@rigour-labs/core 6.5.2 → 6.5.3

package/dist/review/check-outcomes.js

@@ -0,0 +1,81 @@
+/**
+ * How this repository treats each check: findings fixed versus dismissed.
+ *
+ * Every check gets a Beta(fixed + 1, dismissed + 1) posterior, so its mean is
+ * the chance that a finding from it is worth acting on here, and it starts at
+ * an honest 0.5 with no evidence. Advisory checks the team keeps dismissing are
+ * muted once the evidence is clear; proven checks are never muted, because
+ * quiet must not cost correctness.
+ *
+ * Local files under .rigour/: check-outcomes.json (the counts) and
+ * reported-findings.json (which check each recent finding key came from, so a
+ * dismissal by key can be attributed).
+ */
+import fs from 'fs';
+import path from 'path';
+const OUTCOMES_FILE = path.join('.rigour', 'check-outcomes.json');
+const REPORTED_FILE = path.join('.rigour', 'reported-findings.json');
+const MAX_REPORTED = 2000;
+/** Outcomes a check needs before it can be muted, and the posterior mean below which it is. */
+export const MUTE_MIN_OUTCOMES = 5;
+export const MUTE_BELOW = 0.25;
+/** A check is a gate and the rule within it: `ast` alone would mute complexity and parameter count together. */
+export function checkId(finding) {
+    const gate = finding.id ?? finding.rule ?? 'unknown';
+    return finding.title?.trim() ? `${gate}: ${finding.title.trim()}` : gate;
+}
+export function precisionOf(outcome) {
+    return (outcome.fixed + 1) / (outcome.fixed + outcome.dismissed + 2);
+}
+export function isMuted(outcome) {
+    if (!outcome)
+        return false;
+    return outcome.fixed + outcome.dismissed >= MUTE_MIN_OUTCOMES && precisionOf(outcome) < MUTE_BELOW;
+}
+export function readOutcomes(cwd) {
+    return readJson(path.join(cwd, OUTCOMES_FILE)) ?? {};
+}
+export function recordOutcome(cwd, check, kind) {
+    const outcomes = readOutcomes(cwd);
+    const current = outcomes[check] ?? { fixed: 0, dismissed: 0 };
+    outcomes[check] = { ...current, [kind]: current[kind] + 1 };
+    writeJson(path.join(cwd, OUTCOMES_FILE), outcomes);
+}
+/** Every check with an outcome, most dismissed first. */
+export function checkPrecisions(cwd) {
+    return Object.entries(readOutcomes(cwd))
+        .map(([check, outcome]) => ({ check, ...outcome, precision: precisionOf(outcome), muted: isMuted(outcome) }))
+        .sort((a, b) => a.precision - b.precision);
+}
+/** Remember which check each reported finding key came from (most recent kept). */
+export function rememberReported(cwd, entries) {
+    if (entries.length === 0)
+        return;
+    const reported = readJson(path.join(cwd, REPORTED_FILE)) ?? {};
+    for (const { key, check } of entries) {
+        delete reported[key];
+        reported[key] = check;
+    }
+    const kept = Object.entries(reported).slice(-MAX_REPORTED);
+    writeJson(path.join(cwd, REPORTED_FILE), Object.fromEntries(kept));
+}
+export function reportedCheck(cwd, key) {
+    return readJson(path.join(cwd, REPORTED_FILE))?.[key];
+}
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+function writeJson(file, value) {
+    try {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, JSON.stringify(value, null, 2) + '\n');
+    }
+    catch {
+        // Learning is best-effort; a read-only checkout still reviews.
+    }
+}

package/dist/review/check-outcomes.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/review/check-outcomes.test.js

@@ -0,0 +1,56 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { checkId, checkPrecisions, isMuted, precisionOf, readOutcomes, recordOutcome, rememberReported } from './check-outcomes.js';
+import { dismissFinding, findingKey, quietSplit } from './quiet.js';
+import { recordReviewOutcome } from './agent-fixes.js';
+let cwd;
+beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'outcomes-')); });
+afterEach(() => fs.rmSync(cwd, { recursive: true, force: true }));
+const finding = (id, title, file = 'src/a.ts', details = `${title} here`) => ({ id, title, details, severity: 'low', provenance: 'traditional', files: [file], line: 1 });
+describe('check precision', () => {
+    it('starts at an honest 0.5 and follows the evidence', () => {
+        expect(precisionOf({ fixed: 0, dismissed: 0 })).toBe(0.5);
+        expect(precisionOf({ fixed: 0, dismissed: 8 })).toBe(0.1);
+        expect(precisionOf({ fixed: 8, dismissed: 0 })).toBe(0.9);
+    });
+    it('mutes only on clear evidence: enough outcomes and a low posterior', () => {
+        expect(isMuted({ fixed: 0, dismissed: 3 })).toBe(false);
+        expect(isMuted({ fixed: 0, dismissed: 5 })).toBe(true);
+        expect(isMuted({ fixed: 2, dismissed: 4 })).toBe(false);
+    });
+    it('names a check by gate and rule, so one rule in a gate never mutes its neighbours', () => {
+        expect(checkId(finding('ast', 'Function too complex'))).toBe('ast: Function too complex');
+        expect(checkId({ rule: 'ast' })).toBe('ast');
+    });
+});
+describe('outcomes from real decisions', () => {
+    it('attributes a dismissal by key to the check review reported it from', () => {
+        const f = finding('ast', 'Too many parameters');
+        rememberReported(cwd, [{ key: findingKey(f), check: checkId(f) }]);
+        expect(dismissFinding(cwd, findingKey(f), 'builder needs these')).toBe(true);
+        expect(dismissFinding(cwd, findingKey(f), 'again')).toBe(true);
+        expect(readOutcomes(cwd)).toEqual({ 'ast: Too many parameters': { fixed: 0, dismissed: 1 } });
+    });
+    it('counts a fix an agent made against the check that reported it', () => {
+        fs.mkdirSync(path.join(cwd, 'src'));
+        fs.writeFileSync(path.join(cwd, 'src/a.ts'), 'before\n');
+        recordReviewOutcome(cwd, [finding('semantic-bugs', 'Unbounded read')], ['src/a.ts']);
+        fs.writeFileSync(path.join(cwd, 'src/a.ts'), 'after\n');
+        recordReviewOutcome(cwd, [], ['src/a.ts']);
+        expect(checkPrecisions(cwd)).toEqual([expect.objectContaining({ check: 'semantic-bugs: Unbounded read', fixed: 1, dismissed: 0 })]);
+    });
+});
+describe('quietSplit with precision', () => {
+    it('mutes an advisory check the team keeps dismissing, but never a proven one', () => {
+        for (let i = 0; i < 5; i++) {
+            recordOutcome(cwd, 'ast: Too many parameters', 'dismissed');
+            recordOutcome(cwd, 'security-patterns: Hard-coded secret', 'dismissed');
+        }
+        const split = quietSplit(cwd, [finding('ast', 'Too many parameters'), finding('ast', 'Function too complex'), finding('security-patterns', 'Hard-coded secret')]);
+        expect(split.muted).toBe(1);
+        expect(split.advisory.map(f => f.title)).toEqual(['Function too complex']);
+        expect(split.speaking.map(f => f.title)).toEqual(['Hard-coded secret']);
+    });
+});

package/dist/review/migration-order.d.ts

@@ -0,0 +1,5 @@
+import type { Config, Failure } from '../types/index.js';
+import type { DiffSource } from './git-diff.js';
+export declare function migrationOrderFailures(cwd: string, diff: string, source: DiffSource | undefined, config: Config): Failure[];
+/** Files a unified diff creates (`--- /dev/null`). */
+export declare function addedFiles(diff: string): string[];

package/dist/review/migration-order.js

@@ -0,0 +1,70 @@
+/**
+ * Migration out of order: a migration the change adds that sorts before the
+ * newest migration already on the base (the base ref, or HEAD for
+ * uncommitted work).
+ *
+ * The Supabase CLI applies migrations in filename order and `db push` stops
+ * at a local migration older than the last one applied, so a branch that
+ * picked an earlier timestamp than main's newest fails or is skipped on any
+ * database main already reached. Only directories listed in
+ * `gates.migration_order.dirs` are checked (Supabase's by default): runners
+ * that track each migration separately, such as Rails, apply older ones fine.
+ */
+import { spawnSync } from 'child_process';
+import path from 'path';
+import micromatch from 'micromatch';
+const GIT_TIMEOUT_MS = 10_000;
+export function migrationOrderFailures(cwd, diff, source, config) {
+    const settings = config.gates.migration_order;
+    if (!settings?.enabled)
+        return [];
+    const base = source?.mode === 'base' ? source.base : 'HEAD';
+    const byDirectory = new Map();
+    for (const file of addedFiles(diff)) {
+        const directory = path.posix.dirname(file);
+        if (!file.endsWith('.sql') || !micromatch.isMatch(directory, settings.dirs))
+            continue;
+        byDirectory.set(directory, [...(byDirectory.get(directory) ?? []), file]);
+    }
+    const failures = [];
+    for (const [directory, added] of byDirectory) {
+        const newest = newestOnBase(cwd, base, directory);
+        if (!newest)
+            continue;
+        for (const file of added) {
+            if (path.posix.basename(file) < newest)
+                failures.push(outOfOrder(file, newest, base));
+        }
+    }
+    return failures;
+}
+/** Files a unified diff creates (`--- /dev/null`). */
+export function addedFiles(diff) {
+    const added = [];
+    const lines = diff.split('\n');
+    for (let i = 0; i < lines.length - 1; i++) {
+        if (lines[i] === '--- /dev/null' && lines[i + 1].startsWith('+++ b/'))
+            added.push(lines[i + 1].slice('+++ b/'.length));
+    }
+    return added;
+}
+/** The last .sql file name in `directory` at `base`, or undefined when git cannot say. */
+function newestOnBase(cwd, base, directory) {
+    const result = spawnSync('git', ['ls-tree', '--name-only', base, `${directory}/`], { cwd, encoding: 'utf8', timeout: GIT_TIMEOUT_MS });
+    if (result.status !== 0)
+        return undefined;
+    const names = result.stdout.split('\n').map(line => path.posix.basename(line.trim())).filter(name => name.endsWith('.sql'));
+    return names.sort().at(-1);
+}
+function outOfOrder(file, newest, base) {
+    return {
+        id: 'migration-order',
+        title: 'Migration out of order',
+        details: `\`${path.posix.basename(file)}\` sorts before \`${newest}\`, the newest migration on \`${base}\`. Migrations apply in filename order, so a database that already ran \`${newest}\` stops at or skips this one.`,
+        severity: 'medium',
+        provenance: 'traditional',
+        files: [file],
+        line: 1,
+        hint: `Rename it with a timestamp after \`${newest}\`.`,
+    };
+}

package/dist/review/migration-order.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/review/migration-order.test.js

@@ -0,0 +1,62 @@
+import { execFileSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { ConfigSchema } from '../types/index.js';
+import { diffFromGit } from './git-diff.js';
+import { addedFiles, migrationOrderFailures } from './migration-order.js';
+let repo;
+const git = (...args) => execFileSync('git', ['-C', repo, ...args], { encoding: 'utf8' });
+const write = (rel, body = 'select 1;\n') => {
+    fs.mkdirSync(path.dirname(path.join(repo, rel)), { recursive: true });
+    fs.writeFileSync(path.join(repo, rel), body);
+};
+const commit = (message) => { git('add', '-A'); git('commit', '-qm', message); };
+const config = (enabled = true) => ConfigSchema.parse({ version: 1, gates: { migration_order: { enabled } } });
+const DIR = 'supabase/migrations';
+beforeEach(() => {
+    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'migration-order-'));
+    git('init', '-q', '-b', 'main');
+    git('config', 'user.email', 't@example.com');
+    git('config', 'user.name', 't');
+    git('config', 'commit.gpgsign', 'false');
+    write(`${DIR}/20260101000000_init.sql`);
+    commit('init');
+});
+afterEach(() => fs.rmSync(repo, { recursive: true, force: true }));
+describe('migrationOrderFailures', () => {
+    it('flags a branch migration dated before one main merged since', () => {
+        git('checkout', '-q', '-b', 'feature');
+        write(`${DIR}/20260107000000_feature.sql`);
+        commit('feature');
+        git('checkout', '-q', 'main');
+        write(`${DIR}/20260110000000_main.sql`);
+        commit('main moved');
+        git('checkout', '-q', 'feature');
+        const source = { mode: 'base', base: 'main' };
+        const failures = migrationOrderFailures(repo, diffFromGit(repo, source), source, config());
+        expect(failures).toEqual([expect.objectContaining({
+                id: 'migration-order', files: [`${DIR}/20260107000000_feature.sql`], line: 1,
+            })]);
+        expect(failures[0].details).toContain('20260110000000_main.sql');
+    });
+    it('passes a migration dated after the newest on the base, and uncommitted work against HEAD', () => {
+        write(`${DIR}/20260201000000_next.sql`);
+        expect(migrationOrderFailures(repo, diffFromGit(repo), { mode: 'working' }, config())).toEqual([]);
+        write(`${DIR}/20251231000000_old.sql`);
+        expect(migrationOrderFailures(repo, diffFromGit(repo), { mode: 'working' }, config()).map(f => f.files)).toEqual([[`${DIR}/20251231000000_old.sql`]]);
+    });
+    it('checks only the configured directories, and only when enabled', () => {
+        write('db/migrations/0001_old.sql');
+        write(`${DIR}/20251231000000_old.sql`);
+        expect(migrationOrderFailures(repo, diffFromGit(repo), { mode: 'working' }, config(false))).toEqual([]);
+        expect(migrationOrderFailures(repo, diffFromGit(repo), { mode: 'working' }, config()).map(f => f.files[0])).toEqual([`${DIR}/20251231000000_old.sql`]);
+    });
+});
+describe('addedFiles', () => {
+    it('lists only files the diff creates', () => {
+        const diff = ['--- /dev/null', '+++ b/new.sql', '@@ -0,0 +1 @@', '+x', '--- a/old.sql', '+++ b/old.sql'].join('\n');
+        expect(addedFiles(diff)).toEqual(['new.sql']);
+    });
+});

package/dist/review/quiet.d.ts

@@ -6,6 +6,8 @@ export declare function findingKey(failure: Failure): string;
 export interface QuietSplit {
     speaking: Failure[];
     advisory: Failure[];
+    /** Advisory findings from checks this repository keeps dismissing (check-outcomes.ts); counted, not listed. */
+    muted: number;
     dismissed: number;
     /** Which gates the dismissed findings came from: where Rigour is wrong for this team. */
     dismissedByGate: Record<string, number>;

package/dist/review/quiet.js

@@ -16,6 +16,7 @@
 import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
+import { checkId, isMuted, readOutcomes, recordOutcome, reportedCheck } from './check-outcomes.js';
 const PROVEN_GATES = new Set(['semantic-bugs', 'hallucinated-imports', 'security-patterns', 'deep-analysis', 'diff-tests']);
 export const DISMISSED_FILE = path.join('.rigour', 'dismissed.json');
 export function isProven(failure) {
@@ -27,7 +28,8 @@ export function findingKey(failure) {
 }
 export function quietSplit(cwd, findings, includeHeuristics = false) {
     const dismissed = dismissedKeys(cwd);
-    const split = { speaking: [], advisory: [], dismissed: 0, dismissedByGate: {} };
+    const outcomes = readOutcomes(cwd);
+    const split = { speaking: [], advisory: [], muted: 0, dismissed: 0, dismissedByGate: {} };
     for (const finding of findings) {
         if (dismissed.has(findingKey(finding))) {
             split.dismissed++;
@@ -35,6 +37,8 @@ export function quietSplit(cwd, findings, includeHeuristics = false) {
         }
         else if (includeHeuristics || isProven(finding))
             split.speaking.push(finding);
+        else if (isMuted(outcomes[checkId(finding)]))
+            split.muted++;
         else
             split.advisory.push(finding);
     }
@@ -63,8 +67,13 @@ export function dismissFinding(cwd, key, reason, at = new Date().toISOString())
     catch {
         // First dismissal in this repository.
     }
-    if (!entries.some(e => e.key === key))
-        entries.push({ key, reason: reason.trim(), at });
+    if (entries.some(e => e.key === key))
+        return true;
+    // The check this key came from (remembered when review reported it) feeds its precision.
+    const check = reportedCheck(cwd, key);
+    entries.push({ key, reason: reason.trim(), at, ...(check ? { check } : {}) });
+    if (check)
+        recordOutcome(cwd, check, 'dismissed');
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, JSON.stringify({ version: 1, entries }, null, 2) + '\n');
     return true;

package/dist/review/review.d.ts

@@ -21,6 +21,8 @@ export interface ReviewResult {
     contextFindings: Failure[];
     /** Heuristic findings on changed lines: returned on request, never deciding the verdict (quiet.ts). */
     advisory: Failure[];
+    /** Advisory findings from checks this repository keeps dismissing: counted, not listed. */
+    muted: number;
     /** Findings a person dismissed as not a bug, and the gates they came from. */
     dismissed: number;
     dismissedByGate: Record<string, number>;

package/dist/review/review.js

@@ -15,28 +15,33 @@ import { splitByChangedLines } from './changed-lines.js';
 import { changedFunctionSpans } from './changed-function-spans.js';
 import { withoutGenerated } from './generated-files.js';
 import { findingKey, isProven, quietSplit } from './quiet.js';
+import { checkId, rememberReported } from './check-outcomes.js';
 import { diffFromGit } from './git-diff.js';
 import { diffTestFailures } from './diff-test-findings.js';
+import { migrationOrderFailures } from './migration-order.js';
 export async function reviewChange(input) {
     const diff = input.diff ?? diffFromGit(input.cwd, input.source);
     const changedLines = withoutGenerated(input.cwd, parseDiff(diff));
     const targets = input.files?.length ? input.files : Object.keys(changedLines);
     if (targets.length === 0) {
-        return { status: 'PASS', findings: [], fileFindings: [], contextFindings: [], advisory: [], dismissed: 0, dismissedByGate: {}, unlocated: 0, excludedOutsideChangedLines: 0, changedLines, report: null, gateErrors: [] };
+        return { status: 'PASS', findings: [], fileFindings: [], contextFindings: [], advisory: [], muted: 0, dismissed: 0, dismissedByGate: {}, unlocated: 0, excludedOutsideChangedLines: 0, changedLines, report: null, gateErrors: [] };
     }
     const deep = input.deep ? { ...input.deep, focusLines: changedLinesByFile(changedLines), removedLines: removedByFile(diff), diff } : undefined;
     const report = await new GateRunner(input.config).run(input.cwd, await normalizeScopePatterns(input.cwd, targets), deep);
     if (input.diffTests && deep)
         report.failures.push(...await diffTestFailures(input.cwd, input.source, deep));
-    const split = splitByChangedLines(report.failures, changedLines, deep ? changedFunctionSpans(input.cwd, changedLines) : {});
+    report.failures.push(...migrationOrderFailures(input.cwd, diff, input.source, input.config));
+    const split = splitByChangedLines(report.failures, changedLines, deep ? changedFunctionSpans(input.cwd, changedLines) : {}, removedByFile(diff));
     const deepError = deepAnalysisError(report);
     const quiet = quietSplit(input.cwd, split.findings, input.config.review?.include_heuristics);
+    rememberReported(input.cwd, [...quiet.speaking, ...quiet.advisory].map(f => ({ key: findingKey(f), check: checkId(f) })));
     const gateErrors = crashedGates(report);
     const provenCrashed = gateErrors.some(id => isProven({ id }));
     return {
         status: deepError || provenCrashed ? 'ERROR' : quiet.speaking.length > 0 ? 'FAIL' : 'PASS',
         findings: quiet.speaking,
         advisory: quiet.advisory,
+        muted: quiet.muted,
         dismissed: quiet.dismissed,
         dismissedByGate: quiet.dismissedByGate,
         fileFindings: split.fileFindings,

package/dist/review/review.test.js

@@ -37,6 +37,17 @@ describe('splitByChangedLines', () => {
         expect(split.contextFindings.map(f => f.line)).toEqual([30]); // elsewhere in a changed file: shown, not blocking
         expect(split.outside).toBe(1); // a rule finding on an unchanged line is pre-existing, as before
     });
+    it('counts a multi-line finding as changed when lines inside it were deleted', () => {
+        // fetch(url, {      <- line 4, unchanged
+        //   redirect: ...   <- deleted, so the removal sits before new line 5
+        // })                <- line 5
+        const call = { ...failure('a.ts', 4), endLine: 5 };
+        const outsideCall = { ...failure('a.ts', 9), endLine: 10 };
+        const removed = { 'a.ts': [{ line: 5, text: ["  redirect: 'manual',"] }] };
+        const split = splitByChangedLines([call, outsideCall, failure('a.ts', 4)], {}, {}, removed);
+        expect(split.findings).toEqual([call]);
+        expect(split.outside).toBe(2);
+    });
 });
 describe('changedFunctionSpans', () => {
     it('spans the outermost function around changed lines, and anchors to the nearest changed line in it', () => {

package/dist/semantic/ast.d.ts

@@ -20,6 +20,7 @@ export declare function forEachNode(root: ts.Node, visit: (node: ts.Node) => voi
 /** Text of a property name (`a`, `'a'`, `"x-token"`), or undefined for computed names. */
 export declare function propertyNameText(name: ts.PropertyName | undefined): string | undefined;
 export declare function lineOf(node: ts.Node): number;
+export declare function endLineOf(node: ts.Node): number;
 /** "http.ts:51" style location for evidence, relative to cwd. */
 export declare function locationOf(cwd: string, node: ts.Node): string;
 export declare function relativeFile(cwd: string, sf: ts.SourceFile): string;

package/dist/semantic/ast.js

@@ -94,6 +94,10 @@ export function lineOf(node) {
     const sf = node.getSourceFile();
     return sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
 }
+export function endLineOf(node) {
+    const sf = node.getSourceFile();
+    return sf.getLineAndCharacterOfPosition(node.getEnd()).line + 1;
+}
 /** "http.ts:51" style location for evidence, relative to cwd. */
 export function locationOf(cwd, node) {
     return `${relativeFile(cwd, node.getSourceFile())}:${lineOf(node)}`;

package/dist/semantic/learn/compile.js

@@ -1,4 +1,4 @@
-import { forEachNode, lineOf, relativeFile, snippet } from '../ast.js';
+import { endLineOf, forEachNode, lineOf, relativeFile, snippet } from '../ast.js';
 import { guardsOf, mentionsName, namesIn, propertiesNamed, setsProperty } from './conditions.js';
 import { calleeKey, functionKeyOf, invocationArgs, isInvocation } from './identity.js';
 export const LEARNED_PREFIX = 'learned/';
@@ -23,6 +23,8 @@ export function compileLearnedRule(rule) {
                     provenance: 'traditional',
                     file,
                     line: lineOf(at),
+                    // The whole call: an option deleted from inside it is a change to this line.
+                    endLine: endLineOf(node),
                     message: rule.message,
                     hint: `Learned from ${describeSource(rule)}. Apply the same fix here, or delete .rigour/rules/${rule.id}.json if the rule no longer holds.`,
                     evidence: [`${file}:${lineOf(node)} ${snippet(node)}`],

package/dist/semantic/learn/learn.js

@@ -16,6 +16,8 @@ import { analyzeFiles } from '../engine.js';
 import { programBatches, loadProjectConfig } from '../program.js';
 import { compileLearnedRule, LEARNED_PREFIX } from './compile.js';
 import { extractEdits } from './extract.js';
+import { endLineOf, forEachNode, lineOf } from '../ast.js';
+import { functionKeyOf, isInvocation } from './identity.js';
 const DEFAULT_MAX_HITS = 3;
 const SOURCE = /\.(?:[cm]?[jt]s|[jt]sx)$/i;
 const NOT_SOURCE = /\.d\.[cm]?ts$|(?:^|\/)(?:__tests__|__mocks__|tests?)\/|\.(?:test|spec)\.[cm]?[jt]sx?$/;
@@ -73,6 +75,12 @@ function openTree(cwd, file) {
         throw new Error(`Cannot parse ${file} in ${cwd}`);
     return { cwd, checker: program.getTypeChecker(), sourceFile };
 }
+/**
+ * How often each candidate fires: before the fix, after it, and elsewhere. "After" counts only
+ * the function that was fixed: an unfixed copy of the bug next to it in the same file is
+ * another place the rule should find (listed with the repository hits), not a sign the rule
+ * is wrong about the fix.
+ */
 function countFindings(input, rules, files, repoFiles) {
     const compiled = rules.map(compileLearnedRule);
     const tally = (dir, scan) => analyzeFiles(dir, scan, { rules: compiled });
@@ -80,11 +88,38 @@ function countFindings(input, rules, files, repoFiles) {
     const before = tally(input.beforeDir, files);
     const after = tally(input.afterDir, files);
     const repo = tally(input.repoDir, repoFiles);
-    return new Map(rules.map(rule => [rule.id, {
-            before: byRule(before, rule.id).length,
-            after: byRule(after, rule.id).length,
-            hits: byRule(repo, rule.id).map(f => `${f.file}:${f.line}`),
-        }]));
+    const keyAt = functionKeysAt(input.afterDir, files);
+    return new Map(rules.map(rule => {
+        const afterHits = byRule(after, rule.id);
+        const atFix = afterHits.filter(f => f.file === rule.source.file && keyAt(f.file, f.line) === rule.source.function);
+        const besideFix = afterHits.filter(f => !atFix.includes(f)).map(f => `${f.file}:${f.line}`);
+        const elsewhere = byRule(repo, rule.id).map(f => `${f.file}:${f.line}`);
+        return [rule.id, { before: byRule(before, rule.id).length, after: atFix.length, hits: [...new Set([...besideFix, ...elsewhere])] }];
+    }));
+}
+/** The key of the function enclosing a call on a given line of a fixed file (the same key rules are scoped by). */
+function functionKeysAt(dir, files) {
+    const keys = new Map();
+    return (file, line) => {
+        if (!keys.has(file)) {
+            const byLine = new Map();
+            try {
+                forEachNode(openTree(dir, file).sourceFile, node => {
+                    // Every line a call spans: a finding can point inside the call, not at its first line.
+                    if (!isInvocation(node))
+                        return;
+                    for (let line = lineOf(node); line <= endLineOf(node); line++)
+                        if (!byLine.has(line))
+                            byLine.set(line, functionKeyOf(node));
+                });
+            }
+            catch {
+                // An unparseable file attributes nothing to the fix.
+            }
+            keys.set(file, byLine);
+        }
+        return files.includes(file) ? keys.get(file).get(line) : undefined;
+    };
 }
 function failure(counts, maxHits) {
     if (counts.before === 0)

package/dist/semantic/types.d.ts

@@ -16,6 +16,8 @@ export interface SemanticFinding {
     /** cwd-relative posix path of the reported line. */
     file: string;
     line: number;
+    /** Last line of the code the finding is about (a call), when it spans several lines. */
+    endLine?: number;
     message: string;
     hint: string;
     /** Supporting locations, e.g. "http.ts:51 deps.fetch(url, init)". */

package/dist/services/context-scope-summary.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/context-scope-summary.test.js

@@ -0,0 +1,17 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { getContextScopeSummary } from './context-telemetry-service.js';
+let root;
+beforeEach(() => { root = fs.mkdtempSync(path.join(os.tmpdir(), 'scope-summary-')); });
+afterEach(() => fs.rmSync(root, { recursive: true, force: true }));
+describe('getContextScopeSummary', () => {
+    it('counts rule files and skips a rules directory such as .clinerules/', async () => {
+        fs.mkdirSync(path.join(root, '.clinerules'));
+        fs.writeFileSync(path.join(root, '.clinerules', 'rigour.md'), 'rules');
+        fs.writeFileSync(path.join(root, 'CLAUDE.md'), 'Use small PRs.');
+        const summary = await getContextScopeSummary(root);
+        expect(summary.alwaysOnRuleTokens).toBeGreaterThan(0);
+    });
+});

package/dist/services/context-telemetry-service.js

@@ -432,7 +432,8 @@ export async function getContextScopeSummary(cwd) {
     let alwaysOnRuleTokens = 0;
     for (const fileName of GOVERNANCE_RULE_FILES) {
         const filePath = path.join(projectRoot, fileName);
-        if (await fs.pathExists(filePath)) {
+        // .clinerules may be a directory of rule files; only count regular files.
+        if ((await fs.stat(filePath).catch(() => null))?.isFile()) {
             alwaysOnRuleTokens += estimateTokenCount(await fs.readFile(filePath, 'utf8'));
         }
     }