@rigour-labs/core 6.4.4 → 6.5.1

package/dist/inference/cloud-provider.test.js

@@ -0,0 +1,118 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const openaiCreate = vi.fn();
+const anthropicCreate = vi.fn();
+vi.mock('openai', () => ({
+    default: class {
+        chat = { completions: { create: openaiCreate } };
+    },
+}));
+vi.mock('@anthropic-ai/sdk', () => ({
+    default: class {
+        messages = { create: anthropicCreate };
+    },
+}));
+const { CloudProvider } = await import('./cloud-provider.js');
+const { priceTokens } = await import('./pricing.js');
+beforeEach(() => {
+    openaiCreate.mockReset();
+    anthropicCreate.mockReset();
+});
+describe('CloudProvider', () => {
+    it('passes the per-call timeout to the SDK request', async () => {
+        anthropicCreate.mockResolvedValue({ content: [{ type: 'text', text: 'ok' }], usage: { input_tokens: 10, output_tokens: 2 } });
+        const provider = new CloudProvider('claude', 'k', { modelName: 'claude-sonnet-5-5' });
+        await provider.setup();
+        await provider.analyze('p', { timeout: 30_000 });
+        expect(anthropicCreate.mock.calls[0][1]).toEqual({ timeout: 30_000 });
+    });
+    it('prices tokens at list price when the provider reports no cost', async () => {
+        anthropicCreate.mockResolvedValue({ content: [{ type: 'text', text: 'ok' }], usage: { input_tokens: 1_000_000, output_tokens: 100_000 } });
+        const provider = new CloudProvider('claude', 'k', { modelName: 'claude-sonnet-5-5' });
+        await provider.setup();
+        await provider.analyze('p');
+        expect(provider.usage()).toEqual({ inputTokens: 1_000_000, outputTokens: 100_000, costUsd: 3 });
+    });
+    it('asks OpenRouter for its own cost, and uses it', async () => {
+        openaiCreate.mockResolvedValue({ choices: [{ message: { content: 'ok' } }], usage: { prompt_tokens: 500, completion_tokens: 50, cost: 0.0123 } });
+        const provider = new CloudProvider('openrouter', 'k', { baseUrl: 'https://openrouter.ai/api/v1', modelName: 'anthropic/claude-sonnet-5.5' });
+        await provider.setup();
+        await provider.analyze('p');
+        expect(openaiCreate.mock.calls[0][0].usage).toEqual({ include: true });
+        expect(provider.usage()).toEqual({ inputTokens: 500, outputTokens: 50, costUsd: 0.0123 });
+    });
+    it('sends no OpenRouter-only field to other endpoints, and reports no cost for an unpriced model', async () => {
+        openaiCreate.mockResolvedValue({ choices: [{ message: { content: 'ok' } }], usage: { prompt_tokens: 500, completion_tokens: 50 } });
+        const provider = new CloudProvider('openai', 'k', { modelName: 'some-new-model' });
+        await provider.setup();
+        await provider.analyze('p');
+        expect(openaiCreate.mock.calls[0][0]).not.toHaveProperty('usage');
+        expect(provider.usage()).toEqual({ inputTokens: 500, outputTokens: 50 });
+    });
+});
+describe('CloudProvider.chat', () => {
+    const history = [
+        { role: 'user', content: 'review' },
+        { role: 'assistant', content: '', toolCalls: [{ id: 'a', name: 'read_file', arguments: { path: 'x.ts' } }, { id: 'b', name: 'grep', arguments: { pattern: 'y' } }] },
+        { role: 'tool', toolCallId: 'a', content: 'x' },
+        { role: 'tool', toolCallId: 'b', content: 'y' },
+    ];
+    const tools = [{ name: 'read_file', description: 'd', parameters: { type: 'object' } }];
+    it('speaks Anthropic tool use: grouped tool results, tool_use blocks back', async () => {
+        anthropicCreate.mockResolvedValue({ content: [{ type: 'text', text: 'checking' }, { type: 'tool_use', id: 'c', name: 'read_file', input: { path: 'z.ts' } }] });
+        const provider = new CloudProvider('claude', 'k', { modelName: 'claude-sonnet-5-5' });
+        await provider.setup();
+        const reply = await provider.chat(history, tools);
+        const sent = anthropicCreate.mock.calls[0][0];
+        expect(sent.messages).toHaveLength(3);
+        expect(sent.messages[2].content.map((b) => b.tool_use_id)).toEqual(['a', 'b']);
+        expect(sent.tools[0]).toEqual({ name: 'read_file', description: 'd', input_schema: { type: 'object' } });
+        expect(reply).toEqual({ text: 'checking', toolCalls: [{ id: 'c', name: 'read_file', arguments: { path: 'z.ts' } }] });
+        expect(sent).not.toHaveProperty('tool_choice');
+    });
+    it('keeps tools defined but forbids calls when asked for a final answer', async () => {
+        anthropicCreate.mockResolvedValue({ content: [{ type: 'text', text: '{}' }] });
+        openaiCreate.mockResolvedValue({ choices: [{ message: { content: '{}' } }] });
+        for (const name of ['claude', 'openai']) {
+            const provider = new CloudProvider(name, 'k', { modelName: 'm' });
+            await provider.setup();
+            await provider.chat(history, tools, { toolChoice: 'none' });
+        }
+        expect(anthropicCreate.mock.calls[0][0]).toMatchObject({ tools: [expect.anything()], tool_choice: { type: 'none' } });
+        expect(openaiCreate.mock.calls[0][0]).toMatchObject({ tools: [expect.anything()], tool_choice: 'none' });
+    });
+    it('speaks OpenAI function calling, and survives malformed arguments', async () => {
+        openaiCreate.mockResolvedValue({ choices: [{ message: { content: null, tool_calls: [{ id: 'c', function: { name: 'grep', arguments: '{not json' } }] } }] });
+        const provider = new CloudProvider('openai', 'k', { modelName: 'm' });
+        await provider.setup();
+        const reply = await provider.chat(history, tools);
+        const sent = openaiCreate.mock.calls[0][0];
+        expect(sent.messages[1].tool_calls[0].function).toEqual({ name: 'read_file', arguments: '{"path":"x.ts"}' });
+        expect(sent.messages[2]).toEqual({ role: 'tool', tool_call_id: 'a', content: 'x' });
+        expect(sent.tools[0].type).toBe('function');
+        expect(reply).toEqual({ text: '', toolCalls: [{ id: 'c', name: 'grep', arguments: {} }] });
+    });
+});
+describe('prompt caching', () => {
+    it('caches the first prompt for Claude, directly and through OpenRouter, and nowhere else', async () => {
+        anthropicCreate.mockResolvedValue({ content: [{ type: 'text', text: '{}' }] });
+        openaiCreate.mockResolvedValue({ choices: [{ message: { content: '{}' } }] });
+        const first = [{ role: 'user', content: 'big diff' }];
+        const claude = new CloudProvider('claude', 'k', { modelName: 'claude-sonnet-5-5' });
+        const viaOpenRouter = new CloudProvider('openrouter', 'k', { baseUrl: 'https://openrouter.ai/api/v1', modelName: 'anthropic/claude-sonnet-5.5' });
+        const other = new CloudProvider('openrouter', 'k', { baseUrl: 'https://openrouter.ai/api/v1', modelName: 'openai/gpt-5' });
+        for (const p of [claude, viaOpenRouter, other]) {
+            await p.setup();
+            await p.chat(first, []);
+        }
+        const cached = { role: 'user', content: [{ type: 'text', text: 'big diff', cache_control: { type: 'ephemeral' } }] };
+        expect(anthropicCreate.mock.calls[0][0].messages[0]).toEqual(cached);
+        expect(openaiCreate.mock.calls[0][0].messages[0]).toEqual(cached);
+        expect(openaiCreate.mock.calls[1][0].messages[0]).toEqual({ role: 'user', content: 'big diff' });
+    });
+});
+describe('priceTokens', () => {
+    it('prices known models and refuses to guess for the rest', () => {
+        expect(priceTokens('anthropic/claude-opus-5.5', 1_000_000, 1_000_000)).toBe(24);
+        expect(priceTokens('mystery-7b', 1, 1)).toBeUndefined();
+    });
+});

package/dist/inference/pricing.d.ts

@@ -0,0 +1,15 @@
+/**
+ * List prices for pricing a run's tokens when the provider does not report
+ * cost itself (OpenRouter does; see cloud-provider.ts). USD per million tokens.
+ *
+ * Only models whose price we have checked are listed. An unlisted model gets
+ * no cost at all rather than a guess: a wrong number in Studio is worse than
+ * a missing one.
+ */
+interface Price {
+    input: number;
+    output: number;
+}
+export declare function listPrice(model: string): Price | undefined;
+export declare function priceTokens(model: string, inputTokens: number, outputTokens: number): number | undefined;
+export {};

package/dist/inference/pricing.js

@@ -0,0 +1,13 @@
+const PRICES = [
+    [/claude-opus-5[.-]5/, { input: 4, output: 20 }],
+    [/claude-sonnet-5[.-]5/, { input: 2, output: 10 }],
+    [/claude-haiku-4[.-]5/, { input: 1, output: 5 }],
+];
+export function listPrice(model) {
+    const name = model.toLowerCase();
+    return PRICES.find(([pattern]) => pattern.test(name))?.[1];
+}
+export function priceTokens(model, inputTokens, outputTokens) {
+    const price = listPrice(model);
+    return price ? (inputTokens * price.input + outputTokens * price.output) / 1_000_000 : undefined;
+}

package/dist/inference/types.d.ts

@@ -21,9 +21,49 @@ export interface InferenceProvider {
      * Provider handles tokenization, temperature, etc.
      */
     analyze(prompt: string, options?: InferenceOptions): Promise<string>;
+    /**
+     * Multi-turn conversation with tools the model may call (cloud providers).
+     * The caller runs the tools and sends their results back as `tool` messages.
+     */
+    chat?(messages: ChatMessage[], tools: ChatTool[], options?: InferenceOptions): Promise<ChatReply>;
+    /** Tokens (and cost, when known) used since setup; cloud providers only. */
+    usage?(): InferenceUsage;
     /** Clean up resources (kill process, close connection) */
     dispose(): void;
 }
+export interface ChatTool {
+    name: string;
+    description: string;
+    /** JSON schema of the tool's arguments. */
+    parameters: Record<string, unknown>;
+}
+export interface ToolCall {
+    id: string;
+    name: string;
+    arguments: Record<string, unknown>;
+}
+export type ChatMessage = {
+    role: 'user';
+    content: string;
+} | {
+    role: 'assistant';
+    content: string;
+    toolCalls?: ToolCall[];
+} | {
+    role: 'tool';
+    toolCallId: string;
+    content: string;
+};
+export interface ChatReply {
+    text: string;
+    toolCalls: ToolCall[];
+}
+export interface InferenceUsage {
+    inputTokens: number;
+    outputTokens: number;
+    /** Provider-reported or priced cost in USD; undefined when the model is not priced. */
+    costUsd?: number;
+}
 export interface InferenceOptions {
     maxTokens?: number;
     temperature?: number;
@@ -31,6 +71,8 @@ export interface InferenceOptions {
     jsonMode?: boolean;
     /** Constrain local output to this JSON schema instead of the findings schema. */
     jsonSchema?: Record<string, unknown>;
+    /** chat(): 'none' forbids tool calls while keeping the tools defined (a history with tool calls needs them). */
+    toolChoice?: 'auto' | 'none';
 }
 /**
  * A single finding from deep LLM analysis.

package/dist/review/changed-function-spans.d.ts

@@ -0,0 +1,4 @@
+export type LineSpan = [number, number];
+export declare function changedFunctionSpans(cwd: string, changedLines: Record<string, Set<number>>): Record<string, LineSpan[]>;
+/** The changed line nearest to `line` inside the changed function that contains it, if any. */
+export declare function anchorInChangedFunction(line: number, lines: Set<number> | undefined, spans: LineSpan[] | undefined): number | undefined;

package/dist/review/changed-function-spans.js

@@ -0,0 +1,48 @@
+/**
+ * Line spans of the functions a change touched, per file.
+ *
+ * A model often reports a defect where it starts (a missing guard above the
+ * edit, the declaration of a value the edit misuses) rather than on the edited
+ * line. Inside a changed function, that finding is still about the change.
+ */
+import fs from 'fs';
+import path from 'path';
+import ts from 'typescript';
+import { changedFunctions } from '../deep/changed-functions.js';
+const PARSEABLE = /\.(?:[cm]?[jt]sx?)$/i;
+export function changedFunctionSpans(cwd, changedLines) {
+    const spans = {};
+    for (const [file, lines] of Object.entries(changedLines)) {
+        if (!PARSEABLE.test(file) || lines.size === 0)
+            continue;
+        let text;
+        try {
+            text = fs.readFileSync(path.join(cwd, file), 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        const sourceFile = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, false);
+        const found = changedFunctions(sourceFile, [...lines]).map((fn) => [
+            sourceFile.getLineAndCharacterOfPosition(fn.getStart(sourceFile)).line + 1,
+            sourceFile.getLineAndCharacterOfPosition(fn.getEnd()).line + 1,
+        ]);
+        if (found.length > 0)
+            spans[file] = found;
+    }
+    return spans;
+}
+/** The changed line nearest to `line` inside the changed function that contains it, if any. */
+export function anchorInChangedFunction(line, lines, spans) {
+    const span = spans?.find(([start, end]) => line >= start && line <= end);
+    if (!span || !lines)
+        return undefined;
+    let best;
+    for (const changed of lines) {
+        if (changed < span[0] || changed > span[1])
+            continue;
+        if (best === undefined || Math.abs(changed - line) < Math.abs(best - line))
+            best = changed;
+    }
+    return best;
+}

package/dist/review/changed-lines.d.ts

@@ -1,19 +1,25 @@
 /**
  * Which findings belong to a change.
  *
- * - findings: on a changed line; these decide PASS/FAIL.
+ * - findings: on a changed line; these decide PASS/FAIL. A deep finding on an
+ *   unchanged line inside a changed function also belongs here, with
+ *   `anchorLine` set to the nearest changed line (where a PR comment can go).
  * - fileFindings: about a changed file as a whole (no line); shown as context.
+ * - contextFindings: deep findings elsewhere in a changed file; returned so
+ *   nothing the model found disappears, never blocking.
  * - unlocated: no file at all; counted, never shown as a changed-line finding.
- * - outside: on an unchanged line; counted.
+ * - outside: any other finding on an unchanged line; counted.
  *
  * The CLI, the MCP tool and the GitHub integration all use this, so the same
  * change gets the same verdict everywhere.
  */
 import type { Failure } from '../types/index.js';
+import { type LineSpan } from './changed-function-spans.js';
 export interface ChangedLineSplit {
     findings: Failure[];
     fileFindings: Failure[];
+    contextFindings: Failure[];
     unlocated: number;
     outside: number;
 }
-export declare function splitByChangedLines(failures: Failure[], changedLines: Record<string, Set<number>>): ChangedLineSplit;
+export declare function splitByChangedLines(failures: Failure[], changedLines: Record<string, Set<number>>, spans?: Record<string, LineSpan[]>): ChangedLineSplit;

package/dist/review/changed-lines.js

@@ -1,5 +1,6 @@
-export function splitByChangedLines(failures, changedLines) {
-    const split = { findings: [], fileFindings: [], unlocated: 0, outside: 0 };
+import { anchorInChangedFunction } from './changed-function-spans.js';
+export function splitByChangedLines(failures, changedLines, spans = {}) {
+    const split = { findings: [], fileFindings: [], contextFindings: [], unlocated: 0, outside: 0 };
     for (const failure of failures) {
         const files = failure.files ?? [];
         if (files.length === 0) {
@@ -14,9 +15,25 @@ export function splitByChangedLines(failures, changedLines) {
         else if (files.some(file => changedLines[file]?.has(failure.line))) {
             split.findings.push(failure);
         }
+        else if (failure.provenance === 'deep-analysis') {
+            placeDeepFinding(failure, files, changedLines, spans, split);
+        }
         else {
             split.outside++;
         }
     }
     return split;
 }
+function placeDeepFinding(failure, files, changedLines, spans, split) {
+    for (const file of files) {
+        const anchorLine = anchorInChangedFunction(failure.line, changedLines[file], spans[file]);
+        if (anchorLine !== undefined) {
+            split.findings.push({ ...failure, anchorLine });
+            return;
+        }
+    }
+    if (files.some(file => changedLines[file]))
+        split.contextFindings.push(failure);
+    else
+        split.outside++;
+}

package/dist/review/deep-runs.d.ts

@@ -0,0 +1,22 @@
+import type { Report } from '../types/index.js';
+export type DeepRunStats = NonNullable<Report['stats']['deep']>;
+export interface DeepRun extends DeepRunStats {
+    at: string;
+}
+export interface DeepRunSummary {
+    runs: number;
+    /** Sum over runs that reported a cost; runs without one are counted in `unpricedRuns`. */
+    costUsd: number;
+    unpricedRuns: number;
+    inputTokens: number;
+    outputTokens: number;
+    functionsRanked: number;
+    functionsRouted: number;
+    /** Risky functions the model was not asked about because they were reviewed before. */
+    alreadyReviewed: number;
+    toolCalls: number;
+    findingsKept: number;
+}
+export declare function appendDeepRun(cwd: string, stats: DeepRunStats, at?: string): void;
+export declare function readDeepRuns(cwd: string): DeepRun[];
+export declare function summarizeDeepRuns(runs: DeepRun[]): DeepRunSummary;

package/dist/review/deep-runs.js

@@ -0,0 +1,59 @@
+/**
+ * Deep runs, as they happened: model, tokens, cost, what the router sent and
+ * skipped. Every deep review appends one line (.rigour/deep-runs.jsonl), so
+ * Studio reports observed spend, never an estimate of what a run might cost.
+ */
+import fs from 'fs';
+import path from 'path';
+const LOG = path.join('.rigour', 'deep-runs.jsonl');
+const MAX_LOG_BYTES = 1024 * 1024;
+export function appendDeepRun(cwd, stats, at = new Date().toISOString()) {
+    if (!stats.enabled || stats.status === 'error')
+        return;
+    try {
+        const file = path.join(cwd, LOG);
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.appendFileSync(file, JSON.stringify({ at, ...stats }) + '\n');
+        if (fs.statSync(file).size > MAX_LOG_BYTES) {
+            const lines = fs.readFileSync(file, 'utf8').trimEnd().split('\n');
+            fs.writeFileSync(file, lines.slice(Math.floor(lines.length / 2)).join('\n') + '\n');
+        }
+    }
+    catch {
+        // Recording spend must never fail a review.
+    }
+}
+export function readDeepRuns(cwd) {
+    try {
+        return fs.readFileSync(path.join(cwd, LOG), 'utf8').split('\n').filter(Boolean)
+            .flatMap(line => { try {
+            return [JSON.parse(line)];
+        }
+        catch {
+            return [];
+        } });
+    }
+    catch {
+        return [];
+    }
+}
+export function summarizeDeepRuns(runs) {
+    const summary = {
+        runs: runs.length, costUsd: 0, unpricedRuns: 0, inputTokens: 0, outputTokens: 0,
+        functionsRanked: 0, functionsRouted: 0, alreadyReviewed: 0, toolCalls: 0, findingsKept: 0,
+    };
+    for (const run of runs) {
+        if (typeof run.cost_usd === 'number')
+            summary.costUsd += run.cost_usd;
+        else if (run.tier === 'cloud')
+            summary.unpricedRuns++;
+        summary.inputTokens += run.input_tokens ?? 0;
+        summary.outputTokens += run.output_tokens ?? 0;
+        summary.functionsRanked += run.router?.functions ?? 0;
+        summary.functionsRouted += run.router?.routed ?? 0;
+        summary.alreadyReviewed += run.router?.already_reviewed ?? 0;
+        summary.toolCalls += run.tool_calls ?? 0;
+        summary.findingsKept += run.findings_count ?? 0;
+    }
+    return summary;
+}

package/dist/review/deep-runs.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/review/deep-runs.test.js

@@ -0,0 +1,23 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { appendDeepRun, readDeepRuns, summarizeDeepRuns } from './deep-runs.js';
+let dir;
+beforeEach(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), 'deep-runs-')); });
+afterEach(() => { fs.rmSync(dir, { recursive: true, force: true }); });
+describe('deep runs', () => {
+    it('records what each run spent and sums only what was reported', () => {
+        appendDeepRun(dir, { enabled: true, status: 'ok', tier: 'cloud', cost_usd: 0.25, input_tokens: 1000, output_tokens: 100,
+            router: { functions: 10, routed: 3, files_skipped: 2, already_reviewed: 1 }, tool_calls: 7, findings_count: 2 });
+        appendDeepRun(dir, { enabled: true, status: 'partial', tier: 'cloud', input_tokens: 500, output_tokens: 50 });
+        appendDeepRun(dir, { enabled: true, status: 'ok', tier: 'lite' });
+        appendDeepRun(dir, { enabled: true, status: 'error', tier: 'cloud', cost_usd: 9 }); // nothing ran: not a run
+        const runs = readDeepRuns(dir);
+        expect(runs).toHaveLength(3);
+        expect(summarizeDeepRuns(runs)).toEqual({
+            runs: 3, costUsd: 0.25, unpricedRuns: 1, inputTokens: 1500, outputTokens: 150,
+            functionsRanked: 10, functionsRouted: 3, alreadyReviewed: 1, toolCalls: 7, findingsKept: 2,
+        });
+    });
+});

package/dist/review/generated-files.d.ts

@@ -0,0 +1,3 @@
+export declare function isGeneratedFile(cwd: string, file: string): boolean;
+/** The changed lines without generated files. */
+export declare function withoutGenerated(cwd: string, changedLines: Record<string, Set<number>>): Record<string, Set<number>>;

package/dist/review/generated-files.js

@@ -0,0 +1,35 @@
+/**
+ * Generated files: code a tool wrote, not a change anyone authored.
+ *
+ * A finding in a generated client, schema dump or lockfile cannot be fixed
+ * where it is reported (the next codegen run overwrites it) and is noise in a
+ * review. They are recognised by name and by the marker generators put at the
+ * top of the file.
+ */
+import fs from 'fs';
+import path from 'path';
+const GENERATED_NAME = /(\.|-|_)(gen|generated|pb)\.[cm]?[jt]sx?$|\.d\.ts\.map$|(^|\/)(__generated__|generated|gen)\/|\.min\.[cm]?js$|(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock)$/i;
+const GENERATED_MARKER = /@generated\b|\bauto-?generated\b|\bDO NOT EDIT\b|\bThis file (?:is|was) (?:automatically )?generated\b/i;
+const HEADER_BYTES = 1024;
+export function isGeneratedFile(cwd, file) {
+    if (GENERATED_NAME.test(file))
+        return true;
+    let fd;
+    try {
+        fd = fs.openSync(path.join(cwd, file), 'r');
+        const buffer = Buffer.alloc(HEADER_BYTES);
+        const read = fs.readSync(fd, buffer, 0, HEADER_BYTES, 0);
+        return GENERATED_MARKER.test(buffer.subarray(0, read).toString('utf8'));
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
+/** The changed lines without generated files. */
+export function withoutGenerated(cwd, changedLines) {
+    return Object.fromEntries(Object.entries(changedLines).filter(([file]) => !isGeneratedFile(cwd, file)));
+}

package/dist/review/generated-files.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/review/generated-files.test.js

@@ -0,0 +1,25 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { isGeneratedFile, withoutGenerated } from './generated-files.js';
+let dir;
+beforeEach(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), 'generated-')); });
+afterEach(() => { fs.rmSync(dir, { recursive: true, force: true }); });
+describe('generated files', () => {
+    it('recognises generated files by name and by the marker at their top', () => {
+        fs.writeFileSync(path.join(dir, 'client.ts'), '// This file is auto-generated by @hey-api/openapi-ts\nexport const x = 1;\n');
+        fs.writeFileSync(path.join(dir, 'schema.ts'), '/* eslint-disable */\n// @generated by protoc\n');
+        fs.writeFileSync(path.join(dir, 'handwritten.ts'), "// Generates the client; edit freely.\nexport const generate = () => 'x';\n");
+        expect(isGeneratedFile(dir, 'client.ts')).toBe(true);
+        expect(isGeneratedFile(dir, 'schema.ts')).toBe(true);
+        expect(isGeneratedFile(dir, 'src/api/client.gen.ts')).toBe(true);
+        expect(isGeneratedFile(dir, 'src/__generated__/types.ts')).toBe(true);
+        expect(isGeneratedFile(dir, 'handwritten.ts')).toBe(false);
+        expect(isGeneratedFile(dir, 'src/missing.ts')).toBe(false);
+    });
+    it('drops generated files from the change under review', () => {
+        const changed = { 'src/a.ts': new Set([1]), 'src/b.gen.ts': new Set([2]) };
+        expect(Object.keys(withoutGenerated(dir, changed))).toEqual(['src/a.ts']);
+    });
+});

package/dist/review/ledger.d.ts

@@ -0,0 +1,27 @@
+export declare const REVIEWED_FILE: string;
+export type ReviewVerdict = 'fixed' | 'no_issue';
+export interface LedgerEntry {
+    file: string;
+    function: string;
+    hash: string;
+    /** 'agent', 'human', or 'byok:<model>'. */
+    reviewer: string;
+    verdict: ReviewVerdict;
+    note: string;
+    at: string;
+}
+export interface ReviewedKey {
+    file: string;
+    function: string;
+    hash: string;
+}
+export declare function recordReview(cwd: string, entry: Omit<LedgerEntry, 'at'>, at?: string): LedgerEntry;
+export declare function readLedger(cwd: string): LedgerEntry[];
+/** True when this exact function text has a review on record (local log or a committed reviewed.json). */
+export declare function isReviewed(reviewed: ReviewedKey[], key: ReviewedKey): boolean;
+export declare function reviewedKeys(cwd: string): ReviewedKey[];
+/** The shareable form: latest verdict per function hash, sorted, no code and no notes. */
+export declare function exportReviewed(cwd: string): {
+    path: string;
+    entries: number;
+};

package/dist/review/ledger.js

@@ -0,0 +1,72 @@
+/**
+ * Review ledger: which changed functions were reviewed before the PR, by whom,
+ * with what verdict.
+ *
+ * Entries are keyed by the function's content hash, so any edit after the
+ * review makes the entry stale: a ledger can say "this exact code was looked
+ * at", never "this function is fine forever". The local log is append-only
+ * (.rigour/review-ledger.jsonl); `exportReviewed` writes the shareable form
+ * (.rigour/reviewed.json: hashes and verdicts only, no code, no notes) that a
+ * team may commit so the PR bot skips what was already reviewed.
+ */
+import fs from 'fs';
+import path from 'path';
+const LOG = path.join('.rigour', 'review-ledger.jsonl');
+export const REVIEWED_FILE = path.join('.rigour', 'reviewed.json');
+const MAX_LOG_BYTES = 2 * 1024 * 1024;
+export function recordReview(cwd, entry, at = new Date().toISOString()) {
+    const full = { ...entry, at };
+    const file = path.join(cwd, LOG);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.appendFileSync(file, JSON.stringify(full) + '\n');
+    if (fs.statSync(file).size > MAX_LOG_BYTES) {
+        const lines = fs.readFileSync(file, 'utf8').trimEnd().split('\n');
+        fs.writeFileSync(file, lines.slice(Math.floor(lines.length / 2)).join('\n') + '\n');
+    }
+    return full;
+}
+export function readLedger(cwd) {
+    try {
+        return fs.readFileSync(path.join(cwd, LOG), 'utf8').split('\n').filter(Boolean)
+            .flatMap(line => { try {
+            return [JSON.parse(line)];
+        }
+        catch {
+            return [];
+        } });
+    }
+    catch {
+        return [];
+    }
+}
+/** True when this exact function text has a review on record (local log or a committed reviewed.json). */
+export function isReviewed(reviewed, key) {
+    return reviewed.some(r => r.file === key.file && r.function === key.function && r.hash === key.hash);
+}
+export function reviewedKeys(cwd) {
+    return [...readLedger(cwd), ...readReviewedFile(cwd)];
+}
+/** The shareable form: latest verdict per function hash, sorted, no code and no notes. */
+export function exportReviewed(cwd) {
+    const latest = new Map();
+    for (const entry of readLedger(cwd))
+        latest.set(`${entry.file}\u0000${entry.function}\u0000${entry.hash}`, entry);
+    const entries = [...latest.values()]
+        .map(e => ({ file: e.file, function: e.function, hash: e.hash, reviewer: e.reviewer, verdict: e.verdict }))
+        .sort((a, b) => a.file.localeCompare(b.file) || a.function.localeCompare(b.function) || a.hash.localeCompare(b.hash));
+    const out = path.join(cwd, REVIEWED_FILE);
+    fs.mkdirSync(path.dirname(out), { recursive: true });
+    fs.writeFileSync(out, JSON.stringify({ version: 1, entries }, null, 2) + '\n');
+    return { path: REVIEWED_FILE, entries: entries.length };
+}
+function readReviewedFile(cwd) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(cwd, REVIEWED_FILE), 'utf8'));
+        return Array.isArray(parsed?.entries)
+            ? parsed.entries.filter((e) => typeof e?.file === 'string' && typeof e?.function === 'string' && typeof e?.hash === 'string')
+            : [];
+    }
+    catch {
+        return [];
+    }
+}

package/dist/review/quiet.d.ts

@@ -0,0 +1,16 @@
+import type { Failure } from '../types/index.js';
+export declare const DISMISSED_FILE: string;
+export declare function isProven(failure: Failure): boolean;
+/** The same finding across runs and pushes: gate, file and message, never the line (lines move). */
+export declare function findingKey(failure: Failure): string;
+export interface QuietSplit {
+    speaking: Failure[];
+    advisory: Failure[];
+    dismissed: number;
+    /** Which gates the dismissed findings came from: where Rigour is wrong for this team. */
+    dismissedByGate: Record<string, number>;
+}
+export declare function quietSplit(cwd: string, findings: Failure[], includeHeuristics?: boolean): QuietSplit;
+export declare function dismissedKeys(cwd: string): Set<string>;
+/** Record "not a bug" for a finding key; idempotent. */
+export declare function dismissFinding(cwd: string, key: string, reason: string, at?: string): boolean;