@rigour-labs/core 6.2.5 → 6.3.1

package/README.md

@@ -26,6 +26,8 @@ The core library powering [Rigour](https://rigour.run) — 27+ quality gates, fi
 - **Dependency bloat** — unused deps, heavy alternatives (moment→dayjs), duplicate purpose packages.
 - **Context-window artifacts**, inconsistent error handling, promise safety, deprecated APIs.
 
+**Semantic Bugs (type-aware, opt-in):** a TypeScript program with the checker and cross-file value tracing proves a defect before reporting it: credentials forwarded on redirect, paged reads aggregated in memory, cached responses that can carry a failure fallback. Rules learned from fixes (`rigour learn`) run alongside them from `.rigour/rules/`.
+
 **Agent Governance:** Multi-agent scope isolation, EWMA-based checkpoint supervision, context drift, retry loop breaker, memory & skills governance with DLP scanning.
 
 ### Real-Time Hook Engine

package/dist/discovery-signals.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Framework and library markers. These are decided by the project's declared
+ * dependencies only: as words they are too common in code and prose
+ * ("next()" in Express middleware, "reactivity" in a Svelte comment).
+ */
+export declare const PACKAGE_MARKERS: Set<string>;
+/** Declared dependency names: package.json sections, requirements.txt and pyproject.toml. */
+export declare function dependencyNames(cwd: string): Promise<Set<string>>;
+/** `marker` is declared as a dependency, directly or as its scope (`@nestjs/core`). */
+export declare function declaresPackage(dependencies: Set<string>, marker: string): boolean;
+/** Up to MAX_SAMPLE project source files (not configs or tests), spread evenly so one package cannot fill the sample. */
+export declare function sampleSourceFiles(cwd: string): Promise<string[]>;
+/** Markers naming a file extension (`ipynb`): proven by one such file existing, not by the word. */
+export declare const EXTENSION_MARKERS: Set<string>;
+export declare function hasFileWithExtension(cwd: string, extension: string): Promise<boolean>;
+/** A marker naming a file or folder (`next.config.js`, `k8s/`, `Dockerfile`), which only its existence proves. */
+export declare function isPathMarker(marker: string): boolean;
+/** `marker` as a whole token, not inside a longer word or package name. */
+export declare function containsToken(text: string, marker: string): boolean;
+/** Drop line and block comments so prose is not read as code. */
+export declare function stripComments(text: string): string;
+export interface ParadigmSignal {
+    name: 'oop' | 'functional';
+    marker: string;
+}
+/** OOP or functional by declaration counts in comment-free sources; null when neither clearly dominates. */
+export declare function detectParadigm(contents: string[]): ParadigmSignal | null;

package/dist/discovery-signals.js

@@ -0,0 +1,96 @@
+/**
+ * Signals for `rigour init` discovery.
+ *
+ * Substring search misread projects: "reactivity" in an ESLint comment made
+ * a Svelte repo "react", and "the public internet" in a Playwright comment
+ * made it "OOP". Framework markers now match package.json dependency names,
+ * other markers match whole tokens, and the paradigm comes from counting
+ * declarations in real source files, with no guess when neither side leads.
+ */
+import fs from 'fs-extra';
+import path from 'path';
+import { globby } from 'globby';
+const SOURCE_EXT = '{ts,tsx,js,jsx,mjs,py,go,java,kt,rb}';
+const SOURCE_GLOBS = [
+    `{src,lib,app,pkg,api,internal,cmd}/**/*.${SOURCE_EXT}`,
+    `{packages,apps,services}/*/{src,lib,app}/**/*.${SOURCE_EXT}`,
+    '*.{py,go}',
+];
+const SOURCE_IGNORE = ['**/node_modules/**', '**/dist/**', '**/build/**', '**/*.d.ts', '**/*.config.*', '**/*.{test,spec}.*', '**/__tests__/**'];
+const MAX_SAMPLE = 40;
+/**
+ * Framework and library markers. These are decided by the project's declared
+ * dependencies only: as words they are too common in code and prose
+ * ("next()" in Express middleware, "reactivity" in a Svelte comment).
+ */
+export const PACKAGE_MARKERS = new Set(['react', 'next', 'vue', 'svelte', 'express', 'fastify', 'nestjs', 'spark', 'pandas']);
+/** Declared dependency names: package.json sections, requirements.txt and pyproject.toml. */
+export async function dependencyNames(cwd) {
+    const names = new Set();
+    const pkg = await fs.readJson(path.join(cwd, 'package.json')).catch(() => null);
+    for (const section of ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']) {
+        for (const name of Object.keys(pkg?.[section] ?? {}))
+            names.add(name);
+    }
+    const requirements = await fs.readFile(path.join(cwd, 'requirements.txt'), 'utf-8').catch(() => '');
+    for (const match of requirements.matchAll(/^\s*([A-Za-z0-9][\w.-]*)/gm))
+        names.add(match[1].toLowerCase());
+    const pyproject = await fs.readFile(path.join(cwd, 'pyproject.toml'), 'utf-8').catch(() => '');
+    for (const match of pyproject.matchAll(/["']([A-Za-z0-9][\w.-]*)\s*(?:\[[^\]]*\])?\s*(?:[<>=~!;]|["'])/g))
+        names.add(match[1].toLowerCase());
+    return names;
+}
+/** `marker` is declared as a dependency, directly or as its scope (`@nestjs/core`). */
+export function declaresPackage(dependencies, marker) {
+    if (dependencies.has(marker))
+        return true;
+    for (const name of dependencies)
+        if (name.startsWith(`@${marker}/`))
+            return true;
+    return false;
+}
+/** Up to MAX_SAMPLE project source files (not configs or tests), spread evenly so one package cannot fill the sample. */
+export async function sampleSourceFiles(cwd) {
+    const files = (await globby(SOURCE_GLOBS, { cwd, ignore: SOURCE_IGNORE, gitignore: false, followSymbolicLinks: false })).sort();
+    const stride = Math.max(1, files.length / MAX_SAMPLE);
+    const sample = [];
+    for (let i = 0; i < files.length && sample.length < MAX_SAMPLE; i += stride)
+        sample.push(files[Math.floor(i)]);
+    return sample.map(f => path.join(cwd, f));
+}
+/** Markers naming a file extension (`ipynb`): proven by one such file existing, not by the word. */
+export const EXTENSION_MARKERS = new Set(['ipynb']);
+export async function hasFileWithExtension(cwd, extension) {
+    const found = await globby(`**/*.${extension}`, { cwd, ignore: ['**/node_modules/**', '**/.git/**'], gitignore: false, followSymbolicLinks: false, deep: 4 });
+    return found.length > 0;
+}
+/** A marker naming a file or folder (`next.config.js`, `k8s/`, `Dockerfile`), which only its existence proves. */
+export function isPathMarker(marker) {
+    return /[./]/.test(marker) || /^[A-Z]/.test(marker);
+}
+/** `marker` as a whole token, not inside a longer word or package name. */
+export function containsToken(text, marker) {
+    const escaped = marker.trim().replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`(?<![\\w@/.-])${escaped}(?![\\w-])`, 'i').test(text);
+}
+/** Drop line and block comments so prose is not read as code. */
+export function stripComments(text) {
+    return text.replace(/\/\*[\s\S]*?\*\//g, '').replace(/(^|[^:"'`])\/\/.*$/gm, '$1').replace(/^\s*#.*$/gm, '');
+}
+const CLASS_DECLARATION = /^\s*(?:export\s+)?(?:default\s+)?(?:abstract\s+)?(?:public\s+)?class\s+[A-Z]\w*/gm;
+const FUNCTION_DECLARATION = /^\s*(?:export\s+(?:default\s+)?(?:async\s+)?function\b|export\s+const\s+\w+\s*(?::[^=]+)?=\s*(?:async\s*)?(?:\([^)]*\)|\w+)\s*(?::[^=]+)?=>|def\s+\w+\s*\(|func\s+\w+\s*\()/gm;
+/** OOP or functional by declaration counts in comment-free sources; null when neither clearly dominates. */
+export function detectParadigm(contents) {
+    let classes = 0;
+    let functions = 0;
+    for (const text of contents) {
+        classes += text.match(CLASS_DECLARATION)?.length ?? 0;
+        functions += text.match(FUNCTION_DECLARATION)?.length ?? 0;
+    }
+    const marker = `declarations: ${classes} classes, ${functions} functions`;
+    if (classes > 0 && classes >= 2 * functions)
+        return { name: 'oop', marker };
+    if (functions > 0 && functions >= 2 * classes)
+        return { name: 'functional', marker };
+    return null;
+}

package/dist/discovery.d.ts

@@ -16,6 +16,5 @@ export declare class DiscoveryService {
     discover(cwd: string): Promise<DiscoveryResult>;
     private mergeConfig;
     private findFirstMarker;
-    private existsInContent;
-    private findSourceFiles;
+    private recurs;
 }

package/dist/discovery.js

@@ -1,28 +1,37 @@
 import fs from 'fs-extra';
 import path from 'path';
 import { TEMPLATES, PARADIGM_TEMPLATES, UNIVERSAL_CONFIG } from './templates/index.js';
+import { EXTENSION_MARKERS, PACKAGE_MARKERS, containsToken, hasFileWithExtension, declaresPackage, dependencyNames, detectParadigm, isPathMarker, sampleSourceFiles, stripComments, } from './discovery-signals.js';
+/**
+ * Domain keywords are ambiguous alone ("health" score, "transaction" block), and a
+ * domain preset adds compliance docs and stricter gates. It needs several keywords,
+ * each recurring across files rather than listed once.
+ */
+const MIN_KEYWORDS = 2;
+const MIN_KEYWORD_FILES = 2;
 export class DiscoveryService {
     async discover(cwd) {
         let config = { ...UNIVERSAL_CONFIG };
         const matches = {};
-        // 1. Detect Role (ui, api, infra, data)
+        const dependencies = await dependencyNames(cwd);
+        const files = await sampleSourceFiles(cwd);
+        const contents = await Promise.all(files.map(f => fs.readFile(f, 'utf-8').then(stripComments, () => '')));
+        // 1. Role (ui, api, infra, data, domain presets): the first template with a marker wins.
         for (const template of TEMPLATES) {
-            const marker = await this.findFirstMarker(cwd, template.markers, true); // Search content for roles too
+            const marker = await this.findFirstMarker(cwd, template.markers, dependencies, contents);
             if (marker) {
                 config = this.mergeConfig(config, template.config);
                 matches.preset = { name: template.name, marker };
-                break; // Only one role for now
-            }
-        }
-        // 2. Detect Paradigm (oop, functional)
-        for (const template of PARADIGM_TEMPLATES) {
-            const marker = await this.findFirstMarker(cwd, template.markers, true); // Search content
-            if (marker) {
-                config = this.mergeConfig(config, template.config);
-                matches.paradigm = { name: template.name, marker };
                 break;
             }
         }
+        // 2. Paradigm (oop, functional): only when the declarations clearly lean one way.
+        const paradigm = detectParadigm(contents);
+        const template = paradigm && PARADIGM_TEMPLATES.find(t => t.name === paradigm.name);
+        if (paradigm && template) {
+            config = this.mergeConfig(config, template.config);
+            matches.paradigm = paradigm;
+        }
         return { config, matches };
     }
     mergeConfig(base, extension) {
@@ -47,49 +56,27 @@ export class DiscoveryService {
             ignore: [...new Set([...(base.ignore || []), ...(extension.ignore || [])])],
         };
     }
-    async findFirstMarker(cwd, markers, searchContent = false) {
+    async findFirstMarker(cwd, markers, dependencies, contents) {
+        const keywords = [];
         for (const marker of markers) {
-            const fullPath = path.join(cwd, marker);
-            // File/Directory existence check
-            if (await fs.pathExists(fullPath)) {
+            if (PACKAGE_MARKERS.has(marker)) {
+                if (declaresPackage(dependencies, marker))
+                    return `dependency:${marker}`;
+            }
+            else if (EXTENSION_MARKERS.has(marker)) {
+                if (await hasFileWithExtension(cwd, marker))
+                    return `file:*.${marker}`;
+            }
+            else if (await fs.pathExists(path.join(cwd, marker))) {
                 return marker;
             }
-            // Deep content check for paradigms
-            if (searchContent) {
-                const match = await this.existsInContent(cwd, marker);
-                if (match)
-                    return `content:${marker}`;
+            else if (!isPathMarker(marker) && this.recurs(contents, marker)) {
+                keywords.push(marker);
             }
         }
-        return null;
-    }
-    async existsInContent(cwd, pattern) {
-        // Simple heuristic: search in top 5 source files
-        const files = await this.findSourceFiles(cwd);
-        for (const file of files) {
-            const content = await fs.readFile(file, 'utf-8');
-            if (content.includes(pattern))
-                return true;
-        }
-        return false;
+        return keywords.length >= MIN_KEYWORDS ? `content:${keywords.join(',')}` : null;
     }
-    async findSourceFiles(cwd) {
-        const extensions = ['.ts', '.js', '.py', '.go', '.java', '.tf', 'package.json'];
-        const samples = [];
-        const commonDirs = ['.', 'src', 'app', 'lib', 'api', 'pkg'];
-        for (const dir of commonDirs) {
-            const fullDir = path.join(cwd, dir);
-            if (!(await fs.pathExists(fullDir)))
-                continue;
-            const files = await fs.readdir(fullDir);
-            for (const file of files) {
-                if (extensions.some(ext => file.endsWith(ext))) {
-                    samples.push(path.join(fullDir, file));
-                    if (samples.length >= 5)
-                        return samples;
-                }
-            }
-        }
-        return samples;
+    recurs(contents, keyword) {
+        return contents.filter(text => containsToken(text, keyword)).length >= MIN_KEYWORD_FILES;
     }
 }

package/dist/discovery.test.js

@@ -1,80 +1,93 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 import { DiscoveryService } from './discovery.js';
-import fs from 'fs-extra';
-vi.mock('fs-extra');
+import { containsToken, detectParadigm, stripComments } from './discovery-signals.js';
 describe('DiscoveryService', () => {
-    beforeEach(() => {
-        vi.resetAllMocks();
+    let cwd;
+    beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'discovery-')); });
+    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+    function write(rel, body) {
+        fs.mkdirSync(path.dirname(path.join(cwd, rel)), { recursive: true });
+        fs.writeFileSync(path.join(cwd, rel), body);
+    }
+    const discover = () => new DiscoveryService().discover(cwd);
+    it('detects an API from a declared dependency', async () => {
+        write('package.json', JSON.stringify({ dependencies: { express: '^4.0.0' } }));
+        const result = await discover();
+        expect(result.matches.preset).toEqual({ name: 'api', marker: 'dependency:express' });
     });
-    it('should discover project marker in root directory', async () => {
-        const service = new DiscoveryService();
-        vi.mocked(fs.pathExists).mockImplementation(async (p) => p.includes('package.json'));
-        vi.mocked(fs.readdir).mockResolvedValue(['package.json']);
-        vi.mocked(fs.readFile).mockResolvedValue('{}');
-        const result = await service.discover('/test');
-        // If package.json doesn't match a specific role marker, it stays Universal.
-        // Let's mock a specific one like 'express'
-        vi.mocked(fs.pathExists).mockImplementation(async (p) => p.includes('express'));
-        const result2 = await service.discover('/test');
-        expect(result2.matches.preset?.name).toBe('api');
+    it('detects a scoped framework package such as @nestjs/core', async () => {
+        write('package.json', JSON.stringify({ dependencies: { '@nestjs/core': '^10.0.0' } }));
+        expect((await discover()).matches.preset?.marker).toBe('dependency:nestjs');
     });
-    it('should discover project marker in src/ directory (Deep Detection)', async () => {
-        const service = new DiscoveryService();
-        vi.mocked(fs.pathExists).mockImplementation((async (p) => {
-            if (p.endsWith('src'))
-                return true;
-            if (p.includes('src/index.ts'))
-                return true;
-            return false;
-        }));
-        vi.mocked(fs.readdir).mockImplementation((async (p) => {
-            if (p.toString().endsWith('/test'))
-                return ['src'];
-            if (p.toString().endsWith('src'))
-                return ['index.ts'];
-            return [];
-        }));
-        vi.mocked(fs.readFile).mockResolvedValue('export const x = 1;');
-        const result = await service.discover('/test');
-        // Since UNIVERSAL_CONFIG has a default, we check if it found something extra or matches expectation
-        // Default is universal, but detecting .ts should tilt it towards node or similar if configured
-        // In our current templates, package.json is the node marker.
-        // Let's check for paradigm detection which uses content
-        expect(result.config).toBeDefined();
-    });
-    it('should identify OOP paradigm from content in subfolder', async () => {
-        const service = new DiscoveryService();
-        vi.mocked(fs.pathExists).mockImplementation((async (p) => p.endsWith('src') || p.endsWith('src/Service.ts')));
-        vi.mocked(fs.readdir).mockImplementation((async (p) => {
-            if (p.toString().endsWith('src'))
-                return ['Service.ts'];
-            return ['src'];
-        }));
-        vi.mocked(fs.readFile).mockResolvedValue('class MyService {}');
-        const result = await service.discover('/test');
-        expect(result.matches.paradigm?.name).toBe('oop');
-    });
-    it('should include project-type-aware ignore patterns for API preset', async () => {
-        const service = new DiscoveryService();
-        // Mock finding requirements.txt (Python API marker)
-        vi.mocked(fs.pathExists).mockImplementation(async (p) => p.includes('requirements.txt'));
-        vi.mocked(fs.readdir).mockResolvedValue(['requirements.txt']);
-        vi.mocked(fs.readFile).mockResolvedValue('flask==2.0.0');
-        const result = await service.discover('/test');
+    it('detects a Python API with its ignore patterns', async () => {
+        write('requirements.txt', 'flask==2.0.0\n');
+        const result = await discover();
         expect(result.matches.preset?.name).toBe('api');
-        expect(result.config.ignore).toContain('venv/**');
-        expect(result.config.ignore).toContain('__pycache__/**');
-        expect(result.config.ignore).toContain('*.pyc');
+        expect(result.config.ignore).toEqual(expect.arrayContaining(['venv/**', '__pycache__/**', '*.pyc']));
     });
-    it('should include project-type-aware ignore patterns for UI preset', async () => {
-        const service = new DiscoveryService();
-        // Mock finding next.config.js (UI marker)
-        vi.mocked(fs.pathExists).mockImplementation(async (p) => p.includes('next.config.js'));
-        vi.mocked(fs.readdir).mockResolvedValue(['next.config.js']);
-        vi.mocked(fs.readFile).mockResolvedValue('module.exports = {}');
-        const result = await service.discover('/test');
+    it('detects a UI project from a config file with its ignore patterns', async () => {
+        write('next.config.js', 'module.exports = {};\n');
+        const result = await discover();
         expect(result.matches.preset?.name).toBe('ui');
-        expect(result.config.ignore).toContain('node_modules/**');
-        expect(result.config.ignore).toContain('.next/**');
+        expect(result.config.ignore).toEqual(expect.arrayContaining(['node_modules/**', '.next/**']));
+    });
+    it('detects Svelte from its dependencies, not "reactivity" or "public" in comments', async () => {
+        write('package.json', JSON.stringify({ devDependencies: { '@sveltejs/kit': '^2.0.0', svelte: '^5.0.0' } }));
+        write('eslint.config.js', '// Svelte 5 rules (state_referenced_locally, a11y, reactivity)\nexport default [];\n');
+        write('playwright.config.ts', '// rides the public internet\nexport default {};\n');
+        write('src/lib/format.ts', 'export function format(v: number) { return v.toFixed(2); }\nexport const pad = (s: string) => s.padStart(2);\n');
+        const result = await discover();
+        expect(result.matches.preset).toEqual({ name: 'ui', marker: 'dependency:svelte' });
+        expect(result.matches.paradigm?.name).toBe('functional');
+    });
+    it('does not read a framework name in source text as a dependency', async () => {
+        write('src/middleware.ts', 'export function run(next: () => void) { next(); }\n');
+        expect((await discover()).matches.preset).toBeUndefined();
+    });
+    it('identifies OOP from class declarations in a subfolder', async () => {
+        write('src/Service.ts', 'export class MyService {}\nexport class OtherService {}\n');
+        const result = await discover();
+        expect(result.matches.paradigm).toEqual({ name: 'oop', marker: 'declarations: 2 classes, 0 functions' });
+    });
+    it('needs several recurring domain keywords before choosing a domain preset', async () => {
+        write('src/billing.ts', 'export const ledger = new Map<string, number>();\n');
+        write('src/report.ts', "import { ledger } from './billing';\nexport const total = () => ledger.size;\n");
+        expect((await discover()).matches.preset).toBeUndefined();
+        write('src/pay.ts', 'export function payment(ledger: Map<string, number>) { return ledger; }\n');
+        write('src/refund.ts', 'export function refund(payment: number) { return -payment; }\n');
+        expect((await discover()).matches.preset).toEqual({ name: 'fintech', marker: 'content:payment,ledger' });
+    });
+    it('needs a file marker to exist, not to be mentioned', async () => {
+        write('src/serve.ts', "export const page = () => 'index.html';\n");
+        expect((await discover()).matches.preset).toBeUndefined();
+    });
+    it('detects notebooks by file, not by the word ipynb in code', async () => {
+        write('src/scan.ts', "export const exts = ['.ipynb', '.py'];\n");
+        expect((await discover()).matches.preset).toBeUndefined();
+        write('notebooks/explore.ipynb', '{}');
+        expect((await discover()).matches.preset).toEqual({ name: 'data', marker: 'file:*.ipynb' });
+    });
+    it('leaves the paradigm unset for an empty project', async () => {
+        expect((await discover()).matches.paradigm).toBeUndefined();
+    });
+});
+describe('discovery signals', () => {
+    it('matches whole tokens only', () => {
+        expect(containsToken('import x from "react"', 'react')).toBe(true);
+        expect(containsToken('reactivity', 'react')).toBe(false);
+        expect(containsToken('@vue/compiler', 'vue')).toBe(false);
+        expect(containsToken('GET /health', 'health')).toBe(false);
+    });
+    it('drops comments but keeps URLs in strings', () => {
+        const text = stripComments('/* public */\nconst u = "https://x.io"; // public\n# public\n');
+        expect(text).not.toContain('public');
+        expect(text).toContain('https://x.io');
+    });
+    it('declines to guess a paradigm when neither side clearly leads', () => {
+        expect(detectParadigm(['export class A {}\nexport function f() {}\n'])).toBeNull();
+        expect(detectParadigm(['export class A {}\nexport function f() {}\nexport function g() {}\n'])?.name).toBe('functional');
     });
 });

package/dist/gates/deep-analysis.d.ts

@@ -20,6 +20,8 @@ export interface DeepGateConfig {
     maxTokens?: number;
     temperature?: number;
     timeoutMs?: number;
+    /** Ask intent questions at engine-proven sites in scoped reviews (deep-intent.ts). */
+    intentChecks?: boolean;
     onProgress?: (message: string) => void;
 }
 export type DeepRunStatus = 'ok' | 'partial' | 'error';

package/dist/gates/deep-analysis.js

@@ -18,6 +18,7 @@ import { extractFacts, verifyFindings } from '../deep/index.js';
 import { runFactsPass } from '../deep/facts-pass.js';
 import { runCodePass } from '../deep/code-pass.js';
 import { verifyCodeFindings } from '../deep/code-verifier.js';
+import { runIntentChecks } from './deep-intent.js';
 import { checkLocalPatterns } from '../storage/local-memory.js';
 import { isScoped } from '../utils/scope.js';
 import { Logger } from '../utils/logger.js';
@@ -63,7 +64,10 @@ export class DeepAnalysisGate extends Gate {
                 ? await this.reviewCode(context.cwd, facts)
                 : await this.analyzeFacts(context.cwd, limitFiles(facts, this.config));
             this.config.onProgress?.(`  ✓ ${verified.length} verified findings in ${((Date.now() - startTime) / 1000).toFixed(1)}s`);
-            return verified.map(f => this.toFailure(f));
+            const intent = scoped && this.config.intentChecks
+                ? await runIntentChecks(context.cwd, facts.map(f => f.path), this.provider, this.config.onProgress)
+                : [];
+            return [...verified.map(f => this.toFailure(f)), ...intent];
         }
         catch (error) {
             this.outcome.status = 'error';

package/dist/gates/deep-intent.d.ts

@@ -0,0 +1,3 @@
+import type { InferenceProvider } from '../inference/types.js';
+import type { Failure } from '../types/index.js';
+export declare function runIntentChecks(cwd: string, files: string[], provider: InferenceProvider, onProgress?: (message: string) => void): Promise<Failure[]>;

package/dist/gates/deep-intent.js

@@ -0,0 +1,57 @@
+/**
+ * Intent checks in a scoped deep review (`rigour review --deep`,
+ * `rigour check <paths> --deep`): the only questions put to the model are
+ * ones the code cannot answer, at sites the engine has already proven.
+ *
+ * Today that is optional-read-no-fallback: at an `await Promise.all([...])`
+ * with no failure handling, is one read optional while another is required?
+ * Off unless `deep.intent_checks` is set; see docs/DEEP_ANALYSIS.md for the
+ * measured accuracy that decides the default.
+ */
+import path from 'path';
+import { loadProjectConfig, programBatches } from '../semantic/program.js';
+import { findParallelReads } from '../semantic/intent/parallel-reads.js';
+import { classifyReads, findingsFor, yesNoModel } from '../semantic/intent/intent-check.js';
+/** Each read costs two model calls; bound the cost of one review. */
+const MAX_SITES = 10;
+const SOURCE = /\.(?:[cm]?[jt]s|[jt]sx)$/i;
+export async function runIntentChecks(cwd, files, provider, onProgress) {
+    const sites = findSites(cwd, files.filter(f => SOURCE.test(f) && !/\.d\.[cm]?ts$/i.test(f)));
+    if (sites.length === 0)
+        return [];
+    const checked = sites.slice(0, MAX_SITES);
+    onProgress?.(`  Asking the model about ${checked.length} Promise.all site(s)${sites.length > MAX_SITES ? ` (first ${MAX_SITES} of ${sites.length})` : ''}...`);
+    const model = yesNoModel(provider);
+    const failures = [];
+    for (const site of checked) {
+        failures.push(...findingsFor(site, await classifyReads(model, site)).map(toFailure));
+    }
+    return failures;
+}
+function findSites(cwd, files) {
+    const roots = files.map(f => path.resolve(cwd, f));
+    const wanted = new Set(roots.map(r => path.normalize(r)));
+    const sites = [];
+    for (const program of programBatches(roots, loadProjectConfig(cwd).options)) {
+        for (const sourceFile of program.getSourceFiles()) {
+            if (wanted.has(path.normalize(sourceFile.fileName)))
+                sites.push(...findParallelReads(cwd, program.getTypeChecker(), sourceFile));
+        }
+    }
+    return sites;
+}
+function toFailure(finding) {
+    return {
+        id: 'deep-analysis',
+        title: `[${finding.rule}] ${finding.message.split('. ')[0]}`.slice(0, 120),
+        details: `${finding.message}\n${finding.evidence.map(e => `  at ${e}`).join('\n')}`,
+        files: [finding.file],
+        line: finding.line,
+        hint: finding.hint,
+        severity: finding.severity,
+        provenance: finding.provenance,
+        category: finding.rule,
+        source: 'hybrid',
+        verified: false,
+    };
+}

package/dist/gates/deep-intent.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/deep-intent.test.js

@@ -0,0 +1,51 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { runIntentChecks } from './deep-intent.js';
+const DASHBOARD = [
+    'declare function getAccount(id: string): Promise<{ name: string }>;',
+    'declare function getRecommendedCourses(id: string): Promise<string[]>;',
+    'export async function loadDashboard(id: string) {',
+    '  const [account, recommended] = await Promise.all([getAccount(id), getRecommendedCourses(id)]);',
+    '  return { account, recommended };',
+    '}',
+].join('\n');
+/** Answers as if getRecommendedCourses were optional and getAccount required. */
+function provider(calls) {
+    return {
+        name: 'fake',
+        isAvailable: async () => true,
+        setup: async () => { },
+        dispose: () => { },
+        analyze: async (prompt) => {
+            calls.push(prompt);
+            const optional = /Question: [^\n]*getRecommendedCourses/.test(prompt);
+            const ifFails = prompt.includes('Question: If');
+            return JSON.stringify({ answer: ifFails === optional ? 'yes' : 'no' });
+        },
+    };
+}
+describe('runIntentChecks', () => {
+    let cwd;
+    beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'deep-intent-')); });
+    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+    it('reports an optional read that can take down a required one', async () => {
+        fs.writeFileSync(path.join(cwd, 'dashboard.ts'), DASHBOARD);
+        const calls = [];
+        const [failure, ...rest] = await runIntentChecks(cwd, ['dashboard.ts'], provider(calls));
+        expect(rest).toHaveLength(0);
+        expect(calls).toHaveLength(4);
+        expect(failure).toMatchObject({
+            id: 'deep-analysis', files: ['dashboard.ts'], line: 4, category: 'optional-read-no-fallback',
+            provenance: 'deep-analysis', source: 'hybrid', verified: false,
+        });
+        expect(failure.details).toContain('`getRecommendedCourses` looks optional');
+    });
+    it('asks nothing when no file has an unhandled Promise.all', async () => {
+        fs.writeFileSync(path.join(cwd, 'plain.ts'), 'export const x = 1;\n');
+        const calls = [];
+        expect(await runIntentChecks(cwd, ['plain.ts', 'README.md'], provider(calls))).toEqual([]);
+        expect(calls).toEqual([]);
+    });
+});

package/dist/gates/deep-runner.js

@@ -18,6 +18,7 @@ export async function runDeepAnalysis(config, context, deepOptions) {
         maxTokens: config.gates.deep?.max_tokens,
         temperature: config.gates.deep?.temperature,
         timeoutMs: config.gates.deep?.timeout_ms,
+        intentChecks: config.gates.deep?.intent_checks,
         onProgress: deepOptions.onProgress,
     });
     let findings = [];

package/dist/gates/deprecated-apis-ast.d.ts

@@ -0,0 +1,8 @@
+export interface AstDeprecation {
+    line: number;
+    api: string;
+    reason: string;
+    replacement: string;
+    category: 'removed';
+}
+export declare function findWithStatements(content: string, file: string): AstDeprecation[];

package/dist/gates/deprecated-apis-ast.js

@@ -0,0 +1,25 @@
+/**
+ * Deprecated JS/TS constructs that need the syntax tree to detect reliably.
+ *
+ * A `with` statement is found from the parsed tree, so the words "with (" in
+ * a comment, a string or an identifier never match.
+ */
+import ts from 'typescript';
+export function findWithStatements(content, file) {
+    const source = ts.createSourceFile(file, content, ts.ScriptTarget.Latest, true);
+    const found = [];
+    const visit = (node) => {
+        if (node.kind === ts.SyntaxKind.WithStatement) {
+            found.push({
+                line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+                api: 'with statement',
+                reason: 'Removed in strict mode, creates ambiguous scope, security risk',
+                replacement: 'Destructuring or explicit property access',
+                category: 'removed',
+            });
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return found;
+}

package/dist/gates/deprecated-apis-rules-node.js

@@ -15,7 +15,8 @@ export const NODE_DEPRECATED_RULES = [
         category: 'security',
     },
     {
-        pattern: /Buffer\s*\(\s*(?:\d|['"])/,
+        // Not ArrayBuffer(n) / SharedArrayBuffer(n) / x.Buffer(...).
+        pattern: /(?<![\w$.])Buffer\s*\(\s*(?:\d|['"])/,
         api: 'Buffer() constructor',
         reason: 'DEP0005: Security vulnerability — uninitialized memory exposure',
         replacement: 'Buffer.from(), Buffer.alloc(), or Buffer.allocUnsafe()',
@@ -168,13 +169,6 @@ export const WEB_DEPRECATED_RULES = [
         replacement: 'JSON.parse(), Function constructor (if absolutely needed), or structured approach',
         category: 'security',
     },
-    {
-        pattern: /with\s*\(\s*\w/,
-        api: 'with statement',
-        reason: 'Removed in strict mode, creates ambiguous scope, security risk',
-        replacement: 'Destructuring or explicit property access',
-        category: 'removed',
-    },
     {
         pattern: /document\.all\b/,
         api: 'document.all',