@rigour-labs/core 6.2.4 → 6.3.0

package/dist/storage/team-diagnostics.test.js

@@ -0,0 +1,51 @@
+import { describe, expect, it } from 'vitest';
+import { diagnoseMissingMembership, explainTeamConnectionError } from './team-diagnostics.js';
+import { TEAM_SCHEMA } from './team-schema.js';
+function pool(rows) {
+    return {
+        query: async () => {
+            if (rows instanceof Error)
+                throw rows;
+            return { rows, rowCount: rows.length };
+        },
+    };
+}
+describe('explainTeamConnectionError', () => {
+    it('explains an untrusted certificate chain with the CA fix', () => {
+        const message = explainTeamConnectionError(Object.assign(new Error('self-signed certificate in certificate chain'), { code: 'SELF_SIGNED_CERT_IN_CHAIN' }));
+        expect(message).toContain('NODE_EXTRA_CA_CERTS');
+        expect(message).toContain('sslmode=verify-full');
+    });
+    it('points a missing schema at init-schema', () => {
+        expect(explainTeamConnectionError({ code: '42P01', message: 'relation "rigour.memberships" does not exist' })).toContain('rigour team init-schema');
+    });
+    it('explains a rejected login and an unreachable host', () => {
+        expect(explainTeamConnectionError({ code: '28P01', message: 'password authentication failed' })).toContain('rejected the login');
+        expect(explainTeamConnectionError({ code: 'ECONNREFUSED', message: 'connect ECONNREFUSED' })).toContain('Cannot reach');
+    });
+    it('passes other errors through', () => {
+        expect(explainTeamConnectionError(new Error('something else'))).toBe('something else');
+    });
+});
+describe('diagnoseMissingMembership', () => {
+    it('names row-level security without a policy as the cause', async () => {
+        const message = await diagnoseMissingMembership(pool([{ table_name: 'memberships' }, { table_name: 'meta' }]));
+        expect(message).toContain('rigour.memberships and rigour.meta');
+        expect(message).toContain('init-schema');
+    });
+    it('reports a missing membership when nothing hides it', async () => {
+        expect(await diagnoseMissingMembership(pool([]))).toContain('no membership');
+    });
+    it('falls back to the membership message when the catalog cannot be read', async () => {
+        expect(await diagnoseMissingMembership(pool(new Error('permission denied')))).toContain('no membership');
+    });
+});
+describe('team schema', () => {
+    it('protects every team table with row-level security and a read policy', () => {
+        for (const table of ['lessons', 'memberships', 'meta']) {
+            expect(TEAM_SCHEMA).toContain(`ALTER TABLE rigour.${table} ENABLE ROW LEVEL SECURITY;`);
+        }
+        expect(TEAM_SCHEMA).toContain('CREATE POLICY memberships_read_own ON rigour.memberships FOR SELECT USING (db_role = current_user);');
+        expect(TEAM_SCHEMA).toContain('CREATE POLICY meta_read ON rigour.meta FOR SELECT USING (true);');
+    });
+});

package/dist/storage/team-schema.d.ts

@@ -0,0 +1,6 @@
+/**
+ * PostgreSQL team schema. Idempotent: re-running it on an existing database
+ * (`rigour team init-schema`) adds anything missing, including the RLS
+ * policies, without touching data.
+ */
+export declare const TEAM_SCHEMA = "\nCREATE SCHEMA IF NOT EXISTS rigour;\nCREATE TABLE IF NOT EXISTS rigour.meta (\n    key TEXT PRIMARY KEY,\n    value TEXT NOT NULL\n);\nCREATE TABLE IF NOT EXISTS rigour.memberships (\n    db_role NAME NOT NULL,\n    organization_id TEXT NOT NULL,\n    team_id TEXT NOT NULL,\n    actor_id TEXT NOT NULL,\n    role TEXT NOT NULL CHECK (role IN ('member', 'sme', 'owner')),\n    PRIMARY KEY (db_role, team_id)\n);\nCREATE TABLE IF NOT EXISTS rigour.lessons (\n    id TEXT PRIMARY KEY,\n    organization_id TEXT NOT NULL,\n    team_id TEXT NOT NULL,\n    repository_id TEXT NOT NULL,\n    actor_id TEXT NOT NULL,\n    visibility TEXT NOT NULL CHECK (visibility IN ('personal', 'team')),\n    state TEXT NOT NULL CHECK (state IN ('candidate', 'validated', 'promoted', 'rejected', 'superseded')),\n    kind TEXT NOT NULL,\n    subject TEXT NOT NULL,\n    evidence_json JSONB NOT NULL,\n    confidence DOUBLE PRECISION NOT NULL,\n    source TEXT NOT NULL,\n    supersedes_id TEXT,\n    created_at BIGINT NOT NULL,\n    updated_at BIGINT NOT NULL\n);\nALTER TABLE rigour.lessons ENABLE ROW LEVEL SECURITY;\nDROP POLICY IF EXISTS lessons_read ON rigour.lessons;\nCREATE POLICY lessons_read ON rigour.lessons FOR SELECT USING (\n    EXISTS (\n        SELECT 1 FROM rigour.memberships membership\n        WHERE membership.db_role = current_user\n          AND membership.organization_id = lessons.organization_id\n          AND membership.team_id = lessons.team_id\n          AND ((lessons.visibility = 'team' AND lessons.state = 'promoted')\n               OR membership.actor_id = lessons.actor_id)\n    )\n);\nDROP POLICY IF EXISTS lessons_write ON rigour.lessons;\nCREATE POLICY lessons_write ON rigour.lessons FOR ALL USING (\n    EXISTS (\n        SELECT 1 FROM rigour.memberships membership\n        WHERE membership.db_role = current_user\n          AND membership.organization_id = lessons.organization_id\n          AND membership.team_id = lessons.team_id\n          AND membership.actor_id = lessons.actor_id\n          AND (lessons.visibility = 'personal' OR membership.role IN ('sme', 'owner'))\n    )\n) WITH CHECK (\n    EXISTS (\n        SELECT 1 FROM rigour.memberships membership\n        WHERE membership.db_role = current_user\n          AND membership.organization_id = lessons.organization_id\n          AND membership.team_id = lessons.team_id\n          AND membership.actor_id = lessons.actor_id\n          AND (lessons.visibility = 'personal' OR membership.role IN ('sme', 'owner'))\n    )\n);\n-- Row-level security on every team table. A host (for example Supabase's\n-- security advisor) may enable RLS on its own; without a policy each member\n-- login would then see no rows at all. Members read only their own\n-- membership rows (the lessons policies read memberships the same way), and\n-- meta holds only the schema version.\nALTER TABLE rigour.memberships ENABLE ROW LEVEL SECURITY;\nDROP POLICY IF EXISTS memberships_read_own ON rigour.memberships;\nCREATE POLICY memberships_read_own ON rigour.memberships FOR SELECT USING (db_role = current_user);\nALTER TABLE rigour.meta ENABLE ROW LEVEL SECURITY;\nDROP POLICY IF EXISTS meta_read ON rigour.meta;\nCREATE POLICY meta_read ON rigour.meta FOR SELECT USING (true);\nINSERT INTO rigour.meta (key, value) VALUES ('schema_version', '1')\nON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;\n";

package/dist/storage/team-schema.js

@@ -0,0 +1,82 @@
+/**
+ * PostgreSQL team schema. Idempotent: re-running it on an existing database
+ * (`rigour team init-schema`) adds anything missing, including the RLS
+ * policies, without touching data.
+ */
+export const TEAM_SCHEMA = `
+CREATE SCHEMA IF NOT EXISTS rigour;
+CREATE TABLE IF NOT EXISTS rigour.meta (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS rigour.memberships (
+    db_role NAME NOT NULL,
+    organization_id TEXT NOT NULL,
+    team_id TEXT NOT NULL,
+    actor_id TEXT NOT NULL,
+    role TEXT NOT NULL CHECK (role IN ('member', 'sme', 'owner')),
+    PRIMARY KEY (db_role, team_id)
+);
+CREATE TABLE IF NOT EXISTS rigour.lessons (
+    id TEXT PRIMARY KEY,
+    organization_id TEXT NOT NULL,
+    team_id TEXT NOT NULL,
+    repository_id TEXT NOT NULL,
+    actor_id TEXT NOT NULL,
+    visibility TEXT NOT NULL CHECK (visibility IN ('personal', 'team')),
+    state TEXT NOT NULL CHECK (state IN ('candidate', 'validated', 'promoted', 'rejected', 'superseded')),
+    kind TEXT NOT NULL,
+    subject TEXT NOT NULL,
+    evidence_json JSONB NOT NULL,
+    confidence DOUBLE PRECISION NOT NULL,
+    source TEXT NOT NULL,
+    supersedes_id TEXT,
+    created_at BIGINT NOT NULL,
+    updated_at BIGINT NOT NULL
+);
+ALTER TABLE rigour.lessons ENABLE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS lessons_read ON rigour.lessons;
+CREATE POLICY lessons_read ON rigour.lessons FOR SELECT USING (
+    EXISTS (
+        SELECT 1 FROM rigour.memberships membership
+        WHERE membership.db_role = current_user
+          AND membership.organization_id = lessons.organization_id
+          AND membership.team_id = lessons.team_id
+          AND ((lessons.visibility = 'team' AND lessons.state = 'promoted')
+               OR membership.actor_id = lessons.actor_id)
+    )
+);
+DROP POLICY IF EXISTS lessons_write ON rigour.lessons;
+CREATE POLICY lessons_write ON rigour.lessons FOR ALL USING (
+    EXISTS (
+        SELECT 1 FROM rigour.memberships membership
+        WHERE membership.db_role = current_user
+          AND membership.organization_id = lessons.organization_id
+          AND membership.team_id = lessons.team_id
+          AND membership.actor_id = lessons.actor_id
+          AND (lessons.visibility = 'personal' OR membership.role IN ('sme', 'owner'))
+    )
+) WITH CHECK (
+    EXISTS (
+        SELECT 1 FROM rigour.memberships membership
+        WHERE membership.db_role = current_user
+          AND membership.organization_id = lessons.organization_id
+          AND membership.team_id = lessons.team_id
+          AND membership.actor_id = lessons.actor_id
+          AND (lessons.visibility = 'personal' OR membership.role IN ('sme', 'owner'))
+    )
+);
+-- Row-level security on every team table. A host (for example Supabase's
+-- security advisor) may enable RLS on its own; without a policy each member
+-- login would then see no rows at all. Members read only their own
+-- membership rows (the lessons policies read memberships the same way), and
+-- meta holds only the schema version.
+ALTER TABLE rigour.memberships ENABLE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS memberships_read_own ON rigour.memberships;
+CREATE POLICY memberships_read_own ON rigour.memberships FOR SELECT USING (db_role = current_user);
+ALTER TABLE rigour.meta ENABLE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS meta_read ON rigour.meta;
+CREATE POLICY meta_read ON rigour.meta FOR SELECT USING (true);
+INSERT INTO rigour.meta (key, value) VALUES ('schema_version', '1')
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+`;

package/dist/storage/team-store.js

@@ -3,6 +3,8 @@ import os from 'os';
 import path from 'path';
 import { openDatabase } from './db.js';
 import { decryptLocalPayload, encryptLocalPayload } from './local-encryption.js';
+import { TEAM_SCHEMA } from './team-schema.js';
+import { diagnoseMissingMembership, explainTeamConnectionError } from './team-diagnostics.js';
 import { TEAM_VECTOR_SCHEMA, backfillConfiguredTeamEmbeddings, getTeamSemanticHealth, searchConfiguredTeamKnowledge, upsertTeamLessonEmbedding, } from './team-vector-store.js';
 const DEFAULT_SEMANTIC = {
     provider: 'pgvector',
@@ -84,72 +86,6 @@ async function queuedChanges() {
         await db.close();
     }
 }
-const TEAM_SCHEMA = `
-CREATE SCHEMA IF NOT EXISTS rigour;
-CREATE TABLE IF NOT EXISTS rigour.meta (
-    key TEXT PRIMARY KEY,
-    value TEXT NOT NULL
-);
-CREATE TABLE IF NOT EXISTS rigour.memberships (
-    db_role NAME NOT NULL,
-    organization_id TEXT NOT NULL,
-    team_id TEXT NOT NULL,
-    actor_id TEXT NOT NULL,
-    role TEXT NOT NULL CHECK (role IN ('member', 'sme', 'owner')),
-    PRIMARY KEY (db_role, team_id)
-);
-CREATE TABLE IF NOT EXISTS rigour.lessons (
-    id TEXT PRIMARY KEY,
-    organization_id TEXT NOT NULL,
-    team_id TEXT NOT NULL,
-    repository_id TEXT NOT NULL,
-    actor_id TEXT NOT NULL,
-    visibility TEXT NOT NULL CHECK (visibility IN ('personal', 'team')),
-    state TEXT NOT NULL CHECK (state IN ('candidate', 'validated', 'promoted', 'rejected', 'superseded')),
-    kind TEXT NOT NULL,
-    subject TEXT NOT NULL,
-    evidence_json JSONB NOT NULL,
-    confidence DOUBLE PRECISION NOT NULL,
-    source TEXT NOT NULL,
-    supersedes_id TEXT,
-    created_at BIGINT NOT NULL,
-    updated_at BIGINT NOT NULL
-);
-ALTER TABLE rigour.lessons ENABLE ROW LEVEL SECURITY;
-DROP POLICY IF EXISTS lessons_read ON rigour.lessons;
-CREATE POLICY lessons_read ON rigour.lessons FOR SELECT USING (
-    EXISTS (
-        SELECT 1 FROM rigour.memberships membership
-        WHERE membership.db_role = current_user
-          AND membership.organization_id = lessons.organization_id
-          AND membership.team_id = lessons.team_id
-          AND ((lessons.visibility = 'team' AND lessons.state = 'promoted')
-               OR membership.actor_id = lessons.actor_id)
-    )
-);
-DROP POLICY IF EXISTS lessons_write ON rigour.lessons;
-CREATE POLICY lessons_write ON rigour.lessons FOR ALL USING (
-    EXISTS (
-        SELECT 1 FROM rigour.memberships membership
-        WHERE membership.db_role = current_user
-          AND membership.organization_id = lessons.organization_id
-          AND membership.team_id = lessons.team_id
-          AND membership.actor_id = lessons.actor_id
-          AND (lessons.visibility = 'personal' OR membership.role IN ('sme', 'owner'))
-    )
-) WITH CHECK (
-    EXISTS (
-        SELECT 1 FROM rigour.memberships membership
-        WHERE membership.db_role = current_user
-          AND membership.organization_id = lessons.organization_id
-          AND membership.team_id = lessons.team_id
-          AND membership.actor_id = lessons.actor_id
-          AND (lessons.visibility = 'personal' OR membership.role IN ('sme', 'owner'))
-    )
-);
-INSERT INTO rigour.meta (key, value) VALUES ('schema_version', '1')
-ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
-`;
 export async function initializeTeamSchema(databaseUrl, options = {}) {
     validateTeamDatabaseUrl(databaseUrl);
     const { Pool } = await loadPg();
@@ -171,7 +107,7 @@ export async function getTeamModeStatus() {
     }
     try {
         const result = await doctorTeamConnection(config);
-        return result;
+        return result.connectivity === 'offline' ? { ...result, message: `Offline — changes queued. ${result.message}` } : result;
     }
     catch (error) {
         return {
@@ -190,7 +126,21 @@ export async function doctorTeamConnection(config) {
     if (!resolved?.databaseUrl) {
         return { mode: 'local', connectivity: 'local', queuedChanges: await queuedChanges(), message: 'Team mode is not configured.' };
     }
-    validateTeamDatabaseUrl(resolved.databaseUrl);
+    const offline = async (message) => ({
+        mode: 'team',
+        connectivity: 'offline',
+        organizationId: resolved.organizationId,
+        teamId: resolved.teamId,
+        actorId: resolved.actorId,
+        queuedChanges: await queuedChanges(),
+        message,
+    });
+    try {
+        validateTeamDatabaseUrl(resolved.databaseUrl);
+    }
+    catch (error) {
+        return offline(explainTeamConnectionError(error));
+    }
     const { Pool } = await loadPg();
     const pool = new Pool({ connectionString: resolved.databaseUrl });
     try {
@@ -200,10 +150,10 @@ export async function doctorTeamConnection(config) {
              FROM rigour.memberships
              WHERE db_role = current_user AND team_id = $1 AND actor_id = $2 AND organization_id = $3`, [resolved.teamId, resolved.actorId, resolved.organizationId]);
         if (result.rowCount !== 1)
-            throw new Error('Database role is not provisioned for this team.');
+            return offline(await diagnoseMissingMembership(pool));
         const schemaVersion = Number(result.rows[0].schema_version);
         if (schemaVersion !== 1)
-            throw new Error(`Incompatible team schema version ${schemaVersion}; expected 1.`);
+            return offline(`Incompatible team schema version ${schemaVersion}; expected 1.`);
         const semantic = resolved.semantic ? await getTeamSemanticHealth(pool, resolved) : undefined;
         return {
             mode: 'team',
@@ -219,8 +169,11 @@ export async function doctorTeamConnection(config) {
             message: 'PostgreSQL team mode is healthy.',
         };
     }
+    catch (error) {
+        return offline(explainTeamConnectionError(error));
+    }
     finally {
-        await pool.end();
+        await pool.end().catch(() => undefined);
     }
 }
 export async function syncTeamOutbox(options = {}) {
@@ -243,7 +196,7 @@ export async function syncTeamOutbox(options = {}) {
                   WHERE db_role = current_user AND team_id = $1
                     AND actor_id = $2 AND organization_id = $3`, [config.teamId, config.actorId, config.organizationId]);
             if (membership.rowCount !== 1)
-                throw new Error('Database role is not provisioned for this team.');
+                throw new Error(await diagnoseMissingMembership(pool));
             for (const item of pending) {
                 const lesson = await decryptLocalPayload(item.payload_json);
                 try {

package/dist/templates/universal-config.js

@@ -234,6 +234,9 @@ export const UNIVERSAL_CONFIG = {
             track_branches: true,
             track_returns: true,
         },
+        semantic_bugs: {
+            enabled: false,
+        },
         side_effect_analysis: {
             enabled: true,
             check_unbounded_timers: true,
@@ -251,9 +254,8 @@ export const UNIVERSAL_CONFIG = {
             pro: false,
             provider: 'local',
             threads: 4,
-            max_tokens: 512,
             temperature: 0.1,
-            timeout_ms: 60000,
+            intent_checks: false,
             checks: {
                 solid: true,
                 dry: true,