@rigour-labs/core 6.4.4 → 6.5.0

package/dist/types/index.js

@@ -172,7 +172,7 @@ export const GatesSchema = z.object({
     promise_safety: z.object({
         enabled: z.boolean().optional().default(true),
         check_unhandled_then: z.boolean().optional().default(true),
-        check_unsafe_parse: z.boolean().optional().default(true),
+        check_unsafe_parse: z.boolean().optional().default(false), // opt-in: a regex cannot tell trusted JSON (own files, own serializer) from untrusted input
         check_async_without_await: z.boolean().optional().default(true),
         check_unsafe_fetch: z.boolean().optional().default(true),
         ignore_patterns: z.array(z.string()).optional().default([]),
@@ -211,10 +211,13 @@ export const GatesSchema = z.object({
     // v4.2+ Memory & Skills Governance
     governance: z.object({
         enabled: z.boolean().optional().default(true),
-        /** Enforce rigour_remember for all persistent storage — block native agent memory writes */
-        enforce_memory: z.boolean().optional().default(true),
-        /** Enforce rigour skills over native agent skills/rules files */
-        enforce_skills: z.boolean().optional().default(true),
+        /**
+         * Block agent writes to native memory files (CLAUDE.md, …) and point to rigour_remember.
+         * Off by default: teams edit their agent instructions deliberately; their content is still scanned for secrets.
+         */
+        enforce_memory: z.boolean().optional().default(false),
+        /** Block agent writes to native skills/rules files (.cursor/rules, …). Off by default, like enforce_memory. */
+        enforce_skills: z.boolean().optional().default(false),
         /** Block writes and tell agent to use rigour_remember / rigour_recall */
         block_native_memory: z.boolean().optional().default(true),
         /** Agent-native MEMORY paths — where agents auto-save context (glob patterns) */
@@ -312,6 +315,15 @@ export const GatesSchema = z.object({
         max_tokens: z.number().optional(), // default per provider: local 1024, cloud 4096
         temperature: z.number().optional().default(0.1),
         timeout_ms: z.number().optional(), // per inference call; default per provider: local 60s, cloud 120s
+        budget_ms: z.number().optional(), // whole deep run; files not started in time are reported as skipped
+        agentic: z.boolean().optional(), // cloud tier: the model may read the repository while it reviews (default true)
+        repo_rules: z.boolean().optional(), // show the reviewer the rules in AGENTS.md / CLAUDE.md / Cursor rules that name what the change touches (default false)
+        review_lessons: z.enum(['verified', 'all', 'off']).optional(), // the team's past review lessons shown to the reviewer: off (default), verified, or all
+        router: z.object({
+            enabled: z.boolean().optional(), // default true
+            min_score: z.number().optional(), // functions below this get the deterministic gates only
+            max_functions: z.number().optional(), // at most this many functions go to the model
+        }).optional(),
         // Intent questions at engine-proven sites (optional-read-no-fallback) in scoped reviews.
         // Off: the stock local models failed the zero-false-finding bar (docs/DEEP_ANALYSIS.md).
         intent_checks: z.boolean().optional().default(false),
@@ -347,6 +359,8 @@ export const HooksSchema = z.object({
     ]),
     timeout_ms: z.number().optional().default(5000),
     block_on_failure: z.boolean().optional().default(false),
+    /** Stop hook: hold "done" until the agent acknowledges each risky changed function (rigour_review_ack). */
+    require_review_ack: z.boolean().optional().default(false),
     /** Enable DLP (Data Loss Prevention) pre-input hooks — default ON for security */
     dlp: z.boolean().optional().default(true),
 }).optional().default({});
@@ -360,6 +374,11 @@ export const ConfigSchema = z.object({
     output: z.object({
         report_path: z.string().default('rigour-report.json'),
     }).optional().default({}),
+    /** rigour review / rigour_review / the PR bot / the stop hook. */
+    review: z.object({
+        /** Let heuristic gates decide the verdict too; by default only findings that prove a defect do (quiet.ts). */
+        include_heuristics: z.boolean().optional().default(false),
+    }).optional().default({}),
     planned: z.array(z.string()).optional().default([]),
     ignore: z.array(z.string()).optional().default([]),
 });
@@ -384,6 +403,8 @@ export const FailureSchema = z.object({
     files: z.array(z.string()).optional(),
     line: z.number().optional(),
     endLine: z.number().optional(),
+    /** The changed line a finding about its enclosing changed function is posted on. */
+    anchorLine: z.number().optional(),
     hint: z.string().optional(),
     // Deep analysis fields
     confidence: z.number().min(0).max(1).optional(), // LLM confidence score
@@ -424,6 +445,18 @@ export const ReportSchema = z.object({
             error: z.string().optional(),
             findings_proposed: z.number().optional(), // code mode, before the self-check
             findings_withdrawn: z.number().optional(), // by the self-check
+            /** Findings the grounding check dropped, by reason. */
+            findings_rejected: z.record(z.number()).optional(),
+            /** Files a run budget (`gates.deep.budget_ms`) left unreviewed. */
+            files_skipped: z.number().optional(),
+            /** Repository lookups the model made in an agentic review. */
+            tool_calls: z.number().optional(),
+            /** Cloud router: changed functions ranked, how many went to the model, files it left to the gates. */
+            router: z.object({ functions: z.number(), routed: z.number(), files_skipped: z.number(), already_reviewed: z.number() }).optional(),
+            input_tokens: z.number().optional(),
+            output_tokens: z.number().optional(),
+            /** Provider-reported cost when available, else tokens × list price; undefined for an unpriced model. */
+            cost_usd: z.number().optional(),
             findings_count: z.number().optional(),
             findings_verified: z.number().optional(),
         }).optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.4.4",
+  "version": "6.5.0",
   "description": "AI-native quality gate engine with local Bayesian learning. AST analysis, drift detection, Fix Packet generation, and agent self-healing across TypeScript, JavaScript, Python, Go, Ruby, and C#.",
   "engines": {
     "node": ">=22"
@@ -70,11 +70,11 @@
     "pg": "^8.16.3",
     "sqlite3": "^5.1.7",
     "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-arm64": "6.4.4",
-    "@rigour-labs/brain-linux-arm64": "6.4.4",
-    "@rigour-labs/brain-win-x64": "6.4.4",
-    "@rigour-labs/brain-linux-x64": "6.4.4",
-    "@rigour-labs/brain-darwin-x64": "6.4.4"
+    "@rigour-labs/brain-darwin-arm64": "6.5.0",
+    "@rigour-labs/brain-linux-arm64": "6.5.0",
+    "@rigour-labs/brain-darwin-x64": "6.5.0",
+    "@rigour-labs/brain-linux-x64": "6.5.0",
+    "@rigour-labs/brain-win-x64": "6.5.0"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",