({ line: null, description: 'The code is well-structured.' })], [context])).toHaveLength(0);
+    });
+    it('drops very low confidence findings', () => {
+        expect(verifyCodeFindings([finding({ confidence: 0.2 })], [context])).toHaveLength(0);
+    });
+});
+describe('quotedIdentifiers', () => {
+    it('extracts identifier-like backticked tokens only', () => {
+        expect(quotedIdentifiers('`fetchAll()` and `rows.length` but not `a + b` or `"quoted"`')).toEqual(['fetchAll', 'rows.length']);
+    });
+});

package/dist/deep/fact-extractor.d.ts

@@ -72,7 +72,13 @@ export interface ErrorHandlingFact {
  * Works across languages without tree-sitter grammar loading.
  * Fast enough for the deep analysis pipeline.
  */
-export declare function extractFacts(cwd: string, ignore?: string[]): Promise<FileFacts[]>;
+export declare function extractFacts(cwd: string, ignore?: string[], scope?: string[]): Promise<FileFacts[]>;
+/**
+ * Test file by path convention, or by a test-runner call at the start of a
+ * line. A bare substring check misreads `exit(`, `submit(` or `regex.test(`
+ * as tests, and `latest/` as a test directory.
+ */
+export declare function isTestFile(filePath: string, content: string): boolean;
 /**
  * Serialize facts into a compact string for LLM prompts.
  * Keeps only the most relevant information within token budget.

package/dist/deep/fact-extractor.js

@@ -6,20 +6,22 @@
 import fs from 'fs-extra';
 import path from 'path';
 import { globby } from 'globby';
+const ANALYZABLE_EXTENSION = /\.(ts|js|tsx|jsx|py|go|rs|cs|java|rb|kt)$/i;
 /**
  * Lightweight regex-based fact extraction.
  * Works across languages without tree-sitter grammar loading.
  * Fast enough for the deep analysis pipeline.
  */
-export async function extractFacts(cwd, ignore) {
-    const patterns = ['**/*.{ts,js,tsx,jsx,py,go,rs,cs,java,rb,kt}'];
+export async function extractFacts(cwd, ignore, scope) {
+    const patterns = scope && scope.length > 0 ? scope : ['**/*.{ts,js,tsx,jsx,py,go,rs,cs,java,rb,kt}'];
     const ignorePatterns = [
         ...(ignore || []),
         '**/node_modules/**', '**/dist/**', '**/build/**',
         '**/.git/**', '**/vendor/**', '**/__pycache__/**',
         '**/*.min.js', '**/*.bundle.js',
     ];
-    const files = await globby(patterns, { cwd, ignore: ignorePatterns, followSymbolicLinks: false });
+    const matched = await globby(patterns, { cwd, ignore: ignorePatterns, followSymbolicLinks: false });
+    const files = matched.filter(f => ANALYZABLE_EXTENSION.test(f));
     const allFacts = [];
     for (const file of files) {
         try {
@@ -364,14 +366,20 @@ function countAssertions(content) {
     }
     return count;
 }
-function isTestFile(filePath, content) {
-    if (filePath.match(/\.(test|spec|_test)\./))
+/**
+ * Test file by path convention, or by a test-runner call at the start of a
+ * line. A bare substring check misreads `exit(`, `submit(` or `regex.test(`
+ * as tests, and `latest/` as a test directory.
+ */
+export function isTestFile(filePath, content) {
+    const posixPath = filePath.replace(/\\/g, '/');
+    if (/\.(test|spec)\.[^/]+$|_test\.(go|py)$|(^|\/)test_[^/]+\.py$/.test(posixPath))
         return true;
-    if (filePath.includes('__tests__') || filePath.includes('test/') || filePath.includes('tests/'))
+    if (/(^|\/)(__tests__|tests?)\//.test(posixPath))
         return true;
-    if (content.includes('describe(') || content.includes('it(') || content.includes('test('))
+    if (/^\s*(describe|it|test)(\.\w+)?\s*\(/m.test(content))
         return true;
-    if (content.includes('def test_') || content.includes('@pytest'))
+    if (/^\s*def test_\w+\s*\(/m.test(content) || content.includes('@pytest'))
         return true;
     return false;
 }

package/dist/deep/fact-extractor.test.js

@@ -11,7 +11,7 @@ vi.mock('fs-extra', () => ({
         readFile: mockReadFile,
     },
 }));
-import { extractFacts, factsToPromptString } from './fact-extractor.js';
+import { extractFacts, factsToPromptString, isTestFile } from './fact-extractor.js';
 describe('Fact Extractor', () => {
     beforeEach(() => {
         vi.clearAllMocks();
@@ -545,3 +545,36 @@ function bar() {
         });
     });
 });
+describe('extractFacts scope', () => {
+    beforeEach(() => { vi.clearAllMocks(); });
+    it('globs only the scoped patterns and skips non-code files they match', async () => {
+        mockGlobby.mockResolvedValue(['src/a.ts', 'src/README.md', 'src/data.json']);
+        mockReadFile.mockResolvedValue('export const a = 1;\nexport const b = 2;\nexport const c = 3;\n');
+        const facts = await extractFacts('/project', [], ['src/**/*']);
+        expect(mockGlobby.mock.calls[0][0]).toEqual(['src/**/*']);
+        expect(facts.map(f => f.path)).toEqual(['src/a.ts']);
+    });
+    it('uses the whole-repo pattern when unscoped', async () => {
+        mockGlobby.mockResolvedValue([]);
+        await extractFacts('/project');
+        expect(mockGlobby.mock.calls[0][0]).toEqual(['**/*.{ts,js,tsx,jsx,py,go,rs,cs,java,rb,kt}']);
+    });
+});
+describe('isTestFile', () => {
+    it('recognises test files by path convention', () => {
+        for (const p of ['src/a.test.ts', 'src/a.spec.tsx', '__tests__/a.ts', 'tests/a.py', 'test/a.js', 'pkg/a_test.go', 'test_a.py']) {
+            expect(isTestFile(p, ''), p).toBe(true);
+        }
+    });
+    it('recognises test-runner calls at the start of a line', () => {
+        expect(isTestFile('src/a.ts', "describe('x', () => {});")).toBe(true);
+        expect(isTestFile('src/a.ts', "  it.each([1])('x', () => {});")).toBe(true);
+        expect(isTestFile('src/a.py', 'def test_x():\n    pass')).toBe(true);
+    });
+    it('does not mistake ordinary code or paths for tests', () => {
+        expect(isTestFile('src/route.ts', 'process.exit(1);\nform.submit();\nawait wait(5);')).toBe(false);
+        expect(isTestFile('src/check.ts', 'if (/^a/.test(value)) return;')).toBe(false);
+        expect(isTestFile('src/latest/report.ts', 'export {}')).toBe(false);
+        expect(isTestFile('src/contest/entry.ts', 'export {}')).toBe(false);
+    });
+});

package/dist/deep/facts-pass.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Facts pass: repo-wide analysis from AST facts (no source sent).
+ * Used for unscoped `rigour check --deep`.
+ */
+import type { InferenceOptions, InferenceProvider, DeepFinding } from '../inference/types.js';
+import type { FileFacts } from './fact-extractor.js';
+export interface PassResult {
+    findings: DeepFinding[];
+    chunksTotal: number;
+    chunksFailed: number;
+    /** Message of the first failed chunk, for reporting. */
+    firstError?: string;
+}
+export interface PassConfig {
+    inference: InferenceOptions;
+    checks?: Record<string, boolean>;
+    onProgress?: (message: string) => void;
+    /** Cloud only: fan chunks out over N providers. */
+    agents?: {
+        count: number;
+        create: () => Promise<InferenceProvider>;
+    };
+}
+export declare function runFactsPass(provider: InferenceProvider, facts: FileFacts[], config: PassConfig): Promise<PassResult>;

package/dist/deep/facts-pass.js

@@ -0,0 +1,69 @@
+import { factsToPromptString } from './fact-extractor.js';
+import { buildAnalysisPrompt, buildCrossFilePrompt, chunkFacts } from './prompts.js';
+import { parseFindings } from './parse-findings.js';
+import { Logger } from '../utils/logger.js';
+export async function runFactsPass(provider, facts, config) {
+    const chunks = chunkFacts(facts);
+    const result = config.agents && config.agents.count > 1
+        ? await analyzeWithAgents(chunks, config)
+        : await analyzeSequentially(provider, chunks, config);
+    if (facts.length >= 3 && result.chunksFailed < result.chunksTotal) {
+        config.onProgress?.('  Running cross-file analysis...');
+        try {
+            const response = await provider.analyze(buildCrossFilePrompt(facts), config.inference);
+            result.findings.push(...parseFindings(response));
+        }
+        catch (error) {
+            Logger.warn(`Cross-file analysis failed: ${error.message}`);
+        }
+    }
+    return result;
+}
+async function analyzeSequentially(provider, chunks, config) {
+    const result = { findings: [], chunksTotal: chunks.length, chunksFailed: 0 };
+    for (let i = 0; i < chunks.length; i++) {
+        config.onProgress?.(`  Analyzing batch ${i + 1}/${chunks.length}...`);
+        await analyzeChunk(provider, chunks[i], config, result, `Batch ${i + 1}`);
+    }
+    return result;
+}
+async function analyzeWithAgents(chunks, config) {
+    const { count, create } = config.agents;
+    config.onProgress?.(`  Spawning ${count} parallel agents...`);
+    const buckets = Array.from({ length: count }, () => []);
+    chunks.forEach((chunk, i) => buckets[i % count].push(chunk));
+    const result = { findings: [], chunksTotal: chunks.length, chunksFailed: 0 };
+    await Promise.all(buckets.filter(b => b.length > 0).map(async (bucket, agent) => {
+        let provider;
+        try {
+            provider = await create();
+        }
+        catch (error) {
+            result.chunksFailed += bucket.length;
+            result.firstError ??= error.message;
+            return;
+        }
+        try {
+            for (let i = 0; i < bucket.length; i++) {
+                await analyzeChunk(provider, bucket[i], config, result, `Agent ${agent + 1} batch ${i + 1}`);
+            }
+        }
+        finally {
+            provider.dispose();
+        }
+    }));
+    config.onProgress?.(`  All ${count} agents completed.`);
+    return result;
+}
+async function analyzeChunk(provider, chunk, config, result, label) {
+    const prompt = buildAnalysisPrompt(factsToPromptString(chunk, Number.POSITIVE_INFINITY), config.checks);
+    try {
+        result.findings.push(...parseFindings(await provider.analyze(prompt, config.inference)));
+    }
+    catch (error) {
+        result.chunksFailed++;
+        result.firstError ??= error.message;
+        Logger.warn(`${label} inference failed: ${error.message}`);
+        config.onProgress?.(`  ⚠ ${label} failed: ${error.message}`);
+    }
+}

package/dist/deep/index.d.ts

@@ -7,8 +7,13 @@
  *
  * Neither AST nor LLM works alone. Together they're accurate.
  */
-export { extractFacts, factsToPromptString } from './fact-extractor.js';
+export { extractFacts, factsToPromptString, isTestFile } from './fact-extractor.js';
 export type { FileFacts, ClassFact, FunctionFact, ErrorHandlingFact, StructFact, InterfaceFact } from './fact-extractor.js';
 export { buildAnalysisPrompt, buildCrossFilePrompt, chunkFacts, DEEP_SYSTEM_PROMPT } from './prompts.js';
 export { verifyFindings } from './verifier.js';
 export type { VerifiedFinding } from './verifier.js';
+export { parseFindings } from './parse-findings.js';
+export { buildCodeContext } from './code-context.js';
+export type { CodeContext, LineRange } from './code-context.js';
+export { buildCodeReviewPrompt, REVIEW_CATEGORIES } from './code-review-prompt.js';
+export { verifyCodeFindings } from './code-verifier.js';