@rigour-labs/core 6.6.6 → 6.7.0

package/README.md

@@ -1,104 +1,28 @@
 # @rigour-labs/core
 
-[![npm version](https://img.shields.io/npm/v/@rigour-labs/core?color=cyan)](https://www.npmjs.com/package/@rigour-labs/core)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![npm version](https://img.shields.io/npm/v/@rigour-labs/core?color=4f46e5)](https://www.npmjs.com/package/@rigour-labs/core)
+[![License: MIT](https://img.shields.io/badge/license-MIT-facc15.svg)](https://opensource.org/licenses/MIT)
 
-**AI Agent Governance Engine — deterministic quality gates, drift detection, and LLM-powered deep analysis.**
+The engine behind [Rigour](https://github.com/rigour-labs/rigour): the checks, the review of a change, the
+reviewer that runs coding agents' own CLIs as judges, model review, local learning and the team database.
 
-The core library powering [Rigour](https://rigour.run) — 27+ quality gates, five-signal deep analysis pipeline, temporal drift engine, and AI agent DLP across TypeScript, JavaScript, Python, Go, Ruby, and C#/.NET.
+Most people want the command, [@rigour-labs/cli](https://www.npmjs.com/package/@rigour-labs/cli), or the MCP
+server, [@rigour-labs/mcp](https://www.npmjs.com/package/@rigour-labs/mcp). This package is for building on
+the engine.
 
-> This package is the engine. For the CLI, use [`@rigour-labs/cli`](https://www.npmjs.com/package/@rigour-labs/cli). For MCP integration, use [`@rigour-labs/mcp`](https://www.npmjs.com/package/@rigour-labs/mcp).
-
-## What's Inside
-
-### 27+ Deterministic Quality Gates
-
-**Structural:** File size, cyclomatic complexity, method count, parameter count, nesting depth, required docs, content hygiene.
-
-**Security:** Hardcoded secrets, SQL injection, XSS, command injection, path traversal, frontend secret exposure.
-
-**AI Drift Detection:**
-- **Three-pass duplication drift** — MD5 exact → AST Jaccard (tree-sitter) → semantic embedding (all-MiniLM-L6-v2, 384D cosine). Catches `.find()` vs `.filter()[0]` — same intent, different implementation.
-- **Hallucinated imports** — language-aware resolution for relative + package imports.
-- **Phantom APIs** — non-existent stdlib/framework methods the LLM invented.
-- **Style drift** — fingerprints naming, error handling, import style, quote preferences against project baseline.
-- **Logic drift** — tracks comparison operators (>= → >), branch counts, return statements per function across scans.
-- **Dependency bloat** — unused deps, heavy alternatives (moment→dayjs), duplicate purpose packages.
-- **Context-window artifacts**, inconsistent error handling, promise safety, deprecated APIs.
-
-**Semantic Bugs (type-aware, on by default):** a TypeScript program with the checker and cross-file value tracing proves a defect before reporting it: credentials forwarded on redirect, paged reads aggregated in memory, cached responses that can carry a failure fallback. Rules learned from fixes (`rigour learn`) run alongside them from `.rigour/rules/`.
-
-**Agent Governance:** Multi-agent scope isolation, EWMA-based checkpoint supervision, context drift, retry loop breaker, memory & skills governance with DLP scanning.
-
-### Real-Time Hook Engine
-
-Sub-200ms per-file-write checker with 5 fast gates (governance, hallucinated imports, promise safety, security patterns, file size). Generates native hook configs for Claude Code, Cursor, Cline, and Windsurf.
-
-### AI Agent DLP (Data Loss Prevention)
-
-29 credential patterns with anti-evasion hardening (unicode normalization, zero-width char removal, bidi control stripping, Shannon entropy detection >4.5 bits). Compliance-mapped to SOC2-CC6.1, HIPAA-164.312, PCI-DSS-3.4/3.5/6.5, OWASP-A2, CWE-798.
-
-### Five-Signal Deep Analysis Pipeline
-
-Rigour's deep analysis is not a wrapper around a generic LLM. The model operates within a cage of deterministic facts:
-
-1. **Extract** — five independent signal streams (AST facts, semantic embeddings, style fingerprints, logic baselines, dependency graphs) computed deterministically before the LLM sees anything.
-2. **Interpret** — the model receives structured facts (not raw source), focuses on SOLID, design patterns, language idioms, architecture. Constrained input prevents hallucination.
-3. **Verify** — every LLM finding is cross-referenced against all five signal streams. Wrong line numbers, phantom patterns, non-existent functions → discarded. Only verified findings with confidence scores reach the report.
-
-Deep review is built for frontier models: your own key, or the coding agent's own model. The small local models (lite and deep tiers fine-tuned via the [DriftBench RLAIF pipeline](https://github.com/rigour-labs/driftbench); max is the stock Qwen2.5-Coder-7B) remain available offline but are no longer developed.
-
-### Temporal Drift Engine (v5.1)
-
-Cross-session trend analysis powered by EWMA and Z-score anomaly detection. Tracks three independent provenance streams (AI drift, structural, security) with separate trend directions. Reads from the SQLite brain for month-over-month analysis.
-
-Key capabilities: per-provenance EWMA streams (alpha=0.3), Z-score anomaly detection (|Z| > 2.0), monthly/weekly rollups, semantic duplicate tracking, style + logic baseline evolution, human-readable narrative generation.
-
-### Multi-Language Support
-
-Hallucinated import detection supports 8 languages with stdlib whitelists and dependency manifest parsing: TypeScript, JavaScript, Python, Go, Ruby, C#/.NET, Rust, Java, and Kotlin. Core structural gates support all languages via AST analysis.
-
-### Two-Score System
-
-Every failure carries a **provenance tag** (`ai-drift`, `traditional`, `security`, `governance`) and contributes to two sub-scores:
-
-- **AI Health Score** (0–100) — AI-specific failures
-- **Structural Score** (0–100) — Traditional code quality
-
-### Fix Packets (v2)
-
-Machine-readable JSON diagnostics with severity, provenance, file, line number, and step-by-step remediation instructions that AI agents can consume directly.
-
-## Usage
-
-```typescript
-import { GateRunner } from '@rigour-labs/core';
-
-const runner = new GateRunner(config);
-const report = await runner.run(projectRoot);
-
-console.log(report.status);    // 'PASS' or 'FAIL'
-console.log(report.stats.score);     // 0-100
-console.log(report.failures);  // Failure[]
+```bash
+npm install @rigour-labs/core
 ```
 
-### With Deep Analysis
-
-```typescript
-import { GateRunner } from '@rigour-labs/core';
+```ts
+import { ConfigSchema, reviewChange } from '@rigour-labs/core';
 
-const runner = new GateRunner(config);
-const report = await runner.run(projectRoot, undefined, {
-  enabled: true,
-  pro: false,        // true for full-power model
-  provider: 'local', // or 'claude', 'openai', etc.
-});
+const config = ConfigSchema.parse({});   // or the parsed rigour.yml
+const result = await reviewChange({ cwd: process.cwd(), config, source: { mode: 'working' } });
+console.log(result.status, result.findings);
 ```
 
-## Documentation
-
-**[Full docs at docs.rigour.run](https://docs.rigour.run)**
-
-## License
+What each check finds and whether it blocks: [What Rigour checks](https://github.com/rigour-labs/rigour/blob/main/docs/CHECKS.md). Every setting:
+[Configuration reference](https://github.com/rigour-labs/rigour/blob/main/docs/CONFIG_REFERENCE.md). Node 22 or later.
 
 MIT © [Rigour Labs](https://github.com/rigour-labs)

package/dist/environment.test.js

@@ -14,7 +14,6 @@ describe('Environment Alignment Gate', () => {
     });
     it('should detect tool version mismatch (Explicit)', async () => {
         const rawConfig = {
-            version: 1,
             gates: {
                 environment: {
                     enabled: true,
@@ -36,7 +35,6 @@ describe('Environment Alignment Gate', () => {
     });
     it('should detect missing environment variables', async () => {
         const rawConfig = {
-            version: 1,
             gates: {
                 environment: {
                     enabled: true,
@@ -57,7 +55,6 @@ describe('Environment Alignment Gate', () => {
 ruff = ">=99.14.0"
 `);
         const rawConfig = {
-            version: 1,
             gates: {
                 environment: {
                     enabled: true,
@@ -77,7 +74,6 @@ ruff = ">=99.14.0"
     });
     it('should prioritize environment gate and run it first', async () => {
         const rawConfig = {
-            version: 1,
             gates: {
                 max_file_lines: 1,
                 environment: {

package/dist/gates/agent-team.d.ts

@@ -26,8 +26,6 @@ export interface AgentTeamSession {
 export interface AgentTeamConfig {
     enabled?: boolean;
     max_concurrent_agents?: number;
-    cross_agent_pattern_check?: boolean;
-    handoff_verification?: boolean;
     task_ownership?: 'strict' | 'collaborative';
 }
 /**

package/dist/gates/agent-team.js

@@ -114,8 +114,6 @@ export class AgentTeamGate extends Gate {
         this.config = {
             enabled: config.enabled ?? false,
             max_concurrent_agents: config.max_concurrent_agents ?? 3,
-            cross_agent_pattern_check: config.cross_agent_pattern_check ?? true,
-            handoff_verification: config.handoff_verification ?? true,
             task_ownership: config.task_ownership ?? 'strict',
         };
     }
@@ -148,12 +146,6 @@ export class AgentTeamGate extends Gate {
                 }
             }
         }
-        // Check 3: Cross-agent pattern detection (if enabled)
-        if (this.config.cross_agent_pattern_check && context.record) {
-            // This would integrate with the Pattern Index to detect conflicting patterns
-            // For now, we log that we would do this check
-            Logger.debug('Cross-agent pattern check: would analyze patterns across agent scopes');
-        }
         return failures;
     }
 }

package/dist/gates/checkpoint.d.ts

@@ -44,7 +44,6 @@ export interface CheckpointConfig {
     interval_minutes?: number;
     quality_threshold?: number;
     drift_detection?: boolean;
-    auto_save_on_failure?: boolean;
     /** EWMA smoothing factor. Higher = more weight on recent data. Default 0.3 */
     ewma_alpha?: number;
     /** Drop from EWMA that triggers drift warning. Default 15 */

package/dist/gates/checkpoint.js

@@ -256,7 +256,6 @@ export class CheckpointGate extends Gate {
             interval_minutes: config.interval_minutes ?? 15,
             quality_threshold: config.quality_threshold ?? 80,
             drift_detection: config.drift_detection ?? true,
-            auto_save_on_failure: config.auto_save_on_failure ?? true,
             ewma_alpha: config.ewma_alpha ?? 0.3,
             drift_drop_threshold: config.drift_drop_threshold ?? 15,
         };

package/dist/gates/context.d.ts

@@ -8,10 +8,6 @@ export interface ExtendedContextConfig {
     enabled?: boolean;
     sensitivity?: number;
     mining_depth?: number;
-    cross_file_patterns?: boolean;
-    naming_consistency?: boolean;
-    import_relationships?: boolean;
-    max_cross_file_depth?: number;
 }
 export declare class ContextGate extends Gate {
     private config;

package/dist/gates/context.js

@@ -13,10 +13,6 @@ export class ContextGate extends Gate {
             enabled: config.context?.enabled ?? false,
             sensitivity: config.context?.sensitivity ?? 0.8,
             mining_depth: config.context?.mining_depth ?? 100,
-            cross_file_patterns: true, // Default ON for frontier model support
-            naming_consistency: true,
-            import_relationships: true,
-            max_cross_file_depth: 50,
         };
     }
     get provenance() { return 'ai-drift'; }
@@ -42,22 +38,16 @@ export class ContextGate extends Gate {
                 const codeContent = this.stripComments(content);
                 // 1. Original: Detect Redundant Suffixes (The Golden Example)
                 this.checkEnvDrift(codeContent, file, envAnchors, failures);
-                // 2. NEW: Cross-file pattern collection
-                if (this.extendedConfig.cross_file_patterns) {
-                    this.collectNamingPatterns(codeContent, file, namingPatterns);
-                    this.collectImportPatterns(codeContent, file, importPatterns);
-                }
+                // 2. Cross-file pattern collection
+                this.collectNamingPatterns(codeContent, file, namingPatterns);
+                this.collectImportPatterns(codeContent, file, importPatterns);
             }
             catch (e) { }
         }
-        // 3. NEW: Analyze naming consistency across files
-        if (this.extendedConfig.naming_consistency) {
-            this.analyzeNamingConsistency(namingPatterns, failures);
-        }
-        // 4. NEW: Analyze import relationship patterns
-        if (this.extendedConfig.import_relationships) {
-            this.analyzeImportPatterns(importPatterns, failures);
-        }
+        // 3. Naming consistency across files
+        this.analyzeNamingConsistency(namingPatterns, failures);
+        // 4. Import relationship patterns
+        this.analyzeImportPatterns(importPatterns, failures);
         // Cross-file patterns need the whole repo, but a scoped run reports
         // only findings that cite a file in scope.
         if (isScoped(context.patterns)) {

package/dist/gates/deep-analysis.d.ts

@@ -20,7 +20,6 @@ import { type LessonMode } from '../review-learning/team-lessons.js';
 export interface DeepGateConfig {
     options: DeepOptions;
     checks?: Record<string, boolean>;
-    threads?: number;
     maxTokens?: number;
     temperature?: number;
     timeoutMs?: number;

package/dist/gates/deep-runner.js

@@ -16,7 +16,6 @@ export async function runDeepAnalysis(config, context, deepOptions) {
     const deepGate = new DeepAnalysisGate({
         options: deepOptions,
         checks: config.gates.deep?.checks,
-        threads: config.gates.deep?.threads,
         maxTokens: config.gates.deep?.max_tokens,
         temperature: config.gates.deep?.temperature,
         timeoutMs: config.gates.deep?.timeout_ms,

package/dist/gates/frontend-secret-exposure.test.js

@@ -97,9 +97,9 @@ describe('FrontendSecretExposureGate', () => {
         expect(await gate.run({ cwd: testDir })).toHaveLength(0);
     });
     it('ignores shell files even when a broad project scan passes them in', async () => {
-        const shellPath = path.join(testDir, 'scripts/rigour-nmc.sh');
+        const shellPath = path.join(testDir, 'scripts/rigour-team.sh');
         fs.mkdirSync(path.dirname(shellPath), { recursive: true });
-        fs.writeFileSync(shellPath, 'node -e "process.env.RIGOUR_NMC_DATABASE_URL"');
+        fs.writeFileSync(shellPath, 'node -e "process.env.APP_DATABASE_URL"');
         const gate = new FrontendSecretExposureGate();
         expect(await gate.run({ cwd: testDir, patterns: ['**/*'] })).toHaveLength(0);
     });

package/dist/gates/hallucinated-imports/index.d.ts

@@ -27,8 +27,6 @@ export interface HallucinatedImport {
 }
 export interface HallucinatedImportsConfig {
     enabled?: boolean;
-    check_relative?: boolean;
-    check_packages?: boolean;
     ignore_patterns?: string[];
 }
 export declare class HallucinatedImportsGate extends Gate {

package/dist/gates/hallucinated-imports/index.js

@@ -33,8 +33,6 @@ export class HallucinatedImportsGate extends Gate {
         super('hallucinated-imports', 'Hallucinated Import Detection');
         this.config = {
             enabled: config.enabled ?? true,
-            check_relative: config.check_relative ?? true,
-            check_packages: config.check_packages ?? true,
             ignore_patterns: config.ignore_patterns ?? [
                 '\\.css$', '\\.scss$', '\\.less$', '\\.svg$', '\\.png$', '\\.jpg$',
                 '\\.json$', '\\.wasm$', '\\.graphql$', '\\.gql$',
@@ -70,6 +68,8 @@ export class HallucinatedImportsGate extends Gate {
         const allProjectFiles = projectFiles;
         const packageJson = await loadPackageJson(context.cwd);
         const rootDeps = new Set([
+            // A package importing itself by its own name (type tests, examples) is Node's self-reference.
+            ...(typeof packageJson?.name === 'string' ? [packageJson.name] : []),
             ...Object.keys(packageJson?.dependencies || {}),
             ...Object.keys(packageJson?.devDependencies || {}),
             ...Object.keys(packageJson?.peerDependencies || {}),

package/dist/gates/hallucinated-imports/js-resolver.js

@@ -180,6 +180,7 @@ export async function resolveJSDepsForFile(file, cwd, rootDeps, depCacheByDir) {
                 const packageJson = await fs.readJson(packageJsonPath);
                 const deps = new Set([
                     ...rootDeps,
+                    ...(typeof packageJson?.name === 'string' ? [packageJson.name] : []),
                     ...Object.keys(packageJson?.dependencies || {}),
                     ...Object.keys(packageJson?.devDependencies || {}),
                     ...Object.keys(packageJson?.peerDependencies || {}),

package/dist/gates/hallucinated-imports.test.js

@@ -423,6 +423,16 @@ import { cfg } from '~shared/config';
         expect(details.includes("Path alias '@/utils/missing' does not resolve to a project file")
             || details.includes("Package '@/utils' not in package.json dependencies")).toBe(true);
     });
+    it('should NOT flag a package importing itself by its own name (type tests, examples), and still flag an undeclared one', async () => {
+        FileScanner.findFiles.mockResolvedValue(['test-d/types.ts']);
+        mockReadFile.mockResolvedValue(`import ky from 'ky';\nimport left from 'left-pad';\n`);
+        mockPathExists.mockImplementation(async (p) => normalizePath(p) === `${testCwdNormalized}/package.json`);
+        mockReadJson.mockResolvedValue({ name: 'ky', dependencies: {}, devDependencies: {} });
+        const failures = await gate.run(context);
+        const details = failures.map(f => f.details).join('\n');
+        expect(details).not.toContain("Package 'ky'");
+        expect(details).toContain("Package 'left-pad' not in package.json dependencies");
+    });
     it('should resolve configured aliases to hidden generated files', async () => {
         const jsContent = `import { docs } from '@/.source';`;
         const tsconfigContent = `{

package/dist/gates/runner.js

@@ -1,6 +1,7 @@
 import { SEVERITY_WEIGHTS } from '../types/index.js';
 import { runDeepAnalysis } from './deep-runner.js';
 import { persistAndReinforce } from '../storage/local-memory.js';
+import { splitCommand } from '../utils/command-line.js';
 import { recordGateRun } from '../services/adaptive-thresholds.js';
 import { FileGate } from './file.js';
 import { ContentGate } from './content.js';
@@ -71,7 +72,7 @@ export class GateRunner {
         if (this.config.gates.checkpoint?.enabled) {
             this.gates.push(new CheckpointGate(this.config.gates.checkpoint));
         }
-        // Semantic Bugs Gate (type-aware, proven findings) — opt-in until field-validated
+        // Semantic Bugs Gate (type-aware, proven findings); on by default, `enabled: false` turns it off
         if (this.config.gates.semantic_bugs?.enabled) {
             this.gates.push(new SemanticBugsGate(this.config.gates.semantic_bugs));
         }
@@ -192,9 +193,7 @@ export class GateRunner {
                 }
                 try {
                     Logger.info(`Running command gate: ${key} (${cmd})`);
-                    const parts = cmd.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || [cmd];
-                    const bin = parts[0];
-                    const args = parts.slice(1).map(a => a.replace(/^["']|["']$/g, ''));
+                    const { bin, args } = splitCommand(cmd);
                     await execa(bin, args, { cwd });
                     summary[key] = 'PASS';
                 }

package/dist/gates/test-quality-matchers.d.ts

@@ -35,10 +35,6 @@ export declare const JS_TAUTOLOGICAL_PATTERNS: RegExp[];
  * Variable tautology pattern for JavaScript
  */
 export declare const JS_VAR_TAUTOLOGY_PATTERN: RegExp;
-/**
- * Snapshot test patterns
- */
-export declare const SNAPSHOT_PATTERNS: RegExp[];
 /**
  * Python tautological patterns
  */

package/dist/gates/test-quality-matchers.js

@@ -64,13 +64,6 @@ export const JS_TAUTOLOGICAL_PATTERNS = [
  * Variable tautology pattern for JavaScript
  */
 export const JS_VAR_TAUTOLOGY_PATTERN = /expect\s*\(\s*(\w+)\s*\)\s*\.(?:toBe|toEqual|toStrictEqual)\s*\(\s*(\w+)\s*\)/;
-/**
- * Snapshot test patterns
- */
-export const SNAPSHOT_PATTERNS = [
-    /\.toMatchSnapshot\s*\(/,
-    /\.toMatchInlineSnapshot\s*\(/,
-];
 /**
  * Python tautological patterns
  */

package/dist/gates/test-quality.d.ts

@@ -33,10 +33,8 @@ export interface TestQualityConfig {
     check_empty_tests?: boolean;
     check_tautological?: boolean;
     check_mock_heavy?: boolean;
-    check_snapshot_abuse?: boolean;
     check_assertion_free_async?: boolean;
     max_mocks_per_test?: number;
-    ignore_patterns?: string[];
 }
 export declare class TestQualityGate extends Gate {
     private config;

package/dist/gates/test-quality.js

@@ -25,7 +25,7 @@ import { FileScanner } from '../utils/scanner.js';
 import { Logger } from '../utils/logger.js';
 import { languageAdapters } from './language-adapters/index.js';
 import { checkGoTestQuality, checkJavaKotlinTestQuality } from './test-quality-lang.js';
-import { JS_TEST_START_PATTERN, JS_ASSERTION_PATTERNS, JS_MOCK_PATTERNS, JS_TAUTOLOGICAL_PATTERNS, JS_VAR_TAUTOLOGY_PATTERN, SNAPSHOT_PATTERNS, PYTHON_TEST_FUNC_PATTERN, PYTHON_ASSERTION_PATTERNS, PYTHON_MOCK_PATTERNS, PYTHON_TAUTOLOGICAL_PATTERNS, PYTHON_FIXTURE_PATTERN, PYTHON_CONFTEST_NAME, } from './test-quality-matchers.js';
+import { JS_TEST_START_PATTERN, JS_ASSERTION_PATTERNS, JS_MOCK_PATTERNS, JS_TAUTOLOGICAL_PATTERNS, JS_VAR_TAUTOLOGY_PATTERN, PYTHON_TEST_FUNC_PATTERN, PYTHON_ASSERTION_PATTERNS, PYTHON_MOCK_PATTERNS, PYTHON_TAUTOLOGICAL_PATTERNS, PYTHON_FIXTURE_PATTERN, PYTHON_CONFTEST_NAME, } from './test-quality-matchers.js';
 import fs from 'fs-extra';
 import path from 'path';
 export class TestQualityGate extends Gate {
@@ -37,10 +37,8 @@ export class TestQualityGate extends Gate {
             check_empty_tests: config.check_empty_tests ?? true,
             check_tautological: config.check_tautological ?? true,
             check_mock_heavy: config.check_mock_heavy ?? true,
-            check_snapshot_abuse: config.check_snapshot_abuse ?? true,
             check_assertion_free_async: config.check_assertion_free_async ?? true,
             max_mocks_per_test: config.max_mocks_per_test ?? 5,
-            ignore_patterns: config.ignore_patterns ?? [],
         };
     }
     get provenance() { return 'ai-drift'; }
@@ -200,13 +198,6 @@ export class TestQualityGate extends Gate {
                         });
                     }
                 }
-                // Check for snapshot-only tests
-                if (this.config.check_snapshot_abuse) {
-                    if (SNAPSHOT_PATTERNS.some(p => p.test(line))) {
-                        // This is fine IF there are also semantic assertions
-                        // We'll check when the block ends
-                    }
-                }
                 // End of test block
                 if (braceDepth === 0) {
                     this.analyzeJSTestBlock(testBlockContent, file, testStartLine, mockCount, hasAssertion, hasAwait, isAsync, issues);

package/dist/hooks/checker.js

@@ -40,7 +40,7 @@ async function loadConfig(cwd) {
         const raw = yaml.parse(await fs.readFile(configPath, 'utf-8'));
         return ConfigSchema.parse(raw);
     }
-    return ConfigSchema.parse({ version: 1 });
+    return ConfigSchema.parse({});
 }
 /**
  * Resolve a file path to absolute, read its content, and return metadata.

package/dist/hooks/index.d.ts

@@ -6,8 +6,7 @@ export { runHookChecker } from './checker.js';
 export type { CheckerOptions } from './checker.js';
 export { generateHookFiles, pushGateShell } from './templates.js';
 export type { GeneratedHookFile } from './templates.js';
-export type { HookTool, HookConfig, HookCheckerResult } from './types.js';
-export { DEFAULT_HOOK_CONFIG, FAST_GATE_IDS } from './types.js';
+export type { HookTool, HookCheckerResult } from './types.js';
 export { scanInputForCredentials, formatDLPAlert, createDLPAuditEntry } from './input-validator.js';
 export type { CredentialDetection, InputValidationResult, InputValidationConfig } from './input-validator.js';
 export { recordDLPFeedback, allowLastDLPBlock, writeDLPBlockManifest, getLearnedAllowCount, loadDLPFeedbackStore, loadDLPFeedbackStoreSync, fingerprintDetection, } from './dlp-feedback.js';

package/dist/hooks/index.js

@@ -4,7 +4,6 @@
  */
 export { runHookChecker } from './checker.js';
 export { generateHookFiles, pushGateShell } from './templates.js';
-export { DEFAULT_HOOK_CONFIG, FAST_GATE_IDS } from './types.js';
 // DLP (Data Loss Prevention) — v4.2.0
 export { scanInputForCredentials, formatDLPAlert, createDLPAuditEntry } from './input-validator.js';
 export { recordDLPFeedback, allowLastDLPBlock, writeDLPBlockManifest, getLearnedAllowCount, loadDLPFeedbackStore, loadDLPFeedbackStoreSync, fingerprintDetection, } from './dlp-feedback.js';

package/dist/hooks/types.d.ts

@@ -6,20 +6,6 @@
  *
  */
 export type HookTool = 'claude' | 'cursor' | 'cline' | 'windsurf';
-export interface HookConfig {
-    /** Which tools to generate hooks for */
-    tools: HookTool[];
-    /** Gates to run in the hook checker (fast subset) */
-    fast_gates: string[];
-    /** Max execution time in ms before the checker aborts */
-    timeout_ms: number;
-    /** Whether to block the tool on failure (exit 2) or just warn */
-    block_on_failure: boolean;
-}
-/** The fast gates that can run per-file in <200ms */
-export declare const FAST_GATE_IDS: readonly ["file-guard", "governance", "hallucinated-imports", "promise-safety", "security-patterns", "file-size"];
-export declare const DEFAULT_HOOK_CONFIG: HookConfig;
-export type FastGateId = typeof FAST_GATE_IDS[number];
 export interface HookCheckerResult {
     status: 'pass' | 'fail' | 'error';
     failures: Array<{

package/dist/hooks/types.js

@@ -5,18 +5,4 @@
  * has its own hook format. These types unify the config generation.
  *
  */
-/** The fast gates that can run per-file in <200ms */
-export const FAST_GATE_IDS = [
-    'file-guard',
-    'governance',
-    'hallucinated-imports',
-    'promise-safety',
-    'security-patterns',
-    'file-size',
-];
-export const DEFAULT_HOOK_CONFIG = {
-    tools: ['claude'],
-    fast_gates: [...FAST_GATE_IDS],
-    timeout_ms: 5000,
-    block_on_failure: false,
-};
+export {};

package/dist/index.d.ts

@@ -12,20 +12,25 @@ export * from './utils/logger.js';
 export { normalizeScopePatterns, isScoped } from './utils/scope.js';
 export { deepAnalysisError } from './utils/deep-status.js';
 export { rigourUserDir, repoStateDir } from './utils/user-state.js';
+export { locateTransformers, semanticRuntimeDir, semanticRuntimeInstalled, TRANSFORMERS_SPEC } from './pattern-index/semantic-runtime.js';
 export { reviewChange, toReviewFinding, type ReviewInput, type ReviewResult, type ReviewFinding } from './review/review.js';
 export { splitByChangedLines, type ChangedLineSplit } from './review/changed-lines.js';
 export { isControlFile, mergeBaseOf, readStateFile } from './review/trusted-state.js';
 export { dismissFinding, dismissedKeys, findingKey, isProven, mustFix, quietSplit, DISMISSED_FILE } from './review/quiet.js';
 export { loadLedger, ledgerProblems, runBacktest, backtestPassed, formatBacktest, LEDGER_PATH, type Ledger, type RoundResult } from './review/backtest.js';
 export { scaffoldLedger } from './review/backtest-init.js';
+export { fixScope, type FixScope } from './review/fix-scope.js';
 export { isGeneratedFile } from './review/generated-files.js';
-export { countUsage, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, telemetryToken, trackUsage } from './telemetry/telemetry.js';
+export { costBucket, countUsage, doNotTrack, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, telemetryToken, trackUsage } from './telemetry/telemetry.js';
 export { buildReviewTask, type ReviewTask, type ReviewTaskItem } from './review/review-task.js';
 export { buildQualityReceipt, receiptReport, type QualityReceipt, type ReceiptGap, type ReceiptOptions } from './review/receipt.js';
 export { runToolchain, type ToolResult, type ToolStatus } from './review/toolchain.js';
 export { branchFailures, mergeConflicts, staleReferences } from './review/branch-checks.js';
 export { runReviewer, reviewerBlocks, itemLine, type ReviewerOptions, type ReviewerResult, type ReviewerOutcome, type OpenItem } from './review/reviewer.js';
 export { startBackgroundReview, backgroundReview, reviewStatus, type ReviewStatus } from './review/reviewer/background.js';
+export { dismissReviewerFinding, REVIEW_DISMISSALS, reviewerInputs } from './review/reviewer/context.js';
+export { resolveReviewer, saveUserReviewer, type ResolvedReviewer, type RunChoice, type UserReviewerPatch } from './review/reviewer/settings.js';
+export { reviewerAvailability } from './review/reviewer/adapters.js';
 export { branchBase, type BranchBase } from './gates/logic-drift-git-base.js';
 export { acknowledgeReview, type ReviewAck, type AckResult } from './review/review-ack.js';
 export { exportReviewed, readLedger, reviewedKeys, isReviewed, recordReview, REVIEWED_FILE, type LedgerEntry, type ReviewedKey, type ReviewVerdict } from './review/ledger.js';

package/dist/index.js

@@ -12,20 +12,25 @@ export * from './utils/logger.js';
 export { normalizeScopePatterns, isScoped } from './utils/scope.js';
 export { deepAnalysisError } from './utils/deep-status.js';
 export { rigourUserDir, repoStateDir } from './utils/user-state.js';
+export { locateTransformers, semanticRuntimeDir, semanticRuntimeInstalled, TRANSFORMERS_SPEC } from './pattern-index/semantic-runtime.js';
 export { reviewChange, toReviewFinding } from './review/review.js';
 export { splitByChangedLines } from './review/changed-lines.js';
 export { isControlFile, mergeBaseOf, readStateFile } from './review/trusted-state.js';
 export { dismissFinding, dismissedKeys, findingKey, isProven, mustFix, quietSplit, DISMISSED_FILE } from './review/quiet.js';
 export { loadLedger, ledgerProblems, runBacktest, backtestPassed, formatBacktest, LEDGER_PATH } from './review/backtest.js';
 export { scaffoldLedger } from './review/backtest-init.js';
+export { fixScope } from './review/fix-scope.js';
 export { isGeneratedFile } from './review/generated-files.js';
-export { countUsage, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, telemetryToken, trackUsage } from './telemetry/telemetry.js';
+export { costBucket, countUsage, doNotTrack, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, telemetryToken, trackUsage } from './telemetry/telemetry.js';
 export { buildReviewTask } from './review/review-task.js';
 export { buildQualityReceipt, receiptReport } from './review/receipt.js';
 export { runToolchain } from './review/toolchain.js';
 export { branchFailures, mergeConflicts, staleReferences } from './review/branch-checks.js';
 export { runReviewer, reviewerBlocks, itemLine } from './review/reviewer.js';
 export { startBackgroundReview, backgroundReview, reviewStatus } from './review/reviewer/background.js';
+export { dismissReviewerFinding, REVIEW_DISMISSALS, reviewerInputs } from './review/reviewer/context.js';
+export { resolveReviewer, saveUserReviewer } from './review/reviewer/settings.js';
+export { reviewerAvailability } from './review/reviewer/adapters.js';
 export { branchBase } from './gates/logic-drift-git-base.js';
 export { acknowledgeReview } from './review/review-ack.js';
 export { exportReviewed, readLedger, reviewedKeys, isReviewed, recordReview, REVIEWED_FILE } from './review/ledger.js';

package/dist/inference/cloud-provider.d.ts

@@ -41,5 +41,7 @@ export declare class CloudProvider implements InferenceProvider {
     /** OpenRouter forwards Anthropic's cache_control to Claude models. */
     private cachesPrompts;
     private isOpenRouter;
+    /** The API base URL: the one given, else the provider's own. */
+    private endpoint;
     dispose(): void;
 }