@rigour-labs/core 6.7.1 → 6.7.2

package/README.md

@@ -23,6 +23,6 @@ console.log(result.status, result.findings);
 ```
 
 What each check finds and whether it blocks: [What Rigour checks](https://github.com/rigour-labs/rigour/blob/main/docs/CHECKS.md). Every setting:
-[Configuration reference](https://github.com/rigour-labs/rigour/blob/main/docs/CONFIG_REFERENCE.md). Node 22 or later.
+[Configuration reference](https://github.com/rigour-labs/rigour/blob/main/docs/CONFIG_REFERENCE.md). Node 22.13 or later.
 
 MIT © [Rigour Labs](https://github.com/rigour-labs)

package/dist/review/review.js

@@ -43,13 +43,28 @@ export async function reviewChange(input) {
     const preexisting = await dropPreexisting(input, report, targets);
     if (input.diffTests && deep)
         report.failures.push(...await diffTestFailures(input.cwd, input.source, deep));
-    report.failures.push(...migrationOrderFailures(input.cwd, diff, input.source, input.config));
-    report.failures.push(...unusedExportFailures(input.cwd, diff, input.config), ...orphanFileFailures(input.cwd, diff, input.config));
-    report.failures.push(...queryPatternFailures(input.cwd, changedLines, input.config), ...optionalParamFailures(input.cwd, changedLines, input.config), ...duplicateFunctionFailures(input.cwd, changedLines, input.config), ...loopCopyFailures(input.cwd, changedLines, input.config), ...partialFixFailures(input.cwd, changedLines, input.config), ...partialWiringFailures(input.cwd, changedLines, input.config));
+    // The review's own checks, each recorded in the summary beside the gates, so a report says everything that ran.
+    const reviewCheck = (id, key, failures) => {
+        const enabled = input.config.gates[key]?.enabled;
+        report.summary[id] = !enabled ? 'SKIP' : failures.length ? 'FAIL' : 'PASS';
+        report.failures.push(...failures);
+    };
+    reviewCheck('migration-order', 'migration_order', migrationOrderFailures(input.cwd, diff, input.source, input.config));
+    reviewCheck('unused-exports', 'unused_exports', unusedExportFailures(input.cwd, diff, input.config));
+    reviewCheck('orphan-files', 'orphan_files', orphanFileFailures(input.cwd, diff, input.config));
+    reviewCheck('query-patterns', 'query_patterns', queryPatternFailures(input.cwd, changedLines, input.config));
+    reviewCheck('optional-params', 'optional_params', optionalParamFailures(input.cwd, changedLines, input.config));
+    reviewCheck('duplicate-functions', 'duplicate_functions', duplicateFunctionFailures(input.cwd, changedLines, input.config));
+    reviewCheck('change-sweep', 'change_sweep', [
+        ...loopCopyFailures(input.cwd, changedLines, input.config),
+        ...partialFixFailures(input.cwd, changedLines, input.config),
+        ...partialWiringFailures(input.cwd, changedLines, input.config),
+    ]);
     const typed = input.typed ? typedChecks(input.cwd, changedLines, input.config) : { failures: [], hints: [] };
-    report.failures.push(...typed.failures);
     if (typed.error)
         report.summary[TYPED_CHECKS] = 'ERROR'; // a check that could not run is a crashed gate, never a pass
+    else if (input.typed)
+        reviewCheck('redundancy', 'redundancy', typed.failures);
     const split = splitByChangedLines(report.failures, changedLines, deep ? changedFunctionSpans(input.cwd, changedLines) : {}, removedByFile(diff));
     const deepError = deepAnalysisError(report);
     const quiet = quietSplit(input.cwd, split.findings, input.config.review?.include_heuristics, input.trustedRef);

package/dist/review/review.test.js

@@ -117,6 +117,17 @@ describe('git-backed review', () => {
         expect(semantic.map(f => [f.files?.[0], f.line])).toEqual([['src/notify.ts', 2]]);
         expect(toReviewFinding(semantic[0])).toMatchObject({ id: 'semantic-bugs', file: 'src/notify.ts', line: 2, severity: 'high' });
     });
+    it("names every check it ran in the summary, the review's own beside the gates", async () => {
+        write('src/a.ts', 'export const a = 1;\n');
+        git('add', '-A');
+        git('commit', '-qm', 'init');
+        write('src/b.ts', 'export const unused = 2;\n');
+        git('add', '-A');
+        const config = ConfigSchema.parse({ gates: { migration_order: { enabled: false } } });
+        const { report } = await reviewChange({ cwd: repo, config });
+        expect(report?.summary).toMatchObject({ 'unused-exports': 'FAIL', 'migration-order': 'SKIP', 'query-patterns': 'PASS', 'change-sweep': 'PASS' });
+        expect(report?.summary).not.toHaveProperty('redundancy'); // typed checks were not asked for
+    });
     it('reports what the change introduced, not what the touched code already had', async () => {
         const branchy = (name, extra = '') => [
             `export function ${name}(x: number) {`,

package/dist/services/temporal-drift.js

@@ -94,7 +94,7 @@ export async function generateTemporalDriftReport(cwd, maxScans = 200) {
     if (!db) {
         if (!_sqliteWarningShown) {
             _sqliteWarningShown = true;
-            Logger.warn('Temporal drift: SQLite not available — install sqlite3 to enable scan history');
+            Logger.warn('Temporal drift: SQLite not available (it is built into Node 22.13 and later), so there is no scan history');
         }
         return null;
     }

package/dist/storage/db.d.ts

@@ -1,8 +1,8 @@
 declare const RIGOUR_DIR: string;
 declare const DB_PATH: string;
 /**
- * Promisified wrapper around a node-sqlite3 Database instance.
- * Provides run/get/all/exec methods that return Promises.
+ * The database behind a promise API: run/get/all/exec return Promises, so callers do not change
+ * with the driver, and a later move to a worker or an async driver stays inside this file.
  */
 export interface RigourDB {
     /** Execute a write statement (INSERT/UPDATE/DELETE). Returns { changes }. */
@@ -23,7 +23,7 @@ export interface RigourDB {
 }
 /**
  * Open (or create) the Rigour SQLite database.
- * Returns null if sqlite3 is not available.
+ * Returns null where this Node has no node:sqlite.
  */
 export declare function openDatabase(dbPath?: string): Promise<RigourDB | null>;
 /**
@@ -44,8 +44,6 @@ export declare function getDatabaseSize(): number;
  * Reset the database — delete and recreate from scratch.
  */
 export declare function resetDatabase(): void;
-/**
- * Check if SQLite is available (sqlite3 installed)
- */
+/** Whether this Node has SQLite (node:sqlite, Node 22.13 or later). */
 export declare function isSQLiteAvailable(): boolean;
 export { RIGOUR_DIR, DB_PATH };

package/dist/storage/db.js

@@ -3,44 +3,38 @@
  * Single file at ~/.rigour/rigour.db stores all scan history, findings,
  * learned patterns, and feedback. ACID-safe, portable, queryable.
  *
- * Uses node-sqlite3 (async, widely supported, no native build issues).
- * All public APIs are async. Graceful degradation if sqlite3 not installed.
+ * Uses Node's built-in SQLite (node:sqlite): nothing to install or compile, and no native addon to
+ * crash a worker thread. All public APIs are async. Where node:sqlite is missing (Node before
+ * 22.13), storage is off and every caller degrades as before.
  */
 import path from 'path';
 import fs from 'fs-extra';
 import { createRequire } from 'module';
 import { rigourUserDir } from '../utils/user-state.js';
-// ---------------------------------------------------------------------------
-// Optional dynamic import of sqlite3
-// ---------------------------------------------------------------------------
-let sqlite3Module = null;
-let _resolved = false;
-function loadSqlite3() {
-    if (_resolved)
-        return sqlite3Module;
-    _resolved = true;
-    // Try multiple resolution paths:
-    // 1. Relative to this package (works when sqlite3 is installed in monorepo)
-    // 2. Relative to cwd (works when user installs sqlite3 in their project)
-    // 3. Relative to global node_modules (works for global installs)
-    const searchPaths = [
-        import.meta.url,
-        `file://${process.cwd()}/package.json`,
-        `file://${path.join(rigourUserDir(), 'package.json')}`,
-    ];
-    for (const base of searchPaths) {
-        try {
-            const req = createRequire(base);
-            sqlite3Module = req('sqlite3');
-            if (sqlite3Module)
-                return sqlite3Module;
-        }
-        catch {
-            // Try next path
-        }
+let sqliteModule;
+/**
+ * node:sqlite, or null where this Node has none. Node 22 prints an "experimental feature" warning on
+ * the first load; it says nothing a Rigour user can act on, so that one warning is not shown.
+ */
+function loadSqlite() {
+    if (sqliteModule !== undefined)
+        return sqliteModule;
+    const emitWarning = process.emitWarning;
+    process.emitWarning = ((warning, ...rest) => {
+        if (String(warning?.message ?? warning).startsWith('SQLite is an experimental feature'))
+            return;
+        return emitWarning.call(process, warning, ...rest);
+    });
+    try {
+        sqliteModule = createRequire(import.meta.url)('node:sqlite');
+    }
+    catch {
+        sqliteModule = null;
+    }
+    finally {
+        process.emitWarning = emitWarning;
     }
-    sqlite3Module = null;
-    return sqlite3Module;
+    return sqliteModule;
 }
 // RIGOUR_HOME when set (tests, sandboxes) so nothing but a real run touches ~/.rigour.
 const RIGOUR_DIR = rigourUserDir();
@@ -254,52 +248,41 @@ CREATE INDEX IF NOT EXISTS idx_repositories_last_seen ON repositories(last_seen)
 CREATE INDEX IF NOT EXISTS idx_interaction_events_repo_created ON interaction_events(repository_id, created_at);
 CREATE INDEX IF NOT EXISTS idx_interaction_events_request ON interaction_events(request_id);
 `;
+/**
+ * A value as SQLite stores it. node:sqlite refuses what sqlite3 converted silently, so the same
+ * conversions happen here: undefined is NULL, a boolean is 1 or 0, a Date is its epoch milliseconds.
+ */
+function bindable(value) {
+    if (value === undefined)
+        return null;
+    if (typeof value === 'boolean')
+        return value ? 1 : 0;
+    if (value instanceof Date)
+        return value.getTime();
+    return value;
+}
+/** Rows as plain objects (node:sqlite returns them without a prototype). */
+function plain(row) {
+    return row && typeof row === 'object' ? { ...row } : row;
+}
 function wrapDatabase(raw) {
+    const prepare = (sql) => raw.prepare(sql);
     const db = {
-        run(sql, ...params) {
-            return new Promise((resolve, reject) => {
-                raw.run(sql, ...params, function (err) {
-                    if (err)
-                        return reject(err);
-                    resolve({ changes: this.changes, lastID: this.lastID });
-                });
-            });
+        async run(sql, ...params) {
+            const result = prepare(sql).run(...params.map(bindable));
+            return { changes: Number(result.changes), lastID: Number(result.lastInsertRowid) };
         },
-        get(sql, ...params) {
-            return new Promise((resolve, reject) => {
-                raw.get(sql, ...params, (err, row) => {
-                    if (err)
-                        return reject(err);
-                    resolve(row);
-                });
-            });
+        async get(sql, ...params) {
+            return plain(prepare(sql).get(...params.map(bindable)));
         },
-        all(sql, ...params) {
-            return new Promise((resolve, reject) => {
-                raw.all(sql, ...params, (err, rows) => {
-                    if (err)
-                        return reject(err);
-                    resolve(rows || []);
-                });
-            });
+        async all(sql, ...params) {
+            return prepare(sql).all(...params.map(bindable)).map(plain);
         },
-        exec(sql) {
-            return new Promise((resolve, reject) => {
-                raw.exec(sql, (err) => {
-                    if (err)
-                        return reject(err);
-                    resolve();
-                });
-            });
+        async exec(sql) {
+            raw.exec(sql);
         },
-        close() {
-            return new Promise((resolve, reject) => {
-                raw.close((err) => {
-                    if (err)
-                        return reject(err);
-                    resolve();
-                });
-            });
+        async close() {
+            raw.close();
         },
         async transaction(fn) {
             await db.exec('BEGIN TRANSACTION');
@@ -318,22 +301,15 @@ function wrapDatabase(raw) {
 }
 /**
  * Open (or create) the Rigour SQLite database.
- * Returns null if sqlite3 is not available.
+ * Returns null where this Node has no node:sqlite.
  */
 export async function openDatabase(dbPath) {
-    const sqlite3 = loadSqlite3();
-    if (!sqlite3)
+    const sqlite = loadSqlite();
+    if (!sqlite)
         return null;
     const resolvedPath = dbPath || DB_PATH;
     fs.ensureDirSync(path.dirname(resolvedPath));
-    const raw = await new Promise((resolve, reject) => {
-        const instance = new sqlite3.Database(resolvedPath, (err) => {
-            if (err)
-                return reject(err);
-            resolve(instance);
-        });
-    });
-    const db = wrapDatabase(raw);
+    const db = wrapDatabase(new sqlite.DatabaseSync(resolvedPath));
     // Wait for a lock instead of failing at once: a hook and an MCP server often open the database
     // at the same moment, and without this the second open fails with SQLITE_BUSY.
     await db.exec('PRAGMA busy_timeout = 5000');
@@ -528,7 +504,7 @@ async function enableWal(db, attempts = 10) {
             return;
         }
         catch (error) {
-            if (!/SQLITE_BUSY/.test(String(error)) || attempt >= attempts)
+            if (!/SQLITE_BUSY|database is locked/i.test(String(error)) || attempt >= attempts)
                 throw error;
             await new Promise(resolve => setTimeout(resolve, 25 * attempt));
         }
@@ -555,8 +531,7 @@ async function addColumnIfMissing(db, table, column, alterSql) {
  * Compact the database — prune old data, reclaim disk space.
  */
 export async function compactDatabase(retainDays = 90) {
-    const sqlite3 = loadSqlite3();
-    if (!sqlite3)
+    if (!loadSqlite())
         return { pruned: 0, patternsDecayed: 0, sizeBefore: 0, sizeAfter: 0 };
     const resolvedPath = DB_PATH;
     const sizeBefore = fs.existsSync(resolvedPath) ? fs.statSync(resolvedPath).size : 0;
@@ -604,10 +579,8 @@ export function resetDatabase() {
     if (fs.existsSync(DB_PATH + '-shm'))
         fs.removeSync(DB_PATH + '-shm');
 }
-/**
- * Check if SQLite is available (sqlite3 installed)
- */
+/** Whether this Node has SQLite (node:sqlite, Node 22.13 or later). */
 export function isSQLiteAvailable() {
-    return loadSqlite3() !== null;
+    return loadSqlite() !== null;
 }
 export { RIGOUR_DIR, DB_PATH };

package/dist/storage/db.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/storage/db.test.js

@@ -0,0 +1,46 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { isSQLiteAvailable, openDatabase } from './db.js';
+let dir;
+let db;
+beforeEach(async () => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rigour-db-'));
+    db = (await openDatabase(path.join(dir, 'rigour.db')));
+});
+afterEach(async () => {
+    await db?.close();
+    fs.rmSync(dir, { recursive: true, force: true });
+});
+describe('the database (node:sqlite)', () => {
+    it('is built in: no package to install', () => {
+        expect(isSQLiteAvailable()).toBe(true);
+        expect(db).not.toBeNull();
+    });
+    it('stores what callers pass the way sqlite3 did: undefined as NULL, booleans as 1 or 0, a Date as epoch ms', async () => {
+        await db.exec('CREATE TABLE t (a, b, c, d)');
+        const when = new Date('2026-01-02T03:04:05Z');
+        const written = await db.run('INSERT INTO t VALUES (?, ?, ?, ?)', undefined, true, false, when);
+        expect(written).toEqual({ changes: 1, lastID: 1 });
+        const row = await db.get('SELECT * FROM t');
+        expect(row).toEqual({ a: null, b: 1, c: 0, d: when.getTime() });
+        expect(Object.getPrototypeOf(row)).toBe(Object.prototype); // a plain object, as callers spread and compare
+        expect(await db.get('SELECT * FROM t WHERE a = 1')).toBeUndefined();
+    });
+    it('rolls a failed transaction back whole', async () => {
+        await db.exec('CREATE TABLE t (a UNIQUE)');
+        await expect(db.transaction(async (tx) => {
+            await tx.run('INSERT INTO t VALUES (?)', 1);
+            await tx.run('INSERT INTO t VALUES (?)', 1); // violates UNIQUE
+        })).rejects.toThrow(/UNIQUE/);
+        expect(await db.all('SELECT * FROM t')).toEqual([]);
+    });
+    it('opens an existing database again with its schema and data, in WAL mode', async () => {
+        await db.run("INSERT INTO meta (key, value) VALUES ('probe', 'kept')");
+        await db.close();
+        db = (await openDatabase(path.join(dir, 'rigour.db')));
+        expect(await db.get("SELECT value FROM meta WHERE key = 'probe'")).toEqual({ value: 'kept' });
+        expect(await db.get('PRAGMA journal_mode')).toEqual({ journal_mode: 'wal' });
+    });
+});

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.7.1",
+  "version": "6.7.2",
   "description": "Rigour's review engine: deterministic gates on changed lines, rules and lessons learned from your team's fixes, and per-check precision from what you fix versus dismiss, across TypeScript, JavaScript, Python, Go, Ruby and C#.",
   "engines": {
-    "node": ">=22"
+    "node": ">=22.13"
   },
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -71,13 +71,12 @@
   "optionalDependencies": {
     "@anthropic-ai/sdk": "^0.30.1",
     "pg": "^8.16.3",
-    "sqlite3": "^5.1.7",
-    "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-arm64": "6.7.1",
-    "@rigour-labs/brain-darwin-x64": "6.7.1",
-    "@rigour-labs/brain-linux-arm64": "6.7.1",
-    "@rigour-labs/brain-linux-x64": "6.7.1",
-    "@rigour-labs/brain-win-x64": "6.7.1"
+    "openai": "^5.23.2",
+    "@rigour-labs/brain-darwin-x64": "6.7.2",
+    "@rigour-labs/brain-linux-x64": "6.7.2",
+    "@rigour-labs/brain-win-x64": "6.7.2",
+    "@rigour-labs/brain-darwin-arm64": "6.7.2",
+    "@rigour-labs/brain-linux-arm64": "6.7.2"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",