@rigour-labs/core 6.6.4 → 6.6.6

package/dist/review/partial-wiring.js

@@ -0,0 +1,201 @@
+/**
+ * Partial wiring: a change adds a prop to some mounts of a component, and a sibling mount of the
+ * same kind (agreeing on a literal prop, such as `mode="quiz"`, in at least three files) still lacks it, so that place keeps the
+ * old behaviour (a handler never called, events missing). Svelte and JSX mounts are read with a
+ * brace-aware scanner; a mount that spreads props (`{...rest}`) is given the benefit of the doubt.
+ * Reported on the line that adds the prop.
+ */
+import { spawnSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+const MOUNTING = /\.(svelte|tsx|jsx)$/;
+const SKIPPED = /\.(test|spec|stories)\.|(^|\/)(__tests__|tests?)\//;
+const GIT_TIMEOUT_MS = 10_000;
+export function partialWiringFailures(cwd, changedLines, config) {
+    if (!config.gates.change_sweep?.enabled)
+        return [];
+    const failures = [];
+    const seen = new Set();
+    for (const [file, lines] of Object.entries(changedLines)) {
+        if (!MOUNTING.test(file) || SKIPPED.test(file) || lines.size === 0)
+            continue;
+        for (const mount of mountsIn(cwd, file)) {
+            for (const { prop, line } of addedProps(cwd, mount, lines)) {
+                const key = `${mount.component}\0${prop}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                // A missed wiring is a callback the project's own component offers (`onResume`), among mounts
+                // of the same kind (a literal they agree on, `mode="quiz"`) in several files. UI-kit and icon
+                // components, styling props and DOM events take different values everywhere by design.
+                if (!/^on[A-Z]/.test(prop) || mount.literals.size === 0 || !isLocalComponent(cwd, mount))
+                    continue;
+                const kin = mountsOf(cwd, mount.component).filter(m => sameKind(m, mount));
+                if (new Set(kin.map(m => m.file)).size < 3)
+                    continue;
+                const missing = kin.filter(m => !m.props.has(prop) && !m.spreads);
+                const having = kin.filter(m => m.props.has(prop));
+                if (kin.length >= 3 && having.length >= 2 && missing.length >= 1 && missing.length < having.length) {
+                    failures.push(unwired(mount, prop, line, missing));
+                }
+            }
+        }
+    }
+    return failures;
+}
+/** Props on the mount written on a line the change added, with that line (where a finding belongs). */
+function addedProps(cwd, mount, lines) {
+    const text = fs.readFileSync(path.join(cwd, mount.file), 'utf8').split('\n');
+    const added = new Map();
+    for (let line = mount.line; line <= mount.endLine; line++) {
+        if (!lines.has(line))
+            continue;
+        for (const prop of mount.props) {
+            if (!added.has(prop) && new RegExp(`(^|[\\s{])${prop.replace(/[$]/g, '\\$')}(\\s*=|\\s*}|\\s|$)`).test(text[line - 1] ?? ''))
+                added.set(prop, line);
+        }
+    }
+    return [...added].map(([prop, line]) => ({ prop, line }));
+}
+/** The component is imported from the project itself (a relative path or a project alias), not a package. */
+function isLocalComponent(cwd, mount) {
+    const text = fs.readFileSync(path.join(cwd, mount.file), 'utf8');
+    const name = mount.component.split('.')[0];
+    const imported = new RegExp(`import\\s+(?:type\\s+)?(?:${name}\\b[^;]*?|\\{[^}]*\\b${name}\\b[^}]*\\})\\s*from\\s*['"]([^'"]+)['"]`).exec(text);
+    return !!imported && /^(\.|\$lib\/|@\/|~\/|src\/)/.test(imported[1]);
+}
+function sameKind(a, b) {
+    return [...b.literals].every(([name, value]) => a.literals.get(name) === value);
+}
+const mountCache = new Map();
+/** Every mount of `component` in the repository's Svelte and JSX files. */
+function mountsOf(cwd, component) {
+    const key = `${cwd}\0${component}`;
+    const cached = mountCache.get(key);
+    if (cached)
+        return cached;
+    const grep = spawnSync('git', ['grep', '--untracked', '-l', '-F', '-e', `<${component}`], { cwd, encoding: 'utf8', timeout: GIT_TIMEOUT_MS });
+    const files = grep.status === 0 ? grep.stdout.split('\n').filter(f => f && MOUNTING.test(f) && !SKIPPED.test(f)) : [];
+    const mounts = files.flatMap(file => mountsIn(cwd, file).filter(m => m.component === component));
+    mountCache.set(key, mounts);
+    return mounts;
+}
+/** Component tags (capitalised) in a file, with their props, read without breaking on `>` inside braces or quotes. */
+function mountsIn(cwd, file) {
+    let text;
+    try {
+        text = fs.readFileSync(path.join(cwd, file), 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const mounts = [];
+    const tag = /<([A-Z][\w.]*)(?=[\s/>])/g;
+    for (let match = tag.exec(text); match; match = tag.exec(text)) {
+        const end = tagEnd(text, match.index + match[0].length);
+        if (end < 0)
+            continue;
+        const body = text.slice(match.index + match[0].length, end);
+        const line = text.slice(0, match.index).split('\n').length;
+        mounts.push({ file, line, endLine: line + body.split('\n').length - 1, component: match[1], ...props(body) });
+    }
+    return mounts;
+}
+/** Index of the `>` that closes the tag starting at `from`, skipping braces and quotes. */
+function tagEnd(text, from) {
+    let depth = 0;
+    let quote = '';
+    for (let i = from; i < text.length; i++) {
+        const c = text[i];
+        if (quote) {
+            if (c === quote)
+                quote = '';
+        }
+        else if (c === '"' || c === "'" || c === '`') {
+            quote = c;
+        }
+        else if (c === '{') {
+            depth++;
+        }
+        else if (c === '}') {
+            depth--;
+        }
+        else if (c === '>' && depth === 0) {
+            return i;
+        }
+    }
+    return -1;
+}
+/**
+ * A tag's props: `name="literal"`, `name={…}`, the shorthand `{name}`, and whether it spreads
+ * `{...rest}`. Text inside braces is code, not props, and never read as one.
+ */
+function props(body) {
+    let top = '';
+    let depth = 0;
+    let quote = '';
+    let inner = '';
+    for (const c of body) {
+        if (quote) {
+            if (depth === 0)
+                top += c;
+            else
+                inner += c;
+            if (c === quote)
+                quote = '';
+            continue;
+        }
+        if (c === '"' || c === "'" || c === '`') {
+            quote = c;
+            if (depth === 0)
+                top += c;
+            else
+                inner += c;
+            continue;
+        }
+        if (c === '{') {
+            if (depth > 0)
+                inner += c;
+            depth++;
+            continue;
+        }
+        if (c === '}') {
+            depth--;
+            if (depth > 0) {
+                inner += c;
+                continue;
+            }
+            const content = inner.trim();
+            top += /^\.\.\./.test(content) ? '{...}' : /^[A-Za-z_$][\w$]*$/.test(content) ? `{${content}}` : '{}';
+            inner = '';
+            continue;
+        }
+        if (depth === 0)
+            top += c;
+        else
+            inner += c;
+    }
+    const names = new Set();
+    const literals = new Map();
+    for (const m of top.matchAll(/([A-Za-z_$][\w$:-]*)\s*=\s*(?:"([^"]*)"|'([^']*)'|\{)/g)) {
+        names.add(m[1]);
+        if (m[2] !== undefined || m[3] !== undefined)
+            literals.set(m[1], m[2] ?? m[3]);
+    }
+    for (const m of top.matchAll(/(?<![=\w$])\{([A-Za-z_$][\w$]*)\}/g))
+        names.add(m[1]);
+    return { props: names, literals, spreads: top.includes('{...}') };
+}
+function unwired(mount, prop, line, missing) {
+    const where = missing.slice(0, 5).map(m => `\`${m.file}:${m.line}\``).join(', ');
+    return {
+        id: 'partial-wiring',
+        title: 'Wired in some places, not all',
+        details: `\`${prop}\` is passed to \`<${mount.component}>\` here and in other mounts of the same kind, but not at ${where}, so that place keeps the old behaviour.`,
+        severity: 'medium',
+        provenance: 'traditional',
+        files: [mount.file],
+        line,
+        hint: `Pass \`${prop}\` there too, or say why that mount should not have it.`,
+    };
+}

package/dist/review/quiet.d.ts

@@ -1,6 +1,12 @@
 import type { Failure } from '../types/index.js';
 export declare const DISMISSED_FILE: string;
 export declare function isProven(failure: Failure): boolean;
+/**
+ * What a change must fix: a proven finding, a critical one, or a high one the semantic engine
+ * verified or a security gate found. The one rule behind the review's verdict, the stop hook and
+ * the push gate, so the three never disagree about the same finding.
+ */
+export declare function mustFix(failure: Failure): boolean;
 /** The same finding across runs and pushes: gate, file and message, never the line (lines move). */
 export declare function findingKey(failure: Failure): string;
 export interface QuietSplit {

package/dist/review/quiet.js

@@ -20,11 +20,21 @@ import fs from 'fs';
 import path from 'path';
 import { checkId, isMuted, readOutcomes, recordOutcome, reportedCheck } from './check-outcomes.js';
 import { readStateFile } from './trusted-state.js';
-const PROVEN_GATES = new Set(['semantic-bugs', 'hallucinated-imports', 'security-patterns', 'deep-analysis', 'diff-tests', 'unused-export', 'orphan-file', 'offset-paging', 'unbounded-window', 'duplicate-function']);
+const PROVEN_GATES = new Set(['semantic-bugs', 'hallucinated-imports', 'security-patterns', 'deep-analysis', 'diff-tests', 'unused-export', 'orphan-file', 'offset-paging', 'unbounded-window', 'duplicate-function', 'partial-fix', 'partial-wiring', 'migration-order',
+    'duplicate-null-filter', 'nullable-filtered-column', 'optional-always-supplied', 'write-only-property', 'typed-checks-unavailable']);
 export const DISMISSED_FILE = path.join('.rigour', 'dismissed.json');
 export function isProven(failure) {
     return PROVEN_GATES.has(failure.id);
 }
+/**
+ * What a change must fix: a proven finding, a critical one, or a high one the semantic engine
+ * verified or a security gate found. The one rule behind the review's verdict, the stop hook and
+ * the push gate, so the three never disagree about the same finding.
+ */
+export function mustFix(failure) {
+    const severity = failure.severity ?? 'medium';
+    return isProven(failure) || severity === 'critical' || (severity === 'high' && (failure.verified === true || failure.provenance === 'security'));
+}
 /** The same finding across runs and pushes: gate, file and message, never the line (lines move). */
 export function findingKey(failure) {
     return crypto.createHash('sha256').update(`${failure.id}\u0000${failure.files?.[0] ?? ''}\u0000${failure.details}`).digest('hex').slice(0, 16);
@@ -39,7 +49,7 @@ export function quietSplit(cwd, findings, includeHeuristics = false, trustedRef)
             split.dismissed++;
             split.dismissedByGate[finding.id] = (split.dismissedByGate[finding.id] ?? 0) + 1;
         }
-        else if (includeHeuristics || isProven(finding))
+        else if (includeHeuristics || mustFix(finding))
             split.speaking.push(finding);
         else if (isMuted(outcomes[checkId(finding)]))
             split.muted++;

package/dist/review/quiet.test.js

@@ -15,6 +15,17 @@ describe('quiet by default', () => {
         expect(quiet.advisory.map(f => f.id)).toEqual(['promise-safety', 'file-size']);
         expect(quietSplit(dir, all, true).speaking).toHaveLength(5);
     });
+    it('speaks on what must be fixed, the one rule the stop hook and the push gate share: critical, or high and verified or from a security gate', () => {
+        const all = [
+            { ...finding('frontend-secret-exposure'), severity: 'high', provenance: 'security' },
+            { ...finding('promise-safety'), severity: 'high' },
+            { ...finding('promise-safety', 'verified'), severity: 'high', verified: true },
+            { ...finding('file-size'), severity: 'critical' },
+            finding('migration-order'),
+        ];
+        expect(quietSplit(dir, all).speaking.map(f => f.id)).toEqual(['frontend-secret-exposure', 'promise-safety', 'file-size', 'migration-order']);
+        expect(quietSplit(dir, all).advisory.map(f => f.details)).toEqual(['d']);
+    });
     it('never reports a dismissed finding again, even after its line moves', () => {
         const leak = finding('security-patterns', 'Hardcoded token in `client`');
         expect(dismissFinding(dir, findingKey(leak), 'test fixture token, never deployed')).toBe(true);

package/dist/review/review.d.ts

@@ -14,6 +14,8 @@ export interface ReviewInput {
     deep?: Omit<DeepOptions, 'focusLines' | 'removedLines' | 'diff'>;
     /** Read dismissals and check outcomes at this commit (the base), not as the change left them. */
     trustedRef?: string;
+    /** Run the typed checks (review/typed): the project's TypeScript program takes seconds, so at push, in `rigour review` and in a backtest, not at every stop. */
+    typed?: boolean;
 }
 export interface ReviewResult {
     status: 'PASS' | 'FAIL' | 'ERROR';
@@ -39,6 +41,10 @@ export interface ReviewResult {
     gateErrors: string[];
     /** rigour.yml or .rigour/ files this change edits: they steer the review, so they are called out. */
     controlFilesChanged: string[];
+    /** Candidates for the reviewer to confirm (a nested scan, a property that only leaves through serialisation), from the typed checks. */
+    hints: string[];
+    /** Why the typed checks could not run on a TypeScript project (`gateErrors` then names `typed-checks-unavailable`). */
+    typedError?: string;
 }
 export interface ReviewFinding {
     id: string;

package/dist/review/review.js

@@ -24,6 +24,10 @@ import { unusedExportFailures } from './unused-exports.js';
 import { queryPatternFailures } from './query-patterns.js';
 import { optionalParamFailures } from './optional-params.js';
 import { duplicateFunctionFailures } from './duplicate-functions.js';
+import { typedChecks, TYPED_CHECKS } from './typed/redundancy.js';
+import { loopCopyFailures } from './loop-copies.js';
+import { partialFixFailures } from './partial-fixes.js';
+import { partialWiringFailures } from './partial-wiring.js';
 import { isControlFile } from './trusted-state.js';
 import { baseCommit, baseFindings, splitIntroduced } from './baseline.js';
 export async function reviewChange(input) {
@@ -31,7 +35,7 @@ export async function reviewChange(input) {
     const changedLines = withoutGenerated(input.cwd, parseDiff(diff));
     const targets = input.files?.length ? input.files : Object.keys(changedLines);
     if (targets.length === 0) {
-        return { status: 'PASS', findings: [], fileFindings: [], contextFindings: [], advisory: [], muted: 0, dismissed: 0, dismissedByGate: {}, unlocated: 0, excludedOutsideChangedLines: 0, preexisting: 0, changedLines, report: null, gateErrors: [], controlFilesChanged: controlFiles(diff) };
+        return { status: 'PASS', findings: [], fileFindings: [], contextFindings: [], advisory: [], muted: 0, dismissed: 0, dismissedByGate: {}, unlocated: 0, excludedOutsideChangedLines: 0, preexisting: 0, changedLines, report: null, gateErrors: [], controlFilesChanged: controlFiles(diff), hints: [] };
     }
     const deep = input.deep ? { ...input.deep, focusLines: changedLinesByFile(changedLines), removedLines: removedByFile(diff), diff } : undefined;
     const report = await new GateRunner(input.config).run(input.cwd, await normalizeScopePatterns(input.cwd, targets), deep);
@@ -40,7 +44,11 @@ export async function reviewChange(input) {
         report.failures.push(...await diffTestFailures(input.cwd, input.source, deep));
     report.failures.push(...migrationOrderFailures(input.cwd, diff, input.source, input.config));
     report.failures.push(...unusedExportFailures(input.cwd, diff, input.config), ...orphanFileFailures(input.cwd, diff, input.config));
-    report.failures.push(...queryPatternFailures(input.cwd, changedLines, input.config), ...optionalParamFailures(input.cwd, changedLines, input.config), ...duplicateFunctionFailures(input.cwd, changedLines, input.config));
+    report.failures.push(...queryPatternFailures(input.cwd, changedLines, input.config), ...optionalParamFailures(input.cwd, changedLines, input.config), ...duplicateFunctionFailures(input.cwd, changedLines, input.config), ...loopCopyFailures(input.cwd, changedLines, input.config), ...partialFixFailures(input.cwd, changedLines, input.config), ...partialWiringFailures(input.cwd, changedLines, input.config));
+    const typed = input.typed ? typedChecks(input.cwd, changedLines, input.config) : { failures: [], hints: [] };
+    report.failures.push(...typed.failures);
+    if (typed.error)
+        report.summary[TYPED_CHECKS] = 'ERROR'; // a check that could not run is a crashed gate, never a pass
     const split = splitByChangedLines(report.failures, changedLines, deep ? changedFunctionSpans(input.cwd, changedLines) : {}, removedByFile(diff));
     const deepError = deepAnalysisError(report);
     const quiet = quietSplit(input.cwd, split.findings, input.config.review?.include_heuristics, input.trustedRef);
@@ -63,7 +71,9 @@ export async function reviewChange(input) {
         report,
         gateErrors,
         controlFilesChanged: controlFiles(diff),
+        hints: typed.hints,
         ...(deepError ? { deepError } : {}),
+        ...(typed.error ? { typedError: typed.error } : {}),
     };
 }
 /** Drop the rules' findings the base already had; returns how many. Model findings stay: the model reviews only the change. */

package/dist/review/reviewer/adapters.d.ts

@@ -0,0 +1,35 @@
+import type { Exec } from './exec.js';
+export type ReviewerName = 'claude' | 'cursor' | 'codex';
+export type Vendor = 'anthropic' | 'cursor' | 'openai';
+export type ReviewMode = 'single' | 'cross' | 'full';
+export interface Adapter {
+    vendor: Vendor;
+    binary: string;
+    /** The command line for one review: the prompt is passed as text, never through a shell. */
+    args(prompt: string, model: string | undefined): string[];
+    /** The reviewer's final message and, when the CLI reports it, what the run cost. */
+    answer(stdout: string): {
+        text: string;
+        costUsd?: number;
+    };
+}
+export declare const ADAPTERS: Record<ReviewerName, Adapter>;
+export declare function isReviewerName(name: string): name is ReviewerName;
+export interface Installed {
+    binary: string;
+    version: string;
+}
+/**
+ * The newest installed copy of the adapter's CLI, or undefined when none is. Several copies are
+ * common (an old global npm install first on PATH, a current one from Homebrew), and the old one
+ * refuses current models, so the version decides, not PATH order.
+ */
+export declare function resolveAdapter(adapter: Adapter, cwd: string, exec: Exec): Promise<Installed | undefined>;
+/** Which vendors wrote the commits, from their Co-Authored-By trailers. No trailer means a person. */
+export declare function vendorsOf(trailers: string): Set<Vendor>;
+/**
+ * The reviewers a run uses. single: the first available of the list. cross: the first available
+ * whose vendor is not on the trailers, else the first available. full: that one plus the first
+ * available of another vendor. Empty when none is installed.
+ */
+export declare function selectReviewers(candidates: ReviewerName[], mode: ReviewMode, authors: Set<Vendor>, available: Set<ReviewerName>): ReviewerName[];

package/dist/review/reviewer/adapters.js

@@ -0,0 +1,156 @@
+/**
+ * Reviewer adapters: the person's own coding-agent CLIs, each run headless and read-only on the
+ * same prompt. `review.reviewer.reviewers` is the contract (an explicit list, any vendors); the
+ * mode picks among it: `single` runs the first available (the default, and the fastest), `cross`
+ * prefers a vendor not on the commits' Co-Authored-By trailers, `full` runs two vendors and the
+ * verdicts are merged. Which mode earns its minutes is decided by the backtest ledger, which
+ * records the reviewer behind each catch, not by preference.
+ */
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+const READ_ONLY_TOOLS = ['Read', 'Grep', 'Glob', 'Bash(git diff:*)', 'Bash(git show:*)', 'Bash(git log:*)', 'Bash(git grep:*)'];
+export const ADAPTERS = {
+    claude: {
+        vendor: 'anthropic',
+        binary: 'claude',
+        // Isolated: no MCP servers, no hooks, no user-level settings (an output style or permission
+        // of the author's session must not shape the reviewer), read-only tools.
+        args: (prompt, model) => [
+            '-p', prompt,
+            ...(model ? ['--model', model] : []),
+            '--output-format', 'json',
+            '--max-turns', '80',
+            '--strict-mcp-config', '--mcp-config', '{"mcpServers":{}}',
+            '--setting-sources', 'project', '--settings', '{"hooks":{},"outputStyle":"default"}',
+            '--allowedTools', ...READ_ONLY_TOOLS,
+            '--disallowedTools', 'Edit', 'Write', 'NotebookEdit', 'Bash(git push:*)', 'Bash(git commit:*)',
+        ],
+        answer: stdout => {
+            try {
+                const parsed = JSON.parse(stdout);
+                return { text: String(parsed.result ?? ''), ...(typeof parsed.total_cost_usd === 'number' ? { costUsd: parsed.total_cost_usd } : {}) };
+            }
+            catch {
+                return { text: stdout };
+            }
+        },
+    },
+    cursor: {
+        vendor: 'cursor',
+        binary: 'cursor-agent',
+        // Ask mode is read-only and cannot run git: every input the prompt names is a file.
+        args: (prompt, model) => ['-p', '--print', '--output-format', 'json', '--trust', '--mode', 'ask', '--model', model ?? 'auto', prompt],
+        answer: stdout => {
+            try {
+                const pick = (o) => typeof o === 'string' ? o : o && typeof o === 'object' ? (Array.isArray(o) ? pick(o[o.length - 1]) : String(o.result ?? o.text ?? o.content ?? o.message ?? '')) : '';
+                return { text: pick(JSON.parse(stdout)) };
+            }
+            catch {
+                return { text: stdout };
+            }
+        },
+    },
+    codex: {
+        vendor: 'openai',
+        binary: 'codex',
+        args: (prompt, model) => ['exec', '--sandbox', 'read-only', '--json', ...(model ? ['--model', model] : []), '-c', 'model_reasoning_effort=high', prompt],
+        // `codex exec --json` streams events; the last text-bearing one carries the answer.
+        answer: stdout => {
+            let text = '';
+            for (const line of stdout.split('\n').filter(Boolean)) {
+                try {
+                    const event = JSON.parse(line);
+                    const candidate = event?.item?.text ?? event?.msg?.message ?? event?.text;
+                    if (typeof candidate === 'string')
+                        text = candidate;
+                }
+                catch {
+                    // not an event line
+                }
+            }
+            return { text: text || stdout };
+        },
+    },
+};
+export function isReviewerName(name) {
+    return name in ADAPTERS;
+}
+/** Where a CLI tends to be installed besides PATH: a global npm prefix, Homebrew, a user-local bin, the agent's own installer. */
+const EXTRA_BIN_DIRS = ['/opt/homebrew/bin', '/usr/local/bin', path.join(os.homedir(), '.local', 'bin'), path.join(os.homedir(), '.npm-global', 'bin'), path.join(os.homedir(), '.claude', 'local')];
+/**
+ * The newest installed copy of the adapter's CLI, or undefined when none is. Several copies are
+ * common (an old global npm install first on PATH, a current one from Homebrew), and the old one
+ * refuses current models, so the version decides, not PATH order.
+ */
+export async function resolveAdapter(adapter, cwd, exec) {
+    const names = process.platform === 'win32' ? [`${adapter.binary}.cmd`, `${adapter.binary}.exe`, adapter.binary] : [adapter.binary];
+    const dirs = [...(process.env.PATH ?? '').split(path.delimiter), ...EXTRA_BIN_DIRS].filter(Boolean);
+    const candidates = new Set();
+    for (const dir of dirs) {
+        for (const name of names) {
+            const candidate = path.join(dir, name);
+            if (executable(candidate))
+                candidates.add(candidate);
+        }
+    }
+    let best;
+    for (const binary of candidates) {
+        const result = await exec(binary, ['--version'], { cwd, timeoutMs: 20_000 });
+        if (result.exitCode !== 0)
+            continue;
+        const version = result.stdout.trim().split('\n')[0];
+        if (!best || newer(version, best.version))
+            best = { binary, version };
+    }
+    return best;
+}
+function executable(file) {
+    try {
+        fs.accessSync(file, process.platform === 'win32' ? fs.constants.F_OK : fs.constants.X_OK);
+        return fs.statSync(file).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/** `a` carries a higher dotted version than `b` (the first such run of digits in each line). */
+function newer(a, b) {
+    const parse = (line) => (line.match(/\d+(?:\.\d+)+/)?.[0] ?? '0').split('.').map(Number);
+    const [x, y] = [parse(a), parse(b)];
+    for (let i = 0; i < Math.max(x.length, y.length); i++) {
+        if ((x[i] ?? 0) !== (y[i] ?? 0))
+            return (x[i] ?? 0) > (y[i] ?? 0);
+    }
+    return false;
+}
+/** Which vendors wrote the commits, from their Co-Authored-By trailers. No trailer means a person. */
+export function vendorsOf(trailers) {
+    const vendors = new Set();
+    for (const line of trailers.toLowerCase().split('\n')) {
+        if (/claude/.test(line))
+            vendors.add('anthropic');
+        if (/cursor/.test(line))
+            vendors.add('cursor');
+        if (/codex|openai/.test(line))
+            vendors.add('openai');
+    }
+    return vendors;
+}
+/**
+ * The reviewers a run uses. single: the first available of the list. cross: the first available
+ * whose vendor is not on the trailers, else the first available. full: that one plus the first
+ * available of another vendor. Empty when none is installed.
+ */
+export function selectReviewers(candidates, mode, authors, available) {
+    const installed = candidates.filter(name => available.has(name));
+    if (installed.length === 0)
+        return [];
+    let first = installed[0];
+    if (mode !== 'single')
+        first = installed.find(name => !authors.has(ADAPTERS[name].vendor)) ?? first;
+    if (mode !== 'full')
+        return [first];
+    const second = installed.find(name => name !== first && ADAPTERS[name].vendor !== ADAPTERS[first].vendor);
+    return second ? [first, second] : [first];
+}

package/dist/review/reviewer/background.d.ts

@@ -0,0 +1,34 @@
+import type { Config } from '../../types/index.js';
+import { type ReviewerResult } from '../reviewer.js';
+import { type Exec } from './exec.js';
+import { type OpenItem } from './verdict.js';
+export interface BackgroundJob {
+    head: string;
+    branch: string;
+    base: string;
+}
+/**
+ * Starts `command` detached (its own process group, output to the branch's log) and records its
+ * pid; a job still running for the same branch is ended first. Returns the log path.
+ */
+export declare function startBackgroundReview(cwd: string, job: BackgroundJob, command: string[], exec?: Exec): Promise<string | undefined>;
+/** The detached process: review the commit in a worktree of its own, write the verdict, tell the person. */
+export declare function backgroundReview(cwd: string, job: BackgroundJob, config: Config, exec?: Exec, log?: (line: string) => void): Promise<ReviewerResult>;
+export interface ReviewStatus {
+    branch: string;
+    /** A review still running, and for which commit. */
+    running?: {
+        pid: number;
+        head: string;
+    };
+    /** The last verdict recorded for the branch. */
+    last?: {
+        head: string;
+        mode: 'full' | 'delta';
+        at: string;
+        open: OpenItem[];
+    };
+    log?: string;
+}
+/** What the background reviewer has done for a branch: running, the last verdict and its open items. */
+export declare function reviewStatus(cwd: string, branch: string, exec?: Exec): Promise<ReviewStatus | undefined>;