@rigour-labs/core 6.3.1 → 6.4.1

package/dist/deep/reference-pack.d.ts

@@ -0,0 +1,19 @@
+import type { RemovedBlock } from '../utils/diff.js';
+export interface ReferenceInput {
+    cwd: string;
+    /** cwd-relative path of the reviewed file. */
+    file: string;
+    focusLines?: number[];
+    removed?: RemovedBlock[];
+    prBody?: string;
+    maxChars: number;
+}
+export interface ReferencePack {
+    /** Prompt block, empty when there is nothing to add. */
+    text: string;
+    /** Raw reference source, for identifier verification. */
+    source: string;
+    /** The prompt sections in priority order, for a second pass that reads them in reverse. */
+    sections: string[];
+}
+export declare function buildReferencePack(input: ReferenceInput): ReferencePack;

package/dist/deep/reference-pack.js

@@ -0,0 +1,101 @@
+/**
+ * Reference material for reviewing a changed file: what the change means,
+ * beyond the file itself.
+ *
+ * Most bugs reviewers miss need facts outside the changed lines: a guard the
+ * change deleted, what a called function actually does, who calls a changed
+ * export, what the PR says it intends. The pack carries, within a character
+ * budget and in this priority:
+ *   1. the PR description,
+ *   2. lines the change removed from this file,
+ *   3. definitions of functions the changed code calls (resolved by the type checker),
+ *   4. call sites of changed exported functions elsewhere in the repository.
+ *
+ * It is reference only: findings must still cite a line of the reviewed file.
+ * Its source joins the identifier check, so a finding may name a callee.
+ */
+import { execFileSync } from 'child_process';
+import path from 'path';
+import ts from 'typescript';
+import { calledFunction, forEachNode, lineOf } from '../semantic/ast.js';
+import { changedFunctions, functionName, isExported } from './changed-functions.js';
+import { loadProjectConfig, programBatches } from '../semantic/program.js';
+const PR_BODY_CHARS = 1500;
+const MAX_CALLEES = 6;
+const CALLEE_LINES = 40;
+const MAX_CALLERS = 5;
+const TS_FILE = /\.(?:[cm]?[jt]s|[jt]sx)$/i;
+export function buildReferencePack(input) {
+    const sections = [];
+    const sources = [];
+    let budget = input.maxChars;
+    const add = (title, body, source = body) => {
+        const block = `${title}\n${body}`;
+        if (!body.trim() || block.length > budget)
+            return;
+        sections.push(block);
+        sources.push(source);
+        budget -= block.length + 2;
+    };
+    if (input.prBody?.trim())
+        add('PR DESCRIPTION (what the author intends):', input.prBody.trim().slice(0, PR_BODY_CHARS));
+    for (const block of input.removed ?? []) {
+        add(`REMOVED by this change, just before line ${block.line} of ${input.file}:`, block.text.map(l => `- ${l}`).join('\n'), block.text.join('\n'));
+    }
+    const change = changeOf(input);
+    if (change) {
+        for (const callee of calleeDefinitions(input.cwd, change))
+            add(`CALLED: ${callee.label}`, callee.text);
+        for (const caller of callersOfChangedExports(input.cwd, input.file, change))
+            add(`CALLER of ${caller.name}:`, caller.text);
+    }
+    return { text: sections.join('\n\n'), source: sources.join('\n'), sections };
+}
+function changeOf(input) {
+    const focus = input.focusLines ?? [];
+    if (focus.length === 0 || !TS_FILE.test(input.file))
+        return undefined;
+    const absolute = path.resolve(input.cwd, input.file);
+    const [program] = programBatches([absolute], loadProjectConfig(input.cwd).options, 1);
+    const sourceFile = program?.getSourceFile(absolute);
+    if (!program || !sourceFile)
+        return undefined;
+    return { sourceFile, checker: program.getTypeChecker(), functions: changedFunctions(sourceFile, focus) };
+}
+/** Definitions, in other files, of functions called from the changed functions. */
+function calleeDefinitions(cwd, change) {
+    const seen = new Set();
+    const snippets = [];
+    for (const fn of change.functions) {
+        forEachNode(fn, (node) => {
+            if (snippets.length >= MAX_CALLEES || !ts.isCallExpression(node))
+                return;
+            const target = calledFunction(change.checker, node);
+            const where = target?.getSourceFile();
+            if (!target || !where || seen.has(target) || where === change.sourceFile || where.isDeclarationFile)
+                return;
+            seen.add(target);
+            const lines = target.getText(where).split('\n');
+            const text = lines.slice(0, CALLEE_LINES).join('\n') + (lines.length > CALLEE_LINES ? `\n… [${lines.length - CALLEE_LINES} more lines]` : '');
+            snippets.push({ label: `${path.relative(cwd, where.fileName).split(path.sep).join('/')}:${lineOf(target)}`, text });
+        });
+    }
+    return snippets;
+}
+/** Call sites, outside this file, of exported functions the change touched. */
+function callersOfChangedExports(cwd, file, change) {
+    const names = change.functions.filter(isExported).map(functionName).filter((n) => !!n);
+    return names.map(name => ({ name, text: grepCallers(cwd, file, name) })).filter(c => c.text);
+}
+function grepCallers(cwd, file, name) {
+    try {
+        const out = execFileSync('git', ['grep', '-n', '-E', '-e', `(^|[^A-Za-z0-9_$])${name}\\(`, '--', '*.ts', '*.tsx', '*.js', '*.jsx', '*.mjs', `:!${file}`], {
+            cwd, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return out.split('\n').filter(Boolean).filter(l => !/\.(?:test|spec)\./.test(l)).slice(0, MAX_CALLERS)
+            .map(l => l.length > 200 ? `${l.slice(0, 200)}…` : l).join('\n');
+    }
+    catch {
+        return '';
+    }
+}

package/dist/deep/reference-pack.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deep/reference-pack.test.js

@@ -0,0 +1,46 @@
+import { execFileSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { buildReferencePack } from './reference-pack.js';
+let repo;
+afterEach(() => { if (repo)
+    fs.rmSync(repo, { recursive: true, force: true }); repo = undefined; });
+function project() {
+    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'reference-pack-'));
+    const files = {
+        'src/paths.ts': "export function cleanPath(p: string): string {\n  return p.replace(/\\/+/g, '/');\n}\n",
+        'src/routes.ts': "import { cleanPath } from './paths';\nexport function routePath(dir: string, route: string): string {\n  return cleanPath(`/${dir}${route}`);\n}\n",
+        'src/generator.ts': "import { routePath } from './routes';\nexport const home = routePath('.', '/');\n",
+    };
+    for (const [name, text] of Object.entries(files)) {
+        fs.mkdirSync(path.dirname(path.join(repo, name)), { recursive: true });
+        fs.writeFileSync(path.join(repo, name), text);
+    }
+    execFileSync('git', ['init', '-q'], { cwd: repo });
+    execFileSync('git', ['add', '-A'], { cwd: repo });
+    return repo;
+}
+describe('buildReferencePack', () => {
+    it('carries the intent, removed lines, callee definitions and callers of a changed export', () => {
+        const cwd = project();
+        const pack = buildReferencePack({
+            cwd, file: 'src/routes.ts', focusLines: [3], maxChars: 10_000,
+            prBody: 'Normalize virtual route paths.',
+            removed: [{ line: 3, text: ["  return `/${dir}${route}`;"] }],
+        });
+        expect(pack.text).toContain('PR DESCRIPTION (what the author intends):\nNormalize virtual route paths.');
+        expect(pack.text).toContain('REMOVED by this change, just before line 3 of src/routes.ts:\n-   return `/${dir}${route}`;');
+        expect(pack.text).toContain('CALLED: src/paths.ts:1\nexport function cleanPath');
+        expect(pack.text).toContain("CALLER of routePath:\nsrc/generator.ts:2:export const home = routePath('.', '/');");
+        expect(pack.source).toContain('cleanPath');
+    });
+    it('stays within its budget, keeping the highest-priority sections', () => {
+        const cwd = project();
+        const pack = buildReferencePack({ cwd, file: 'src/routes.ts', focusLines: [3], maxChars: 80, prBody: 'Normalize virtual route paths.' });
+        expect(pack.text).toContain('PR DESCRIPTION');
+        expect(pack.text).not.toContain('CALLED');
+        expect(pack.text.length).toBeLessThanOrEqual(80);
+    });
+});

package/dist/deep/review-context-export.d.ts

@@ -0,0 +1,11 @@
+export interface ReviewContextExport {
+    file: string;
+    focusLines: number[];
+    prompt: string;
+}
+export interface ReviewContextOptions {
+    prBody?: string;
+    maxSourceChars?: number;
+    maxReferenceChars?: number;
+}
+export declare function exportReviewContexts(cwd: string, diff: string, options?: ReviewContextOptions): Promise<ReviewContextExport[]>;

package/dist/deep/review-context-export.js

@@ -0,0 +1,31 @@
+/**
+ * The exact prompt the max tier would review for each changed file of a diff.
+ *
+ * The driftbench review miner pairs these prompts with what the later fix
+ * changed, so a fine-tuned model learns from the input it will get at runtime,
+ * built by the same code (numbered source, focus segments, reference pack).
+ */
+import fs from 'fs';
+import path from 'path';
+import { changedLinesByFile, parseDiff, removedByFile } from '../utils/diff.js';
+import { buildCodeContext } from './code-context.js';
+import { buildCodeReviewPrompt } from './code-review-prompt.js';
+import { extractFacts } from './fact-extractor.js';
+import { buildReferencePack } from './reference-pack.js';
+export async function exportReviewContexts(cwd, diff, options = {}) {
+    const focus = changedLinesByFile(parseDiff(diff));
+    const removed = removedByFile(diff);
+    const files = Object.keys(focus).filter(f => focus[f].length > 0 && fs.existsSync(path.join(cwd, f)));
+    if (files.length === 0)
+        return [];
+    const facts = await extractFacts(cwd, [], files);
+    return facts.map(fileFacts => {
+        const content = fs.readFileSync(path.join(cwd, fileFacts.path), 'utf-8');
+        const context = buildCodeContext(fileFacts, content, { maxChars: options.maxSourceChars ?? 36_000, focusLines: focus[fileFacts.path] });
+        const pack = buildReferencePack({
+            cwd, file: fileFacts.path, focusLines: focus[fileFacts.path], removed: removed[fileFacts.path],
+            prBody: options.prBody, maxChars: options.maxReferenceChars ?? 12_000,
+        });
+        return { file: fileFacts.path, focusLines: focus[fileFacts.path], prompt: buildCodeReviewPrompt(context, pack.text) };
+    });
+}

package/dist/deep/review-context-export.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deep/review-context-export.test.js

@@ -0,0 +1,32 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { buildCodeReviewPrompt } from './code-review-prompt.js';
+import { exportReviewContexts } from './review-context-export.js';
+let dir;
+afterEach(() => { if (dir)
+    fs.rmSync(dir, { recursive: true, force: true }); dir = undefined; });
+const DIFF = `diff --git a/src/total.ts b/src/total.ts
+--- a/src/total.ts
++++ b/src/total.ts
+@@ -2,2 +2,2 @@
+   let sum = 0;
+-  for (let i = 0; i < items.length; i++) sum += items[i];
++  for (let i = 0; i <= items.length; i++) sum += items[i];
+`;
+describe('exportReviewContexts', () => {
+    it('emits the review prompt for each changed file, with its focus lines and what the change removed', async () => {
+        dir = fs.mkdtempSync(path.join(os.tmpdir(), 'review-context-'));
+        fs.mkdirSync(path.join(dir, 'src'));
+        fs.writeFileSync(path.join(dir, 'src/total.ts'), 'export function total(items: number[]) {\n  let sum = 0;\n  for (let i = 0; i <= items.length; i++) sum += items[i];\n  return sum;\n}\n');
+        const [context, ...rest] = await exportReviewContexts(dir, DIFF, { prBody: 'Sum the basket.' });
+        expect(rest).toEqual([]);
+        expect(context.file).toBe('src/total.ts');
+        expect(context.focusLines).toEqual([3]);
+        expect(context.prompt.startsWith(buildCodeReviewPrompt({ file: '', language: '', text: '', ranges: [], source: '' }).slice(0, 60))).toBe(true);
+        expect(context.prompt).toContain('3|   for (let i = 0; i <= items.length; i++) sum += items[i];');
+        expect(context.prompt).toContain('-   for (let i = 0; i < items.length; i++) sum += items[i];');
+        expect(context.prompt).toContain('Sum the basket.');
+    });
+});

package/dist/deep/self-check.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Self-check: the model re-reads each finding against the code and confirms
+ * or withdraws it.
+ *
+ * Two review passes with the reference material in different orders raise
+ * recall (a finding one ordering misses, the other catches); asking again,
+ * finding by finding, whether it would misbehave at runtime keeps that extra
+ * recall from arriving as noise. A check that cannot run keeps the finding:
+ * an unavailable model is not evidence against it.
+ */
+import type { DeepFinding, InferenceOptions, InferenceProvider } from '../inference/types.js';
+import type { CodeContext } from './code-context.js';
+export interface SelfCheckResult {
+    kept: DeepFinding[];
+    withdrawn: number;
+    failed: number;
+}
+export declare function selfCheck(provider: InferenceProvider, context: CodeContext, reference: string, findings: DeepFinding[], inference: InferenceOptions): Promise<SelfCheckResult>;
+export declare function checkPrompt(context: CodeContext, reference: string, finding: DeepFinding): string;
+/** true, false, or undefined when the reply is not a verdict. */
+export declare function parseVerdict(reply: string): boolean | undefined;

package/dist/deep/self-check.js

@@ -0,0 +1,49 @@
+const MAX_CHECKED = 8;
+const VERDICT_SCHEMA = {
+    type: 'object',
+    properties: { real: { type: 'boolean' }, reason: { type: 'string' } },
+    required: ['real'],
+};
+export async function selfCheck(provider, context, reference, findings, inference) {
+    const result = { kept: [], withdrawn: 0, failed: 0 };
+    for (const [index, finding] of findings.entries()) {
+        if (index >= MAX_CHECKED) {
+            result.kept.push(finding);
+            continue;
+        }
+        try {
+            const reply = await provider.analyze(checkPrompt(context, reference, finding), { ...inference, jsonSchema: VERDICT_SCHEMA });
+            if (parseVerdict(reply) === false)
+                result.withdrawn++;
+            else
+                result.kept.push(finding);
+        }
+        catch {
+            result.failed++;
+            result.kept.push(finding);
+        }
+    }
+    return result;
+}
+export function checkPrompt(context, reference, finding) {
+    return [
+        'You reported a defect in a code review. Check it against the code before it is posted.',
+        `SOURCE (line numbers on the left):\n${context.text}`,
+        reference ? `REFERENCE (not under review):\n${reference}` : '',
+        `REPORTED at ${context.file}:${finding.line}: ${finding.description}`,
+        'Is this a real defect: would this code misbehave at runtime or in production as described? '
+            + 'Answer false if it is style, speculation about unseen callers, or already handled in the code shown. '
+            + 'Respond ONLY with JSON: {"real": true|false, "reason": "..."}.',
+    ].filter(Boolean).join('\n\n');
+}
+/** true, false, or undefined when the reply is not a verdict. */
+export function parseVerdict(reply) {
+    const json = reply.slice(reply.indexOf('{'), reply.lastIndexOf('}') + 1);
+    try {
+        const value = JSON.parse(json).real;
+        return typeof value === 'boolean' ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/firewall/trusted-control.d.ts

@@ -19,7 +19,7 @@ export declare function getGatewayPolicyHash(cwd: string, config: GatewayControl
 export declare function validateGatewayConfig(value: unknown): GatewayControlConfig;
 export declare function saveGatewayConfig(cwd: string, config: GatewayControlConfig, controlRoot?: string): Promise<string>;
 export declare function loadGatewayConfig(cwd: string, controlRoot?: string): Promise<GatewayControlConfig | null>;
-interface GrantInput {
+export interface GrantInput {
     issuerId: string;
     subjectId: string;
     taskId: string;
@@ -42,4 +42,3 @@ export declare function consumeTrustedGrant(cwd: string, input: {
     reason: string;
     grant?: CapabilityGrant;
 }>;
-export {};

package/dist/gates/deep-analysis.d.ts

@@ -47,6 +47,8 @@ export declare class DeepAnalysisGate extends Gate {
     run(context: GateContext): Promise<Failure[]>;
     private setupProvider;
     private reviewCode;
+    /** The max and cloud tiers read reference material and review twice; the small models do not. */
+    private referenceOptions;
     private analyzeFacts;
     private recordPass;
     private localMemoryFindings;

package/dist/gates/deep-analysis.js

@@ -32,6 +32,9 @@ const CLOUD_SETUP_TIMEOUT_MS = 120_000;
  */
 const LOCAL_SOURCE_CHARS = 36_000;
 const CLOUD_SOURCE_CHARS = 60_000;
+/** Reference material (removed lines, callees, callers, PR intent) for the max and cloud tiers. */
+const LOCAL_REFERENCE_CHARS = 12_000;
+const CLOUD_REFERENCE_CHARS = 24_000;
 export class DeepAnalysisGate extends Gate {
     config;
     provider = null;
@@ -104,11 +107,20 @@ export class DeepAnalysisGate extends Gate {
             inference: inferenceOptions(this.config),
             maxSourceChars: isCloud(this.config.options) ? CLOUD_SOURCE_CHARS : LOCAL_SOURCE_CHARS,
             focusLines: this.config.options.focusLines,
+            reference: this.referenceOptions(),
             onProgress: this.config.onProgress,
         });
         this.recordPass(result);
         return verifyCodeFindings(result.findings, result.contexts);
     }
+    /** The max and cloud tiers read reference material and review twice; the small models do not. */
+    referenceOptions() {
+        const options = this.config.options;
+        const cloud = isCloud(options);
+        if (!cloud && !options.max)
+            return undefined;
+        return { maxChars: cloud ? CLOUD_REFERENCE_CHARS : LOCAL_REFERENCE_CHARS, removed: options.removedLines, prBody: options.prBody };
+    }
     async analyzeFacts(cwd, facts) {
         this.config.onProgress?.(`  Found ${facts.length} files to analyze.`);
         const memory = await this.localMemoryFindings(cwd, facts);

package/dist/gates/deep-runner.js

@@ -3,6 +3,7 @@
  * and failures, derived from the deep gate's outcome.
  */
 import { DeepAnalysisGate } from './deep-analysis.js';
+import { localTier } from '../inference/types.js';
 import { Logger } from '../utils/logger.js';
 /**
  * Run the deep gate and turn its outcome into summary, stats and failures.
@@ -37,7 +38,7 @@ export async function runDeepAnalysis(config, context, deepOptions) {
         enabled: true,
         status: outcome.status,
         mode: outcome.mode,
-        tier: isLocal ? (deepOptions.pro ? 'deep' : 'lite') : 'cloud',
+        tier: isLocal ? localTier(deepOptions) : 'cloud',
         model: outcome.model,
         model_fallback: outcome.modelFallback,
         total_ms: Date.now() - start,

package/dist/gates/hallucinated-imports/js-resolver.d.ts

@@ -29,6 +29,13 @@ export interface JsImportContext {
  * Check JavaScript/TypeScript imports in a source file and add hallucinated findings.
  */
 export declare function checkJSImports(content: string, file: string, ctx: JsImportContext): Promise<void>;
+/**
+ * Bundler conventions: a query on a relative import (`./logo.svg?raw`, `./worker.ts?worker`)
+ * names a transform of that file, so the file is what must exist; a `virtual:` module or a
+ * bare specifier with a query (`page.tsx?tsr-split=component`) is produced by a plugin at
+ * build time and cannot be checked. Returns the path to check, or null to skip.
+ */
+export declare function bundlerSpecifier(importPath: string): string | null;
 /**
  * Collect all import statements from JavaScript/TypeScript file content.
  * Handles import, export, require(), and dynamic import() statements.

package/dist/gates/hallucinated-imports/js-resolver.js

@@ -21,7 +21,9 @@ import { loadTsPathConfig } from './tsconfig-paths.js';
 export async function checkJSImports(content, file, ctx) {
     const depsForFile = await resolveJSDepsForFile(file, ctx.cwd, ctx.rootDeps, ctx.depCacheByDir);
     const kitRoot = await ctx.kitRoots.rootFor(file);
-    for (const { importPath, line } of collectJSImportSpecs(content, file)) {
+    for (const spec of collectJSImportSpecs(content, file)) {
+        const { line } = spec;
+        const importPath = bundlerSpecifier(spec.importPath);
         if (!importPath || ctx.shouldIgnore(importPath))
             continue;
         if (kitRoot && isSvelteKitProvided(importPath))
@@ -38,6 +40,20 @@ export async function checkJSImports(content, file, ctx) {
         }
     }
 }
+/**
+ * Bundler conventions: a query on a relative import (`./logo.svg?raw`, `./worker.ts?worker`)
+ * names a transform of that file, so the file is what must exist; a `virtual:` module or a
+ * bare specifier with a query (`page.tsx?tsr-split=component`) is produced by a plugin at
+ * build time and cannot be checked. Returns the path to check, or null to skip.
+ */
+export function bundlerSpecifier(importPath) {
+    if (!importPath || importPath.startsWith('virtual:') || importPath.startsWith('\0'))
+        return null;
+    const query = importPath.search(/[?#]/);
+    if (query < 0)
+        return importPath;
+    return importPath.startsWith('.') ? importPath.slice(0, query) : null;
+}
 async function checkRelativeImport(file, importPath, ctx) {
     if (ctx.resolveRelativeImport(file, importPath, ctx.projectFiles))
         return null;

package/dist/gates/hallucinated-imports-sveltekit.test.js

@@ -106,3 +106,27 @@ describe('HallucinatedImportsGate — tsconfig inheritance and rootDirs', () =>
         expect(await missingImports(cwd)).toContain("'./nowhere'");
     });
 });
+describe('HallucinatedImportsGate — bundler query and virtual imports', () => {
+    let cwd;
+    beforeEach(() => {
+        cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'bundler-imports-'));
+        write(cwd, 'package.json', JSON.stringify({ dependencies: { '@tanstack/react-router': '1.0.0' } }));
+        write(cwd, 'src/logo.svg', '<svg/>');
+        write(cwd, 'src/worker.ts', 'export {};\n');
+    });
+    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+    it('checks the file behind a query and skips plugin-provided modules', async () => {
+        write(cwd, 'src/route.tsx', [
+            "import raw from './logo.svg?raw';",
+            "import Worker from './worker.ts?worker&inline';",
+            "const split = () => import('route.tsx?tsr-split=component');",
+            "import { registerSW } from 'virtual:pwa-register';",
+            'export default { raw, Worker, split, registerSW };',
+        ].join('\n'));
+        expect(await missingImports(cwd)).toBe('');
+    });
+    it('still reports a missing module behind a query', async () => {
+        write(cwd, 'src/route.tsx', "import Worker from './missing-worker.ts?worker';\nexport default Worker;\n");
+        expect(await missingImports(cwd)).toContain('./missing-worker.ts');
+    });
+});

package/dist/gates/semantic-bugs.js

@@ -8,7 +8,7 @@
 import { Gate } from './base.js';
 import { FileScanner } from '../utils/scanner.js';
 import { Logger } from '../utils/logger.js';
-import { analyzeFiles, BUILT_IN_RULES } from '../semantic/engine.js';
+import { ALL_RULES, analyzeFiles, BUILT_IN_RULES } from '../semantic/engine.js';
 import { compileLearnedRule, LEARNED_PREFIX } from '../semantic/learn/compile.js';
 import { loadLearnedRules } from '../semantic/learn/store.js';
 const SOURCE_PATTERNS = ['**/*.{ts,tsx,js,jsx,mjs,cjs,mts,cts}'];
@@ -36,9 +36,10 @@ export class SemanticBugsGate extends Gate {
     }
     /** Built-in rules plus the repository's learned rules (`.rigour/rules/`), filtered by config. */
     selectRules(cwd) {
-        const all = [...BUILT_IN_RULES, ...loadLearnedRules(cwd).map(compileLearnedRule)];
+        const learned = loadLearnedRules(cwd).map(compileLearnedRule);
         const wanted = this.config.rules;
-        return wanted?.length ? all.filter(rule => wanted.includes(rule.id)) : all;
+        // Named rules may include opt-in candidates; unnamed, only the default set runs.
+        return wanted?.length ? [...ALL_RULES, ...learned].filter(rule => wanted.includes(rule.id)) : [...BUILT_IN_RULES, ...learned];
     }
     toFailure(finding) {
         const failure = this.createFailure(`${finding.message}\n${finding.evidence.map(e => `  at ${e}`).join('\n')}`, [finding.file], finding.hint, `[${finding.rule}] ${finding.message.split('. ')[0]}`.slice(0, 120), finding.line, undefined, finding.severity);

package/dist/gates/semantic-bugs.test.js

@@ -4,6 +4,7 @@ import path from 'path';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 import { SemanticBugsGate } from './semantic-bugs.js';
 import { GateRunner } from './runner.js';
+import { ConfigSchema } from '../types/index.js';
 const LEAKY = [
     'export async function notify(endpoint: string, signature: string) {',
     "  return fetch(endpoint, { method: 'POST', headers: { 'x-hook-signature': signature } });",
@@ -17,6 +18,12 @@ describe('SemanticBugsGate', () => {
         fs.mkdirSync(path.dirname(path.join(cwd, rel)), { recursive: true });
         fs.writeFileSync(path.join(cwd, rel), body);
     }
+    it('runs an unvalidated candidate rule only when it is named', async () => {
+        write('src/scroll.ts', "export function setup(fn: () => void) {\n  window.addEventListener('a', fn);\n  addEventListener('b', fn);\n}\n");
+        expect(await new SemanticBugsGate().run({ cwd })).toEqual([]);
+        const named = await new SemanticBugsGate({ rules: ['env/bare-browser-global'] }).run({ cwd });
+        expect(named.map(f => [f.category, f.line])).toEqual([['env/bare-browser-global', 3]]);
+    });
     it('reports a proven finding with its evidence, rule and verified metadata', async () => {
         write('src/notify.ts', LEAKY);
         const [failure, ...rest] = await new SemanticBugsGate().run({ cwd });
@@ -59,12 +66,11 @@ describe('SemanticBugsGate', () => {
         expect(failure.title).toContain('[learned/require-option-redirect-abcd1234]');
         expect(failure.hint).toContain('fix abcdef01 in src/http.ts (post)');
     });
-    it('is off unless enabled in rigour.yml', async () => {
+    it('is on by default and can be turned off in rigour.yml', async () => {
         write('src/notify.ts', LEAKY);
-        const base = { version: 1, commands: {}, gates: { max_file_lines: 500 } };
-        const off = await new GateRunner(base).run(cwd);
-        expect(off.failures.some(f => f.id === 'semantic-bugs')).toBe(false);
-        const on = await new GateRunner({ ...base, gates: { ...base.gates, semantic_bugs: { enabled: true } } }).run(cwd);
+        const on = await new GateRunner(ConfigSchema.parse({ version: 1 })).run(cwd);
         expect(on.failures.some(f => f.id === 'semantic-bugs')).toBe(true);
+        const off = await new GateRunner(ConfigSchema.parse({ version: 1, gates: { semantic_bugs: { enabled: false } } })).run(cwd);
+        expect(off.failures.some(f => f.id === 'semantic-bugs')).toBe(false);
     });
 });

package/dist/hooks/checker.d.ts

@@ -8,7 +8,7 @@
  *
  */
 import type { HookCheckerResult } from './types.js';
-interface CheckerOptions {
+export interface CheckerOptions {
     cwd: string;
     files: string[];
     timeout_ms?: number;
@@ -21,4 +21,3 @@ interface CheckerOptions {
  * Returns structured JSON for hook consumers.
  */
 export declare function runHookChecker(options: CheckerOptions): Promise<HookCheckerResult>;
-export {};

package/dist/hooks/index.d.ts

@@ -3,7 +3,9 @@
  *
  */
 export { runHookChecker } from './checker.js';
+export type { CheckerOptions } from './checker.js';
 export { generateHookFiles } from './templates.js';
+export type { GeneratedHookFile } from './templates.js';
 export type { HookTool, HookConfig, HookCheckerResult } from './types.js';
 export { DEFAULT_HOOK_CONFIG, FAST_GATE_IDS } from './types.js';
 export { scanInputForCredentials, formatDLPAlert, createDLPAuditEntry } from './input-validator.js';
@@ -12,3 +14,5 @@ export { recordDLPFeedback, allowLastDLPBlock, writeDLPBlockManifest, getLearned
 export type { DLPFeedbackEntry, DLPFeedbackStore, DLPBlockManifest } from './dlp-feedback.js';
 export { generateDLPHookFiles } from './dlp-templates.js';
 export type { GeneratedDLPHookFile } from './dlp-templates.js';
+export { stopReview, stopMessage, blocksStop, STOP_MAX_ATTEMPTS } from './stop-review.js';
+export type { StopDecision } from './stop-review.js';

package/dist/hooks/index.js

@@ -9,3 +9,5 @@ export { DEFAULT_HOOK_CONFIG, FAST_GATE_IDS } from './types.js';
 export { scanInputForCredentials, formatDLPAlert, createDLPAuditEntry } from './input-validator.js';
 export { recordDLPFeedback, allowLastDLPBlock, writeDLPBlockManifest, getLearnedAllowCount, loadDLPFeedbackStore, loadDLPFeedbackStoreSync, fingerprintDetection, } from './dlp-feedback.js';
 export { generateDLPHookFiles } from './dlp-templates.js';
+// Stop review ("before you say done")
+export { stopReview, stopMessage, blocksStop, STOP_MAX_ATTEMPTS } from './stop-review.js';

package/dist/hooks/stop-review.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The "before you say done" review: when an agent is about to stop, review the
+ * uncommitted change and, if it introduced serious findings, tell the agent
+ * what to fix instead of letting it finish.
+ *
+ * Only findings that deserve it block: critical ones, and high ones that are
+ * proven (the semantic engine traced them) or security findings. A high
+ * heuristic (a regex that sees `fetch` without `.catch`) is not enough to hold
+ * an agent back; callers also cap the number of attempts.
+ */
+import type { Config, Failure } from '../types/index.js';
+export declare const STOP_MAX_ATTEMPTS = 3;
+export interface StopDecision {
+    block: boolean;
+    /** What the agent is told when blocked; empty otherwise. */
+    message: string;
+    blocking: number;
+    /** Every finding on changed lines, and the files the review covered (for fix capture). */
+    findings: Failure[];
+    reviewedFiles: string[];
+}
+export declare function stopReview(cwd: string, config: Config, attempt: number): Promise<StopDecision>;
+/** Critical, or high and either proven by the semantic engine or a security finding. */
+export declare function blocksStop(finding: Failure): boolean;
+export declare function stopMessage(findings: Failure[], attempt: number): string;

package/dist/hooks/stop-review.js

@@ -0,0 +1,31 @@
+import { reviewChange } from '../review/review.js';
+export const STOP_MAX_ATTEMPTS = 3;
+const MAX_LISTED = 8;
+export async function stopReview(cwd, config, attempt) {
+    const result = await reviewChange({ cwd, config, source: { mode: 'working' } });
+    const blocking = result.findings.filter(blocksStop);
+    const reviewed = { findings: result.findings, reviewedFiles: Object.keys(result.changedLines) };
+    if (blocking.length === 0)
+        return { block: false, message: '', blocking: 0, ...reviewed };
+    return { block: true, message: stopMessage(blocking, attempt), blocking: blocking.length, ...reviewed };
+}
+/** Critical, or high and either proven by the semantic engine or a security finding. */
+export function blocksStop(finding) {
+    const severity = (finding.severity || 'medium');
+    if (severity === 'critical')
+        return true;
+    return severity === 'high' && (finding.verified === true || finding.provenance === 'security');
+}
+export function stopMessage(findings, attempt) {
+    const listed = findings.slice(0, MAX_LISTED).map(f => {
+        const where = `${f.files?.[0] ?? '?'}:${f.line ?? '?'}`;
+        return `- [${(f.severity || 'medium').toUpperCase()}] ${where} ${f.title}${f.hint ? `\n  Fix: ${f.hint}` : ''}`;
+    });
+    const more = findings.length > MAX_LISTED ? [`- …and ${findings.length - MAX_LISTED} more (run \`rigour review\`).`] : [];
+    return [
+        `Rigour review found ${findings.length} serious issue(s) on the lines you changed (attempt ${attempt} of ${STOP_MAX_ATTEMPTS}).`,
+        'Fix them before finishing, or explain why a finding is wrong:',
+        ...listed,
+        ...more,
+    ].join('\n');
+}