@rigour-labs/core 6.6.5 → 6.7.0

package/README.md

@@ -1,104 +1,28 @@
 # @rigour-labs/core
 
-[![npm version](https://img.shields.io/npm/v/@rigour-labs/core?color=cyan)](https://www.npmjs.com/package/@rigour-labs/core)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![npm version](https://img.shields.io/npm/v/@rigour-labs/core?color=4f46e5)](https://www.npmjs.com/package/@rigour-labs/core)
+[![License: MIT](https://img.shields.io/badge/license-MIT-facc15.svg)](https://opensource.org/licenses/MIT)
 
-**AI Agent Governance Engine — deterministic quality gates, drift detection, and LLM-powered deep analysis.**
+The engine behind [Rigour](https://github.com/rigour-labs/rigour): the checks, the review of a change, the
+reviewer that runs coding agents' own CLIs as judges, model review, local learning and the team database.
 
-The core library powering [Rigour](https://rigour.run) — 27+ quality gates, five-signal deep analysis pipeline, temporal drift engine, and AI agent DLP across TypeScript, JavaScript, Python, Go, Ruby, and C#/.NET.
+Most people want the command, [@rigour-labs/cli](https://www.npmjs.com/package/@rigour-labs/cli), or the MCP
+server, [@rigour-labs/mcp](https://www.npmjs.com/package/@rigour-labs/mcp). This package is for building on
+the engine.
 
-> This package is the engine. For the CLI, use [`@rigour-labs/cli`](https://www.npmjs.com/package/@rigour-labs/cli). For MCP integration, use [`@rigour-labs/mcp`](https://www.npmjs.com/package/@rigour-labs/mcp).
-
-## What's Inside
-
-### 27+ Deterministic Quality Gates
-
-**Structural:** File size, cyclomatic complexity, method count, parameter count, nesting depth, required docs, content hygiene.
-
-**Security:** Hardcoded secrets, SQL injection, XSS, command injection, path traversal, frontend secret exposure.
-
-**AI Drift Detection:**
-- **Three-pass duplication drift** — MD5 exact → AST Jaccard (tree-sitter) → semantic embedding (all-MiniLM-L6-v2, 384D cosine). Catches `.find()` vs `.filter()[0]` — same intent, different implementation.
-- **Hallucinated imports** — language-aware resolution for relative + package imports.
-- **Phantom APIs** — non-existent stdlib/framework methods the LLM invented.
-- **Style drift** — fingerprints naming, error handling, import style, quote preferences against project baseline.
-- **Logic drift** — tracks comparison operators (>= → >), branch counts, return statements per function across scans.
-- **Dependency bloat** — unused deps, heavy alternatives (moment→dayjs), duplicate purpose packages.
-- **Context-window artifacts**, inconsistent error handling, promise safety, deprecated APIs.
-
-**Semantic Bugs (type-aware, on by default):** a TypeScript program with the checker and cross-file value tracing proves a defect before reporting it: credentials forwarded on redirect, paged reads aggregated in memory, cached responses that can carry a failure fallback. Rules learned from fixes (`rigour learn`) run alongside them from `.rigour/rules/`.
-
-**Agent Governance:** Multi-agent scope isolation, EWMA-based checkpoint supervision, context drift, retry loop breaker, memory & skills governance with DLP scanning.
-
-### Real-Time Hook Engine
-
-Sub-200ms per-file-write checker with 5 fast gates (governance, hallucinated imports, promise safety, security patterns, file size). Generates native hook configs for Claude Code, Cursor, Cline, and Windsurf.
-
-### AI Agent DLP (Data Loss Prevention)
-
-29 credential patterns with anti-evasion hardening (unicode normalization, zero-width char removal, bidi control stripping, Shannon entropy detection >4.5 bits). Compliance-mapped to SOC2-CC6.1, HIPAA-164.312, PCI-DSS-3.4/3.5/6.5, OWASP-A2, CWE-798.
-
-### Five-Signal Deep Analysis Pipeline
-
-Rigour's deep analysis is not a wrapper around a generic LLM. The model operates within a cage of deterministic facts:
-
-1. **Extract** — five independent signal streams (AST facts, semantic embeddings, style fingerprints, logic baselines, dependency graphs) computed deterministically before the LLM sees anything.
-2. **Interpret** — the model receives structured facts (not raw source), focuses on SOLID, design patterns, language idioms, architecture. Constrained input prevents hallucination.
-3. **Verify** — every LLM finding is cross-referenced against all five signal streams. Wrong line numbers, phantom patterns, non-existent functions → discarded. Only verified findings with confidence scores reach the report.
-
-Deep review is built for frontier models: your own key, or the coding agent's own model. The small local models (lite and deep tiers fine-tuned via the [DriftBench RLAIF pipeline](https://github.com/rigour-labs/driftbench); max is the stock Qwen2.5-Coder-7B) remain available offline but are no longer developed.
-
-### Temporal Drift Engine (v5.1)
-
-Cross-session trend analysis powered by EWMA and Z-score anomaly detection. Tracks three independent provenance streams (AI drift, structural, security) with separate trend directions. Reads from the SQLite brain for month-over-month analysis.
-
-Key capabilities: per-provenance EWMA streams (alpha=0.3), Z-score anomaly detection (|Z| > 2.0), monthly/weekly rollups, semantic duplicate tracking, style + logic baseline evolution, human-readable narrative generation.
-
-### Multi-Language Support
-
-Hallucinated import detection supports 8 languages with stdlib whitelists and dependency manifest parsing: TypeScript, JavaScript, Python, Go, Ruby, C#/.NET, Rust, Java, and Kotlin. Core structural gates support all languages via AST analysis.
-
-### Two-Score System
-
-Every failure carries a **provenance tag** (`ai-drift`, `traditional`, `security`, `governance`) and contributes to two sub-scores:
-
-- **AI Health Score** (0–100) — AI-specific failures
-- **Structural Score** (0–100) — Traditional code quality
-
-### Fix Packets (v2)
-
-Machine-readable JSON diagnostics with severity, provenance, file, line number, and step-by-step remediation instructions that AI agents can consume directly.
-
-## Usage
-
-```typescript
-import { GateRunner } from '@rigour-labs/core';
-
-const runner = new GateRunner(config);
-const report = await runner.run(projectRoot);
-
-console.log(report.status);    // 'PASS' or 'FAIL'
-console.log(report.stats.score);     // 0-100
-console.log(report.failures);  // Failure[]
+```bash
+npm install @rigour-labs/core
 ```
 
-### With Deep Analysis
-
-```typescript
-import { GateRunner } from '@rigour-labs/core';
+```ts
+import { ConfigSchema, reviewChange } from '@rigour-labs/core';
 
-const runner = new GateRunner(config);
-const report = await runner.run(projectRoot, undefined, {
-  enabled: true,
-  pro: false,        // true for full-power model
-  provider: 'local', // or 'claude', 'openai', etc.
-});
+const config = ConfigSchema.parse({});   // or the parsed rigour.yml
+const result = await reviewChange({ cwd: process.cwd(), config, source: { mode: 'working' } });
+console.log(result.status, result.findings);
 ```
 
-## Documentation
-
-**[Full docs at docs.rigour.run](https://docs.rigour.run)**
-
-## License
+What each check finds and whether it blocks: [What Rigour checks](https://github.com/rigour-labs/rigour/blob/main/docs/CHECKS.md). Every setting:
+[Configuration reference](https://github.com/rigour-labs/rigour/blob/main/docs/CONFIG_REFERENCE.md). Node 22 or later.
 
 MIT © [Rigour Labs](https://github.com/rigour-labs)

package/dist/environment.test.js

@@ -14,7 +14,6 @@ describe('Environment Alignment Gate', () => {
     });
     it('should detect tool version mismatch (Explicit)', async () => {
         const rawConfig = {
-            version: 1,
             gates: {
                 environment: {
                     enabled: true,
@@ -36,7 +35,6 @@ describe('Environment Alignment Gate', () => {
     });
     it('should detect missing environment variables', async () => {
         const rawConfig = {
-            version: 1,
             gates: {
                 environment: {
                     enabled: true,
@@ -57,7 +55,6 @@ describe('Environment Alignment Gate', () => {
 ruff = ">=99.14.0"
 `);
         const rawConfig = {
-            version: 1,
             gates: {
                 environment: {
                     enabled: true,
@@ -77,7 +74,6 @@ ruff = ">=99.14.0"
     });
     it('should prioritize environment gate and run it first', async () => {
         const rawConfig = {
-            version: 1,
             gates: {
                 max_file_lines: 1,
                 environment: {

package/dist/gates/agent-team.d.ts

@@ -26,8 +26,6 @@ export interface AgentTeamSession {
 export interface AgentTeamConfig {
     enabled?: boolean;
     max_concurrent_agents?: number;
-    cross_agent_pattern_check?: boolean;
-    handoff_verification?: boolean;
     task_ownership?: 'strict' | 'collaborative';
 }
 /**

package/dist/gates/agent-team.js

@@ -114,8 +114,6 @@ export class AgentTeamGate extends Gate {
         this.config = {
             enabled: config.enabled ?? false,
             max_concurrent_agents: config.max_concurrent_agents ?? 3,
-            cross_agent_pattern_check: config.cross_agent_pattern_check ?? true,
-            handoff_verification: config.handoff_verification ?? true,
             task_ownership: config.task_ownership ?? 'strict',
         };
     }
@@ -148,12 +146,6 @@ export class AgentTeamGate extends Gate {
                 }
             }
         }
-        // Check 3: Cross-agent pattern detection (if enabled)
-        if (this.config.cross_agent_pattern_check && context.record) {
-            // This would integrate with the Pattern Index to detect conflicting patterns
-            // For now, we log that we would do this check
-            Logger.debug('Cross-agent pattern check: would analyze patterns across agent scopes');
-        }
         return failures;
     }
 }

package/dist/gates/checkpoint.d.ts

@@ -44,7 +44,6 @@ export interface CheckpointConfig {
     interval_minutes?: number;
     quality_threshold?: number;
     drift_detection?: boolean;
-    auto_save_on_failure?: boolean;
     /** EWMA smoothing factor. Higher = more weight on recent data. Default 0.3 */
     ewma_alpha?: number;
     /** Drop from EWMA that triggers drift warning. Default 15 */

package/dist/gates/checkpoint.js

@@ -256,7 +256,6 @@ export class CheckpointGate extends Gate {
             interval_minutes: config.interval_minutes ?? 15,
             quality_threshold: config.quality_threshold ?? 80,
             drift_detection: config.drift_detection ?? true,
-            auto_save_on_failure: config.auto_save_on_failure ?? true,
             ewma_alpha: config.ewma_alpha ?? 0.3,
             drift_drop_threshold: config.drift_drop_threshold ?? 15,
         };

package/dist/gates/context.d.ts

@@ -8,10 +8,6 @@ export interface ExtendedContextConfig {
     enabled?: boolean;
     sensitivity?: number;
     mining_depth?: number;
-    cross_file_patterns?: boolean;
-    naming_consistency?: boolean;
-    import_relationships?: boolean;
-    max_cross_file_depth?: number;
 }
 export declare class ContextGate extends Gate {
     private config;

package/dist/gates/context.js

@@ -13,10 +13,6 @@ export class ContextGate extends Gate {
             enabled: config.context?.enabled ?? false,
             sensitivity: config.context?.sensitivity ?? 0.8,
             mining_depth: config.context?.mining_depth ?? 100,
-            cross_file_patterns: true, // Default ON for frontier model support
-            naming_consistency: true,
-            import_relationships: true,
-            max_cross_file_depth: 50,
         };
     }
     get provenance() { return 'ai-drift'; }
@@ -42,22 +38,16 @@ export class ContextGate extends Gate {
                 const codeContent = this.stripComments(content);
                 // 1. Original: Detect Redundant Suffixes (The Golden Example)
                 this.checkEnvDrift(codeContent, file, envAnchors, failures);
-                // 2. NEW: Cross-file pattern collection
-                if (this.extendedConfig.cross_file_patterns) {
-                    this.collectNamingPatterns(codeContent, file, namingPatterns);
-                    this.collectImportPatterns(codeContent, file, importPatterns);
-                }
+                // 2. Cross-file pattern collection
+                this.collectNamingPatterns(codeContent, file, namingPatterns);
+                this.collectImportPatterns(codeContent, file, importPatterns);
             }
             catch (e) { }
         }
-        // 3. NEW: Analyze naming consistency across files
-        if (this.extendedConfig.naming_consistency) {
-            this.analyzeNamingConsistency(namingPatterns, failures);
-        }
-        // 4. NEW: Analyze import relationship patterns
-        if (this.extendedConfig.import_relationships) {
-            this.analyzeImportPatterns(importPatterns, failures);
-        }
+        // 3. Naming consistency across files
+        this.analyzeNamingConsistency(namingPatterns, failures);
+        // 4. Import relationship patterns
+        this.analyzeImportPatterns(importPatterns, failures);
         // Cross-file patterns need the whole repo, but a scoped run reports
         // only findings that cite a file in scope.
         if (isScoped(context.patterns)) {

package/dist/gates/deep-analysis.d.ts

@@ -20,7 +20,6 @@ import { type LessonMode } from '../review-learning/team-lessons.js';
 export interface DeepGateConfig {
     options: DeepOptions;
     checks?: Record<string, boolean>;
-    threads?: number;
     maxTokens?: number;
     temperature?: number;
     timeoutMs?: number;

package/dist/gates/deep-runner.js

@@ -16,7 +16,6 @@ export async function runDeepAnalysis(config, context, deepOptions) {
     const deepGate = new DeepAnalysisGate({
         options: deepOptions,
         checks: config.gates.deep?.checks,
-        threads: config.gates.deep?.threads,
         maxTokens: config.gates.deep?.max_tokens,
         temperature: config.gates.deep?.temperature,
         timeoutMs: config.gates.deep?.timeout_ms,

package/dist/gates/frontend-secret-exposure.d.ts

@@ -54,5 +54,5 @@ export declare class FrontendSecretExposureGate extends Gate {
     private isDummyValue;
     private toFailures;
 }
-/** Imports a Node-only module: server code, whatever its path. */
+/** Imports a Node-only module (a built-in, or a package that spawns processes): server code, whatever its path. */
 export declare function importsNodeBuiltins(content: string): boolean;

package/dist/gates/frontend-secret-exposure.js

@@ -66,8 +66,14 @@ export class FrontendSecretExposureGate extends Gate {
                 // Any tool config at the repository root runs in Node, never in a browser bundle.
                 '^[^/]+\\.config\\.[cm]?[jt]s$',
                 '\\.server\\.(?:ts|tsx|js|jsx|mjs|cjs)$',
-                // SvelteKit endpoints (`+server.ts`) are server-only.
+                // SvelteKit endpoints (`+server.ts`) and `src/lib/server/` are server-only.
                 '(^|/)\\+server\\.[cm]?[jt]s$',
+                '(^|/)src/lib/server/',
+                // Serverless functions and workers run on the platform, never in a browser bundle.
+                '(^|/)netlify/(?:functions|edge-functions)/',
+                '(^|/)supabase/functions/',
+                '^api/',
+                '(^|/)(?:functions|lambdas?|workers?|cron|jobs)/',
                 ...(config.server_path_patterns ?? []),
             ],
             allowlist_env_names: config.allowlist_env_names ?? [],
@@ -254,8 +260,8 @@ export class FrontendSecretExposureGate extends Gate {
         return failures;
     }
 }
-const NODE_BUILTINS = /(?:from\s+|require\(\s*|import\(\s*)['"](?:node:[\w/]+|fs|fs\/promises|fs-extra|child_process|os|net|tls|worker_threads|cluster|module)['"]/;
-/** Imports a Node-only module: server code, whatever its path. */
+const NODE_BUILTINS = /(?:from\s+|require\(\s*|import\(\s*)['"](?:node:[\w/]+|fs|fs\/promises|fs-extra|child_process|os|net|tls|worker_threads|cluster|module|execa|cross-spawn)['"]/;
+/** Imports a Node-only module (a built-in, or a package that spawns processes): server code, whatever its path. */
 export function importsNodeBuiltins(content) {
     return NODE_BUILTINS.test(content);
 }

package/dist/gates/frontend-secret-exposure.test.js

@@ -40,15 +40,18 @@ describe('FrontendSecretExposureGate', () => {
     });
     it('treats a file outside frontend paths that imports Node built-ins as server code', async () => {
         const cli = path.join(testDir, 'packages/cli/src/commands/post.ts');
+        const spawner = path.join(testDir, 'packages/core/src/exec.ts');
         const shared = path.join(testDir, 'packages/shared/src/config.ts');
         const component = path.join(testDir, 'src/components/Admin.tsx');
-        for (const file of [cli, shared, component])
+        for (const file of [cli, spawner, shared, component])
             fs.mkdirSync(path.dirname(file), { recursive: true });
         fs.writeFileSync(cli, "import { execFileSync } from 'child_process';\nexport const token = process.env.GITHUB_TOKEN;\n");
+        fs.writeFileSync(spawner, "import { execa } from 'execa';\nexport const env = { GH_TOKEN: process.env.GH_TOKEN };\n");
         fs.writeFileSync(shared, 'export const token = process.env.GITHUB_TOKEN;\n');
         fs.writeFileSync(component, "import fs from 'node:fs';\nexport const key = process.env.STRIPE_SECRET_KEY;\n");
         const files = (await new FrontendSecretExposureGate().run({ cwd: testDir })).flatMap(f => f.files ?? []);
         expect(files).not.toContain('packages/cli/src/commands/post.ts'); // Node-only: never bundled
+        expect(files).not.toContain('packages/core/src/exec.ts'); // a package that spawns processes is Node-only too
         expect(files).toContain('packages/shared/src/config.ts'); // could be bundled: still flagged
         expect(files).toContain('src/components/Admin.tsx'); // a frontend path stays frontend
     });
@@ -94,9 +97,9 @@ describe('FrontendSecretExposureGate', () => {
         expect(await gate.run({ cwd: testDir })).toHaveLength(0);
     });
     it('ignores shell files even when a broad project scan passes them in', async () => {
-        const shellPath = path.join(testDir, 'scripts/rigour-nmc.sh');
+        const shellPath = path.join(testDir, 'scripts/rigour-team.sh');
         fs.mkdirSync(path.dirname(shellPath), { recursive: true });
-        fs.writeFileSync(shellPath, 'node -e "process.env.RIGOUR_NMC_DATABASE_URL"');
+        fs.writeFileSync(shellPath, 'node -e "process.env.APP_DATABASE_URL"');
         const gate = new FrontendSecretExposureGate();
         expect(await gate.run({ cwd: testDir, patterns: ['**/*'] })).toHaveLength(0);
     });

package/dist/gates/hallucinated-imports/index.d.ts

@@ -27,8 +27,6 @@ export interface HallucinatedImport {
 }
 export interface HallucinatedImportsConfig {
     enabled?: boolean;
-    check_relative?: boolean;
-    check_packages?: boolean;
     ignore_patterns?: string[];
 }
 export declare class HallucinatedImportsGate extends Gate {

package/dist/gates/hallucinated-imports/index.js

@@ -33,8 +33,6 @@ export class HallucinatedImportsGate extends Gate {
         super('hallucinated-imports', 'Hallucinated Import Detection');
         this.config = {
             enabled: config.enabled ?? true,
-            check_relative: config.check_relative ?? true,
-            check_packages: config.check_packages ?? true,
             ignore_patterns: config.ignore_patterns ?? [
                 '\\.css$', '\\.scss$', '\\.less$', '\\.svg$', '\\.png$', '\\.jpg$',
                 '\\.json$', '\\.wasm$', '\\.graphql$', '\\.gql$',
@@ -70,6 +68,8 @@ export class HallucinatedImportsGate extends Gate {
         const allProjectFiles = projectFiles;
         const packageJson = await loadPackageJson(context.cwd);
         const rootDeps = new Set([
+            // A package importing itself by its own name (type tests, examples) is Node's self-reference.
+            ...(typeof packageJson?.name === 'string' ? [packageJson.name] : []),
             ...Object.keys(packageJson?.dependencies || {}),
             ...Object.keys(packageJson?.devDependencies || {}),
             ...Object.keys(packageJson?.peerDependencies || {}),

package/dist/gates/hallucinated-imports/js-resolver.js

@@ -180,6 +180,7 @@ export async function resolveJSDepsForFile(file, cwd, rootDeps, depCacheByDir) {
                 const packageJson = await fs.readJson(packageJsonPath);
                 const deps = new Set([
                     ...rootDeps,
+                    ...(typeof packageJson?.name === 'string' ? [packageJson.name] : []),
                     ...Object.keys(packageJson?.dependencies || {}),
                     ...Object.keys(packageJson?.devDependencies || {}),
                     ...Object.keys(packageJson?.peerDependencies || {}),

package/dist/gates/hallucinated-imports.test.js

@@ -423,6 +423,16 @@ import { cfg } from '~shared/config';
         expect(details.includes("Path alias '@/utils/missing' does not resolve to a project file")
             || details.includes("Package '@/utils' not in package.json dependencies")).toBe(true);
     });
+    it('should NOT flag a package importing itself by its own name (type tests, examples), and still flag an undeclared one', async () => {
+        FileScanner.findFiles.mockResolvedValue(['test-d/types.ts']);
+        mockReadFile.mockResolvedValue(`import ky from 'ky';\nimport left from 'left-pad';\n`);
+        mockPathExists.mockImplementation(async (p) => normalizePath(p) === `${testCwdNormalized}/package.json`);
+        mockReadJson.mockResolvedValue({ name: 'ky', dependencies: {}, devDependencies: {} });
+        const failures = await gate.run(context);
+        const details = failures.map(f => f.details).join('\n');
+        expect(details).not.toContain("Package 'ky'");
+        expect(details).toContain("Package 'left-pad' not in package.json dependencies");
+    });
     it('should resolve configured aliases to hidden generated files', async () => {
         const jsContent = `import { docs } from '@/.source';`;
         const tsconfigContent = `{

package/dist/gates/runner.js

@@ -1,6 +1,7 @@
 import { SEVERITY_WEIGHTS } from '../types/index.js';
 import { runDeepAnalysis } from './deep-runner.js';
 import { persistAndReinforce } from '../storage/local-memory.js';
+import { splitCommand } from '../utils/command-line.js';
 import { recordGateRun } from '../services/adaptive-thresholds.js';
 import { FileGate } from './file.js';
 import { ContentGate } from './content.js';
@@ -71,7 +72,7 @@ export class GateRunner {
         if (this.config.gates.checkpoint?.enabled) {
             this.gates.push(new CheckpointGate(this.config.gates.checkpoint));
         }
-        // Semantic Bugs Gate (type-aware, proven findings) — opt-in until field-validated
+        // Semantic Bugs Gate (type-aware, proven findings); on by default, `enabled: false` turns it off
         if (this.config.gates.semantic_bugs?.enabled) {
             this.gates.push(new SemanticBugsGate(this.config.gates.semantic_bugs));
         }
@@ -192,9 +193,7 @@ export class GateRunner {
                 }
                 try {
                     Logger.info(`Running command gate: ${key} (${cmd})`);
-                    const parts = cmd.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || [cmd];
-                    const bin = parts[0];
-                    const args = parts.slice(1).map(a => a.replace(/^["']|["']$/g, ''));
+                    const { bin, args } = splitCommand(cmd);
                     await execa(bin, args, { cwd });
                     summary[key] = 'PASS';
                 }

package/dist/gates/test-quality-matchers.d.ts

@@ -35,10 +35,6 @@ export declare const JS_TAUTOLOGICAL_PATTERNS: RegExp[];
  * Variable tautology pattern for JavaScript
  */
 export declare const JS_VAR_TAUTOLOGY_PATTERN: RegExp;
-/**
- * Snapshot test patterns
- */
-export declare const SNAPSHOT_PATTERNS: RegExp[];
 /**
  * Python tautological patterns
  */

package/dist/gates/test-quality-matchers.js

@@ -64,13 +64,6 @@ export const JS_TAUTOLOGICAL_PATTERNS = [
  * Variable tautology pattern for JavaScript
  */
 export const JS_VAR_TAUTOLOGY_PATTERN = /expect\s*\(\s*(\w+)\s*\)\s*\.(?:toBe|toEqual|toStrictEqual)\s*\(\s*(\w+)\s*\)/;
-/**
- * Snapshot test patterns
- */
-export const SNAPSHOT_PATTERNS = [
-    /\.toMatchSnapshot\s*\(/,
-    /\.toMatchInlineSnapshot\s*\(/,
-];
 /**
  * Python tautological patterns
  */

package/dist/gates/test-quality.d.ts

@@ -33,10 +33,8 @@ export interface TestQualityConfig {
     check_empty_tests?: boolean;
     check_tautological?: boolean;
     check_mock_heavy?: boolean;
-    check_snapshot_abuse?: boolean;
     check_assertion_free_async?: boolean;
     max_mocks_per_test?: number;
-    ignore_patterns?: string[];
 }
 export declare class TestQualityGate extends Gate {
     private config;

package/dist/gates/test-quality.js

@@ -25,7 +25,7 @@ import { FileScanner } from '../utils/scanner.js';
 import { Logger } from '../utils/logger.js';
 import { languageAdapters } from './language-adapters/index.js';
 import { checkGoTestQuality, checkJavaKotlinTestQuality } from './test-quality-lang.js';
-import { JS_TEST_START_PATTERN, JS_ASSERTION_PATTERNS, JS_MOCK_PATTERNS, JS_TAUTOLOGICAL_PATTERNS, JS_VAR_TAUTOLOGY_PATTERN, SNAPSHOT_PATTERNS, PYTHON_TEST_FUNC_PATTERN, PYTHON_ASSERTION_PATTERNS, PYTHON_MOCK_PATTERNS, PYTHON_TAUTOLOGICAL_PATTERNS, PYTHON_FIXTURE_PATTERN, PYTHON_CONFTEST_NAME, } from './test-quality-matchers.js';
+import { JS_TEST_START_PATTERN, JS_ASSERTION_PATTERNS, JS_MOCK_PATTERNS, JS_TAUTOLOGICAL_PATTERNS, JS_VAR_TAUTOLOGY_PATTERN, PYTHON_TEST_FUNC_PATTERN, PYTHON_ASSERTION_PATTERNS, PYTHON_MOCK_PATTERNS, PYTHON_TAUTOLOGICAL_PATTERNS, PYTHON_FIXTURE_PATTERN, PYTHON_CONFTEST_NAME, } from './test-quality-matchers.js';
 import fs from 'fs-extra';
 import path from 'path';
 export class TestQualityGate extends Gate {
@@ -37,10 +37,8 @@ export class TestQualityGate extends Gate {
             check_empty_tests: config.check_empty_tests ?? true,
             check_tautological: config.check_tautological ?? true,
             check_mock_heavy: config.check_mock_heavy ?? true,
-            check_snapshot_abuse: config.check_snapshot_abuse ?? true,
             check_assertion_free_async: config.check_assertion_free_async ?? true,
             max_mocks_per_test: config.max_mocks_per_test ?? 5,
-            ignore_patterns: config.ignore_patterns ?? [],
         };
     }
     get provenance() { return 'ai-drift'; }
@@ -200,13 +198,6 @@ export class TestQualityGate extends Gate {
                         });
                     }
                 }
-                // Check for snapshot-only tests
-                if (this.config.check_snapshot_abuse) {
-                    if (SNAPSHOT_PATTERNS.some(p => p.test(line))) {
-                        // This is fine IF there are also semantic assertions
-                        // We'll check when the block ends
-                    }
-                }
                 // End of test block
                 if (braceDepth === 0) {
                     this.analyzeJSTestBlock(testBlockContent, file, testStartLine, mockCount, hasAssertion, hasAwait, isAsync, issues);

package/dist/hooks/checker.js

@@ -40,7 +40,7 @@ async function loadConfig(cwd) {
         const raw = yaml.parse(await fs.readFile(configPath, 'utf-8'));
         return ConfigSchema.parse(raw);
     }
-    return ConfigSchema.parse({ version: 1 });
+    return ConfigSchema.parse({});
 }
 /**
  * Resolve a file path to absolute, read its content, and return metadata.

package/dist/hooks/index.d.ts

@@ -6,14 +6,13 @@ export { runHookChecker } from './checker.js';
 export type { CheckerOptions } from './checker.js';
 export { generateHookFiles, pushGateShell } from './templates.js';
 export type { GeneratedHookFile } from './templates.js';
-export type { HookTool, HookConfig, HookCheckerResult } from './types.js';
-export { DEFAULT_HOOK_CONFIG, FAST_GATE_IDS } from './types.js';
+export type { HookTool, HookCheckerResult } from './types.js';
 export { scanInputForCredentials, formatDLPAlert, createDLPAuditEntry } from './input-validator.js';
 export type { CredentialDetection, InputValidationResult, InputValidationConfig } from './input-validator.js';
 export { recordDLPFeedback, allowLastDLPBlock, writeDLPBlockManifest, getLearnedAllowCount, loadDLPFeedbackStore, loadDLPFeedbackStoreSync, fingerprintDetection, } from './dlp-feedback.js';
 export type { DLPFeedbackEntry, DLPFeedbackStore, DLPBlockManifest } from './dlp-feedback.js';
 export { generateDLPHookFiles } from './dlp-templates.js';
 export type { GeneratedDLPHookFile } from './dlp-templates.js';
-export { stopReview, stopMessage, blocksStop, STOP_MAX_ATTEMPTS } from './stop-review.js';
+export { stopReview, stopMessage, STOP_MAX_ATTEMPTS } from './stop-review.js';
 export type { StopDecision } from './stop-review.js';
 export { recordSessionBaseline, sessionBaseline, nextStopAttempt, clearStopAttempts, workFingerprint, alreadyReviewed, recordReviewed } from './session-state.js';

package/dist/hooks/index.js

@@ -4,11 +4,10 @@
  */
 export { runHookChecker } from './checker.js';
 export { generateHookFiles, pushGateShell } from './templates.js';
-export { DEFAULT_HOOK_CONFIG, FAST_GATE_IDS } from './types.js';
 // DLP (Data Loss Prevention) — v4.2.0
 export { scanInputForCredentials, formatDLPAlert, createDLPAuditEntry } from './input-validator.js';
 export { recordDLPFeedback, allowLastDLPBlock, writeDLPBlockManifest, getLearnedAllowCount, loadDLPFeedbackStore, loadDLPFeedbackStoreSync, fingerprintDetection, } from './dlp-feedback.js';
 export { generateDLPHookFiles } from './dlp-templates.js';
 // Stop review ("before you say done")
-export { stopReview, stopMessage, blocksStop, STOP_MAX_ATTEMPTS } from './stop-review.js';
+export { stopReview, stopMessage, STOP_MAX_ATTEMPTS } from './stop-review.js';
 export { recordSessionBaseline, sessionBaseline, nextStopAttempt, clearStopAttempts, workFingerprint, alreadyReviewed, recordReviewed } from './session-state.js';

package/dist/hooks/stop-review.d.ts

@@ -6,13 +6,12 @@
  * letting it finish. A review with nothing to look at says so; it is never
  * reported as a clean pass.
  *
- * Only findings that deserve it block: critical ones, high ones that are proven
- * (the semantic engine traced them) or security findings, findings the change added that are
- * certain from the code alone (MUST_FIX: dead code, offset paging, an unbounded window, a
- * duplicate function), and on a branch a merge conflict with main or a mention of a file the
- * branch deleted (review/branch-checks.ts).
- * A high heuristic (a regex that sees `fetch` without `.catch`) is not enough to
- * hold an agent back; callers also cap the number of attempts.
+ * What blocks is what the review itself reports (review/quiet.ts `mustFix`: proven, critical, or
+ * high and verified or from a security gate), plus on a branch a merge conflict with main or a
+ * mention of a file the branch deleted (review/branch-checks.ts). The same rule decides the push
+ * gate, so a stop, a review and a push never disagree about a finding. A high heuristic (a regex
+ * that sees `fetch` without `.catch`) is not enough to hold an agent back; callers also cap the
+ * number of attempts.
  */
 import type { Config, Failure } from '../types/index.js';
 import { type ReviewTaskItem } from '../review/review-task.js';
@@ -31,6 +30,4 @@ export interface StopDecision {
 /** `sessionBaseline`: the commit the session started from, used on main (session-state.ts). */
 export declare function stopReview(cwd: string, config: Config, attempt: number, sessionBaseline?: string): Promise<StopDecision>;
 export declare function reviewAckMessage(items: ReviewTaskItem[], attempt: number): string;
-/** Critical; high and either proven by the semantic engine or a security finding; or a certain, local finding the change added (MUST_FIX). */
-export declare function blocksStop(finding: Failure): boolean;
 export declare function stopMessage(findings: Failure[], attempt: number): string;

package/dist/hooks/stop-review.js

@@ -22,7 +22,11 @@ export async function stopReview(cwd, config, attempt, sessionBaseline) {
     const result = await reviewChange({ cwd, config, diff, source });
     const branch = branchBase(cwd);
     const whole = branch && !branch.onMain ? branchFailures(cwd, branch.base, branch.mainRef, config) : [];
-    const blocking = [...result.findings.filter(blocksStop), ...whole];
+    // A check that could not run is never a pass; the attempt cap keeps a broken environment from looping forever.
+    const crashed = result.status === 'ERROR'
+        ? result.gateErrors.map(id => ({ id, title: 'A check could not run', details: id === 'typed-checks-unavailable' && result.typedError ? result.typedError : `${id} crashed instead of running`, severity: 'high', files: [], hint: 'Fix the environment (dependencies, generated config), then try again.' }))
+        : [];
+    const blocking = [...result.findings, ...whole, ...crashed];
     const unreviewed = config.hooks?.require_review_ack ? buildReviewTask(cwd, diff, config.gates.deep?.router).items : [];
     const reviewed = { findings: result.findings, reviewedFiles: Object.keys(result.changedLines), against };
     if (blocking.length === 0 && unreviewed.length === 0)
@@ -41,15 +45,6 @@ export function reviewAckMessage(items, attempt) {
         ...listed,
     ].join('\n');
 }
-/** Certain from the code alone, and quick to fix (each measured with no false alarms before it blocks). */
-const MUST_FIX = new Set(['unused-export', 'orphan-file', 'offset-paging', 'unbounded-window', 'duplicate-function', 'partial-fix', 'partial-wiring']);
-/** Critical; high and either proven by the semantic engine or a security finding; or a certain, local finding the change added (MUST_FIX). */
-export function blocksStop(finding) {
-    const severity = (finding.severity || 'medium');
-    if (severity === 'critical' || MUST_FIX.has(finding.id))
-        return true;
-    return severity === 'high' && (finding.verified === true || finding.provenance === 'security');
-}
 export function stopMessage(findings, attempt) {
     const listed = findings.slice(0, MAX_LISTED).map(f => {
         const where = `${f.files?.[0] ?? '?'}:${f.line ?? '?'}`;

package/dist/hooks/types.d.ts

@@ -6,20 +6,6 @@
  *
  */
 export type HookTool = 'claude' | 'cursor' | 'cline' | 'windsurf';
-export interface HookConfig {
-    /** Which tools to generate hooks for */
-    tools: HookTool[];
-    /** Gates to run in the hook checker (fast subset) */
-    fast_gates: string[];
-    /** Max execution time in ms before the checker aborts */
-    timeout_ms: number;
-    /** Whether to block the tool on failure (exit 2) or just warn */
-    block_on_failure: boolean;
-}
-/** The fast gates that can run per-file in <200ms */
-export declare const FAST_GATE_IDS: readonly ["file-guard", "governance", "hallucinated-imports", "promise-safety", "security-patterns", "file-size"];
-export declare const DEFAULT_HOOK_CONFIG: HookConfig;
-export type FastGateId = typeof FAST_GATE_IDS[number];
 export interface HookCheckerResult {
     status: 'pass' | 'fail' | 'error';
     failures: Array<{