@rigour-labs/core 6.5.0 → 6.5.2

package/dist/deep/fact-extractor.js

@@ -6,6 +6,7 @@
 import fs from 'fs-extra';
 import path from 'path';
 import { globby } from 'globby';
+import { directoriesAsGlobs, withDirectoryForms } from '../utils/glob-paths.js';
 const ANALYZABLE_EXTENSION = /\.(ts|js|tsx|jsx|py|go|rs|cs|java|rb|kt)$/i;
 /**
  * Lightweight regex-based fact extraction.
@@ -20,7 +21,7 @@ export async function extractFacts(cwd, ignore, scope) {
         '**/.git/**', '**/vendor/**', '**/__pycache__/**',
         '**/*.min.js', '**/*.bundle.js',
     ];
-    const matched = await globby(patterns, { cwd, ignore: ignorePatterns, followSymbolicLinks: false });
+    const matched = await globby(directoriesAsGlobs(cwd, patterns), { cwd, ignore: withDirectoryForms(ignorePatterns), expandDirectories: false, followSymbolicLinks: false });
     const files = matched.filter(f => ANALYZABLE_EXTENSION.test(f));
     const allFacts = [];
     for (const file of files) {

package/dist/deep/fact-extractor.test.js

@@ -3,7 +3,8 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
 // But we need to test extraction logic directly, so we also test via the public API
 const mockGlobby = vi.hoisted(() => vi.fn());
 const mockReadFile = vi.hoisted(() => vi.fn());
-vi.mock('globby', () => ({
+vi.mock('globby', async (importOriginal) => ({
+    isDynamicPattern: (await importOriginal()).isDynamicPattern,
     globby: mockGlobby,
 }));
 vi.mock('fs-extra', () => ({

package/dist/gates/ast.js

@@ -5,6 +5,7 @@ import { Gate } from './base.js';
 import { TypeScriptHandler } from './ast-handlers/typescript.js';
 import { PythonHandler } from './ast-handlers/python.js';
 import { UniversalASTHandler } from './ast-handlers/universal.js';
+import { directoriesAsGlobs, withDirectoryForms } from '../utils/glob-paths.js';
 export class ASTGate extends Gate {
     config;
     handlers = [];
@@ -35,9 +36,10 @@ export class ASTGate extends Gate {
         const ignore = [...new Set([...(context.ignore || []), ...defaultIgnore])].map(p => p.replace(/\\/g, '/'));
         const normalizedCwd = context.cwd.replace(/\\/g, '/');
         // Find all supported files
-        const files = await globby(patterns, {
+        const files = await globby(directoriesAsGlobs(normalizedCwd, patterns), {
             cwd: normalizedCwd,
-            ignore: ignore,
+            ignore: withDirectoryForms(ignore),
+            expandDirectories: false,
         });
         // Process files concurrently in batches for performance
         const CONCURRENCY = 16;

package/dist/gates/coverage.js

@@ -3,6 +3,7 @@ import path from 'path';
 import readline from 'node:readline';
 import { Gate } from './base.js';
 import { globby } from 'globby';
+import { withDirectoryForms } from '../utils/glob-paths.js';
 export class CoverageGate extends Gate {
     config;
     constructor(config) {
@@ -62,7 +63,8 @@ export class CoverageGate extends Gate {
             followSymbolicLinks: false,
             onlyFiles: true,
             deep: 8,
-            ignore: [...new Set([
+            expandDirectories: false,
+            ignore: withDirectoryForms([...new Set([
                     ...(context.ignore || []),
                     '**/node_modules/**',
                     '**/.git/**',
@@ -75,7 +77,7 @@ export class CoverageGate extends Gate {
                     '**/vendor/**',
                     '**/.venv/**',
                     '**/venv/**',
-                ])],
+                ])]),
         });
         if (reports.length === 0)
             return null;

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export { reviewChange, toReviewFinding, type ReviewInput, type ReviewResult, typ
 export { splitByChangedLines, type ChangedLineSplit } from './review/changed-lines.js';
 export { dismissFinding, dismissedKeys, findingKey, isProven, quietSplit, DISMISSED_FILE } from './review/quiet.js';
 export { isGeneratedFile } from './review/generated-files.js';
+export { countUsage, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, telemetryToken, trackUsage } from './telemetry/telemetry.js';
 export { buildReviewTask, type ReviewTask, type ReviewTaskItem } from './review/review-task.js';
 export { acknowledgeReview, type ReviewAck, type AckResult } from './review/review-ack.js';
 export { exportReviewed, readLedger, reviewedKeys, isReviewed, recordReview, REVIEWED_FILE, type LedgerEntry, type ReviewedKey, type ReviewVerdict } from './review/ledger.js';

package/dist/index.js

@@ -15,6 +15,7 @@ export { reviewChange, toReviewFinding } from './review/review.js';
 export { splitByChangedLines } from './review/changed-lines.js';
 export { dismissFinding, dismissedKeys, findingKey, isProven, quietSplit, DISMISSED_FILE } from './review/quiet.js';
 export { isGeneratedFile } from './review/generated-files.js';
+export { countUsage, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, telemetryToken, trackUsage } from './telemetry/telemetry.js';
 export { buildReviewTask } from './review/review-task.js';
 export { acknowledgeReview } from './review/review-ack.js';
 export { exportReviewed, readLedger, reviewedKeys, isReviewed, recordReview, REVIEWED_FILE } from './review/ledger.js';

package/dist/pattern-index/indexer.js

@@ -17,6 +17,7 @@ import { generateEmbedding } from './embeddings.js';
 import { hashContent } from './indexer-helpers.js';
 import { extractGoPatterns, extractRustPatterns, extractJVMStylePatterns, extractPythonPatterns, extractGenericCPatterns, } from './indexer-lang.js';
 import { nodeToPattern } from './indexer-ts.js';
+import { directoriesAsGlobs, withDirectoryForms } from '../utils/glob-paths.js';
 // ---------------------------------------------------------------------------
 // Configuration
 // ---------------------------------------------------------------------------
@@ -239,10 +240,11 @@ export class PatternIndexer {
         if (!this.config.indexTests) {
             exclude.push('**/*.test.*', '**/*.spec.*', '**/__tests__/**');
         }
-        return globby(patterns, {
+        return globby(directoriesAsGlobs(this.rootDir, patterns), {
             cwd: this.rootDir,
             absolute: true,
-            ignore: exclude,
+            ignore: withDirectoryForms(exclude),
+            expandDirectories: false,
             gitignore: true,
         });
     }

package/dist/review/quiet.d.ts

@@ -7,6 +7,8 @@ export interface QuietSplit {
     speaking: Failure[];
     advisory: Failure[];
     dismissed: number;
+    /** Which gates the dismissed findings came from: where Rigour is wrong for this team. */
+    dismissedByGate: Record<string, number>;
 }
 export declare function quietSplit(cwd: string, findings: Failure[], includeHeuristics?: boolean): QuietSplit;
 export declare function dismissedKeys(cwd: string): Set<string>;

package/dist/review/quiet.js

@@ -27,10 +27,12 @@ export function findingKey(failure) {
 }
 export function quietSplit(cwd, findings, includeHeuristics = false) {
     const dismissed = dismissedKeys(cwd);
-    const split = { speaking: [], advisory: [], dismissed: 0 };
+    const split = { speaking: [], advisory: [], dismissed: 0, dismissedByGate: {} };
     for (const finding of findings) {
-        if (dismissed.has(findingKey(finding)))
+        if (dismissed.has(findingKey(finding))) {
             split.dismissed++;
+            split.dismissedByGate[finding.id] = (split.dismissedByGate[finding.id] ?? 0) + 1;
+        }
         else if (includeHeuristics || isProven(finding))
             split.speaking.push(finding);
         else

package/dist/review/quiet.test.js

@@ -20,7 +20,7 @@ describe('quiet by default', () => {
         expect(dismissFinding(dir, findingKey(leak), 'test fixture token, never deployed')).toBe(true);
         expect(dismissFinding(dir, findingKey(leak), 'again')).toBe(true); // idempotent
         const moved = { ...leak, line: 40 };
-        expect(quietSplit(dir, [moved, finding('semantic-bugs')])).toMatchObject({ dismissed: 1, speaking: [expect.objectContaining({ id: 'semantic-bugs' })] });
+        expect(quietSplit(dir, [moved, finding('semantic-bugs')])).toMatchObject({ dismissed: 1, dismissedByGate: { 'security-patterns': 1 }, speaking: [expect.objectContaining({ id: 'semantic-bugs' })] });
         expect(JSON.parse(fs.readFileSync(path.join(dir, '.rigour/dismissed.json'), 'utf8')).entries).toHaveLength(1);
         expect(dismissFinding(dir, 'not-a-key', 'x')).toBe(false);
     });

package/dist/review/review.d.ts

@@ -21,13 +21,16 @@ export interface ReviewResult {
     contextFindings: Failure[];
     /** Heuristic findings on changed lines: returned on request, never deciding the verdict (quiet.ts). */
     advisory: Failure[];
-    /** Findings a person dismissed as not a bug. */
+    /** Findings a person dismissed as not a bug, and the gates they came from. */
     dismissed: number;
+    dismissedByGate: Record<string, number>;
     unlocated: number;
     excludedOutsideChangedLines: number;
     changedLines: Record<string, Set<number>>;
     report: Report | null;
     deepError?: string;
+    /** Gates that crashed instead of running; a proven one makes the result ERROR. */
+    gateErrors: string[];
 }
 export interface ReviewFinding {
     id: string;

package/dist/review/review.js

@@ -4,7 +4,8 @@
  *
  * Runs the configured gates on the files a change touches and keeps what
  * belongs to the change (see changed-lines.ts). A deep run that was asked for
- * but could not analyze anything makes the result ERROR, never a clean PASS.
+ * but could not analyze anything makes the result ERROR, never a clean PASS,
+ * and so does a proven gate that crashed (a heuristic one is only listed).
  */
 import { GateRunner } from '../gates/runner.js';
 import { changedLinesByFile, parseDiff, removedByFile } from '../utils/diff.js';
@@ -13,7 +14,7 @@ import { deepAnalysisError } from '../utils/deep-status.js';
 import { splitByChangedLines } from './changed-lines.js';
 import { changedFunctionSpans } from './changed-function-spans.js';
 import { withoutGenerated } from './generated-files.js';
-import { findingKey, quietSplit } from './quiet.js';
+import { findingKey, isProven, quietSplit } from './quiet.js';
 import { diffFromGit } from './git-diff.js';
 import { diffTestFailures } from './diff-test-findings.js';
 export async function reviewChange(input) {
@@ -21,7 +22,7 @@ export async function reviewChange(input) {
     const changedLines = withoutGenerated(input.cwd, parseDiff(diff));
     const targets = input.files?.length ? input.files : Object.keys(changedLines);
     if (targets.length === 0) {
-        return { status: 'PASS', findings: [], fileFindings: [], contextFindings: [], advisory: [], dismissed: 0, unlocated: 0, excludedOutsideChangedLines: 0, changedLines, report: null };
+        return { status: 'PASS', findings: [], fileFindings: [], contextFindings: [], advisory: [], dismissed: 0, dismissedByGate: {}, unlocated: 0, excludedOutsideChangedLines: 0, changedLines, report: null, gateErrors: [] };
     }
     const deep = input.deep ? { ...input.deep, focusLines: changedLinesByFile(changedLines), removedLines: removedByFile(diff), diff } : undefined;
     const report = await new GateRunner(input.config).run(input.cwd, await normalizeScopePatterns(input.cwd, targets), deep);
@@ -30,20 +31,27 @@ export async function reviewChange(input) {
     const split = splitByChangedLines(report.failures, changedLines, deep ? changedFunctionSpans(input.cwd, changedLines) : {});
     const deepError = deepAnalysisError(report);
     const quiet = quietSplit(input.cwd, split.findings, input.config.review?.include_heuristics);
+    const gateErrors = crashedGates(report);
+    const provenCrashed = gateErrors.some(id => isProven({ id }));
     return {
-        status: deepError ? 'ERROR' : quiet.speaking.length > 0 ? 'FAIL' : 'PASS',
+        status: deepError || provenCrashed ? 'ERROR' : quiet.speaking.length > 0 ? 'FAIL' : 'PASS',
         findings: quiet.speaking,
         advisory: quiet.advisory,
         dismissed: quiet.dismissed,
+        dismissedByGate: quiet.dismissedByGate,
         fileFindings: split.fileFindings,
         contextFindings: split.contextFindings,
         unlocated: split.unlocated,
         excludedOutsideChangedLines: split.outside,
         changedLines,
         report,
+        gateErrors,
         ...(deepError ? { deepError } : {}),
     };
 }
+function crashedGates(report) {
+    return Object.entries(report.summary).filter(([, status]) => status === 'ERROR').map(([id]) => id);
+}
 /** The JSON shape of a finding, shared by the CLI's --json and the MCP tool. */
 export function toReviewFinding(failure) {
     return {

package/dist/review/review.test.js

@@ -2,7 +2,8 @@ import { execFileSync } from 'child_process';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { GateRunner } from '../gates/runner.js';
 import { ConfigSchema } from '../types/index.js';
 import { parseDiff } from '../utils/diff.js';
 import { splitByChangedLines } from './changed-lines.js';
@@ -102,6 +103,29 @@ describe('git-backed review', () => {
         expect(semantic.map(f => [f.files?.[0], f.line])).toEqual([['src/notify.ts', 2]]);
         expect(toReviewFinding(semantic[0])).toMatchObject({ id: 'semantic-bugs', file: 'src/notify.ts', line: 2, severity: 'high' });
     });
+    it('runs every gate in a git worktree, where .git is a file', async () => {
+        write('src/a.ts', 'export const a = 1;\n');
+        git('add', '-A');
+        git('commit', '-qm', 'init');
+        const worktree = path.join(repo, 'wt');
+        git('worktree', 'add', '-q', worktree);
+        fs.writeFileSync(path.join(worktree, 'src/a.ts'), 'export const a = 1;\nexport const b = 2;\n');
+        const config = ConfigSchema.parse({ version: 1, ignore: ['.git/**', 'wt/**'] });
+        const result = await reviewChange({ cwd: worktree, config });
+        expect(result.gateErrors).toEqual([]);
+        expect(result.status).not.toBe('ERROR');
+    });
+    it('is ERROR when a proven gate crashed, and only lists a crashed heuristic gate', async () => {
+        write('src/a.ts', 'export const a = 1;\n');
+        const config = ConfigSchema.parse({ version: 1 });
+        const crash = (summary) => vi.spyOn(GateRunner.prototype, 'run').mockResolvedValueOnce({ status: 'FAIL', summary, failures: [], stats: { duration_ms: 0 } });
+        crash({ 'hallucinated-imports': 'ERROR' });
+        const proven = await reviewChange({ cwd: repo, config });
+        expect([proven.status, proven.gateErrors]).toEqual(['ERROR', ['hallucinated-imports']]);
+        crash({ 'style-drift': 'ERROR', 'semantic-bugs': 'PASS' });
+        const heuristic = await reviewChange({ cwd: repo, config });
+        expect([heuristic.status, heuristic.gateErrors]).toEqual(['PASS', ['style-drift']]);
+    });
     it('passes when nothing changed', async () => {
         write('src/a.ts', 'export const a = 1;\n');
         git('add', '-A');

package/dist/telemetry/telemetry.d.ts

@@ -0,0 +1,28 @@
+type Env = Record<string, string | undefined>;
+type Fetch = (url: string, init?: any) => Promise<unknown>;
+export interface TelemetryState {
+    /** undefined until the person has been asked. */
+    enabled?: boolean;
+    installId: string;
+}
+export interface TelemetryDeps {
+    env?: Env;
+    home?: string;
+    fetch?: Fetch;
+    version?: string;
+    now?: number;
+}
+export declare function telemetryToken(env?: Env): string;
+export declare function readTelemetryState(home?: string): TelemetryState;
+export declare function setTelemetryEnabled(enabled: boolean, home?: string): TelemetryState;
+export declare function isTelemetryEnabled(deps?: TelemetryDeps): boolean;
+/** Ask only once, only a person at a terminal, only when sending would be possible at all. */
+export declare function shouldAskTelemetry(isTty: boolean, deps?: TelemetryDeps): boolean;
+export declare function trackUsage(event: string, properties: Record<string, unknown>, deps?: TelemetryDeps): Promise<void>;
+/** Count something an agent does on a hot path (a hook check, an MCP tool call). Local only; no network. */
+export declare function countUsage(name: string, by?: number, deps?: TelemetryDeps): void;
+/** Send the day's counters as one `daily_usage` event once they are a day old, then start a new day. */
+export declare function flushDailyUsage(deps?: TelemetryDeps): Promise<boolean>;
+/** A duration as a coarse bucket, so timing never identifies a run. */
+export declare function durationBucket(ms: number): string;
+export {};

package/dist/telemetry/telemetry.js

@@ -0,0 +1,152 @@
+/**
+ * Anonymous, opt-in usage telemetry: how Rigour is used and where it is wrong,
+ * so the next release fixes what people actually hit. Every field is listed in
+ * TELEMETRY.md.
+ *
+ * Never sent: code, file or repository names, paths, git remotes, finding
+ * text, emails, keys, IP addresses (Mixpanel is told not to record them). The
+ * only identity is a random install id. Nothing is sent unless the person said
+ * yes, a token is built in (release builds only), and neither DO_NOT_TRACK nor
+ * RIGOUR_TELEMETRY=0 is set. CI never sends unless RIGOUR_TELEMETRY=1. A send
+ * that fails or is slow is dropped: telemetry never fails or slows a command.
+ *
+ * Two shapes: an event per CLI command or review (`trackUsage`), and, for the
+ * hot paths an agent drives on every edit (hooks, MCP tools), local counters
+ * (`countUsage`, no network) sent as one `daily_usage` event a day.
+ */
+import crypto from 'crypto';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { MIXPANEL_TOKEN } from './token.js';
+const ENDPOINT = 'https://api.mixpanel.com/track?ip=0';
+const TIMEOUT_MS = 2000;
+const DAY_MS = 24 * 60 * 60 * 1000;
+export function telemetryToken(env = process.env) {
+    return env.RIGOUR_MIXPANEL_TOKEN?.trim() || MIXPANEL_TOKEN;
+}
+function file(home, name) {
+    return path.join(home, '.rigour', name);
+}
+export function readTelemetryState(home = os.homedir()) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file(home, 'telemetry.json'), 'utf8'));
+        if (typeof parsed?.installId === 'string')
+            return { installId: parsed.installId, enabled: typeof parsed.enabled === 'boolean' ? parsed.enabled : undefined };
+    }
+    catch {
+        // Not asked yet.
+    }
+    return { installId: crypto.randomUUID() };
+}
+export function setTelemetryEnabled(enabled, home = os.homedir()) {
+    const state = { ...readTelemetryState(home), enabled };
+    writeJson(file(home, 'telemetry.json'), state);
+    return state;
+}
+function isCi(env) {
+    return !!(env.CI || env.GITHUB_ACTIONS || env.BUILDKITE || env.GITLAB_CI || env.CIRCLECI);
+}
+/** Opted out by the environment, whatever the stored answer. */
+function vetoed(env) {
+    return (!!env.DO_NOT_TRACK && env.DO_NOT_TRACK !== '0') || env.RIGOUR_TELEMETRY === '0' || !telemetryToken(env);
+}
+export function isTelemetryEnabled(deps = {}) {
+    const env = deps.env ?? process.env;
+    if (vetoed(env))
+        return false;
+    if (env.RIGOUR_TELEMETRY === '1')
+        return true;
+    if (isCi(env))
+        return false;
+    return readTelemetryState(deps.home).enabled === true;
+}
+/** Ask only once, only a person at a terminal, only when sending would be possible at all. */
+export function shouldAskTelemetry(isTty, deps = {}) {
+    const env = deps.env ?? process.env;
+    return isTty && !isCi(env) && !vetoed(env) && env.RIGOUR_TELEMETRY === undefined && readTelemetryState(deps.home).enabled === undefined;
+}
+export async function trackUsage(event, properties, deps = {}) {
+    if (!isTelemetryEnabled(deps))
+        return;
+    const env = deps.env ?? process.env;
+    const body = [{
+            event,
+            properties: {
+                token: telemetryToken(env),
+                distinct_id: readTelemetryState(deps.home).installId,
+                time: Math.floor((deps.now ?? Date.now()) / 1000),
+                $insert_id: crypto.randomUUID(),
+                version: deps.version,
+                os: process.platform,
+                node_major: Number(process.versions.node.split('.')[0]),
+                ci: isCi(env),
+                ...properties,
+            },
+        }];
+    try {
+        await (deps.fetch ?? fetch)(ENDPOINT, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Accept: 'text/plain' },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+    }
+    catch {
+        // Dropped: telemetry never affects the command.
+    }
+}
+/** Count something an agent does on a hot path (a hook check, an MCP tool call). Local only; no network. */
+export function countUsage(name, by = 1, deps = {}) {
+    if (!isTelemetryEnabled(deps))
+        return;
+    try {
+        const home = deps.home ?? os.homedir();
+        const counters = readCounters(home, deps.now ?? Date.now());
+        counters.counts[name] = (counters.counts[name] ?? 0) + by;
+        writeJson(file(home, 'telemetry-counters.json'), counters);
+    }
+    catch {
+        // Counting never affects the agent.
+    }
+}
+/** Send the day's counters as one `daily_usage` event once they are a day old, then start a new day. */
+export async function flushDailyUsage(deps = {}) {
+    if (!isTelemetryEnabled(deps))
+        return false;
+    const home = deps.home ?? os.homedir();
+    const now = deps.now ?? Date.now();
+    const counters = readCounters(home, now);
+    if (now - counters.since < DAY_MS || Object.keys(counters.counts).length === 0)
+        return false;
+    writeJson(file(home, 'telemetry-counters.json'), { since: now, counts: {} });
+    await trackUsage('daily_usage', { ...counters.counts }, deps);
+    return true;
+}
+function readCounters(home, now) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file(home, 'telemetry-counters.json'), 'utf8'));
+        if (typeof parsed?.since === 'number' && parsed.counts && typeof parsed.counts === 'object')
+            return parsed;
+    }
+    catch {
+        // First count.
+    }
+    return { since: now, counts: {} };
+}
+function writeJson(target, value) {
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, JSON.stringify(value, null, 2) + '\n');
+}
+/** A duration as a coarse bucket, so timing never identifies a run. */
+export function durationBucket(ms) {
+    if (ms < 1000)
+        return '<1s';
+    if (ms < 5000)
+        return '1-5s';
+    if (ms < 30000)
+        return '5-30s';
+    if (ms < 120000)
+        return '30s-2m';
+    return '>2m';
+}

package/dist/telemetry/telemetry.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/telemetry/telemetry.test.js

@@ -0,0 +1,59 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { countUsage, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, trackUsage } from './telemetry.js';
+let home;
+const env = { RIGOUR_MIXPANEL_TOKEN: 'tok' };
+beforeEach(() => { home = fs.mkdtempSync(path.join(os.tmpdir(), 'telemetry-')); });
+afterEach(() => { fs.rmSync(home, { recursive: true, force: true }); });
+describe('telemetry consent', () => {
+    it('sends nothing until the person says yes, and the environment always wins', () => {
+        expect(isTelemetryEnabled({ env, home })).toBe(false);
+        expect(shouldAskTelemetry(true, { env, home })).toBe(true);
+        setTelemetryEnabled(true, home);
+        expect(isTelemetryEnabled({ env, home })).toBe(true);
+        expect(shouldAskTelemetry(true, { env, home })).toBe(false); // asked once
+        expect(isTelemetryEnabled({ env: { ...env, DO_NOT_TRACK: '1' }, home })).toBe(false);
+        expect(isTelemetryEnabled({ env: { ...env, RIGOUR_TELEMETRY: '0' }, home })).toBe(false);
+        expect(isTelemetryEnabled({ env: { ...env, CI: 'true' }, home })).toBe(false);
+        expect(isTelemetryEnabled({ env: {}, home })).toBe(false); // a build without a token never sends
+    });
+    it('never asks in CI or without a terminal, and keeps one random install id', () => {
+        expect(shouldAskTelemetry(false, { env, home })).toBe(false);
+        expect(shouldAskTelemetry(true, { env: { ...env, GITHUB_ACTIONS: 'true' }, home })).toBe(false);
+        const first = setTelemetryEnabled(false, home).installId;
+        expect(readTelemetryState(home).installId).toBe(first);
+        expect(first).toMatch(/^[0-9a-f-]{36}$/);
+    });
+});
+describe('telemetry sending', () => {
+    it('sends one event with the install id and no IP, and swallows a failing network', async () => {
+        setTelemetryEnabled(true, home);
+        const fetch = vi.fn().mockResolvedValue({ ok: true });
+        await trackUsage('review_completed', { status: 'PASS', findings_by_gate: { 'semantic-bugs': 1 } }, { env, home, fetch, version: '6.5.0' });
+        const [url, init] = fetch.mock.calls[0];
+        expect(url).toBe('https://api.mixpanel.com/track?ip=0');
+        const [event] = JSON.parse(init.body);
+        expect(event.event).toBe('review_completed');
+        expect(event.properties).toMatchObject({ token: 'tok', distinct_id: readTelemetryState(home).installId, version: '6.5.0', status: 'PASS' });
+        expect(JSON.stringify(event)).not.toContain(home);
+        await expect(trackUsage('x', {}, { env, home, fetch: vi.fn().mockRejectedValue(new Error('offline')) })).resolves.toBeUndefined();
+    });
+    it('counts hot-path activity locally and sends it as one daily event', async () => {
+        setTelemetryEnabled(true, home);
+        const fetch = vi.fn().mockResolvedValue({ ok: true });
+        const day = 24 * 60 * 60 * 1000;
+        countUsage('hook_check', 1, { env, home, now: 0 });
+        countUsage('hook_check', 1, { env, home, now: 1000 });
+        countUsage('mcp:rigour_review', 1, { env, home, now: 2000 });
+        expect(await flushDailyUsage({ env, home, fetch, now: 5000 })).toBe(false); // not a day yet
+        expect(await flushDailyUsage({ env, home, fetch, now: day + 1 })).toBe(true);
+        const [event] = JSON.parse(fetch.mock.calls[0][1].body);
+        expect(event).toMatchObject({ event: 'daily_usage', properties: { hook_check: 2, 'mcp:rigour_review': 1 } });
+        expect(await flushDailyUsage({ env, home, fetch, now: 2 * day + 2 })).toBe(false); // counters reset
+    });
+    it('buckets durations so timing never identifies a run', () => {
+        expect([500, 3000, 20000, 60000, 600000].map(durationBucket)).toEqual(['<1s', '1-5s', '5-30s', '30s-2m', '>2m']);
+    });
+});

package/dist/telemetry/token.d.ts

@@ -0,0 +1 @@
+export declare const MIXPANEL_TOKEN = "53ab28669fd4bf80e2dbe5605eabacc5";

package/dist/telemetry/token.js

@@ -0,0 +1 @@
+export const MIXPANEL_TOKEN = '53ab28669fd4bf80e2dbe5605eabacc5';

package/dist/utils/glob-paths.d.ts

@@ -0,0 +1,4 @@
+/** Ignore entries: a plain path also ignores everything under it. Matched only, never listed. */
+export declare function withDirectoryForms(patterns: string[]): string[];
+/** Search patterns: a plain path that is a directory becomes `dir/**`; files and globs stay. */
+export declare function directoriesAsGlobs(cwd: string, patterns: string[]): string[];

package/dist/utils/glob-paths.js

@@ -0,0 +1,26 @@
+import fs from 'fs';
+import path from 'path';
+import { isDynamicPattern } from 'globby';
+/*
+ * globby's default directory expansion stats every pattern and ignore entry,
+ * and throws ENOTDIR when one runs through a file: `.git/**` in a git
+ * worktree, where `.git` is a file. Rigour turns it off
+ * (`expandDirectories: false`) and expands plain paths itself, as before:
+ * a directory `legacy` also means `legacy/**`.
+ */
+/** Ignore entries: a plain path also ignores everything under it. Matched only, never listed. */
+export function withDirectoryForms(patterns) {
+    return patterns.flatMap(pattern => isDynamicPattern(pattern) ? [pattern] : [pattern, `${pattern.replace(/\/+$/, '')}/**`]);
+}
+/** Search patterns: a plain path that is a directory becomes `dir/**`; files and globs stay. */
+export function directoriesAsGlobs(cwd, patterns) {
+    return patterns.map(pattern => !isDynamicPattern(pattern) && isDirectory(path.resolve(cwd, pattern)) ? `${pattern.replace(/\/+$/, '')}/**` : pattern);
+}
+function isDirectory(target) {
+    try {
+        return fs.statSync(target).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}

package/dist/utils/glob-paths.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/glob-paths.test.js

@@ -0,0 +1,40 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { FileScanner } from './scanner.js';
+import { directoriesAsGlobs, withDirectoryForms } from './glob-paths.js';
+let root;
+beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), 'glob-paths-'));
+    fs.mkdirSync(path.join(root, 'src'));
+    fs.mkdirSync(path.join(root, 'legacy'));
+    fs.writeFileSync(path.join(root, 'src', 'a.ts'), 'export const a = 1;\n');
+    fs.writeFileSync(path.join(root, 'legacy', 'old.ts'), 'export const b = 2;\n');
+});
+afterEach(() => fs.rmSync(root, { recursive: true, force: true }));
+describe('withDirectoryForms', () => {
+    it('adds the directory form to plain paths and leaves globs alone', () => {
+        expect(withDirectoryForms(['legacy', 'build/', '.git/**', '**/*.min.js'])).toEqual(['legacy', 'legacy/**', 'build/', 'build/**', '.git/**', '**/*.min.js']);
+    });
+});
+describe('directoriesAsGlobs', () => {
+    it('turns a directory into dir/** and leaves files, missing paths and globs alone', () => {
+        expect(directoriesAsGlobs(root, ['src', 'src/a.ts', 'missing', '**/*.ts'])).toEqual(['src/**', 'src/a.ts', 'missing', '**/*.ts']);
+    });
+});
+describe('FileScanner in a git worktree', () => {
+    it('scans when .git is a file and the config ignores .git/**', async () => {
+        fs.writeFileSync(path.join(root, '.git'), 'gitdir: /elsewhere/.git/worktrees/x\n');
+        const files = await FileScanner.findFiles({ cwd: root, patterns: ['**/*.ts'], ignore: ['.git/**'] });
+        expect(files.sort()).toEqual(['legacy/old.ts', 'src/a.ts']);
+    });
+    it('finds a file or a whole directory named by a plain path', async () => {
+        expect(await FileScanner.findFiles({ cwd: root, patterns: ['src/a.ts'] })).toEqual(['src/a.ts']);
+        expect(await FileScanner.findFiles({ cwd: root, patterns: ['legacy'] })).toEqual(['legacy/old.ts']);
+    });
+    it('still ignores a whole directory named by a plain path', async () => {
+        const files = await FileScanner.findFiles({ cwd: root, patterns: ['**/*.ts'], ignore: ['legacy'] });
+        expect(files).toEqual(['src/a.ts']);
+    });
+});

package/dist/utils/scanner.js

@@ -1,6 +1,7 @@
 import { globby } from 'globby';
 import fs from 'fs-extra';
 import path from 'path';
+import { directoriesAsGlobs, withDirectoryForms } from './glob-paths.js';
 /**
  * Glob patterns use `/` as the separator and `\` as the escape character.
  * Only on Windows can a backslash be a path separator, and even there one
@@ -33,9 +34,10 @@ export class FileScanner {
         const userIgnore = options.ignore || [];
         const ignore = [...new Set([...this.DEFAULT_IGNORE, ...userIgnore])].map(toGlobSeparators);
         const normalizedCwd = options.cwd.replace(/\\/g, '/');
-        return globby(patterns, {
+        return globby(directoriesAsGlobs(normalizedCwd, patterns), {
             cwd: normalizedCwd,
-            ignore: ignore,
+            ignore: withDirectoryForms(ignore),
+            expandDirectories: false,
         });
     }
     /**

package/dist/utils/scanner.test.js

@@ -1,7 +1,8 @@
 import { describe, it, expect, vi } from 'vitest';
 import { FileScanner } from './scanner.js';
 import { globby } from 'globby';
-vi.mock('globby', () => ({
+vi.mock('globby', async (importOriginal) => ({
+    isDynamicPattern: (await importOriginal()).isDynamicPattern,
     globby: vi.fn(),
 }));
 describe('FileScanner', () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.5.0",
+  "version": "6.5.2",
   "description": "AI-native quality gate engine with local Bayesian learning. AST analysis, drift detection, Fix Packet generation, and agent self-healing across TypeScript, JavaScript, Python, Go, Ruby, and C#.",
   "engines": {
     "node": ">=22"
@@ -70,11 +70,11 @@
     "pg": "^8.16.3",
     "sqlite3": "^5.1.7",
     "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-arm64": "6.5.0",
-    "@rigour-labs/brain-linux-arm64": "6.5.0",
-    "@rigour-labs/brain-darwin-x64": "6.5.0",
-    "@rigour-labs/brain-linux-x64": "6.5.0",
-    "@rigour-labs/brain-win-x64": "6.5.0"
+    "@rigour-labs/brain-darwin-arm64": "6.5.2",
+    "@rigour-labs/brain-linux-arm64": "6.5.2",
+    "@rigour-labs/brain-darwin-x64": "6.5.2",
+    "@rigour-labs/brain-win-x64": "6.5.2",
+    "@rigour-labs/brain-linux-x64": "6.5.2"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",