@rigour-labs/core 6.3.1 → 6.4.1

package/README.md

@@ -26,7 +26,7 @@ The core library powering [Rigour](https://rigour.run) — 27+ quality gates, fi
 - **Dependency bloat** — unused deps, heavy alternatives (moment→dayjs), duplicate purpose packages.
 - **Context-window artifacts**, inconsistent error handling, promise safety, deprecated APIs.
 
-**Semantic Bugs (type-aware, opt-in):** a TypeScript program with the checker and cross-file value tracing proves a defect before reporting it: credentials forwarded on redirect, paged reads aggregated in memory, cached responses that can carry a failure fallback. Rules learned from fixes (`rigour learn`) run alongside them from `.rigour/rules/`.
+**Semantic Bugs (type-aware, on by default):** a TypeScript program with the checker and cross-file value tracing proves a defect before reporting it: credentials forwarded on redirect, paged reads aggregated in memory, cached responses that can carry a failure fallback. Rules learned from fixes (`rigour learn`) run alongside them from `.rigour/rules/`.
 
 **Agent Governance:** Multi-agent scope isolation, EWMA-based checkpoint supervision, context drift, retry loop breaker, memory & skills governance with DLP scanning.
 

package/dist/deep/changed-functions.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Functions a change touched: the outermost function around each changed line.
+ * Shared by the reference pack (callees and callers of the change) and
+ * differential tests (the exported functions to exercise).
+ */
+import ts from 'typescript';
+import { type FunctionLike } from '../semantic/ast.js';
+/**
+ * Lines come from `sourceFile` directly, so this works on an unbound program
+ * too (parent pointers exist only once a type checker has been created).
+ */
+export declare function changedFunctions(sourceFile: ts.SourceFile, focusLines: number[]): FunctionLike[];
+/** `export function f` or `export const f = () => …`. */
+export declare function isExported(fn: FunctionLike): boolean;
+export declare function functionName(fn: FunctionLike): string | undefined;

package/dist/deep/changed-functions.js

@@ -0,0 +1,34 @@
+/**
+ * Functions a change touched: the outermost function around each changed line.
+ * Shared by the reference pack (callees and callers of the change) and
+ * differential tests (the exported functions to exercise).
+ */
+import ts from 'typescript';
+import { forEachNode, isFunctionLike } from '../semantic/ast.js';
+/**
+ * Lines come from `sourceFile` directly, so this works on an unbound program
+ * too (parent pointers exist only once a type checker has been created).
+ */
+export function changedFunctions(sourceFile, focusLines) {
+    const found = [];
+    forEachNode(sourceFile, (node) => {
+        if (!isFunctionLike(node) || !node.body)
+            return;
+        const start = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
+        const end = sourceFile.getLineAndCharacterOfPosition(node.getEnd()).line + 1;
+        if (focusLines.some(l => l >= start && l <= end) && !found.some(outer => outer.pos <= node.pos && node.end <= outer.end))
+            found.push(node);
+    });
+    return found;
+}
+/** `export function f` or `export const f = () => …`. */
+export function isExported(fn) {
+    const holder = ts.isFunctionDeclaration(fn) ? fn : fn.parent?.parent?.parent;
+    return !!holder && ts.canHaveModifiers(holder) && !!ts.getModifiers(holder)?.some(m => m.kind === ts.SyntaxKind.ExportKeyword);
+}
+export function functionName(fn) {
+    if (ts.isFunctionDeclaration(fn))
+        return fn.name?.text;
+    const decl = fn.parent;
+    return decl && ts.isVariableDeclaration(decl) && ts.isIdentifier(decl.name) ? decl.name.text : undefined;
+}

package/dist/deep/code-pass.d.ts

@@ -1,6 +1,7 @@
 import type { InferenceProvider } from '../inference/types.js';
 import type { FileFacts } from './fact-extractor.js';
 import { type CodeContext } from './code-context.js';
+import type { RemovedBlock } from '../utils/diff.js';
 import type { PassConfig, PassResult } from './facts-pass.js';
 export interface CodePassConfig extends PassConfig {
     cwd: string;
@@ -8,6 +9,15 @@ export interface CodePassConfig extends PassConfig {
     maxSourceChars: number;
     /** Changed lines per file (cwd-relative path → line numbers). */
     focusLines?: Record<string, number[]>;
+    /**
+     * Stronger tiers only: send reference material with each file, review it
+     * twice with that material in opposite orders, and self-check the union.
+     */
+    reference?: {
+        maxChars: number;
+        removed?: Record<string, RemovedBlock[]>;
+        prBody?: string;
+    };
 }
 export interface CodePassResult extends PassResult {
     contexts: CodeContext[];

package/dist/deep/code-pass.js

@@ -7,6 +7,8 @@ import fs from 'fs-extra';
 import { buildCodeContext } from './code-context.js';
 import { buildCodeReviewPrompt } from './code-review-prompt.js';
 import { parseFindings } from './parse-findings.js';
+import { buildReferencePack } from './reference-pack.js';
+import { selfCheck } from './self-check.js';
 import { Logger } from '../utils/logger.js';
 export async function runCodePass(provider, facts, config) {
     const result = { findings: [], chunksTotal: facts.length, chunksFailed: 0, contexts: [] };
@@ -25,10 +27,12 @@ export async function runCodePass(provider, facts, config) {
             recordFailure(result, `${file.path}: ${error.message}`, config);
             continue;
         }
+        const pack = config.reference ? packFor(file.path, config) : undefined;
+        if (pack)
+            context = { ...context, source: `${context.source}\n${pack.source}` };
         result.contexts.push(context);
         try {
-            const response = await provider.analyze(buildCodeReviewPrompt(context), config.inference);
-            result.findings.push(...parseFindings(response));
+            result.findings.push(...(pack ? await reviewTwiceAndCheck(provider, context, pack, config) : await reviewOnce(provider, context, '', config)));
         }
         catch (error) {
             recordFailure(result, `${file.path}: ${error.message}`, config);
@@ -36,6 +40,37 @@ export async function runCodePass(provider, facts, config) {
     }
     return result;
 }
+async function reviewOnce(provider, context, reference, config) {
+    return parseFindings(await provider.analyze(buildCodeReviewPrompt(context, reference), config.inference));
+}
+async function reviewTwiceAndCheck(provider, context, pack, config) {
+    const first = await reviewOnce(provider, context, pack.text, config);
+    const second = pack.sections.length > 1 ? await reviewOnce(provider, context, [...pack.sections].reverse().join('\n\n'), config) : [];
+    const union = dedupe([...first, ...second]);
+    if (union.length === 0)
+        return union;
+    const checked = await selfCheck(provider, context, pack.text, union, config.inference);
+    if (checked.withdrawn > 0)
+        config.onProgress?.(`  Self-check withdrew ${checked.withdrawn} of ${union.length} finding(s) in ${context.file}.`);
+    return checked.kept;
+}
+function packFor(file, config) {
+    const reference = config.reference;
+    return buildReferencePack({
+        cwd: config.cwd, file, focusLines: config.focusLines?.[file],
+        removed: reference.removed?.[file], prBody: reference.prBody, maxChars: reference.maxChars,
+    });
+}
+function dedupe(findings) {
+    const seen = new Set();
+    return findings.filter(f => {
+        const key = `${f.file}:${f.line}:${f.category}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
 function recordFailure(result, message, config) {
     result.chunksFailed++;
     result.firstError ??= message;

package/dist/deep/code-pass.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deep/code-pass.test.js

@@ -0,0 +1,69 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { runCodePass } from './code-pass.js';
+import { parseVerdict } from './self-check.js';
+let dir;
+afterEach(() => { if (dir)
+    fs.rmSync(dir, { recursive: true, force: true }); dir = undefined; });
+const SOURCE = 'export function total(items: number[]) {\n  let sum = 0;\n  for (let i = 0; i <= items.length; i++) sum += items[i];\n  return sum;\n}\n';
+const facts = { path: 'total.ts', language: 'typescript', classes: [], functions: [] };
+function finding(line, category, description) {
+    return { category, severity: 'high', file: 'total.ts', line, description, suggestion: 's', confidence: 0.9 };
+}
+/** Review passes answer from `reviews` in turn; self-checks withdraw findings whose line is in `withdraw`. */
+function fakeProvider(reviews, withdraw) {
+    const prompts = [];
+    const provider = {
+        name: 'fake', isAvailable: async () => true, setup: async () => { }, dispose: () => { },
+        analyze: async (prompt) => {
+            prompts.push(prompt);
+            if (prompt.startsWith('You reported a defect')) {
+                const line = Number(prompt.match(/REPORTED at total\.ts:(\d+)/)?.[1]);
+                return JSON.stringify({ real: !withdraw.includes(line) });
+            }
+            return JSON.stringify({ findings: reviews.shift() ?? [] });
+        },
+    };
+    return { provider, prompts };
+}
+function run(provider, reference) {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), 'code-pass-'));
+    fs.writeFileSync(path.join(dir, 'total.ts'), SOURCE);
+    return runCodePass(provider, [facts], { cwd: dir, inference: {}, maxSourceChars: 10_000, focusLines: { 'total.ts': [3] }, reference });
+}
+describe('runCodePass', () => {
+    it('reviews once without reference material (the small tiers)', async () => {
+        const { provider, prompts } = fakeProvider([[finding(3, 'correctness', 'off by one on `items`')]], []);
+        const result = await run(provider);
+        expect(prompts).toHaveLength(1);
+        expect(result.findings.map(f => f.line)).toEqual([3]);
+    });
+    it('does not repeat an identical pass when there is only one reference section', async () => {
+        const { provider, prompts } = fakeProvider([[]], []);
+        await run(provider, { maxChars: 4000, prBody: 'Sum the basket.' });
+        expect(prompts).toHaveLength(1);
+    });
+    it('with reference material, reviews twice in opposite orders, merges, and keeps what the self-check confirms', async () => {
+        const { provider, prompts } = fakeProvider([
+            [finding(3, 'correctness', 'reads past the end of `items`')],
+            [finding(3, 'correctness', 'same bug seen again'), finding(2, 'consistency', 'style-ish claim about `sum`')],
+        ], [2]);
+        const result = await run(provider, {
+            maxChars: 4000, prBody: 'Sum the basket.',
+            removed: { 'total.ts': [{ line: 3, text: ['  for (let i = 0; i < items.length; i++) sum += items[i];'] }] },
+        });
+        const reviews = prompts.filter(p => !p.startsWith('You reported a defect'));
+        expect(reviews).toHaveLength(2);
+        expect(reviews[0].indexOf('PR DESCRIPTION')).toBeLessThan(reviews[0].indexOf('REMOVED by this change'));
+        expect(reviews[1].indexOf('REMOVED by this change')).toBeLessThan(reviews[1].indexOf('PR DESCRIPTION'));
+        expect(prompts.filter(p => p.startsWith('You reported a defect'))).toHaveLength(2);
+        expect(result.findings.map(f => [f.line, f.category])).toEqual([[3, 'correctness']]);
+    });
+    it('reads a self-check reply only when it is a verdict', () => {
+        expect(parseVerdict('{"real": false, "reason": "handled"}')).toBe(false);
+        expect(parseVerdict('Sure! {"real": true}')).toBe(true);
+        expect(parseVerdict('I am not sure')).toBeUndefined();
+    });
+});

package/dist/deep/code-review-prompt.d.ts

@@ -14,4 +14,4 @@ export declare const REVIEW_CATEGORIES: ReadonlyArray<{
     key: string;
     focus: string;
 }>;
-export declare function buildCodeReviewPrompt(context: CodeContext): string;
+export declare function buildCodeReviewPrompt(context: CodeContext, reference?: string): string;

package/dist/deep/code-review-prompt.js

@@ -18,13 +18,14 @@ const REVIEW_RULES = `RULES:
 4. If you find nothing concrete, return {"findings": []}. An empty list is a good answer.
 5. confidence: 0.9+ only when the defect is certain from the code shown; 0.5-0.7 when it depends on how callers use it.
 6. Respond ONLY with JSON: {"findings":[{"category","severity","file","line","description","suggestion","confidence"}]}.`;
-export function buildCodeReviewPrompt(context) {
+export function buildCodeReviewPrompt(context, reference = '') {
     const categories = REVIEW_CATEGORIES.map(c => `- ${c.key}: ${c.focus}`).join('\n');
     return [
         'You are a senior engineer reviewing a change before it ships. Read the source and report real defects.',
         `CATEGORIES:\n${categories}`,
         REVIEW_RULES,
         `SOURCE (line numbers on the left):\n${context.text}`,
+        reference ? `REFERENCE (context for the change, not under review; report defects only at lines of ${context.file}):\n${reference}` : '',
         `Review ${context.file}. Return findings as JSON.`,
-    ].join('\n\n');
+    ].filter(Boolean).join('\n\n');
 }

package/dist/deep/diff-tests/calls.d.ts

@@ -0,0 +1,8 @@
+export type Runner = 'vitest' | 'jest';
+export declare function safeCalls(name: string, candidates: string[]): string[];
+/**
+ * A test file that runs each call and records its outcome (a stable rendering of
+ * the value, or the error's type and message) to the file named by
+ * RIGOUR_DIFF_OUT. It asserts nothing: the verdict is base versus head.
+ */
+export declare function testFileSource(runner: Runner, name: string, importPath: string, calls: string[]): string;

package/dist/deep/diff-tests/calls.js

@@ -0,0 +1,85 @@
+/**
+ * The calls a differential test makes, and the test file that records them.
+ *
+ * The model proposes calls; it never writes test code. A call is kept only if
+ * it is `name(...)` with plain literal arguments (strings, numbers, booleans,
+ * null, undefined, and arrays or objects of those), so what runs is the
+ * function under test on data, nothing else: no file, network or process
+ * access can come from model output. Rigour writes the file that runs them.
+ */
+import ts from 'typescript';
+const MAX_CALLS = 8;
+export function safeCalls(name, candidates) {
+    const kept = new Set();
+    for (const candidate of candidates) {
+        const text = candidate.trim().replace(/;$/, '');
+        if (kept.size >= MAX_CALLS || text.length > 300)
+            continue;
+        const statement = ts.createSourceFile('call.ts', text, ts.ScriptTarget.Latest, true).statements;
+        if (statement.length !== 1 || !ts.isExpressionStatement(statement[0]))
+            continue;
+        const call = statement[0].expression;
+        if (ts.isCallExpression(call) && ts.isIdentifier(call.expression) && call.expression.text === name
+            && !call.typeArguments && call.arguments.every(isLiteralValue))
+            kept.add(call.getText());
+    }
+    return [...kept];
+}
+function isLiteralValue(node) {
+    if (ts.isStringLiteral(node) || ts.isNumericLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node))
+        return true;
+    if (node.kind === ts.SyntaxKind.TrueKeyword || node.kind === ts.SyntaxKind.FalseKeyword || node.kind === ts.SyntaxKind.NullKeyword)
+        return true;
+    if (ts.isIdentifier(node))
+        return node.text === 'undefined' || node.text === 'NaN' || node.text === 'Infinity';
+    if (ts.isPrefixUnaryExpression(node))
+        return node.operator === ts.SyntaxKind.MinusToken && ts.isNumericLiteral(node.operand);
+    if (ts.isArrayLiteralExpression(node))
+        return node.elements.every(isLiteralValue);
+    if (ts.isObjectLiteralExpression(node)) {
+        return node.properties.every(p => ts.isPropertyAssignment(p) && !ts.isComputedPropertyName(p.name) && isLiteralValue(p.initializer));
+    }
+    return false;
+}
+/**
+ * A test file that runs each call and records its outcome (a stable rendering of
+ * the value, or the error's type and message) to the file named by
+ * RIGOUR_DIFF_OUT. It asserts nothing: the verdict is base versus head.
+ */
+export function testFileSource(runner, name, importPath, calls) {
+    return [
+        runner === 'vitest' ? "import { test } from 'vitest';" : '',
+        "import { writeFileSync } from 'fs';",
+        `import { ${name} } from ${JSON.stringify(importPath)};`,
+        '',
+        'function render(value: unknown): string {',
+        "    const seen = new WeakSet<object>();",
+        '    return JSON.stringify(value, (_key, v) => {',
+        "        if (typeof v === 'bigint') return `${v}n`;",
+        "        if (typeof v === 'function') return '[function]';",
+        "        if (v instanceof Map) return { map: [...v.entries()] };",
+        "        if (v instanceof Set) return { set: [...v.values()] };",
+        "        if (v && typeof v === 'object') { if (seen.has(v)) return '[circular]'; seen.add(v); }",
+        "        return v === undefined ? '[undefined]' : v;",
+        '    }) ?? "[undefined]";',
+        '}',
+        '',
+        `const calls: Array<[string, () => unknown]> = [`,
+        ...calls.map(call => `    [${JSON.stringify(call)}, () => ${call}],`),
+        '];',
+        '',
+        "test('rigour differential calls', async () => {",
+        '    const out: Record<string, string> = {};',
+        '    for (const [label, run] of calls) {',
+        '        try {',
+        '            out[label] = `returns ${render(await run())}`;',
+        '        } catch (error) {',
+        "            const e = error as { constructor?: { name?: string }; message?: string };",
+        "            out[label] = `throws ${e?.constructor?.name ?? 'Error'}: ${e?.message ?? String(error)}`;",
+        '        }',
+        '    }',
+        '    writeFileSync(process.env.RIGOUR_DIFF_OUT as string, JSON.stringify(out));',
+        '});',
+        '',
+    ].filter((line, i) => i > 0 || line).join('\n');
+}

package/dist/deep/diff-tests/calls.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deep/diff-tests/calls.test.js

@@ -0,0 +1,33 @@
+import { describe, expect, it } from 'vitest';
+import { safeCalls, testFileSource } from './calls.js';
+describe('safeCalls', () => {
+    it('keeps calls of the function with literal arguments only', () => {
+        expect(safeCalls('encodePath', [
+            "encodePath('/a b')",
+            "encodePath('/x?y', { keepQuery: true, depth: -1 }, [1, null, undefined]);",
+            'encodePath(`/%`)',
+        ])).toEqual(["encodePath('/a b')", "encodePath('/x?y', { keepQuery: true, depth: -1 }, [1, null, undefined])", 'encodePath(`/%`)']);
+    });
+    it('drops anything that could do more than call the function on data', () => {
+        expect(safeCalls('encodePath', [
+            "require('fs').rmSync('/')",
+            "encodePath(process.env.HOME)",
+            "encodePath((() => { fetch('x') })())",
+            'encodePath(`${secret}`)',
+            "other('/a')",
+            "encodePath('/a'); encodePath('/b')",
+            "encodePath({ [key]: 1 })",
+        ])).toEqual([]);
+    });
+});
+describe('testFileSource', () => {
+    it('imports the function, runs each call and records return values or errors without asserting', () => {
+        const source = testFileSource('vitest', 'encodePath', '../src/path', ["encodePath('/a b')"]);
+        expect(source).toContain("import { test } from 'vitest';");
+        expect(source).toContain('import { encodePath } from "../src/path";');
+        expect(source).toContain(`["encodePath('/a b')", () => encodePath('/a b')],`);
+        expect(source).toContain('writeFileSync(process.env.RIGOUR_DIFF_OUT as string, JSON.stringify(out));');
+        expect(source).not.toContain('expect(');
+        expect(testFileSource('jest', 'f', './f', ['f(1)'])).not.toContain("from 'vitest'");
+    });
+});

package/dist/deep/diff-tests/run.d.ts

@@ -0,0 +1,21 @@
+import type { InferenceOptions, InferenceProvider } from '../../inference/types.js';
+export interface DiffTestInput {
+    cwd: string;
+    /** The ref the change is compared against (a merge base, or HEAD for working changes). */
+    baseRef: string;
+    focusLines: Record<string, number[]>;
+    provider: InferenceProvider;
+    inference: InferenceOptions;
+    prBody?: string;
+    timeoutMs?: number;
+}
+export interface BehaviourChange {
+    file: string;
+    /** A changed line inside the function, so the finding lands on the change. */
+    line: number;
+    name: string;
+    call: string;
+    before: string;
+    after: string;
+}
+export declare function runDiffTests(input: DiffTestInput): Promise<BehaviourChange[]>;

package/dist/deep/diff-tests/run.js

@@ -0,0 +1,178 @@
+/**
+ * Differential tests: call each changed exported function on the same inputs
+ * before and after the change, and report where its behaviour changed.
+ *
+ * Many bugs reviewers miss only show up when the code runs: an encoder that
+ * stopped escaping spaces, a status that no longer reaches `notFound`. The
+ * model proposes edge-case calls (validated to be literal-only), Rigour writes
+ * a recording test, runs it in a worktree of the base and in the head tree,
+ * and compares. A change the PR description says is intended is dropped.
+ *
+ * Opt-in (`rigour review --diff-tests`), for the max and cloud tiers, and only
+ * where the package already runs vitest or jest.
+ */
+import { execa } from 'execa';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { evaluateTypedCommand } from '../../firewall/typed-command.js';
+import { loadProjectConfig, programBatches } from '../../semantic/program.js';
+import { ProjectFacts } from '../../semantic/project-facts.js';
+import { changedFunctions, functionName, isExported } from '../changed-functions.js';
+import { safeCalls, testFileSource } from './calls.js';
+const MAX_TARGETS = 5;
+/** A junction on Windows needs no admin rights; elsewhere a plain directory symlink. */
+const DIR_LINK = process.platform === 'win32' ? 'junction' : 'dir';
+const TS_FILE = /\.(?:[cm]?ts|tsx)$/i;
+const CALLS_SCHEMA = { type: 'object', properties: { calls: { type: 'array', items: { type: 'string' } } }, required: ['calls'] };
+const INTENT_SCHEMA = { type: 'object', properties: { intended: { type: 'boolean' } }, required: ['intended'] };
+export async function runDiffTests(input) {
+    const targets = findTargets(input.cwd, input.focusLines);
+    if (targets.length === 0)
+        return [];
+    const base = fs.mkdtempSync(path.join(os.tmpdir(), 'rigour-diff-base-'));
+    try {
+        await execa('git', ['worktree', 'add', '-q', '--detach', base, input.baseRef], { cwd: input.cwd });
+        linkDependencies(input.cwd, base);
+        const changes = [];
+        for (const target of targets) {
+            if (!fs.existsSync(path.join(base, target.file)))
+                continue; // a new file has no "before"
+            const calls = await proposeCalls(input, target);
+            if (calls.length === 0)
+                continue;
+            const before = await record(base, input.cwd, target, calls, input.timeoutMs);
+            const after = await record(input.cwd, input.cwd, target, calls, input.timeoutMs);
+            for (const call of calls) {
+                if (before[call] !== undefined && after[call] !== undefined && before[call] !== after[call]) {
+                    changes.push({ file: target.file, line: target.line, name: target.name, call, before: before[call], after: after[call] });
+                }
+            }
+        }
+        return input.prBody ? await dropIntended(input, changes) : changes;
+    }
+    finally {
+        await execa('git', ['worktree', 'remove', '--force', base], { cwd: input.cwd, reject: false });
+        fs.rmSync(base, { recursive: true, force: true });
+    }
+}
+/** Changed exported functions in TS files of packages that run vitest or jest. */
+function findTargets(cwd, focusLines) {
+    const facts = new ProjectFacts(cwd);
+    const targets = [];
+    const files = Object.keys(focusLines).filter(f => TS_FILE.test(f) && !/\.(?:test|spec)\./.test(f) && focusLines[f].length > 0);
+    const options = loadProjectConfig(cwd).options;
+    for (const file of files) {
+        const runner = facts.declares(file, 'vitest') ? 'vitest' : facts.declares(file, 'jest') ? 'jest' : undefined;
+        const packageDir = facts.packageDir(file);
+        if (!runner || !packageDir)
+            continue;
+        const absolute = path.resolve(cwd, file);
+        const [program] = programBatches([absolute], options, 1);
+        const sourceFile = program?.getSourceFile(absolute);
+        if (!program || !sourceFile)
+            continue;
+        program.getTypeChecker(); // binds the program: export checks walk parent pointers
+        for (const fn of changedFunctions(sourceFile, focusLines[file]).filter(isExported)) {
+            const name = functionName(fn);
+            const start = sourceFile.getLineAndCharacterOfPosition(fn.getStart(sourceFile)).line + 1;
+            const end = sourceFile.getLineAndCharacterOfPosition(fn.getEnd()).line + 1;
+            const line = focusLines[file].find(l => l >= start && l <= end);
+            if (name && line)
+                targets.push({ file, line, name, source: fn.getText(sourceFile), runner, packageDir });
+            if (targets.length >= MAX_TARGETS)
+                return targets;
+        }
+    }
+    return targets;
+}
+async function proposeCalls(input, target) {
+    const prompt = [
+        `Propose up to 8 calls of \`${target.name}\` that probe its edge cases: empty, boundary, unusual characters, missing optional fields.`,
+        'Use literal arguments only (strings, numbers, booleans, null, undefined, arrays and objects of those). No variables, no other functions.',
+        `FUNCTION (${target.file}):\n${target.source}`,
+        input.prBody ? `THE CHANGE INTENDS:\n${input.prBody.slice(0, 1000)}` : '',
+        `Respond ONLY with JSON: {"calls": ["${target.name}(...)", ...]}`,
+    ].filter(Boolean).join('\n\n');
+    try {
+        const reply = await input.provider.analyze(prompt, { ...input.inference, jsonSchema: CALLS_SCHEMA });
+        const parsed = JSON.parse(reply.slice(reply.indexOf('{'), reply.lastIndexOf('}') + 1));
+        return safeCalls(target.name, Array.isArray(parsed.calls) ? parsed.calls.map(String) : []);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Run the recording test in `root` (the base worktree or the head tree, `head`
+ * being where the target was found) and return each call's outcome; empty when
+ * the run fails.
+ */
+async function record(root, head, target, calls, timeoutMs = 120_000) {
+    const testFile = path.join(root, path.dirname(target.file), `__rigour_diff_${target.name}.test.ts`);
+    const outFile = path.join(os.tmpdir(), `rigour-diff-${process.pid}-${Date.now()}.json`);
+    const importPath = `./${path.basename(target.file).replace(/\.(?:[cm]?ts|tsx)$/, '')}`;
+    const packageDir = path.join(root, path.relative(head, target.packageDir));
+    fs.writeFileSync(testFile, testFileSource(target.runner, target.name, importPath, calls));
+    try {
+        const runner = installedRunner(packageDir, root, target.runner);
+        const command = runner && `${runner} ${target.runner === 'vitest' ? 'run ' : ''}${path.relative(packageDir, testFile)}`;
+        if (!command || evaluateTypedCommand(command).decision !== 'allow')
+            return {};
+        const [bin, ...args] = command.split(' ');
+        await execa(bin, args, { cwd: packageDir, env: { ...process.env, RIGOUR_DIFF_OUT: outFile, CI: '1' }, timeout: timeoutMs, reject: false });
+        return fs.existsSync(outFile) ? JSON.parse(fs.readFileSync(outFile, 'utf8')) : {};
+    }
+    finally {
+        fs.rmSync(testFile, { force: true });
+        fs.rmSync(outFile, { force: true });
+    }
+}
+/** The package's own installed runner, never a download: node_modules/.bin up to the repository root. */
+function installedRunner(packageDir, root, runner) {
+    for (let dir = packageDir; dir.startsWith(root); dir = path.dirname(dir)) {
+        const bin = path.join(dir, 'node_modules', '.bin', runner);
+        if (fs.existsSync(bin))
+            return bin;
+        if (dir === root)
+            break;
+    }
+    return undefined;
+}
+/** The base worktree has no installed packages: link the head's node_modules into it. */
+function linkDependencies(head, base) {
+    const walk = (dir, depth) => {
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            const from = path.join(dir, entry.name);
+            const to = path.join(base, path.relative(head, from));
+            if (entry.name === 'node_modules') {
+                // A linked node_modules (pnpm, a workspace) counts; its target is what the base needs.
+                if (fs.existsSync(path.dirname(to)) && !fs.existsSync(to))
+                    fs.symlinkSync(fs.realpathSync(from), to, DIR_LINK);
+            }
+            else if (entry.isDirectory() && entry.name !== '.git' && depth < 3) {
+                walk(from, depth + 1); // never through symlinks: no loops
+            }
+        }
+    };
+    walk(head, 0);
+}
+async function dropIntended(input, changes) {
+    const kept = [];
+    for (const change of changes) {
+        const prompt = [
+            `THE CHANGE INTENDS:\n${input.prBody.slice(0, 1500)}`,
+            `BEHAVIOUR CHANGED: ${change.call} ${change.before} before the change, and ${change.after} after it.`,
+            'Is this behaviour change what the description asks for? Respond ONLY with JSON: {"intended": true|false}.',
+        ].join('\n\n');
+        try {
+            const reply = await input.provider.analyze(prompt, { ...input.inference, jsonSchema: INTENT_SCHEMA });
+            if (JSON.parse(reply.slice(reply.indexOf('{'), reply.lastIndexOf('}') + 1)).intended !== true)
+                kept.push(change);
+        }
+        catch {
+            kept.push(change);
+        }
+    }
+    return kept;
+}

package/dist/deep/diff-tests/run.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deep/diff-tests/run.test.js

@@ -0,0 +1,58 @@
+import { execFileSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { runDiffTests } from './run.js';
+// The workspace root's node_modules, where the vitest binary is installed.
+const WORKSPACE_MODULES = path.resolve(__dirname, '../../../../../node_modules');
+let repo;
+afterEach(() => { if (repo)
+    fs.rmSync(repo, { recursive: true, force: true }); repo = undefined; });
+const BEFORE = "export function encodePath(p: string): string {\n  return p.replace(/ /g, '%20').replace(/#/g, '%23');\n}\n";
+const AFTER = "export function encodePath(p: string): string {\n  return p.replace(/#/g, '%23');\n}\n";
+function repoWithChange() {
+    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'diff-tests-'));
+    const git = (...args) => execFileSync('git', args, { cwd: repo });
+    git('init', '-q');
+    git('config', 'user.email', 't@example.com');
+    git('config', 'user.name', 't');
+    git('config', 'commit.gpgsign', 'false');
+    fs.writeFileSync(path.join(repo, 'package.json'), JSON.stringify({ name: 'paths', type: 'module', devDependencies: { vitest: '*' } }));
+    fs.writeFileSync(path.join(repo, '.gitignore'), 'node_modules\n');
+    fs.mkdirSync(path.join(repo, 'src'));
+    fs.writeFileSync(path.join(repo, 'src/encode.ts'), BEFORE);
+    git('add', '-A');
+    git('commit', '-qm', 'init');
+    fs.symlinkSync(WORKSPACE_MODULES, path.join(repo, 'node_modules'), process.platform === 'win32' ? 'junction' : 'dir');
+    fs.writeFileSync(path.join(repo, 'src/encode.ts'), AFTER);
+    return repo;
+}
+function provider(calls, intended = false) {
+    return {
+        name: 'fake', isAvailable: async () => true, setup: async () => { }, dispose: () => { },
+        analyze: async (prompt) => prompt.includes('"intended"') ? JSON.stringify({ intended }) : JSON.stringify({ calls }),
+    };
+}
+describe('runDiffTests', () => {
+    it('reports a call whose outcome changed between the base and the change', async () => {
+        const cwd = repoWithChange();
+        const changes = await runDiffTests({
+            cwd, baseRef: 'HEAD', focusLines: { 'src/encode.ts': [2] }, inference: {},
+            provider: provider(["encodePath('/a b')", "encodePath('/x#y')", "process.exit(1)"]),
+        });
+        expect(changes).toEqual([{
+                file: 'src/encode.ts', line: 2, name: 'encodePath', call: "encodePath('/a b')",
+                before: 'returns "/a%20b"', after: 'returns "/a b"',
+            }]);
+        expect(fs.readdirSync(path.join(cwd, 'src'))).toEqual(['encode.ts']);
+    }, 60_000);
+    it('drops a change the PR description says is intended', async () => {
+        const cwd = repoWithChange();
+        const changes = await runDiffTests({
+            cwd, baseRef: 'HEAD', focusLines: { 'src/encode.ts': [2] }, inference: {}, prBody: 'Stop encoding spaces.',
+            provider: provider(["encodePath('/a b')"], true),
+        });
+        expect(changes).toEqual([]);
+    }, 60_000);
+});