@rigour-labs/core 6.6.2 → 6.6.4

package/dist/review/unused-exports.js

@@ -0,0 +1,189 @@
+/**
+ * Unused export: an export the change adds that no other file names.
+ *
+ * Linters skip exports (no-unused-vars only sees module scope) and type checkers accept them, so
+ * dead exports pile up in agent-written code. Only exports on added lines are checked. Another
+ * file uses an export when it names the symbol as a whole word AND points at the module: an import,
+ * re-export, dynamic import or mock whose specifier ends in the module's name (its folder's, for an
+ * index file). A same-named word elsewhere, such as an unrelated route parameter, is not a use. What a framework calls by convention
+ * (SvelteKit and Next.js route modules, hooks, serverless functions) is never reported.
+ */
+import { spawnSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+import { emitsDeclarations, isPackageEntry } from './package-layout.js';
+const GIT_TIMEOUT_MS = 10_000;
+const CODE = /\.(ts|tsx|js|jsx|mjs|svelte)$/;
+const SKIPPED = /\.(test|spec)\.|\.d\.ts$|(^|\/)(dist|build|out|coverage|\.next|[\w-]+-dist)\//;
+/** What a route or hook module exports for its framework, not for an importer. */
+const FRAMEWORK_EXPORTS = new Set([
+    'load', 'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', 'HEAD', 'fallback', 'actions',
+    'prerender', 'ssr', 'csr', 'trailingSlash', 'config', 'entries', 'handle', 'handleFetch',
+    'handleError', 'reroute', 'transport', 'init', 'match', 'default',
+    'metadata', 'generateMetadata', 'generateStaticParams', 'generateViewport', 'viewport',
+    'dynamic', 'dynamicParams', 'revalidate', 'fetchCache', 'runtime', 'preferredRegion',
+    'maxDuration', 'middleware', 'proxy',
+]);
+function isRouteModule(file) {
+    return /(^|\/)\+(page|layout|server|error)(\.server)?\.(ts|js)$/.test(file)
+        || /(^|\/)hooks(\.server|\.client)?\.(ts|js)$/.test(file)
+        || /(^|\/)params\/[^/]+\.(ts|js)$/.test(file)
+        || /^netlify\/functions\//.test(file)
+        || /(^|\/)(page|layout|route|loading|error|not-found|template|default|middleware|proxy)\.(ts|tsx|js|jsx)$/.test(file);
+}
+const DECLARATION = /^\s*export\s+(?:declare\s+)?(?:async\s+)?(const|let|var|function\*?|class|type|interface|enum|abstract\s+class)\s+([A-Za-z_$][\w$]*)/;
+const LIST = /^\s*export\s+(?:type\s+)?\{([^}]*)\}\s*(?:;|$)/;
+const RE_EXPORT = /^\s*export\s+(?:type\s+)?\{([^}]*)\}\s*from\s*['"]([^'"]+)['"]/;
+/** Exports on the diff's added lines, with their line in the new file. */
+function addedExports(diff) {
+    const found = [];
+    let file;
+    let line = 0;
+    let previous = '';
+    for (const text of diff.split('\n')) {
+        const header = text.startsWith('+++ ') && previous.startsWith('--- ');
+        previous = text;
+        if (header) {
+            file = text.startsWith('+++ b/') ? text.slice('+++ b/'.length) : undefined;
+            continue;
+        }
+        if (text.startsWith('diff --git ')) {
+            file = undefined;
+            continue;
+        }
+        const hunk = text.match(/^@@ -\d+(?:,\d+)? \+(\d+)/);
+        if (hunk) {
+            line = Number(hunk[1]);
+            continue;
+        }
+        if (!file || text.startsWith('-'))
+            continue;
+        if (text.startsWith('+')) {
+            if (CODE.test(file) && !SKIPPED.test(file))
+                found.push(...exportsOn(text.slice(1), file, line));
+            line++;
+        }
+        else if (text.startsWith(' ')) {
+            line++;
+        }
+    }
+    return found;
+}
+function exportsOn(text, file, line) {
+    const declaration = text.match(DECLARATION);
+    if (declaration)
+        return [{ file, name: declaration[2], line, ...(/^(type|interface)$/.test(declaration[1]) ? { type: true } : {}) }];
+    const reExport = text.match(RE_EXPORT);
+    if (reExport) {
+        const source = reExport[2].startsWith('.') ? path.posix.join(path.posix.dirname(file), reExport[2]) : undefined;
+        return source ? names(reExport[1]).map(name => ({ file, name, line, source })) : []; // a package's export is that package's to judge
+    }
+    const list = text.match(LIST);
+    if (!list || /\bfrom\b/.test(text))
+        return [];
+    return names(list[1]).map(name => ({ file, name, line }));
+}
+/** The exported names in `a, b as c, type D`: what importers would write. */
+function names(list) {
+    return list.split(',')
+        .map(part => part.trim().replace(/^type\s+/, '').split(/\s+as\s+/).pop()?.trim())
+        .filter((name) => !!name && /^[A-Za-z_$][\w$]*$/.test(name));
+}
+const withoutExtension = (file) => path.posix.normalize(file).replace(/\.(ts|tsx|js|jsx|mjs|cjs|svelte)$/, '').replace(/\/index$/, '');
+/** A file that names the export without using it: the exporting file itself, and a re-export's source module. */
+function isOwnFile(user, exp) {
+    const normalized = path.posix.normalize(user);
+    return normalized === path.posix.normalize(exp.file) || (!!exp.source && withoutExtension(normalized) === withoutExtension(exp.source));
+}
+export function unusedExportFailures(cwd, diff, config) {
+    const settings = config.gates.unused_exports;
+    if (!settings?.enabled)
+        return [];
+    const allowed = new Set(settings.allow);
+    const candidates = addedExports(diff).filter(exp => !allowed.has(exp.name) && !(isRouteModule(exp.file) && FRAMEWORK_EXPORTS.has(exp.name))
+        && !isPackageEntry(cwd, exp.file) && !signatureType(cwd, exp));
+    if (candidates.length === 0)
+        return [];
+    const users = filesNaming(cwd, [...new Set(candidates.map(exp => exp.name))], ownOutputs(config));
+    if (!users)
+        return []; // git could not answer: say nothing rather than guess
+    const points = pointsAtCache(cwd);
+    return candidates
+        .filter(exp => ![...(users.get(exp.name) ?? [])].some(user => !isOwnFile(user, exp) && points(user, exp.file)))
+        .map(unused);
+}
+/**
+ * In a project that emits declarations, an exported type named elsewhere in its own file is part
+ * of another export's signature (TypeScript requires it to stay exported); in an application it is not.
+ */
+function signatureType(cwd, exp) {
+    if (!exp.type || !emitsDeclarations(cwd, exp.file))
+        return false;
+    try {
+        const pattern = new RegExp(`\\b${exp.name.replace(/\$/g, '\\$')}\\b`, 'g');
+        return (fs.readFileSync(path.join(cwd, exp.file), 'utf8').match(pattern)?.length ?? 0) > 1;
+    }
+    catch {
+        return false;
+    }
+}
+/** Whether a file names `module` in a specifier: `from './dir/module'`, `import('../module.js')`, `vi.mock('$lib/module')`. */
+function pointsAtCache(cwd) {
+    const texts = new Map();
+    return (file, module) => {
+        const ext = path.posix.extname(module);
+        const stem = path.posix.basename(module, ext);
+        const names = stem === 'index' ? [path.posix.basename(path.posix.dirname(module)), 'index'] : [stem];
+        const escaped = names.map(n => n.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|');
+        const specifier = new RegExp(`['"\`][^'"\`]*/(?:${escaped})(\\.(ts|tsx|js|jsx|mjs|svelte))?['"\`]`);
+        if (!texts.has(file)) {
+            try {
+                texts.set(file, fs.readFileSync(path.join(cwd, file), 'utf8'));
+            }
+            catch {
+                texts.set(file, '');
+            }
+        }
+        return specifier.test(texts.get(file));
+    };
+}
+/** Rigour's own reports name exports and files; they must never count as a use. */
+export function ownOutputs(config) {
+    return ['.rigour', config.output?.report_path ?? 'rigour-report.json', 'rigour-fix-packet.json'];
+}
+/** Names per batch: one git grep over the repository answers them all. */
+const NAMES_PER_SEARCH = 200;
+/**
+ * For each name, the tracked and new (untracked, not ignored) files containing it as a whole word,
+ * Rigour's outputs aside: one `git grep -o` pass per batch of names instead of one per name.
+ */
+function filesNaming(cwd, names, excluded) {
+    const found = new Map();
+    const pathspec = ['.', ...excluded.map(p => `:(exclude)${p}`)];
+    for (let i = 0; i < names.length; i += NAMES_PER_SEARCH) {
+        const patterns = names.slice(i, i + NAMES_PER_SEARCH).flatMap(name => ['-e', name]);
+        const result = spawnSync('git', ['grep', '--untracked', '-z', '-o', '-w', '-F', ...patterns, '--', ...pathspec], { cwd, encoding: 'utf8', timeout: GIT_TIMEOUT_MS, maxBuffer: 256 * 1024 * 1024 });
+        if (result.status === 1)
+            continue;
+        if (result.status !== 0)
+            return undefined;
+        for (const line of result.stdout.split('\n')) {
+            const [file, name] = line.split('\0');
+            if (file && name)
+                found.set(name, (found.get(name) ?? new Set()).add(file));
+        }
+    }
+    return found;
+}
+function unused(exp) {
+    return {
+        id: 'unused-export',
+        title: 'Unused export',
+        details: `\`${exp.name}\` is exported but no other file uses it. An export nothing imports is dead code that readers and agents treat as part of the module's contract.`,
+        severity: 'medium',
+        provenance: 'traditional',
+        files: [exp.file],
+        line: exp.line,
+        hint: `Drop the \`export\` (or the declaration, if nothing in the file uses it either). If a framework or tool loads it by name, add \`${exp.name}\` to gates.unused_exports.allow.`,
+    };
+}

package/dist/settings.js

@@ -1,13 +1,12 @@
-import os from 'os';
 import path from 'path';
+import { rigourUserDir } from './utils/user-state.js';
 import fs from 'fs-extra';
 import { Logger } from './utils/logger.js';
 /**
  * Get the settings file path: ~/.rigour/settings.json
  */
 export function getSettingsPath() {
-    const homeDir = os.homedir();
-    return path.join(homeDir, '.rigour', 'settings.json');
+    return path.join(rigourUserDir(), 'settings.json');
 }
 /**
  * Load settings from ~/.rigour/settings.json

package/dist/storage/db.js

@@ -7,7 +7,6 @@
  * All public APIs are async. Graceful degradation if sqlite3 not installed.
  */
 import path from 'path';
-import os from 'os';
 import fs from 'fs-extra';
 import { createRequire } from 'module';
 import { rigourUserDir } from '../utils/user-state.js';
@@ -27,7 +26,7 @@ function loadSqlite3() {
     const searchPaths = [
         import.meta.url,
         `file://${process.cwd()}/package.json`,
-        `file://${path.join(os.homedir(), '.rigour', 'package.json')}`,
+        `file://${path.join(rigourUserDir(), 'package.json')}`,
     ];
     for (const base of searchPaths) {
         try {

package/dist/storage/team-scope.d.ts

@@ -0,0 +1,20 @@
+/**
+ * What may leave this machine for the configured team.
+ *
+ * One machine often works in repositories of more than one organization (a consultant, an
+ * employee with side projects), and the local outbox holds lessons from all of them. Only lessons
+ * from the team's own repositories are sent; personal lessons stay on the machine unless the team
+ * opts in. Checked when a queued item is about to be sent, so items queued by older versions are
+ * held to the same rule.
+ */
+export interface TeamScope {
+    organizationId: string;
+    /** Repository patterns such as `github.com/acme/*` or `gitlab.com/acme/api`; matched against the origin remote. */
+    repositories?: string[];
+    /** Also send lessons marked personal (default false). */
+    syncPersonal?: boolean;
+}
+/** Whether a repository, by its recorded origin remote, belongs to the team. */
+export declare function repositoryAllowed(canonicalUri: string, scope: TeamScope): boolean;
+/** Why a queued lesson must stay on this machine, or null to send it. */
+export declare function withheldReason(visibility: string, canonicalUri: string | undefined, scope: TeamScope): string | null;

package/dist/storage/team-scope.js

@@ -0,0 +1,32 @@
+/**
+ * What may leave this machine for the configured team.
+ *
+ * One machine often works in repositories of more than one organization (a consultant, an
+ * employee with side projects), and the local outbox holds lessons from all of them. Only lessons
+ * from the team's own repositories are sent; personal lessons stay on the machine unless the team
+ * opts in. Checked when a queued item is about to be sent, so items queued by older versions are
+ * held to the same rule.
+ */
+/** The origin remote as Rigour records it, without its scheme: `github.com/acme/api`. */
+function hostPath(canonicalUri) {
+    return canonicalUri.replace(/^[a-z][a-z0-9+.-]*:\/\//i, '').replace(/^[^@/]+@/, '').toLowerCase();
+}
+/** Whether a repository, by its recorded origin remote, belongs to the team. */
+export function repositoryAllowed(canonicalUri, scope) {
+    const repo = hostPath(canonicalUri);
+    // No list, nothing leaves: a team names its repositories before any lesson is sent.
+    return (scope.repositories ?? []).some(pattern => {
+        const want = hostPath(pattern.trim());
+        return want.endsWith('/*') ? repo.startsWith(want.slice(0, -1)) : repo === want;
+    });
+}
+/** Why a queued lesson must stay on this machine, or null to send it. */
+export function withheldReason(visibility, canonicalUri, scope) {
+    if (visibility === 'personal' && !scope.syncPersonal)
+        return 'personal lesson';
+    if (!canonicalUri)
+        return 'repository unknown on this machine';
+    if (!repositoryAllowed(canonicalUri, scope))
+        return `repository ${hostPath(canonicalUri)} is not one of the team's repositories`;
+    return null;
+}

package/dist/storage/team-scope.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/storage/team-scope.test.js

@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest';
+import { repositoryAllowed, withheldReason } from './team-scope.js';
+const scope = { organizationId: 'acme', repositories: ['github.com/acme/*', 'https://GitLab.com/Acme/api'] };
+describe('team scope', () => {
+    it('sends lessons only from the repositories the team lists', () => {
+        expect(repositoryAllowed('https://github.com/acme/web', scope)).toBe(true);
+        expect(repositoryAllowed('https://gitlab.com/acme/api', scope)).toBe(true);
+        expect(repositoryAllowed('https://gitlab.com/acme/api-internal', scope)).toBe(false);
+        expect(repositoryAllowed('https://github.com/other-org/web', scope)).toBe(false);
+        expect(repositoryAllowed('https://github.com/acme-evil/web', scope)).toBe(false);
+    });
+    it('sends nothing when the team lists no repositories', () => {
+        expect(repositoryAllowed('https://github.com/acme/web', { organizationId: 'acme' })).toBe(false);
+    });
+    it('keeps personal lessons and unknown repositories on the machine, and says why', () => {
+        expect(withheldReason('personal', 'https://github.com/acme/web', scope)).toBe('personal lesson');
+        expect(withheldReason('personal', 'https://github.com/acme/web', { ...scope, syncPersonal: true })).toBeNull();
+        expect(withheldReason('team', undefined, scope)).toBe('repository unknown on this machine');
+        expect(withheldReason('team', 'https://github.com/other-org/web', scope)).toContain('github.com/other-org/web');
+        expect(withheldReason('team', 'https://github.com/acme/web', scope)).toBeNull();
+    });
+});

package/dist/storage/team-store.d.ts

@@ -4,6 +4,10 @@ export interface TeamConfiguration {
     actorId: string;
     databaseUrl?: string;
     semantic?: TeamSemanticConfiguration;
+    /** The team's repositories (`github.com/acme/*`); lessons from any other repository stay local. */
+    repositories?: string[];
+    /** Also send lessons marked personal (default false). */
+    syncPersonal?: boolean;
 }
 export interface TeamSemanticConfiguration {
     provider: 'pgvector';
@@ -64,6 +68,7 @@ export declare function syncTeamOutbox(options?: {
     dryRun?: boolean;
 }): Promise<{
     pending: number;
+    withheld: number;
     synced: number;
     pulled: number;
 }>;

package/dist/storage/team-store.js

@@ -1,3 +1,4 @@
+import { spawnSync } from 'child_process';
 import fs from 'fs-extra';
 import path from 'path';
 import { openDatabase } from './db.js';
@@ -5,6 +6,7 @@ import { decryptLocalPayload, encryptLocalPayload } from './local-encryption.js'
 import { TEAM_SCHEMA } from './team-schema.js';
 import { diagnoseMissingMembership, explainTeamConnectionError } from './team-diagnostics.js';
 import { rigourUserDir } from '../utils/user-state.js';
+import { withheldReason } from './team-scope.js';
 import { TEAM_VECTOR_SCHEMA, backfillConfiguredTeamEmbeddings, getTeamSemanticHealth, searchConfiguredTeamKnowledge, upsertTeamLessonEmbedding, } from './team-vector-store.js';
 const DEFAULT_SEMANTIC = {
     provider: 'pgvector',
@@ -37,12 +39,27 @@ export async function loadTeamConfiguration() {
     const organizationId = nonEmpty(process.env.RIGOUR_ORGANIZATION_ID) ?? nonEmpty(file.organizationId);
     const teamId = nonEmpty(process.env.RIGOUR_TEAM_ID) ?? nonEmpty(file.teamId);
     const actorId = nonEmpty(process.env.RIGOUR_ACTOR_ID) ?? nonEmpty(file.actorId);
-    const databaseUrl = nonEmpty(process.env.RIGOUR_TEAM_DATABASE_URL) ?? nonEmpty(file.databaseUrl);
+    const databaseUrl = nonEmpty(process.env.RIGOUR_TEAM_DATABASE_URL) ?? databaseUrlFromCommand() ?? nonEmpty(file.databaseUrl);
     if (!organizationId || !teamId || !actorId || !databaseUrl)
         return null;
     const envSemantic = process.env.RIGOUR_TEAM_SEMANTIC === 'pgvector' ? DEFAULT_SEMANTIC : undefined;
     const semantic = envSemantic ?? (file.semantic?.provider === 'pgvector' ? DEFAULT_SEMANTIC : undefined);
-    return { organizationId, teamId, actorId, databaseUrl, semantic };
+    const envRepositories = nonEmpty(process.env.RIGOUR_TEAM_REPOSITORIES)?.split(',').map(r => r.trim()).filter(Boolean);
+    const repositories = envRepositories ?? (Array.isArray(file.repositories) ? file.repositories.filter(r => typeof r === 'string') : undefined);
+    const syncPersonal = process.env.RIGOUR_TEAM_SYNC_PERSONAL !== undefined ? process.env.RIGOUR_TEAM_SYNC_PERSONAL === '1' : file.syncPersonal === true;
+    return { organizationId, teamId, actorId, databaseUrl, semantic, repositories, syncPersonal };
+}
+let commandUrl;
+/** A profile's `databaseUrlCommand` (RIGOUR_TEAM_DATABASE_URL_COMMAND): run once per process, its output never stored. */
+function databaseUrlFromCommand() {
+    const command = nonEmpty(process.env.RIGOUR_TEAM_DATABASE_URL_COMMAND);
+    if (!command)
+        return undefined;
+    if (commandUrl === undefined) {
+        const result = spawnSync(command, { shell: true, encoding: 'utf8', timeout: 15_000 });
+        commandUrl = result.status === 0 ? nonEmpty(result.stdout) ?? null : null;
+    }
+    return commandUrl ?? undefined;
 }
 export async function saveTeamConfiguration(config) {
     if (!config.databaseUrl)
@@ -176,6 +193,21 @@ export async function doctorTeamConnection(config) {
         await pool.end().catch(() => undefined);
     }
 }
+/** Queued items split into those this team may receive and those that stay on this machine, with why. */
+async function splitOutbox(db, queued, config) {
+    const sendable = [];
+    const held = [];
+    for (const item of queued) {
+        const lesson = await decryptLocalPayload(item.payload_json);
+        const repo = await db.get('SELECT canonical_uri FROM repositories WHERE id = ?', lesson.repositoryId);
+        const reason = withheldReason(lesson.visibility, repo?.canonical_uri, config);
+        if (reason)
+            held.push({ id: item.id, reason });
+        else
+            sendable.push({ item, lesson });
+    }
+    return { sendable, held };
+}
 export async function syncTeamOutbox(options = {}) {
     const config = await loadTeamConfiguration();
     if (!config?.databaseUrl)
@@ -184,9 +216,13 @@ export async function syncTeamOutbox(options = {}) {
     if (!db)
         throw new Error('SQLite offline cache is unavailable.');
     try {
-        const pending = await db.all(`SELECT * FROM sync_outbox WHERE synced_at IS NULL ORDER BY created_at ASC LIMIT 200`);
+        const queued = await db.all(`SELECT * FROM sync_outbox WHERE synced_at IS NULL ORDER BY created_at ASC LIMIT 200`);
+        const { sendable: pending, held } = await splitOutbox(db, queued, config);
         if (options.dryRun)
-            return { pending: pending.length, synced: 0, pulled: 0 };
+            return { pending: pending.length, withheld: held.length, synced: 0, pulled: 0 };
+        for (const item of held) {
+            await db.run('UPDATE sync_outbox SET synced_at = ?, last_error = ? WHERE id = ?', Date.now(), `not sent: ${item.reason}`, item.id);
+        }
         const { Pool } = await loadPg();
         const pool = new Pool({ connectionString: config.databaseUrl });
         let synced = 0;
@@ -197,8 +233,7 @@ export async function syncTeamOutbox(options = {}) {
                     AND actor_id = $2 AND organization_id = $3`, [config.teamId, config.actorId, config.organizationId]);
             if (membership.rowCount !== 1)
                 throw new Error(await diagnoseMissingMembership(pool));
-            for (const item of pending) {
-                const lesson = await decryptLocalPayload(item.payload_json);
+            for (const { item, lesson } of pending) {
                 try {
                     const result = await pool.query(`INSERT INTO rigour.lessons (
                         id, organization_id, team_id, repository_id, actor_id, visibility, state,
@@ -254,7 +289,7 @@ export async function syncTeamOutbox(options = {}) {
         finally {
             await pool.end();
         }
-        return { pending: pending.length, synced, pulled };
+        return { pending: pending.length, withheld: held.length, synced, pulled };
     }
     finally {
         await db.close();

package/dist/storage/team-sync-scope.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/storage/team-sync-scope.test.js

@@ -0,0 +1,67 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+/** The outbox and repositories a machine holds, and what reached the team database. */
+const state = vi.hoisted(() => ({ outbox: [], repos: new Map(), sent: [] }));
+vi.mock('./db.js', () => ({
+    openDatabase: async () => ({
+        all: async () => state.outbox.filter(o => o.synced_at == null),
+        get: async (_sql, id) => (state.repos.has(id) ? { canonical_uri: state.repos.get(id) } : undefined),
+        run: async (sql, ...p) => {
+            if (sql.startsWith('UPDATE sync_outbox SET synced_at')) {
+                const id = p.at(-1);
+                Object.assign(state.outbox.find(o => o.id === id) ?? {}, { synced_at: p[0], last_error: p.length === 3 ? p[1] : null });
+            }
+            return { changes: 1 };
+        },
+        close: async () => undefined,
+    }),
+}));
+vi.mock('./local-encryption.js', () => ({ encryptLocalPayload: async (v) => JSON.stringify(v), decryptLocalPayload: async (v) => JSON.parse(v) }));
+vi.mock('pg', () => ({
+    Pool: class {
+        async query(sql, params) {
+            if (sql.includes('INSERT INTO rigour.lessons')) {
+                state.sent.push(params[0]);
+                return { rowCount: 1, rows: [] };
+            }
+            return { rowCount: 1, rows: [] };
+        }
+        async end() { }
+    },
+}));
+const { syncTeamOutbox } = await import('./team-store.js');
+const queue = (id, repositoryId, visibility) => state.outbox.push({ id: `outbox-${id}`, payload_json: JSON.stringify({ id, repositoryId, visibility, evidence: {} }), synced_at: null });
+const TEAM_ENV = {
+    RIGOUR_ORGANIZATION_ID: 'acme', RIGOUR_TEAM_ID: 'web', RIGOUR_ACTOR_ID: 'dev-1',
+    RIGOUR_TEAM_DATABASE_URL: 'postgresql://localhost/rigour', RIGOUR_TEAM_REPOSITORIES: 'github.com/acme/*',
+};
+const saved = { ...process.env };
+beforeEach(() => {
+    Object.assign(process.env, TEAM_ENV);
+    delete process.env.RIGOUR_TEAM_SYNC_PERSONAL;
+    state.outbox = [];
+    state.sent = [];
+    state.repos = new Map([['r-team', 'https://github.com/acme/web'], ['r-other', 'https://github.com/other-org/app']]);
+    queue('l-team', 'r-team', 'team');
+    queue('l-other', 'r-other', 'team');
+    queue('l-personal', 'r-team', 'personal');
+    queue('l-unknown', 'r-gone', 'team');
+});
+afterEach(() => { process.env = { ...saved }; });
+describe('team sync scope', () => {
+    it("sends only the team's own shared lessons and says what it kept back", async () => {
+        expect(await syncTeamOutbox({ dryRun: true })).toMatchObject({ pending: 1, withheld: 3 });
+        expect(state.sent).toEqual([]);
+        const result = await syncTeamOutbox();
+        expect(result).toMatchObject({ synced: 1, withheld: 3 });
+        expect(state.sent).toEqual(['l-team']);
+        const reasons = Object.fromEntries(state.outbox.map(o => [o.id, o.last_error]));
+        expect(reasons['outbox-l-other']).toContain('github.com/other-org/app');
+        expect(reasons['outbox-l-personal']).toContain('personal lesson');
+        expect(reasons['outbox-l-unknown']).toContain('repository unknown');
+        expect(await syncTeamOutbox({ dryRun: true })).toMatchObject({ pending: 0, withheld: 0 }); // never retried
+    });
+    it('sends nothing when the team lists no repositories', async () => {
+        delete process.env.RIGOUR_TEAM_REPOSITORIES;
+        expect(await syncTeamOutbox({ dryRun: true })).toMatchObject({ pending: 0, withheld: 4 });
+    });
+});

package/dist/telemetry/telemetry.js

@@ -16,8 +16,8 @@
  */
 import crypto from 'crypto';
 import fs from 'fs';
-import os from 'os';
 import path from 'path';
+import { rigourHome } from '../utils/user-state.js';
 import { MIXPANEL_TOKEN } from './token.js';
 const ENDPOINT = 'https://api.mixpanel.com/track?ip=0';
 const TIMEOUT_MS = 2000;
@@ -28,7 +28,7 @@ export function telemetryToken(env = process.env) {
 function file(home, name) {
     return path.join(home, '.rigour', name);
 }
-export function readTelemetryState(home = os.homedir()) {
+export function readTelemetryState(home = rigourHome()) {
     try {
         const parsed = JSON.parse(fs.readFileSync(file(home, 'telemetry.json'), 'utf8'));
         if (typeof parsed?.installId === 'string')
@@ -39,7 +39,7 @@ export function readTelemetryState(home = os.homedir()) {
     }
     return { installId: crypto.randomUUID() };
 }
-export function setTelemetryEnabled(enabled, home = os.homedir()) {
+export function setTelemetryEnabled(enabled, home = rigourHome()) {
     const state = { ...readTelemetryState(home), enabled };
     writeJson(file(home, 'telemetry.json'), state);
     return state;
@@ -103,7 +103,7 @@ export function countUsage(name, by = 1, deps = {}) {
     if (!isTelemetryEnabled(deps))
         return;
     try {
-        const home = deps.home ?? os.homedir();
+        const home = deps.home ?? rigourHome();
         const counters = readCounters(home, deps.now ?? Date.now());
         counters.counts[name] = (counters.counts[name] ?? 0) + by;
         writeJson(file(home, 'telemetry-counters.json'), counters);
@@ -116,7 +116,7 @@ export function countUsage(name, by = 1, deps = {}) {
 export async function flushDailyUsage(deps = {}) {
     if (!isTelemetryEnabled(deps))
         return false;
-    const home = deps.home ?? os.homedir();
+    const home = deps.home ?? rigourHome();
     const now = deps.now ?? Date.now();
     const counters = readCounters(home, now);
     if (now - counters.since < DAY_MS || Object.keys(counters.counts).length === 0)

package/dist/templates/universal-config.js

@@ -241,6 +241,23 @@ export const UNIVERSAL_CONFIG = {
         deprecated_dependencies: {
             enabled: false,
         },
+        unused_exports: {
+            enabled: true,
+            allow: [],
+        },
+        orphan_files: {
+            enabled: true,
+            allow: [],
+        },
+        query_patterns: {
+            enabled: true,
+        },
+        optional_params: {
+            enabled: true,
+        },
+        duplicate_functions: {
+            enabled: true,
+        },
         migration_order: {
             enabled: false,
             dirs: ['**/supabase/migrations'],
@@ -294,6 +311,12 @@ export const UNIVERSAL_CONFIG = {
     },
     review: {
         include_heuristics: false,
+        show_preexisting: false,
+        reviewer: {
+            enabled: false,
+            command: 'claude',
+            timeout_ms: 900000,
+        },
     },
     planned: [],
     ignore: [],