@rigour-labs/core 6.5.2 → 6.5.4

package/dist/gates/unindexed-reads/unindexed-reads.test.js

@@ -0,0 +1,90 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { UnindexedReadsGate } from './index.js';
+let repo;
+const write = (rel, body) => {
+    fs.mkdirSync(path.dirname(path.join(repo, rel)), { recursive: true });
+    fs.writeFileSync(path.join(repo, rel), body);
+};
+const run = (config = { enabled: true }) => new UnindexedReadsGate(config).run({ cwd: repo, patterns: ['src/**/*.ts'] });
+const TABLE = `create table orders (
+  id uuid primary key,
+  customer_id uuid,
+  status text not null,
+  placed_at timestamptz,
+  campaign_id uuid
+);
+create index orders_customer_idx on orders (customer_id, status, placed_at desc);
+create index orders_campaign_window_idx on orders (placed_at, id) where status = 'open' and campaign_id is not null;
+`;
+const WINDOW_READ = `
+export async function openOrders(db: Db, since: string, until: string) {
+  return db
+    .from('orders')
+    .select('id, placed_at')
+    .eq('status', 'open')
+    .not('customer_id', 'is', null)
+    .gt('placed_at', since)
+    .lte('placed_at', until)
+    .order('placed_at')
+    .order('id');
+}
+`;
+beforeEach(() => { repo = fs.mkdtempSync(path.join(os.tmpdir(), 'unindexed-')); });
+afterEach(() => fs.rmSync(repo, { recursive: true, force: true }));
+describe('UnindexedReadsGate', () => {
+    it('flags a window read whose only candidate index is partial on a filter the read does not have', async () => {
+        write('supabase/migrations/20260101000000_orders.sql', TABLE);
+        write('src/orders.ts', WINDOW_READ);
+        const failures = await run();
+        expect(failures).toHaveLength(1);
+        expect(failures[0]).toMatchObject({ id: 'unindexed-reads', files: ['src/orders.ts'], line: 4 });
+        expect(failures[0].details).toContain('`orders`');
+        expect(failures[0].details).toContain('`placed_at`');
+    });
+    it('is silent once a later migration adds an index that serves the read', async () => {
+        write('supabase/migrations/20260101000000_orders.sql', TABLE);
+        write('supabase/migrations/20260102000000_orders_open.sql', `create index concurrently orders_open_window_idx on public.orders (placed_at, id) where status = 'open' and customer_id is not null;`);
+        write('src/orders.ts', WINDOW_READ);
+        expect(await run()).toEqual([]);
+    });
+    it('is silent for a primary-key lookup, a table outside the migrations, and an uncertain table', async () => {
+        write('db/migrations/001_orders.sql', TABLE + 'create table notes (id int, body text);\nalter table notes rename column body to text;\n');
+        write('src/reads.ts', `
+          db.from('orders').select('*').eq('id', id);
+          db.from('auth_users').select('*').eq('email', email);
+          db.from('notes').select('*').eq('text', q);
+        `);
+        expect(await run()).toEqual([]);
+    });
+    it('is silent unless enabled, and for a read that narrows nothing', async () => {
+        write('supabase/migrations/20260101000000_orders.sql', TABLE);
+        write('src/orders.ts', WINDOW_READ + `\ndb.from('orders').select('*').limit(10);\n`);
+        expect(await run({ enabled: false })).toEqual([]);
+        expect(await new UnindexedReadsGate({ enabled: true }).run({ cwd: repo, patterns: ['src/**/*.ts'] })).toHaveLength(1);
+    });
+    it('needs every migration set that defines the table to lack a serving index', async () => {
+        write('apps/a/supabase/migrations/1_orders.sql', TABLE);
+        write('apps/b/supabase/migrations/1_orders.sql', TABLE + `create index orders_status_idx on orders (status);`);
+        write('src/orders.ts', WINDOW_READ);
+        expect(await run()).toEqual([]);
+    });
+    it('counts a row-level policy as a filter: names its column, and is silent once that column is indexed', async () => {
+        const subs = `create table subs (id text primary key, user_id uuid not null, status text);
+create policy "own subs" on subs for select using (auth.uid() = user_id);`;
+        write('supabase/migrations/1_subs.sql', subs);
+        write('src/subs.ts', `export const active = (db: Db) => db.from('subs').select('*').in('status', ['active']).maybeSingle();\n`);
+        const [finding] = await run();
+        expect(finding.details).toContain('`user_id`');
+        write('supabase/migrations/2_subs_user.sql', 'create index subs_user_idx on subs (user_id);');
+        expect(await run()).toEqual([]);
+    });
+    it('is silent for a table whose policy it cannot read', async () => {
+        write('supabase/migrations/1_docs.sql', `create table docs (id int primary key, org_id int, title text);
+create policy "members" on docs for select using (exists (select 1 from members m where m.org_id = docs.org_id));`);
+        write('src/docs.ts', `db.from('docs').select('*').eq('title', t);\n`);
+        expect(await run()).toEqual([]);
+    });
+});

package/dist/hooks/checker.js

@@ -110,6 +110,11 @@ export async function runHookChecker(options) {
             if (!resolved) {
                 continue;
             }
+            // Before ignore patterns: rigour.yml commonly ignores .rigour/ for scanning, not for writes.
+            if (isRigourState(resolved.relPath)) {
+                failures.push(rigourStateFailure(resolved.relPath));
+                continue;
+            }
             // Respect rigour.yml ignore patterns
             if (isIgnored(resolved.relPath, ignorePatterns)) {
                 continue;
@@ -270,6 +275,23 @@ function checkCommandInjection(line, i, relPath, failures) {
         });
     }
 }
+// ── Rigour's own state (always on) ────────────────────────────────
+/**
+ * .rigour/ holds what decides a review: dismissals, check outcomes, learned rules, the review
+ * ledger, operator scopes. Rigour writes it through its own commands and tools, never through
+ * the agent's edit tool, so an agent edit there is refused whatever rigour.yml says.
+ */
+function isRigourState(relPath) {
+    return relPath.replace(/\\/g, '/').startsWith('.rigour/');
+}
+function rigourStateFailure(relPath) {
+    return {
+        gate: 'file-guard',
+        file: relPath,
+        message: `BLOCKED: "${relPath}" is Rigour's own state. Change it with Rigour's commands (rigour dismiss, rigour_review_ack, rigour_remember), not by editing the file.`,
+        severity: 'critical',
+    };
+}
 // ── Protected Paths Enforcement (real-time) ───────────────────────
 /**
  * Block writes to protected paths defined in rigour.yml safety.protected_paths.

package/dist/hooks/checker.test.js

@@ -43,6 +43,14 @@ describe('runHookChecker', () => {
         const optedIn = await runHookChecker({ cwd: testDir, files: [filePath] });
         expect(optedIn.failures.some(f => f.gate === 'governance')).toBe(true);
     });
+    it("refuses an agent edit to Rigour's own state, even when rigour.yml ignores .rigour/", async () => {
+        fs.writeFileSync(path.join(testDir, 'rigour.yml'), 'version: 1\nignore:\n  - ".rigour/**"\n');
+        fs.mkdirSync(path.join(testDir, '.rigour'), { recursive: true });
+        fs.writeFileSync(path.join(testDir, '.rigour', 'dismissed.json'), '{"version":1,"entries":[]}');
+        const result = await runHookChecker({ cwd: testDir, files: ['.rigour/dismissed.json'] });
+        expect(result.status).toBe('fail');
+        expect(result.failures[0]).toMatchObject({ gate: 'file-guard', severity: 'critical' });
+    });
     it('should detect file size violations', async () => {
         const filePath = path.join(testDir, 'big.ts');
         const lines = Array.from({ length: 100 }, (_, i) => `export const v${i} = ${i};`);

package/dist/hooks/index.d.ts

@@ -16,3 +16,4 @@ export { generateDLPHookFiles } from './dlp-templates.js';
 export type { GeneratedDLPHookFile } from './dlp-templates.js';
 export { stopReview, stopMessage, blocksStop, STOP_MAX_ATTEMPTS } from './stop-review.js';
 export type { StopDecision } from './stop-review.js';
+export { recordSessionBaseline, sessionBaseline, nextStopAttempt, clearStopAttempts } from './session-state.js';

package/dist/hooks/index.js

@@ -11,3 +11,4 @@ export { recordDLPFeedback, allowLastDLPBlock, writeDLPBlockManifest, getLearned
 export { generateDLPHookFiles } from './dlp-templates.js';
 // Stop review ("before you say done")
 export { stopReview, stopMessage, blocksStop, STOP_MAX_ATTEMPTS } from './stop-review.js';
+export { recordSessionBaseline, sessionBaseline, nextStopAttempt, clearStopAttempts } from './session-state.js';

package/dist/hooks/session-state.d.ts

@@ -0,0 +1,8 @@
+/** Record where the session started, once; later calls keep the first commit. */
+export declare function recordSessionBaseline(cwd: string, session: string): void;
+/** The commit the session started from, if it is still in history (a rebase can drop it). */
+export declare function sessionBaseline(cwd: string, session: string): string | undefined;
+/** This stop's attempt number: blocks so far plus one. */
+export declare function nextStopAttempt(cwd: string, session: string): number;
+/** The agent finished cleanly: the next stop starts counting again. The baseline stays. */
+export declare function clearStopAttempts(cwd: string, session: string): void;

package/dist/hooks/session-state.js

@@ -0,0 +1,61 @@
+/**
+ * What the agent hooks remember per session, kept outside the workspace (utils/user-state.ts)
+ * so the agent being reviewed cannot rewrite it:
+ *   - baseline: the commit HEAD was at when the session first edited a file. The stop review
+ *     covers everything since then, so committing mid-session hides nothing.
+ *   - attempts: how many times the stop review has blocked this session.
+ */
+import { spawnSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+import { repoStateDir } from '../utils/user-state.js';
+/** Sessions untouched this long are forgotten, so the store stays small. */
+const SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+function storePath(cwd) {
+    return path.join(repoStateDir(cwd), 'sessions.json');
+}
+function readStore(cwd) {
+    try {
+        return JSON.parse(fs.readFileSync(storePath(cwd), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+function update(cwd, session, change) {
+    const store = readStore(cwd);
+    const now = Date.now();
+    for (const [id, entry] of Object.entries(store))
+        if (now - entry.at > SESSION_TTL_MS)
+            delete store[id];
+    store[session] = { ...change(store[session] ?? { at: now }), at: now };
+    fs.mkdirSync(path.dirname(storePath(cwd)), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(storePath(cwd), JSON.stringify(store), { mode: 0o600 });
+    return store[session];
+}
+/** Record where the session started, once; later calls keep the first commit. */
+export function recordSessionBaseline(cwd, session) {
+    if (!session || readStore(cwd)[session]?.baseline)
+        return;
+    const head = spawnSync('git', ['rev-parse', '--verify', '--quiet', 'HEAD'], { cwd, encoding: 'utf8' });
+    if (head.status !== 0)
+        return; // no commits yet: the working-tree review already covers everything
+    update(cwd, session, entry => ({ ...entry, baseline: head.stdout.trim() }));
+}
+/** The commit the session started from, if it is still in history (a rebase can drop it). */
+export function sessionBaseline(cwd, session) {
+    const baseline = readStore(cwd)[session]?.baseline;
+    if (!baseline)
+        return undefined;
+    const known = spawnSync('git', ['cat-file', '-e', `${baseline}^{commit}`], { cwd });
+    return known.status === 0 ? baseline : undefined;
+}
+/** This stop's attempt number: blocks so far plus one. */
+export function nextStopAttempt(cwd, session) {
+    return update(cwd, session, entry => ({ ...entry, attempts: (entry.attempts ?? 0) + 1 })).attempts ?? 1;
+}
+/** The agent finished cleanly: the next stop starts counting again. The baseline stays. */
+export function clearStopAttempts(cwd, session) {
+    if (readStore(cwd)[session]?.attempts)
+        update(cwd, session, entry => ({ ...entry, attempts: 0 }));
+}

package/dist/hooks/stop-review.d.ts

@@ -1,7 +1,8 @@
 /**
- * The "before you say done" review: when an agent is about to stop, review the
- * uncommitted change and, if it introduced serious findings, tell the agent
- * what to fix instead of letting it finish.
+ * The "before you say done" review: when an agent is about to stop, review what
+ * the session changed (since its baseline commit, or the uncommitted change when
+ * none was recorded) and, if it introduced serious findings, tell the agent what
+ * to fix instead of letting it finish.
  *
  * Only findings that deserve it block: critical ones, and high ones that are
  * proven (the semantic engine traced them) or security findings. A high
@@ -20,7 +21,8 @@ export interface StopDecision {
     findings: Failure[];
     reviewedFiles: string[];
 }
-export declare function stopReview(cwd: string, config: Config, attempt: number): Promise<StopDecision>;
+/** `since`: the session's baseline commit (session-state.ts); committing after it hides nothing. */
+export declare function stopReview(cwd: string, config: Config, attempt: number, since?: string): Promise<StopDecision>;
 export declare function reviewAckMessage(items: ReviewTaskItem[], attempt: number): string;
 /** Critical, or high and either proven by the semantic engine or a security finding. */
 export declare function blocksStop(finding: Failure): boolean;

package/dist/hooks/stop-review.js

@@ -3,9 +3,11 @@ import { buildReviewTask } from '../review/review-task.js';
 import { diffFromGit } from '../review/git-diff.js';
 export const STOP_MAX_ATTEMPTS = 3;
 const MAX_LISTED = 8;
-export async function stopReview(cwd, config, attempt) {
-    const diff = diffFromGit(cwd, { mode: 'working' });
-    const result = await reviewChange({ cwd, config, diff });
+/** `since`: the session's baseline commit (session-state.ts); committing after it hides nothing. */
+export async function stopReview(cwd, config, attempt, since) {
+    const source = since ? { mode: 'since', commit: since } : { mode: 'working' };
+    const diff = diffFromGit(cwd, source);
+    const result = await reviewChange({ cwd, config, diff, source });
     const blocking = result.findings.filter(blocksStop);
     const unreviewed = config.hooks?.require_review_ack ? buildReviewTask(cwd, diff, config.gates.deep?.router).items : [];
     const reviewed = { findings: result.findings, reviewedFiles: Object.keys(result.changedLines) };

package/dist/hooks/templates.js

@@ -47,7 +47,7 @@ function generateClaudeHooks(checkerCommand) {
                     hooks: [
                         {
                             type: "command",
-                            command: `${checkerCommand} --files "$TOOL_INPUT_file_path"`,
+                            command: `${checkerCommand} --stdin`,
                         }
                     ]
                 }

package/dist/index.d.ts

@@ -11,8 +11,10 @@ export { FrontendSecretExposureGate } from './gates/frontend-secret-exposure.js'
 export * from './utils/logger.js';
 export { normalizeScopePatterns, isScoped } from './utils/scope.js';
 export { deepAnalysisError } from './utils/deep-status.js';
+export { rigourUserDir, repoStateDir } from './utils/user-state.js';
 export { reviewChange, toReviewFinding, type ReviewInput, type ReviewResult, type ReviewFinding } from './review/review.js';
 export { splitByChangedLines, type ChangedLineSplit } from './review/changed-lines.js';
+export { isControlFile, mergeBaseOf, readStateFile } from './review/trusted-state.js';
 export { dismissFinding, dismissedKeys, findingKey, isProven, quietSplit, DISMISSED_FILE } from './review/quiet.js';
 export { isGeneratedFile } from './review/generated-files.js';
 export { countUsage, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, telemetryToken, trackUsage } from './telemetry/telemetry.js';
@@ -27,6 +29,7 @@ export { readLessons, writeLessons, promoteLesson, matchLessons, lessonText, les
 export { lessonsForDiff, lessonsSection, type LessonMode } from './review-learning/team-lessons.js';
 export { readRepoRules, rulesForDiff, rulesSection, splitRules, type RepoRule } from './review-learning/repo-rules.js';
 export { diffFromGit, GitDiffError, type DiffSource } from './review/git-diff.js';
+export { checkPrecisions, checkId, precisionOf, isMuted, MUTE_MIN_OUTCOMES, MUTE_BELOW, type CheckPrecision, type CheckOutcome } from './review/check-outcomes.js';
 export { recordReviewOutcome, listResolvedFixes, removeResolvedFix, openFindingCount, type ResolvedFix, type FixCapture } from './review/agent-fixes.js';
 export { computeEffectiveness, readAgentEvents, appendAgentEvent, findingKeys, type AgentEvent, type ReviewEffectiveness } from './review/effectiveness.js';
 export { parseDiff, changedLinesByFile } from './utils/diff.js';
@@ -47,7 +50,9 @@ export { openDatabase, isSQLiteAvailable, compactDatabase, getDatabaseSize, rese
 export type { RigourDB, CompactResult } from './storage/index.js';
 export { checkLocalPatterns, persistAndReinforce, getProjectStats } from './storage/index.js';
 export type { ProjectStats } from './storage/index.js';
-export { recordInteractionEvidence, countInteractionEvidence, recordInteractionLesson, listLessons, listKnowledgeLessons, getApplicableLessons, transitionLesson, getRepositoryId, queueLocalLessonsForTeam } from './storage/index.js';
+export { recordFixLessons, fixLessonSubject, fixLessonPrefix, FILES_TO_VALIDATE } from './storage/index.js';
+export { recordInteractionEvidence, countInteractionEvidence, listLessons, listKnowledgeLessons, getApplicableLessons, transitionLesson, getRepositoryId, shareMemoryLesson, queueLocalLessonsForTeam } from './storage/index.js';
+export { rankMemories, rankByMeaning, memoryText, SEMANTIC_FLOOR, RECALL_LIMIT, type MemoryEntry, type MemoryScope, type RankedMemory, type Ranked } from './memory/recall.js';
 export type { ApplicableLessons, InteractionEvidence, LessonRecord, LessonState, LessonVisibility, LocalLessonImportOptions, LocalLessonImportResult } from './storage/index.js';
 export { loadTeamConfiguration, saveTeamConfiguration, initializeTeamSchema, getTeamModeStatus, doctorTeamConnection, syncTeamOutbox, searchTeamKnowledge, backfillTeamEmbeddings, TEAM_CONFIG_PATH, validateTeamDatabaseUrl, explainTeamConnectionError, } from './storage/index.js';
 export type { TeamConfiguration, TeamSemanticConfiguration, TeamModeStatus, TeamDoctorResult, SemanticKnowledgeCandidate, SemanticKnowledgeResult, } from './storage/index.js';

package/dist/index.js

@@ -11,8 +11,10 @@ export { FrontendSecretExposureGate } from './gates/frontend-secret-exposure.js'
 export * from './utils/logger.js';
 export { normalizeScopePatterns, isScoped } from './utils/scope.js';
 export { deepAnalysisError } from './utils/deep-status.js';
+export { rigourUserDir, repoStateDir } from './utils/user-state.js';
 export { reviewChange, toReviewFinding } from './review/review.js';
 export { splitByChangedLines } from './review/changed-lines.js';
+export { isControlFile, mergeBaseOf, readStateFile } from './review/trusted-state.js';
 export { dismissFinding, dismissedKeys, findingKey, isProven, quietSplit, DISMISSED_FILE } from './review/quiet.js';
 export { isGeneratedFile } from './review/generated-files.js';
 export { countUsage, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, telemetryToken, trackUsage } from './telemetry/telemetry.js';
@@ -27,6 +29,7 @@ export { readLessons, writeLessons, promoteLesson, matchLessons, lessonText, les
 export { lessonsForDiff, lessonsSection } from './review-learning/team-lessons.js';
 export { readRepoRules, rulesForDiff, rulesSection, splitRules } from './review-learning/repo-rules.js';
 export { diffFromGit, GitDiffError } from './review/git-diff.js';
+export { checkPrecisions, checkId, precisionOf, isMuted, MUTE_MIN_OUTCOMES, MUTE_BELOW } from './review/check-outcomes.js';
 export { recordReviewOutcome, listResolvedFixes, removeResolvedFix, openFindingCount } from './review/agent-fixes.js';
 export { computeEffectiveness, readAgentEvents, appendAgentEvent, findingKeys } from './review/effectiveness.js';
 export { parseDiff, changedLinesByFile } from './utils/diff.js';
@@ -47,7 +50,9 @@ export { extractFacts, factsToPromptString } from './deep/fact-extractor.js';
 export { openDatabase, isSQLiteAvailable, compactDatabase, getDatabaseSize, resetDatabase, insertScan, insertFindings, getRecentScans, getScoreTrendFromDB, getTopIssues, reinforcePattern, getStrongPatterns } from './storage/index.js';
 // Local Project Memory (hybrid intelligence — SQLite-backed per-project learning)
 export { checkLocalPatterns, persistAndReinforce, getProjectStats } from './storage/index.js';
-export { recordInteractionEvidence, countInteractionEvidence, recordInteractionLesson, listLessons, listKnowledgeLessons, getApplicableLessons, transitionLesson, getRepositoryId, queueLocalLessonsForTeam } from './storage/index.js';
+export { recordFixLessons, fixLessonSubject, fixLessonPrefix, FILES_TO_VALIDATE } from './storage/index.js';
+export { recordInteractionEvidence, countInteractionEvidence, listLessons, listKnowledgeLessons, getApplicableLessons, transitionLesson, getRepositoryId, shareMemoryLesson, queueLocalLessonsForTeam } from './storage/index.js';
+export { rankMemories, rankByMeaning, memoryText, SEMANTIC_FLOOR, RECALL_LIMIT } from './memory/recall.js';
 export { loadTeamConfiguration, saveTeamConfiguration, initializeTeamSchema, getTeamModeStatus, doctorTeamConnection, syncTeamOutbox, searchTeamKnowledge, backfillTeamEmbeddings, TEAM_CONFIG_PATH, validateTeamDatabaseUrl, explainTeamConnectionError, } from './storage/index.js';
 // Temporal Drift Engine (v5 — cross-session trend analysis + per-provenance EWMA)
 export { generateTemporalDriftReport, formatDriftSummary } from './services/temporal-drift.js';

package/dist/inference/brain-placeholder.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/inference/brain-placeholder.test.js

@@ -0,0 +1,28 @@
+import { spawnSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { describe, expect, it } from 'vitest';
+const PACKAGES = path.resolve(__dirname, '../../..');
+const scripts = fs.readdirSync(PACKAGES)
+    .filter(name => name.startsWith('brain-') && !name.includes('win'))
+    .map(name => path.join(PACKAGES, name, 'bin', 'rigour-brain'));
+describe('rigour-brain placeholder', () => {
+    it.runIf(process.platform !== 'win32')('prints its message without running the command it names', () => {
+        const bin = fs.mkdtempSync(path.join(os.tmpdir(), 'brain-'));
+        const marker = path.join(bin, 'ran');
+        fs.writeFileSync(path.join(bin, 'rigour'), `#!/bin/sh\necho "$@" > "${marker}"\n`, { mode: 0o755 });
+        try {
+            expect(scripts.length).toBeGreaterThan(0);
+            for (const script of scripts) {
+                const result = spawnSync('sh', [script, '--version'], { env: { PATH: `${bin}:/usr/bin:/bin` }, encoding: 'utf8' });
+                expect(result.status).toBe(1);
+                expect(result.stderr).toContain('rigour deep pull');
+                expect(fs.existsSync(marker)).toBe(false);
+            }
+        }
+        finally {
+            fs.rmSync(bin, { recursive: true, force: true });
+        }
+    });
+});

package/dist/inference/llama-engine-checksum.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/inference/llama-engine-checksum.test.js

@@ -0,0 +1,27 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { Readable } from 'stream';
+import { afterAll, describe, expect, it, vi } from 'vitest';
+/** Install into a scratch folder: the real one is ~/.rigour. */
+const home = vi.hoisted(() => {
+    const p = require('path');
+    return p.join(require('os').tmpdir(), `rigour-engine-${process.pid}`);
+});
+vi.mock('../storage/db.js', async (importOriginal) => ({ ...(await importOriginal()), RIGOUR_DIR: home }));
+const { installLlamaEngine, managedEngineDir, releaseAssetFor } = await import('./llama-engine.js');
+afterAll(() => fs.rmSync(home, { recursive: true, force: true }));
+describe('llama.cpp engine install', () => {
+    it('pins a checksum for every published platform', () => {
+        for (const key of ['darwin-arm64', 'darwin-x64', 'linux-x64', 'win32-x64']) {
+            expect(releaseAssetFor(key)?.sha256).toMatch(/^[0-9a-f]{64}$/);
+        }
+        expect(releaseAssetFor('linux-arm64')).toBeUndefined();
+    });
+    it.runIf(releaseAssetFor(`${os.platform()}-${os.arch()}`))('refuses an archive that does not match its pinned checksum, and installs nothing', async () => {
+        const tampered = async () => ({ statusCode: 200, headers: {}, body: Readable.from([Buffer.from('not the real llama.cpp archive')]) });
+        await expect(installLlamaEngine(undefined, tampered)).rejects.toThrow(/does not match its pinned checksum/);
+        expect(fs.existsSync(managedEngineDir())).toBe(false);
+        expect(fs.readdirSync(path.dirname(managedEngineDir())).filter(f => f.endsWith('.zip'))).toEqual([]);
+    });
+});

package/dist/inference/llama-engine.d.ts

@@ -4,7 +4,10 @@ export declare function llamaBinaryName(): string;
 /** Install directory for the pinned release: ~/.rigour/bin/llama-<tag>. */
 export declare function managedEngineDir(): string;
 export declare function managedEnginePath(): string;
-export declare function releaseAssetFor(platformKey: string): string | undefined;
+export declare function releaseAssetFor(platformKey: string): {
+    file: string;
+    sha256: string;
+} | undefined;
 export interface ProbeResult {
     ok: boolean;
     version?: string;

package/dist/inference/llama-engine.js

@@ -16,12 +16,16 @@ export const LLAMA_RELEASE_TAG = 'b5604';
 const LLAMA_RELEASE_BASE = `https://github.com/ggml-org/llama.cpp/releases/download/${LLAMA_RELEASE_TAG}`;
 const PROBE_TIMEOUT_MS = 5_000;
 const EXTRACT_TIMEOUT_MS = 120_000;
-/** Platform → llama.cpp release asset. linux-arm64 has no published build. */
+/**
+ * Platform → llama.cpp release asset and its SHA-256, checked against the digest GitHub publishes
+ * for the release. A download that does not match is refused: the engine runs code on the
+ * user's machine. linux-arm64 has no published build.
+ */
 const LLAMA_RELEASE_ASSETS = {
-    'darwin-arm64': `llama-${LLAMA_RELEASE_TAG}-bin-macos-arm64.zip`,
-    'darwin-x64': `llama-${LLAMA_RELEASE_TAG}-bin-macos-x64.zip`,
-    'linux-x64': `llama-${LLAMA_RELEASE_TAG}-bin-ubuntu-x64.zip`,
-    'win32-x64': `llama-${LLAMA_RELEASE_TAG}-bin-win-cpu-x64.zip`,
+    'darwin-arm64': { file: `llama-${LLAMA_RELEASE_TAG}-bin-macos-arm64.zip`, sha256: '673c5f8c4a7a2226ca6f3db5141d1ed78dcdf178d902c1486b77b3dda41e6a61' },
+    'darwin-x64': { file: `llama-${LLAMA_RELEASE_TAG}-bin-macos-x64.zip`, sha256: 'ab9ba59f3e355aebe6bc2c632b3489d4ab98d727f0ee03b9df6b4a6207452ad2' },
+    'linux-x64': { file: `llama-${LLAMA_RELEASE_TAG}-bin-ubuntu-x64.zip`, sha256: '3981c1e353399fbc35ea23316854b3c302877c00fb6b7fa4063a0623ad9e0309' },
+    'win32-x64': { file: `llama-${LLAMA_RELEASE_TAG}-bin-win-cpu-x64.zip`, sha256: 'df32d58de0b57c3c9de2e68e44b947efbac1b8a3e417536b6703cbd8da11eddd' },
 };
 export function llamaBinaryName() {
     return os.platform() === 'win32' ? 'llama-cli.exe' : 'llama-cli';
@@ -84,13 +88,16 @@ export async function installLlamaEngine(onProgress, get) {
     }
     const installDir = managedEngineDir();
     const workDir = `${installDir}.partial`;
-    const zipPath = path.join(path.dirname(installDir), asset);
+    const zipPath = path.join(path.dirname(installDir), asset.file);
     await fs.ensureDir(path.dirname(installDir));
     await fs.remove(workDir);
     onProgress?.(`⬇ Downloading inference engine (llama.cpp ${LLAMA_RELEASE_TAG})...`);
     try {
-        await downloadToFile(`${LLAMA_RELEASE_BASE}/${asset}`, zipPath, { get });
-        onProgress?.('  Extracting...');
+        const { sha256 } = await downloadToFile(`${LLAMA_RELEASE_BASE}/${asset.file}`, zipPath, { get });
+        if (sha256 !== asset.sha256) {
+            throw new Error(`llama.cpp ${asset.file} does not match its pinned checksum (got ${sha256.slice(0, 12)}…, expected ${asset.sha256.slice(0, 12)}…); not installing it.`);
+        }
+        onProgress?.('  Verified checksum. Extracting...');
         await extractZip(zipPath, workDir);
         await installBinFolder(workDir, installDir);
     }

package/dist/memory/recall.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Recall by meaning: the few memories that match what an agent is about to do,
+ * instead of every memory at once.
+ *
+ * Ranking uses the same local embedding model as the pattern index and team
+ * knowledge (all-MiniLM-L6-v2, loaded lazily so its native dependency never
+ * loads for anything else). When the model is unavailable it falls back to
+ * keyword overlap and says so in each result's `match`.
+ */
+export type MemoryScope = 'repo' | 'user';
+export interface MemoryEntry {
+    scope: MemoryScope;
+    key: string;
+    value: string;
+    timestamp?: string;
+}
+export type RankedMemory = Ranked<MemoryEntry>;
+/**
+ * The similarity a memory needs to be returned, for local memory and team knowledge alike. Measured
+ * with scripts/eval/memory-recall.mjs: at 0.25 recall and precision are both 81% and no unrelated
+ * query gets anything; at the previous 0.45, 62% of right memories were missed.
+ */
+export declare const SEMANTIC_FLOOR = 0.25;
+/** Share of the query's words a memory must contain when ranking falls back to keywords. */
+export declare const KEYWORD_FLOOR = 0.5;
+export declare const RECALL_LIMIT = 3;
+type Embed = (text: string) => Promise<number[]>;
+export type Ranked<T> = T & {
+    score: number;
+    match: 'semantic' | 'keyword';
+};
+export declare function rankMemories(query: string, entries: MemoryEntry[], embed?: Embed): Promise<RankedMemory[]>;
+/** The items whose text best matches the query by meaning, at most RECALL_LIMIT, each above the floor. */
+export declare function rankByMeaning<T>(query: string, items: T[], textOf: (item: T) => string, embed?: Embed): Promise<Array<Ranked<T>>>;
+/** What a memory is searched by: its key reads as a title (`db_access` → "db access"). */
+export declare function memoryText(entry: Pick<MemoryEntry, 'key' | 'value'>): string;
+export {};

package/dist/memory/recall.js

@@ -0,0 +1,93 @@
+/**
+ * Recall by meaning: the few memories that match what an agent is about to do,
+ * instead of every memory at once.
+ *
+ * Ranking uses the same local embedding model as the pattern index and team
+ * knowledge (all-MiniLM-L6-v2, loaded lazily so its native dependency never
+ * loads for anything else). When the model is unavailable it falls back to
+ * keyword overlap and says so in each result's `match`.
+ */
+/**
+ * The similarity a memory needs to be returned, for local memory and team knowledge alike. Measured
+ * with scripts/eval/memory-recall.mjs: at 0.25 recall and precision are both 81% and no unrelated
+ * query gets anything; at the previous 0.45, 62% of right memories were missed.
+ */
+export const SEMANTIC_FLOOR = 0.25;
+/** Share of the query's words a memory must contain when ranking falls back to keywords. */
+export const KEYWORD_FLOOR = 0.5;
+export const RECALL_LIMIT = 3;
+/** Memories considered per recall; more are skipped so a large store cannot stall an agent. */
+const MAX_CANDIDATES = 300;
+/**
+ * Embeddings by text, kept for the life of the process: the MCP server is long-lived and the same
+ * memories and lessons are ranked on every recall, so each text is embedded once, not per query.
+ */
+const EMBEDDING_CACHE_LIMIT = 2000;
+const embeddingCache = new Map();
+async function cachedEmbedding(embed, text) {
+    const hit = embeddingCache.get(text);
+    if (hit)
+        return hit;
+    const vector = await embed(text);
+    if (vector.length === 0)
+        return vector; // unavailable: do not remember a failure
+    if (embeddingCache.size >= EMBEDDING_CACHE_LIMIT)
+        embeddingCache.delete(embeddingCache.keys().next().value);
+    embeddingCache.set(text, vector);
+    return vector;
+}
+export async function rankMemories(query, entries, embed) {
+    return rankByMeaning(query, entries, memoryText, embed);
+}
+/** The items whose text best matches the query by meaning, at most RECALL_LIMIT, each above the floor. */
+export async function rankByMeaning(query, items, textOf, embed) {
+    const candidates = items.slice(0, MAX_CANDIDATES);
+    if (candidates.length === 0)
+        return [];
+    const embedText = embed ?? (await import('../pattern-index/embeddings.js')).generateEmbedding;
+    const queryVector = await embedText(query);
+    const ranked = queryVector.length > 0
+        ? await bySimilarity(queryVector, candidates, textOf, embedText)
+        : byKeywords(query, candidates, textOf);
+    return ranked.sort((a, b) => b.score - a.score).slice(0, RECALL_LIMIT);
+}
+async function bySimilarity(queryVector, items, textOf, embed) {
+    const ranked = [];
+    for (const item of items) {
+        const score = cosine(queryVector, await cachedEmbedding(embed, textOf(item)));
+        if (score >= SEMANTIC_FLOOR)
+            ranked.push({ ...item, score, match: 'semantic' });
+    }
+    return ranked;
+}
+function byKeywords(query, items, textOf) {
+    const wanted = words(query);
+    if (wanted.size === 0)
+        return [];
+    return items.flatMap(item => {
+        const have = words(textOf(item));
+        const score = [...wanted].filter(word => have.has(word)).length / wanted.size;
+        return score >= KEYWORD_FLOOR ? [{ ...item, score, match: 'keyword' }] : [];
+    });
+}
+/** What a memory is searched by: its key reads as a title (`db_access` → "db access"). */
+export function memoryText(entry) {
+    return `${entry.key.replace(/[_-]+/g, ' ')}: ${entry.value}`;
+}
+const STOP_WORDS = new Set(['the', 'and', 'for', 'with', 'that', 'this', 'from', 'into', 'how', 'what', 'when', 'use', 'our', 'are', 'not']);
+function words(text) {
+    return new Set(text.toLowerCase().split(/[^a-z0-9]+/).filter(word => word.length > 2 && !STOP_WORDS.has(word)));
+}
+function cosine(a, b) {
+    if (a.length === 0 || a.length !== b.length)
+        return 0;
+    let dot = 0;
+    let normA = 0;
+    let normB = 0;
+    for (let i = 0; i < a.length; i++) {
+        dot += a[i] * b[i];
+        normA += a[i] * a[i];
+        normB += b[i] * b[i];
+    }
+    return normA && normB ? dot / Math.sqrt(normA * normB) : 0;
+}

package/dist/memory/recall.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/memory/recall.test.js

@@ -0,0 +1,36 @@
+import { describe, expect, it } from 'vitest';
+import { RECALL_LIMIT, rankMemories } from './recall.js';
+const memories = [
+    { scope: 'repo', key: 'retry_policy', value: 'Wrap network calls in withRetry from lib/net; never hand-roll backoff.' },
+    { scope: 'repo', key: 'db_access', value: 'Reports read from the replica, never the primary.' },
+    { scope: 'user', key: 'pr_size', value: 'Keep pull requests under 400 lines.' },
+];
+/** A stand-in embedding: one dimension per topic word, so similarity is predictable. */
+const TOPICS = ['retry', 'backoff', 'network', 'replica', 'report', 'pull', 'request'];
+const embed = async (text) => TOPICS.map(topic => (text.toLowerCase().includes(topic) ? 1 : 0));
+describe('rankMemories', () => {
+    it('returns the memories that match by meaning, best first, above the floor', async () => {
+        const ranked = await rankMemories('add exponential backoff to a flaky network call', memories, embed);
+        expect(ranked.map(m => [m.key, m.match])).toEqual([['retry_policy', 'semantic']]);
+    });
+    it('returns nothing rather than the closest weak match', async () => {
+        expect(await rankMemories('rename a css class', memories, embed)).toEqual([]);
+    });
+    it('falls back to keyword overlap when the model is unavailable, and says so', async () => {
+        const ranked = await rankMemories('replica reports', memories, async () => []);
+        expect(ranked.map(m => [m.key, m.match])).toEqual([['db_access', 'keyword']]);
+    });
+    it(`returns at most ${RECALL_LIMIT}`, async () => {
+        const many = Array.from({ length: 10 }, (_, i) => ({ scope: 'repo', key: `retry_${i}`, value: 'network retry backoff' }));
+        expect(await rankMemories('network retry backoff', many, embed)).toHaveLength(RECALL_LIMIT);
+    });
+    it('embeds each text once, not on every recall', async () => {
+        let calls = 0;
+        const counting = async (text) => { calls++; return embed(text); };
+        const fresh = memories.map(m => ({ ...m, value: `${m.value} (cache test)` }));
+        await rankMemories('network retry', fresh, counting);
+        const first = calls;
+        await rankMemories('replica reports', fresh, counting);
+        expect(calls - first).toBe(1); // only the new query
+    });
+});