@rigour-labs/core 6.7.10 → 6.8.1-rc.1

package/dist/hooks/checker.test.js

@@ -1,159 +0,0 @@
-/**
- * Tests for the hooks fast-checker module.
- * Verifies all 4 fast gates: file-size, hallucinated-imports, promise-safety, security-patterns.
- */
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { runHookChecker } from './checker.js';
-import * as fs from 'fs';
-import * as path from 'path';
-import * as os from 'os';
-import yaml from 'yaml';
-describe('runHookChecker', () => {
-    let testDir;
-    beforeEach(() => {
-        testDir = fs.mkdtempSync(path.join(os.tmpdir(), 'hook-checker-test-'));
-        // Write minimal rigour.yml
-        fs.writeFileSync(path.join(testDir, 'rigour.yml'), yaml.stringify({
-            version: 1,
-            gates: { max_file_lines: 50 },
-        }));
-        // Write package.json for import resolution
-        fs.writeFileSync(path.join(testDir, 'package.json'), JSON.stringify({
-            name: 'test-proj',
-            dependencies: { express: '^4.0.0' },
-        }));
-    });
-    afterEach(() => {
-        fs.rmSync(testDir, { recursive: true, force: true });
-    });
-    it('should return pass for clean files', async () => {
-        const filePath = path.join(testDir, 'clean.ts');
-        fs.writeFileSync(filePath, 'export const x = 1;\n');
-        const result = await runHookChecker({ cwd: testDir, files: [filePath] });
-        expect(result.status).toBe('pass');
-        expect(result.failures).toHaveLength(0);
-        expect(result.duration_ms).toBeGreaterThanOrEqual(0);
-    });
-    it('lets an agent edit CLAUDE.md by default, and blocks it only when the team opts in', async () => {
-        const filePath = path.join(testDir, 'CLAUDE.md');
-        fs.writeFileSync(filePath, '# Rules\n\n- Use the retry wrapper for partner APIs.\n');
-        const byDefault = await runHookChecker({ cwd: testDir, files: [filePath] });
-        expect(byDefault.failures.filter(f => f.gate === 'governance')).toEqual([]);
-        fs.writeFileSync(path.join(testDir, 'rigour.yml'), yaml.stringify({ version: 1, gates: { governance: { enforce_memory: true } } }));
-        const optedIn = await runHookChecker({ cwd: testDir, files: [filePath] });
-        expect(optedIn.failures.some(f => f.gate === 'governance')).toBe(true);
-    });
-    it("refuses an agent edit to Rigour's own state, even when rigour.yml ignores .rigour/", async () => {
-        fs.writeFileSync(path.join(testDir, 'rigour.yml'), 'version: 1\nignore:\n  - ".rigour/**"\n');
-        fs.mkdirSync(path.join(testDir, '.rigour'), { recursive: true });
-        fs.writeFileSync(path.join(testDir, '.rigour', 'dismissed.json'), '{"version":1,"entries":[]}');
-        const result = await runHookChecker({ cwd: testDir, files: ['.rigour/dismissed.json'] });
-        expect(result.status).toBe('fail');
-        expect(result.failures[0]).toMatchObject({ gate: 'file-guard', severity: 'critical' });
-    });
-    it('catches a real vendor key whatever it is named, and leaves publishable and test keys alone', async () => {
-        // Built at runtime: a key-shaped literal in this source would be (rightly) refused by secret scanning.
-        const fake = (prefix) => `${prefix}_${'51HxQ'}${'abcdefghijklmnopqrstuv'}`;
-        fs.writeFileSync(path.join(testDir, 'pay.ts'), `export const stripe = {\n  value: "${fake('sk_live')}",\n};\n`);
-        fs.writeFileSync(path.join(testDir, 'public.ts'), `export const key = "${fake('pk_live')}";\nexport const t = "${fake('sk_test')}";\n`);
-        const leaked = await runHookChecker({ cwd: testDir, files: ['pay.ts'] });
-        expect(leaked.failures).toEqual([expect.objectContaining({ gate: 'security-patterns', line: 2, severity: 'critical', message: 'Stripe API key detected in code' })]);
-        const fine = await runHookChecker({ cwd: testDir, files: ['public.ts'] });
-        expect(fine.failures.filter(f => f.gate === 'security-patterns')).toEqual([]);
-    });
-    it('should detect file size violations', async () => {
-        const filePath = path.join(testDir, 'big.ts');
-        const lines = Array.from({ length: 100 }, (_, i) => `export const v${i} = ${i};`);
-        fs.writeFileSync(filePath, lines.join('\n'));
-        const result = await runHookChecker({ cwd: testDir, files: [filePath] });
-        expect(result.status).toBe('fail');
-        expect(result.failures.some(f => f.gate === 'file-size')).toBe(true);
-    });
-    it('should detect hardcoded secrets', async () => {
-        const filePath = path.join(testDir, 'auth.ts');
-        fs.writeFileSync(filePath, `
-            const api_key = "abcdefghijklmnopqrstuvwxyz123456";
-        `);
-        const result = await runHookChecker({ cwd: testDir, files: [filePath] });
-        expect(result.status).toBe('fail');
-        expect(result.failures.some(f => f.gate === 'security-patterns')).toBe(true);
-    });
-    it('should detect command injection patterns', async () => {
-        const filePath = path.join(testDir, 'cmd.ts');
-        fs.writeFileSync(filePath, `
-            import { exec } from 'child_process';
-            exec(\`rm -rf \${userInput}\`);
-        `);
-        const result = await runHookChecker({ cwd: testDir, files: [filePath] });
-        expect(result.status).toBe('fail');
-        expect(result.failures.some(f => f.gate === 'security-patterns' && f.message.includes('command injection'))).toBe(true);
-    });
-    it('should detect JSON.parse without try/catch', async () => {
-        const filePath = path.join(testDir, 'parse.ts');
-        fs.writeFileSync(filePath, `
-            const data = JSON.parse(input);
-            console.log(data);
-        `);
-        const result = await runHookChecker({ cwd: testDir, files: [filePath] });
-        expect(result.status).toBe('fail');
-        expect(result.failures.some(f => f.gate === 'promise-safety')).toBe(true);
-    });
-    it('should skip non-existent files gracefully', async () => {
-        const result = await runHookChecker({
-            cwd: testDir,
-            files: ['/does/not/exist.ts'],
-        });
-        expect(result.status).toBe('pass');
-        expect(result.failures).toHaveLength(0);
-    });
-    it('should handle multiple files', async () => {
-        const cleanFile = path.join(testDir, 'clean.ts');
-        fs.writeFileSync(cleanFile, 'export const x = 1;\n');
-        const badFile = path.join(testDir, 'bad.ts');
-        fs.writeFileSync(badFile, `const password = "supersecretpassword123456";`);
-        const result = await runHookChecker({
-            cwd: testDir,
-            files: [cleanFile, badFile],
-        });
-        expect(result.status).toBe('fail');
-        expect(result.failures.length).toBeGreaterThan(0);
-    });
-    it('should handle missing config gracefully', async () => {
-        // Remove rigour.yml
-        fs.unlinkSync(path.join(testDir, 'rigour.yml'));
-        const filePath = path.join(testDir, 'test.ts');
-        fs.writeFileSync(filePath, 'export const x = 1;\n');
-        const result = await runHookChecker({ cwd: testDir, files: [filePath] });
-        expect(result.status).toBe('pass');
-    });
-    it('should complete within timeout', async () => {
-        const filePath = path.join(testDir, 'test.ts');
-        fs.writeFileSync(filePath, 'export const x = 1;\n');
-        const result = await runHookChecker({
-            cwd: testDir,
-            files: [filePath],
-            timeout_ms: 5000,
-        });
-        expect(result.duration_ms).toBeLessThan(5000);
-    });
-    it('should detect hallucinated relative imports', async () => {
-        const filePath = path.join(testDir, 'app.ts');
-        fs.writeFileSync(filePath, `
-            import { helper } from './nonexistent-module';
-        `);
-        const result = await runHookChecker({ cwd: testDir, files: [filePath] });
-        expect(result.status).toBe('fail');
-        expect(result.failures.some(f => f.gate === 'hallucinated-imports')).toBe(true);
-    });
-    it('should not flag existing relative imports', async () => {
-        const helperPath = path.join(testDir, 'helper.ts');
-        fs.writeFileSync(helperPath, 'export const help = true;\n');
-        const filePath = path.join(testDir, 'app.ts');
-        fs.writeFileSync(filePath, `
-            import { help } from './helper';
-        `);
-        const result = await runHookChecker({ cwd: testDir, files: [filePath] });
-        const importFailures = result.failures.filter(f => f.gate === 'hallucinated-imports');
-        expect(importFailures).toHaveLength(0);
-    });
-});

package/dist/hooks/dlp-confidence.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/hooks/dlp-confidence.test.js

@@ -1,51 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { createDLPAuditEntry, formatDLPAlert, scanInputForCredentials, } from './input-validator.js';
-describe('DLP confidence engine', () => {
-    it('allows explicit example password assignments', () => {
-        const result = scanInputForCredentials('password = "examplepassword"');
-        expect(result.status).toBe('clean');
-        expect(result.allowed_detections?.[0].decision).toBe('allow');
-    });
-    it('warns on high-entropy values even with api_key label', () => {
-        const result = scanInputForCredentials('api_key: "abcdefZ9y8X7w6V5u4T3s2R1q0P9o8N7m6"');
-        expect(result.status).toBe('warning');
-        expect(result.detections[0].decision).toBe('warn');
-    });
-    it('allows localhost database URLs with placeholder credentials', () => {
-        const result = scanInputForCredentials('DATABASE_URL=postgresql://user:password@localhost:5432/db');
-        expect(result.status).toBe('clean');
-    });
-    it('warns for live Stripe publishable keys', () => {
-        const result = scanInputForCredentials('STRIPE_PUBLIC_KEY=pk_live_123456789012345678901234');
-        expect(result.status).toBe('warning');
-        expect(result.detections[0].decision).toBe('warn');
-        expect(result.detections[0].reason_codes).toContain('public_live_key');
-    });
-    it('allows provider keys in comments (reduced false positives)', () => {
-        const result = scanInputForCredentials('// AWS_ACCESS_KEY_ID=AKIAZ9Y8X7W6V5U4T3Q2');
-        expect(result.status).toBe('clean');
-    });
-    it('allows GitHub tokens in comments', () => {
-        const result = scanInputForCredentials('// ghp_Z9Y8X7W6V5U4T3S2R1Q0P9O8N7M6B5C4A3D2');
-        expect(result.status).toBe('clean');
-    });
-    it('blocks JWT tokens in comments', () => {
-        const jwt = '// token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJwcm9kLXVzZXIiLCJpc3MiOiJhdXRoLXNlcnZpY2UifQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';
-        const result = scanInputForCredentials(jwt);
-        expect(result.status).toBe('blocked');
-        expect(result.detections.some(d => d.type === 'jwt_token')).toBe(true);
-    });
-    it('shows allowed safe values in clean output', () => {
-        const result = scanInputForCredentials('api_key: "abcdefghijklmnopqrstuvwxyz"');
-        const alert = formatDLPAlert(result);
-        expect(alert).toContain('allowed 1 sample or safe credential-like value');
-    });
-    it('includes allowed detections without raw values in audit log', () => {
-        const result = scanInputForCredentials('api_key: "abcdefghijklmnopqrstuvwxyz"');
-        const entry = createDLPAuditEntry(result, { agent: 'claude' });
-        const allowed = entry.allowed_detections;
-        expect(allowed).toHaveLength(1);
-        expect(allowed[0].decision).toBe('allow');
-        expect(allowed[0].match).toBeUndefined();
-    });
-});

package/dist/hooks/dlp-feedback.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/hooks/dlp-feedback.test.js

@@ -1,131 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import path from 'path';
-import os from 'os';
-import fs from 'fs-extra';
-import { recordDLPFeedback, feedbackFingerprint, loadDLPFeedbackStoreSync, isLearnedAllowSync, writeDLPBlockManifest, allowLastDLPBlock, } from './dlp-feedback.js';
-import { scanInputForCredentials } from './input-validator.js';
-import { generateDLPHookFiles } from './dlp-templates.js';
-describe('DLP feedback learning', () => {
-    const testCwd = path.join(os.tmpdir(), `rigour-dlp-fb-${Date.now()}`);
-    beforeEach(async () => {
-        await fs.ensureDir(path.join(testCwd, '.rigour'));
-    });
-    afterEach(async () => {
-        await fs.remove(testCwd);
-    });
-    it('produces stable fingerprints for same shape', () => {
-        const a = feedbackFingerprint('password_assignment', 'api_key = "your-key-here"');
-        const b = feedbackFingerprint('password_assignment', 'api_key = "your-key-here"');
-        expect(a).toBe(b);
-    });
-    it('records and applies learned false positives', async () => {
-        const match = 'api_key = "Z9y8X7w6V5u4T3s2R1q0P9o8N7m6B5c4"';
-        await recordDLPFeedback(testCwd, {
-            type: 'password_assignment',
-            match,
-            confidence: 55,
-            source: 'hook',
-        });
-        const store = loadDLPFeedbackStoreSync(testCwd);
-        expect(isLearnedAllowSync(store, 'password_assignment', match)).toBe(true);
-        const result = scanInputForCredentials(match, { cwd: testCwd });
-        expect(result.status).toBe('clean');
-        expect(result.allowed_detections?.[0].reason_codes).toContain('learned_false_positive');
-    });
-    it('allowLastDLPBlock learns from manifest', async () => {
-        const text = 'api_key = "Z9y8X7w6V5u4T3s2R1q0P9o8N7m6B5c4"';
-        const blocked = scanInputForCredentials(text, { cwd: testCwd, block_on_detection: true });
-        expect(blocked.status).toBe('warning');
-        await writeDLPBlockManifest(testCwd, blocked.detections, text);
-        const learned = await allowLastDLPBlock(testCwd, 'hook');
-        expect(learned).toBeGreaterThan(0);
-        const retry = scanInputForCredentials(text, { cwd: testCwd });
-        expect(retry.status).toBe('clean');
-    });
-    it('never learns provider or high-confidence detections', async () => {
-        const provider = await recordDLPFeedback(testCwd, {
-            type: 'openai_key',
-            match: 'sk-proj-Z9Y8X7W6V5U4T3S2R1Q0P9O8N7M6',
-            confidence: 92,
-        });
-        const highConfidence = await recordDLPFeedback(testCwd, {
-            type: 'password_assignment',
-            match: 'password = "Z9y8X7w6V5u4T3s2R1q0P9o8N7m6B5c4"',
-            confidence: 95,
-        });
-        expect(provider).toBeNull();
-        expect(highConfidence).toBeNull();
-        expect(loadDLPFeedbackStoreSync(testCwd).entries).toHaveLength(0);
-    });
-    it('does not retain raw credential fragments in manifests', async () => {
-        const text = 'api_key = "Z9y8X7w6V5u4T3s2R1q0P9o8N7m6B5c4"';
-        const result = scanInputForCredentials(text);
-        expect(result.detections[0].match).toBe(result.detections[0].redacted);
-        expect(result.detections[0].match).not.toContain('Z9y8X7w6V5u4T3s2R1q0P9o8N7m6B5c4');
-        await writeDLPBlockManifest(testCwd, result.detections, text);
-        const manifest = fs.readFileSync(path.join(testCwd, '.rigour', 'dlp-last-block.json'), 'utf-8');
-        expect(manifest).not.toContain('Z9y8X7w6V5u4T3s2R1q0P9o8N7m6B5c4');
-        expect(manifest).not.toContain('match');
-        expect(manifest).not.toContain('shape');
-    });
-    it('rejects and consumes expired manifests', async () => {
-        const text = 'api_key = "Z9y8X7w6V5u4T3s2R1q0P9o8N7m6B5c4"';
-        const result = scanInputForCredentials(text);
-        await writeDLPBlockManifest(testCwd, result.detections, text);
-        const manifestPath = path.join(testCwd, '.rigour', 'dlp-last-block.json');
-        const manifest = fs.readJsonSync(manifestPath);
-        manifest.timestamp = '2020-01-01T00:00:00.000Z';
-        fs.writeJsonSync(manifestPath, manifest);
-        expect(await allowLastDLPBlock(testCwd, 'hook')).toBe(0);
-        expect(fs.existsSync(manifestPath)).toBe(false);
-    });
-    it('rejects and consumes malformed manifests', async () => {
-        const manifestPath = path.join(testCwd, '.rigour', 'dlp-last-block.json');
-        fs.writeFileSync(manifestPath, '{not-json');
-        expect(await allowLastDLPBlock(testCwd, 'hook')).toBe(0);
-        expect(fs.existsSync(manifestPath)).toBe(false);
-    });
-});
-describe('DLP scanner URL boundaries', () => {
-    it('detects genuine HTTP basic-auth credentials', () => {
-        const result = scanInputForCredentials('https://alice:S3cr3t-Prod-9842@example.com/v1');
-        expect(result.status).toBe('warning');
-        expect(result.detections.some(d => d.type === 'credentials_in_url')).toBe(true);
-    });
-    it('allows signed GCS URLs without URL user-info', () => {
-        const url = 'https://storage.googleapis.com/example/archive.zip'
-            + '?X-Goog-Credential=service%40example.invalid&X-Goog-Signature=redacted';
-        expect(scanInputForCredentials(url).status).toBe('clean');
-    });
-    it('does not cross multiline JSON boundaries while scanning URLs', () => {
-        const input = `{
-            "task_archive_url": "https://storage.googleapis.com/example/archive.zip",
-            "provider": { "npm": "@ai-sdk/openai-compatible" }
-        }`;
-        expect(scanInputForCredentials(input).status).toBe('clean');
-    });
-    it('allows nested OpenCode configuration with scoped npm packages', () => {
-        const config = JSON.stringify({
-            $schema: 'https://opencode.ai/config.json',
-            provider: {
-                moonshot: {
-                    npm: '@ai-sdk/openai-compatible',
-                    options: {
-                        baseURL: 'https://api.moonshot.ai/v1',
-                        apiKey: '{env:OPENAI_API_KEY}',
-                    },
-                },
-            },
-        }, null, 2);
-        expect(scanInputForCredentials(config).status).toBe('clean');
-    });
-});
-describe('DLP hook warning templates', () => {
-    it.each(['cursor', 'cline', 'windsurf'])('generates non-blocking %s warnings', (tool) => {
-        const content = generateDLPHookFiles(tool, 'rigour hooks check')
-            .map(file => file.content)
-            .join('\n');
-        expect(content).toContain('possible credential');
-        expect(content).not.toContain('process.exit(2)');
-    });
-});

package/dist/hooks/input-validator.test.d.ts

@@ -1 +0,0 @@
-export {};