@rigour-labs/core 6.2.4 → 6.2.5

package/dist/gates/deep-runner.js

@@ -0,0 +1,65 @@
+/**
+ * Deep analysis as the gate runner reports it: summary status, report stats
+ * and failures, derived from the deep gate's outcome.
+ */
+import { DeepAnalysisGate } from './deep-analysis.js';
+import { Logger } from '../utils/logger.js';
+/**
+ * Run the deep gate and turn its outcome into summary, stats and failures.
+ * A deep run that could not analyze anything is ERROR with a visible
+ * failure, never a clean PASS.
+ */
+export async function runDeepAnalysis(config, context, deepOptions) {
+    const start = Date.now();
+    const deepGate = new DeepAnalysisGate({
+        options: deepOptions,
+        checks: config.gates.deep?.checks,
+        threads: config.gates.deep?.threads,
+        maxTokens: config.gates.deep?.max_tokens,
+        temperature: config.gates.deep?.temperature,
+        timeoutMs: config.gates.deep?.timeout_ms,
+        onProgress: deepOptions.onProgress,
+    });
+    let findings = [];
+    let thrown;
+    try {
+        findings = await deepGate.run(context);
+    }
+    catch (error) {
+        thrown = error?.message ?? String(error);
+        Logger.error(`Deep analysis failed: ${thrown}`);
+    }
+    // A gate that threw produced nothing: never report its last outcome as ok.
+    const outcome = thrown ? { ...deepGate.getOutcome(), status: 'error', error: thrown } : deepGate.getOutcome();
+    const isLocal = !deepOptions.apiKey || (deepOptions.provider || '').toLowerCase() === 'local';
+    const stats = {
+        enabled: true,
+        status: outcome.status,
+        mode: outcome.mode,
+        tier: isLocal ? (deepOptions.pro ? 'deep' : 'lite') : 'cloud',
+        model: outcome.model,
+        model_fallback: outcome.modelFallback,
+        total_ms: Date.now() - start,
+        files_analyzed: outcome.filesAnalyzed,
+        chunks_total: outcome.chunksTotal,
+        chunks_failed: outcome.chunksFailed,
+        error: outcome.error,
+        findings_count: findings.length,
+        findings_verified: findings.filter(f => f.verified).length,
+    };
+    if (outcome.status === 'error') {
+        return {
+            failures: [{
+                    id: 'deep-analysis',
+                    title: 'Deep analysis did not run',
+                    details: outcome.error || 'Deep analysis failed before producing results.',
+                    severity: 'medium',
+                    provenance: 'traditional',
+                    hint: 'Run `rigour doctor`. For local mode, `rigour deep pull` installs the engine and model.',
+                }],
+            summary: 'ERROR',
+            stats,
+        };
+    }
+    return { failures: findings, summary: findings.length > 0 ? 'FAIL' : 'PASS', stats };
+}

package/dist/gates/dependency.js

@@ -18,6 +18,7 @@ import path from 'path';
 import { Gate } from './base.js';
 import { FileScanner } from '../utils/scanner.js';
 import { Logger } from '../utils/logger.js';
+import { scopeExcludes } from '../utils/scope.js';
 /**
  * Known heavy packages with lighter alternatives.
  * Format: package → "alternative (size comparison)"
@@ -84,6 +85,9 @@ export class DependencyGate extends Gate {
         const depConfig = this.config.gates.dependencies || {};
         const forbidden = depConfig.forbid || [];
         const { cwd } = context;
+        // Dependency health belongs to the manifest: a scoped run checks it only with package.json in scope.
+        if (await scopeExcludes(context, 'package.json'))
+            return [];
         // 1. Scan Node.js (package.json) — forbidden + new checks
         const pkgPath = path.join(cwd, 'package.json');
         if (await fs.pathExists(pkgPath)) {

package/dist/gates/logic-drift.js

@@ -22,6 +22,7 @@ import { Logger } from '../utils/logger.js';
 import { languageAdapters } from './language-adapters/index.js';
 import { extractCallSequence, isDangerousMutation } from './logic-drift-extractors.js';
 import { isGitWorktree, resolveGitLogicBase } from './logic-drift-git-base.js';
+import { isScoped } from '../utils/scope.js';
 import fs from 'fs-extra';
 import path from 'path';
 import crypto from 'crypto';
@@ -94,6 +95,11 @@ export class LogicDriftGate extends Gate {
                 Logger.debug('Failed to load logic baseline');
             }
         }
+        // A scoped run sees only some files: compare against the baseline but
+        // never create or overwrite it, or the rest of the repo drops out of it.
+        const scoped = isScoped(context.patterns);
+        if (!previousBaseline && scoped)
+            return [];
         if (!previousBaseline) {
             // First scan: save baseline, no comparisons yet
             const baseline = {
@@ -151,7 +157,7 @@ export class LogicDriftGate extends Gate {
             lastUpdated: new Date().toISOString(),
             scanCount: previousBaseline.scanCount + 1,
         };
-        if (!gitBase)
+        if (!gitBase && !scoped)
             await fs.writeJson(baselinePath, updatedBaseline, { spaces: 2 });
         if (failures.length > 0) {
             Logger.info(`Logic Drift: Found ${failures.length} logic mutations`);

package/dist/gates/runner.js

@@ -1,5 +1,5 @@
 import { SEVERITY_WEIGHTS } from '../types/index.js';
-import { DeepAnalysisGate } from './deep-analysis.js';
+import { runDeepAnalysis } from './deep-runner.js';
 import { persistAndReinforce } from '../storage/local-memory.js';
 import { recordGateRun } from '../services/adaptive-thresholds.js';
 import { FileGate } from './file.js';
@@ -200,45 +200,10 @@ export class GateRunner {
         // 3. Run Deep Analysis (if enabled)
         let deepStats = undefined;
         if (deepOptions?.enabled) {
-            const deepSetupStart = Date.now();
-            const deepGate = new DeepAnalysisGate({
-                options: deepOptions,
-                checks: this.config.gates.deep?.checks,
-                threads: this.config.gates.deep?.threads,
-                maxTokens: this.config.gates.deep?.max_tokens,
-                temperature: this.config.gates.deep?.temperature,
-                timeoutMs: this.config.gates.deep?.timeout_ms,
-                onProgress: deepOptions.onProgress,
-            });
-            try {
-                const deepFailures = await deepGate.run({ cwd, ignore, patterns });
-                if (deepFailures.length > 0) {
-                    failures.push(...deepFailures);
-                    summary['deep-analysis'] = 'FAIL';
-                }
-                else {
-                    summary['deep-analysis'] = 'PASS';
-                }
-                const isLocalDeepExecution = !deepOptions.apiKey || (deepOptions.provider || '').toLowerCase() === 'local';
-                const deepTier = isLocalDeepExecution
-                    ? (deepOptions.pro ? 'deep' : 'lite')
-                    : 'cloud';
-                deepStats = {
-                    enabled: true,
-                    tier: deepTier,
-                    model: isLocalDeepExecution
-                        ? (deepOptions.pro ? 'Qwen2.5-Coder-1.5B' : 'Qwen2.5-Coder-0.5B')
-                        : (deepOptions.modelName || deepOptions.provider || 'cloud'),
-                    total_ms: Date.now() - deepSetupStart,
-                    findings_count: deepFailures.length,
-                    findings_verified: deepFailures.filter((f) => f.verified).length,
-                };
-            }
-            catch (error) {
-                Logger.error(`Deep analysis failed: ${error.message}`);
-                summary['deep-analysis'] = 'ERROR';
-                deepStats = { enabled: true };
-            }
+            const deep = await runDeepAnalysis(this.config, { cwd, ignore, patterns }, deepOptions);
+            failures.push(...deep.failures);
+            summary['deep-analysis'] = deep.summary;
+            deepStats = deep.stats;
         }
         const status = failures.length > 0 ? 'FAIL' : 'PASS';
         // Severity-weighted scoring with per-gate cap and deduplication

package/dist/gates/runner.test.js

@@ -4,6 +4,12 @@ import path from 'path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { GateRunner } from './runner.js';
 import { DeepAnalysisGate } from './deep-analysis.js';
+function mockDeep(outcome, failures = []) {
+    vi.spyOn(DeepAnalysisGate.prototype, 'run').mockResolvedValue(failures);
+    vi.spyOn(DeepAnalysisGate.prototype, 'getOutcome').mockReturnValue({
+        status: 'ok', mode: 'facts', filesAnalyzed: 1, chunksTotal: 1, chunksFailed: 0, ...outcome,
+    });
+}
 describe('GateRunner deep stats execution mode', () => {
     let testDir;
     beforeEach(async () => {
@@ -25,41 +31,47 @@ describe('GateRunner deep stats execution mode', () => {
             },
         });
     }
-    it('reports local lite tier when provider=local even with apiKey', async () => {
-        vi.spyOn(DeepAnalysisGate.prototype, 'run').mockResolvedValue([]);
-        const runner = createRunner();
-        const report = await runner.run(testDir, undefined, {
-            enabled: true,
-            apiKey: 'sk-test',
-            provider: 'local',
-            pro: false,
+    it('reports local lite tier and the model the provider actually loaded', async () => {
+        mockDeep({ model: 'Qwen2.5-Coder-0.5B-Instruct (stock)', modelFallback: true });
+        const report = await createRunner().run(testDir, undefined, {
+            enabled: true, apiKey: 'sk-test', provider: 'local', pro: false,
         });
         expect(report.stats.deep?.tier).toBe('lite');
-        expect(report.stats.deep?.model).toBe('Qwen2.5-Coder-0.5B');
+        expect(report.stats.deep?.model).toBe('Qwen2.5-Coder-0.5B-Instruct (stock)');
+        expect(report.stats.deep?.model_fallback).toBe(true);
+        expect(report.stats.deep?.status).toBe('ok');
+        expect(report.summary['deep-analysis']).toBe('PASS');
     });
     it('reports local deep tier when provider=local and pro=true', async () => {
-        vi.spyOn(DeepAnalysisGate.prototype, 'run').mockResolvedValue([]);
-        const runner = createRunner();
-        const report = await runner.run(testDir, undefined, {
-            enabled: true,
-            apiKey: 'sk-test',
-            provider: 'local',
-            pro: true,
+        mockDeep({ model: 'Rigour-Deep-v5.0.0 (Qwen2.5-Coder-1.5B fine-tuned)', modelFallback: false });
+        const report = await createRunner().run(testDir, undefined, {
+            enabled: true, apiKey: 'sk-test', provider: 'local', pro: true,
         });
         expect(report.stats.deep?.tier).toBe('deep');
-        expect(report.stats.deep?.model).toBe('Qwen2.5-Coder-1.5B');
+        expect(report.stats.deep?.model).toBe('Rigour-Deep-v5.0.0 (Qwen2.5-Coder-1.5B fine-tuned)');
     });
     it('reports cloud tier/model for cloud providers', async () => {
-        vi.spyOn(DeepAnalysisGate.prototype, 'run').mockResolvedValue([]);
-        const runner = createRunner();
-        const report = await runner.run(testDir, undefined, {
-            enabled: true,
-            apiKey: 'sk-test',
-            provider: 'openai',
-            modelName: 'gpt-4.1-mini',
-            pro: false,
+        mockDeep({ model: 'gpt-4.1-mini' });
+        const report = await createRunner().run(testDir, undefined, {
+            enabled: true, apiKey: 'sk-test', provider: 'openai', modelName: 'gpt-4.1-mini', pro: false,
         });
         expect(report.stats.deep?.tier).toBe('cloud');
         expect(report.stats.deep?.model).toBe('gpt-4.1-mini');
     });
+    it('reports a deep run that could not analyze anything as ERROR with a visible failure', async () => {
+        mockDeep({ status: 'error', chunksTotal: 3, chunksFailed: 3, error: 'All 3 inference call(s) failed.' });
+        const report = await createRunner().run(testDir, undefined, { enabled: true, pro: false });
+        expect(report.summary['deep-analysis']).toBe('ERROR');
+        expect(report.status).toBe('FAIL');
+        expect(report.stats.deep).toMatchObject({ status: 'error', chunks_total: 3, chunks_failed: 3, error: 'All 3 inference call(s) failed.' });
+        const failure = report.failures.find(f => f.id === 'deep-analysis');
+        expect(failure?.title).toBe('Deep analysis did not run');
+        expect(failure?.details).toContain('All 3 inference call(s) failed.');
+    });
+    it('keeps a partial run as PASS/FAIL by findings and records failed chunks', async () => {
+        mockDeep({ status: 'partial', chunksTotal: 4, chunksFailed: 1 });
+        const report = await createRunner().run(testDir, undefined, { enabled: true, pro: false });
+        expect(report.summary['deep-analysis']).toBe('PASS');
+        expect(report.stats.deep).toMatchObject({ status: 'partial', chunks_total: 4, chunks_failed: 1 });
+    });
 });

package/dist/gates/scoped-gates.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/scoped-gates.test.js

@@ -0,0 +1,52 @@
+import fs from 'fs-extra';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { ContextGate } from './context.js';
+import { DependencyGate } from './dependency.js';
+import { LogicDriftGate } from './logic-drift.js';
+import { StyleDriftGate } from './style-drift.js';
+describe('gates on a scoped run', () => {
+    let cwd;
+    beforeEach(async () => { cwd = await fs.mkdtemp(path.join(os.tmpdir(), 'rigour-scoped-')); });
+    afterEach(async () => { await fs.remove(cwd); });
+    it('context-drift reports only findings that cite a file in scope', async () => {
+        await fs.outputFile(path.join(cwd, 'src/a.ts'), 'export const a = process.env.API_URL_PROD;\n');
+        await fs.outputFile(path.join(cwd, 'src/b.ts'), 'export const b = process.env.API_URL_STAGING;\n');
+        const gate = new ContextGate({ context: { enabled: true } });
+        const record = { anchors: [{ type: 'env', id: 'API_URL', confidence: 1 }] };
+        const unscoped = await gate.run({ cwd, record });
+        const scoped = await gate.run({ cwd, record, patterns: ['src/a.ts'] });
+        expect(unscoped.flatMap(f => f.files)).toEqual(expect.arrayContaining(['src/a.ts', 'src/b.ts']));
+        expect(scoped.length).toBeGreaterThan(0);
+        expect(scoped.every(f => f.files?.includes('src/a.ts'))).toBe(true);
+    });
+    it('dependency-guardian checks the manifest only when package.json is in scope', async () => {
+        await fs.outputJson(path.join(cwd, 'package.json'), { dependencies: { 'left-pad': '1.0.0' } });
+        await fs.outputFile(path.join(cwd, 'src/a.ts'), "import pad from 'left-pad';\n");
+        const gate = new DependencyGate({ gates: { dependencies: { forbid: ['left-pad'] } } });
+        expect(await gate.run({ cwd, patterns: ['src/a.ts'] })).toEqual([]);
+        const withManifest = await gate.run({ cwd, patterns: ['package.json'] });
+        expect(withManifest.some(f => f.title === 'Forbidden Dependency')).toBe(true);
+    });
+    it('logic-drift never creates or rewrites its baseline from a scoped run', async () => {
+        const baseline = path.join(cwd, '.rigour/logic-baseline.json');
+        await fs.outputFile(path.join(cwd, 'src/rules.ts'), 'export function eligible(score: number) { return score >= 10; }\n');
+        await fs.outputFile(path.join(cwd, 'src/other.ts'), 'export function other(n: number) { return n > 1; }\n');
+        const gate = new LogicDriftGate();
+        expect(await gate.run({ cwd, patterns: ['src/rules.ts'] })).toEqual([]);
+        expect(await fs.pathExists(baseline)).toBe(false);
+        await gate.run({ cwd });
+        const before = await fs.readFile(baseline, 'utf-8');
+        await fs.outputFile(path.join(cwd, 'src/rules.ts'), 'export function eligible(score: number) { return score > 10; }\n');
+        const scoped = await gate.run({ cwd, patterns: ['src/rules.ts'] });
+        expect(scoped.some(f => f.details.includes("'>=' to '>'"))).toBe(true);
+        expect(await fs.readFile(baseline, 'utf-8')).toBe(before);
+    });
+    it('style-drift does not create its baseline from a scoped run', async () => {
+        await fs.outputFile(path.join(cwd, 'src/a.ts'), 'export function doThing() { return 1; }\n');
+        const gate = new StyleDriftGate();
+        expect(await gate.run({ cwd, patterns: ['src/a.ts'] })).toEqual([]);
+        expect(await fs.pathExists(path.join(cwd, '.rigour/style-baseline.json'))).toBe(false);
+    });
+});

package/dist/gates/style-drift.js

@@ -24,6 +24,7 @@ import { FileScanner } from '../utils/scanner.js';
 import { Logger } from '../utils/logger.js';
 import { languageAdapters } from './language-adapters/index.js';
 import { extractComparableJsNames } from './js-style-context.js';
+import { isScoped } from '../utils/scope.js';
 import { TRY_CATCH_PATTERN, CATCH_PATTERN, RESULT_TYPE_PATTERN, NAMED_IMPORT_PATTERN, WILDCARD_IMPORT_PATTERN, SIDE_EFFECT_IMPORT_PATTERN, DEFAULT_IMPORT_PATTERN, countQuotes, } from './style-drift-rules.js';
 import fs from 'fs-extra';
 import path from 'path';
@@ -79,6 +80,8 @@ export class StyleDriftGate extends Gate {
                 Logger.debug('Failed to load style baseline, will create new one');
             }
         }
+        if (!baseline && isScoped(context.patterns))
+            return []; // never baseline from a subset of files
         if (!baseline) {
             // First scan: create per-language baseline
             baseline = await this.computePerLanguageBaseline(context, filesByLang);

package/dist/index.d.ts

@@ -9,6 +9,9 @@ export { RetryLoopBreakerGate } from './gates/retry-loop-breaker.js';
 export { SideEffectAnalysisGate } from './gates/side-effect-analysis/index.js';
 export { FrontendSecretExposureGate } from './gates/frontend-secret-exposure.js';
 export * from './utils/logger.js';
+export { normalizeScopePatterns, isScoped } from './utils/scope.js';
+export { deepAnalysisError } from './utils/deep-status.js';
+export { parseDiff, changedLinesByFile } from './utils/diff.js';
 export { FileScanner } from './utils/scanner.js';
 export * from './services/score-history.js';
 export * from './hooks/index.js';
@@ -18,7 +21,9 @@ export { DeepAnalysisGate } from './gates/deep-analysis.js';
 export { createProvider } from './inference/index.js';
 export type { InferenceProvider, DeepFinding, DeepAnalysisResult, ModelTier } from './inference/types.js';
 export { MODELS } from './inference/types.js';
-export { isModelCached, getModelsDir, getModelInfo } from './inference/model-manager.js';
+export { isModelCached, getModelsDir, getModelInfo, getCachedModel, ensureModel } from './inference/model-manager.js';
+export { installLlamaEngine, probeBinary, managedEnginePath, LLAMA_RELEASE_TAG } from './inference/llama-engine.js';
+export { SidecarProvider } from './inference/sidecar-provider.js';
 export { extractFacts, factsToPromptString } from './deep/fact-extractor.js';
 export { openDatabase, isSQLiteAvailable, compactDatabase, getDatabaseSize, resetDatabase, insertScan, insertFindings, getRecentScans, getScoreTrendFromDB, getTopIssues, reinforcePattern, getStrongPatterns } from './storage/index.js';
 export type { RigourDB, CompactResult } from './storage/index.js';

package/dist/index.js

@@ -9,6 +9,9 @@ export { RetryLoopBreakerGate } from './gates/retry-loop-breaker.js';
 export { SideEffectAnalysisGate } from './gates/side-effect-analysis/index.js';
 export { FrontendSecretExposureGate } from './gates/frontend-secret-exposure.js';
 export * from './utils/logger.js';
+export { normalizeScopePatterns, isScoped } from './utils/scope.js';
+export { deepAnalysisError } from './utils/deep-status.js';
+export { parseDiff, changedLinesByFile } from './utils/diff.js';
 export { FileScanner } from './utils/scanner.js';
 export * from './services/score-history.js';
 export * from './hooks/index.js';
@@ -18,7 +21,9 @@ export { loadSettings, saveSettings, getSettingsPath, resolveDeepOptions, getPro
 export { DeepAnalysisGate } from './gates/deep-analysis.js';
 export { createProvider } from './inference/index.js';
 export { MODELS } from './inference/types.js';
-export { isModelCached, getModelsDir, getModelInfo } from './inference/model-manager.js';
+export { isModelCached, getModelsDir, getModelInfo, getCachedModel, ensureModel } from './inference/model-manager.js';
+export { installLlamaEngine, probeBinary, managedEnginePath, LLAMA_RELEASE_TAG } from './inference/llama-engine.js';
+export { SidecarProvider } from './inference/sidecar-provider.js';
 export { extractFacts, factsToPromptString } from './deep/fact-extractor.js';
 // Storage (SQLite Brain)
 export { openDatabase, isSQLiteAvailable, compactDatabase, getDatabaseSize, resetDatabase, insertScan, insertFindings, getRecentScans, getScoreTrendFromDB, getTopIssues, reinforcePattern, getStrongPatterns } from './storage/index.js';

package/dist/inference/http-download.d.ts

@@ -0,0 +1,22 @@
+import { type Readable } from 'stream';
+export interface HttpResponse {
+    statusCode: number;
+    headers: Record<string, string | string[] | undefined>;
+    body: Readable;
+}
+export type HttpGet = (url: string, headers: Record<string, string>, timeoutMs: number) => Promise<HttpResponse>;
+export interface DownloadOptions {
+    onProgress?: (downloadedBytes: number, totalBytes: number | null) => void;
+    stallTimeoutMs?: number;
+    /** Resume from an existing partial file at `destPath` (default true). */
+    resume?: boolean;
+    /** Transport override for tests. */
+    get?: HttpGet;
+}
+export interface DownloadResult {
+    sha256: string;
+    bytes: number;
+    /** ETag seen on any hop; Hugging Face exposes the LFS SHA-256 as x-linked-etag. */
+    etag: string | null;
+}
+export declare function downloadToFile(url: string, destPath: string, options?: DownloadOptions): Promise<DownloadResult>;

package/dist/inference/http-download.js

@@ -0,0 +1,132 @@
+/**
+ * Streaming HTTPS download for large binaries (models, engine archives).
+ *
+ * Uses node:https rather than global fetch: on large Hugging Face downloads
+ * undici's fetch measured ~1.7 MB/s where node:https reached ~17 MB/s on the
+ * same host and byte range, which made the first-run model download exceed
+ * any reasonable setup window.
+ *
+ * - follows at most MAX_REDIRECTS redirects, https only
+ * - resumes a kept partial file with a Range request (the prefix is re-hashed
+ *   so the SHA-256 still covers the whole file)
+ * - aborts when no bytes arrive for `stallTimeoutMs` instead of imposing a
+ *   wall-clock limit that a slow but healthy connection cannot meet
+ */
+import https from 'https';
+import fs from 'fs-extra';
+import { createHash } from 'crypto';
+import { Transform } from 'stream';
+import { pipeline } from 'stream/promises';
+const MAX_REDIRECTS = 5;
+const DEFAULT_STALL_TIMEOUT_MS = 30_000;
+export async function downloadToFile(url, destPath, options = {}) {
+    const stallMs = options.stallTimeoutMs ?? DEFAULT_STALL_TIMEOUT_MS;
+    const get = options.get ?? httpsGet;
+    let existing = options.resume === false ? 0 : await partialSize(destPath);
+    let { response, etag } = await followRedirects(url, rangeFrom(existing), get, stallMs);
+    if (response.statusCode === 416 && existing > 0) {
+        // The partial is already at or past the end: start over once, from zero.
+        response.body.resume();
+        await fs.remove(destPath);
+        existing = 0;
+        ({ response, etag } = await followRedirects(url, rangeFrom(0), get, stallMs));
+    }
+    if (response.statusCode < 200 || response.statusCode >= 300) {
+        response.body.resume();
+        throw new Error(`HTTP ${response.statusCode} for ${url}`);
+    }
+    const resumed = response.statusCode === 206 && existing > 0;
+    const hash = createHash('sha256');
+    if (resumed)
+        await hashFilePrefix(destPath, hash);
+    const startBytes = resumed ? existing : 0;
+    const total = contentLength(response.headers, startBytes);
+    const bytes = await writeBody(response.body, destPath, hash, {
+        append: resumed, startBytes, total, stallMs, onProgress: options.onProgress,
+    });
+    return { sha256: hash.digest('hex'), bytes, etag };
+}
+function rangeFrom(offset) {
+    return offset > 0 ? { Range: `bytes=${offset}-` } : {};
+}
+async function partialSize(filePath) {
+    try {
+        return (await fs.stat(filePath)).size;
+    }
+    catch {
+        return 0;
+    }
+}
+async function followRedirects(url, headers, get, timeoutMs) {
+    let current = url;
+    let etag = null;
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+        if (new URL(current).protocol !== 'https:') {
+            throw new Error(`Refusing non-https download URL: ${current}`);
+        }
+        const response = await get(current, headers, timeoutMs);
+        etag = etag ?? headerValue(response.headers, 'x-linked-etag') ?? headerValue(response.headers, 'etag');
+        const location = headerValue(response.headers, 'location');
+        if (response.statusCode >= 300 && response.statusCode < 400 && location) {
+            response.body.resume();
+            current = new URL(location, current).toString();
+            continue;
+        }
+        return { response, etag };
+    }
+    throw new Error(`Too many redirects downloading ${url}`);
+}
+async function writeBody(body, destPath, hash, opts) {
+    let downloaded = opts.startBytes;
+    let stallTimer;
+    const armStall = () => {
+        clearTimeout(stallTimer);
+        stallTimer = setTimeout(() => {
+            body.destroy(new Error(`Download stalled: no data for ${opts.stallMs / 1000}s`));
+        }, opts.stallMs);
+    };
+    const tap = new Transform({
+        transform(chunk, _encoding, callback) {
+            armStall();
+            hash.update(chunk);
+            downloaded += chunk.length;
+            opts.onProgress?.(downloaded, opts.total);
+            callback(null, chunk);
+        },
+    });
+    armStall();
+    try {
+        await pipeline(body, tap, fs.createWriteStream(destPath, { flags: opts.append ? 'a' : 'w' }));
+    }
+    finally {
+        clearTimeout(stallTimer);
+    }
+    return downloaded;
+}
+async function hashFilePrefix(filePath, hash) {
+    const stream = fs.createReadStream(filePath);
+    try {
+        for await (const chunk of stream)
+            hash.update(chunk);
+    }
+    finally {
+        stream.destroy();
+    }
+}
+function contentLength(headers, offset) {
+    const value = Number(headerValue(headers, 'content-length'));
+    return Number.isFinite(value) && value > 0 ? value + offset : null;
+}
+function headerValue(headers, name) {
+    const value = headers[name];
+    if (Array.isArray(value))
+        return value[0] ?? null;
+    return value ?? null;
+}
+const httpsGet = (url, headers, timeoutMs) => new Promise((resolve, reject) => {
+    const request = https.get(url, { headers: { 'user-agent': 'rigour-cli', ...headers } }, (res) => {
+        resolve({ statusCode: res.statusCode ?? 0, headers: res.headers, body: res });
+    });
+    request.setTimeout(timeoutMs, () => request.destroy(new Error(`No response from ${new URL(url).host} after ${timeoutMs / 1000}s`)));
+    request.on('error', reject);
+});

package/dist/inference/http-download.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/inference/http-download.test.js

@@ -0,0 +1,109 @@
+import fs from 'fs-extra';
+import os from 'os';
+import path from 'path';
+import { createHash } from 'crypto';
+import { Readable, PassThrough } from 'stream';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { downloadToFile } from './http-download.js';
+const PAYLOAD = Buffer.from('0123456789abcdefghijklmnopqrstuvwxyz');
+const sha = (b) => createHash('sha256').update(b).digest('hex');
+function response(statusCode, body = Buffer.alloc(0), headers = {}) {
+    return { statusCode, headers, body: Buffer.isBuffer(body) ? Readable.from([body]) : body };
+}
+/** Serves PAYLOAD, honouring Range unless told not to. */
+function server(opts = {}) {
+    const calls = [];
+    const get = async (url, headers) => {
+        calls.push({ url, headers });
+        const range = headers.Range?.match(/bytes=(\d+)-/);
+        if (range && opts.honourRange !== false) {
+            const start = Number(range[1]);
+            if (start >= PAYLOAD.length)
+                return response(416);
+            return response(206, PAYLOAD.subarray(start), { 'content-length': String(PAYLOAD.length - start) });
+        }
+        return response(200, PAYLOAD, { 'content-length': String(PAYLOAD.length), etag: opts.etag });
+    };
+    return { get, calls };
+}
+describe('downloadToFile', () => {
+    let dir;
+    let dest;
+    beforeEach(async () => {
+        dir = await fs.mkdtemp(path.join(os.tmpdir(), 'rigour-dl-'));
+        dest = path.join(dir, 'model.gguf.download');
+    });
+    afterEach(async () => { await fs.remove(dir); });
+    it('downloads the full body and hashes it', async () => {
+        const { get } = server({ etag: '"abc"' });
+        const result = await downloadToFile('https://host/model', dest, { get });
+        expect(await fs.readFile(dest)).toEqual(PAYLOAD);
+        expect(result).toEqual({ sha256: sha(PAYLOAD), bytes: PAYLOAD.length, etag: '"abc"' });
+    });
+    it('follows redirects and keeps the x-linked-etag from the first hop', async () => {
+        const { get: origin, calls } = server();
+        const get = async (url, headers, timeout) => {
+            if (url === 'https://hub/model') {
+                return response(302, Buffer.alloc(0), { location: 'https://cdn/model', 'x-linked-etag': '"lfs-sha"' });
+            }
+            return origin(url, headers, timeout);
+        };
+        const result = await downloadToFile('https://hub/model', dest, { get });
+        expect(calls.map(c => c.url)).toEqual(['https://cdn/model']);
+        expect(result.etag).toBe('"lfs-sha"');
+    });
+    it('resumes a partial file with a Range request and hashes the whole file', async () => {
+        await fs.writeFile(dest, PAYLOAD.subarray(0, 10));
+        const { get, calls } = server();
+        const result = await downloadToFile('https://host/model', dest, { get });
+        expect(calls[0].headers.Range).toBe('bytes=10-');
+        expect(await fs.readFile(dest)).toEqual(PAYLOAD);
+        expect(result.sha256).toBe(sha(PAYLOAD));
+        expect(result.bytes).toBe(PAYLOAD.length);
+    });
+    it('restarts from zero when the server ignores Range', async () => {
+        await fs.writeFile(dest, Buffer.from('stale-bytes'));
+        const { get } = server({ honourRange: false });
+        const result = await downloadToFile('https://host/model', dest, { get });
+        expect(await fs.readFile(dest)).toEqual(PAYLOAD);
+        expect(result.sha256).toBe(sha(PAYLOAD));
+    });
+    it('restarts when the partial is already past the end (416)', async () => {
+        await fs.writeFile(dest, Buffer.concat([PAYLOAD, Buffer.from('extra')]));
+        const { get, calls } = server();
+        await downloadToFile('https://host/model', dest, { get });
+        expect(calls).toHaveLength(2);
+        expect(await fs.readFile(dest)).toEqual(PAYLOAD);
+    });
+    it('rejects non-success responses without creating the file', async () => {
+        const get = async () => response(401);
+        await expect(downloadToFile('https://host/model', dest, { get })).rejects.toThrow('HTTP 401');
+        expect(await fs.pathExists(dest)).toBe(false);
+    });
+    it('refuses non-https URLs, including redirects to them', async () => {
+        const { get } = server();
+        await expect(downloadToFile('http://host/model', dest, { get })).rejects.toThrow('non-https');
+        const redirecting = async () => response(302, Buffer.alloc(0), { location: 'http://evil/model' });
+        await expect(downloadToFile('https://host/model', dest, { get: redirecting })).rejects.toThrow('non-https');
+    });
+    it('stops after too many redirects', async () => {
+        const loop = async (url) => response(302, Buffer.alloc(0), { location: `${url}x` });
+        await expect(downloadToFile('https://host/m', dest, { get: loop })).rejects.toThrow('Too many redirects');
+    });
+    it('aborts a stalled body and keeps the partial for the next resume', async () => {
+        const body = new PassThrough();
+        body.write(PAYLOAD.subarray(0, 5));
+        const get = async () => response(200, body, { 'content-length': String(PAYLOAD.length) });
+        await expect(downloadToFile('https://host/model', dest, { get, stallTimeoutMs: 50 })).rejects.toThrow('stalled');
+        // The partial file is kept for the next resume (how many bytes reached disk is up to the OS).
+        expect(await fs.pathExists(dest)).toBe(true);
+        expect((await fs.stat(dest)).size).toBeLessThanOrEqual(5);
+    });
+    it('reports progress against the full size when resuming', async () => {
+        await fs.writeFile(dest, PAYLOAD.subarray(0, 10));
+        const { get } = server();
+        const seen = [];
+        await downloadToFile('https://host/model', dest, { get, onProgress: (d, t) => seen.push([d, t]) });
+        expect(seen.at(-1)).toEqual([PAYLOAD.length, PAYLOAD.length]);
+    });
+});