@rigour-labs/core 6.2.5 → 6.3.1

package/dist/gates/side-effect-helpers/pattern-detection.js

@@ -71,7 +71,7 @@ export function pathsOverlap(watchPath, writePath) {
 // ═══════════════════════════════════════════════════════════════════
 // LOOP & RECURSION ANALYSIS — Context-aware body extraction
 // ═══════════════════════════════════════════════════════════════════
-import { findBlockEndBrace, findBlockEndIndent } from './scope-analysis.js';
+import { findBlockEndBrace, findBlockEndIndent, findExpressionEnd } from './scope-analysis.js';
 /**
  * Extract loop body with correct scope tracking.
  * Uses brace/indent matching (not just "next N lines").
@@ -122,13 +122,24 @@ export function extractFunctionDefs(lines, lang) {
                 ? findBlockEndIndent(lines, i)
                 : lang === 'rb'
                     ? findBlockEndRuby(lines, i)
-                    : findBlockEndBrace(lines, i);
+                    : isExpressionArrow(lines, i, stripped, m.index) ? findExpressionEnd(lines, i) : findBlockEndBrace(lines, i);
             defs.push({ name, start: i, end, params: lines[i] });
             break;
         }
     }
     return defs;
 }
+/** An arrow whose body is an expression, not a `{ ... }` block. */
+function isExpressionArrow(lines, line, stripped, matchAt) {
+    const arrow = stripped.indexOf('=>', matchAt);
+    if (arrow < 0)
+        return false;
+    const rest = stripped.slice(arrow + 2).trim();
+    if (rest !== '')
+        return !rest.startsWith('{');
+    const next = lines.slice(line + 1).find(l => l.trim() !== '');
+    return next !== undefined && !next.trim().startsWith('{');
+}
 function getFuncDefPatterns(lang) {
     switch (lang) {
         case 'py': return [/^\s*(?:async\s+)?def\s+(\w+)\s*\(/];
@@ -297,11 +308,24 @@ export function hasCatchWithContinue(body, lang) {
 // ═══════════════════════════════════════════════════════════════════
 // PROCESS & TIMER OPERATIONS
 // ═══════════════════════════════════════════════════════════════════
+/**
+ * Drop a trailing line comment (and whole comment lines) so prose such as
+ * "ported from the fork (verified …)" is not read as code. Strings are
+ * already blanked, so `//` inside a URL string is gone before this runs.
+ */
+function stripLineComment(line, lang) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith('*') || trimmed.startsWith('/*'))
+        return '';
+    const marker = lang === 'py' || lang === 'rb' ? '#' : '//';
+    const at = line.indexOf(marker);
+    return at === -1 ? line : line.slice(0, at);
+}
 /**
  * Check if a line contains a process spawn call.
  */
 export function isProcessSpawn(line, lang) {
-    const stripped = stripStrings(line);
+    const stripped = stripLineComment(stripStrings(line), lang);
     const patterns = getSpawnPatterns(lang);
     for (const pat of patterns) {
         const m = pat.exec(stripped);
@@ -314,9 +338,13 @@ function getSpawnPatterns(lang) {
     switch (lang) {
         case 'js':
         case 'ts':
+            // A bare call (from a child_process import) or a call on a
+            // child_process namespace; `re.exec(src)` or `db.exec(sql)` is not a
+            // spawn. *Sync variants finish before returning, so they cannot orphan.
             return [
-                /\b(?:spawn|exec|execFile|fork|execa)\s*\(/,
-                /\bchild_process\.\w+\s*\(/,
+                /(?<![.\w$])(?:spawn|exec|execFile|fork)\s*\(/,
+                /(?<![.\w$])(?:execa|execaCommand)\s*\(/,
+                /\b(?:child_process|childProcess|cp)\.(?:spawn|exec|execFile|fork)\s*\(/,
             ];
         case 'py':
             return [
@@ -354,9 +382,9 @@ function getTimerCreatePatterns(lang) {
     switch (lang) {
         case 'js':
         case 'ts':
+            // setTimeout fires once and cannot run unbounded; only setInterval repeats.
             return [
                 [/\bsetInterval\s*\(/, 'setInterval'],
-                [/\bsetTimeout\s*\(/, 'setTimeout'],
             ];
         case 'py':
             return [
@@ -410,7 +438,7 @@ export function getProcessCleanupPatterns(lang) {
         case 'js':
         case 'ts':
             return [
-                /\.on\s*\(\s*['"](?:exit|close)['"]/,
+                /\.(?:on|once|addListener)\s*\(\s*['"](?:exit|close)['"]/,
                 /\.kill\s*\(/,
                 /\.disconnect\s*\(/,
             ];

package/dist/gates/side-effect-helpers/resource-tracking.js

@@ -39,8 +39,8 @@ export function extractVariableBinding(line, lang) {
     const jsMatch = stripped.match(/^(?:const|let|var|final|auto|val)\s+(\w+)\s*=\s*/);
     if (jsMatch)
         return jsMatch[1];
-    // Member assignment: `this.timer = ...`, `self.timer = ...`
-    const memberMatch = stripped.match(/^(?:this|self)\.([\w]+)\s*=\s*/);
+    // Member assignment: `this.timer = ...`, `self.timer = ...`, `this.#timer = ...`
+    const memberMatch = stripped.match(/^(?:this|self)\.(#?[\w]+)\s*=\s*/);
     if (memberMatch)
         return memberMatch[1];
     // Simple assignment: `timer = ...`
@@ -68,26 +68,33 @@ export function hasCleanupForVariable(lines, varName, scopeStart, scopeEnd, clea
     const scope = lines.slice(scopeStart, scopeEnd);
     for (let i = 0; i < scope.length; i++) {
         const stripped = stripStrings(scope[i]);
-        // Check cleanup patterns that reference the specific variable
+        // Check cleanup patterns that reference the specific variable. Some
+        // patterns need the quoted event name (`.once('exit', …)`), which
+        // stripStrings blanks, so they are also tried on the raw line.
         for (const pat of cleanupPatterns) {
-            if (!pat.test(stripped))
+            if (!pat.test(stripped) && !pat.test(scope[i]))
                 continue;
-            // The cleanup call should reference our variable
-            const escapedVar = varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-            const varRef = new RegExp(`\\b${escapedVar}\\b`);
-            if (varRef.test(stripped))
+            // The cleanup call should reference our variable. Lookarounds, not
+            // \b, so a private field such as `#timer` matches too.
+            if (variableReference(varName).test(stripped))
                 return true;
             // Also check method calls on the variable: timer.close(), timer.stop()
             // The pattern might match a generic .close() — check if it's on our var
         }
         // Direct method cleanup on the variable: varName.close(), varName.Stop()
-        const escapedVar = varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-        const methodCleanup = new RegExp(`\\b${escapedVar}\\.(?:close|stop|destroy|kill|terminate|dispose|cancel|shutdown|unsubscribe|disconnect|end|release|Clear|Stop|Dispose|Close|Cancel)\\s*\\(`);
+        const escapedVar = escapeRegExp(varName);
+        const methodCleanup = new RegExp(`(?<![\\w$#])${escapedVar}\\.(?:close|stop|destroy|kill|terminate|dispose|cancel|shutdown|unsubscribe|disconnect|end|release|Clear|Stop|Dispose|Close|Cancel)\\s*\\(`);
         if (methodCleanup.test(stripped))
             return true;
     }
     return false;
 }
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function variableReference(varName) {
+    return new RegExp(`(?<![\\w$#])${escapeRegExp(varName)}(?![\\w$])`);
+}
 /**
  * Check if a line is inside a cleanup/teardown context.
  *

package/dist/gates/side-effect-helpers/scope-analysis.d.ts

@@ -14,6 +14,12 @@ export declare function findEnclosingFunction(lines: string[], lineIdx: number,
  * Find the end of a brace-delimited block starting at `start`.
  */
 export declare function findBlockEndBrace(lines: string[], start: number): number;
+/**
+ * Find the end of an expression-bodied arrow (`const f = (x) => x + 1;`):
+ * the first line where brackets balance and the expression does not
+ * continue. Scanning for a `{` instead would run into the next block.
+ */
+export declare function findExpressionEnd(lines: string[], start: number): number;
 /**
  * Find the end of an indentation-delimited block (Python).
  */

package/dist/gates/side-effect-helpers/scope-analysis.js

@@ -95,6 +95,26 @@ export function findBlockEndBrace(lines, start) {
     }
     return maxScan;
 }
+/**
+ * Find the end of an expression-bodied arrow (`const f = (x) => x + 1;`):
+ * the first line where brackets balance and the expression does not
+ * continue. Scanning for a `{` instead would run into the next block.
+ */
+export function findExpressionEnd(lines, start) {
+    let depth = 0;
+    const maxScan = Math.min(lines.length, start + 300);
+    for (let j = start; j < maxScan; j++) {
+        const stripped = stripStrings(lines[j]);
+        depth += bracketDelta(stripped);
+        const continues = /(?:=>|[=+\-*/%&|?:,.(])\s*$/.test(stripped.trimEnd());
+        if (depth <= 0 && !continues)
+            return j + 1;
+    }
+    return maxScan;
+}
+function bracketDelta(text) {
+    return (text.match(/[([{]/g)?.length ?? 0) - (text.match(/[)\]}]/g)?.length ?? 0);
+}
 /**
  * Find the end of an indentation-delimited block (Python).
  */

package/dist/index.d.ts

@@ -31,7 +31,7 @@ export { checkLocalPatterns, persistAndReinforce, getProjectStats } from './stor
 export type { ProjectStats } from './storage/index.js';
 export { recordInteractionEvidence, countInteractionEvidence, recordInteractionLesson, listLessons, listKnowledgeLessons, getApplicableLessons, transitionLesson, getRepositoryId, queueLocalLessonsForTeam } from './storage/index.js';
 export type { ApplicableLessons, InteractionEvidence, LessonRecord, LessonState, LessonVisibility, LocalLessonImportOptions, LocalLessonImportResult } from './storage/index.js';
-export { loadTeamConfiguration, saveTeamConfiguration, initializeTeamSchema, getTeamModeStatus, doctorTeamConnection, syncTeamOutbox, searchTeamKnowledge, backfillTeamEmbeddings, TEAM_CONFIG_PATH, validateTeamDatabaseUrl, } from './storage/index.js';
+export { loadTeamConfiguration, saveTeamConfiguration, initializeTeamSchema, getTeamModeStatus, doctorTeamConnection, syncTeamOutbox, searchTeamKnowledge, backfillTeamEmbeddings, TEAM_CONFIG_PATH, validateTeamDatabaseUrl, explainTeamConnectionError, } from './storage/index.js';
 export type { TeamConfiguration, TeamSemanticConfiguration, TeamModeStatus, TeamDoctorResult, SemanticKnowledgeCandidate, SemanticKnowledgeResult, } from './storage/index.js';
 export { generateTemporalDriftReport, formatDriftSummary } from './services/temporal-drift.js';
 export type { TemporalDriftReport, ProvenanceStream, MonthlyBucket, WeeklyBucket, DriftDirection } from './services/temporal-drift.js';
@@ -51,4 +51,8 @@ export * from './services/system-health.js';
 export * from './services/agent-history.js';
 export * from './services/engineering-knowledge-graph.js';
 export * from './firewall/index.js';
+export { learnFromFix, type LearnReport, type Rejection } from './semantic/learn/learn.js';
+export { extractFixTrees, type FixTrees } from './semantic/learn/git-trees.js';
+export { saveLearnedRule, loadLearnedRules, LEARNED_RULES_DIR } from './semantic/learn/store.js';
+export type { LearnedRule, LearnedPattern } from './semantic/learn/types.js';
 export { recordContextEvent, recordModelUsage, recordCheckpointMetric, getContextEvents, getModelUsages, getCheckpointMetrics, } from './storage/index.js';

package/dist/index.js

@@ -30,7 +30,7 @@ export { openDatabase, isSQLiteAvailable, compactDatabase, getDatabaseSize, rese
 // Local Project Memory (hybrid intelligence — SQLite-backed per-project learning)
 export { checkLocalPatterns, persistAndReinforce, getProjectStats } from './storage/index.js';
 export { recordInteractionEvidence, countInteractionEvidence, recordInteractionLesson, listLessons, listKnowledgeLessons, getApplicableLessons, transitionLesson, getRepositoryId, queueLocalLessonsForTeam } from './storage/index.js';
-export { loadTeamConfiguration, saveTeamConfiguration, initializeTeamSchema, getTeamModeStatus, doctorTeamConnection, syncTeamOutbox, searchTeamKnowledge, backfillTeamEmbeddings, TEAM_CONFIG_PATH, validateTeamDatabaseUrl, } from './storage/index.js';
+export { loadTeamConfiguration, saveTeamConfiguration, initializeTeamSchema, getTeamModeStatus, doctorTeamConnection, syncTeamOutbox, searchTeamKnowledge, backfillTeamEmbeddings, TEAM_CONFIG_PATH, validateTeamDatabaseUrl, explainTeamConnectionError, } from './storage/index.js';
 // Temporal Drift Engine (v5 — cross-session trend analysis + per-provenance EWMA)
 export { generateTemporalDriftReport, formatDriftSummary } from './services/temporal-drift.js';
 // Adaptive Thresholds (v5 — Z-score + per-provenance trends)
@@ -50,6 +50,9 @@ export * from './services/system-health.js';
 export * from './services/agent-history.js';
 export * from './services/engineering-knowledge-graph.js';
 export * from './firewall/index.js';
+export { learnFromFix } from './semantic/learn/learn.js';
+export { extractFixTrees } from './semantic/learn/git-trees.js';
+export { saveLearnedRule, loadLearnedRules, LEARNED_RULES_DIR } from './semantic/learn/store.js';
 export { recordContextEvent, recordModelUsage, recordCheckpointMetric, getContextEvents, getModelUsages, getCheckpointMetrics, } from './storage/index.js';
 // Pattern Index is intentionally NOT exported here to prevent
 // native dependency issues (sharp/transformers) from leaking into

package/dist/inference/model-download.test.js

@@ -9,7 +9,7 @@ const home = vi.hoisted(() => {
     return p.join(o.tmpdir(), `rigour-models-${process.pid}-${Date.now()}`);
 });
 vi.mock('../storage/db.js', () => ({ RIGOUR_DIR: home }));
-const { downloadModel, getCachedModel } = await import('./model-manager.js');
+const { checkForUpdates, downloadModel, getCachedModel, normalizeModelVersion } = await import('./model-manager.js');
 const { FALLBACK_MODELS, MODELS } = await import('./types.js');
 const modelsDir = path.join(home, 'models');
 const PAYLOAD = Buffer.from('gguf-model-bytes');
@@ -22,7 +22,7 @@ describe('downloadModel', () => {
     beforeEach(async () => {
         await fs.remove(home);
         // A fresh version check: no network call to Hugging Face.
-        await fs.outputJson(path.join(modelsDir, '.latest_version.json'), { version: '2.0.0', checkedAt: new Date().toISOString() });
+        await fs.outputJson(path.join(modelsDir, '.latest_version.json'), { format: 2, version: '5', checkedAt: new Date().toISOString() });
     });
     afterAll(async () => { await fs.remove(home); });
     it('falls back to the stock model when the fine-tuned model is unavailable, and says so', async () => {
@@ -39,6 +39,19 @@ describe('downloadModel', () => {
         const meta = await fs.readJson(`${modelPath}.meta.json`);
         expect(meta).toMatchObject({ sha256: PAYLOAD_SHA, sizeBytes: PAYLOAD.length, sourceUrl: FALLBACK_MODELS.lite.url });
     });
+    it('retries the fine-tuned model once a day when only the stock fallback is cached', async () => {
+        const failing = (url) => (url.includes('rigour-labs/') ? unauthorized : ok(PAYLOAD, PAYLOAD_SHA));
+        const stockPath = await downloadModel('lite', undefined, failing);
+        const requested = [];
+        const again = await downloadModel('lite', undefined, (url) => { requested.push(url); return unauthorized; });
+        expect(requested).toEqual([]); // failed less than a day ago: keep the fallback, no request
+        expect(again).toBe(stockPath);
+        await fs.writeJson(path.join(modelsDir, '.fine-tuned-unavailable-lite.json'), { failedAt: '2000-01-01T00:00:00Z', url: MODELS.lite.url });
+        const fineTuned = await downloadModel('lite', undefined, (url) => { requested.push(url); return ok(PAYLOAD, PAYLOAD_SHA); });
+        expect(requested).toEqual([MODELS.lite.url]);
+        expect(path.basename(fineTuned)).toBe(MODELS.lite.filename);
+        expect(await fs.pathExists(path.join(modelsDir, '.fine-tuned-unavailable-lite.json'))).toBe(false);
+    });
     it('rejects a checksum mismatch and deletes the partial download', async () => {
         const get = () => ok(PAYLOAD, 'f'.repeat(64));
         await expect(downloadModel('lite', undefined, get)).rejects.toThrow('Checksum mismatch');
@@ -65,9 +78,48 @@ describe('getCachedModel', () => {
         const cached = await getCachedModel('deep');
         expect(cached).toMatchObject({ fallback: true, info: { filename: FALLBACK_MODELS.deep.filename } });
     });
+    it('accepts a verified fine-tuned file smaller than the size estimate', async () => {
+        await cacheFile(MODELS.lite.filename, 397_807_360); // the published v5 lite model
+        expect(await getCachedModel('lite')).toMatchObject({ fallback: false, info: { filename: MODELS.lite.filename } });
+    });
+    it('accepts a file verified within the same millisecond it was written', async () => {
+        const file = path.join(modelsDir, FALLBACK_MODELS.deep.filename);
+        await cacheFile(FALLBACK_MODELS.deep.filename, 10);
+        const written = new Date('2026-01-01T00:00:00.000Z');
+        await fs.utimes(file, written, written.getTime() / 1000 + 0.0007); // mtime 0.7 ms into the same millisecond
+        await fs.writeJson(`${file}.meta.json`, { sha256: 'a'.repeat(64), sizeBytes: 10, verifiedAt: written.toISOString(), sourceUrl: 'https://x' });
+        expect(await getCachedModel('deep')).toMatchObject({ fallback: true });
+    });
+    it('rejects a file modified after it was verified', async () => {
+        const file = path.join(modelsDir, FALLBACK_MODELS.deep.filename);
+        await cacheFile(FALLBACK_MODELS.deep.filename, 10);
+        await fs.writeJson(`${file}.meta.json`, { sha256: 'a'.repeat(64), sizeBytes: 10, verifiedAt: '2000-01-01T00:00:00.000Z', sourceUrl: 'https://x' });
+        expect(await getCachedModel('deep')).toBeNull();
+    });
     it('ignores a file without verified metadata', async () => {
         await fs.ensureDir(modelsDir);
         await fs.writeFile(path.join(modelsDir, FALLBACK_MODELS.deep.filename), 'partial');
         expect(await getCachedModel('deep')).toBeNull();
     });
 });
+describe('model versions', () => {
+    beforeEach(async () => { await fs.remove(home); vi.unstubAllGlobals(); });
+    it('keeps published version strings as they are', () => {
+        expect(normalizeModelVersion(5)).toBe('5');
+        expect(normalizeModelVersion('5')).toBe('5');
+        expect(normalizeModelVersion('v2.1.0')).toBe('2.1.0');
+        expect(normalizeModelVersion('5.0')).toBeNull();
+        expect(normalizeModelVersion({})).toBeNull();
+    });
+    it('names the published v5 repositories by default', () => {
+        expect(MODELS.lite.url).toBe('https://huggingface.co/rigour-labs/rigour-lite-v5-gguf/resolve/main/rigour-lite-v5-q4_k_m.gguf');
+        expect(MODELS.deep.url).toBe('https://huggingface.co/rigour-labs/rigour-deep-v5-gguf/resolve/main/rigour-deep-v5-q4_k_m.gguf');
+    });
+    it('ignores a version cache from the old SemVer conversion and re-reads the published version', async () => {
+        await fs.outputJson(path.join(modelsDir, '.latest_version.json'), { version: '5.0.0', checkedAt: new Date().toISOString() });
+        vi.stubGlobal('fetch', vi.fn(async () => ({ ok: true, json: async () => ({ version: 5 }) })));
+        expect(await checkForUpdates()).toBe('5');
+        expect(await fs.readJson(path.join(modelsDir, '.latest_version.json'))).toMatchObject({ format: 2, version: '5' });
+        expect(MODELS.deep.filename).toBe('rigour-deep-v5-q4_k_m.gguf');
+    });
+});

package/dist/inference/model-manager.d.ts

@@ -26,6 +26,12 @@ export declare function getModelPath(tier: ModelTier): string;
  * Get model info for a tier.
  */
 export declare function getModelInfo(tier: ModelTier): ModelInfo;
+/**
+ * The version exactly as published. Integer versions (the RLAIF pipeline
+ * before SemVer) are published as `v5`, SemVer versions as `v2.1.0`; either
+ * way the string goes into the repository and file names unchanged.
+ */
+export declare function normalizeModelVersion(raw: unknown): string | null;
 /**
  * Check HuggingFace for a newer model version (like antivirus signature updates).
  * Reads latest_version.json from the RLAIF dataset repo. Non-blocking — if the

package/dist/inference/model-manager.js

@@ -8,6 +8,7 @@ import { createHash } from 'crypto';
 import { RIGOUR_DIR } from '../storage/db.js';
 import { downloadToFile } from './http-download.js';
 import { MODELS, FALLBACK_MODELS, VERSION_CHECK_URL, BUNDLED_MODEL_VERSION, updateModelVersion } from './types.js';
+import { Logger } from '../utils/logger.js';
 const MODELS_DIR = path.join(RIGOUR_DIR, 'models');
 const VERSION_CACHE_PATH = path.join(MODELS_DIR, '.latest_version.json');
 const VERSION_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // Check once per day
@@ -63,13 +64,14 @@ async function isFileCached(model) {
     const metadata = await readModelMeta(model.filename);
     if (!metadata)
         return false;
+    // The metadata is written only after the checksum passed, so its exact size is
+    // the completeness check; ModelInfo sizes are display estimates that differ by version.
     const stat = await fs.stat(modelPath);
-    const tolerance = model.sizeBytes * 0.1;
-    if (stat.size <= model.sizeBytes - tolerance)
-        return false;
     if (metadata.sizeBytes !== stat.size)
         return false;
-    if (new Date(metadata.verifiedAt).getTime() < stat.mtimeMs)
+    // verifiedAt has millisecond precision and mtimeMs a sub-millisecond fraction: compare
+    // whole milliseconds, or a file verified within the same millisecond looks modified.
+    if (new Date(metadata.verifiedAt).getTime() < Math.floor(stat.mtimeMs))
         return false;
     return true;
 }
@@ -161,6 +163,27 @@ async function downloadFromUrl(model, onProgress, get) {
     onProgress?.(`Model ${model.name} ready`, 100);
     return destPath;
 }
+/**
+ * Version cache format. Format 1 turned a published integer version into
+ * SemVer ("5" -> "5.0.0"), which names repositories that were never published,
+ * so those caches are ignored.
+ */
+const VERSION_CACHE_FORMAT = 2;
+/** How long a failed fine-tuned download keeps the stock fallback before retrying. */
+const FINE_TUNED_RETRY_MS = 24 * 60 * 60 * 1000;
+/**
+ * The version exactly as published. Integer versions (the RLAIF pipeline
+ * before SemVer) are published as `v5`, SemVer versions as `v2.1.0`; either
+ * way the string goes into the repository and file names unchanged.
+ */
+export function normalizeModelVersion(raw) {
+    if (typeof raw === 'number' && Number.isInteger(raw) && raw > 0)
+        return String(raw);
+    if (typeof raw !== 'string')
+        return null;
+    const value = raw.trim().replace(/^v/, '');
+    return /^\d+$/.test(value) || /^\d+\.\d+\.\d+$/.test(value) ? value : null;
+}
 /**
  * Check HuggingFace for a newer model version (like antivirus signature updates).
  * Reads latest_version.json from the RLAIF dataset repo. Non-blocking — if the
@@ -175,8 +198,8 @@ export async function checkForUpdates(onProgress) {
         if (await fs.pathExists(VERSION_CACHE_PATH)) {
             const cached = await fs.readJson(VERSION_CACHE_PATH);
             const age = Date.now() - new Date(cached.checkedAt).getTime();
-            if (age < VERSION_CHECK_INTERVAL_MS && cached.version) {
-                const v = String(cached.version);
+            const v = cached.format === VERSION_CACHE_FORMAT ? normalizeModelVersion(cached.version) : null;
+            if (age < VERSION_CHECK_INTERVAL_MS && v) {
                 updateModelVersion(v);
                 return v;
             }
@@ -193,13 +216,10 @@ export async function checkForUpdates(onProgress) {
         clearTimeout(timeout);
         if (response.ok) {
             const data = await response.json();
-            // Handle both legacy integer versions (5 → "5.0.0") and SemVer strings ("2.0.0")
-            let rawVersion = data.version ?? BUNDLED_MODEL_VERSION;
-            const latestVersion = typeof rawVersion === 'number'
-                ? `${rawVersion}.0.0`
-                : String(rawVersion);
+            const latestVersion = normalizeModelVersion(data.version) ?? BUNDLED_MODEL_VERSION;
             // Cache the result locally
             await fs.writeJson(VERSION_CACHE_PATH, {
+                format: VERSION_CACHE_FORMAT,
                 version: latestVersion,
                 checkedAt: new Date().toISOString(),
                 source: 'huggingface',
@@ -226,22 +246,42 @@ export async function downloadModel(tier, onProgress, get) {
     // Check for newer model version (non-blocking, cached 24h)
     await checkForUpdates(onProgress);
     const cached = await getCachedModel(tier);
-    if (cached) {
+    if (cached && !cached.fallback) {
         onProgress?.(`Model ${cached.info.name} already cached`, 100);
         return cached.path;
     }
+    // Only the stock fallback is cached: try the fine-tuned model again, at most once a day,
+    // so one failed download does not pin a user to the stock model forever.
+    if (cached && !(await fineTunedRetryDue(tier)))
+        return cached.path;
     const model = MODELS[tier];
     onProgress?.(`Downloading ${model.name} (${model.sizeHuman})...`, 0);
     try {
-        return await downloadFromUrl(model, onProgress, get);
+        const downloaded = await downloadFromUrl(model, onProgress, get);
+        await fs.remove(retryMarker(tier)).catch(() => { });
+        return downloaded;
     }
     catch (error) {
         const fallback = FALLBACK_MODELS[tier];
-        if (fallback && fallback.url !== model.url) {
-            onProgress?.(`Fine-tuned model unavailable (${error?.message ?? 'unknown error'}); using stock ${fallback.name}`, 0);
-            return downloadFromUrl(fallback, onProgress, get);
-        }
-        throw error;
+        if (!fallback || fallback.url === model.url)
+            throw error;
+        const reason = error?.message ?? 'unknown error';
+        Logger.warn(`Fine-tuned model ${model.name} could not be downloaded from ${model.url} (${reason}); using the stock ${fallback.name}. Deep findings will be less accurate.`);
+        onProgress?.(`Fine-tuned model unavailable (${reason}); using stock ${fallback.name}`, 0);
+        await fs.writeJson(retryMarker(tier), { failedAt: new Date().toISOString(), url: model.url, reason }).catch(() => { });
+        return cached?.path ?? downloadFromUrl(fallback, onProgress, get);
+    }
+}
+function retryMarker(tier) {
+    return path.join(MODELS_DIR, `.fine-tuned-unavailable-${tier}.json`);
+}
+async function fineTunedRetryDue(tier) {
+    try {
+        const marker = await fs.readJson(retryMarker(tier));
+        return Date.now() - new Date(marker.failedAt).getTime() >= FINE_TUNED_RETRY_MS || marker.url !== MODELS[tier].url;
+    }
+    catch {
+        return true;
     }
 }
 /**

package/dist/inference/sidecar-provider.js

@@ -9,6 +9,7 @@
  *
  * Code never leaves the machine: prompts go to a local child process.
  */
+import crypto from 'crypto';
 import path from 'path';
 import os from 'os';
 import fs from 'fs-extra';
@@ -88,7 +89,7 @@ export class SidecarProvider {
             maxTokens: options?.maxTokens || 1024,
             threads: this.threads,
             temperature: options?.temperature ?? 0.1,
-            schemaPath: options?.jsonMode ? this.schemaPath ?? undefined : undefined,
+            schemaPath: options?.jsonSchema ? await schemaFileFor(options.jsonSchema) : options?.jsonMode ? this.schemaPath ?? undefined : undefined,
         });
         let result;
         try {
@@ -159,6 +160,16 @@ async function findOnPath(name) {
         return null;
     }
 }
+/** A schema file per distinct schema, written once and reused across calls. */
+async function schemaFileFor(schema) {
+    const text = JSON.stringify(schema);
+    const schemaPath = path.join(managedEngineDir(), '..', 'schemas', `${crypto.createHash('sha256').update(text).digest('hex').slice(0, 16)}.json`);
+    if (!(await fs.pathExists(schemaPath))) {
+        await fs.ensureDir(path.dirname(schemaPath));
+        await fs.writeFile(schemaPath, text);
+    }
+    return schemaPath;
+}
 async function writeFindingsSchema() {
     const schemaPath = path.join(managedEngineDir(), '..', 'findings.schema.json');
     await fs.ensureDir(path.dirname(schemaPath));

package/dist/inference/types.d.ts

@@ -29,6 +29,8 @@ export interface InferenceOptions {
     temperature?: number;
     timeout?: number;
     jsonMode?: boolean;
+    /** Constrain local output to this JSON schema instead of the findings schema. */
+    jsonSchema?: Record<string, unknown>;
 }
 /**
  * A single finding from deep LLM analysis.
@@ -84,12 +86,16 @@ export interface ModelInfo {
  * At startup, model-manager checks HF for the latest version and downloads
  * it automatically (like antivirus signature updates).
  *
- * Version format: SemVer (MAJOR.MINOR.PATCH)
+ * The fallback is the last version actually published: v5, from the RLAIF
+ * pipeline's integer versions. SemVer versions (MAJOR.MINOR.PATCH) are
+ * published under their SemVer names.
+ *
+ * Version format: SemVer (MAJOR.MINOR.PATCH), or a legacy integer
  *   - MAJOR: Training data format change, base model change, pipeline architecture
  *   - MINOR: New training repos, updated dataset, hyperparameter improvements
  *   - PATCH: Bug fixes, retraining with same data/format
  */
-export declare const BUNDLED_MODEL_VERSION = "2.0.0";
+export declare const BUNDLED_MODEL_VERSION = "5";
 /** HuggingFace dataset repo where latest_version.json lives */
 export declare const VERSION_CHECK_URL = "https://huggingface.co/datasets/rigour-labs/rigour-rlaif-data/resolve/main/latest_version.json";
 /** Build model info for a given tier and version */

package/dist/inference/types.js

@@ -5,19 +5,23 @@
  * At startup, model-manager checks HF for the latest version and downloads
  * it automatically (like antivirus signature updates).
  *
- * Version format: SemVer (MAJOR.MINOR.PATCH)
+ * The fallback is the last version actually published: v5, from the RLAIF
+ * pipeline's integer versions. SemVer versions (MAJOR.MINOR.PATCH) are
+ * published under their SemVer names.
+ *
+ * Version format: SemVer (MAJOR.MINOR.PATCH), or a legacy integer
  *   - MAJOR: Training data format change, base model change, pipeline architecture
  *   - MINOR: New training repos, updated dataset, hyperparameter improvements
  *   - PATCH: Bug fixes, retraining with same data/format
  */
-export const BUNDLED_MODEL_VERSION = '2.0.0';
+export const BUNDLED_MODEL_VERSION = '5';
 /** HuggingFace dataset repo where latest_version.json lives */
 export const VERSION_CHECK_URL = 'https://huggingface.co/datasets/rigour-labs/rigour-rlaif-data/resolve/main/latest_version.json';
 /** Build model info for a given tier and version */
 export function buildModelInfo(tier, version) {
     const meta = {
         deep: { base: 'Qwen2.5-Coder-1.5B', size: 900_000_000, sizeH: '900MB' },
-        lite: { base: 'Qwen2.5-Coder-0.5B', size: 500_000_000, sizeH: '500MB' },
+        lite: { base: 'Qwen2.5-Coder-0.5B', size: 400_000_000, sizeH: '400MB' },
         legacy: { base: 'Qwen2.5-Coder-0.5B', size: 350_000_000, sizeH: '350MB' },
     };
     const m = meta[tier];

package/dist/semantic/ast.d.ts

@@ -0,0 +1,29 @@
+import ts from 'typescript';
+export type FunctionLike = ts.FunctionDeclaration | ts.FunctionExpression | ts.ArrowFunction | ts.MethodDeclaration;
+export declare function isFunctionLike(node: ts.Node): node is FunctionLike;
+/** Drop parentheses, type assertions, non-null and `await` around an expression. */
+export declare function unwrap(expr: ts.Expression): ts.Expression;
+/**
+ * Symbol for a node, following import aliases to the declaration. For the
+ * name in a shorthand property (`{ headers }`) this is the variable it reads,
+ * not the property it creates.
+ */
+export declare function symbolOf(checker: ts.TypeChecker, node: ts.Node): ts.Symbol | undefined;
+/** The function a call invokes, when it resolves to one declared in source. */
+export declare function calledFunction(checker: ts.TypeChecker, call: ts.CallExpression): FunctionLike | undefined;
+/** `fetch` in `fetch(...)`, `deps.fetch(...)`, `this.fetch(...)`. */
+export declare function calleeName(call: ts.CallExpression): string | undefined;
+export declare function enclosingFunction(node: ts.Node): FunctionLike | undefined;
+/** Visit every descendant of `root` that belongs to `root` itself, not to a nested function. */
+export declare function forEachOwnNode(root: ts.Node, visit: (node: ts.Node) => void): void;
+export declare function forEachNode(root: ts.Node, visit: (node: ts.Node) => void): void;
+/** Text of a property name (`a`, `'a'`, `"x-token"`), or undefined for computed names. */
+export declare function propertyNameText(name: ts.PropertyName | undefined): string | undefined;
+export declare function lineOf(node: ts.Node): number;
+/** "http.ts:51" style location for evidence, relative to cwd. */
+export declare function locationOf(cwd: string, node: ts.Node): string;
+export declare function relativeFile(cwd: string, sf: ts.SourceFile): string;
+/** Short, single-line source text for messages. */
+export declare function snippet(node: ts.Node, max?: number): string;
+/** True when any identifier inside `expr` resolves to `target`. */
+export declare function mentionsSymbol(checker: ts.TypeChecker, expr: ts.Node, target: ts.Symbol): boolean;