@rigour-labs/core 6.7.1 → 6.7.4

package/dist/types/index.d.ts

@@ -426,12 +426,15 @@ export declare const GatesSchema: z.ZodObject<{
     unused_exports: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         allow: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        block: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     }, "strip", z.ZodTypeAny, {
         enabled: boolean;
         allow: string[];
+        block: boolean;
     }, {
         enabled?: boolean | undefined;
         allow?: string[] | undefined;
+        block?: boolean | undefined;
     }>>>;
     /** Query shapes that cost production: offset paging in a loop, a time window with no upper bound (review/query-patterns.ts). */
     query_patterns: z.ZodDefault<z.ZodOptional<z.ZodObject<{
@@ -490,12 +493,15 @@ export declare const GatesSchema: z.ZodObject<{
     orphan_files: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         allow: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        block: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     }, "strip", z.ZodTypeAny, {
         enabled: boolean;
         allow: string[];
+        block: boolean;
     }, {
         enabled?: boolean | undefined;
         allow?: string[] | undefined;
+        block?: boolean | undefined;
     }>>>;
     migration_order: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
@@ -867,6 +873,7 @@ export declare const GatesSchema: z.ZodObject<{
     unused_exports: {
         enabled: boolean;
         allow: string[];
+        block: boolean;
     };
     query_patterns: {
         enabled: boolean;
@@ -888,6 +895,7 @@ export declare const GatesSchema: z.ZodObject<{
     orphan_files: {
         enabled: boolean;
         allow: string[];
+        block: boolean;
     };
     migration_order: {
         enabled: boolean;
@@ -1104,6 +1112,7 @@ export declare const GatesSchema: z.ZodObject<{
     unused_exports?: {
         enabled?: boolean | undefined;
         allow?: string[] | undefined;
+        block?: boolean | undefined;
     } | undefined;
     query_patterns?: {
         enabled?: boolean | undefined;
@@ -1125,6 +1134,7 @@ export declare const GatesSchema: z.ZodObject<{
     orphan_files?: {
         enabled?: boolean | undefined;
         allow?: string[] | undefined;
+        block?: boolean | undefined;
     } | undefined;
     migration_order?: {
         enabled?: boolean | undefined;
@@ -1630,12 +1640,15 @@ export declare const ConfigSchema: z.ZodObject<{
         unused_exports: z.ZodDefault<z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
             allow: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+            block: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         }, "strip", z.ZodTypeAny, {
             enabled: boolean;
             allow: string[];
+            block: boolean;
         }, {
             enabled?: boolean | undefined;
             allow?: string[] | undefined;
+            block?: boolean | undefined;
         }>>>;
         /** Query shapes that cost production: offset paging in a loop, a time window with no upper bound (review/query-patterns.ts). */
         query_patterns: z.ZodDefault<z.ZodOptional<z.ZodObject<{
@@ -1694,12 +1707,15 @@ export declare const ConfigSchema: z.ZodObject<{
         orphan_files: z.ZodDefault<z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
             allow: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+            block: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         }, "strip", z.ZodTypeAny, {
             enabled: boolean;
             allow: string[];
+            block: boolean;
         }, {
             enabled?: boolean | undefined;
             allow?: string[] | undefined;
+            block?: boolean | undefined;
         }>>>;
         migration_order: z.ZodDefault<z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
@@ -2071,6 +2087,7 @@ export declare const ConfigSchema: z.ZodObject<{
         unused_exports: {
             enabled: boolean;
             allow: string[];
+            block: boolean;
         };
         query_patterns: {
             enabled: boolean;
@@ -2092,6 +2109,7 @@ export declare const ConfigSchema: z.ZodObject<{
         orphan_files: {
             enabled: boolean;
             allow: string[];
+            block: boolean;
         };
         migration_order: {
             enabled: boolean;
@@ -2308,6 +2326,7 @@ export declare const ConfigSchema: z.ZodObject<{
         unused_exports?: {
             enabled?: boolean | undefined;
             allow?: string[] | undefined;
+            block?: boolean | undefined;
         } | undefined;
         query_patterns?: {
             enabled?: boolean | undefined;
@@ -2329,6 +2348,7 @@ export declare const ConfigSchema: z.ZodObject<{
         orphan_files?: {
             enabled?: boolean | undefined;
             allow?: string[] | undefined;
+            block?: boolean | undefined;
         } | undefined;
         migration_order?: {
             enabled?: boolean | undefined;
@@ -2437,6 +2457,17 @@ export declare const ConfigSchema: z.ZodObject<{
             escalate: z.ZodDefault<z.ZodOptional<z.ZodEnum<["always", "risk"]>>>;
             /** A model per reviewer name for cross-examination (a narrow verification task), e.g. { claude: "haiku" }. */
             cross_models: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+            /**
+             * Environment variables a judge's CLI must not see, per reviewer name, e.g. { codex: { unset: [OPENAI_API_KEY] } }
+             * when that variable holds a key meant for another service. RIGOUR_API_KEY is never passed to a judge.
+             */
+            judge_env: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                unset: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+            }, "strip", z.ZodTypeAny, {
+                unset: string[];
+            }, {
+                unset?: string[] | undefined;
+            }>>>>;
         }, "strip", z.ZodTypeAny, {
             enabled: boolean;
             mode: "single" | "cross" | "full";
@@ -2451,6 +2482,9 @@ export declare const ConfigSchema: z.ZodObject<{
             judges: 2 | 3;
             escalate: "always" | "risk";
             cross_models: Record<string, string>;
+            judge_env: Record<string, {
+                unset: string[];
+            }>;
             model?: string | undefined;
             max_runs_per_day?: number | undefined;
             max_usd_per_day?: number | undefined;
@@ -2471,6 +2505,9 @@ export declare const ConfigSchema: z.ZodObject<{
             judges?: 2 | 3 | undefined;
             escalate?: "always" | "risk" | undefined;
             cross_models?: Record<string, string> | undefined;
+            judge_env?: Record<string, {
+                unset?: string[] | undefined;
+            }> | undefined;
         }>>>;
     }, "strip", z.ZodTypeAny, {
         include_heuristics: boolean;
@@ -2489,6 +2526,9 @@ export declare const ConfigSchema: z.ZodObject<{
             judges: 2 | 3;
             escalate: "always" | "risk";
             cross_models: Record<string, string>;
+            judge_env: Record<string, {
+                unset: string[];
+            }>;
             model?: string | undefined;
             max_runs_per_day?: number | undefined;
             max_usd_per_day?: number | undefined;
@@ -2515,6 +2555,9 @@ export declare const ConfigSchema: z.ZodObject<{
             judges?: 2 | 3 | undefined;
             escalate?: "always" | "risk" | undefined;
             cross_models?: Record<string, string> | undefined;
+            judge_env?: Record<string, {
+                unset?: string[] | undefined;
+            }> | undefined;
         } | undefined;
     }>>>;
     ignore: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
@@ -2708,6 +2751,7 @@ export declare const ConfigSchema: z.ZodObject<{
         unused_exports: {
             enabled: boolean;
             allow: string[];
+            block: boolean;
         };
         query_patterns: {
             enabled: boolean;
@@ -2729,6 +2773,7 @@ export declare const ConfigSchema: z.ZodObject<{
         orphan_files: {
             enabled: boolean;
             allow: string[];
+            block: boolean;
         };
         migration_order: {
             enabled: boolean;
@@ -2787,6 +2832,9 @@ export declare const ConfigSchema: z.ZodObject<{
             judges: 2 | 3;
             escalate: "always" | "risk";
             cross_models: Record<string, string>;
+            judge_env: Record<string, {
+                unset: string[];
+            }>;
             model?: string | undefined;
             max_runs_per_day?: number | undefined;
             max_usd_per_day?: number | undefined;
@@ -2987,6 +3035,7 @@ export declare const ConfigSchema: z.ZodObject<{
         unused_exports?: {
             enabled?: boolean | undefined;
             allow?: string[] | undefined;
+            block?: boolean | undefined;
         } | undefined;
         query_patterns?: {
             enabled?: boolean | undefined;
@@ -3008,6 +3057,7 @@ export declare const ConfigSchema: z.ZodObject<{
         orphan_files?: {
             enabled?: boolean | undefined;
             allow?: string[] | undefined;
+            block?: boolean | undefined;
         } | undefined;
         migration_order?: {
             enabled?: boolean | undefined;
@@ -3070,6 +3120,9 @@ export declare const ConfigSchema: z.ZodObject<{
             judges?: 2 | 3 | undefined;
             escalate?: "always" | "risk" | undefined;
             cross_models?: Record<string, string> | undefined;
+            judge_env?: Record<string, {
+                unset?: string[] | undefined;
+            }> | undefined;
         } | undefined;
     } | undefined;
 }>;
@@ -3106,6 +3159,8 @@ export declare const FailureSchema: z.ZodObject<{
     source: z.ZodOptional<z.ZodEnum<["ast", "llm", "hybrid"]>>;
     category: z.ZodOptional<z.ZodString>;
     verified: z.ZodOptional<z.ZodBoolean>;
+    /** A proven check the team keeps as a note (its `block: false`): shown, never blocking. */
+    advisory: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     id: string;
     title: string;
@@ -3121,6 +3176,7 @@ export declare const FailureSchema: z.ZodObject<{
     confidence?: number | undefined;
     source?: "ast" | "llm" | "hybrid" | undefined;
     category?: string | undefined;
+    advisory?: boolean | undefined;
 }, {
     id: string;
     title: string;
@@ -3136,6 +3192,7 @@ export declare const FailureSchema: z.ZodObject<{
     confidence?: number | undefined;
     source?: "ast" | "llm" | "hybrid" | undefined;
     category?: string | undefined;
+    advisory?: boolean | undefined;
 }>;
 export type Failure = z.infer<typeof FailureSchema>;
 export declare const ReportSchema: z.ZodObject<{
@@ -3157,6 +3214,8 @@ export declare const ReportSchema: z.ZodObject<{
         source: z.ZodOptional<z.ZodEnum<["ast", "llm", "hybrid"]>>;
         category: z.ZodOptional<z.ZodString>;
         verified: z.ZodOptional<z.ZodBoolean>;
+        /** A proven check the team keeps as a note (its `block: false`): shown, never blocking. */
+        advisory: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
         id: string;
         title: string;
@@ -3172,6 +3231,7 @@ export declare const ReportSchema: z.ZodObject<{
         confidence?: number | undefined;
         source?: "ast" | "llm" | "hybrid" | undefined;
         category?: string | undefined;
+        advisory?: boolean | undefined;
     }, {
         id: string;
         title: string;
@@ -3187,6 +3247,7 @@ export declare const ReportSchema: z.ZodObject<{
         confidence?: number | undefined;
         source?: "ast" | "llm" | "hybrid" | undefined;
         category?: string | undefined;
+        advisory?: boolean | undefined;
     }>, "many">;
     stats: z.ZodObject<{
         duration_ms: z.ZodNumber;
@@ -3464,6 +3525,7 @@ export declare const ReportSchema: z.ZodObject<{
         confidence?: number | undefined;
         source?: "ast" | "llm" | "hybrid" | undefined;
         category?: string | undefined;
+        advisory?: boolean | undefined;
     }[];
 }, {
     stats: {
@@ -3527,6 +3589,7 @@ export declare const ReportSchema: z.ZodObject<{
         confidence?: number | undefined;
         source?: "ast" | "llm" | "hybrid" | undefined;
         category?: string | undefined;
+        advisory?: boolean | undefined;
     }[];
 }>;
 export type Report = z.infer<typeof ReportSchema>;

package/dist/types/index.js

@@ -251,6 +251,8 @@ export const GatesSchema = z.object({
     unused_exports: z.object({
         enabled: z.boolean().optional().default(true),
         allow: z.array(z.string()).optional().default([]), // export names a tool loads by name
+        // Block on them. Off by default: teams routinely approve exports kept for tests or for a signature; a team whose reviewers block on them turns it on.
+        block: z.boolean().optional().default(false),
     }).optional().default({}),
     /** Query shapes that cost production: offset paging in a loop, a time window with no upper bound (review/query-patterns.ts). */
     query_patterns: z.object({ enabled: z.boolean().optional().default(true) }).optional().default({}),
@@ -277,6 +279,8 @@ export const GatesSchema = z.object({
     orphan_files: z.object({
         enabled: z.boolean().optional().default(true),
         allow: z.array(z.string()).optional().default([]), // globs for files a tool loads by path
+        // Block on them. Off by default, like unused_exports.block: a team whose reviewers block on dead files turns it on.
+        block: z.boolean().optional().default(false),
     }).optional().default({}),
     migration_order: z.object({
         enabled: z.boolean().optional().default(false),
@@ -419,6 +423,11 @@ export const ConfigSchema = z.object({
             escalate: z.enum(['always', 'risk']).optional().default('always'),
             /** A model per reviewer name for cross-examination (a narrow verification task), e.g. { claude: "haiku" }. */
             cross_models: z.record(ModelName).optional().default({}),
+            /**
+             * Environment variables a judge's CLI must not see, per reviewer name, e.g. { codex: { unset: [OPENAI_API_KEY] } }
+             * when that variable holds a key meant for another service. RIGOUR_API_KEY is never passed to a judge.
+             */
+            judge_env: z.record(z.object({ unset: z.array(z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/, 'an environment variable name')).optional().default([]) })).optional().default({}),
         }).optional().default({}),
     }).optional().default({}),
     ignore: z.array(z.string()).optional().default([]),
@@ -452,6 +461,8 @@ export const FailureSchema = z.object({
     source: z.enum(['ast', 'llm', 'hybrid']).optional(), // Finding source
     category: z.string().optional(), // e.g. 'srp_violation', 'god_function'
     verified: z.boolean().optional(), // AST-verified LLM finding
+    /** A proven check the team keeps as a note (its `block: false`): shown, never blocking. */
+    advisory: z.boolean().optional(),
 });
 export const ReportSchema = z.object({
     status: StatusSchema,

package/dist/utils/profile.d.ts

@@ -22,7 +22,11 @@ export declare function readProfiles(): RigourProfile[];
 export declare function writeProfiles(profiles: RigourProfile[]): void;
 /** The first profile whose match fits `cwd`, by path or by origin remote. */
 export declare function profileFor(cwd: string, profiles?: RigourProfile[]): RigourProfile | undefined;
-/** Apply the profile for `cwd` to this process's environment; returns it, or undefined when none matches. */
+/**
+ * Apply the profile for `cwd` to this process's environment; returns it, or undefined when none matches.
+ * A RIGOUR_HOME you set yourself (not one a profile set: RIGOUR_PROFILE is unset) is a home you chose, so
+ * no profile replaces it or brings its team: an isolated run stays isolated.
+ */
 export declare function applyProfile(cwd: string, profiles?: RigourProfile[]): RigourProfile | undefined;
 /** Why this process must not act for `cwd` (it belongs to another profile than the one applied at start), or null. */
 export declare function profileMismatch(cwd: string, profiles?: RigourProfile[]): string | null;

package/dist/utils/profile.js

@@ -44,8 +44,14 @@ export function profileFor(cwd, profiles = readProfiles()) {
         ? !!remote && remoteMatches(remote, entry)
         : isInside(where, real(expandHome(entry)))));
 }
-/** Apply the profile for `cwd` to this process's environment; returns it, or undefined when none matches. */
+/**
+ * Apply the profile for `cwd` to this process's environment; returns it, or undefined when none matches.
+ * A RIGOUR_HOME you set yourself (not one a profile set: RIGOUR_PROFILE is unset) is a home you chose, so
+ * no profile replaces it or brings its team: an isolated run stays isolated.
+ */
 export function applyProfile(cwd, profiles) {
+    if (process.env.RIGOUR_HOME && !process.env.RIGOUR_PROFILE)
+        return undefined;
     const profile = profileFor(cwd, profiles);
     if (!profile)
         return undefined;

package/dist/utils/profile.test.js

@@ -33,6 +33,7 @@ describe('profiles', () => {
     });
     it("applies the profile's home and team, clearing team settings inherited from the shell", () => {
         const dir = repo('work/acme/api');
+        delete process.env.RIGOUR_HOME; // no home of your own: the profile chooses it
         process.env.RIGOUR_TEAM_DATABASE_URL = 'postgres://other-org';
         process.env.RIGOUR_ORGANIZATION_ID = 'other-org';
         applyProfile(dir, [{ name: 'acme', match: [path.join(root, 'work/acme')], home: path.join(root, 'acme-home'), githubAccount: 'acme-dev' }]);
@@ -44,6 +45,15 @@ describe('profiles', () => {
         applyProfile(dir, [{ name: 'acme', match: [dir], team: { organization: 'acme', team: 'web', actor: 'dev', repositories: ['github.com/acme/*'], databaseUrlCommand: 'echo url' } }]);
         expect([process.env.RIGOUR_ORGANIZATION_ID, process.env.RIGOUR_TEAM_REPOSITORIES, process.env.RIGOUR_TEAM_DATABASE_URL_COMMAND]).toEqual(['acme', 'github.com/acme/*', 'echo url']);
     });
+    it('leaves a RIGOUR_HOME you set yourself alone: no profile replaces it or brings its team', () => {
+        const dir = repo('work/acme/api');
+        delete process.env.RIGOUR_PROFILE;
+        process.env.RIGOUR_HOME = path.join(root, 'isolated');
+        const applied = applyProfile(dir, [{ name: 'acme', match: [path.join(root, 'work/acme')], home: path.join(root, 'acme-home'), team: { organization: 'acme', team: 'web', actor: 'dev' } }]);
+        expect(applied).toBeUndefined();
+        expect(process.env.RIGOUR_HOME).toBe(path.join(root, 'isolated'));
+        expect(process.env.RIGOUR_ORGANIZATION_ID).toBeUndefined();
+    });
     it('refuses to act for a repository of another profile than the one the process started with', () => {
         const acme = repo('work/acme/api');
         const mine = repo('personal/tool');

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.7.1",
+  "version": "6.7.4",
   "description": "Rigour's review engine: deterministic gates on changed lines, rules and lessons learned from your team's fixes, and per-check precision from what you fix versus dismiss, across TypeScript, JavaScript, Python, Go, Ruby and C#.",
   "engines": {
-    "node": ">=22"
+    "node": ">=22.13"
   },
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -71,13 +71,12 @@
   "optionalDependencies": {
     "@anthropic-ai/sdk": "^0.30.1",
     "pg": "^8.16.3",
-    "sqlite3": "^5.1.7",
-    "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-arm64": "6.7.1",
-    "@rigour-labs/brain-darwin-x64": "6.7.1",
-    "@rigour-labs/brain-linux-arm64": "6.7.1",
-    "@rigour-labs/brain-linux-x64": "6.7.1",
-    "@rigour-labs/brain-win-x64": "6.7.1"
+    "openai": "^5.23.2",
+    "@rigour-labs/brain-darwin-arm64": "6.7.4",
+    "@rigour-labs/brain-win-x64": "6.7.4",
+    "@rigour-labs/brain-linux-arm64": "6.7.4",
+    "@rigour-labs/brain-linux-x64": "6.7.4",
+    "@rigour-labs/brain-darwin-x64": "6.7.4"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",