@rigour-labs/core 6.2.3 → 6.2.5

package/dist/gates/scoped-gates.test.js

@@ -0,0 +1,52 @@
+import fs from 'fs-extra';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { ContextGate } from './context.js';
+import { DependencyGate } from './dependency.js';
+import { LogicDriftGate } from './logic-drift.js';
+import { StyleDriftGate } from './style-drift.js';
+describe('gates on a scoped run', () => {
+    let cwd;
+    beforeEach(async () => { cwd = await fs.mkdtemp(path.join(os.tmpdir(), 'rigour-scoped-')); });
+    afterEach(async () => { await fs.remove(cwd); });
+    it('context-drift reports only findings that cite a file in scope', async () => {
+        await fs.outputFile(path.join(cwd, 'src/a.ts'), 'export const a = process.env.API_URL_PROD;\n');
+        await fs.outputFile(path.join(cwd, 'src/b.ts'), 'export const b = process.env.API_URL_STAGING;\n');
+        const gate = new ContextGate({ context: { enabled: true } });
+        const record = { anchors: [{ type: 'env', id: 'API_URL', confidence: 1 }] };
+        const unscoped = await gate.run({ cwd, record });
+        const scoped = await gate.run({ cwd, record, patterns: ['src/a.ts'] });
+        expect(unscoped.flatMap(f => f.files)).toEqual(expect.arrayContaining(['src/a.ts', 'src/b.ts']));
+        expect(scoped.length).toBeGreaterThan(0);
+        expect(scoped.every(f => f.files?.includes('src/a.ts'))).toBe(true);
+    });
+    it('dependency-guardian checks the manifest only when package.json is in scope', async () => {
+        await fs.outputJson(path.join(cwd, 'package.json'), { dependencies: { 'left-pad': '1.0.0' } });
+        await fs.outputFile(path.join(cwd, 'src/a.ts'), "import pad from 'left-pad';\n");
+        const gate = new DependencyGate({ gates: { dependencies: { forbid: ['left-pad'] } } });
+        expect(await gate.run({ cwd, patterns: ['src/a.ts'] })).toEqual([]);
+        const withManifest = await gate.run({ cwd, patterns: ['package.json'] });
+        expect(withManifest.some(f => f.title === 'Forbidden Dependency')).toBe(true);
+    });
+    it('logic-drift never creates or rewrites its baseline from a scoped run', async () => {
+        const baseline = path.join(cwd, '.rigour/logic-baseline.json');
+        await fs.outputFile(path.join(cwd, 'src/rules.ts'), 'export function eligible(score: number) { return score >= 10; }\n');
+        await fs.outputFile(path.join(cwd, 'src/other.ts'), 'export function other(n: number) { return n > 1; }\n');
+        const gate = new LogicDriftGate();
+        expect(await gate.run({ cwd, patterns: ['src/rules.ts'] })).toEqual([]);
+        expect(await fs.pathExists(baseline)).toBe(false);
+        await gate.run({ cwd });
+        const before = await fs.readFile(baseline, 'utf-8');
+        await fs.outputFile(path.join(cwd, 'src/rules.ts'), 'export function eligible(score: number) { return score > 10; }\n');
+        const scoped = await gate.run({ cwd, patterns: ['src/rules.ts'] });
+        expect(scoped.some(f => f.details.includes("'>=' to '>'"))).toBe(true);
+        expect(await fs.readFile(baseline, 'utf-8')).toBe(before);
+    });
+    it('style-drift does not create its baseline from a scoped run', async () => {
+        await fs.outputFile(path.join(cwd, 'src/a.ts'), 'export function doThing() { return 1; }\n');
+        const gate = new StyleDriftGate();
+        expect(await gate.run({ cwd, patterns: ['src/a.ts'] })).toEqual([]);
+        expect(await fs.pathExists(path.join(cwd, '.rigour/style-baseline.json'))).toBe(false);
+    });
+});

package/dist/gates/security-command-execution.d.ts

@@ -0,0 +1,5 @@
+export interface UnsafeShellCall {
+    line: number;
+    text: string;
+}
+export declare function findUnsafeShellCalls(content: string, file: string): UnsafeShellCall[];

package/dist/gates/security-command-execution.js

@@ -0,0 +1,123 @@
+import ts from 'typescript';
+const SHELL_MODULES = new Set(['child_process', 'node:child_process']);
+const EXEC_METHODS = new Set(['exec', 'execSync']);
+const SPAWN_METHODS = new Set(['spawn', 'spawnSync']);
+const USER_INPUT = /\b(?:req|request|query|params|body|input|user|argv)\b|process\.env/;
+function shellModule(node) {
+    return ts.isStringLiteral(node) && SHELL_MODULES.has(node.text);
+}
+function isShellRequire(node) {
+    return ts.isCallExpression(node)
+        && ts.isIdentifier(node.expression)
+        && node.expression.text === 'require'
+        && node.arguments.length === 1
+        && shellModule(node.arguments[0]);
+}
+function collectBindings(source) {
+    const bindings = { functions: new Map(), namespaces: new Set() };
+    for (const statement of source.statements) {
+        if (ts.isImportDeclaration(statement) && shellModule(statement.moduleSpecifier)) {
+            const clause = statement.importClause;
+            if (clause?.name)
+                bindings.namespaces.add(clause.name.text);
+            const named = clause?.namedBindings;
+            if (named && ts.isNamespaceImport(named))
+                bindings.namespaces.add(named.name.text);
+            if (named && ts.isNamedImports(named)) {
+                for (const element of named.elements) {
+                    const exported = element.propertyName?.text ?? element.name.text;
+                    if (EXEC_METHODS.has(exported) || SPAWN_METHODS.has(exported)) {
+                        bindings.functions.set(element.name.text, exported);
+                    }
+                }
+            }
+        }
+        if (!ts.isVariableStatement(statement))
+            continue;
+        for (const declaration of statement.declarationList.declarations) {
+            const initializer = declaration.initializer;
+            if (!initializer)
+                continue;
+            if (isShellRequire(initializer)) {
+                if (ts.isIdentifier(declaration.name))
+                    bindings.namespaces.add(declaration.name.text);
+                if (ts.isObjectBindingPattern(declaration.name)) {
+                    for (const element of declaration.name.elements) {
+                        const exported = element.propertyName?.getText(source) ?? element.name.getText(source);
+                        if ((EXEC_METHODS.has(exported) || SPAWN_METHODS.has(exported)) && ts.isIdentifier(element.name)) {
+                            bindings.functions.set(element.name.text, exported);
+                        }
+                    }
+                }
+            }
+            else if (ts.isPropertyAccessExpression(initializer) && isShellRequire(initializer.expression)
+                && ts.isIdentifier(declaration.name)) {
+                bindings.functions.set(declaration.name.text, initializer.name.text);
+            }
+        }
+    }
+    return bindings;
+}
+function shadowsImportedName(node, name) {
+    for (let scope = node.parent; scope && !ts.isSourceFile(scope); scope = scope.parent) {
+        if (ts.isFunctionLike(scope) && scope.parameters.some(param => ts.isIdentifier(param.name) && param.name.text === name)) {
+            return true;
+        }
+        if (!ts.isBlock(scope))
+            continue;
+        for (const statement of scope.statements) {
+            if (ts.isFunctionDeclaration(statement) && statement.name?.text === name)
+                return true;
+            if (!ts.isVariableStatement(statement))
+                continue;
+            if (statement.declarationList.declarations.some(decl => ts.isIdentifier(decl.name) && decl.name.text === name)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+function shellMethod(call, bindings) {
+    const expression = call.expression;
+    if (ts.isIdentifier(expression)) {
+        return shadowsImportedName(call, expression.text) ? undefined : bindings.functions.get(expression.text);
+    }
+    if (ts.isPropertyAccessExpression(expression)) {
+        const receiver = expression.expression;
+        if (isShellRequire(receiver))
+            return expression.name.text;
+        if (ts.isIdentifier(receiver) && bindings.namespaces.has(receiver.text)
+            && !shadowsImportedName(call, receiver.text))
+            return expression.name.text;
+    }
+    return undefined;
+}
+function shellEnabled(call) {
+    return call.arguments.some(arg => ts.isObjectLiteralExpression(arg)
+        && arg.properties.some(prop => ts.isPropertyAssignment(prop)
+            && (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name))
+            && prop.name.text === 'shell'
+            && prop.initializer.kind === ts.SyntaxKind.TrueKeyword));
+}
+function taintedArgument(call, source) {
+    return call.arguments.some(arg => USER_INPUT.test(arg.getText(source)));
+}
+export function findUnsafeShellCalls(content, file) {
+    const kind = file.endsWith('.ts') ? ts.ScriptKind.TS : ts.ScriptKind.JS;
+    const source = ts.createSourceFile(file, content, ts.ScriptTarget.Latest, true, kind);
+    const bindings = collectBindings(source);
+    const calls = [];
+    const visit = (node) => {
+        if (ts.isCallExpression(node)) {
+            const method = shellMethod(node, bindings);
+            const executesShell = method && (EXEC_METHODS.has(method) || (SPAWN_METHODS.has(method) && shellEnabled(node)));
+            if (executesShell && taintedArgument(node, source)) {
+                calls.push({ line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+                    text: node.getText(source).slice(0, 120) });
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return calls;
+}

package/dist/gates/security-patterns-data.js

@@ -98,23 +98,7 @@ export const VULNERABILITY_PATTERNS = [
         cwe: 'CWE-338',
         languages: ['ts', 'js', 'tsx', 'jsx']
     },
-    // Command Injection
-    {
-        type: 'command_injection',
-        regex: /(?:exec|execSync|spawn|spawnSync)\s*\(\s*(?:`[^`]*\$\{[^}]*(?:req\.|query|params|body|input|user|argv|process\.env)[^}]*\}[^`]*`|[^)]*(?:req\.|query|params|body|input|user|argv|process\.env)[^)]*)\)/g,
-        severity: 'critical',
-        description: 'Potential command injection: shell execution with user input',
-        cwe: 'CWE-78',
-        languages: ['ts', 'js']
-    },
-    {
-        type: 'command_injection',
-        regex: /child_process.*\s*\.\s*(?:exec|spawn)\s*\([^)]*(?:req\.|query|params|body|input|user|argv|process\.env)/g,
-        severity: 'high',
-        description: 'child_process usage detected (verify input sanitization)',
-        cwe: 'CWE-78',
-        languages: ['ts', 'js']
-    },
+    // JavaScript shell calls are checked with receiver-aware syntax analysis.
     // Python subprocess command injection
     {
         type: 'command_injection',

package/dist/gates/security-patterns.d.ts

@@ -61,11 +61,6 @@ export declare class SecurityPatternsGate extends Gate {
      * Known sanitizers: DOMPurify.sanitize(), sanitize(), xss(), escapeHtml(), htmlEncode().
      */
     private isSanitizedAssignment;
-    /**
-     * Check if a shell execution call is using { shell: false } option (safe pattern).
-     * Also, spawn() without { shell: true } is safe by default — don't flag it.
-     */
-    private isSafeShellCall;
 }
 /**
  * Quick helper to check a single file for security issues

package/dist/gates/security-patterns.js

@@ -16,6 +16,7 @@ import { Gate } from './base.js';
 import { FileScanner } from '../utils/scanner.js';
 import { Logger } from '../utils/logger.js';
 import { VULNERABILITY_PATTERNS } from './security-patterns-data.js';
+import { findUnsafeShellCalls } from './security-command-execution.js';
 import fs from 'fs-extra';
 import path from 'path';
 export class SecurityPatternsGate extends Gate {
@@ -127,7 +128,16 @@ export class SecurityPatternsGate extends Gate {
         return false;
     }
     scanFileForVulnerabilities(content, file, ext, vulnerabilities) {
-        const lines = content.split('\n');
+        if (ext === 'ts' || ext === 'js') {
+            for (const call of findUnsafeShellCalls(content, file)) {
+                vulnerabilities.push({
+                    type: 'command_injection', severity: 'critical', file,
+                    line: call.line, match: call.text,
+                    description: 'Potential command injection: shell execution with user input',
+                    cwe: 'CWE-78',
+                });
+            }
+        }
         for (const pattern of VULNERABILITY_PATTERNS) {
             // Check if pattern applies to this file type
             if (!pattern.languages.includes('*') && !pattern.languages.includes(ext)) {
@@ -145,10 +155,6 @@ export class SecurityPatternsGate extends Gate {
                 if (pattern.type === 'xss' && this.isSanitizedAssignment(match[0])) {
                     continue;
                 }
-                // For command_injection: check if spawn/exec uses { shell: false } (safe)
-                if (pattern.type === 'command_injection' && this.isSafeShellCall(match[0], content, match.index)) {
-                    continue;
-                }
                 // Find line number
                 const beforeMatch = content.slice(0, match.index);
                 const lineNumber = beforeMatch.split('\n').length;
@@ -244,20 +250,6 @@ export class SecurityPatternsGate extends Gate {
         const rhs = matchText.includes('=') ? matchText.split('=').slice(1).join('=') : matchText;
         return sanitizers.some(s => rhs.toLowerCase().includes(s.toLowerCase()));
     }
-    /**
-     * Check if a shell execution call is using { shell: false } option (safe pattern).
-     * Also, spawn() without { shell: true } is safe by default — don't flag it.
-     */
-    isSafeShellCall(matchText, fullContent, matchIndex) {
-        // Check surrounding context (100 chars after match) for shell: false
-        const context = fullContent.slice(matchIndex, matchIndex + matchText.length + 100);
-        if (/shell\s*:\s*false/.test(context))
-            return true;
-        // spawn() without shell: true is safe by default
-        if (/\bspawn(?:Sync)?\s*\(/.test(matchText) && !/shell\s*:\s*true/.test(context))
-            return true;
-        return false;
-    }
 }
 /**
  * Quick helper to check a single file for security issues

package/dist/gates/security-patterns.test.js

@@ -105,14 +105,49 @@ describe('SecurityPatternsGate', () => {
         });
     });
     describe('command injection detection', () => {
-        it('should detect exec with user input', async () => {
+        it('detects imported shell execution with user input', async () => {
             const filePath = path.join(testDir, 'shell.ts');
             fs.writeFileSync(filePath, `
-                exec(\`ls \${req.query.path}\`);
+                import { exec as runShell } from 'node:child_process';
+                runShell(\`ls \${req.query.path}\`);
             `);
             const vulns = await checkSecurityPatterns(filePath);
             expect(vulns.some(v => v.type === 'command_injection')).toBe(true);
         });
+        it('does not treat RegExp.exec or unrelated methods as shell execution', async () => {
+            const filePath = path.join(testDir, 'template.ts');
+            fs.writeFileSync(filePath, `
+                const separator = HB_ELSE.exec(body);
+                const other = LIQUID_BRANCH.exec(user);
+                const local = { exec(value: string) { return value; } };
+                local.exec(request.body);
+            `);
+            const vulns = await checkSecurityPatterns(filePath);
+            expect(vulns.filter(v => v.type === 'command_injection')).toEqual([]);
+        });
+        it('detects namespace, require, and shell-enabled spawn calls', async () => {
+            const filePath = path.join(testDir, 'shell.js');
+            fs.writeFileSync(filePath, `
+                const cp = require('child_process');
+                const { exec: runShell } = require('node:child_process');
+                cp.exec(req.body.command);
+                runShell(user.command);
+                cp.spawn(process.env.SHELL, [input], { shell: true });
+                cp.spawn(process.env.SHELL, [input]);
+            `);
+            const vulns = await checkSecurityPatterns(filePath);
+            expect(vulns.filter(v => v.type === 'command_injection')).toHaveLength(3);
+        });
+        it('does not use an imported shell binding shadowed by a parameter', async () => {
+            const filePath = path.join(testDir, 'shadow.ts');
+            fs.writeFileSync(filePath, `
+                import { exec } from 'child_process';
+                function parse(exec: RegExp) { return exec.exec(body); }
+                function run(exec: (value: string) => void) { exec(user); }
+            `);
+            const vulns = await checkSecurityPatterns(filePath);
+            expect(vulns.filter(v => v.type === 'command_injection')).toEqual([]);
+        });
     });
     describe('severity filtering', () => {
         it('should block on high severity by default', async () => {

package/dist/gates/style-drift.d.ts

@@ -6,10 +6,8 @@
  * style which may differ from the project norm.
  *
  * What it checks:
- * 1. Naming conventions — camelCase vs snake_case vs PascalCase consistency
+ * 1. Naming conventions — compare names with the same language conventions
  * 2. Error handling patterns — try-catch vs .catch()/except/rescue consistency
- * 3. Import style — named vs default vs wildcard import consistency
- * 4. Quote style — single vs double quote consistency
  *
  * How it works:
  * 1. First scan: sample source files → compute per-language style fingerprints → store baseline
@@ -17,7 +15,9 @@
  * 3. If a file deviates >25% on any dimension → flag as style drift
  *
  * Baselines are per-language to avoid cross-language contamination
- * (e.g., Python snake_case shouldn't flag JS camelCase).
+ * (e.g., Python snake_case should not flag JS camelCase).
+ * JS names mandated by frameworks are excluded from style comparison, and
+ * imports are never compared by a language-wide named/default ratio.
  */
 import { Gate, GateContext } from './base.js';
 import { Failure, Provenance } from '../types/index.js';

package/dist/gates/style-drift.js

@@ -6,10 +6,8 @@
  * style which may differ from the project norm.
  *
  * What it checks:
- * 1. Naming conventions — camelCase vs snake_case vs PascalCase consistency
+ * 1. Naming conventions — compare names with the same language conventions
  * 2. Error handling patterns — try-catch vs .catch()/except/rescue consistency
- * 3. Import style — named vs default vs wildcard import consistency
- * 4. Quote style — single vs double quote consistency
  *
  * How it works:
  * 1. First scan: sample source files → compute per-language style fingerprints → store baseline
@@ -17,12 +15,16 @@
  * 3. If a file deviates >25% on any dimension → flag as style drift
  *
  * Baselines are per-language to avoid cross-language contamination
- * (e.g., Python snake_case shouldn't flag JS camelCase).
+ * (e.g., Python snake_case should not flag JS camelCase).
+ * JS names mandated by frameworks are excluded from style comparison, and
+ * imports are never compared by a language-wide named/default ratio.
  */
 import { Gate } from './base.js';
 import { FileScanner } from '../utils/scanner.js';
 import { Logger } from '../utils/logger.js';
 import { languageAdapters } from './language-adapters/index.js';
+import { extractComparableJsNames } from './js-style-context.js';
+import { isScoped } from '../utils/scope.js';
 import { TRY_CATCH_PATTERN, CATCH_PATTERN, RESULT_TYPE_PATTERN, NAMED_IMPORT_PATTERN, WILDCARD_IMPORT_PATTERN, SIDE_EFFECT_IMPORT_PATTERN, DEFAULT_IMPORT_PATTERN, countQuotes, } from './style-drift-rules.js';
 import fs from 'fs-extra';
 import path from 'path';
@@ -67,7 +69,7 @@ export class StyleDriftGate extends Gate {
             try {
                 const raw = await fs.readJson(baselinePath);
                 // Handle migration from old single-fingerprint format
-                if (raw.version === 2) {
+                if (raw.version === 3) {
                     baseline = raw;
                 }
                 else {
@@ -78,6 +80,8 @@ export class StyleDriftGate extends Gate {
                 Logger.debug('Failed to load style baseline, will create new one');
             }
         }
+        if (!baseline && isScoped(context.patterns))
+            return []; // never baseline from a subset of files
         if (!baseline) {
             // First scan: create per-language baseline
             baseline = await this.computePerLanguageBaseline(context, filesByLang);
@@ -116,7 +120,7 @@ export class StyleDriftGate extends Gate {
         const baseline = {
             languages: {},
             createdAt: new Date().toISOString(),
-            version: 2,
+            version: 3,
         };
         for (const [langId, langFiles] of filesByLang) {
             // Sample up to sample_size files per language
@@ -157,7 +161,9 @@ export class StyleDriftGate extends Gate {
         const adapter = languageAdapters.getAdapter(filePath);
         // ── Naming conventions (via adapter) ──
         if (adapter) {
-            const namingPatterns = adapter.extractNamingPatterns(content);
+            const namingPatterns = adapter.id === 'js'
+                ? extractComparableJsNames(content, filePath)
+                : adapter.extractNamingPatterns(content);
             for (const pattern of namingPatterns) {
                 if (pattern.kind === 'function' || pattern.kind === 'method') {
                     fp.naming.functions[pattern.convention]++;
@@ -244,15 +250,8 @@ export class StyleDriftGate extends Gate {
                 suggestion: `Use ${errDev.baselinePredominant} error handling pattern to match project conventions.`,
             });
         }
-        const impDev = this.distributionDeviation(file.importStyle, baseline.importStyle);
-        if (impDev.score > 0 && this.hasSignificantData(file.importStyle)) {
-            deviations.push({
-                dimension: 'import style',
-                score: impDev.score,
-                detail: `file uses ${impDev.filePredominant}, project uses ${impDev.baselinePredominant}`,
-                suggestion: `Use ${impDev.baselinePredominant} imports to match project conventions.`,
-            });
-        }
+        // Import form depends on the imported module's exports. A language-wide
+        // named/default ratio cannot establish a valid replacement.
         return deviations;
     }
     distributionDeviation(file, baseline) {

package/dist/gates/style-drift.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/style-drift.test.js

@@ -0,0 +1,26 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { StyleDriftGate } from './style-drift.js';
+describe('StyleDriftGate', () => {
+    let cwd;
+    beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'style-drift-')); });
+    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+    it('does not compare default imports against unrelated named imports', async () => {
+        const src = path.join(cwd, 'src');
+        fs.mkdirSync(src);
+        for (let i = 0; i < 5; i++) {
+            fs.writeFileSync(path.join(src, `named${i}.ts`), `import { value } from './shared';\nexport function helper${i}() { return value; }\n`);
+        }
+        fs.writeFileSync(path.join(src, 'mui.ts'), [
+            "import Box from '@mui/material/Box';",
+            "import TextField from '@mui/material/TextField';",
+            "import Button from '@mui/material/Button';",
+        ].join('\n'));
+        const gate = new StyleDriftGate();
+        expect(await gate.run({ cwd })).toEqual([]);
+        const findings = await gate.run({ cwd });
+        expect(findings.some(finding => finding.details.includes('import style'))).toBe(false);
+    });
+});

package/dist/index.d.ts

@@ -9,6 +9,9 @@ export { RetryLoopBreakerGate } from './gates/retry-loop-breaker.js';
 export { SideEffectAnalysisGate } from './gates/side-effect-analysis/index.js';
 export { FrontendSecretExposureGate } from './gates/frontend-secret-exposure.js';
 export * from './utils/logger.js';
+export { normalizeScopePatterns, isScoped } from './utils/scope.js';
+export { deepAnalysisError } from './utils/deep-status.js';
+export { parseDiff, changedLinesByFile } from './utils/diff.js';
 export { FileScanner } from './utils/scanner.js';
 export * from './services/score-history.js';
 export * from './hooks/index.js';
@@ -18,7 +21,9 @@ export { DeepAnalysisGate } from './gates/deep-analysis.js';
 export { createProvider } from './inference/index.js';
 export type { InferenceProvider, DeepFinding, DeepAnalysisResult, ModelTier } from './inference/types.js';
 export { MODELS } from './inference/types.js';
-export { isModelCached, getModelsDir, getModelInfo } from './inference/model-manager.js';
+export { isModelCached, getModelsDir, getModelInfo, getCachedModel, ensureModel } from './inference/model-manager.js';
+export { installLlamaEngine, probeBinary, managedEnginePath, LLAMA_RELEASE_TAG } from './inference/llama-engine.js';
+export { SidecarProvider } from './inference/sidecar-provider.js';
 export { extractFacts, factsToPromptString } from './deep/fact-extractor.js';
 export { openDatabase, isSQLiteAvailable, compactDatabase, getDatabaseSize, resetDatabase, insertScan, insertFindings, getRecentScans, getScoreTrendFromDB, getTopIssues, reinforcePattern, getStrongPatterns } from './storage/index.js';
 export type { RigourDB, CompactResult } from './storage/index.js';

package/dist/index.js

@@ -9,6 +9,9 @@ export { RetryLoopBreakerGate } from './gates/retry-loop-breaker.js';
 export { SideEffectAnalysisGate } from './gates/side-effect-analysis/index.js';
 export { FrontendSecretExposureGate } from './gates/frontend-secret-exposure.js';
 export * from './utils/logger.js';
+export { normalizeScopePatterns, isScoped } from './utils/scope.js';
+export { deepAnalysisError } from './utils/deep-status.js';
+export { parseDiff, changedLinesByFile } from './utils/diff.js';
 export { FileScanner } from './utils/scanner.js';
 export * from './services/score-history.js';
 export * from './hooks/index.js';
@@ -18,7 +21,9 @@ export { loadSettings, saveSettings, getSettingsPath, resolveDeepOptions, getPro
 export { DeepAnalysisGate } from './gates/deep-analysis.js';
 export { createProvider } from './inference/index.js';
 export { MODELS } from './inference/types.js';
-export { isModelCached, getModelsDir, getModelInfo } from './inference/model-manager.js';
+export { isModelCached, getModelsDir, getModelInfo, getCachedModel, ensureModel } from './inference/model-manager.js';
+export { installLlamaEngine, probeBinary, managedEnginePath, LLAMA_RELEASE_TAG } from './inference/llama-engine.js';
+export { SidecarProvider } from './inference/sidecar-provider.js';
 export { extractFacts, factsToPromptString } from './deep/fact-extractor.js';
 // Storage (SQLite Brain)
 export { openDatabase, isSQLiteAvailable, compactDatabase, getDatabaseSize, resetDatabase, insertScan, insertFindings, getRecentScans, getScoreTrendFromDB, getTopIssues, reinforcePattern, getStrongPatterns } from './storage/index.js';

package/dist/inference/http-download.d.ts

@@ -0,0 +1,22 @@
+import { type Readable } from 'stream';
+export interface HttpResponse {
+    statusCode: number;
+    headers: Record<string, string | string[] | undefined>;
+    body: Readable;
+}
+export type HttpGet = (url: string, headers: Record<string, string>, timeoutMs: number) => Promise<HttpResponse>;
+export interface DownloadOptions {
+    onProgress?: (downloadedBytes: number, totalBytes: number | null) => void;
+    stallTimeoutMs?: number;
+    /** Resume from an existing partial file at `destPath` (default true). */
+    resume?: boolean;
+    /** Transport override for tests. */
+    get?: HttpGet;
+}
+export interface DownloadResult {
+    sha256: string;
+    bytes: number;
+    /** ETag seen on any hop; Hugging Face exposes the LFS SHA-256 as x-linked-etag. */
+    etag: string | null;
+}
+export declare function downloadToFile(url: string, destPath: string, options?: DownloadOptions): Promise<DownloadResult>;