@rigour-labs/core 6.4.3 → 6.5.0

package/dist/services/observed-savings.js

@@ -0,0 +1,94 @@
+/**
+ * Observed context savings: tokens an agent did not read because Rigour scoped its context.
+ *
+ * The estimate in context telemetry assumes the agent would otherwise read every
+ * scoped file whole, and does not read them afterwards anyway. Neither is
+ * measured. Here both sides are observed:
+ *
+ *   .rigour/context-scopes.jsonl   files rigour_context_scope summarised, with their tokens
+ *   .rigour/agent-activity.jsonl   every tool call the agent's hook saw (and the file it read)
+ *
+ * A scope is tracked when the hook recorded any agent activity after it, so
+ * "the agent read nothing" is told apart from "no hook is installed". For a
+ * tracked scope, the saving is the tokens of scoped files the agent did not
+ * read within the window, less the summary it read instead.
+ */
+import fs from 'fs';
+import path from 'path';
+const SCOPES = 'context-scopes.jsonl';
+const ACTIVITY = 'agent-activity.jsonl';
+const MAX_LOG_BYTES = 2 * 1024 * 1024;
+export const OBSERVATION_WINDOW_MS = 30 * 60 * 1000;
+const READ_TOOLS = /^(?:read|read_file|readfile|view|open_file|cat)$/i;
+export function recordScopeOffer(cwd, files, summaryTokens, ts = Date.now()) {
+    append(cwd, SCOPES, { ts, files: files.map(f => ({ path: normalize(cwd, f.path), tokens: f.tokens })), summaryTokens });
+}
+/** One tool call an agent hook saw. Read-like tools carry the file they read. */
+export function recordAgentActivity(cwd, tool, filePath, ts = Date.now()) {
+    const entry = { ts, tool };
+    if (filePath && READ_TOOLS.test(tool))
+        entry.path = normalize(cwd, filePath);
+    append(cwd, ACTIVITY, entry);
+}
+/**
+ * A hook payload for one agent tool call (Claude Code PreToolUse sends tool_name,
+ * tool_input and cwd); anything else is ignored.
+ */
+export function recordHookPayload(payload, fallbackCwd, ts = Date.now()) {
+    const event = payload;
+    if (!event || typeof event.tool_name !== 'string')
+        return;
+    const input = event.tool_input ?? {};
+    const file = [input.file_path, input.path, input.target_file].find((v) => typeof v === 'string');
+    recordAgentActivity(typeof event.cwd === 'string' ? event.cwd : fallbackCwd, event.tool_name, file, ts);
+}
+export function observedSavings(cwd, windowMs = OBSERVATION_WINDOW_MS) {
+    const scopes = readLog(cwd, SCOPES);
+    const activity = readLog(cwd, ACTIVITY).sort((a, b) => a.ts - b.ts);
+    const result = { scopes: scopes.length, trackedScopes: 0, offeredTokens: 0, readBackTokens: 0, avoidedTokens: 0 };
+    for (const scope of scopes) {
+        const after = activity.filter(a => a.ts >= scope.ts && a.ts <= scope.ts + windowMs);
+        if (after.length === 0)
+            continue;
+        result.trackedScopes++;
+        const read = new Set(after.filter(a => a.path).map(a => a.path));
+        const offered = scope.files.reduce((sum, f) => sum + f.tokens, 0);
+        const readBack = scope.files.filter(f => read.has(f.path)).reduce((sum, f) => sum + f.tokens, 0);
+        result.offeredTokens += offered;
+        result.readBackTokens += readBack;
+        result.avoidedTokens += Math.max(0, offered - readBack - scope.summaryTokens);
+    }
+    return result;
+}
+function normalize(cwd, file) {
+    return path.relative(cwd, path.resolve(cwd, file)).split(path.sep).join('/');
+}
+function append(cwd, name, entry) {
+    try {
+        const dir = path.join(cwd, '.rigour');
+        fs.mkdirSync(dir, { recursive: true });
+        const file = path.join(dir, name);
+        fs.appendFileSync(file, JSON.stringify(entry) + '\n');
+        if (fs.statSync(file).size > MAX_LOG_BYTES) {
+            const lines = fs.readFileSync(file, 'utf8').trimEnd().split('\n');
+            fs.writeFileSync(file, lines.slice(Math.floor(lines.length / 2)).join('\n') + '\n');
+        }
+    }
+    catch {
+        // Measurement must never break the agent's tool call.
+    }
+}
+function readLog(cwd, name) {
+    try {
+        return fs.readFileSync(path.join(cwd, '.rigour', name), 'utf8').split('\n').filter(Boolean)
+            .flatMap(line => { try {
+            return [JSON.parse(line)];
+        }
+        catch {
+            return [];
+        } });
+    }
+    catch {
+        return [];
+    }
+}

package/dist/services/observed-savings.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/observed-savings.test.js

@@ -0,0 +1,37 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { observedSavings, recordAgentActivity, recordHookPayload, recordScopeOffer } from './observed-savings.js';
+let cwd;
+beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'observed-savings-')); });
+afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+const T = 1_000_000;
+describe('observedSavings', () => {
+    it('counts only scoped files the agent did not read afterwards, less the summary', () => {
+        recordScopeOffer(cwd, [{ path: 'src/a.ts', tokens: 3000 }, { path: 'src/b.ts', tokens: 2000 }], 400, T);
+        recordAgentActivity(cwd, 'Read', path.join(cwd, 'src/a.ts'), T + 60_000); // read anyway
+        recordAgentActivity(cwd, 'Edit', path.join(cwd, 'src/b.ts'), T + 90_000); // an edit is not a read
+        expect(observedSavings(cwd)).toEqual({ scopes: 1, trackedScopes: 1, offeredTokens: 5000, readBackTokens: 3000, avoidedTokens: 1600 });
+    });
+    it('claims nothing for a scope no hook observed, so a missing hook never reads as a saving', () => {
+        recordScopeOffer(cwd, [{ path: 'src/a.ts', tokens: 3000 }], 400, T);
+        expect(observedSavings(cwd)).toMatchObject({ scopes: 1, trackedScopes: 0, avoidedTokens: 0 });
+    });
+    it('ignores activity outside the observation window', () => {
+        recordScopeOffer(cwd, [{ path: 'src/a.ts', tokens: 3000 }], 400, T);
+        recordAgentActivity(cwd, 'Read', 'src/a.ts', T + 2 * 60 * 60 * 1000);
+        expect(observedSavings(cwd).trackedScopes).toBe(0);
+    });
+    it('never claims more than was offered when the summary outweighs unread files', () => {
+        recordScopeOffer(cwd, [{ path: 'src/a.ts', tokens: 100 }], 400, T);
+        recordAgentActivity(cwd, 'Grep', undefined, T + 1000);
+        expect(observedSavings(cwd).avoidedTokens).toBe(0);
+    });
+    it('reads a Claude Code PreToolUse payload: the tool, the file it reads, and its working directory', () => {
+        recordScopeOffer(cwd, [{ path: 'src/a.ts', tokens: 3000 }], 400, T);
+        recordHookPayload({ tool_name: 'Read', tool_input: { file_path: path.join(cwd, 'src/a.ts') }, cwd }, '/elsewhere', T + 1000);
+        recordHookPayload({ hello: 'not a tool call' }, cwd, T + 2000);
+        expect(observedSavings(cwd)).toMatchObject({ trackedScopes: 1, readBackTokens: 3000, avoidedTokens: 0 });
+    });
+});

package/dist/settings.js

@@ -123,10 +123,13 @@ export function resolveDeepOptions(cliOptions) {
         result.modelName = cliOptions.modelName;
     }
     // 4. Resolve API key
-    // CLI flag takes highest precedence
+    // CLI flag takes highest precedence, then RIGOUR_API_KEY (CI secrets: never on a command line)
     if (cliOptions.apiKey) {
         result.apiKey = cliOptions.apiKey;
     }
+    else if (process.env.RIGOUR_API_KEY?.trim()) {
+        result.apiKey = process.env.RIGOUR_API_KEY.trim();
+    }
     else if (settings.providers) {
         // Otherwise look up provider key in settings.providers
         const normalizedProvider = normalizeProviderName(selectedProvider);

package/dist/templates/universal-config.js

@@ -154,7 +154,7 @@ export const UNIVERSAL_CONFIG = {
         promise_safety: {
             enabled: true,
             check_unhandled_then: true,
-            check_unsafe_parse: true,
+            check_unsafe_parse: false,
             check_async_without_await: true,
             check_unsafe_fetch: true,
             ignore_patterns: [],
@@ -191,8 +191,8 @@ export const UNIVERSAL_CONFIG = {
         },
         governance: {
             enabled: true,
-            enforce_memory: true,
-            enforce_skills: true,
+            enforce_memory: false,
+            enforce_skills: false,
             block_native_memory: true,
             protected_memory_paths: [
                 'CLAUDE.md', '.claude/CLAUDE.md',
@@ -275,11 +275,15 @@ export const UNIVERSAL_CONFIG = {
         fast_gates: ['hallucinated-imports', 'phantom-apis', 'deprecated-apis', 'promise-safety', 'security-patterns', 'file-size'],
         timeout_ms: 5000,
         block_on_failure: false,
+        require_review_ack: false,
         dlp: true,
     },
     output: {
         report_path: 'rigour-report.json',
     },
+    review: {
+        include_heuristics: false,
+    },
     planned: [],
     ignore: [],
 };