@rigour-labs/core 6.4.1 → 6.4.3

package/dist/deep/code-pass.d.ts

@@ -21,5 +21,9 @@ export interface CodePassConfig extends PassConfig {
 }
 export interface CodePassResult extends PassResult {
     contexts: CodeContext[];
+    /** Findings the model proposed, before the self-check (the max and cloud tiers). */
+    proposed: number;
+    /** Of those, withdrawn by the self-check. */
+    withdrawn: number;
 }
 export declare function runCodePass(provider: InferenceProvider, facts: FileFacts[], config: CodePassConfig): Promise<CodePassResult>;

package/dist/deep/code-pass.js

@@ -11,7 +11,7 @@ import { buildReferencePack } from './reference-pack.js';
 import { selfCheck } from './self-check.js';
 import { Logger } from '../utils/logger.js';
 export async function runCodePass(provider, facts, config) {
-    const result = { findings: [], chunksTotal: facts.length, chunksFailed: 0, contexts: [] };
+    const result = { findings: [], chunksTotal: facts.length, chunksFailed: 0, contexts: [], proposed: 0, withdrawn: 0 };
     for (let i = 0; i < facts.length; i++) {
         const file = facts[i];
         config.onProgress?.(`  Reviewing ${file.path} (${i + 1}/${facts.length})...`);
@@ -32,7 +32,17 @@ export async function runCodePass(provider, facts, config) {
             context = { ...context, source: `${context.source}\n${pack.source}` };
         result.contexts.push(context);
         try {
-            result.findings.push(...(pack ? await reviewTwiceAndCheck(provider, context, pack, config) : await reviewOnce(provider, context, '', config)));
+            if (pack) {
+                const checked = await reviewTwiceAndCheck(provider, context, pack, config);
+                result.findings.push(...checked.kept);
+                result.proposed += checked.proposed;
+                result.withdrawn += checked.withdrawn;
+            }
+            else {
+                const found = await reviewOnce(provider, context, '', config);
+                result.findings.push(...found);
+                result.proposed += found.length;
+            }
         }
         catch (error) {
             recordFailure(result, `${file.path}: ${error.message}`, config);
@@ -48,11 +58,11 @@ async function reviewTwiceAndCheck(provider, context, pack, config) {
     const second = pack.sections.length > 1 ? await reviewOnce(provider, context, [...pack.sections].reverse().join('\n\n'), config) : [];
     const union = dedupe([...first, ...second]);
     if (union.length === 0)
-        return union;
+        return { kept: union, proposed: 0, withdrawn: 0 };
     const checked = await selfCheck(provider, context, pack.text, union, config.inference);
     if (checked.withdrawn > 0)
         config.onProgress?.(`  Self-check withdrew ${checked.withdrawn} of ${union.length} finding(s) in ${context.file}.`);
-    return checked.kept;
+    return { kept: checked.kept, proposed: union.length, withdrawn: checked.withdrawn };
 }
 function packFor(file, config) {
     const reference = config.reference;

package/dist/deep/code-pass.test.js

@@ -39,6 +39,7 @@ describe('runCodePass', () => {
         const result = await run(provider);
         expect(prompts).toHaveLength(1);
         expect(result.findings.map(f => f.line)).toEqual([3]);
+        expect([result.proposed, result.withdrawn]).toEqual([1, 0]);
     });
     it('does not repeat an identical pass when there is only one reference section', async () => {
         const { provider, prompts } = fakeProvider([[]], []);
@@ -60,6 +61,7 @@ describe('runCodePass', () => {
         expect(reviews[1].indexOf('REMOVED by this change')).toBeLessThan(reviews[1].indexOf('PR DESCRIPTION'));
         expect(prompts.filter(p => p.startsWith('You reported a defect'))).toHaveLength(2);
         expect(result.findings.map(f => [f.line, f.category])).toEqual([[3, 'correctness']]);
+        expect([result.proposed, result.withdrawn]).toEqual([2, 1]); // two distinct findings, one withdrawn
     });
     it('reads a self-check reply only when it is a verdict', () => {
         expect(parseVerdict('{"real": false, "reason": "handled"}')).toBe(false);

package/dist/gates/deep-analysis.d.ts

@@ -31,6 +31,9 @@ export interface DeepRunOutcome {
     filesAnalyzed: number;
     chunksTotal: number;
     chunksFailed: number;
+    /** Code mode: findings the model proposed, and how many the self-check withdrew. */
+    findingsProposed?: number;
+    findingsWithdrawn?: number;
     /** Model actually used (the stock fallback is named as such). */
     model?: string;
     modelFallback?: boolean;
@@ -55,3 +58,6 @@ export declare class DeepAnalysisGate extends Gate {
     private createCloudAgent;
     private toFailure;
 }
+/** Per-call options; unset config falls back to per-provider defaults. */
+/** Per-call inference timeout: a local 7B reads a file with its reference pack far slower than the small tiers. */
+export declare function defaultTimeout(options: DeepOptions): number;

package/dist/gates/deep-analysis.js

@@ -111,6 +111,8 @@ export class DeepAnalysisGate extends Gate {
             onProgress: this.config.onProgress,
         });
         this.recordPass(result);
+        this.outcome.findingsProposed = result.proposed;
+        this.outcome.findingsWithdrawn = result.withdrawn;
         return verifyCodeFindings(result.findings, result.contexts);
     }
     /** The max and cloud tiers read reference material and review twice; the small models do not. */
@@ -175,12 +177,18 @@ function isCloud(options) {
     return !!options.apiKey && !!options.provider && options.provider !== 'local';
 }
 /** Per-call options; unset config falls back to per-provider defaults. */
+/** Per-call inference timeout: a local 7B reads a file with its reference pack far slower than the small tiers. */
+export function defaultTimeout(options) {
+    if (isCloud(options))
+        return 120_000;
+    return options.max ? 240_000 : 60_000;
+}
 function inferenceOptions(config) {
     const cloud = isCloud(config.options);
     return {
         maxTokens: config.maxTokens ?? (cloud ? 4096 : 1024),
         temperature: config.temperature ?? 0.1,
-        timeout: config.timeoutMs ?? (cloud ? 120_000 : 60_000),
+        timeout: config.timeoutMs ?? defaultTimeout(config.options),
         jsonMode: true,
     };
 }

package/dist/gates/deep-runner.js

@@ -46,6 +46,8 @@ export async function runDeepAnalysis(config, context, deepOptions) {
         chunks_total: outcome.chunksTotal,
         chunks_failed: outcome.chunksFailed,
         error: outcome.error,
+        findings_proposed: outcome.findingsProposed,
+        findings_withdrawn: outcome.findingsWithdrawn,
         findings_count: findings.length,
         findings_verified: findings.filter(f => f.verified).length,
     };

package/dist/gates/deep-timeout.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/deep-timeout.test.js

@@ -0,0 +1,10 @@
+import { describe, expect, it } from 'vitest';
+import { defaultTimeout } from './deep-analysis.js';
+describe('deep inference timeout', () => {
+    it('gives the local 7B tier four minutes a call, the small tiers one, and cloud two', () => {
+        expect(defaultTimeout({ enabled: true })).toBe(60_000);
+        expect(defaultTimeout({ enabled: true, pro: true })).toBe(60_000);
+        expect(defaultTimeout({ enabled: true, max: true })).toBe(240_000);
+        expect(defaultTimeout({ enabled: true, apiKey: 'k', provider: 'claude' })).toBe(120_000);
+    });
+});

package/dist/gates/logic-drift.d.ts

@@ -3,9 +3,14 @@
  *
  * Detects when AI subtly changes business logic in functions:
  * - Comparison operator mutations: >= became > (off-by-one)
- * - Return statement additions/removals
- * - Branch count changes (new if/else added or removed)
- * - Call sequence changes (function calls reordered)
+ * - Return statement additions/removals (opt-in: track_returns)
+ * - Branch count changes, new if/else added or removed (opt-in: track_branches)
+ *
+ * Return and branch counts are off by default: a change that edits a function
+ * usually changes them on purpose, so they fired on almost every edited function
+ * without saying what was wrong. Judged against review comments developers acted
+ * on, 0 of 7 such findings raised the reviewer's issue. An operator mutation is
+ * specific and actionable, so it stays on.
  *
  * This is the HARDEST drift to catch because:
  * - Code still compiles

package/dist/gates/logic-drift.js

@@ -3,9 +3,14 @@
  *
  * Detects when AI subtly changes business logic in functions:
  * - Comparison operator mutations: >= became > (off-by-one)
- * - Return statement additions/removals
- * - Branch count changes (new if/else added or removed)
- * - Call sequence changes (function calls reordered)
+ * - Return statement additions/removals (opt-in: track_returns)
+ * - Branch count changes, new if/else added or removed (opt-in: track_branches)
+ *
+ * Return and branch counts are off by default: a change that edits a function
+ * usually changes them on purpose, so they fired on almost every edited function
+ * without saying what was wrong. Judged against review comments developers acted
+ * on, 0 of 7 such findings raised the reviewer's issue. An operator mutation is
+ * specific and actionable, so it stays on.
  *
  * This is the HARDEST drift to catch because:
  * - Code still compiles
@@ -34,8 +39,8 @@ export class LogicDriftGate extends Gate {
             enabled: config.enabled ?? true,
             baseline_path: config.baseline_path ?? '.rigour/logic-baseline.json',
             track_operators: config.track_operators ?? true,
-            track_branches: config.track_branches ?? true,
-            track_returns: config.track_returns ?? true,
+            track_branches: config.track_branches ?? false,
+            track_returns: config.track_returns ?? false,
         };
     }
     get provenance() { return 'ai-drift'; }

package/dist/gates/logic-drift.test.js

@@ -35,6 +35,13 @@ describe('LogicDriftGate Git baseline', () => {
         git('merge', '-q', '--ff-only', 'feature');
         expect(await gate.run({ cwd })).toEqual([]);
     }, 30_000);
+    it('reports return and branch count changes only when opted in', async () => {
+        git('switch', '-q', '-c', 'feature');
+        fs.writeFileSync(path.join(cwd, 'src/rules.ts'), 'export function eligible(score: number) {\n  if (score < 0) return false;\n  if (score > 100) return false;\n  return score >= 10;\n}\n');
+        expect(await new LogicDriftGate().run({ cwd })).toEqual([]);
+        const opted = await new LogicDriftGate({ track_returns: true, track_branches: true }).run({ cwd });
+        expect(opted.map(f => f.title).sort()).toEqual(['Logic Drift: Branch Change', 'Logic Drift: Return Change']);
+    }, 30_000);
     it('does not use a moving local snapshot when Git has no main reference', async () => {
         git('switch', '-q', '-c', 'feature');
         git('branch', '-D', 'main');

package/dist/gates/promise-safety.js

@@ -104,7 +104,9 @@ export class PromiseSafetyGate extends Gate {
                 // Also count .then().then().catch() chains — the catch at the end covers all
                 if (j > i && braceDepth < 0)
                     break; // Exited enclosing scope
-                if (j > i && /^(?:const|let|var|function|class|export|import|if|for|while|return)\b/.test(lookahead.trim()))
+                // A statement keyword ends the chain only at the chain's own depth; inside the
+                // .then callback's body (depth > 0) `if`/`return` belong to the callback.
+                if (j > i && braceDepth <= 0 && /^(?:const|let|var|function|class|export|import|if|for|while|return)\b/.test(lookahead.trim()))
                     break;
             }
             if (!hasCatch && !isInsideTryBlock(lines, i) && !/(?:const|let|var)\s+\w+\s*=/.test(line)) {

package/dist/gates/promise-safety.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/promise-safety.test.js

@@ -0,0 +1,34 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { PromiseSafetyGate } from './promise-safety.js';
+describe('PromiseSafetyGate unhandled .then', () => {
+    let cwd;
+    beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'promise-safety-')); });
+    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+    async function thenFindings(code) {
+        fs.writeFileSync(path.join(cwd, 'session.ts'), code);
+        const failures = await new PromiseSafetyGate().run({ cwd });
+        return failures.filter(f => f.details.includes('unhandled-then')).length;
+    }
+    it('flags a .then chain with no .catch', async () => {
+        expect(await thenFindings('export function wake(p: Promise<number>) {\n  p.then(n => {\n    if (n > 1) log(n);\n  });\n}\ndeclare function log(n: number): void;\n')).toBe(1);
+    });
+    it('finds the .catch that closes a chain whose callback body has if and return statements', async () => {
+        const code = [
+            'export function wake(accepted: Promise<{ action: string }>) {',
+            '  void accepted',
+            '    .then(result => {',
+            "      if (result.action === 'wake') {",
+            '        return run();',
+            '      }',
+            '      return undefined;',
+            '    })',
+            '    .catch(() => {});',
+            '}',
+            'declare function run(): Promise<void>;',
+        ].join('\n');
+        expect(await thenFindings(code)).toBe(0);
+    });
+});

package/dist/gates/security-patterns-data.js

@@ -67,7 +67,8 @@ export const VULNERABILITY_PATTERNS = [
     // Hardcoded Secrets
     {
         type: 'hardcoded_secrets',
-        regex: /(?:password|secret|api_key|apikey|auth_token|access_token|private_key)\s*[:=]\s*['"][^'"]{8,}['"]/gi,
+        // A secret literal has no whitespace: `hidePassword: 'Hide password'` is a UI label, not a credential.
+        regex: /(?:password|secret|api_key|apikey|auth_token|access_token|private_key)\s*[:=]\s*['"][^'"\s]{8,}['"]/gi,
         severity: 'critical',
         description: 'Hardcoded secret detected in code',
         cwe: 'CWE-798',

package/dist/gates/security-patterns.test.js

@@ -85,6 +85,14 @@ describe('SecurityPatternsGate', () => {
             const vulns = await checkSecurityPatterns(filePath);
             expect(vulns.some(v => v.type === 'hardcoded_secrets')).toBe(true);
         });
+        it('does not take a UI label that mentions a password for a secret', async () => {
+            const filePath = path.join(testDir, 'be.ts');
+            fs.writeFileSync(filePath, `
+                export default { authForm: { hidePassword: 'Схаваць пароль', showPassword: 'Show the password' } };
+            `);
+            const vulns = await checkSecurityPatterns(filePath);
+            expect(vulns.some(v => v.type === 'hardcoded_secrets')).toBe(false);
+        });
         it('should detect password assignments', async () => {
             const filePath = path.join(testDir, 'auth.ts');
             fs.writeFileSync(filePath, `

package/dist/templates/universal-config.js

@@ -231,8 +231,8 @@ export const UNIVERSAL_CONFIG = {
             enabled: true,
             baseline_path: '.rigour/logic-baseline.json',
             track_operators: true,
-            track_branches: true,
-            track_returns: true,
+            track_branches: false,
+            track_returns: false,
         },
         semantic_bugs: {
             enabled: true,

package/dist/types/index.d.ts

@@ -3023,6 +3023,8 @@ export declare const ReportSchema: z.ZodObject<{
             chunks_total: z.ZodOptional<z.ZodNumber>;
             chunks_failed: z.ZodOptional<z.ZodNumber>;
             error: z.ZodOptional<z.ZodString>;
+            findings_proposed: z.ZodOptional<z.ZodNumber>;
+            findings_withdrawn: z.ZodOptional<z.ZodNumber>;
             findings_count: z.ZodOptional<z.ZodNumber>;
             findings_verified: z.ZodOptional<z.ZodNumber>;
         }, "strip", z.ZodTypeAny, {
@@ -3037,6 +3039,8 @@ export declare const ReportSchema: z.ZodObject<{
             files_analyzed?: number | undefined;
             chunks_total?: number | undefined;
             chunks_failed?: number | undefined;
+            findings_proposed?: number | undefined;
+            findings_withdrawn?: number | undefined;
             findings_count?: number | undefined;
             findings_verified?: number | undefined;
         }, {
@@ -3051,6 +3055,8 @@ export declare const ReportSchema: z.ZodObject<{
             files_analyzed?: number | undefined;
             chunks_total?: number | undefined;
             chunks_failed?: number | undefined;
+            findings_proposed?: number | undefined;
+            findings_withdrawn?: number | undefined;
             findings_count?: number | undefined;
             findings_verified?: number | undefined;
         }>>;
@@ -3068,6 +3074,8 @@ export declare const ReportSchema: z.ZodObject<{
             files_analyzed?: number | undefined;
             chunks_total?: number | undefined;
             chunks_failed?: number | undefined;
+            findings_proposed?: number | undefined;
+            findings_withdrawn?: number | undefined;
             findings_count?: number | undefined;
             findings_verified?: number | undefined;
         } | undefined;
@@ -3097,6 +3105,8 @@ export declare const ReportSchema: z.ZodObject<{
             files_analyzed?: number | undefined;
             chunks_total?: number | undefined;
             chunks_failed?: number | undefined;
+            findings_proposed?: number | undefined;
+            findings_withdrawn?: number | undefined;
             findings_count?: number | undefined;
             findings_verified?: number | undefined;
         } | undefined;
@@ -3128,6 +3138,8 @@ export declare const ReportSchema: z.ZodObject<{
             files_analyzed?: number | undefined;
             chunks_total?: number | undefined;
             chunks_failed?: number | undefined;
+            findings_proposed?: number | undefined;
+            findings_withdrawn?: number | undefined;
             findings_count?: number | undefined;
             findings_verified?: number | undefined;
         } | undefined;
@@ -3176,6 +3188,8 @@ export declare const ReportSchema: z.ZodObject<{
             files_analyzed?: number | undefined;
             chunks_total?: number | undefined;
             chunks_failed?: number | undefined;
+            findings_proposed?: number | undefined;
+            findings_withdrawn?: number | undefined;
             findings_count?: number | undefined;
             findings_verified?: number | undefined;
         } | undefined;

package/dist/types/index.js

@@ -295,8 +295,8 @@ export const GatesSchema = z.object({
         enabled: z.boolean().optional().default(true),
         baseline_path: z.string().optional().default('.rigour/logic-baseline.json'),
         track_operators: z.boolean().optional().default(true),
-        track_branches: z.boolean().optional().default(true),
-        track_returns: z.boolean().optional().default(true),
+        track_branches: z.boolean().optional().default(false), // opt-in: counts change on purpose in most edits
+        track_returns: z.boolean().optional().default(false), // opt-in: same
     }).optional().default({}),
     // v4.0+ Deep Analysis (LLM-powered)
     deep: z.object({
@@ -422,6 +422,8 @@ export const ReportSchema = z.object({
             chunks_total: z.number().optional(),
             chunks_failed: z.number().optional(),
             error: z.string().optional(),
+            findings_proposed: z.number().optional(), // code mode, before the self-check
+            findings_withdrawn: z.number().optional(), // by the self-check
             findings_count: z.number().optional(),
             findings_verified: z.number().optional(),
         }).optional(),

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.4.1",
+  "version": "6.4.3",
   "description": "AI-native quality gate engine with local Bayesian learning. AST analysis, drift detection, Fix Packet generation, and agent self-healing across TypeScript, JavaScript, Python, Go, Ruby, and C#.",
+  "engines": {
+    "node": ">=22"
+  },
   "license": "MIT",
   "homepage": "https://rigour.run",
   "keywords": [
@@ -67,11 +70,11 @@
     "pg": "^8.16.3",
     "sqlite3": "^5.1.7",
     "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-arm64": "6.4.1",
-    "@rigour-labs/brain-darwin-x64": "6.4.1",
-    "@rigour-labs/brain-linux-x64": "6.4.1",
-    "@rigour-labs/brain-win-x64": "6.4.1",
-    "@rigour-labs/brain-linux-arm64": "6.4.1"
+    "@rigour-labs/brain-darwin-x64": "6.4.3",
+    "@rigour-labs/brain-darwin-arm64": "6.4.3",
+    "@rigour-labs/brain-linux-arm64": "6.4.3",
+    "@rigour-labs/brain-linux-x64": "6.4.3",
+    "@rigour-labs/brain-win-x64": "6.4.3"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",