@rigour-labs/core 6.3.1 → 6.4.1

package/dist/index.d.ts

@@ -11,6 +11,11 @@ export { FrontendSecretExposureGate } from './gates/frontend-secret-exposure.js'
 export * from './utils/logger.js';
 export { normalizeScopePatterns, isScoped } from './utils/scope.js';
 export { deepAnalysisError } from './utils/deep-status.js';
+export { reviewChange, toReviewFinding, type ReviewInput, type ReviewResult, type ReviewFinding } from './review/review.js';
+export { splitByChangedLines, type ChangedLineSplit } from './review/changed-lines.js';
+export { diffFromGit, GitDiffError, type DiffSource } from './review/git-diff.js';
+export { recordReviewOutcome, listResolvedFixes, removeResolvedFix, openFindingCount, type ResolvedFix, type FixCapture } from './review/agent-fixes.js';
+export { computeEffectiveness, readAgentEvents, appendAgentEvent, findingKeys, type AgentEvent, type ReviewEffectiveness } from './review/effectiveness.js';
 export { parseDiff, changedLinesByFile } from './utils/diff.js';
 export { FileScanner } from './utils/scanner.js';
 export * from './services/score-history.js';
@@ -20,7 +25,7 @@ export type { RigourSettings, ResolvedDeepOptions, CLIDeepOptions } from './sett
 export { DeepAnalysisGate } from './gates/deep-analysis.js';
 export { createProvider } from './inference/index.js';
 export type { InferenceProvider, DeepFinding, DeepAnalysisResult, ModelTier } from './inference/types.js';
-export { MODELS } from './inference/types.js';
+export { MODELS, localTier } from './inference/types.js';
 export { isModelCached, getModelsDir, getModelInfo, getCachedModel, ensureModel } from './inference/model-manager.js';
 export { installLlamaEngine, probeBinary, managedEnginePath, LLAMA_RELEASE_TAG } from './inference/llama-engine.js';
 export { SidecarProvider } from './inference/sidecar-provider.js';
@@ -51,8 +56,27 @@ export * from './services/system-health.js';
 export * from './services/agent-history.js';
 export * from './services/engineering-knowledge-graph.js';
 export * from './firewall/index.js';
-export { learnFromFix, type LearnReport, type Rejection } from './semantic/learn/learn.js';
+export { exportCallSites } from './semantic/sites/export.js';
+export { ALL_RULES, analyzeFiles, BUILT_IN_RULES } from './semantic/engine.js';
+export { exportReviewContexts, type ReviewContextExport, type ReviewContextOptions } from './deep/review-context-export.js';
+export type { CallSite, HandledBy } from './semantic/sites/call-sites.js';
+export { learnFromFix, learnFromFileChange, type LearnReport, type Rejection } from './semantic/learn/learn.js';
 export { extractFixTrees, type FixTrees } from './semantic/learn/git-trees.js';
 export { saveLearnedRule, loadLearnedRules, LEARNED_RULES_DIR } from './semantic/learn/store.js';
 export type { LearnedRule, LearnedPattern } from './semantic/learn/types.js';
 export { recordContextEvent, recordModelUsage, recordCheckpointMetric, getContextEvents, getModelUsages, getCheckpointMetrics, } from './storage/index.js';
+export type { ModelInfo } from './inference/types.js';
+export type { HttpGet } from './inference/http-download.js';
+export type { FileFacts } from './deep/fact-extractor.js';
+export type { ScanRecord } from './storage/scans.js';
+export type { QualityTrend } from './services/adaptive-thresholds.js';
+export type { EngineOptions } from './semantic/engine.js';
+export type { LearnInput } from './semantic/learn/learn.js';
+export type { ContextEvent } from './storage/index.js';
+export type { CachedModel } from './inference/model-manager.js';
+export type { ProbeResult } from './inference/llama-engine.js';
+export type { PatternRecord } from './storage/patterns.js';
+export type { SemanticFinding } from './semantic/types.js';
+export type { ModelUsage } from './storage/index.js';
+export type { CheckpointMetric } from './storage/index.js';
+export type { CursorUsageSyncOptions } from './services/cursor-usage-client.js';

package/dist/index.js

@@ -11,6 +11,11 @@ export { FrontendSecretExposureGate } from './gates/frontend-secret-exposure.js'
 export * from './utils/logger.js';
 export { normalizeScopePatterns, isScoped } from './utils/scope.js';
 export { deepAnalysisError } from './utils/deep-status.js';
+export { reviewChange, toReviewFinding } from './review/review.js';
+export { splitByChangedLines } from './review/changed-lines.js';
+export { diffFromGit, GitDiffError } from './review/git-diff.js';
+export { recordReviewOutcome, listResolvedFixes, removeResolvedFix, openFindingCount } from './review/agent-fixes.js';
+export { computeEffectiveness, readAgentEvents, appendAgentEvent, findingKeys } from './review/effectiveness.js';
 export { parseDiff, changedLinesByFile } from './utils/diff.js';
 export { FileScanner } from './utils/scanner.js';
 export * from './services/score-history.js';
@@ -20,7 +25,7 @@ export { loadSettings, saveSettings, getSettingsPath, resolveDeepOptions, getPro
 // Deep Analysis Pipeline (v4.0+)
 export { DeepAnalysisGate } from './gates/deep-analysis.js';
 export { createProvider } from './inference/index.js';
-export { MODELS } from './inference/types.js';
+export { MODELS, localTier } from './inference/types.js';
 export { isModelCached, getModelsDir, getModelInfo, getCachedModel, ensureModel } from './inference/model-manager.js';
 export { installLlamaEngine, probeBinary, managedEnginePath, LLAMA_RELEASE_TAG } from './inference/llama-engine.js';
 export { SidecarProvider } from './inference/sidecar-provider.js';
@@ -50,11 +55,10 @@ export * from './services/system-health.js';
 export * from './services/agent-history.js';
 export * from './services/engineering-knowledge-graph.js';
 export * from './firewall/index.js';
-export { learnFromFix } from './semantic/learn/learn.js';
+export { exportCallSites } from './semantic/sites/export.js';
+export { ALL_RULES, analyzeFiles, BUILT_IN_RULES } from './semantic/engine.js';
+export { exportReviewContexts } from './deep/review-context-export.js';
+export { learnFromFix, learnFromFileChange } from './semantic/learn/learn.js';
 export { extractFixTrees } from './semantic/learn/git-trees.js';
 export { saveLearnedRule, loadLearnedRules, LEARNED_RULES_DIR } from './semantic/learn/store.js';
 export { recordContextEvent, recordModelUsage, recordCheckpointMetric, getContextEvents, getModelUsages, getCheckpointMetrics, } from './storage/index.js';
-// Pattern Index is intentionally NOT exported here to prevent
-// native dependency issues (sharp/transformers) from leaking into
-// non-AI parts of the system.
-// Import from @rigour-labs/core/pattern-index instead.

package/dist/inference/index.d.ts

@@ -10,7 +10,7 @@ export type { ProbeResult } from './llama-engine.js';
 export { CloudProvider } from './cloud-provider.js';
 export { ensureModel, isModelCached, getModelPath, getModelInfo, downloadModel, getModelsDir, getCachedModel } from './model-manager.js';
 export type { CachedModel } from './model-manager.js';
-import type { InferenceProvider } from './types.js';
+import { type InferenceProvider } from './types.js';
 import type { DeepOptions } from '../types/index.js';
 /**
  * Create the appropriate inference provider based on options.

package/dist/inference/index.js

@@ -3,6 +3,7 @@ export { SidecarProvider } from './sidecar-provider.js';
 export { installLlamaEngine, probeBinary, managedEnginePath, LLAMA_RELEASE_TAG } from './llama-engine.js';
 export { CloudProvider } from './cloud-provider.js';
 export { ensureModel, isModelCached, getModelPath, getModelInfo, downloadModel, getModelsDir, getCachedModel } from './model-manager.js';
+import { localTier } from './types.js';
 import { SidecarProvider } from './sidecar-provider.js';
 import { CloudProvider } from './cloud-provider.js';
 /**
@@ -18,9 +19,6 @@ export function createProvider(options) {
             modelName: options.modelName,
         });
     }
-    // Default: local sidecar
-    // deep = Qwen2.5-Coder-1.5B (full power, company-hosted)
-    // lite = Qwen2.5-Coder-0.5B (lightweight, default CLI sidecar)
-    const tier = options.pro ? 'deep' : 'lite';
-    return new SidecarProvider(tier);
+    // Default: local sidecar (lite 0.5B, deep 1.5B with --pro, max 7B with --max)
+    return new SidecarProvider(localTier(options), undefined, options.modelPath);
 }

package/dist/inference/local-model.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/inference/local-model.test.js

@@ -0,0 +1,23 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { localModel } from './sidecar-provider.js';
+let dir;
+afterEach(() => { if (dir)
+    fs.rmSync(dir, { recursive: true, force: true }); dir = undefined; });
+describe('a local GGUF for --model-path', () => {
+    it('is used as is, never reported as a fallback', async () => {
+        dir = fs.mkdtempSync(path.join(os.tmpdir(), 'local-model-'));
+        const file = path.join(dir, 'rigour-max-candidate-q4_k_m.gguf');
+        fs.writeFileSync(file, Buffer.alloc(2_000_000));
+        expect(await localModel('max', file)).toEqual({
+            path: file, fallback: false,
+            info: { tier: 'max', name: 'rigour-max-candidate-q4_k_m.gguf (local)', filename: 'rigour-max-candidate-q4_k_m.gguf', url: '', sizeBytes: 2_000_000, sizeHuman: '2MB' },
+        });
+    });
+    it('fails clearly when the file is missing, rather than downloading something else', async () => {
+        const missing = path.resolve('/nonexistent/model.gguf'); // D:\\nonexistent\\model.gguf on Windows
+        await expect(localModel('max', missing)).rejects.toThrow(`Model file not found: ${missing}`);
+    });
+});

package/dist/inference/sidecar-provider.d.ts

@@ -1,17 +1,23 @@
 import type { InferenceProvider, InferenceOptions, ModelTier } from './types.js';
+import { type CachedModel } from './model-manager.js';
 export interface ActiveModel {
     name: string;
     filename: string;
     fallback: boolean;
 }
 export declare class SidecarProvider implements InferenceProvider {
+    private readonly modelPath?;
     readonly name = "sidecar";
     private binaryPath;
     private model;
     private schemaPath;
     private tier;
     private threads;
-    constructor(tier?: ModelTier, threads?: number);
+    /**
+     * @param modelPath a local GGUF to load instead of the tier's published model:
+     *   how a fine-tune candidate is measured before it is published.
+     */
+    constructor(tier?: ModelTier, threads?: number, modelPath?: string | undefined);
     /** True when a llama-cli that actually runs is installed. */
     isAvailable(): Promise<boolean>;
     /** The llama-cli this provider would use and its version, or null if none runs. */
@@ -22,6 +28,7 @@ export declare class SidecarProvider implements InferenceProvider {
     /** Install the engine and model for this tier without running inference. */
     prepare(onProgress?: (message: string) => void): Promise<void>;
     setup(onProgress?: (message: string) => void): Promise<void>;
+    private publishedModel;
     /** The model file setup() loaded, or null before setup. */
     getActiveModel(): ActiveModel | null;
     analyze(prompt: string, options?: InferenceOptions): Promise<string>;
@@ -30,3 +37,5 @@ export declare class SidecarProvider implements InferenceProvider {
     private resolveBinaryPath;
     private candidateBinaries;
 }
+/** A GGUF on disk, used as is: no download, no version check. */
+export declare function localModel(tier: ModelTier, modelPath: string): Promise<CachedModel>;

package/dist/inference/sidecar-provider.js

@@ -29,13 +29,19 @@ const PLATFORM_PACKAGES = {
     'win32-x64': '@rigour-labs/brain-win-x64',
 };
 export class SidecarProvider {
+    modelPath;
     name = 'sidecar';
     binaryPath = null;
     model = null;
     schemaPath = null;
     tier;
     threads;
-    constructor(tier = 'lite', threads = 4) {
+    /**
+     * @param modelPath a local GGUF to load instead of the tier's published model:
+     *   how a fine-tune candidate is measured before it is published.
+     */
+    constructor(tier = 'lite', threads = 4, modelPath) {
+        this.modelPath = modelPath;
         this.tier = tier;
         this.threads = threads;
     }
@@ -58,11 +64,7 @@ export class SidecarProvider {
     async setup(onProgress) {
         this.binaryPath = await this.resolveBinaryPath() ?? await installLlamaEngine(onProgress);
         onProgress?.('✓ Inference engine ready');
-        await ensureModel(this.tier, (msg, percent) => {
-            if (percent !== undefined && percent < 100)
-                onProgress?.(`  ${msg}`);
-        });
-        this.model = await getCachedModel(this.tier);
+        this.model = this.modelPath ? await localModel(this.tier, this.modelPath) : await this.publishedModel(onProgress);
         if (!this.model) {
             throw new Error(`Model for tier "${this.tier}" is not cached after download.`);
         }
@@ -72,6 +74,13 @@ export class SidecarProvider {
         this.schemaPath = await writeFindingsSchema();
         onProgress?.('✓ Model ready');
     }
+    async publishedModel(onProgress) {
+        await ensureModel(this.tier, (msg, percent) => {
+            if (percent !== undefined && percent < 100)
+                onProgress?.(`  ${msg}`);
+        });
+        return getCachedModel(this.tier);
+    }
     /** The model file setup() loaded, or null before setup. */
     getActiveModel() {
         if (!this.model)
@@ -176,3 +185,16 @@ async function writeFindingsSchema() {
     await fs.writeJson(schemaPath, FINDINGS_JSON_SCHEMA);
     return schemaPath;
 }
+/** A GGUF on disk, used as is: no download, no version check. */
+export async function localModel(tier, modelPath) {
+    const resolved = path.resolve(modelPath);
+    const stat = await fs.stat(resolved).catch(() => null);
+    if (!stat?.isFile())
+        throw new Error(`Model file not found: ${resolved}`);
+    const filename = path.basename(resolved);
+    return {
+        path: resolved,
+        info: { tier, name: `${filename} (local)`, filename, url: '', sizeBytes: stat.size, sizeHuman: `${Math.round(stat.size / 1e6)}MB` },
+        fallback: false,
+    };
+}

package/dist/inference/types.d.ts

@@ -66,8 +66,15 @@ export interface DeepAnalysisResult {
  * - deep: Qwen2.5-Coder-1.5B fine-tuned — full power, company-hosted
  * - lite: Qwen2.5-Coder-0.5B fine-tuned — lightweight, ships as default CLI sidecar
  * - legacy: Qwen2.5-Coder-0.5B fine-tuned — previous default, reproducibility
+ * - max: Qwen2.5-Coder-7B (4.7GB q4) — the strongest model a 16GB laptop runs;
+ *   stock until a fine-tune passes the eval gate and the Review Arena
  */
-export type ModelTier = 'deep' | 'lite' | 'legacy';
+export type ModelTier = 'deep' | 'lite' | 'legacy' | 'max';
+/** The local tier for a run: --max, then --pro, then the lite default. */
+export declare function localTier(options: {
+    max?: boolean;
+    pro?: boolean;
+}): ModelTier;
 /**
  * Model info for download/caching.
  */

package/dist/inference/types.js

@@ -1,3 +1,7 @@
+/** The local tier for a run: --max, then --pro, then the lite default. */
+export function localTier(options) {
+    return options.max ? 'max' : options.pro ? 'deep' : 'lite';
+}
 /**
  * Minimum bundled model version — used as fallback when the auto-update
  * check fails (offline, HF down, first run). The RLAIF training pipeline
@@ -23,6 +27,7 @@ export function buildModelInfo(tier, version) {
         deep: { base: 'Qwen2.5-Coder-1.5B', size: 900_000_000, sizeH: '900MB' },
         lite: { base: 'Qwen2.5-Coder-0.5B', size: 400_000_000, sizeH: '400MB' },
         legacy: { base: 'Qwen2.5-Coder-0.5B', size: 350_000_000, sizeH: '350MB' },
+        max: { base: 'Qwen2.5-Coder-7B', size: 4_700_000_000, sizeH: '4.7GB' },
     };
     const m = meta[tier];
     return {
@@ -39,6 +44,7 @@ export const MODELS = {
     deep: buildModelInfo('deep', BUNDLED_MODEL_VERSION),
     lite: buildModelInfo('lite', BUNDLED_MODEL_VERSION),
     legacy: buildModelInfo('legacy', BUNDLED_MODEL_VERSION),
+    max: buildModelInfo('max', BUNDLED_MODEL_VERSION),
 };
 /**
  * Update MODELS in-place to point to a newer version.
@@ -79,4 +85,12 @@ export const FALLBACK_MODELS = {
         sizeBytes: 350_000_000,
         sizeHuman: '350MB',
     },
+    max: {
+        tier: 'max',
+        name: 'Qwen2.5-Coder-7B-Instruct (stock)',
+        filename: 'qwen2.5-coder-7b-instruct-q4_k_m.gguf',
+        url: 'https://huggingface.co/Qwen/Qwen2.5-Coder-7B-Instruct-GGUF/resolve/main/qwen2.5-coder-7b-instruct-q4_k_m.gguf',
+        sizeBytes: 4_683_073_536,
+        sizeHuman: '4.7GB',
+    },
 };

package/dist/inference/types.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/inference/types.test.js

@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'vitest';
+import { buildModelInfo, FALLBACK_MODELS, localTier, MODELS } from './types.js';
+describe('local model tiers', () => {
+    it('picks max over pro over the lite default', () => {
+        expect(localTier({})).toBe('lite');
+        expect(localTier({ pro: true })).toBe('deep');
+        expect(localTier({ max: true })).toBe('max');
+        expect(localTier({ max: true, pro: true })).toBe('max');
+    });
+    it('asks for a published max fine-tune and falls back to the stock 7B coder model', () => {
+        expect(buildModelInfo('max', '6.0.0').url)
+            .toBe('https://huggingface.co/rigour-labs/rigour-max-v6.0.0-gguf/resolve/main/rigour-max-v6.0.0-q4_k_m.gguf');
+        expect(MODELS.max.tier).toBe('max');
+        expect(FALLBACK_MODELS.max).toMatchObject({
+            filename: 'qwen2.5-coder-7b-instruct-q4_k_m.gguf',
+            url: 'https://huggingface.co/Qwen/Qwen2.5-Coder-7B-Instruct-GGUF/resolve/main/qwen2.5-coder-7b-instruct-q4_k_m.gguf',
+        });
+    });
+});

package/dist/review/agent-fixes.d.ts

@@ -0,0 +1,18 @@
+import type { Failure } from '../types/index.js';
+export interface ResolvedFix {
+    id: string;
+    file: string;
+    rule: string;
+    before: string;
+    after: string;
+    resolvedAt: string;
+}
+export interface FixCapture {
+    opened: number;
+    resolved: number;
+}
+/** Record a review's findings: open new ones, resolve open ones the review no longer reports. */
+export declare function recordReviewOutcome(cwd: string, findings: Failure[], reviewedFiles: string[]): FixCapture;
+export declare function listResolvedFixes(cwd: string): ResolvedFix[];
+export declare function removeResolvedFix(cwd: string, id: string): void;
+export declare function openFindingCount(cwd: string): number;

package/dist/review/agent-fixes.js

@@ -0,0 +1,118 @@
+/**
+ * Fixes agents make to Rigour findings, captured so they can become rules.
+ *
+ * Capture is cheap and happens in the review loop (MCP review, stop hook):
+ * a finding's file content is kept when the finding appears, and when a later
+ * review of that file no longer reports it, the before and after are stored as
+ * a resolved fix. Learning is expensive and happens later, outside the loop
+ * (`rigour learn --agent-fixes`), with the same validation as any learned rule.
+ *
+ * A finding only counts as resolved when its file was part of the review that
+ * no longer reports it: a file committed out of the working tree was not fixed.
+ */
+import crypto from 'crypto';
+import fs from 'fs';
+import path from 'path';
+const DIR = path.join('.rigour', 'agent-fixes');
+const MAX_FILE_BYTES = 200_000;
+const OPEN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+/** Record a review's findings: open new ones, resolve open ones the review no longer reports. */
+export function recordReviewOutcome(cwd, findings, reviewedFiles) {
+    const open = readOpen(cwd);
+    const current = new Map(findings.flatMap(f => (f.files?.[0] ? [[`${f.id}:${f.files[0]}`, f]] : [])));
+    const capture = { resolved: resolveGone(cwd, open, current, new Set(reviewedFiles)), opened: openNew(cwd, open, current) };
+    writeOpen(cwd, open);
+    return capture;
+}
+/** Open findings this review no longer reports: resolved when their file was reviewed and changed. */
+function resolveGone(cwd, open, current, reviewed) {
+    let resolved = 0;
+    for (const [key, entry] of Object.entries(open)) {
+        if (current.has(key))
+            continue;
+        if (!reviewed.has(entry.file)) {
+            if (Date.now() - Date.parse(entry.openedAt) > OPEN_TTL_MS)
+                delete open[key];
+            continue;
+        }
+        const after = readSmall(cwd, entry.file);
+        if (after !== null && after !== entry.before) {
+            writeResolved(cwd, entry, after);
+            resolved++;
+        }
+        delete open[key];
+    }
+    return resolved;
+}
+function openNew(cwd, open, current) {
+    let opened = 0;
+    for (const [key, finding] of current) {
+        if (open[key])
+            continue;
+        const file = finding.files[0];
+        const before = readSmall(cwd, file);
+        if (before === null)
+            continue;
+        open[key] = { file, rule: finding.id, before, openedAt: new Date().toISOString() };
+        opened++;
+    }
+    return opened;
+}
+export function listResolvedFixes(cwd) {
+    const dir = path.join(cwd, DIR, 'resolved');
+    if (!fs.existsSync(dir))
+        return [];
+    return fs.readdirSync(dir).filter(n => n.endsWith('.json')).sort().flatMap(name => {
+        try {
+            return [JSON.parse(fs.readFileSync(path.join(dir, name), 'utf8'))];
+        }
+        catch {
+            return [];
+        }
+    });
+}
+export function removeResolvedFix(cwd, id) {
+    fs.rmSync(path.join(cwd, DIR, 'resolved', `${id}.json`), { force: true });
+}
+export function openFindingCount(cwd) {
+    return Object.keys(readOpen(cwd)).length;
+}
+function readOpen(cwd) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(cwd, DIR, 'open.json'), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+function writeOpen(cwd, open) {
+    try {
+        fs.mkdirSync(path.join(cwd, DIR), { recursive: true });
+        fs.writeFileSync(path.join(cwd, DIR, 'open.json'), JSON.stringify(open));
+    }
+    catch {
+        // Capture is best-effort; it must never break a review.
+    }
+}
+function writeResolved(cwd, entry, after) {
+    const id = crypto.createHash('sha256').update(`${entry.rule}\0${entry.file}\0${entry.before}\0${after}`).digest('hex').slice(0, 16);
+    const fix = { id, file: entry.file, rule: entry.rule, before: entry.before, after, resolvedAt: new Date().toISOString() };
+    try {
+        fs.mkdirSync(path.join(cwd, DIR, 'resolved'), { recursive: true });
+        fs.writeFileSync(path.join(cwd, DIR, 'resolved', `${id}.json`), JSON.stringify(fix));
+    }
+    catch {
+        // Best-effort, as above.
+    }
+}
+function readSmall(cwd, file) {
+    try {
+        const full = path.join(cwd, file);
+        if (fs.statSync(full).size > MAX_FILE_BYTES)
+            return null;
+        return fs.readFileSync(full, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}

package/dist/review/agent-fixes.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/review/agent-fixes.test.js

@@ -0,0 +1,32 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { listResolvedFixes, openFindingCount, recordReviewOutcome } from './agent-fixes.js';
+const finding = (file) => ({ id: 'semantic-bugs', title: 't', details: 'd', files: [file], line: 2 });
+describe('recordReviewOutcome', () => {
+    let cwd;
+    beforeEach(() => {
+        cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-fixes-'));
+        fs.writeFileSync(path.join(cwd, 'a.ts'), 'before\n');
+    });
+    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+    it('stores the before and after once a reviewed file no longer has the finding', () => {
+        expect(recordReviewOutcome(cwd, [finding('a.ts')], ['a.ts'])).toEqual({ opened: 1, resolved: 0 });
+        fs.writeFileSync(path.join(cwd, 'a.ts'), 'after\n');
+        expect(recordReviewOutcome(cwd, [], ['a.ts'])).toEqual({ opened: 0, resolved: 1 });
+        const [fix] = listResolvedFixes(cwd);
+        expect(fix).toMatchObject({ file: 'a.ts', rule: 'semantic-bugs', before: 'before\n', after: 'after\n' });
+        expect(openFindingCount(cwd)).toBe(0);
+    });
+    it('keeps a finding open when its file was not part of the review (committed, not fixed)', () => {
+        recordReviewOutcome(cwd, [finding('a.ts')], ['a.ts']);
+        expect(recordReviewOutcome(cwd, [], ['other.ts'])).toEqual({ opened: 0, resolved: 0 });
+        expect(openFindingCount(cwd)).toBe(1);
+    });
+    it('does not count a finding that vanished without an edit as a fix', () => {
+        recordReviewOutcome(cwd, [finding('a.ts')], ['a.ts']);
+        expect(recordReviewOutcome(cwd, [], ['a.ts'])).toEqual({ opened: 0, resolved: 0 });
+        expect(listResolvedFixes(cwd)).toEqual([]);
+    });
+});

package/dist/review/changed-lines.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Which findings belong to a change.
+ *
+ * - findings: on a changed line; these decide PASS/FAIL.
+ * - fileFindings: about a changed file as a whole (no line); shown as context.
+ * - unlocated: no file at all; counted, never shown as a changed-line finding.
+ * - outside: on an unchanged line; counted.
+ *
+ * The CLI, the MCP tool and the GitHub integration all use this, so the same
+ * change gets the same verdict everywhere.
+ */
+import type { Failure } from '../types/index.js';
+export interface ChangedLineSplit {
+    findings: Failure[];
+    fileFindings: Failure[];
+    unlocated: number;
+    outside: number;
+}
+export declare function splitByChangedLines(failures: Failure[], changedLines: Record<string, Set<number>>): ChangedLineSplit;

package/dist/review/changed-lines.js

@@ -0,0 +1,22 @@
+export function splitByChangedLines(failures, changedLines) {
+    const split = { findings: [], fileFindings: [], unlocated: 0, outside: 0 };
+    for (const failure of failures) {
+        const files = failure.files ?? [];
+        if (files.length === 0) {
+            split.unlocated++;
+        }
+        else if (failure.line === undefined) {
+            if (files.some(file => changedLines[file]))
+                split.fileFindings.push(failure);
+            else
+                split.outside++;
+        }
+        else if (files.some(file => changedLines[file]?.has(failure.line))) {
+            split.findings.push(failure);
+        }
+        else {
+            split.outside++;
+        }
+    }
+    return split;
+}

package/dist/review/diff-test-findings.d.ts

@@ -0,0 +1,3 @@
+import type { DeepOptions, Failure } from '../types/index.js';
+import type { DiffSource } from './git-diff.js';
+export declare function diffTestFailures(cwd: string, source: DiffSource | undefined, deep: DeepOptions): Promise<Failure[]>;

package/dist/review/diff-test-findings.js

@@ -0,0 +1,41 @@
+/**
+ * `rigour review --diff-tests`: behaviour changes found by running changed
+ * functions before and after the change, as review findings on the changed line.
+ */
+import { execFileSync } from 'child_process';
+import { runDiffTests } from '../deep/diff-tests/run.js';
+import { createProvider } from '../inference/index.js';
+export async function diffTestFailures(cwd, source, deep) {
+    const provider = createProvider(deep);
+    await provider.setup();
+    try {
+        const changes = await runDiffTests({
+            cwd, baseRef: baseRef(cwd, source), focusLines: deep.focusLines ?? {}, prBody: deep.prBody,
+            provider, inference: { maxTokens: 1024, temperature: 0.2 },
+        });
+        return changes.map(toFailure);
+    }
+    finally {
+        provider.dispose();
+    }
+}
+/** What the change is compared with: the merge base for a branch review, HEAD for working changes. */
+function baseRef(cwd, source) {
+    if (source?.mode !== 'base')
+        return 'HEAD';
+    return execFileSync('git', ['merge-base', source.base, 'HEAD'], { cwd, encoding: 'utf8' }).trim();
+}
+function toFailure(change) {
+    return {
+        id: 'diff-tests',
+        title: `[diff-tests] ${change.name} behaves differently after this change`,
+        details: `\`${change.call}\` ${change.before} before this change and ${change.after} after it.`,
+        severity: 'medium',
+        provenance: 'deep-analysis',
+        files: [change.file],
+        line: change.line,
+        hint: 'If this is intended, say so in the PR description; otherwise restore the old behaviour for this input.',
+        source: 'hybrid',
+        verified: true,
+    };
+}

package/dist/review/effectiveness.d.ts

@@ -0,0 +1,34 @@
+export interface AgentEvent {
+    type: string;
+    timestamp?: string;
+    tool?: string;
+    status?: string;
+    content?: Array<{
+        type: string;
+        text?: string;
+    }>;
+    session?: string;
+    blocked?: boolean;
+    /** Findings that blocked a stop. */
+    blocking?: number;
+}
+export interface ReviewEffectiveness {
+    toolCalls: Record<string, number>;
+    reviews: number;
+    failedReviews: number;
+    findingsReported: number;
+    findingsResolved: number;
+    stopChecks: number;
+    stopBlocks: number;
+    blockedStopsFollowedThrough: number;
+    stopsWithSelfReview: number;
+}
+export declare function readAgentEvents(cwd: string): AgentEvent[];
+/** Append an event in the same format the MCP server writes; never throws. */
+export declare function appendAgentEvent(cwd: string, event: AgentEvent): void;
+/** `rule:file` keys, so a finding that moved lines is still the same finding. */
+export declare function findingKeys(findings: Array<{
+    id?: string;
+    file?: string;
+}>): string[];
+export declare function computeEffectiveness(events: AgentEvent[]): ReviewEffectiveness;