@rigour-labs/core 6.2.4 → 6.3.0

package/dist/gates/deep-analysis.test.js

@@ -0,0 +1,86 @@
+import fs from 'fs-extra';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+const provider = vi.hoisted(() => ({
+    setup: vi.fn(async () => undefined),
+    analyze: vi.fn(async (_prompt) => '{"findings": []}'),
+}));
+vi.mock('../inference/index.js', () => ({
+    createProvider: () => ({
+        name: 'fake',
+        isAvailable: async () => true,
+        setup: provider.setup,
+        analyze: provider.analyze,
+        dispose: () => undefined,
+    }),
+}));
+vi.mock('../storage/local-memory.js', () => ({ checkLocalPatterns: async () => [] }));
+const { DeepAnalysisGate } = await import('./deep-analysis.js');
+const REPORT_TS = [
+    'export async function loadReport(days: number) {',
+    '  const rows = await fetchAll(days);',
+    '  return rows.length;',
+    '}',
+].join('\n');
+describe('DeepAnalysisGate', () => {
+    let cwd;
+    beforeEach(async () => {
+        cwd = await fs.mkdtemp(path.join(os.tmpdir(), 'rigour-deep-gate-'));
+        await fs.outputFile(path.join(cwd, 'src/report.ts'), REPORT_TS);
+        await fs.outputFile(path.join(cwd, 'src/other.ts'), 'export const other = 1;\nexport const two = 2;\nexport const three = 3;\n');
+        provider.setup.mockReset().mockResolvedValue(undefined);
+        provider.analyze.mockReset().mockResolvedValue('{"findings": []}');
+    });
+    afterEach(async () => { await fs.remove(cwd); });
+    const gate = () => new DeepAnalysisGate({ options: { enabled: true, provider: 'local' } });
+    it('records an error outcome when setup fails', async () => {
+        provider.setup.mockRejectedValue(new Error('engine missing'));
+        const g = gate();
+        expect(await g.run({ cwd })).toEqual([]);
+        expect(g.getOutcome()).toMatchObject({ status: 'error', error: 'engine missing' });
+    });
+    it('records an error outcome when every inference call fails', async () => {
+        provider.analyze.mockRejectedValue(new Error('invalid argument: --json'));
+        const g = gate();
+        await g.run({ cwd, patterns: ['src/report.ts', 'src/other.ts'] });
+        expect(g.getOutcome()).toMatchObject({ status: 'error', chunksTotal: 2, chunksFailed: 2 });
+        expect(g.getOutcome().error).toContain('invalid argument: --json');
+    });
+    it('records a partial outcome when some calls fail', async () => {
+        provider.analyze.mockRejectedValueOnce(new Error('timed out')).mockResolvedValue('{"findings": []}');
+        const g = gate();
+        await g.run({ cwd, patterns: ['src/report.ts', 'src/other.ts'] });
+        expect(g.getOutcome()).toMatchObject({ status: 'partial', chunksTotal: 2, chunksFailed: 1 });
+    });
+    it('reviews only the scoped file, with its numbered source', async () => {
+        const g = gate();
+        await g.run({ cwd, patterns: ['src/report.ts'] });
+        expect(provider.analyze).toHaveBeenCalledTimes(1);
+        const prompt = provider.analyze.mock.calls[0][0];
+        expect(prompt).toContain('2|   const rows = await fetchAll(days);');
+        expect(prompt).not.toContain('src/other.ts');
+        expect(g.getOutcome()).toMatchObject({ status: 'ok', mode: 'code', filesAnalyzed: 1 });
+    });
+    it('keeps grounded findings and drops ones about code that was not sent', async () => {
+        provider.analyze.mockResolvedValue(JSON.stringify({ findings: [
+                { category: 'scalability', severity: 'high', file: 'src/report.ts', line: 2, description: '`fetchAll` loads every row.', suggestion: 'Aggregate in SQL.', confidence: 0.8 },
+                { category: 'security', severity: 'high', file: 'src/report.ts', line: 3, description: '`sendSecret` leaks a token.', suggestion: 'x', confidence: 0.9 },
+            ] }));
+        const failures = await gate().run({ cwd, patterns: ['src/report.ts'] });
+        expect(failures).toHaveLength(1);
+        expect(failures[0]).toMatchObject({ id: 'deep-analysis', files: ['src/report.ts'], line: 2, provenance: 'deep-analysis', verified: true });
+    });
+    it('uses the facts prompt for an unscoped run', async () => {
+        const g = gate();
+        await g.run({ cwd });
+        expect(provider.analyze.mock.calls[0][0]).toContain('AST-EXTRACTED FACTS');
+        expect(g.getOutcome()).toMatchObject({ status: 'ok', mode: 'facts', filesAnalyzed: 2 });
+    });
+    it('is ok with no analyzable files in scope', async () => {
+        const g = gate();
+        expect(await g.run({ cwd, patterns: ['README.md'] })).toEqual([]);
+        expect(g.getOutcome()).toMatchObject({ status: 'ok', filesAnalyzed: 0 });
+        expect(provider.analyze).not.toHaveBeenCalled();
+    });
+});

package/dist/gates/deep-intent.d.ts

@@ -0,0 +1,3 @@
+import type { InferenceProvider } from '../inference/types.js';
+import type { Failure } from '../types/index.js';
+export declare function runIntentChecks(cwd: string, files: string[], provider: InferenceProvider, onProgress?: (message: string) => void): Promise<Failure[]>;

package/dist/gates/deep-intent.js

@@ -0,0 +1,57 @@
+/**
+ * Intent checks in a scoped deep review (`rigour review --deep`,
+ * `rigour check <paths> --deep`): the only questions put to the model are
+ * ones the code cannot answer, at sites the engine has already proven.
+ *
+ * Today that is optional-read-no-fallback: at an `await Promise.all([...])`
+ * with no failure handling, is one read optional while another is required?
+ * Off unless `deep.intent_checks` is set; see docs/DEEP_ANALYSIS.md for the
+ * measured accuracy that decides the default.
+ */
+import path from 'path';
+import { loadProjectConfig, programBatches } from '../semantic/program.js';
+import { findParallelReads } from '../semantic/intent/parallel-reads.js';
+import { classifyReads, findingsFor, yesNoModel } from '../semantic/intent/intent-check.js';
+/** Each read costs two model calls; bound the cost of one review. */
+const MAX_SITES = 10;
+const SOURCE = /\.(?:[cm]?[jt]s|[jt]sx)$/i;
+export async function runIntentChecks(cwd, files, provider, onProgress) {
+    const sites = findSites(cwd, files.filter(f => SOURCE.test(f) && !/\.d\.[cm]?ts$/i.test(f)));
+    if (sites.length === 0)
+        return [];
+    const checked = sites.slice(0, MAX_SITES);
+    onProgress?.(`  Asking the model about ${checked.length} Promise.all site(s)${sites.length > MAX_SITES ? ` (first ${MAX_SITES} of ${sites.length})` : ''}...`);
+    const model = yesNoModel(provider);
+    const failures = [];
+    for (const site of checked) {
+        failures.push(...findingsFor(site, await classifyReads(model, site)).map(toFailure));
+    }
+    return failures;
+}
+function findSites(cwd, files) {
+    const roots = files.map(f => path.resolve(cwd, f));
+    const wanted = new Set(roots.map(r => path.normalize(r)));
+    const sites = [];
+    for (const program of programBatches(roots, loadProjectConfig(cwd).options)) {
+        for (const sourceFile of program.getSourceFiles()) {
+            if (wanted.has(path.normalize(sourceFile.fileName)))
+                sites.push(...findParallelReads(cwd, program.getTypeChecker(), sourceFile));
+        }
+    }
+    return sites;
+}
+function toFailure(finding) {
+    return {
+        id: 'deep-analysis',
+        title: `[${finding.rule}] ${finding.message.split('. ')[0]}`.slice(0, 120),
+        details: `${finding.message}\n${finding.evidence.map(e => `  at ${e}`).join('\n')}`,
+        files: [finding.file],
+        line: finding.line,
+        hint: finding.hint,
+        severity: finding.severity,
+        provenance: finding.provenance,
+        category: finding.rule,
+        source: 'hybrid',
+        verified: false,
+    };
+}

package/dist/gates/deep-intent.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/deep-intent.test.js

@@ -0,0 +1,51 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { runIntentChecks } from './deep-intent.js';
+const DASHBOARD = [
+    'declare function getAccount(id: string): Promise<{ name: string }>;',
+    'declare function getRecommendedCourses(id: string): Promise<string[]>;',
+    'export async function loadDashboard(id: string) {',
+    '  const [account, recommended] = await Promise.all([getAccount(id), getRecommendedCourses(id)]);',
+    '  return { account, recommended };',
+    '}',
+].join('\n');
+/** Answers as if getRecommendedCourses were optional and getAccount required. */
+function provider(calls) {
+    return {
+        name: 'fake',
+        isAvailable: async () => true,
+        setup: async () => { },
+        dispose: () => { },
+        analyze: async (prompt) => {
+            calls.push(prompt);
+            const optional = /Question: [^\n]*getRecommendedCourses/.test(prompt);
+            const ifFails = prompt.includes('Question: If');
+            return JSON.stringify({ answer: ifFails === optional ? 'yes' : 'no' });
+        },
+    };
+}
+describe('runIntentChecks', () => {
+    let cwd;
+    beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'deep-intent-')); });
+    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+    it('reports an optional read that can take down a required one', async () => {
+        fs.writeFileSync(path.join(cwd, 'dashboard.ts'), DASHBOARD);
+        const calls = [];
+        const [failure, ...rest] = await runIntentChecks(cwd, ['dashboard.ts'], provider(calls));
+        expect(rest).toHaveLength(0);
+        expect(calls).toHaveLength(4);
+        expect(failure).toMatchObject({
+            id: 'deep-analysis', files: ['dashboard.ts'], line: 4, category: 'optional-read-no-fallback',
+            provenance: 'deep-analysis', source: 'hybrid', verified: false,
+        });
+        expect(failure.details).toContain('`getRecommendedCourses` looks optional');
+    });
+    it('asks nothing when no file has an unhandled Promise.all', async () => {
+        fs.writeFileSync(path.join(cwd, 'plain.ts'), 'export const x = 1;\n');
+        const calls = [];
+        expect(await runIntentChecks(cwd, ['plain.ts', 'README.md'], provider(calls))).toEqual([]);
+        expect(calls).toEqual([]);
+    });
+});

package/dist/gates/deep-runner.d.ts

@@ -0,0 +1,15 @@
+import type { GateContext } from './base.js';
+import type { Config, DeepOptions, Failure, Report, Status } from '../types/index.js';
+export interface DeepRunResult {
+    failures: Failure[];
+    summary: Status;
+    stats: NonNullable<Report['stats']['deep']>;
+}
+/**
+ * Run the deep gate and turn its outcome into summary, stats and failures.
+ * A deep run that could not analyze anything is ERROR with a visible
+ * failure, never a clean PASS.
+ */
+export declare function runDeepAnalysis(config: Config, context: Pick<GateContext, 'cwd' | 'ignore' | 'patterns'>, deepOptions: DeepOptions & {
+    onProgress?: (msg: string) => void;
+}): Promise<DeepRunResult>;

package/dist/gates/deep-runner.js

@@ -0,0 +1,66 @@
+/**
+ * Deep analysis as the gate runner reports it: summary status, report stats
+ * and failures, derived from the deep gate's outcome.
+ */
+import { DeepAnalysisGate } from './deep-analysis.js';
+import { Logger } from '../utils/logger.js';
+/**
+ * Run the deep gate and turn its outcome into summary, stats and failures.
+ * A deep run that could not analyze anything is ERROR with a visible
+ * failure, never a clean PASS.
+ */
+export async function runDeepAnalysis(config, context, deepOptions) {
+    const start = Date.now();
+    const deepGate = new DeepAnalysisGate({
+        options: deepOptions,
+        checks: config.gates.deep?.checks,
+        threads: config.gates.deep?.threads,
+        maxTokens: config.gates.deep?.max_tokens,
+        temperature: config.gates.deep?.temperature,
+        timeoutMs: config.gates.deep?.timeout_ms,
+        intentChecks: config.gates.deep?.intent_checks,
+        onProgress: deepOptions.onProgress,
+    });
+    let findings = [];
+    let thrown;
+    try {
+        findings = await deepGate.run(context);
+    }
+    catch (error) {
+        thrown = error?.message ?? String(error);
+        Logger.error(`Deep analysis failed: ${thrown}`);
+    }
+    // A gate that threw produced nothing: never report its last outcome as ok.
+    const outcome = thrown ? { ...deepGate.getOutcome(), status: 'error', error: thrown } : deepGate.getOutcome();
+    const isLocal = !deepOptions.apiKey || (deepOptions.provider || '').toLowerCase() === 'local';
+    const stats = {
+        enabled: true,
+        status: outcome.status,
+        mode: outcome.mode,
+        tier: isLocal ? (deepOptions.pro ? 'deep' : 'lite') : 'cloud',
+        model: outcome.model,
+        model_fallback: outcome.modelFallback,
+        total_ms: Date.now() - start,
+        files_analyzed: outcome.filesAnalyzed,
+        chunks_total: outcome.chunksTotal,
+        chunks_failed: outcome.chunksFailed,
+        error: outcome.error,
+        findings_count: findings.length,
+        findings_verified: findings.filter(f => f.verified).length,
+    };
+    if (outcome.status === 'error') {
+        return {
+            failures: [{
+                    id: 'deep-analysis',
+                    title: 'Deep analysis did not run',
+                    details: outcome.error || 'Deep analysis failed before producing results.',
+                    severity: 'medium',
+                    provenance: 'traditional',
+                    hint: 'Run `rigour doctor`. For local mode, `rigour deep pull` installs the engine and model.',
+                }],
+            summary: 'ERROR',
+            stats,
+        };
+    }
+    return { failures: findings, summary: findings.length > 0 ? 'FAIL' : 'PASS', stats };
+}

package/dist/gates/dependency.js

@@ -18,6 +18,7 @@ import path from 'path';
 import { Gate } from './base.js';
 import { FileScanner } from '../utils/scanner.js';
 import { Logger } from '../utils/logger.js';
+import { scopeExcludes } from '../utils/scope.js';
 /**
  * Known heavy packages with lighter alternatives.
  * Format: package → "alternative (size comparison)"
@@ -84,6 +85,9 @@ export class DependencyGate extends Gate {
         const depConfig = this.config.gates.dependencies || {};
         const forbidden = depConfig.forbid || [];
         const { cwd } = context;
+        // Dependency health belongs to the manifest: a scoped run checks it only with package.json in scope.
+        if (await scopeExcludes(context, 'package.json'))
+            return [];
         // 1. Scan Node.js (package.json) — forbidden + new checks
         const pkgPath = path.join(cwd, 'package.json');
         if (await fs.pathExists(pkgPath)) {

package/dist/gates/deprecated-apis-ast.d.ts

@@ -0,0 +1,8 @@
+export interface AstDeprecation {
+    line: number;
+    api: string;
+    reason: string;
+    replacement: string;
+    category: 'removed';
+}
+export declare function findWithStatements(content: string, file: string): AstDeprecation[];

package/dist/gates/deprecated-apis-ast.js

@@ -0,0 +1,25 @@
+/**
+ * Deprecated JS/TS constructs that need the syntax tree to detect reliably.
+ *
+ * A `with` statement is found from the parsed tree, so the words "with (" in
+ * a comment, a string or an identifier never match.
+ */
+import ts from 'typescript';
+export function findWithStatements(content, file) {
+    const source = ts.createSourceFile(file, content, ts.ScriptTarget.Latest, true);
+    const found = [];
+    const visit = (node) => {
+        if (node.kind === ts.SyntaxKind.WithStatement) {
+            found.push({
+                line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+                api: 'with statement',
+                reason: 'Removed in strict mode, creates ambiguous scope, security risk',
+                replacement: 'Destructuring or explicit property access',
+                category: 'removed',
+            });
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return found;
+}

package/dist/gates/deprecated-apis-rules-node.js

@@ -15,7 +15,8 @@ export const NODE_DEPRECATED_RULES = [
         category: 'security',
     },
     {
-        pattern: /Buffer\s*\(\s*(?:\d|['"])/,
+        // Not ArrayBuffer(n) / SharedArrayBuffer(n) / x.Buffer(...).
+        pattern: /(?<![\w$.])Buffer\s*\(\s*(?:\d|['"])/,
         api: 'Buffer() constructor',
         reason: 'DEP0005: Security vulnerability — uninitialized memory exposure',
         replacement: 'Buffer.from(), Buffer.alloc(), or Buffer.allocUnsafe()',
@@ -168,13 +169,6 @@ export const WEB_DEPRECATED_RULES = [
         replacement: 'JSON.parse(), Function constructor (if absolutely needed), or structured approach',
         category: 'security',
     },
-    {
-        pattern: /with\s*\(\s*\w/,
-        api: 'with statement',
-        reason: 'Removed in strict mode, creates ambiguous scope, security risk',
-        replacement: 'Destructuring or explicit property access',
-        category: 'removed',
-    },
     {
         pattern: /document\.all\b/,
         api: 'document.all',

package/dist/gates/deprecated-apis.js

@@ -22,6 +22,7 @@ import { Gate } from './base.js';
 import { FileScanner } from '../utils/scanner.js';
 import { Logger } from '../utils/logger.js';
 import { languageAdapters } from './language-adapters/index.js';
+import { findWithStatements } from './deprecated-apis-ast.js';
 import fs from 'fs-extra';
 import path from 'path';
 import { NODE_DEPRECATED_RULES, WEB_DEPRECATED_RULES, PYTHON_DEPRECATED_RULES, GO_DEPRECATED_RULES, CSHARP_DEPRECATED_RULES, JAVA_DEPRECATED_RULES } from './deprecated-apis-rules.js';
@@ -81,8 +82,11 @@ export class DeprecatedApisGate extends Gate {
                     case 'js':
                         if (this.config.check_node)
                             this.checkNodeDeprecated(content, file, deprecated);
-                        if (this.config.check_web)
+                        if (this.config.check_web) {
                             this.checkWebDeprecated(content, file, deprecated);
+                            for (const w of findWithStatements(content, file))
+                                deprecated.push({ file, ...w });
+                        }
                         break;
                     case 'python':
                         this.checkPythonDeprecated(content, file, deprecated);

package/dist/gates/deprecated-apis.test.js

@@ -286,3 +286,33 @@ class Resource {
         expect(failures[0].details).toContain('finalize');
     });
 });
+describe('DeprecatedApisGate — word fragments and non-code text', () => {
+    let gate;
+    beforeEach(() => {
+        gate = new DeprecatedApisGate();
+        vi.clearAllMocks();
+    });
+    async function apisFor(file, source) {
+        mockFindFiles.mockResolvedValue([file]);
+        mockReadFile.mockResolvedValue(source);
+        const failures = await gate.run({ cwd: '/project' });
+        return failures.map(f => f.details).join('\n');
+    }
+    it('does not flag ArrayBuffer or SharedArrayBuffer as the Buffer() constructor', async () => {
+        const details = await apisFor('src/lib/ingestion-proxy.ts', 'const empty = new ArrayBuffer(0);\nconst shared = new SharedArrayBuffer(8);\n');
+        expect(details).not.toContain('Buffer() constructor');
+    });
+    it('still flags a bare Buffer() constructor call', async () => {
+        expect(await apisFor('src/handler.js', "const b = Buffer(10);\n")).toContain('Buffer() constructor');
+    });
+    it('does not flag "with (" inside a trailing comment or a string', async () => {
+        const details = await apisFor('src/lib/aliases.ts', [
+            "const pattern = compile(source); // match with (optional) prefix",
+            "const label = 'works with (legacy) clients';",
+        ].join('\n'));
+        expect(details).not.toContain('with statement');
+    });
+    it('still flags a real with statement', async () => {
+        expect(await apisFor('src/legacy.js', 'with (obj) {\n  x = 1;\n}\n')).toContain('with statement');
+    });
+});

package/dist/gates/frontend-secret-exposure.js

@@ -62,8 +62,12 @@ export class FrontendSecretExposureGate extends Gate {
                 '(^|/)e2e/',
                 '(^|/)tests/',
                 '(^|/)server/',
-                '(^|/)(?:playwright|vitest|vite|jest|next|webpack|eslint|prettier|tailwind|postcss|babel|tsup|rollup)\\.config\\.[cm]?[jt]s$',
+                '(^|/)(?:playwright|vitest|vite|jest|next|webpack|eslint|prettier|tailwind|postcss|babel|tsup|rollup|drizzle|svelte|astro|nuxt|remix|wrangler|knip|commitlint|esbuild|turbo)\\.config\\.[cm]?[jt]s$',
+                // Any tool config at the repository root runs in Node, never in a browser bundle.
+                '^[^/]+\\.config\\.[cm]?[jt]s$',
                 '\\.server\\.(?:ts|tsx|js|jsx|mjs|cjs)$',
+                // SvelteKit endpoints (`+server.ts`) are server-only.
+                '(^|/)\\+server\\.[cm]?[jt]s$',
                 ...(config.server_path_patterns ?? []),
             ],
             allowlist_env_names: config.allowlist_env_names ?? [],

package/dist/gates/frontend-secret-exposure.test.js

@@ -108,4 +108,24 @@ describe('FrontendSecretExposureGate', () => {
         const failures = await gate.run({ cwd: testDir });
         expect(failures).toHaveLength(0);
     });
+    it('treats SvelteKit endpoints and root tool configs as server code', async () => {
+        const files = {
+            'src/routes/api/sync/+server.ts': 'export const GET = () => fetch(url, { headers: { key: process.env.STRIPE_SECRET_KEY } });\n',
+            'drizzle.config.ts': 'export default { dbCredentials: { url: process.env.DATABASE_SECRET_URL } };\n',
+            'apps/web/drizzle.config.ts': 'export default { dbCredentials: { url: process.env.DATABASE_SECRET_URL } };\n',
+        };
+        for (const [rel, body] of Object.entries(files)) {
+            fs.mkdirSync(path.dirname(path.join(testDir, rel)), { recursive: true });
+            fs.writeFileSync(path.join(testDir, rel), body);
+        }
+        const failures = await new FrontendSecretExposureGate().run({ cwd: testDir });
+        expect(failures).toHaveLength(0);
+    });
+    it('still flags a secret in a config module inside the client source tree', async () => {
+        const filePath = path.join(testDir, 'src/components/site.config.ts');
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        fs.writeFileSync(filePath, 'export const key = process.env.STRIPE_SECRET_KEY;\n');
+        const failures = await new FrontendSecretExposureGate().run({ cwd: testDir });
+        expect(failures.length).toBeGreaterThan(0);
+    });
 });

package/dist/gates/hallucinated-imports/framework-modules.d.ts

@@ -0,0 +1,14 @@
+/** SvelteKit project root for a file (nearest package.json depending on the kit), cached per directory. */
+export declare class SvelteKitRoots {
+    private readonly cwd;
+    private cache;
+    constructor(cwd: string);
+    rootFor(file: string): Promise<string | null>;
+}
+/** `$app/*`, `$env/*`, `$service-worker`, or a route's generated `./$types`. */
+export declare function isSvelteKitProvided(importPath: string): boolean;
+/**
+ * Resolve `$lib` / `$lib/...` to the kit's default `src/lib` folder.
+ * Returns null when the import is not a `$lib` import.
+ */
+export declare function resolveSvelteKitLib(importPath: string, kitRoot: string, cwd: string, projectFiles: Set<string>): Promise<boolean | null>;

package/dist/gates/hallucinated-imports/framework-modules.js

@@ -0,0 +1,75 @@
+/**
+ * Framework-provided modules that no package.json or tsconfig declares.
+ *
+ * SvelteKit supplies `$app/*`, `$env/*` and `$service-worker` as virtual
+ * modules and generates each route's `./$types`. Its `$lib` alias lives in
+ * `.svelte-kit/tsconfig.json`, which `svelte-kit sync` generates and git
+ * ignores, so on a fresh clone or in CI the tsconfig mapping is missing and
+ * `$lib/...` would be read as an uninstalled package.
+ */
+import fs from 'fs-extra';
+import path from 'path';
+import { resolveTsPathTarget } from './ts-path-target.js';
+const SVELTEKIT_PACKAGE = '@sveltejs/kit';
+const SVELTEKIT_VIRTUAL = /^(?:\$app|\$env)\/|^\$service-worker$/;
+const GENERATED_TYPES = /^\.{1,2}\/(?:.*\/)?\$types(?:\.d\.ts|\.js)?$/;
+const LIB_ALIAS = /^\$lib(?:\/(.*))?$/;
+/** SvelteKit project root for a file (nearest package.json depending on the kit), cached per directory. */
+export class SvelteKitRoots {
+    cwd;
+    cache = new Map();
+    constructor(cwd) {
+        this.cwd = cwd;
+    }
+    async rootFor(file) {
+        const top = path.resolve(this.cwd);
+        const visited = [];
+        let dir = path.dirname(path.resolve(this.cwd, file));
+        let found = null;
+        while (dir.startsWith(top)) {
+            if (this.cache.has(dir)) {
+                found = this.cache.get(dir) ?? null;
+                break;
+            }
+            visited.push(dir);
+            if (await declaresKit(path.join(dir, 'package.json'))) {
+                found = dir;
+                break;
+            }
+            const parent = path.dirname(dir);
+            if (parent === dir)
+                break;
+            dir = parent;
+        }
+        for (const d of visited)
+            this.cache.set(d, found);
+        return found;
+    }
+}
+async function declaresKit(packageJsonPath) {
+    if (!(await fs.pathExists(packageJsonPath)))
+        return false;
+    try {
+        const pkg = await fs.readJson(packageJsonPath);
+        return [pkg?.dependencies, pkg?.devDependencies, pkg?.peerDependencies]
+            .some(deps => !!deps && Object.prototype.hasOwnProperty.call(deps, SVELTEKIT_PACKAGE));
+    }
+    catch {
+        return false;
+    }
+}
+/** `$app/*`, `$env/*`, `$service-worker`, or a route's generated `./$types`. */
+export function isSvelteKitProvided(importPath) {
+    return SVELTEKIT_VIRTUAL.test(importPath) || GENERATED_TYPES.test(importPath);
+}
+/**
+ * Resolve `$lib` / `$lib/...` to the kit's default `src/lib` folder.
+ * Returns null when the import is not a `$lib` import.
+ */
+export async function resolveSvelteKitLib(importPath, kitRoot, cwd, projectFiles) {
+    const match = importPath.match(LIB_ALIAS);
+    if (!match)
+        return null;
+    const target = match[1] ? path.join('src/lib', match[1]) : 'src/lib';
+    return resolveTsPathTarget(kitRoot, target, cwd, projectFiles);
+}

package/dist/gates/hallucinated-imports/index.js

@@ -24,6 +24,7 @@ import fs from 'fs-extra';
 import path from 'path';
 import { checkGoImports, checkRubyImports, checkCSharpImports, checkRustImports, checkJavaKotlinImports } from '../hallucinated-imports-lang.js';
 import { checkJSImports } from './js-resolver.js';
+import { SvelteKitRoots } from './framework-modules.js';
 import { checkPyImports } from './python-resolver.js';
 import { discoverWorkspacePackages, loadPackageJson } from './manifest-discovery.js';
 export class HallucinatedImportsGate extends Gate {
@@ -47,6 +48,8 @@ export class HallucinatedImportsGate extends Gate {
         const failures = [];
         const hallucinated = [];
         const defaultPatterns = ['**/*.{ts,js,tsx,jsx,py,go,rb,cs,rs,java,kt}'];
+        // Imports can target component files that are not scanned themselves.
+        const resolutionPatterns = ['**/*.{ts,js,tsx,jsx,mjs,cjs,py,go,rb,cs,rs,java,kt,svelte,vue,astro}'];
         const scanPatterns = context.patterns || defaultPatterns;
         const ignore = [...(context.ignore || []), '**/node_modules/**', '**/dist/**', '**/build/**',
             '**/examples/**', '**/studio-dist/**', '**/.next/**', '**/coverage/**',
@@ -60,11 +63,9 @@ export class HallucinatedImportsGate extends Gate {
         });
         const analyzableFiles = files.filter(file => !this.shouldSkipFile(file));
         Logger.info(`Hallucinated Imports: Scanning ${analyzableFiles.length} files`);
-        // A scoped review scans changed files, but relative imports may point
-        // to unchanged files. Resolve against the project, not the edit set.
-        const resolutionFiles = context.patterns
-            ? await FileScanner.findFiles({ cwd: context.cwd, patterns: defaultPatterns, ignore })
-            : files;
+        // Resolve against the whole project, not the scanned set: a scoped
+        // review scans changed files only, and imports may target components.
+        const resolutionFiles = await FileScanner.findFiles({ cwd: context.cwd, patterns: resolutionPatterns, ignore });
         const projectFiles = new Set(resolutionFiles.map(f => f.replace(/\\/g, '/')));
         const allProjectFiles = projectFiles;
         const packageJson = await loadPackageJson(context.cwd);
@@ -80,6 +81,13 @@ export class HallucinatedImportsGate extends Gate {
         const depCacheByDir = new Map();
         const tsPathCacheByDir = new Map();
         const hasNodeModules = await fs.pathExists(path.join(context.cwd, 'node_modules'));
+        const jsContext = {
+            cwd: context.cwd, projectFiles, rootDeps, depCacheByDir, hasNodeModules, hallucinated, tsPathCacheByDir,
+            kitRoots: new SvelteKitRoots(context.cwd),
+            shouldIgnore: (importPath) => this.shouldIgnore(importPath),
+            resolveRelativeImport: (fromFile, importPath, files) => this.resolveRelativeImport(fromFile, importPath, files),
+            extractPackageName: (importPath) => this.extractPackageName(importPath),
+        };
         for (const file of analyzableFiles) {
             try {
                 const fullPath = path.join(context.cwd, file);
@@ -90,7 +98,7 @@ export class HallucinatedImportsGate extends Gate {
                     continue;
                 switch (adapter.id) {
                     case 'js':
-                        await checkJSImports(content, file, context.cwd, projectFiles, rootDeps, depCacheByDir, hasNodeModules, hallucinated, tsPathCacheByDir, (importPath) => this.shouldIgnore(importPath), (resolvedPath) => this.buildImportCandidates(resolvedPath), (fromFile, importPath, files) => this.resolveRelativeImport(fromFile, importPath, files), (importPath) => this.extractPackageName(importPath));
+                        await checkJSImports(content, file, jsContext);
                         break;
                     case 'python':
                         await checkPyImports(content, file, context.cwd, projectFiles, hallucinated);