@rigour-labs/core 6.2.4 → 6.3.0

package/dist/gates/runner.js

@@ -1,5 +1,5 @@
 import { SEVERITY_WEIGHTS } from '../types/index.js';
-import { DeepAnalysisGate } from './deep-analysis.js';
+import { runDeepAnalysis } from './deep-runner.js';
 import { persistAndReinforce } from '../storage/local-memory.js';
 import { recordGateRun } from '../services/adaptive-thresholds.js';
 import { FileGate } from './file.js';
@@ -27,6 +27,7 @@ import { DeprecatedApisGate } from './deprecated-apis.js';
 import { TestQualityGate } from './test-quality.js';
 import { SideEffectAnalysisGate } from './side-effect-analysis/index.js';
 import { StyleDriftGate } from './style-drift.js';
+import { SemanticBugsGate } from './semantic-bugs.js';
 import { LogicDriftGate } from './logic-drift.js';
 import { execa } from 'execa';
 import { Logger } from '../utils/logger.js';
@@ -68,6 +69,10 @@ export class GateRunner {
         if (this.config.gates.checkpoint?.enabled) {
             this.gates.push(new CheckpointGate(this.config.gates.checkpoint));
         }
+        // Semantic Bugs Gate (type-aware, proven findings) — opt-in until field-validated
+        if (this.config.gates.semantic_bugs?.enabled) {
+            this.gates.push(new SemanticBugsGate(this.config.gates.semantic_bugs));
+        }
         // Security Patterns Gate (code-level vulnerability detection) — enabled by default since v2.15
         if (this.config.gates.security?.enabled !== false) {
             this.gates.push(new SecurityPatternsGate(this.config.gates.security));
@@ -200,45 +205,10 @@ export class GateRunner {
         // 3. Run Deep Analysis (if enabled)
         let deepStats = undefined;
         if (deepOptions?.enabled) {
-            const deepSetupStart = Date.now();
-            const deepGate = new DeepAnalysisGate({
-                options: deepOptions,
-                checks: this.config.gates.deep?.checks,
-                threads: this.config.gates.deep?.threads,
-                maxTokens: this.config.gates.deep?.max_tokens,
-                temperature: this.config.gates.deep?.temperature,
-                timeoutMs: this.config.gates.deep?.timeout_ms,
-                onProgress: deepOptions.onProgress,
-            });
-            try {
-                const deepFailures = await deepGate.run({ cwd, ignore, patterns });
-                if (deepFailures.length > 0) {
-                    failures.push(...deepFailures);
-                    summary['deep-analysis'] = 'FAIL';
-                }
-                else {
-                    summary['deep-analysis'] = 'PASS';
-                }
-                const isLocalDeepExecution = !deepOptions.apiKey || (deepOptions.provider || '').toLowerCase() === 'local';
-                const deepTier = isLocalDeepExecution
-                    ? (deepOptions.pro ? 'deep' : 'lite')
-                    : 'cloud';
-                deepStats = {
-                    enabled: true,
-                    tier: deepTier,
-                    model: isLocalDeepExecution
-                        ? (deepOptions.pro ? 'Qwen2.5-Coder-1.5B' : 'Qwen2.5-Coder-0.5B')
-                        : (deepOptions.modelName || deepOptions.provider || 'cloud'),
-                    total_ms: Date.now() - deepSetupStart,
-                    findings_count: deepFailures.length,
-                    findings_verified: deepFailures.filter((f) => f.verified).length,
-                };
-            }
-            catch (error) {
-                Logger.error(`Deep analysis failed: ${error.message}`);
-                summary['deep-analysis'] = 'ERROR';
-                deepStats = { enabled: true };
-            }
+            const deep = await runDeepAnalysis(this.config, { cwd, ignore, patterns }, deepOptions);
+            failures.push(...deep.failures);
+            summary['deep-analysis'] = deep.summary;
+            deepStats = deep.stats;
         }
         const status = failures.length > 0 ? 'FAIL' : 'PASS';
         // Severity-weighted scoring with per-gate cap and deduplication

package/dist/gates/runner.test.js

@@ -4,6 +4,12 @@ import path from 'path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { GateRunner } from './runner.js';
 import { DeepAnalysisGate } from './deep-analysis.js';
+function mockDeep(outcome, failures = []) {
+    vi.spyOn(DeepAnalysisGate.prototype, 'run').mockResolvedValue(failures);
+    vi.spyOn(DeepAnalysisGate.prototype, 'getOutcome').mockReturnValue({
+        status: 'ok', mode: 'facts', filesAnalyzed: 1, chunksTotal: 1, chunksFailed: 0, ...outcome,
+    });
+}
 describe('GateRunner deep stats execution mode', () => {
     let testDir;
     beforeEach(async () => {
@@ -25,41 +31,47 @@ describe('GateRunner deep stats execution mode', () => {
             },
         });
     }
-    it('reports local lite tier when provider=local even with apiKey', async () => {
-        vi.spyOn(DeepAnalysisGate.prototype, 'run').mockResolvedValue([]);
-        const runner = createRunner();
-        const report = await runner.run(testDir, undefined, {
-            enabled: true,
-            apiKey: 'sk-test',
-            provider: 'local',
-            pro: false,
+    it('reports local lite tier and the model the provider actually loaded', async () => {
+        mockDeep({ model: 'Qwen2.5-Coder-0.5B-Instruct (stock)', modelFallback: true });
+        const report = await createRunner().run(testDir, undefined, {
+            enabled: true, apiKey: 'sk-test', provider: 'local', pro: false,
         });
         expect(report.stats.deep?.tier).toBe('lite');
-        expect(report.stats.deep?.model).toBe('Qwen2.5-Coder-0.5B');
+        expect(report.stats.deep?.model).toBe('Qwen2.5-Coder-0.5B-Instruct (stock)');
+        expect(report.stats.deep?.model_fallback).toBe(true);
+        expect(report.stats.deep?.status).toBe('ok');
+        expect(report.summary['deep-analysis']).toBe('PASS');
     });
     it('reports local deep tier when provider=local and pro=true', async () => {
-        vi.spyOn(DeepAnalysisGate.prototype, 'run').mockResolvedValue([]);
-        const runner = createRunner();
-        const report = await runner.run(testDir, undefined, {
-            enabled: true,
-            apiKey: 'sk-test',
-            provider: 'local',
-            pro: true,
+        mockDeep({ model: 'Rigour-Deep-v5.0.0 (Qwen2.5-Coder-1.5B fine-tuned)', modelFallback: false });
+        const report = await createRunner().run(testDir, undefined, {
+            enabled: true, apiKey: 'sk-test', provider: 'local', pro: true,
         });
         expect(report.stats.deep?.tier).toBe('deep');
-        expect(report.stats.deep?.model).toBe('Qwen2.5-Coder-1.5B');
+        expect(report.stats.deep?.model).toBe('Rigour-Deep-v5.0.0 (Qwen2.5-Coder-1.5B fine-tuned)');
     });
     it('reports cloud tier/model for cloud providers', async () => {
-        vi.spyOn(DeepAnalysisGate.prototype, 'run').mockResolvedValue([]);
-        const runner = createRunner();
-        const report = await runner.run(testDir, undefined, {
-            enabled: true,
-            apiKey: 'sk-test',
-            provider: 'openai',
-            modelName: 'gpt-4.1-mini',
-            pro: false,
+        mockDeep({ model: 'gpt-4.1-mini' });
+        const report = await createRunner().run(testDir, undefined, {
+            enabled: true, apiKey: 'sk-test', provider: 'openai', modelName: 'gpt-4.1-mini', pro: false,
         });
         expect(report.stats.deep?.tier).toBe('cloud');
         expect(report.stats.deep?.model).toBe('gpt-4.1-mini');
     });
+    it('reports a deep run that could not analyze anything as ERROR with a visible failure', async () => {
+        mockDeep({ status: 'error', chunksTotal: 3, chunksFailed: 3, error: 'All 3 inference call(s) failed.' });
+        const report = await createRunner().run(testDir, undefined, { enabled: true, pro: false });
+        expect(report.summary['deep-analysis']).toBe('ERROR');
+        expect(report.status).toBe('FAIL');
+        expect(report.stats.deep).toMatchObject({ status: 'error', chunks_total: 3, chunks_failed: 3, error: 'All 3 inference call(s) failed.' });
+        const failure = report.failures.find(f => f.id === 'deep-analysis');
+        expect(failure?.title).toBe('Deep analysis did not run');
+        expect(failure?.details).toContain('All 3 inference call(s) failed.');
+    });
+    it('keeps a partial run as PASS/FAIL by findings and records failed chunks', async () => {
+        mockDeep({ status: 'partial', chunksTotal: 4, chunksFailed: 1 });
+        const report = await createRunner().run(testDir, undefined, { enabled: true, pro: false });
+        expect(report.summary['deep-analysis']).toBe('PASS');
+        expect(report.stats.deep).toMatchObject({ status: 'partial', chunks_total: 4, chunks_failed: 1 });
+    });
 });

package/dist/gates/scoped-gates.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/scoped-gates.test.js

@@ -0,0 +1,52 @@
+import fs from 'fs-extra';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { ContextGate } from './context.js';
+import { DependencyGate } from './dependency.js';
+import { LogicDriftGate } from './logic-drift.js';
+import { StyleDriftGate } from './style-drift.js';
+describe('gates on a scoped run', () => {
+    let cwd;
+    beforeEach(async () => { cwd = await fs.mkdtemp(path.join(os.tmpdir(), 'rigour-scoped-')); });
+    afterEach(async () => { await fs.remove(cwd); });
+    it('context-drift reports only findings that cite a file in scope', async () => {
+        await fs.outputFile(path.join(cwd, 'src/a.ts'), 'export const a = process.env.API_URL_PROD;\n');
+        await fs.outputFile(path.join(cwd, 'src/b.ts'), 'export const b = process.env.API_URL_STAGING;\n');
+        const gate = new ContextGate({ context: { enabled: true } });
+        const record = { anchors: [{ type: 'env', id: 'API_URL', confidence: 1 }] };
+        const unscoped = await gate.run({ cwd, record });
+        const scoped = await gate.run({ cwd, record, patterns: ['src/a.ts'] });
+        expect(unscoped.flatMap(f => f.files)).toEqual(expect.arrayContaining(['src/a.ts', 'src/b.ts']));
+        expect(scoped.length).toBeGreaterThan(0);
+        expect(scoped.every(f => f.files?.includes('src/a.ts'))).toBe(true);
+    });
+    it('dependency-guardian checks the manifest only when package.json is in scope', async () => {
+        await fs.outputJson(path.join(cwd, 'package.json'), { dependencies: { 'left-pad': '1.0.0' } });
+        await fs.outputFile(path.join(cwd, 'src/a.ts'), "import pad from 'left-pad';\n");
+        const gate = new DependencyGate({ gates: { dependencies: { forbid: ['left-pad'] } } });
+        expect(await gate.run({ cwd, patterns: ['src/a.ts'] })).toEqual([]);
+        const withManifest = await gate.run({ cwd, patterns: ['package.json'] });
+        expect(withManifest.some(f => f.title === 'Forbidden Dependency')).toBe(true);
+    });
+    it('logic-drift never creates or rewrites its baseline from a scoped run', async () => {
+        const baseline = path.join(cwd, '.rigour/logic-baseline.json');
+        await fs.outputFile(path.join(cwd, 'src/rules.ts'), 'export function eligible(score: number) { return score >= 10; }\n');
+        await fs.outputFile(path.join(cwd, 'src/other.ts'), 'export function other(n: number) { return n > 1; }\n');
+        const gate = new LogicDriftGate();
+        expect(await gate.run({ cwd, patterns: ['src/rules.ts'] })).toEqual([]);
+        expect(await fs.pathExists(baseline)).toBe(false);
+        await gate.run({ cwd });
+        const before = await fs.readFile(baseline, 'utf-8');
+        await fs.outputFile(path.join(cwd, 'src/rules.ts'), 'export function eligible(score: number) { return score > 10; }\n');
+        const scoped = await gate.run({ cwd, patterns: ['src/rules.ts'] });
+        expect(scoped.some(f => f.details.includes("'>=' to '>'"))).toBe(true);
+        expect(await fs.readFile(baseline, 'utf-8')).toBe(before);
+    });
+    it('style-drift does not create its baseline from a scoped run', async () => {
+        await fs.outputFile(path.join(cwd, 'src/a.ts'), 'export function doThing() { return 1; }\n');
+        const gate = new StyleDriftGate();
+        expect(await gate.run({ cwd, patterns: ['src/a.ts'] })).toEqual([]);
+        expect(await fs.pathExists(path.join(cwd, '.rigour/style-baseline.json'))).toBe(false);
+    });
+});

package/dist/gates/semantic-bugs.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Semantic Bugs Gate: type-aware rules that prove a defect before reporting it.
+ *
+ * Each rule traces a value from where it enters to where it does harm, across
+ * files when needed (see src/semantic/). A finding names both ends; anything
+ * the engine cannot resolve produces no finding.
+ */
+import { Gate, GateContext } from './base.js';
+import { Failure, Provenance } from '../types/index.js';
+export interface SemanticBugsConfig {
+    enabled?: boolean;
+    /** Rule ids to run (`learned/<id>` for a learned rule); all rules when omitted. */
+    rules?: string[];
+}
+export declare class SemanticBugsGate extends Gate {
+    private readonly config;
+    constructor(config?: SemanticBugsConfig);
+    protected get provenance(): Provenance;
+    run(context: GateContext): Promise<Failure[]>;
+    /** Built-in rules plus the repository's learned rules (`.rigour/rules/`), filtered by config. */
+    private selectRules;
+    private toFailure;
+}

package/dist/gates/semantic-bugs.js

@@ -0,0 +1,48 @@
+/**
+ * Semantic Bugs Gate: type-aware rules that prove a defect before reporting it.
+ *
+ * Each rule traces a value from where it enters to where it does harm, across
+ * files when needed (see src/semantic/). A finding names both ends; anything
+ * the engine cannot resolve produces no finding.
+ */
+import { Gate } from './base.js';
+import { FileScanner } from '../utils/scanner.js';
+import { Logger } from '../utils/logger.js';
+import { analyzeFiles, BUILT_IN_RULES } from '../semantic/engine.js';
+import { compileLearnedRule, LEARNED_PREFIX } from '../semantic/learn/compile.js';
+import { loadLearnedRules } from '../semantic/learn/store.js';
+const SOURCE_PATTERNS = ['**/*.{ts,tsx,js,jsx,mjs,cjs,mts,cts}'];
+const TEST_FILE = /(?:^|\/)(?:__tests__|__mocks__|tests?)\/|\.(?:test|spec)\.[cm]?[jt]sx?$/;
+export class SemanticBugsGate extends Gate {
+    config;
+    constructor(config = {}) {
+        super('semantic-bugs', 'Semantic Bug Detection');
+        this.config = config;
+    }
+    get provenance() { return 'traditional'; }
+    async run(context) {
+        const files = (await FileScanner.findFiles({
+            cwd: context.cwd,
+            patterns: context.patterns || SOURCE_PATTERNS,
+            ignore: context.ignore,
+        })).filter(file => /\.(?:[cm]?[jt]s|[jt]sx)$/i.test(file) && !/\.d\.[cm]?ts$/i.test(file) && !TEST_FILE.test(file));
+        if (files.length === 0)
+            return [];
+        const rules = this.selectRules(context.cwd);
+        if (rules.length === 0)
+            return [];
+        Logger.info(`Semantic Bugs: analyzing ${files.length} files with ${rules.length} rule(s)`);
+        return analyzeFiles(context.cwd, files, { rules }).map(finding => this.toFailure(finding));
+    }
+    /** Built-in rules plus the repository's learned rules (`.rigour/rules/`), filtered by config. */
+    selectRules(cwd) {
+        const all = [...BUILT_IN_RULES, ...loadLearnedRules(cwd).map(compileLearnedRule)];
+        const wanted = this.config.rules;
+        return wanted?.length ? all.filter(rule => wanted.includes(rule.id)) : all;
+    }
+    toFailure(finding) {
+        const failure = this.createFailure(`${finding.message}\n${finding.evidence.map(e => `  at ${e}`).join('\n')}`, [finding.file], finding.hint, `[${finding.rule}] ${finding.message.split('. ')[0]}`.slice(0, 120), finding.line, undefined, finding.severity);
+        const category = finding.rule.startsWith(LEARNED_PREFIX) ? 'learned-rule' : finding.rule;
+        return { ...failure, provenance: finding.provenance, source: 'ast', category, verified: true, confidence: 1 };
+    }
+}

package/dist/gates/semantic-bugs.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/semantic-bugs.test.js

@@ -0,0 +1,70 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { SemanticBugsGate } from './semantic-bugs.js';
+import { GateRunner } from './runner.js';
+const LEAKY = [
+    'export async function notify(endpoint: string, signature: string) {',
+    "  return fetch(endpoint, { method: 'POST', headers: { 'x-hook-signature': signature } });",
+    '}',
+].join('\n');
+describe('SemanticBugsGate', () => {
+    let cwd;
+    beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'semantic-gate-')); });
+    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+    function write(rel, body) {
+        fs.mkdirSync(path.dirname(path.join(cwd, rel)), { recursive: true });
+        fs.writeFileSync(path.join(cwd, rel), body);
+    }
+    it('reports a proven finding with its evidence, rule and verified metadata', async () => {
+        write('src/notify.ts', LEAKY);
+        const [failure, ...rest] = await new SemanticBugsGate().run({ cwd });
+        expect(rest).toHaveLength(0);
+        expect(failure).toMatchObject({
+            id: 'semantic-bugs', files: ['src/notify.ts'], line: 2, severity: 'high',
+            provenance: 'security', source: 'ast', category: 'credential-redirect', verified: true, confidence: 1,
+        });
+        expect(failure.title).toMatch(/^\[credential-redirect\]/);
+        expect(failure.details).toContain('at src/notify.ts:2');
+    });
+    it('skips test files and declaration files', async () => {
+        write('src/notify.test.ts', LEAKY);
+        write('src/__tests__/notify.ts', LEAKY);
+        write('types/notify.d.ts', 'export declare function notify(): void;\n');
+        expect(await new SemanticBugsGate().run({ cwd })).toEqual([]);
+    });
+    it('honours a scoped run', async () => {
+        write('src/notify.ts', LEAKY);
+        write('src/other.ts', LEAKY);
+        const failures = await new SemanticBugsGate().run({ cwd, patterns: ['src/other.ts'] });
+        expect(failures.map(f => f.files?.[0])).toEqual(['src/other.ts']);
+    });
+    it('runs only the configured rules', async () => {
+        write('src/notify.ts', LEAKY);
+        expect(await new SemanticBugsGate({ rules: ['in-memory-aggregation'] }).run({ cwd })).toEqual([]);
+    });
+    it('runs learned rules from .rigour/rules next to the built-in ones', async () => {
+        write('src/load.ts', "export const load = (url: string) => fetch(url, { method: 'GET' });\n");
+        write('.rigour/rules/require-option-redirect-abcd1234.json', JSON.stringify({
+            id: 'require-option-redirect-abcd1234', version: 1,
+            pattern: { template: 'require-option', callee: { level: 'name', key: 'fetch' }, argIndex: 1, property: 'redirect' },
+            message: 'fetch(...) does not set `redirect`.', severity: 'medium',
+            source: { commit: 'abcdef0123', file: 'src/http.ts', function: 'post' },
+            validation: { firesBefore: 1, firesAfter: 0, maxHits: 3, repoHits: [] },
+        }));
+        const [failure, ...rest] = await new SemanticBugsGate().run({ cwd });
+        expect(rest).toHaveLength(0);
+        expect(failure).toMatchObject({ files: ['src/load.ts'], line: 1, category: 'learned-rule', severity: 'medium' });
+        expect(failure.title).toContain('[learned/require-option-redirect-abcd1234]');
+        expect(failure.hint).toContain('fix abcdef01 in src/http.ts (post)');
+    });
+    it('is off unless enabled in rigour.yml', async () => {
+        write('src/notify.ts', LEAKY);
+        const base = { version: 1, commands: {}, gates: { max_file_lines: 500 } };
+        const off = await new GateRunner(base).run(cwd);
+        expect(off.failures.some(f => f.id === 'semantic-bugs')).toBe(false);
+        const on = await new GateRunner({ ...base, gates: { ...base.gates, semantic_bugs: { enabled: true } } }).run(cwd);
+        expect(on.failures.some(f => f.id === 'semantic-bugs')).toBe(true);
+    });
+});

package/dist/gates/side-effect-analysis/index.js

@@ -162,7 +162,8 @@ export class SideEffectAnalysisGate extends Gate {
             }
             if (varName) {
                 // Variable is stored — check for cleanup using that specific variable
-                const hasPairedCleanup = hasCleanupForVariable(lines, varName, scope.start, scope.end, cleanupPats, lang);
+                const cleanupScope = timerCleanupScope(lines, i, scope);
+                const hasPairedCleanup = hasCleanupForVariable(lines, varName, cleanupScope.start, cleanupScope.end, cleanupPats, lang);
                 if (hasPairedCleanup)
                     continue; // Properly paired
             }
@@ -545,3 +546,12 @@ export class SideEffectAnalysisGate extends Gate {
         }
     }
 }
+/**
+ * Where a stored timer's cleanup may live. A local declaration (`const t = …`)
+ * must be cleared in its own function; a timer kept on a field or an outer
+ * variable is usually cleared by another method, so the whole file counts.
+ */
+function timerCleanupScope(lines, lineIdx, scope) {
+    const isLocal = /^\s*(?:const|let|var)\s/.test(lines[lineIdx]);
+    return isLocal ? scope : { start: 0, end: lines.length };
+}

package/dist/gates/side-effect-analysis.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/side-effect-analysis.test.js

@@ -0,0 +1,162 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { SideEffectAnalysisGate } from './side-effect-analysis/index.js';
+describe('SideEffectAnalysisGate', () => {
+    let cwd;
+    beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'side-effect-')); });
+    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+    async function titlesFor(file, source) {
+        fs.mkdirSync(path.dirname(path.join(cwd, file)), { recursive: true });
+        fs.writeFileSync(path.join(cwd, file), source);
+        const failures = await new SideEffectAnalysisGate().run({ cwd });
+        return failures.map(f => f.title);
+    }
+    describe('recursion', () => {
+        it('ends an expression-bodied arrow at its expression, not at the next block', async () => {
+            // Shape of scripts/measure-intent.mjs: a one-line helper used inside a later loop that logs.
+            const titles = await titlesFor('scripts/measure.mjs', [
+                'const pct = (n, d) => (d === 0 ? \'n/a\' : `${Math.round((100 * n) / d)}%`);',
+                'for (const run of [1, 2]) {',
+                '    process.stderr.write(`run ${run}: ${pct(run, 2)}\\n`);',
+                '}',
+            ].join('\n'));
+            expect(titles).not.toContain('Side-Effect: Unbounded Recursion');
+        });
+        it('still flags a block-bodied arrow that recurses with I/O and no base case', async () => {
+            const titles = await titlesFor('src/walk.ts', [
+                "import fs from 'fs';",
+                'export const walk = (dir) => {',
+                '    for (const entry of fs.readdirSync(dir)) walk(`${dir}/${entry}`);',
+                '};',
+            ].join('\n'));
+            expect(titles).toContain('Side-Effect: Unbounded Recursion');
+        });
+    });
+    describe('process spawns', () => {
+        it('does not treat RegExp.prototype.exec as a process spawn', async () => {
+            // Verbatim shape of the SvelteKit repo's scripts/lint-fonts.mjs.
+            const titles = await titlesFor('scripts/lint-fonts.mjs', [
+                'function checkFontFamilyDeclarations(file, source) {',
+                '\tconst findings = [];',
+                '\tconst re = /font-family\\s*:/gi;',
+                '\tlet match;',
+                '\twhile ((match = re.exec(source)) !== null) {',
+                '\t\tconst valueStart = match.index + match[0].length;',
+                '\t\tfindings.push({ file, valueStart });',
+                '\t}',
+                '\treturn findings;',
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Orphan Process/.test(t))).toBe(false);
+        });
+        it('does not treat a database exec method as a process spawn', async () => {
+            const titles = await titlesFor('src/db.ts', "export function migrate(db: any) { db.exec('create table t (id int)'); }\n");
+            expect(titles.some(t => /Orphan Process/.test(t))).toBe(false);
+        });
+        it('does not flag a synchronous execFileSync call', async () => {
+            const titles = await titlesFor('scripts/eval/run.ts', [
+                "import { execFileSync } from 'node:child_process';",
+                "export const revision = () => execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();",
+            ].join('\n'));
+            expect(titles.some(t => /Orphan Process/.test(t))).toBe(false);
+        });
+        it('accepts once("exit") as exit handling for a spawned process', async () => {
+            const titles = await titlesFor('scripts/upload.ts', [
+                "import { spawn } from 'node:child_process';",
+                'export async function upload(args: string[]) {',
+                '  const code = await new Promise<number>((resolve, reject) => {',
+                "    const child = spawn('npx', args, { stdio: 'inherit' });",
+                "    child.once('error', reject);",
+                "    child.once('exit', (c) => resolve(c ?? 1));",
+                '  });',
+                '  return code;',
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Orphan Process/.test(t))).toBe(false);
+        });
+        it('does not read prose in a comment as a fork call', async () => {
+            const titles = await titlesFor('src/lib/seo/json-ld.ts', [
+                "// Canonical profiles, ported as data from the fork (verified against production).",
+                'export const profiles = [];',
+            ].join('\n'));
+            expect(titles.some(t => /Orphan Process/.test(t))).toBe(false);
+        });
+        it('still flags a child_process exec whose process is never handled', async () => {
+            const titles = await titlesFor('src/run.ts', [
+                "import { exec } from 'child_process';",
+                'export function run() {',
+                "  exec('ls -la');",
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Orphan Process/.test(t))).toBe(true);
+        });
+        it('still flags a spawn through a child_process namespace', async () => {
+            const titles = await titlesFor('src/run.ts', [
+                "import * as cp from 'node:child_process';",
+                'export function run() {',
+                "  cp.spawn('node', ['worker.js']);",
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Orphan Process/.test(t))).toBe(true);
+        });
+    });
+    describe('timers', () => {
+        it('does not flag a one-shot awaited setTimeout delay', async () => {
+            const titles = await titlesFor('scripts/deploy.ts', [
+                'export async function retry(attempt: number) {',
+                '  await new Promise((resolve) => setTimeout(resolve, attempt * 250));',
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Unbounded Timer/.test(t))).toBe(false);
+        });
+        it('pairs a timer kept on a private field with a clearInterval in another method', async () => {
+            const titles = await titlesFor('src/lib/review-state.svelte.ts', [
+                'export class ReviewState {',
+                '  #progressTimer: ReturnType<typeof setInterval> | undefined;',
+                '  start() {',
+                '    this.#progressTimer = setInterval(() => this.tick(), 500);',
+                '  }',
+                '  stop() {',
+                '    clearInterval(this.#progressTimer);',
+                '  }',
+                '  tick() {}',
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Unbounded Timer/.test(t))).toBe(false);
+        });
+        it('pairs a timer kept in an outer variable with a clearInterval in another function', async () => {
+            const titles = await titlesFor('src/lib/poller.ts', [
+                'let pollTimer: ReturnType<typeof setInterval> | undefined;',
+                'export function startPolling(refresh: () => void) {',
+                '  pollTimer = setInterval(refresh, 5000);',
+                '}',
+                'export function stopPolling() {',
+                '  clearInterval(pollTimer);',
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Unbounded Timer/.test(t))).toBe(false);
+        });
+        it('still flags a local interval whose own function never clears it', async () => {
+            const titles = await titlesFor('src/lib/leak.ts', [
+                'export function start(refresh: () => void) {',
+                '  const timer = setInterval(refresh, 5000);',
+                '  return 1;',
+                '}',
+                'export function stop(other: ReturnType<typeof setInterval>) {',
+                '  clearInterval(other);',
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Unbounded Timer/.test(t))).toBe(true);
+        });
+        it('still flags a setInterval that is never cleared', async () => {
+            const titles = await titlesFor('src/poll.ts', [
+                'export function poll(check: () => void) {',
+                '  setInterval(check, 1000);',
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Unbounded Timer/.test(t))).toBe(true);
+        });
+    });
+});