@rigour-labs/core 6.5.3 → 6.6.0

package/dist/firewall/attestation.js

@@ -2,18 +2,18 @@
  * Signed attestation bundles for completed transactions.
  * Keys prefer env / home directory — not agent-writable workspace keys for CI admit.
  */
-import { createHash, createHmac, randomBytes } from 'crypto';
+import { createHash, createHmac, randomBytes, timingSafeEqual } from 'crypto';
 import fs from 'fs-extra';
-import os from 'os';
 import path from 'path';
 import { execa } from 'execa';
+import { rigourUserDir } from '../utils/user-state.js';
 const KEY_FILE = 'attestation.key';
 export async function resolveAttestationKey(cwd) {
     const envKey = process.env.RIGOUR_ATTESTATION_KEY;
     if (envKey && envKey.length >= 32) {
         return { key: Buffer.from(envKey, 'utf8'), source: 'env' };
     }
-    const homeKeyPath = path.join(os.homedir(), '.rigour', KEY_FILE);
+    const homeKeyPath = path.join(rigourUserDir(), KEY_FILE);
     if (await fs.pathExists(homeKeyPath)) {
         return { key: await fs.readFile(homeKeyPath), source: 'home' };
     }
@@ -22,7 +22,7 @@ export async function resolveAttestationKey(cwd) {
         return { key: await fs.readFile(workspaceKeyPath), source: 'workspace' };
     }
     // Create home key by default (outside agent workspace)
-    await fs.ensureDir(path.join(os.homedir(), '.rigour'));
+    await fs.ensureDir(rigourUserDir());
     const key = randomBytes(32);
     await fs.writeFile(homeKeyPath, key, { mode: 0o600 });
     return { key, source: 'home' };
@@ -130,10 +130,11 @@ export async function createAttestation(cwd, input) {
 export async function verifyAttestation(cwd, bundle) {
     const { key } = await resolveAttestationKey(cwd);
     const { signature, signedAt, ...rest } = bundle;
-    const expected = createHmac('sha256', key)
+    const expected = Buffer.from(createHmac('sha256', key)
         .update(payloadForSign(rest) + signedAt)
-        .digest('hex');
-    return expected === signature;
+        .digest('hex'));
+    const given = Buffer.from(String(signature ?? ''));
+    return expected.length === given.length && timingSafeEqual(expected, given);
 }
 export async function loadLatestAttestation(cwd) {
     const p = path.join(cwd, '.rigour', 'attestation-latest.json');
@@ -147,9 +148,12 @@ export async function loadLatestAttestation(cwd) {
     }
 }
 /**
- * CI admission: valid signature, PASS gates, bound commit/tree, fresh, non-workspace-key unless allowed.
+ * CI admission. Admits only a bundle that is signed with a key outside the workspace, records PASS
+ * gates, is fresh, is bound to this checkout (commit or tree, and at least one must be present and
+ * match), whose artifact digest recomputes from the files here, and, when the caller names the
+ * policy it requires, was produced under that policy.
  */
-export async function admitForCi(cwd) {
+export async function admitForCi(cwd, options = {}) {
     const { source } = await resolveAttestationKey(cwd);
     if (source === 'workspace' && process.env.RIGOUR_ALLOW_WORKSPACE_ATTESTATION_KEY !== '1') {
         return {
@@ -168,30 +172,47 @@ export async function admitForCi(cwd) {
     if (bundle.gateResults.status !== 'PASS') {
         return { admit: false, reason: `Gates not PASS (${bundle.gateResults.status})` };
     }
-    if (!bundle.treeDigest && (!bundle.filesUsed || bundle.filesUsed.length === 0)) {
-        return { admit: false, reason: 'Attestation missing treeDigest and filesUsed' };
-    }
-    if (!bundle.artifactDigest || bundle.artifactDigest.length < 16) {
-        return { admit: false, reason: 'Attestation artifactDigest missing or trivial' };
+    const requiredPolicy = options.policyHash ?? process.env.RIGOUR_REQUIRED_POLICY_HASH;
+    if (requiredPolicy && bundle.policyHash !== requiredPolicy) {
+        return { admit: false, reason: `Attestation policy ${bundle.policyHash} is not the required ${requiredPolicy}` };
     }
     const maxAgeMs = Number(process.env.RIGOUR_ATTESTATION_MAX_AGE_MS || 24 * 60 * 60 * 1000);
     const age = Date.now() - Date.parse(bundle.signedAt);
     if (!Number.isFinite(age) || age < 0 || age > maxAgeMs) {
         return { admit: false, reason: 'Attestation expired or has invalid signedAt' };
     }
-    const headSha = await getGitCommitSha(cwd);
-    if (bundle.commitSha && headSha && bundle.commitSha !== headSha) {
-        return {
-            admit: false,
-            reason: `Attestation commitSha ${bundle.commitSha.slice(0, 8)}≠ HEAD ${headSha.slice(0, 8)}`,
-        };
+    const binding = await checkBinding(cwd, bundle);
+    if (binding)
+        return { admit: false, reason: binding };
+    if (await recomputeArtifactDigest(cwd, bundle) !== bundle.artifactDigest) {
+        return { admit: false, reason: 'Attestation artifactDigest does not match the files in this checkout' };
     }
-    const headTree = await getGitTreeDigest(cwd);
-    if (bundle.treeDigest && headTree && bundle.treeDigest !== headTree) {
-        return {
-            admit: false,
-            reason: `Attestation treeDigest mismatch vs HEAD tree`,
-        };
-    }
-    return { admit: true, reason: 'Valid attestation with PASS gates and bound tree/commit' };
+    return { admit: true, reason: 'Valid attestation with PASS gates, bound to this checkout, artifacts verified' };
+}
+/** Why the bundle is not bound to this checkout, or null when it is. A bundle bound to nothing is refused. */
+async function checkBinding(cwd, bundle) {
+    if (!bundle.commitSha && !bundle.treeDigest)
+        return 'Attestation is bound to no commit or tree';
+    const [headSha, headTree] = await Promise.all([getGitCommitSha(cwd), getGitTreeDigest(cwd)]);
+    if (bundle.commitSha && bundle.commitSha !== headSha) {
+        return `Attestation commitSha ${bundle.commitSha.slice(0, 8)} is not HEAD ${(headSha ?? 'none').slice(0, 8)}`;
+    }
+    if (bundle.treeDigest && bundle.treeDigest !== headTree)
+        return 'Attestation treeDigest mismatch vs HEAD tree';
+    return null;
+}
+/** The digest createAttestation would compute for this checkout: the named files' contents, or the tree. */
+async function recomputeArtifactDigest(cwd, bundle) {
+    const files = bundle.filesUsed ?? [];
+    if (files.length === 0)
+        return createHash('sha256').update(`tree:${bundle.treeDigest ?? ''}`).digest('hex');
+    const contents = new Map();
+    for (const f of files) {
+        const abs = path.resolve(cwd, f);
+        if (!abs.startsWith(path.resolve(cwd) + path.sep))
+            continue; // never read outside the checkout
+        if (await fs.pathExists(abs))
+            contents.set(f, await fs.readFile(abs, 'utf-8'));
+    }
+    return computeArtifactDigest(files, contents);
 }

package/dist/firewall/execution-receipt.d.ts

@@ -1,4 +1,9 @@
 import type { ExecutionReceipt } from './types.js';
+/**
+ * Another append holds the lock. On Windows, creating a file another process is still deleting
+ * fails with EPERM (or EACCES/EBUSY) rather than EEXIST; elsewhere those are real permission errors.
+ */
+export declare function isLockContention(code: unknown, platform?: NodeJS.Platform): boolean;
 export declare function appendExecutionReceipt(cwd: string, input: Omit<ExecutionReceipt, 'version' | 'id' | 'repositoryId' | 'createdAt' | 'previousReceipt' | 'digest' | 'signature'>, controlRoot?: string): Promise<ExecutionReceipt>;
 export declare function listExecutionReceipts(cwd: string, limit?: number, controlRoot?: string): Promise<ExecutionReceipt[]>;
 export declare function verifyExecutionReceiptChain(cwd: string, controlRoot?: string): Promise<{

package/dist/firewall/execution-receipt.js

@@ -17,6 +17,15 @@ async function receiptKey(cwd, controlRoot) {
     await fs.writeFile(keyPath, key, { mode: 0o600 });
     return key;
 }
+/**
+ * Another append holds the lock. On Windows, creating a file another process is still deleting
+ * fails with EPERM (or EACCES/EBUSY) rather than EEXIST; elsewhere those are real permission errors.
+ */
+export function isLockContention(code, platform = process.platform) {
+    if (code === 'EEXIST')
+        return true;
+    return platform === 'win32' && (code === 'EPERM' || code === 'EACCES' || code === 'EBUSY');
+}
 async function acquireReceiptLock(logPath) {
     const lockPath = `${logPath}.append-lock`;
     for (let attempt = 0; attempt < 100; attempt += 1) {
@@ -24,7 +33,7 @@ async function acquireReceiptLock(logPath) {
             return await fs.promises.open(lockPath, 'wx', 0o600);
         }
         catch (error) {
-            if (error?.code !== 'EEXIST')
+            if (!isLockContention(error?.code))
                 throw error;
             await delay(10);
         }

package/dist/firewall/trust-boundaries.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/firewall/trust-boundaries.test.js

@@ -0,0 +1,64 @@
+import { execFileSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { issueArbitrationToken, signArbitrationDecision, verifyArbitrationDecision } from './arbitration-token.js';
+import { admitForCi, createAttestation } from './attestation.js';
+let repo;
+const git = (...args) => execFileSync('git', ['-C', repo, ...args], { encoding: 'utf8' });
+beforeEach(() => {
+    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'trust-'));
+    git('init', '-q', '-b', 'main');
+    git('config', 'user.email', 't@example.com');
+    git('config', 'user.name', 't');
+    git('config', 'commit.gpgsign', 'false');
+    fs.writeFileSync(path.join(repo, 'a.ts'), 'export const a = 1;\n');
+    git('add', '-A');
+    git('commit', '-qm', 'init');
+});
+afterEach(() => fs.rmSync(repo, { recursive: true, force: true }));
+describe('human arbitration', () => {
+    it('accepts only a decision signed with the issued token, once', async () => {
+        const token = await issueArbitrationToken(repo, 'r1');
+        expect(fs.existsSync(path.join(repo, '.rigour', 'arbitration-tokens.json'))).toBe(false);
+        // A line any process can append to the event log carries no valid proof.
+        expect(verifyArbitrationDecision(token, 'r1', 'approve', undefined)).toBe(false);
+        expect(verifyArbitrationDecision(token, 'r1', 'approve', 'f'.repeat(64))).toBe(false);
+        const proof = await signArbitrationDecision(repo, 'r1', 'approve');
+        expect(verifyArbitrationDecision(token, 'r1', 'approve', proof)).toBe(true);
+        expect(verifyArbitrationDecision(token, 'r1', 'reject', proof)).toBe(false);
+        expect(await signArbitrationDecision(repo, 'r1', 'approve')).toBeNull();
+    });
+});
+describe('CI admission', () => {
+    const tx = (over = {}) => ({
+        id: 'tx1', agentId: 'agent', scope: ['**/*'], policyHash: 'policy-a', capabilitiesIssued: [], filesChanged: ['a.ts'], ...over,
+    });
+    const pass = { status: 'PASS', failedGates: [] };
+    it('admits a fresh, bound bundle whose files are unchanged', async () => {
+        await createAttestation(repo, { transaction: tx(), gateResults: pass });
+        expect(await admitForCi(repo)).toMatchObject({ admit: true });
+    });
+    it('refuses when an attested file differs from what was signed, even at the same commit', async () => {
+        await createAttestation(repo, { transaction: tx(), gateResults: pass });
+        fs.writeFileSync(path.join(repo, 'a.ts'), 'export const a = 2;\n'); // HEAD and its tree are unchanged
+        expect(await admitForCi(repo)).toMatchObject({ admit: false, reason: expect.stringContaining('artifactDigest') });
+    });
+    it('refuses a bundle produced under another policy than the one required', async () => {
+        await createAttestation(repo, { transaction: tx(), gateResults: pass });
+        expect(await admitForCi(repo, { policyHash: 'policy-b' })).toMatchObject({ admit: false });
+        expect(await admitForCi(repo, { policyHash: 'policy-a' })).toMatchObject({ admit: true });
+    });
+    it('refuses a bundle bound to no commit or tree', async () => {
+        const noRepo = fs.mkdtempSync(path.join(os.tmpdir(), 'trust-norepo-'));
+        try {
+            fs.writeFileSync(path.join(noRepo, 'a.ts'), 'export const a = 1;\n');
+            await createAttestation(noRepo, { transaction: tx(), gateResults: pass });
+            expect(await admitForCi(noRepo)).toMatchObject({ admit: false, reason: 'Attestation is bound to no commit or tree' });
+        }
+        finally {
+            fs.rmSync(noRepo, { recursive: true, force: true });
+        }
+    });
+});

package/dist/firewall/trusted-control.test.js

@@ -176,3 +176,13 @@ describe('action normalization and receipts', () => {
         expect(await verifyExecutionReceiptChain(cwd, root)).toMatchObject({ valid: true, count: 1 });
     });
 });
+describe('receipt lock contention', () => {
+    it('retries while another append releases the lock, including Windows delete-pending errors', async () => {
+        const { isLockContention } = await import('./execution-receipt.js');
+        expect(isLockContention('EEXIST', 'linux')).toBe(true);
+        expect(isLockContention('EPERM', 'win32')).toBe(true);
+        expect(isLockContention('EBUSY', 'win32')).toBe(true);
+        expect(isLockContention('EPERM', 'linux')).toBe(false); // a real permission error elsewhere
+        expect(isLockContention('ENOENT', 'win32')).toBe(false);
+    });
+});

package/dist/gates/deep-analysis.d.ts

@@ -15,6 +15,7 @@ import { Gate, GateContext } from './base.js';
 import { Failure, Provenance, DeepOptions } from '../types/index.js';
 import type { InferenceUsage } from '../inference/types.js';
 import { type RouterPolicy, type RouterStats } from '../deep/router.js';
+import { reviewedKeys } from '../review/ledger.js';
 import { type LessonMode } from '../review-learning/team-lessons.js';
 export interface DeepGateConfig {
     options: DeepOptions;
@@ -88,3 +89,8 @@ export declare class DeepAnalysisGate extends Gate {
 /** Per-call options; unset config falls back to per-provider defaults. */
 /** Per-call inference timeout: a local 7B reads a file with its reference pack far slower than the small tiers. */
 export declare function defaultTimeout(options: DeepOptions): number;
+/**
+ * Functions the router may skip as already reviewed: what agents recorded (the ledger and
+ * reviewed.json), unless the run is independent, as an enforcing check is.
+ */
+export declare function trustedReviews(cwd: string, options: Pick<DeepOptions, 'independent'>): ReturnType<typeof reviewedKeys>;

package/dist/gates/deep-analysis.js

@@ -179,7 +179,7 @@ export class DeepAnalysisGate extends Gate {
         const { options } = this.config;
         if (!isCloud(options) || this.config.router?.enabled === false || !options.focusLines)
             return facts;
-        const routed = routeFiles(cwd, facts.map(f => f.path), options.focusLines, options.removedLines, this.config.router, reviewedKeys(cwd));
+        const routed = routeFiles(cwd, facts.map(f => f.path), options.focusLines, options.removedLines, this.config.router, trustedReviews(cwd, options));
         this.outcome.router = routed.stats;
         if (routed.stats.files_skipped > 0) {
             this.config.onProgress?.(`  Router: ${routed.stats.routed} of ${routed.stats.functions} changed function(s) to the model; ${routed.stats.files_skipped} file(s) left to the gates.`);
@@ -302,3 +302,10 @@ async function withTimeout(promise, ms, message) {
         clearTimeout(timer);
     }
 }
+/**
+ * Functions the router may skip as already reviewed: what agents recorded (the ledger and
+ * reviewed.json), unless the run is independent, as an enforcing check is.
+ */
+export function trustedReviews(cwd, options) {
+    return options.independent ? [] : reviewedKeys(cwd);
+}

package/dist/gates/trusted-reviews.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/trusted-reviews.test.js

@@ -0,0 +1,16 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { trustedReviews } from './deep-analysis.js';
+let cwd;
+afterEach(() => fs.rmSync(cwd, { recursive: true, force: true }));
+describe('trustedReviews', () => {
+    it('lets a normal run skip what agents recorded as reviewed, and an independent run skip nothing', () => {
+        cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'trusted-reviews-'));
+        fs.mkdirSync(path.join(cwd, '.rigour'));
+        fs.writeFileSync(path.join(cwd, '.rigour', 'reviewed.json'), JSON.stringify({ version: 1, entries: [{ file: 'src/a.ts', function: 'f', hash: 'h', reviewer: 'agent', verdict: 'no_issue' }] }));
+        expect(trustedReviews(cwd, {}).map(r => r.function)).toEqual(['f']);
+        expect(trustedReviews(cwd, { independent: true })).toEqual([]);
+    });
+});

package/dist/hooks/checker.js

@@ -110,6 +110,11 @@ export async function runHookChecker(options) {
             if (!resolved) {
                 continue;
             }
+            // Before ignore patterns: rigour.yml commonly ignores .rigour/ for scanning, not for writes.
+            if (isRigourState(resolved.relPath)) {
+                failures.push(rigourStateFailure(resolved.relPath));
+                continue;
+            }
             // Respect rigour.yml ignore patterns
             if (isIgnored(resolved.relPath, ignorePatterns)) {
                 continue;
@@ -244,6 +249,24 @@ function checkSecurityPatterns(lines, relPath, failures) {
         checkHardcodedSecrets(line, i, relPath, isTestFile, failures);
         checkCommandInjection(line, i, relPath, failures);
     }
+    if (!isTestFile)
+        checkVendorKeys(lines.join('\n'), relPath, failures);
+}
+/** Credential formats a vendor issues: unambiguous in code, unlike entropy or variable-name guesses. */
+const VENDOR_KEYS = new Set(['aws_access_key', 'openai_key', 'anthropic_key', 'github_token', 'stripe_key', 'slack_token', 'sendgrid_key', 'private_key', 'private_key_full']);
+/** A real vendor key written into code, whatever the variable is called. */
+function checkVendorKeys(content, relPath, failures) {
+    for (const detection of scanInputForCredentials(content).detections) {
+        if (!VENDOR_KEYS.has(detection.type) || !detection.position)
+            continue;
+        const raw = content.slice(detection.position.start, detection.position.end);
+        if (/^pk_|_test_/.test(raw))
+            continue; // publishable and test keys are meant to be shared
+        const line = content.slice(0, detection.position.start).split('\n').length;
+        if (failures.some(f => f.gate === 'security-patterns' && f.line === line))
+            continue;
+        failures.push({ gate: 'security-patterns', file: relPath, message: `${detection.description} in code`, severity: 'critical', line });
+    }
 }
 function checkHardcodedSecrets(line, i, relPath, isTestFile, failures) {
     if (isTestFile) {
@@ -270,6 +293,23 @@ function checkCommandInjection(line, i, relPath, failures) {
         });
     }
 }
+// ── Rigour's own state (always on) ────────────────────────────────
+/**
+ * .rigour/ holds what decides a review: dismissals, check outcomes, learned rules, the review
+ * ledger, operator scopes. Rigour writes it through its own commands and tools, never through
+ * the agent's edit tool, so an agent edit there is refused whatever rigour.yml says.
+ */
+function isRigourState(relPath) {
+    return relPath.replace(/\\/g, '/').startsWith('.rigour/');
+}
+function rigourStateFailure(relPath) {
+    return {
+        gate: 'file-guard',
+        file: relPath,
+        message: `BLOCKED: "${relPath}" is Rigour's own state. Change it with Rigour's commands (rigour dismiss, rigour_review_ack, rigour_remember), not by editing the file.`,
+        severity: 'critical',
+    };
+}
 // ── Protected Paths Enforcement (real-time) ───────────────────────
 /**
  * Block writes to protected paths defined in rigour.yml safety.protected_paths.

package/dist/hooks/checker.test.js

@@ -43,6 +43,24 @@ describe('runHookChecker', () => {
         const optedIn = await runHookChecker({ cwd: testDir, files: [filePath] });
         expect(optedIn.failures.some(f => f.gate === 'governance')).toBe(true);
     });
+    it("refuses an agent edit to Rigour's own state, even when rigour.yml ignores .rigour/", async () => {
+        fs.writeFileSync(path.join(testDir, 'rigour.yml'), 'version: 1\nignore:\n  - ".rigour/**"\n');
+        fs.mkdirSync(path.join(testDir, '.rigour'), { recursive: true });
+        fs.writeFileSync(path.join(testDir, '.rigour', 'dismissed.json'), '{"version":1,"entries":[]}');
+        const result = await runHookChecker({ cwd: testDir, files: ['.rigour/dismissed.json'] });
+        expect(result.status).toBe('fail');
+        expect(result.failures[0]).toMatchObject({ gate: 'file-guard', severity: 'critical' });
+    });
+    it('catches a real vendor key whatever it is named, and leaves publishable and test keys alone', async () => {
+        // Built at runtime: a key-shaped literal in this source would be (rightly) refused by secret scanning.
+        const fake = (prefix) => `${prefix}_${'51HxQ'}${'abcdefghijklmnopqrstuv'}`;
+        fs.writeFileSync(path.join(testDir, 'pay.ts'), `export const stripe = {\n  value: "${fake('sk_live')}",\n};\n`);
+        fs.writeFileSync(path.join(testDir, 'public.ts'), `export const key = "${fake('pk_live')}";\nexport const t = "${fake('sk_test')}";\n`);
+        const leaked = await runHookChecker({ cwd: testDir, files: ['pay.ts'] });
+        expect(leaked.failures).toEqual([expect.objectContaining({ gate: 'security-patterns', line: 2, severity: 'critical', message: 'Stripe API key detected in code' })]);
+        const fine = await runHookChecker({ cwd: testDir, files: ['public.ts'] });
+        expect(fine.failures.filter(f => f.gate === 'security-patterns')).toEqual([]);
+    });
     it('should detect file size violations', async () => {
         const filePath = path.join(testDir, 'big.ts');
         const lines = Array.from({ length: 100 }, (_, i) => `export const v${i} = ${i};`);

package/dist/hooks/index.d.ts

@@ -16,3 +16,4 @@ export { generateDLPHookFiles } from './dlp-templates.js';
 export type { GeneratedDLPHookFile } from './dlp-templates.js';
 export { stopReview, stopMessage, blocksStop, STOP_MAX_ATTEMPTS } from './stop-review.js';
 export type { StopDecision } from './stop-review.js';
+export { recordSessionBaseline, sessionBaseline, nextStopAttempt, clearStopAttempts } from './session-state.js';

package/dist/hooks/index.js

@@ -11,3 +11,4 @@ export { recordDLPFeedback, allowLastDLPBlock, writeDLPBlockManifest, getLearned
 export { generateDLPHookFiles } from './dlp-templates.js';
 // Stop review ("before you say done")
 export { stopReview, stopMessage, blocksStop, STOP_MAX_ATTEMPTS } from './stop-review.js';
+export { recordSessionBaseline, sessionBaseline, nextStopAttempt, clearStopAttempts } from './session-state.js';

package/dist/hooks/session-state.d.ts

@@ -0,0 +1,8 @@
+/** Record where the session started, once; later calls keep the first commit. */
+export declare function recordSessionBaseline(cwd: string, session: string): void;
+/** The commit the session started from, if it is still in history (a rebase can drop it). */
+export declare function sessionBaseline(cwd: string, session: string): string | undefined;
+/** This stop's attempt number: blocks so far plus one. */
+export declare function nextStopAttempt(cwd: string, session: string): number;
+/** The agent finished cleanly: the next stop starts counting again. The baseline stays. */
+export declare function clearStopAttempts(cwd: string, session: string): void;

package/dist/hooks/session-state.js

@@ -0,0 +1,61 @@
+/**
+ * What the agent hooks remember per session, kept outside the workspace (utils/user-state.ts)
+ * so the agent being reviewed cannot rewrite it:
+ *   - baseline: the commit HEAD was at when the session first edited a file. The stop review
+ *     covers everything since then, so committing mid-session hides nothing.
+ *   - attempts: how many times the stop review has blocked this session.
+ */
+import { spawnSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+import { repoStateDir } from '../utils/user-state.js';
+/** Sessions untouched this long are forgotten, so the store stays small. */
+const SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+function storePath(cwd) {
+    return path.join(repoStateDir(cwd), 'sessions.json');
+}
+function readStore(cwd) {
+    try {
+        return JSON.parse(fs.readFileSync(storePath(cwd), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+function update(cwd, session, change) {
+    const store = readStore(cwd);
+    const now = Date.now();
+    for (const [id, entry] of Object.entries(store))
+        if (now - entry.at > SESSION_TTL_MS)
+            delete store[id];
+    store[session] = { ...change(store[session] ?? { at: now }), at: now };
+    fs.mkdirSync(path.dirname(storePath(cwd)), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(storePath(cwd), JSON.stringify(store), { mode: 0o600 });
+    return store[session];
+}
+/** Record where the session started, once; later calls keep the first commit. */
+export function recordSessionBaseline(cwd, session) {
+    if (!session || readStore(cwd)[session]?.baseline)
+        return;
+    const head = spawnSync('git', ['rev-parse', '--verify', '--quiet', 'HEAD'], { cwd, encoding: 'utf8' });
+    if (head.status !== 0)
+        return; // no commits yet: the working-tree review already covers everything
+    update(cwd, session, entry => ({ ...entry, baseline: head.stdout.trim() }));
+}
+/** The commit the session started from, if it is still in history (a rebase can drop it). */
+export function sessionBaseline(cwd, session) {
+    const baseline = readStore(cwd)[session]?.baseline;
+    if (!baseline)
+        return undefined;
+    const known = spawnSync('git', ['cat-file', '-e', `${baseline}^{commit}`], { cwd });
+    return known.status === 0 ? baseline : undefined;
+}
+/** This stop's attempt number: blocks so far plus one. */
+export function nextStopAttempt(cwd, session) {
+    return update(cwd, session, entry => ({ ...entry, attempts: (entry.attempts ?? 0) + 1 })).attempts ?? 1;
+}
+/** The agent finished cleanly: the next stop starts counting again. The baseline stays. */
+export function clearStopAttempts(cwd, session) {
+    if (readStore(cwd)[session]?.attempts)
+        update(cwd, session, entry => ({ ...entry, attempts: 0 }));
+}

package/dist/hooks/stop-review.d.ts

@@ -1,7 +1,8 @@
 /**
- * The "before you say done" review: when an agent is about to stop, review the
- * uncommitted change and, if it introduced serious findings, tell the agent
- * what to fix instead of letting it finish.
+ * The "before you say done" review: when an agent is about to stop, review what
+ * the session changed (since its baseline commit, or the uncommitted change when
+ * none was recorded) and, if it introduced serious findings, tell the agent what
+ * to fix instead of letting it finish.
  *
  * Only findings that deserve it block: critical ones, and high ones that are
  * proven (the semantic engine traced them) or security findings. A high
@@ -20,7 +21,8 @@ export interface StopDecision {
     findings: Failure[];
     reviewedFiles: string[];
 }
-export declare function stopReview(cwd: string, config: Config, attempt: number): Promise<StopDecision>;
+/** `since`: the session's baseline commit (session-state.ts); committing after it hides nothing. */
+export declare function stopReview(cwd: string, config: Config, attempt: number, since?: string): Promise<StopDecision>;
 export declare function reviewAckMessage(items: ReviewTaskItem[], attempt: number): string;
 /** Critical, or high and either proven by the semantic engine or a security finding. */
 export declare function blocksStop(finding: Failure): boolean;

package/dist/hooks/stop-review.js

@@ -3,9 +3,11 @@ import { buildReviewTask } from '../review/review-task.js';
 import { diffFromGit } from '../review/git-diff.js';
 export const STOP_MAX_ATTEMPTS = 3;
 const MAX_LISTED = 8;
-export async function stopReview(cwd, config, attempt) {
-    const diff = diffFromGit(cwd, { mode: 'working' });
-    const result = await reviewChange({ cwd, config, diff });
+/** `since`: the session's baseline commit (session-state.ts); committing after it hides nothing. */
+export async function stopReview(cwd, config, attempt, since) {
+    const source = since ? { mode: 'since', commit: since } : { mode: 'working' };
+    const diff = diffFromGit(cwd, source);
+    const result = await reviewChange({ cwd, config, diff, source });
     const blocking = result.findings.filter(blocksStop);
     const unreviewed = config.hooks?.require_review_ack ? buildReviewTask(cwd, diff, config.gates.deep?.router).items : [];
     const reviewed = { findings: result.findings, reviewedFiles: Object.keys(result.changedLines) };

package/dist/hooks/templates.js

@@ -47,7 +47,7 @@ function generateClaudeHooks(checkerCommand) {
                     hooks: [
                         {
                             type: "command",
-                            command: `${checkerCommand} --files "$TOOL_INPUT_file_path"`,
+                            command: `${checkerCommand} --stdin`,
                         }
                     ]
                 }

package/dist/index.d.ts

@@ -11,8 +11,10 @@ export { FrontendSecretExposureGate } from './gates/frontend-secret-exposure.js'
 export * from './utils/logger.js';
 export { normalizeScopePatterns, isScoped } from './utils/scope.js';
 export { deepAnalysisError } from './utils/deep-status.js';
+export { rigourUserDir, repoStateDir } from './utils/user-state.js';
 export { reviewChange, toReviewFinding, type ReviewInput, type ReviewResult, type ReviewFinding } from './review/review.js';
 export { splitByChangedLines, type ChangedLineSplit } from './review/changed-lines.js';
+export { isControlFile, mergeBaseOf, readStateFile } from './review/trusted-state.js';
 export { dismissFinding, dismissedKeys, findingKey, isProven, quietSplit, DISMISSED_FILE } from './review/quiet.js';
 export { isGeneratedFile } from './review/generated-files.js';
 export { countUsage, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, telemetryToken, trackUsage } from './telemetry/telemetry.js';
@@ -27,8 +29,10 @@ export { readLessons, writeLessons, promoteLesson, matchLessons, lessonText, les
 export { lessonsForDiff, lessonsSection, type LessonMode } from './review-learning/team-lessons.js';
 export { readRepoRules, rulesForDiff, rulesSection, splitRules, type RepoRule } from './review-learning/repo-rules.js';
 export { diffFromGit, GitDiffError, type DiffSource } from './review/git-diff.js';
-export { checkPrecisions, checkId, precisionOf, isMuted, MUTE_MIN_OUTCOMES, MUTE_BELOW, type CheckPrecision, type CheckOutcome } from './review/check-outcomes.js';
-export { recordReviewOutcome, listResolvedFixes, removeResolvedFix, openFindingCount, type ResolvedFix, type FixCapture } from './review/agent-fixes.js';
+export { checkPrecisions, checkId, precisionOf, isMuted, readOutcomes, MUTE_MIN_OUTCOMES, MUTE_BELOW, type CheckPrecision, type CheckOutcome } from './review/check-outcomes.js';
+export { recordReviewOutcome, listResolvedFixes, removeResolvedFix, openFindingCount, listOpenFindings, type ResolvedFix, type FixCapture } from './review/agent-fixes.js';
+export { appendStory, readStories, compactDiff, STORIES_FILE, type Story, type CatchStage } from './review/stories.js';
+export { recordLessonsServed, recordPrCatches, recordReuseSuggested, type LessonChannel } from './review/learning-events.js';
 export { computeEffectiveness, readAgentEvents, appendAgentEvent, findingKeys, type AgentEvent, type ReviewEffectiveness } from './review/effectiveness.js';
 export { parseDiff, changedLinesByFile } from './utils/diff.js';
 export { FileScanner } from './utils/scanner.js';
@@ -44,6 +48,7 @@ export { isModelCached, getModelsDir, getModelInfo, getCachedModel, ensureModel
 export { installLlamaEngine, probeBinary, managedEnginePath, LLAMA_RELEASE_TAG } from './inference/llama-engine.js';
 export { SidecarProvider } from './inference/sidecar-provider.js';
 export { extractFacts, factsToPromptString } from './deep/fact-extractor.js';
+export { cleanContextCache, deadCacheRows, type CacheCleanupReport } from './storage/index.js';
 export { openDatabase, isSQLiteAvailable, compactDatabase, getDatabaseSize, resetDatabase, insertScan, insertFindings, getRecentScans, getScoreTrendFromDB, getTopIssues, reinforcePattern, getStrongPatterns } from './storage/index.js';
 export type { RigourDB, CompactResult } from './storage/index.js';
 export { checkLocalPatterns, persistAndReinforce, getProjectStats } from './storage/index.js';

package/dist/index.js

@@ -11,8 +11,10 @@ export { FrontendSecretExposureGate } from './gates/frontend-secret-exposure.js'
 export * from './utils/logger.js';
 export { normalizeScopePatterns, isScoped } from './utils/scope.js';
 export { deepAnalysisError } from './utils/deep-status.js';
+export { rigourUserDir, repoStateDir } from './utils/user-state.js';
 export { reviewChange, toReviewFinding } from './review/review.js';
 export { splitByChangedLines } from './review/changed-lines.js';
+export { isControlFile, mergeBaseOf, readStateFile } from './review/trusted-state.js';
 export { dismissFinding, dismissedKeys, findingKey, isProven, quietSplit, DISMISSED_FILE } from './review/quiet.js';
 export { isGeneratedFile } from './review/generated-files.js';
 export { countUsage, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, telemetryToken, trackUsage } from './telemetry/telemetry.js';
@@ -27,8 +29,10 @@ export { readLessons, writeLessons, promoteLesson, matchLessons, lessonText, les
 export { lessonsForDiff, lessonsSection } from './review-learning/team-lessons.js';
 export { readRepoRules, rulesForDiff, rulesSection, splitRules } from './review-learning/repo-rules.js';
 export { diffFromGit, GitDiffError } from './review/git-diff.js';
-export { checkPrecisions, checkId, precisionOf, isMuted, MUTE_MIN_OUTCOMES, MUTE_BELOW } from './review/check-outcomes.js';
-export { recordReviewOutcome, listResolvedFixes, removeResolvedFix, openFindingCount } from './review/agent-fixes.js';
+export { checkPrecisions, checkId, precisionOf, isMuted, readOutcomes, MUTE_MIN_OUTCOMES, MUTE_BELOW } from './review/check-outcomes.js';
+export { recordReviewOutcome, listResolvedFixes, removeResolvedFix, openFindingCount, listOpenFindings } from './review/agent-fixes.js';
+export { appendStory, readStories, compactDiff, STORIES_FILE } from './review/stories.js';
+export { recordLessonsServed, recordPrCatches, recordReuseSuggested } from './review/learning-events.js';
 export { computeEffectiveness, readAgentEvents, appendAgentEvent, findingKeys } from './review/effectiveness.js';
 export { parseDiff, changedLinesByFile } from './utils/diff.js';
 export { FileScanner } from './utils/scanner.js';
@@ -45,6 +49,7 @@ export { installLlamaEngine, probeBinary, managedEnginePath, LLAMA_RELEASE_TAG }
 export { SidecarProvider } from './inference/sidecar-provider.js';
 export { extractFacts, factsToPromptString } from './deep/fact-extractor.js';
 // Storage (SQLite Brain)
+export { cleanContextCache, deadCacheRows } from './storage/index.js';
 export { openDatabase, isSQLiteAvailable, compactDatabase, getDatabaseSize, resetDatabase, insertScan, insertFindings, getRecentScans, getScoreTrendFromDB, getTopIssues, reinforcePattern, getStrongPatterns } from './storage/index.js';
 // Local Project Memory (hybrid intelligence — SQLite-backed per-project learning)
 export { checkLocalPatterns, persistAndReinforce, getProjectStats } from './storage/index.js';