@rigour-labs/core 6.2.4 → 6.2.5

package/dist/deep/index.js

@@ -7,6 +7,10 @@
  *
  * Neither AST nor LLM works alone. Together they're accurate.
  */
-export { extractFacts, factsToPromptString } from './fact-extractor.js';
+export { extractFacts, factsToPromptString, isTestFile } from './fact-extractor.js';
 export { buildAnalysisPrompt, buildCrossFilePrompt, chunkFacts, DEEP_SYSTEM_PROMPT } from './prompts.js';
 export { verifyFindings } from './verifier.js';
+export { parseFindings } from './parse-findings.js';
+export { buildCodeContext } from './code-context.js';
+export { buildCodeReviewPrompt, REVIEW_CATEGORIES } from './code-review-prompt.js';
+export { verifyCodeFindings } from './code-verifier.js';

package/dist/deep/parse-findings.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Parse an LLM response into structured findings.
+ *
+ * Handles raw JSON, markdown-wrapped JSON, a findings object embedded in
+ * prose, and truncated responses (the model hit its token budget mid-array).
+ */
+import type { DeepFinding } from '../inference/types.js';
+export declare function parseFindings(response: string): DeepFinding[];
+/** Extract the complete finding objects from a response cut off mid-array. */
+export declare function recoverTruncatedFindings(response: string): DeepFinding[];
+/** Drop malformed entries and normalise confidence and severity. */
+export declare function validateFindings(raw: unknown[]): DeepFinding[];

package/dist/deep/parse-findings.js

@@ -0,0 +1,73 @@
+import { Logger } from '../utils/logger.js';
+const VALID_SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
+const FINDING_OBJECT = /\{\s*"category"\s*:\s*"[^"]+"\s*,[\s\S]*?"description"\s*:\s*"[^"]*"[^}]*\}/g;
+export function parseFindings(response) {
+    if (!response || response.trim().length === 0) {
+        Logger.warn('Empty LLM response received');
+        return [];
+    }
+    const candidates = [
+        response,
+        response.match(/```(?:json)?\s*([\s\S]*?)```/)?.[1],
+        response.match(/\{[\s\S]*"findings"[\s\S]*\}/)?.[0],
+    ];
+    for (const candidate of candidates) {
+        const parsed = candidate === undefined ? null : tryParseFindings(candidate);
+        if (parsed)
+            return parsed;
+    }
+    const recovered = recoverTruncatedFindings(response);
+    if (recovered.length > 0) {
+        Logger.info(`Recovered ${recovered.length} findings from truncated response`);
+        return recovered;
+    }
+    Logger.warn(`Could not parse LLM response as findings JSON. First 200 chars: ${response.substring(0, 200)}`);
+    return [];
+}
+function tryParseFindings(text) {
+    try {
+        const parsed = JSON.parse(text);
+        if (Array.isArray(parsed?.findings))
+            return validateFindings(parsed.findings);
+        if (Array.isArray(parsed))
+            return validateFindings(parsed);
+        return [];
+    }
+    catch {
+        return null;
+    }
+}
+/** Extract the complete finding objects from a response cut off mid-array. */
+export function recoverTruncatedFindings(response) {
+    const findings = [];
+    for (const match of response.matchAll(FINDING_OBJECT)) {
+        try {
+            findings.push(JSON.parse(match[0]));
+        }
+        catch {
+            // The object itself was truncated; skip it.
+        }
+    }
+    return validateFindings(findings);
+}
+/** Drop malformed entries and normalise confidence and severity. */
+export function validateFindings(raw) {
+    return raw.filter(hasRequiredFields).map(normalizeFinding);
+}
+function hasRequiredFields(f) {
+    return !!f && typeof f === 'object'
+        && isNonEmptyString(f.category)
+        && isNonEmptyString(f.file)
+        && isNonEmptyString(f.description);
+}
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+function normalizeFinding(f) {
+    const confidenceOk = typeof f.confidence === 'number' && f.confidence >= 0 && f.confidence <= 1;
+    return {
+        ...f,
+        confidence: confidenceOk ? f.confidence : 0.5,
+        severity: VALID_SEVERITIES.includes(f.severity) ? f.severity : 'medium',
+    };
+}

package/dist/deep/parse-findings.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deep/parse-findings.test.js

@@ -0,0 +1,25 @@
+import { describe, expect, it } from 'vitest';
+import { parseFindings } from './parse-findings.js';
+const finding = { category: 'correctness', severity: 'high', file: 'a.ts', line: 3, description: 'bug', suggestion: 'fix', confidence: 0.8 };
+describe('parseFindings', () => {
+    it('parses a findings object, a bare array and fenced JSON', () => {
+        expect(parseFindings(JSON.stringify({ findings: [finding] }))).toHaveLength(1);
+        expect(parseFindings(JSON.stringify([finding]))).toHaveLength(1);
+        expect(parseFindings('Here you go:\n```json\n' + JSON.stringify({ findings: [finding] }) + '\n```')).toHaveLength(1);
+    });
+    it('recovers complete findings from a response cut off by the token budget', () => {
+        const cut = `{"findings": [${JSON.stringify(finding)}, {"category": "security", "severity": "hi`;
+        expect(parseFindings(cut)).toEqual([finding]);
+    });
+    it('drops malformed entries and normalises confidence and severity', () => {
+        const parsed = parseFindings(JSON.stringify({ findings: [
+                { ...finding, severity: 'urgent', confidence: 7 },
+                { category: 'x', description: 'no file' },
+            ] }));
+        expect(parsed).toEqual([{ ...finding, severity: 'medium', confidence: 0.5 }]);
+    });
+    it('returns nothing for empty or non-JSON output', () => {
+        expect(parseFindings('')).toEqual([]);
+        expect(parseFindings('I could not find any issues.')).toEqual([]);
+    });
+});

package/dist/deep/prompts.d.ts

@@ -2,7 +2,7 @@
  * Prompt Engineering — Step 2 of the three-step pipeline.
  * Constructs structured prompts that ask the LLM to interpret AST-extracted facts.
  */
-import type { FileFacts } from './fact-extractor.js';
+import { type FileFacts } from './fact-extractor.js';
 /**
  * System prompt that defines the LLM's role and output format.
  */

package/dist/deep/prompts.js

@@ -1,3 +1,8 @@
+/**
+ * Prompt Engineering — Step 2 of the three-step pipeline.
+ * Constructs structured prompts that ask the LLM to interpret AST-extracted facts.
+ */
+import { factsToPromptString } from './fact-extractor.js';
 /**
  * System prompt that defines the LLM's role and output format.
  */
@@ -362,13 +367,7 @@ export function chunkFacts(facts, maxCharsPerChunk = 6000) {
     }
     return chunks;
 }
+/** Serialized size of one file's facts, so chunks never overrun the prompt budget. */
 function estimateFactSize(f) {
-    let size = f.path.length + 50;
-    size += f.classes.reduce((a, c) => a + c.name.length + c.methods.length * 20 + 50, 0);
-    size += (f.structs || []).reduce((a, s) => a + s.name.length + s.methods.length * 20 + s.embeds.length * 15 + 60, 0);
-    size += (f.interfaces || []).reduce((a, i) => a + i.name.length + i.methods.length * 15 + 40, 0);
-    size += f.functions.reduce((a, fn) => a + fn.name.length + fn.params.length * 15 + 50, 0);
-    size += f.imports.length * 30;
-    size += f.errorHandling.length * 30;
-    return size;
+    return factsToPromptString([f], Number.POSITIVE_INFINITY).length + 2;
 }

package/dist/deep/prompts.test.js

@@ -1,5 +1,6 @@
 import { describe, it, expect } from 'vitest';
 import { buildAnalysisPrompt, buildCrossFilePrompt, chunkFacts, DEEP_SYSTEM_PROMPT } from './prompts.js';
+import { factsToPromptString } from './fact-extractor.js';
 // ── Test helpers ──
 function makeGoFacts(overrides = {}) {
     return {
@@ -195,6 +196,20 @@ describe('Deep Analysis Prompts', () => {
     });
     // ── chunkFacts ──
     describe('chunkFacts', () => {
+        it('never lets the serialized chunk overrun the prompt budget, so no file is dropped', () => {
+            const facts = Array.from({ length: 40 }, (_, i) => makeTsFacts({
+                path: `src/deeply/nested/module-${i}/implementation-file-with-a-long-name-${i}.ts`,
+                lineCount: 300,
+                imports: Array.from({ length: 8 }, (_, j) => `@scope/package-with-long-name-${j}/sub/path`),
+            }));
+            const chunks = chunkFacts(facts, 6000);
+            expect(chunks.flat()).toHaveLength(facts.length);
+            for (const chunk of chunks) {
+                const text = factsToPromptString(chunk);
+                for (const f of chunk)
+                    expect(text).toContain(`FILE: ${f.path}`);
+            }
+        });
         it('should split facts into token-limited chunks', () => {
             const manyFacts = Array.from({ length: 50 }, (_, i) => makeTsFacts({
                 path: `src/file${i}.ts`,

package/dist/gates/context.js

@@ -1,5 +1,6 @@
 import { Gate } from './base.js';
 import { FileScanner } from '../utils/scanner.js';
+import { isScoped, resolveScopedFiles, touchesScope } from '../utils/scope.js';
 import fs from 'fs-extra';
 import path from 'path';
 export class ContextGate extends Gate {
@@ -57,6 +58,12 @@ export class ContextGate extends Gate {
         if (this.extendedConfig.import_relationships) {
             this.analyzeImportPatterns(importPatterns, failures);
         }
+        // Cross-file patterns need the whole repo, but a scoped run reports
+        // only findings that cite a file in scope.
+        if (isScoped(context.patterns)) {
+            const scoped = await resolveScopedFiles(context.cwd, context.patterns, context.ignore);
+            return failures.filter(f => touchesScope(f.files, scoped));
+        }
         return failures;
     }
     checkEnvDrift(content, file, anchors, failures) {

package/dist/gates/deep-analysis.d.ts

@@ -1,12 +1,15 @@
 /**
- * Deep Analysis Gate — LLM-powered code quality analysis.
+ * Deep Analysis Gate — LLM-powered code analysis.
  *
- * Three-step pipeline:
- * 1. AST extracts facts → "UserService has 8 public methods touching 4 domains"
- * 2. LLM interprets facts → "UserService violates Single Responsibility"
- * 3. AST verifies LLM → Does UserService actually have those methods? ✓
+ * Two modes:
+ * - Unscoped (`rigour check --deep`): repo-wide analysis from AST facts.
+ *   AST extracts facts, the LLM interprets them, AST verifies the findings.
+ * - Scoped (`rigour check <paths> --deep`, `rigour review --deep`): each
+ *   scoped file is reviewed with its numbered source; findings must cite a
+ *   line and identifiers that were actually sent.
  *
- * AST grounds LLM. LLM interprets AST. Neither works alone.
+ * The gate records an outcome. A run where setup failed or every chunk
+ * failed is an error, never a clean pass.
  */
 import { Gate, GateContext } from './base.js';
 import { Failure, Provenance, DeepOptions } from '../types/index.js';
@@ -19,12 +22,32 @@ export interface DeepGateConfig {
     timeoutMs?: number;
     onProgress?: (message: string) => void;
 }
+export type DeepRunStatus = 'ok' | 'partial' | 'error';
+export interface DeepRunOutcome {
+    status: DeepRunStatus;
+    mode: 'facts' | 'code';
+    filesAnalyzed: number;
+    chunksTotal: number;
+    chunksFailed: number;
+    /** Model actually used (the stock fallback is named as such). */
+    model?: string;
+    modelFallback?: boolean;
+    error?: string;
+}
 export declare class DeepAnalysisGate extends Gate {
     private config;
     private provider;
+    private outcome;
     constructor(config: DeepGateConfig);
     protected get provenance(): Provenance;
-    /** Check if a file is a likely entry point (higher analysis priority) */
-    private isEntryPoint;
+    /** Outcome of the last run(). */
+    getOutcome(): DeepRunOutcome;
     run(context: GateContext): Promise<Failure[]>;
+    private setupProvider;
+    private reviewCode;
+    private analyzeFacts;
+    private recordPass;
+    private localMemoryFindings;
+    private createCloudAgent;
+    private toFailure;
 }