@rigour-labs/core 6.6.3 → 6.6.5

package/dist/hooks/session-state.d.ts

@@ -7,7 +7,7 @@ export declare function sessionBaseline(cwd: string, session: string): string |
  * A stop in the same state as the last review (a turn that only read, or only talked) has
  * nothing new to review, so the agent is not told the same thing again.
  */
-export declare function workFingerprint(cwd: string): string | undefined;
+export declare function workFingerprint(cwd: string, ownOutputs?: string[]): string | undefined;
 /** Whether the work is in the state the last stop review saw. */
 export declare function alreadyReviewed(cwd: string, session: string, fingerprint: string | undefined): boolean;
 export declare function recordReviewed(cwd: string, session: string, fingerprint: string | undefined): void;

package/dist/hooks/session-state.js

@@ -56,11 +56,13 @@ export function sessionBaseline(cwd, session) {
  * A stop in the same state as the last review (a turn that only read, or only talked) has
  * nothing new to review, so the agent is not told the same thing again.
  */
-export function workFingerprint(cwd) {
+export function workFingerprint(cwd, ownOutputs = DEFAULT_OWN_OUTPUTS) {
     const run = (args) => spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+    // Rigour's own files change on every review; where a repository does not ignore them, they must not count as work.
+    const pathspec = ['--', '.', ...ownOutputs.map(own => `:(exclude)${own}`)];
     const head = run(['rev-parse', '--verify', '--quiet', 'HEAD']);
-    const diff = run(['diff', 'HEAD', '--no-color', '--no-ext-diff']);
-    const untracked = run(['ls-files', '--others', '--exclude-standard', '-z']);
+    const diff = run(['diff', 'HEAD', '--no-color', '--no-ext-diff', ...pathspec]);
+    const untracked = run(['ls-files', '--others', '--exclude-standard', '-z', ...pathspec]);
     if (diff.status !== 0 || untracked.status !== 0)
         return undefined;
     const hash = createHash('sha256').update(head.stdout).update(diff.stdout);
@@ -75,6 +77,8 @@ export function workFingerprint(cwd) {
     }
     return hash.digest('hex');
 }
+/** What a review writes into the repository: its state folder and its reports. */
+const DEFAULT_OWN_OUTPUTS = ['.rigour', 'rigour-report.json', 'rigour-fix-packet.json'];
 /** Whether the work is in the state the last stop review saw. */
 export function alreadyReviewed(cwd, session, fingerprint) {
     return !!fingerprint && readStore(cwd)[session]?.reviewed === fingerprint;

package/dist/hooks/stop-review.js

@@ -42,7 +42,7 @@ export function reviewAckMessage(items, attempt) {
     ].join('\n');
 }
 /** Certain from the code alone, and quick to fix (each measured with no false alarms before it blocks). */
-const MUST_FIX = new Set(['unused-export', 'orphan-file', 'offset-paging', 'unbounded-window', 'duplicate-function']);
+const MUST_FIX = new Set(['unused-export', 'orphan-file', 'offset-paging', 'unbounded-window', 'duplicate-function', 'partial-fix', 'partial-wiring']);
 /** Critical; high and either proven by the semantic engine or a security finding; or a certain, local finding the change added (MUST_FIX). */
 export function blocksStop(finding) {
     const severity = (finding.severity || 'medium');

package/dist/review/code-patterns.test.js

@@ -7,6 +7,9 @@ import { ConfigSchema } from '../types/index.js';
 import { parseDiff } from '../utils/diff.js';
 import { diffFromGit } from './git-diff.js';
 import { duplicateFunctionFailures } from './duplicate-functions.js';
+import { loopCopyFailures } from './loop-copies.js';
+import { partialFixFailures } from './partial-fixes.js';
+import { partialWiringFailures } from './partial-wiring.js';
 import { optionalParamFailures } from './optional-params.js';
 import { queryPatternFailures } from './query-patterns.js';
 let repo;
@@ -82,3 +85,58 @@ describe('duplicate functions', () => {
         expect(duplicateFunctionFailures(repo, changed(), config)).toEqual([]);
     });
 });
+describe('quadratic copies', () => {
+    it('reports an accumulator spread into a new copy on every step, not a push', () => {
+        write('src/group.ts', [
+            'export function group(items: { day: string }[]) {',
+            '  const groups = new Map<string, { day: string }[]>();',
+            '  for (const item of items) groups.set(item.day, [...(groups.get(item.day) ?? []), item]);',
+            '  const ids = items.reduce((acc: string[], item) => [...acc, item.day], []);',
+            '  const fast = new Map<string, string[]>();',
+            '  for (const item of items) (fast.get(item.day) ?? fast.set(item.day, []).get(item.day)!).push(item.day);',
+            '  return { groups, ids, fast };',
+            '}',
+        ].join('\n'));
+        expect(loopCopyFailures(repo, changed(), config).map(f => f.line)).toEqual([3, 4]);
+    });
+});
+describe('partial fixes', () => {
+    it('names the places that still test the narrower condition a new predicate widened', () => {
+        write('src/routes/session/page.server.ts', 'export function load(snapshot: any) {\n  if (snapshot.answeredCount > 0) return 1;\n  return 0;\n}\n');
+        write('src/routes/session/page.svelte', '<script lang="ts">\n  const show = data.snapshot.answeredCount > 0;\n</script>\n');
+        git('add', '-A');
+        git('commit', '-qm', 'before');
+        write('src/routes/session/page.server.ts', 'export function load(snapshot: any) {\n  if (snapshot.answeredCount > 0) return 1;\n  return 0;\n}\nexport const resume = (snapshot: any) => {\n  const hasSaved = snapshot.answers.length > 0 || snapshot.answeredCount > 0;\n  return hasSaved;\n};\n');
+        const found = partialFixFailures(repo, changed(), config);
+        expect(found.map(f => [f.id, f.line])).toEqual([['partial-fix', 6]]);
+        expect(found[0].details).toContain('page.server.ts:2');
+        expect(found[0].details).toContain('page.svelte:2');
+    });
+});
+describe('partial wiring', () => {
+    const mount = (extra) => `<script lang="ts">\n  import Player from '$lib/Player.svelte';\n</script>\n<Player\n  mode="quiz"\n  {questions}${extra}\n/>\n`;
+    it('reports a callback added to most same-kind mounts of a local component but not one', () => {
+        write('src/lib/Player.svelte', '<script lang="ts">let { onResume } = $props();</script>\n');
+        for (const route of ['a', 'b', 'c'])
+            write(`src/routes/${route}/+page.svelte`, mount(''));
+        write('src/routes/d/+page.svelte', mount('').replace('mode="quiz"', 'mode="exam"'));
+        git('add', '-A');
+        git('commit', '-qm', 'mounts');
+        write('src/routes/a/+page.svelte', mount('\n  {onResume}'));
+        write('src/routes/b/+page.svelte', mount('\n  {onResume}'));
+        const found = partialWiringFailures(repo, changed(), config);
+        expect(found).toHaveLength(1);
+        expect(found[0].details).toContain('src/routes/c/+page.svelte');
+        expect(found[0].details).not.toContain('routes/d'); // another kind of mount
+    });
+    it('ignores styling props and components from packages', () => {
+        const icon = (extra) => `<script lang="ts">\n  import { Star } from 'lucide-svelte';\n</script>\n<Star class="h-4"${extra} />\n`;
+        for (const route of ['a', 'b', 'c'])
+            write(`src/routes/${route}/+page.svelte`, icon(''));
+        git('add', '-A');
+        git('commit', '-qm', 'icons');
+        write('src/routes/a/+page.svelte', icon(' onHover={go}'));
+        write('src/routes/b/+page.svelte', icon(' onHover={go}'));
+        expect(partialWiringFailures(repo, changed(), config)).toEqual([]);
+    });
+});

package/dist/review/duplicate-functions.js

@@ -21,8 +21,13 @@ export function duplicateFunctionFailures(cwd, changedLines, config) {
         bodies.push(...bodiesIn(cwd, file, lines));
     }
     const byKey = new Map();
-    for (const body of bodies)
-        byKey.set(body.key, [...(byKey.get(body.key) ?? []), body]);
+    for (const body of bodies) {
+        const same = byKey.get(body.key);
+        if (same)
+            same.push(body);
+        else
+            byKey.set(body.key, [body]);
+    }
     const failures = [];
     for (const same of byKey.values()) {
         if (same.length < 2)

package/dist/review/loop-copies.d.ts

@@ -0,0 +1,2 @@
+import type { Config, Failure } from '../types/index.js';
+export declare function loopCopyFailures(cwd: string, changedLines: Record<string, Set<number>>, config: Config): Failure[];

package/dist/review/loop-copies.js

@@ -0,0 +1,116 @@
+/**
+ * Quadratic copy: an accumulator copied whole on every step of a loop.
+ * `groups.set(k, [...(groups.get(k) ?? []), item])`, `acc = [...acc, item]`, or a reduce that
+ * returns `[...acc, item]` / `{ ...acc, [k]: v }` copies everything gathered so far each time, so
+ * n items cost O(n²). Pushing into the existing array (or assigning the key) is linear.
+ * Reported only on lines a change adds, from the syntax tree.
+ */
+import fs from 'fs';
+import path from 'path';
+import ts from 'typescript';
+const CODE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+const BUILD_OUTPUT = /(^|\/)(dist|build|out|coverage|\.next|[\w-]+-dist)\//;
+export function loopCopyFailures(cwd, changedLines, config) {
+    if (!config.gates.change_sweep?.enabled)
+        return [];
+    const failures = [];
+    for (const [file, lines] of Object.entries(changedLines)) {
+        if (!CODE.test(file) || BUILD_OUTPUT.test(file) || lines.size === 0)
+            continue;
+        let source;
+        try {
+            const text = fs.readFileSync(path.join(cwd, file), 'utf8');
+            if (!text.includes('...'))
+                continue;
+            source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true);
+        }
+        catch {
+            continue;
+        }
+        const visit = (node) => {
+            const copied = copiedAccumulator(node, source);
+            if (copied) {
+                const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1;
+                if (lines.has(line))
+                    failures.push(quadratic(file, line, copied));
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(source);
+    }
+    return failures;
+}
+/** The accumulator a node copies whole, inside a loop or a reduce, or undefined. */
+function copiedAccumulator(node, source) {
+    // m.set(k, [...(m.get(k) ?? []), v]) in a loop
+    if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression) && node.expression.name.text === 'set' && node.arguments.length === 2) {
+        const map = node.expression.expression.getText(source);
+        const value = node.arguments[1];
+        if (ts.isArrayLiteralExpression(value) && value.elements.some(e => ts.isSpreadElement(e) && e.expression.getText(source).replace(/\s+/g, '').startsWith(`(${map}.get(`))) {
+            return insideLoop(node) ? `${map}'s list` : undefined;
+        }
+    }
+    // acc = [...acc, v] / acc = { ...acc, k: v } in a loop
+    if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.EqualsToken && ts.isIdentifier(node.left)) {
+        const name = node.left.text;
+        if (spreadsItself(node.right, name, source) && insideLoop(node))
+            return name;
+    }
+    // reduce((acc, v) => [...acc, v]) or { ...acc, [k]: v }
+    if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression) && node.expression.name.text === 'reduce') {
+        const reducer = node.arguments[0];
+        if (reducer && (ts.isArrowFunction(reducer) || ts.isFunctionExpression(reducer)) && reducer.parameters[0] && ts.isIdentifier(reducer.parameters[0].name)) {
+            const acc = reducer.parameters[0].name.text;
+            const results = ts.isBlock(reducer.body)
+                ? collectReturns(reducer.body)
+                : [ts.isParenthesizedExpression(reducer.body) ? reducer.body.expression : reducer.body];
+            if (results.some(r => spreadsItself(r, acc, source)))
+                return acc;
+        }
+    }
+    return undefined;
+}
+function spreadsItself(expr, name, source) {
+    const unwrapped = ts.isParenthesizedExpression(expr) ? expr.expression : expr;
+    if (ts.isArrayLiteralExpression(unwrapped))
+        return unwrapped.elements.some(e => ts.isSpreadElement(e) && e.expression.getText(source) === name);
+    if (ts.isObjectLiteralExpression(unwrapped))
+        return unwrapped.properties.some(p => ts.isSpreadAssignment(p) && p.expression.getText(source) === name);
+    return false;
+}
+function collectReturns(body) {
+    const found = [];
+    const walk = (node) => {
+        if (ts.isFunctionLike(node))
+            return;
+        if (ts.isReturnStatement(node) && node.expression)
+            found.push(node.expression);
+        ts.forEachChild(node, walk);
+    };
+    body.statements.forEach(walk);
+    return found;
+}
+/** A loop (or an array callback that runs per item) between the node and its function. */
+function insideLoop(node) {
+    for (let current = node.parent; current; current = current.parent) {
+        if (ts.isForStatement(current) || ts.isForOfStatement(current) || ts.isForInStatement(current) || ts.isWhileStatement(current) || ts.isDoStatement(current))
+            return true;
+        if (ts.isFunctionLike(current)) {
+            const call = current.parent;
+            return !!call && ts.isCallExpression(call) && ts.isPropertyAccessExpression(call.expression) && /^(forEach|map|flatMap)$/.test(call.expression.name.text);
+        }
+    }
+    return false;
+}
+function quadratic(file, line, accumulator) {
+    return {
+        id: 'quadratic-copy',
+        title: 'Accumulator copied on every step',
+        details: `${accumulator} is copied whole on every step (spread into a new array or object), so n items cost O(n²) work and allocations.`,
+        severity: 'medium',
+        provenance: 'traditional',
+        files: [file],
+        line,
+        hint: 'Mutate the accumulator you already own: push onto the existing list (`(m.get(k) ?? m.set(k, []).get(k)!).push(v)`), or assign the key.',
+    };
+}

package/dist/review/migration-order.js

@@ -24,7 +24,11 @@ export function migrationOrderFailures(cwd, diff, source, config) {
         const directory = path.posix.dirname(file);
         if (!file.endsWith('.sql') || !micromatch.isMatch(directory, settings.dirs))
             continue;
-        byDirectory.set(directory, [...(byDirectory.get(directory) ?? []), file]);
+        const files = byDirectory.get(directory);
+        if (files)
+            files.push(file);
+        else
+            byDirectory.set(directory, [file]);
     }
     const failures = [];
     for (const [directory, added] of byDirectory) {

package/dist/review/orphan-files.js

@@ -53,7 +53,11 @@ function referrersOf(cwd, added, files) {
     const underFolder = new Map();
     for (const file of added) {
         for (let dir = path.posix.dirname(file); dir !== '.' && dir !== '/'; dir = path.posix.dirname(dir)) {
-            underFolder.set(dir, [...(underFolder.get(dir) ?? []), file]);
+            const files = underFolder.get(dir);
+            if (files)
+                files.push(file);
+            else
+                underFolder.set(dir, [file]);
         }
     }
     const referrers = new Map(added.map(file => [file, new Set()]));

package/dist/review/partial-fixes.d.ts

@@ -0,0 +1,2 @@
+import type { Config, Failure } from '../types/index.js';
+export declare function partialFixFailures(cwd: string, changedLines: Record<string, Set<number>>, config: Config): Failure[];

package/dist/review/partial-fixes.js

@@ -0,0 +1,138 @@
+/**
+ * Partial fix: a change names a broader condition (`const hasSaved = a.length > 0 || count > 0`)
+ * and uses it at some call sites, while the narrower condition it replaces (`count > 0`) is still
+ * tested on its own elsewhere in the same folder (the same route's other file, a sibling page).
+ * "Fixed" means every case, so the places still using the old form are named. Reported on the
+ * line that adds the named condition, since the leftovers are, by definition, lines it did not touch.
+ */
+import fs from 'fs';
+import path from 'path';
+import ts from 'typescript';
+const CODE = /\.(ts|tsx|js|jsx|mjs|cjs|svelte)$/;
+const SKIPPED = /\.(test|spec)\.|\.d\.ts$/;
+export function partialFixFailures(cwd, changedLines, config) {
+    if (!config.gates.change_sweep?.enabled)
+        return [];
+    const failures = [];
+    for (const [file, lines] of Object.entries(changedLines)) {
+        if (!/\.(ts|tsx|js|jsx|mjs|cjs)$/.test(file) || SKIPPED.test(file) || lines.size === 0)
+            continue;
+        const source = parse(cwd, file);
+        if (!source)
+            continue;
+        const visit = (node) => {
+            if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer && isOr(node.initializer)) {
+                const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1;
+                if (lines.has(line)) {
+                    const leftovers = narrowerElsewhere(cwd, file, line, parts(node.initializer, source), changedLines);
+                    if (leftovers.length)
+                        failures.push(partial(file, line, node.name.text, leftovers));
+                }
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(source);
+    }
+    return failures;
+}
+function isOr(expr) {
+    const e = ts.isParenthesizedExpression(expr) ? expr.expression : expr;
+    return ts.isBinaryExpression(e) && e.operatorToken.kind === ts.SyntaxKind.BarBarToken;
+}
+/**
+ * The comparisons a broader condition ORs together. A comparison on a property (`x.count > 0`)
+ * matches the same property, operator and value on any receiver (`data.x.count > 0`).
+ */
+function parts(expr, source) {
+    const found = [];
+    const walk = (e) => {
+        const inner = ts.isParenthesizedExpression(e) ? e.expression : e;
+        if (ts.isBinaryExpression(inner) && inner.operatorToken.kind === ts.SyntaxKind.BarBarToken) {
+            walk(inner.left);
+            walk(inner.right);
+            return;
+        }
+        if (ts.isBinaryExpression(inner) && isComparison(inner.operatorToken.kind) && ts.isPropertyAccessExpression(inner.left) && isLiteral(inner.right)) {
+            // The receiver's last name and the property (`answers.length`, `snapshot.answeredCount`): specific
+            // enough that an unrelated `.length > 0` never matches, loose enough for `data.snapshot.answeredCount`.
+            const receiver = inner.left.expression;
+            const owner = ts.isIdentifier(receiver) ? receiver.text : ts.isPropertyAccessExpression(receiver) ? receiver.name.text : undefined;
+            if (!owner)
+                return;
+            const tail = `${owner}.${inner.left.name.text}`;
+            const operator = inner.operatorToken.getText(source);
+            const value = inner.right.getText(source);
+            found.push({
+                text: inner.getText(source),
+                pattern: new RegExp(`(?<![\\w$])${escape(tail)}\\s*${escape(operator)}\\s*${escape(value)}(?![\\w.])`),
+            });
+        }
+    };
+    walk(expr);
+    return found;
+}
+function isComparison(kind) {
+    return [ts.SyntaxKind.GreaterThanToken, ts.SyntaxKind.GreaterThanEqualsToken, ts.SyntaxKind.LessThanToken, ts.SyntaxKind.LessThanEqualsToken,
+        ts.SyntaxKind.EqualsEqualsEqualsToken, ts.SyntaxKind.ExclamationEqualsEqualsToken].includes(kind);
+}
+function isLiteral(e) {
+    return ts.isNumericLiteral(e) || ts.isStringLiteral(e) || e.kind === ts.SyntaxKind.NullKeyword || e.kind === ts.SyntaxKind.TrueKeyword || e.kind === ts.SyntaxKind.FalseKeyword;
+}
+/** `file:line` of each remaining standalone use of a part, in the same folder, outside the broader condition. */
+function narrowerElsewhere(cwd, file, declLine, found, changed) {
+    if (found.length < 2)
+        return [];
+    const dir = path.posix.dirname(file);
+    let siblings;
+    try {
+        siblings = fs.readdirSync(path.join(cwd, dir)).filter(name => CODE.test(name) && !SKIPPED.test(name)).map(name => path.posix.join(dir, name));
+    }
+    catch {
+        return [];
+    }
+    const leftovers = [];
+    for (const sibling of siblings) {
+        let text;
+        try {
+            text = fs.readFileSync(path.join(cwd, sibling), 'utf8');
+        }
+        catch {
+            continue;
+        }
+        text.split('\n').forEach((content, index) => {
+            const line = index + 1;
+            if (sibling === file && line === declLine)
+                return;
+            // A line the change itself added is the author's current intent, not a leftover.
+            if (changed[sibling]?.has(line) && sibling === file)
+                return;
+            if (found.some(part => part.pattern.test(content)) && !found.every(part => part.pattern.test(content)))
+                leftovers.push(`${sibling}:${line}`);
+        });
+    }
+    return leftovers;
+}
+function parse(cwd, file) {
+    try {
+        return ts.createSourceFile(file, fs.readFileSync(path.join(cwd, file), 'utf8'), ts.ScriptTarget.Latest, true);
+    }
+    catch {
+        return undefined;
+    }
+}
+function escape(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function partial(file, line, name, leftovers) {
+    const listed = leftovers.slice(0, 5).map(l => `\`${l}\``).join(', ');
+    return {
+        id: 'partial-fix',
+        title: 'Partial fix',
+        details: `\`${name}\` widens a condition, but the narrower form is still tested on its own at ${listed}${leftovers.length > 5 ? ` and ${leftovers.length - 5} more` : ''}.`,
+        severity: 'medium',
+        provenance: 'traditional',
+        files: [file],
+        line,
+        hint: `Use \`${name}\` (or the same condition) at each of those places too, or say in a comment why the narrower test is right there.`,
+    };
+}

package/dist/review/partial-wiring.d.ts

@@ -0,0 +1,2 @@
+import type { Config, Failure } from '../types/index.js';
+export declare function partialWiringFailures(cwd: string, changedLines: Record<string, Set<number>>, config: Config): Failure[];

package/dist/review/partial-wiring.js

@@ -0,0 +1,201 @@
+/**
+ * Partial wiring: a change adds a prop to some mounts of a component, and a sibling mount of the
+ * same kind (agreeing on a literal prop, such as `mode="quiz"`, in at least three files) still lacks it, so that place keeps the
+ * old behaviour (a handler never called, events missing). Svelte and JSX mounts are read with a
+ * brace-aware scanner; a mount that spreads props (`{...rest}`) is given the benefit of the doubt.
+ * Reported on the line that adds the prop.
+ */
+import { spawnSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+const MOUNTING = /\.(svelte|tsx|jsx)$/;
+const SKIPPED = /\.(test|spec|stories)\.|(^|\/)(__tests__|tests?)\//;
+const GIT_TIMEOUT_MS = 10_000;
+export function partialWiringFailures(cwd, changedLines, config) {
+    if (!config.gates.change_sweep?.enabled)
+        return [];
+    const failures = [];
+    const seen = new Set();
+    for (const [file, lines] of Object.entries(changedLines)) {
+        if (!MOUNTING.test(file) || SKIPPED.test(file) || lines.size === 0)
+            continue;
+        for (const mount of mountsIn(cwd, file)) {
+            for (const { prop, line } of addedProps(cwd, mount, lines)) {
+                const key = `${mount.component}\0${prop}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                // A missed wiring is a callback the project's own component offers (`onResume`), among mounts
+                // of the same kind (a literal they agree on, `mode="quiz"`) in several files. UI-kit and icon
+                // components, styling props and DOM events take different values everywhere by design.
+                if (!/^on[A-Z]/.test(prop) || mount.literals.size === 0 || !isLocalComponent(cwd, mount))
+                    continue;
+                const kin = mountsOf(cwd, mount.component).filter(m => sameKind(m, mount));
+                if (new Set(kin.map(m => m.file)).size < 3)
+                    continue;
+                const missing = kin.filter(m => !m.props.has(prop) && !m.spreads);
+                const having = kin.filter(m => m.props.has(prop));
+                if (kin.length >= 3 && having.length >= 2 && missing.length >= 1 && missing.length < having.length) {
+                    failures.push(unwired(mount, prop, line, missing));
+                }
+            }
+        }
+    }
+    return failures;
+}
+/** Props on the mount written on a line the change added, with that line (where a finding belongs). */
+function addedProps(cwd, mount, lines) {
+    const text = fs.readFileSync(path.join(cwd, mount.file), 'utf8').split('\n');
+    const added = new Map();
+    for (let line = mount.line; line <= mount.endLine; line++) {
+        if (!lines.has(line))
+            continue;
+        for (const prop of mount.props) {
+            if (!added.has(prop) && new RegExp(`(^|[\\s{])${prop.replace(/[$]/g, '\\$')}(\\s*=|\\s*}|\\s|$)`).test(text[line - 1] ?? ''))
+                added.set(prop, line);
+        }
+    }
+    return [...added].map(([prop, line]) => ({ prop, line }));
+}
+/** The component is imported from the project itself (a relative path or a project alias), not a package. */
+function isLocalComponent(cwd, mount) {
+    const text = fs.readFileSync(path.join(cwd, mount.file), 'utf8');
+    const name = mount.component.split('.')[0];
+    const imported = new RegExp(`import\\s+(?:type\\s+)?(?:${name}\\b[^;]*?|\\{[^}]*\\b${name}\\b[^}]*\\})\\s*from\\s*['"]([^'"]+)['"]`).exec(text);
+    return !!imported && /^(\.|\$lib\/|@\/|~\/|src\/)/.test(imported[1]);
+}
+function sameKind(a, b) {
+    return [...b.literals].every(([name, value]) => a.literals.get(name) === value);
+}
+const mountCache = new Map();
+/** Every mount of `component` in the repository's Svelte and JSX files. */
+function mountsOf(cwd, component) {
+    const key = `${cwd}\0${component}`;
+    const cached = mountCache.get(key);
+    if (cached)
+        return cached;
+    const grep = spawnSync('git', ['grep', '--untracked', '-l', '-F', '-e', `<${component}`], { cwd, encoding: 'utf8', timeout: GIT_TIMEOUT_MS });
+    const files = grep.status === 0 ? grep.stdout.split('\n').filter(f => f && MOUNTING.test(f) && !SKIPPED.test(f)) : [];
+    const mounts = files.flatMap(file => mountsIn(cwd, file).filter(m => m.component === component));
+    mountCache.set(key, mounts);
+    return mounts;
+}
+/** Component tags (capitalised) in a file, with their props, read without breaking on `>` inside braces or quotes. */
+function mountsIn(cwd, file) {
+    let text;
+    try {
+        text = fs.readFileSync(path.join(cwd, file), 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const mounts = [];
+    const tag = /<([A-Z][\w.]*)(?=[\s/>])/g;
+    for (let match = tag.exec(text); match; match = tag.exec(text)) {
+        const end = tagEnd(text, match.index + match[0].length);
+        if (end < 0)
+            continue;
+        const body = text.slice(match.index + match[0].length, end);
+        const line = text.slice(0, match.index).split('\n').length;
+        mounts.push({ file, line, endLine: line + body.split('\n').length - 1, component: match[1], ...props(body) });
+    }
+    return mounts;
+}
+/** Index of the `>` that closes the tag starting at `from`, skipping braces and quotes. */
+function tagEnd(text, from) {
+    let depth = 0;
+    let quote = '';
+    for (let i = from; i < text.length; i++) {
+        const c = text[i];
+        if (quote) {
+            if (c === quote)
+                quote = '';
+        }
+        else if (c === '"' || c === "'" || c === '`') {
+            quote = c;
+        }
+        else if (c === '{') {
+            depth++;
+        }
+        else if (c === '}') {
+            depth--;
+        }
+        else if (c === '>' && depth === 0) {
+            return i;
+        }
+    }
+    return -1;
+}
+/**
+ * A tag's props: `name="literal"`, `name={…}`, the shorthand `{name}`, and whether it spreads
+ * `{...rest}`. Text inside braces is code, not props, and never read as one.
+ */
+function props(body) {
+    let top = '';
+    let depth = 0;
+    let quote = '';
+    let inner = '';
+    for (const c of body) {
+        if (quote) {
+            if (depth === 0)
+                top += c;
+            else
+                inner += c;
+            if (c === quote)
+                quote = '';
+            continue;
+        }
+        if (c === '"' || c === "'" || c === '`') {
+            quote = c;
+            if (depth === 0)
+                top += c;
+            else
+                inner += c;
+            continue;
+        }
+        if (c === '{') {
+            if (depth > 0)
+                inner += c;
+            depth++;
+            continue;
+        }
+        if (c === '}') {
+            depth--;
+            if (depth > 0) {
+                inner += c;
+                continue;
+            }
+            const content = inner.trim();
+            top += /^\.\.\./.test(content) ? '{...}' : /^[A-Za-z_$][\w$]*$/.test(content) ? `{${content}}` : '{}';
+            inner = '';
+            continue;
+        }
+        if (depth === 0)
+            top += c;
+        else
+            inner += c;
+    }
+    const names = new Set();
+    const literals = new Map();
+    for (const m of top.matchAll(/([A-Za-z_$][\w$:-]*)\s*=\s*(?:"([^"]*)"|'([^']*)'|\{)/g)) {
+        names.add(m[1]);
+        if (m[2] !== undefined || m[3] !== undefined)
+            literals.set(m[1], m[2] ?? m[3]);
+    }
+    for (const m of top.matchAll(/(?<![=\w$])\{([A-Za-z_$][\w$]*)\}/g))
+        names.add(m[1]);
+    return { props: names, literals, spreads: top.includes('{...}') };
+}
+function unwired(mount, prop, line, missing) {
+    const where = missing.slice(0, 5).map(m => `\`${m.file}:${m.line}\``).join(', ');
+    return {
+        id: 'partial-wiring',
+        title: 'Wired in some places, not all',
+        details: `\`${prop}\` is passed to \`<${mount.component}>\` here and in other mounts of the same kind, but not at ${where}, so that place keeps the old behaviour.`,
+        severity: 'medium',
+        provenance: 'traditional',
+        files: [mount.file],
+        line,
+        hint: `Pass \`${prop}\` there too, or say why that mount should not have it.`,
+    };
+}

package/dist/review/quiet.js

@@ -20,7 +20,7 @@ import fs from 'fs';
 import path from 'path';
 import { checkId, isMuted, readOutcomes, recordOutcome, reportedCheck } from './check-outcomes.js';
 import { readStateFile } from './trusted-state.js';
-const PROVEN_GATES = new Set(['semantic-bugs', 'hallucinated-imports', 'security-patterns', 'deep-analysis', 'diff-tests', 'unused-export', 'orphan-file', 'offset-paging', 'unbounded-window', 'duplicate-function']);
+const PROVEN_GATES = new Set(['semantic-bugs', 'hallucinated-imports', 'security-patterns', 'deep-analysis', 'diff-tests', 'unused-export', 'orphan-file', 'offset-paging', 'unbounded-window', 'duplicate-function', 'partial-fix', 'partial-wiring']);
 export const DISMISSED_FILE = path.join('.rigour', 'dismissed.json');
 export function isProven(failure) {
     return PROVEN_GATES.has(failure.id);

package/dist/review/review.js

@@ -24,6 +24,9 @@ import { unusedExportFailures } from './unused-exports.js';
 import { queryPatternFailures } from './query-patterns.js';
 import { optionalParamFailures } from './optional-params.js';
 import { duplicateFunctionFailures } from './duplicate-functions.js';
+import { loopCopyFailures } from './loop-copies.js';
+import { partialFixFailures } from './partial-fixes.js';
+import { partialWiringFailures } from './partial-wiring.js';
 import { isControlFile } from './trusted-state.js';
 import { baseCommit, baseFindings, splitIntroduced } from './baseline.js';
 export async function reviewChange(input) {
@@ -40,7 +43,7 @@ export async function reviewChange(input) {
         report.failures.push(...await diffTestFailures(input.cwd, input.source, deep));
     report.failures.push(...migrationOrderFailures(input.cwd, diff, input.source, input.config));
     report.failures.push(...unusedExportFailures(input.cwd, diff, input.config), ...orphanFileFailures(input.cwd, diff, input.config));
-    report.failures.push(...queryPatternFailures(input.cwd, changedLines, input.config), ...optionalParamFailures(input.cwd, changedLines, input.config), ...duplicateFunctionFailures(input.cwd, changedLines, input.config));
+    report.failures.push(...queryPatternFailures(input.cwd, changedLines, input.config), ...optionalParamFailures(input.cwd, changedLines, input.config), ...duplicateFunctionFailures(input.cwd, changedLines, input.config), ...loopCopyFailures(input.cwd, changedLines, input.config), ...partialFixFailures(input.cwd, changedLines, input.config), ...partialWiringFailures(input.cwd, changedLines, input.config));
     const split = splitByChangedLines(report.failures, changedLines, deep ? changedFunctionSpans(input.cwd, changedLines) : {}, removedByFile(diff));
     const deepError = deepAnalysisError(report);
     const quiet = quietSplit(input.cwd, split.findings, input.config.review?.include_heuristics, input.trustedRef);

package/dist/review/review.test.js

@@ -140,7 +140,7 @@ describe('git-backed review', () => {
         const shown = [...all.findings, ...all.fileFindings, ...all.advisory].filter(f => f.id === 'AST_COMPLEXITY');
         expect(shown.map(f => f.files?.[0]).sort()).toEqual(['src/fresh.ts', 'src/old.ts']);
         expect(all.preexisting).toBe(0);
-    });
+    }, 30_000); // two whole reviews, each running the rules on the change and on the base tree
     it('lets a change dismiss its own finding only when the review trusts the working tree', async () => {
         write('src/old.ts', 'export const a = 1;\n');
         write('.gitignore', '.rigour/*\n!.rigour/dismissed.json\n');

package/dist/review/reviewer.js

@@ -168,8 +168,16 @@ Do this in order.
    "never", "only") must be true of the code; a claim the code does not make true is blocking.
 4. Then review the diff the way that reviewer would: correctness, dead code and unreferenced exports,
    duplicated logic, every comment and claim still true of the code, and the repository's rules.
-5. Blocking is decided by the kind of finding, not by how severe it feels. These are always blocking:
-   a previous blocking point not fully resolved; a read before a filter known before it; an unbounded window;
+5. Sweep the author's own fixes. For each condition, helper or field the change introduces or changes:
+   is the old form still used elsewhere in the module or its sibling routes (a fix applied to some
+   places only)? Does an equivalent already exist nearby (a helper written again)? Is a field the
+   producers fill overwritten before anything reads it (a later spread, a merge), and does its comment
+   name where it really comes from? When a fix depends on what a third-party library does (for
+   example, a call that silently does nothing for an unknown id), cite the library's own types or docs,
+   and check that a test fake can fail the way the library does.
+6. Blocking is decided by the kind of finding, not by how severe it feels. These are always blocking:
+   a previous blocking point not fully resolved; a fix applied to some of the places that need it;
+   state recorded as done before an unconfirmed library call; a read before a filter known before it; an unbounded window;
    OFFSET paging in a loop; a read with no deadline in a scheduled job; a lock or kill switch checked
    after work starts; a request hook that sets or clears cookies and then returns a response it built
    itself without those cookies reaching it (check whether anything adds queued cookies afterwards); dead code or an unreferenced export the change adds; a comment, doc or PR claim

package/dist/templates/universal-config.js

@@ -255,6 +255,9 @@ export const UNIVERSAL_CONFIG = {
         optional_params: {
             enabled: true,
         },
+        change_sweep: {
+            enabled: true,
+        },
         duplicate_functions: {
             enabled: true,
         },

package/dist/types/index.d.ts

@@ -537,6 +537,14 @@ export declare const GatesSchema: z.ZodObject<{
     }, {
         enabled?: boolean | undefined;
     }>>>;
+    /** What a fix leaves half done: the narrower condition still used elsewhere, a prop wired into some sibling mounts only, an accumulator copied every step (review/partial-fixes.ts, partial-wiring.ts, loop-copies.ts). */
+    change_sweep: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+    }, {
+        enabled?: boolean | undefined;
+    }>>>;
     /** A parameter the change adds as optional that only tests omit (review/optional-params.ts). */
     optional_params: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
@@ -1008,6 +1016,9 @@ export declare const GatesSchema: z.ZodObject<{
     query_patterns: {
         enabled: boolean;
     };
+    change_sweep: {
+        enabled: boolean;
+    };
     optional_params: {
         enabled: boolean;
     };
@@ -1280,6 +1291,9 @@ export declare const GatesSchema: z.ZodObject<{
     query_patterns?: {
         enabled?: boolean | undefined;
     } | undefined;
+    change_sweep?: {
+        enabled?: boolean | undefined;
+    } | undefined;
     optional_params?: {
         enabled?: boolean | undefined;
     } | undefined;
@@ -1925,6 +1939,14 @@ export declare const ConfigSchema: z.ZodObject<{
         }, {
             enabled?: boolean | undefined;
         }>>>;
+        /** What a fix leaves half done: the narrower condition still used elsewhere, a prop wired into some sibling mounts only, an accumulator copied every step (review/partial-fixes.ts, partial-wiring.ts, loop-copies.ts). */
+        change_sweep: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+        }, {
+            enabled?: boolean | undefined;
+        }>>>;
         /** A parameter the change adds as optional that only tests omit (review/optional-params.ts). */
         optional_params: z.ZodDefault<z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
@@ -2396,6 +2418,9 @@ export declare const ConfigSchema: z.ZodObject<{
         query_patterns: {
             enabled: boolean;
         };
+        change_sweep: {
+            enabled: boolean;
+        };
         optional_params: {
             enabled: boolean;
         };
@@ -2668,6 +2693,9 @@ export declare const ConfigSchema: z.ZodObject<{
         query_patterns?: {
             enabled?: boolean | undefined;
         } | undefined;
+        change_sweep?: {
+            enabled?: boolean | undefined;
+        } | undefined;
         optional_params?: {
             enabled?: boolean | undefined;
         } | undefined;
@@ -3032,6 +3060,9 @@ export declare const ConfigSchema: z.ZodObject<{
         query_patterns: {
             enabled: boolean;
         };
+        change_sweep: {
+            enabled: boolean;
+        };
         optional_params: {
             enabled: boolean;
         };
@@ -3342,6 +3373,9 @@ export declare const ConfigSchema: z.ZodObject<{
         query_patterns?: {
             enabled?: boolean | undefined;
         } | undefined;
+        change_sweep?: {
+            enabled?: boolean | undefined;
+        } | undefined;
         optional_params?: {
             enabled?: boolean | undefined;
         } | undefined;

package/dist/types/index.js

@@ -288,6 +288,8 @@ export const GatesSchema = z.object({
     }).optional().default({}),
     /** Query shapes that cost production: offset paging in a loop, a time window with no upper bound (review/query-patterns.ts). */
     query_patterns: z.object({ enabled: z.boolean().optional().default(true) }).optional().default({}),
+    /** What a fix leaves half done: the narrower condition still used elsewhere, a prop wired into some sibling mounts only, an accumulator copied every step (review/partial-fixes.ts, partial-wiring.ts, loop-copies.ts). */
+    change_sweep: z.object({ enabled: z.boolean().optional().default(true) }).optional().default({}),
     /** A parameter the change adds as optional that only tests omit (review/optional-params.ts). */
     optional_params: z.object({ enabled: z.boolean().optional().default(true) }).optional().default({}),
     /** A changed function whose body duplicates another in the files the change touched (review/duplicate-functions.ts). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.6.3",
+  "version": "6.6.5",
   "description": "Rigour's review engine: deterministic gates on changed lines, rules and lessons learned from your team's fixes, and per-check precision from what you fix versus dismiss, across TypeScript, JavaScript, Python, Go, Ruby and C#.",
   "engines": {
     "node": ">=22"
@@ -74,11 +74,11 @@
     "pg": "^8.16.3",
     "sqlite3": "^5.1.7",
     "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-arm64": "6.6.3",
-    "@rigour-labs/brain-darwin-x64": "6.6.3",
-    "@rigour-labs/brain-linux-arm64": "6.6.3",
-    "@rigour-labs/brain-linux-x64": "6.6.3",
-    "@rigour-labs/brain-win-x64": "6.6.3"
+    "@rigour-labs/brain-darwin-arm64": "6.6.5",
+    "@rigour-labs/brain-darwin-x64": "6.6.5",
+    "@rigour-labs/brain-linux-arm64": "6.6.5",
+    "@rigour-labs/brain-linux-x64": "6.6.5",
+    "@rigour-labs/brain-win-x64": "6.6.5"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",