@rigour-labs/core 6.7.10 → 6.8.1-rc.1

package/dist/review/review.test.js

@@ -1,203 +0,0 @@
-import { execFileSync } from 'child_process';
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { GateRunner } from '../gates/runner.js';
-import { ConfigSchema } from '../types/index.js';
-import { parseDiff } from '../utils/diff.js';
-import { splitByChangedLines } from './changed-lines.js';
-import { anchorInChangedFunction, changedFunctionSpans } from './changed-function-spans.js';
-import { diffFromGit } from './git-diff.js';
-import { reviewChange, toReviewFinding } from './review.js';
-import { findingKey } from './quiet.js';
-/** These tests are about other checks; a new unreferenced fixture file is not their subject. */
-const NO_DEAD_CODE = { unused_exports: { enabled: false }, orphan_files: { enabled: false } };
-const LEAKY = [
-    'export async function notify(endpoint: string, signature: string) {',
-    "  return fetch(endpoint, { method: 'POST', headers: { 'x-hook-signature': signature } });",
-    '}',
-    '',
-].join('\n');
-function failure(file, line) {
-    return { id: 'x', title: 'X', details: 'd', files: file ? [file] : [], ...(line !== undefined ? { line } : {}) };
-}
-describe('splitByChangedLines', () => {
-    it('separates changed-line, file-level, unlocated and outside findings', () => {
-        const changed = { 'a.ts': new Set([3]) };
-        const split = splitByChangedLines([failure('a.ts', 3), failure('a.ts', 9), failure('a.ts'), failure('b.ts'), failure(undefined)], changed);
-        expect(split.findings.map(f => f.line)).toEqual([3]);
-        expect(split.fileFindings).toHaveLength(1);
-        expect(split.unlocated).toBe(1);
-        expect(split.outside).toBe(2);
-    });
-    it('keeps a deep finding inside a changed function, anchored on the nearest changed line', () => {
-        const deep = (line) => ({ ...failure('a.ts', line), provenance: 'deep-analysis' });
-        const changed = { 'a.ts': new Set([12, 14]) };
-        const spans = { 'a.ts': [[10, 20]] };
-        const split = splitByChangedLines([deep(11), deep(30), failure('a.ts', 11)], changed, spans);
-        expect(split.findings).toEqual([expect.objectContaining({ line: 11, anchorLine: 12 })]);
-        expect(split.contextFindings.map(f => f.line)).toEqual([30]); // elsewhere in a changed file: shown, not blocking
-        expect(split.outside).toBe(1); // a rule finding on an unchanged line is pre-existing, as before
-    });
-    it('counts a multi-line finding as changed when lines inside it were deleted', () => {
-        // fetch(url, {      <- line 4, unchanged
-        //   redirect: ...   <- deleted, so the removal sits before new line 5
-        // })                <- line 5
-        const call = { ...failure('a.ts', 4), endLine: 5 };
-        const outsideCall = { ...failure('a.ts', 9), endLine: 10 };
-        const removed = { 'a.ts': [{ line: 5, text: ["  redirect: 'manual',"] }] };
-        const split = splitByChangedLines([call, outsideCall, failure('a.ts', 4)], {}, {}, removed);
-        expect(split.findings).toEqual([call]);
-        expect(split.outside).toBe(2);
-    });
-});
-describe('changedFunctionSpans', () => {
-    it('spans the outermost function around changed lines, and anchors to the nearest changed line in it', () => {
-        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'spans-'));
-        try {
-            fs.writeFileSync(path.join(dir, 'a.ts'), 'const x = 1;\nexport function f(a: number) {\n  if (a > 0) {\n    return a;\n  }\n  return 0;\n}\n');
-            const spans = changedFunctionSpans(dir, { 'a.ts': new Set([4]), 'missing.ts': new Set([1]), 'notes.md': new Set([1]) });
-            expect(spans).toEqual({ 'a.ts': [[2, 7]] });
-            expect(anchorInChangedFunction(6, new Set([4]), spans['a.ts'])).toBe(4);
-            expect(anchorInChangedFunction(1, new Set([4]), spans['a.ts'])).toBeUndefined();
-        }
-        finally {
-            fs.rmSync(dir, { recursive: true, force: true });
-        }
-    });
-});
-describe('git-backed review', () => {
-    let repo;
-    const git = (...args) => execFileSync('git', ['-C', repo, ...args], { encoding: 'utf8' });
-    const write = (rel, body) => {
-        fs.mkdirSync(path.dirname(path.join(repo, rel)), { recursive: true });
-        fs.writeFileSync(path.join(repo, rel), body);
-    };
-    beforeEach(() => {
-        repo = fs.mkdtempSync(path.join(os.tmpdir(), 'review-core-'));
-        git('init', '-q', '-b', 'main');
-        git('config', 'user.email', 't@example.com');
-        git('config', 'user.name', 't');
-        git('config', 'commit.gpgsign', 'false');
-    });
-    afterEach(() => { fs.rmSync(repo, { recursive: true, force: true }); });
-    it('works in a repository with no commits yet', () => {
-        write('src/new.ts', 'export const a = 1;\n');
-        expect(parseDiff(diffFromGit(repo))).toEqual({ 'src/new.ts': new Set([1]) });
-    });
-    it('takes uncommitted edits and untracked files from the working tree', () => {
-        write('src/a.ts', 'export const a = 1;\nexport const b = 2;\n');
-        git('add', '-A');
-        git('commit', '-qm', 'init');
-        write('src/a.ts', 'export const a = 1;\nexport const b = 3;\n');
-        write('src/new.ts', 'export const c = 1;\nexport const d = 2;\n');
-        expect(parseDiff(diffFromGit(repo))).toEqual({ 'src/a.ts': new Set([2]), 'src/new.ts': new Set([1, 2]) });
-    });
-    it('takes a branch against its merge-base, committed and uncommitted', () => {
-        write('src/a.ts', 'export const a = 1;\n');
-        git('add', '-A');
-        git('commit', '-qm', 'init');
-        git('checkout', '-q', '-b', 'feature');
-        write('src/b.ts', 'export const b = 1;\n');
-        git('add', '-A');
-        git('commit', '-qm', 'feature');
-        write('src/a.ts', 'export const a = 1;\nexport const z = 2;\n');
-        expect(parseDiff(diffFromGit(repo, { mode: 'base', base: 'main' }))).toEqual({ 'src/a.ts': new Set([2]), 'src/b.ts': new Set([1]) });
-    });
-    it('fails a change that introduces a bug and ignores the same bug in untouched code', async () => {
-        write('src/old.ts', LEAKY);
-        git('add', '-A');
-        git('commit', '-qm', 'init');
-        write('src/notify.ts', LEAKY);
-        const config = ConfigSchema.parse({ version: 1, gates: { semantic_bugs: { enabled: true } } });
-        const result = await reviewChange({ cwd: repo, config });
-        const semantic = result.findings.filter(f => f.id === 'semantic-bugs');
-        expect(result.status).toBe('FAIL');
-        expect(semantic.map(f => [f.files?.[0], f.line])).toEqual([['src/notify.ts', 2]]);
-        expect(toReviewFinding(semantic[0])).toMatchObject({ id: 'semantic-bugs', file: 'src/notify.ts', line: 2, severity: 'high' });
-    });
-    it("names every check it ran in the summary, the review's own beside the gates", async () => {
-        write('src/a.ts', 'export const a = 1;\n');
-        git('add', '-A');
-        git('commit', '-qm', 'init');
-        write('src/b.ts', 'export const unused = 2;\n');
-        git('add', '-A');
-        const config = ConfigSchema.parse({ gates: { migration_order: { enabled: false } } });
-        const { report } = await reviewChange({ cwd: repo, config });
-        expect(report?.summary).toMatchObject({ 'unused-exports': 'FAIL', 'migration-order': 'SKIP', 'query-patterns': 'PASS', 'change-sweep': 'PASS' });
-        expect(report?.summary).not.toHaveProperty('redundancy'); // typed checks were not asked for
-    });
-    it('reports what the change introduced, not what the touched code already had', async () => {
-        const branchy = (name, extra = '') => [
-            `export function ${name}(x: number) {`,
-            ...Array.from({ length: 12 }, (_, i) => `  if (x === ${i}) return ${i};`),
-            extra,
-            '  return -1;',
-            '}',
-            '',
-        ].join('\n');
-        write('src/old.ts', branchy('legacy'));
-        git('add', '-A');
-        git('commit', '-qm', 'init');
-        write('src/old.ts', branchy('legacy', '  if (x === 99) return 99;'));
-        write('src/fresh.ts', branchy('fresh'));
-        const config = ConfigSchema.parse({ version: 1 });
-        const result = await reviewChange({ cwd: repo, config });
-        const complexity = [...result.findings, ...result.fileFindings, ...result.advisory].filter(f => f.id === 'AST_COMPLEXITY');
-        expect(complexity.map(f => f.files?.[0])).toEqual(['src/fresh.ts']);
-        expect(result.preexisting).toBeGreaterThanOrEqual(1);
-        const all = await reviewChange({ cwd: repo, config: ConfigSchema.parse({ version: 1, review: { show_preexisting: true } }) });
-        const shown = [...all.findings, ...all.fileFindings, ...all.advisory].filter(f => f.id === 'AST_COMPLEXITY');
-        expect(shown.map(f => f.files?.[0]).sort()).toEqual(['src/fresh.ts', 'src/old.ts']);
-        expect(all.preexisting).toBe(0);
-    }, 30_000); // two whole reviews, each running the rules on the change and on the base tree
-    it('lets a change dismiss its own finding only when the review trusts the working tree', async () => {
-        write('src/old.ts', 'export const a = 1;\n');
-        write('.gitignore', '.rigour/*\n!.rigour/dismissed.json\n');
-        git('add', '-A');
-        git('commit', '-qm', 'init');
-        git('checkout', '-q', '-b', 'pr');
-        write('src/notify.ts', LEAKY);
-        const config = ConfigSchema.parse({ version: 1, gates: { semantic_bugs: { enabled: true }, ...NO_DEAD_CODE } });
-        const key = findingKey((await reviewChange({ cwd: repo, config })).findings[0]);
-        write('.rigour/dismissed.json', JSON.stringify({ version: 1, entries: [{ key, reason: 'trust me', at: 'now' }] }));
-        git('add', '-A');
-        git('commit', '-qm', 'pr');
-        const trusting = await reviewChange({ cwd: repo, config, source: { mode: 'base', base: 'main' } });
-        expect([trusting.status, trusting.dismissed]).toEqual(['PASS', 1]);
-        expect(trusting.controlFilesChanged).toEqual(['.rigour/dismissed.json']);
-        const independent = await reviewChange({ cwd: repo, config, source: { mode: 'base', base: 'main' }, trustedRef: 'main' });
-        expect([independent.status, independent.dismissed]).toEqual(['FAIL', 0]);
-    });
-    it('runs every gate in a git worktree, where .git is a file', async () => {
-        write('src/a.ts', 'export const a = 1;\n');
-        git('add', '-A');
-        git('commit', '-qm', 'init');
-        const worktree = path.join(repo, 'wt');
-        git('worktree', 'add', '-q', worktree);
-        fs.writeFileSync(path.join(worktree, 'src/a.ts'), 'export const a = 1;\nexport const b = 2;\n');
-        const config = ConfigSchema.parse({ version: 1, ignore: ['.git/**', 'wt/**'] });
-        const result = await reviewChange({ cwd: worktree, config });
-        expect(result.gateErrors).toEqual([]);
-        expect(result.status).not.toBe('ERROR');
-    });
-    it('is ERROR when a proven gate crashed, and only lists a crashed heuristic gate', async () => {
-        write('src/a.ts', 'export const a = 1;\n');
-        const config = ConfigSchema.parse({ version: 1, gates: NO_DEAD_CODE });
-        const crash = (summary) => vi.spyOn(GateRunner.prototype, 'run').mockResolvedValueOnce({ status: 'FAIL', summary, failures: [], stats: { duration_ms: 0 } });
-        crash({ 'hallucinated-imports': 'ERROR' });
-        const proven = await reviewChange({ cwd: repo, config });
-        expect([proven.status, proven.gateErrors]).toEqual(['ERROR', ['hallucinated-imports']]);
-        crash({ 'style-drift': 'ERROR', 'semantic-bugs': 'PASS' });
-        const heuristic = await reviewChange({ cwd: repo, config });
-        expect([heuristic.status, heuristic.gateErrors]).toEqual(['PASS', ['style-drift']]);
-    });
-    it('passes when nothing changed', async () => {
-        write('src/a.ts', 'export const a = 1;\n');
-        git('add', '-A');
-        git('commit', '-qm', 'init');
-        const result = await reviewChange({ cwd: repo, config: ConfigSchema.parse({ version: 1 }) });
-        expect(result).toMatchObject({ status: 'PASS', findings: [], report: null });
-    });
-});

package/dist/review/reviewer/adapters.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/review/reviewer/adapters.test.js

@@ -1,60 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { ADAPTERS, apiVendor, selectReviewers } from './adapters.js';
-/** A real `codex exec --json` run (codex-cli 0.160.1), the warning's path shortened: the shape the adapter must read. */
-const CODEX = [
-    '{"type":"thread.started","thread_id":"01a11477-f9fd-7472-8d31-5863de4cbbdb"}',
-    '{"type":"item.completed","item":{"id":"item_0","type":"error","message":"Codex is ignoring 1 unrecognized configuration setting. Check for typos or deprecated settings.\\n  user (~/.codex/config.toml)"}}',
-    '{"type":"turn.started"}',
-    '{"type":"item.completed","item":{"id":"item_2","type":"agent_message","text":"{\\"answers\\":[{\\"id\\":\\"a1\\",\\"call\\":\\"unsure\\",\\"evidence\\":\\"none\\"}]}"}}',
-    '{"type":"turn.completed","usage":{"input_tokens":26565,"cached_input_tokens":13184,"cache_write_input_tokens":0,"output_tokens":24,"reasoning_output_tokens":0}}',
-].join('\n');
-describe('reading an agent CLI\'s answer', () => {
-    it('takes Codex\'s last agent message, never a warning, and its tokens', () => {
-        expect(ADAPTERS.codex.answer(CODEX)).toEqual({ text: '{"answers":[{"id":"a1","call":"unsure","evidence":"none"}]}', tokens: { input: 26565, output: 24 } });
-    });
-    it('takes Claude Code\'s result, its cost and its tokens', () => {
-        const out = JSON.stringify({ result: '{"prior_points":[]}', total_cost_usd: 0.42, usage: { input_tokens: 10, cache_read_input_tokens: 900, cache_creation_input_tokens: 90, output_tokens: 300 } });
-        expect(ADAPTERS.claude.answer(out)).toEqual({ text: '{"prior_points":[]}', costUsd: 0.42, tokens: { input: 1000, output: 300 } });
-    });
-    it('falls back to the raw output when it is not what the CLI usually prints', () => {
-        expect(ADAPTERS.claude.answer('not json')).toEqual({ text: 'not json' });
-        expect(ADAPTERS.codex.answer('plain text')).toEqual({ text: 'plain text' });
-    });
-    it("reads Claude Code's event stream: the answer and cost from its result, each turn's usage once, and what every tool call read", () => {
-        const events = [
-            { type: 'system', subtype: 'init' },
-            { type: 'assistant', message: { id: 'm1', usage: { input_tokens: 10, cache_read_input_tokens: 0, cache_creation_input_tokens: 4000, output_tokens: 50 }, content: [{ type: 'tool_use', id: 't1', name: 'Read', input: { file_path: '/work/full.diff' } }] } },
-            { type: 'user', message: { content: [{ type: 'tool_result', tool_use_id: 't1', content: 'x'.repeat(1200) }] } },
-            { type: 'assistant', message: { id: 'm2', usage: { input_tokens: 5, cache_read_input_tokens: 4000, cache_creation_input_tokens: 300, output_tokens: 20 }, content: [{ type: 'text', text: 'checking' }] } },
-            { type: 'assistant', message: { id: 'm2', usage: { input_tokens: 5, cache_read_input_tokens: 4000, cache_creation_input_tokens: 300, output_tokens: 20 }, content: [{ type: 'tool_use', id: 't2', name: 'Grep', input: { pattern: 'preloadAll' } }] } },
-            { type: 'user', message: { content: [{ type: 'tool_result', tool_use_id: 't2', content: [{ type: 'text', text: 'src/a.ts:3' }] }] } },
-            { type: 'result', result: '{"prior_points":[]}', total_cost_usd: 0.31, usage: { input_tokens: 15, cache_read_input_tokens: 4000, cache_creation_input_tokens: 4300, output_tokens: 70 } },
-        ];
-        const answer = ADAPTERS.claude.answer(events.map(e => JSON.stringify(e)).join('\n'));
-        expect(answer).toMatchObject({ text: '{"prior_points":[]}', costUsd: 0.31, tokens: { input: 8315, output: 70 } });
-        expect(answer.trace).toEqual({
-            turns: 2, // m2 arrived as two events: one turn, counted once
-            usage: { input: 15, cacheRead: 4000, cacheWrite: 4300, output: 70 },
-            calls: [
-                { turn: 1, tool: 'Read', target: '/work/full.diff', resultChars: 1200 },
-                { turn: 2, tool: 'Grep', target: 'preloadAll', resultChars: 10 },
-            ],
-        });
-        expect(ADAPTERS.claude.args('p', undefined)).toEqual(expect.arrayContaining(['--output-format', 'stream-json', '--verbose']));
-    });
-});
-describe('a judge reached through an API', () => {
-    it('is told apart by its model\'s maker, so cross and full modes pair it with a different vendor', () => {
-        expect(apiVendor({ model: 'anthropic/claude-sonnet-4.5' })).toBe('anthropic');
-        expect(apiVendor({ model: 'gpt-5' })).toBe('openai');
-        expect(apiVendor({ model: 'google/gemini-2.5-pro' })).toBe('google');
-        expect(apiVendor({ model: 'qwen3-coder' })).toBe('other');
-        expect(apiVendor({ model: 'qwen3-coder', vendor: 'openai' })).toBe('openai');
-        const vendorOf = (name) => (name === 'api' ? 'openai' : ADAPTERS[name].vendor);
-        expect(selectReviewers(['claude', 'api'], 'cross', new Set(['anthropic']), new Set(['claude', 'api']), 2, vendorOf)).toEqual(['api']); // the author's vendor is skipped
-        expect(selectReviewers(['claude', 'api'], 'full', new Set(), new Set(['claude', 'api']), 2, vendorOf)).toEqual(['claude', 'api']);
-        expect(ADAPTERS.api.answer(JSON.stringify({ result: '{"prior_points":[]}', usage: { input: 10, cacheRead: 5, cacheWrite: 0, output: 3 }, cost_usd: 0.02, trace: { turns: 2, usage: {}, calls: [] } }))).toMatchObject({ text: '{"prior_points":[]}', costUsd: 0.02, tokens: { input: 15, output: 3 }, trace: { turns: 2 } });
-        expect(ADAPTERS.codex.args('p', undefined, { reasoning: 'medium' })).toContain('model_reasoning_effort=medium');
-        expect(ADAPTERS.codex.args('p', undefined)).toContain('model_reasoning_effort=high');
-    });
-});

package/dist/review/reviewer/api-judge.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/review/reviewer/api-judge.test.js

@@ -1,108 +0,0 @@
-import { execFileSync } from 'child_process';
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { runApiJudge } from './api-judge.js';
-let repo;
-let work;
-beforeEach(() => {
-    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'api-judge-'));
-    work = fs.mkdtempSync(path.join(os.tmpdir(), 'api-judge-inputs-'));
-    execFileSync('git', ['-C', repo, 'init', '-q']);
-    fs.mkdirSync(path.join(repo, 'src'));
-    fs.writeFileSync(path.join(repo, 'src/job.ts'), 'export function job() {\n    return 1;\n}\n');
-    execFileSync('git', ['-C', repo, 'add', '-A']);
-    execFileSync('git', ['-C', repo, '-c', 'user.email=t@x', '-c', 'user.name=t', 'commit', '-qm', 'init']);
-    fs.writeFileSync(path.join(work, 'full.diff'), '+++ b/src/job.ts\n');
-});
-afterEach(() => { for (const d of [repo, work])
-    fs.rmSync(d, { recursive: true, force: true }); });
-/** A model that plays a scripted conversation: each entry is what it answers to the next request. */
-function model(turns) {
-    const seen = [];
-    let i = 0;
-    const fetchImpl = (async (_url, init) => {
-        const body = JSON.parse(init.body);
-        seen.push(body);
-        const turn = turns[i++] ?? { text: 'done' };
-        if (turn.status)
-            return new Response('nope', { status: turn.status });
-        const message = turn.tools
-            ? { role: 'assistant', content: null, tool_calls: turn.tools.map((t, k) => ({ id: `c${i}-${k}`, type: 'function', function: { name: t.name, arguments: JSON.stringify(t.args) } })) }
-            : { role: 'assistant', content: turn.text };
-        return new Response(JSON.stringify({ choices: [{ message }], usage: turn.usage ?? { prompt_tokens: 100, completion_tokens: 10, prompt_tokens_details: { cached_tokens: 60 } } }), { status: 200, headers: { 'content-type': 'application/json' } });
-    });
-    return { fetchImpl, seen };
-}
-const options = (fetchImpl, extra = {}) => ({ url: 'https://example.test/v1', model: 'some-model', key: 'k', maxTurns: 10, timeoutMs: 30_000, cwd: repo, roots: [repo, work], fetchImpl, ...extra });
-describe('the API judge', () => {
-    it('runs the tools the model asks for inside the checkout and the inputs, then returns its answer with the usage and the trace', async () => {
-        const { fetchImpl, seen } = model([
-            { tools: [{ name: 'read_file', args: { path: path.join(work, 'full.diff') } }, { name: 'read_file', args: { path: 'src/job.ts', start_line: 2, end_line: 2 } }] },
-            { tools: [{ name: 'search', args: { pattern: 'return' } }, { name: 'git', args: { args: ['log', '-1', '--format=%s'] } }, { name: 'list_dir', args: { path: 'src' } }] },
-            { text: '{"prior_points":[]}', usage: { prompt_tokens: 50, completion_tokens: 5, cost: 0.01 } },
-        ]);
-        const run = await runApiJudge('review this', options(fetchImpl));
-        expect(run.exitCode).toBe(0);
-        const answer = JSON.parse(run.stdout);
-        expect(answer.result).toBe('{"prior_points":[]}');
-        expect(answer.usage).toEqual({ input: 130, cacheRead: 120, cacheWrite: 0, output: 25 });
-        expect(answer.cost_usd).toBe(0.01);
-        expect(answer.trace.turns).toBe(3);
-        expect(answer.trace.calls.map(c => c.tool)).toEqual(['Read', 'Read', 'Grep', 'Bash', 'Glob']);
-        const toolResults = (request) => request.messages.filter((m) => m.role === 'tool').map((m) => m.content);
-        expect(toolResults(seen[1])).toEqual(['1: +++ b/src/job.ts\n2: ', '2:     return 1;']); // turn 1's reads, as the model got them
-        expect(toolResults(seen[2]).slice(2)).toEqual(['src/job.ts:2:    return 1;', 'init', 'job.ts']); // turn 2's search, git and listing
-        expect(seen[0].messages[0].role).toBe('system');
-        expect(seen[0].tools.map((t) => t.function.name)).toEqual(['read_file', 'search', 'list_dir', 'git']);
-    });
-    it('refuses to read outside the roots, a symlink out included, and refuses git that writes or points elsewhere', async () => {
-        fs.symlinkSync(os.homedir(), path.join(repo, 'out'));
-        const { fetchImpl, seen } = model([
-            { tools: [{ name: 'read_file', args: { path: '/etc/hosts' } }, { name: 'read_file', args: { path: 'out/.bashrc' } }, { name: 'git', args: { args: ['log', '--output=/tmp/x'] } }, { name: 'git', args: { args: ['push'] } }, { name: 'nope', args: {} }] },
-            { text: 'ok' },
-        ]);
-        await runApiJudge('p', options(fetchImpl));
-        const results = seen[1].messages.filter((m) => m.role === 'tool').map((m) => m.content);
-        expect(results).toEqual([
-            'refused: outside the repository and the review inputs', 'refused: outside the repository and the review inputs',
-            'refused: only read-only git commands, without options that write or point elsewhere', 'refused: only read-only git commands, without options that write or point elsewhere',
-            'refused: no tool named nope',
-        ]);
-    });
-    it('fails closed on a turn cap, an HTTP error and a timeout, saying why', async () => {
-        const loop = model(Array.from({ length: 5 }, () => ({ tools: [{ name: 'list_dir', args: { path: '.' } }] })));
-        expect(await runApiJudge('p', options(loop.fetchImpl, { maxTurns: 3 }))).toMatchObject({ exitCode: 1, stderr: expect.stringContaining('no answer within 3 turns') });
-        expect(await runApiJudge('p', options(model([{ status: 429 }]).fetchImpl))).toMatchObject({ exitCode: 1, stderr: expect.stringContaining('HTTP 429') });
-        const slow = (async (_u, init) => new Promise((_r, reject) => init.signal.addEventListener('abort', () => reject(new Error('aborted')))));
-        expect(await runApiJudge('p', options(slow, { timeoutMs: 50 }))).toMatchObject({ exitCode: 1, stderr: expect.stringContaining('request failed') });
-    });
-    it('fails closed on an empty final message, saying why, and echoes back only what the API needs to continue', async () => {
-        const empty = (async () => new Response(JSON.stringify({ choices: [{ message: { role: 'assistant', content: '', reasoning: 'thinking…' }, finish_reason: 'length' }], usage: {} }), { status: 200 }));
-        expect(await runApiJudge('p', options(empty))).toMatchObject({ exitCode: 1, stderr: expect.stringContaining('an empty answer on turn 1 (finish_reason length)') });
-        const providerError = (async () => new Response(JSON.stringify({ choices: [{ message: { role: 'assistant', content: '' }, finish_reason: 'error', error: { message: 'Provider returned error', code: 502 } }], usage: {} }), { status: 200 }));
-        expect(await runApiJudge('p', options(providerError))).toMatchObject({ exitCode: 1, stderr: expect.stringContaining('the API reported an error: {"message":"Provider returned error","code":502}') });
-        const { fetchImpl, seen } = model([{ tools: [{ name: 'list_dir', args: { path: '.' } }] }, { text: 'ok' }]);
-        await runApiJudge('p', options(fetchImpl));
-        const echoed = seen[1].messages.find((m) => m.role === 'assistant');
-        expect(Object.keys(echoed).sort()).toEqual(['content', 'role', 'tool_calls']); // no reasoning prose sent back
-        expect(seen[0].max_tokens).toBe(32000);
-    });
-    it('gives the judge its inputs inline, smallest first, the diff cut with a note when the budget runs out', async () => {
-        const { fetchImpl, seen } = model([{ text: 'ok' }]);
-        const inputs = [{ path: '/w/full.diff', text: 'x'.repeat(300_000) }, { path: '/w/pr-description.md', text: 'the description' }, { path: '/w/previous-reviews.md', text: 'the reviews' }];
-        await runApiJudge('review this', options(fetchImpl, { inputs }));
-        const first = seen[0].messages[1].content;
-        expect(first.startsWith('review this\n\nThe inputs named above, inline')).toBe(true);
-        expect(first.indexOf('### /w/previous-reviews.md')).toBeLessThan(first.indexOf('### /w/full.diff')); // smallest first
-        expect(first).toContain('…[cut here: read /w/full.diff with read_file for the rest]');
-        expect(first.length).toBeLessThan(241_000);
-    });
-    it('passes the reasoning effort when asked', async () => {
-        const { fetchImpl, seen } = model([{ text: 'ok' }]);
-        await runApiJudge('p', options(fetchImpl, { reasoning: 'low' }));
-        expect(seen[0].reasoning_effort).toBe('low');
-        expect(seen[0].model).toBe('some-model');
-    });
-});

package/dist/review/reviewer/background.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/review/reviewer/background.test.js

@@ -1,118 +0,0 @@
-import { execFileSync } from 'child_process';
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { ConfigSchema } from '../../types/index.js';
-import { backgroundReview, reviewStatus, startBackgroundReview } from './background.js';
-import { VerdictStore } from './store.js';
-let repo;
-let bin;
-const git = (...args) => execFileSync('git', ['-C', repo, ...args], { encoding: 'utf8' }).trim();
-const config = ConfigSchema.parse({ version: 1, review: { reviewer: { enabled: true } } });
-const originalPath = process.env.PATH;
-let PR = { number: 7, state: 'OPEN', isDraft: false, author: { login: 'author' }, body: 'desc' };
-const VERDICT = JSON.stringify({ prior_points: [], redundant: [], reads: [], scans: [], merge_impact: [], findings: [{ class: 'correctness', file: 'src/job.ts', line: 1, issue: 'never locks', quote: 'export const job = 1;', consequence: 'a second run reads stale rows' }], carried: [], resolved_previous: [] });
-/** Real git; a pull request on the branch; a claude that answers one finding. */
-const exec = async (command, args, options) => {
-    if (command === 'git') {
-        try {
-            return { exitCode: 0, stdout: execFileSync('git', args, { cwd: options.cwd, encoding: 'utf8' }), stderr: '' };
-        }
-        catch (error) {
-            return { exitCode: 1, stdout: '', stderr: String(error.message) };
-        }
-    }
-    if (command === 'gh') {
-        if (args[0] === 'pr')
-            return { exitCode: 0, stdout: JSON.stringify(PR), stderr: '' };
-        return { exitCode: 0, stdout: '[]', stderr: '' };
-    }
-    if (args[0] === '--version')
-        return { exitCode: 0, stdout: '1.0.0\n', stderr: '' };
-    return { exitCode: 0, stdout: JSON.stringify({ result: VERDICT }), stderr: '' };
-};
-beforeEach(() => {
-    bin = fs.mkdtempSync(path.join(os.tmpdir(), 'bin-'));
-    fs.writeFileSync(path.join(bin, process.platform === 'win32' ? 'claude.cmd' : 'claude'), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
-    process.env.PATH = [bin, originalPath ?? ''].join(path.delimiter);
-    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'background-'));
-    git('init', '-q', '-b', 'main');
-    git('config', 'user.email', 't@example.com');
-    git('config', 'user.name', 't');
-    git('config', 'commit.gpgsign', 'false');
-    fs.writeFileSync(path.join(repo, 'a.ts'), 'export const a = 1;\n');
-    git('add', '-A');
-    git('commit', '-qm', 'init');
-    git('checkout', '-qb', 'feature');
-    fs.mkdirSync(path.join(repo, 'src'));
-    fs.writeFileSync(path.join(repo, 'src/job.ts'), 'export const job = 1;\n');
-    git('add', '-A');
-    git('commit', '-qm', 'job');
-});
-afterEach(() => {
-    process.env.PATH = originalPath;
-    try {
-        git('worktree', 'prune');
-    }
-    catch { /* gone */ }
-    for (const dir of [repo, bin])
-        fs.rmSync(dir, { recursive: true, force: true });
-});
-describe('the background review', () => {
-    it('reviews the pushed commit in a worktree of its own, records the verdict under the branch, and leaves the checkout alone', async () => {
-        const head = git('rev-parse', 'HEAD');
-        fs.writeFileSync(path.join(repo, 'src/job.ts'), 'export const job = 2; // edited after the push\n'); // must not be what the reviewer reads
-        const lines = [];
-        const result = await backgroundReview(repo, { head, branch: 'feature', base: 'main' }, config, exec, line => lines.push(line));
-        expect(result).toMatchObject({ outcome: 'findings', pr: 7 });
-        expect(result.items).toEqual([expect.objectContaining({ file: 'src/job.ts', issue: 'never locks' })]);
-        expect(lines.at(-1)).toContain('never locks');
-        expect(fs.readFileSync(path.join(repo, 'src/job.ts'), 'utf8')).toContain('edited after the push');
-        const store = (await VerdictStore.open(repo, exec));
-        expect(store.branchState('feature')).toMatchObject({ head, mode: 'full' });
-        expect(fs.existsSync(store.worktreeDir(head))).toBe(false); // removed when done
-        const status = await reviewStatus(repo, 'feature', exec);
-        expect(status).toMatchObject({ branch: 'feature', last: { head, mode: 'full', open: [expect.objectContaining({ issue: 'never locks' })] } });
-        expect(status?.running).toBeUndefined();
-    });
-    it('asks whether a review is due before checking anything out, and the status says why it was skipped', async () => {
-        PR = { ...PR, isDraft: true };
-        try {
-            const head = git('rev-parse', 'HEAD');
-            const result = await backgroundReview(repo, { head, branch: 'feature', base: 'main' }, config, exec, () => undefined);
-            expect(result).toMatchObject({ outcome: 'skipped', reason: expect.stringContaining('is a draft') });
-            const store = (await VerdictStore.open(repo, exec));
-            expect(fs.existsSync(store.worktreeDir(head))).toBe(false); // never checked out
-            expect((await reviewStatus(repo, 'feature', exec))?.attempt).toMatchObject({ head, outcome: 'skipped', reason: expect.stringContaining('is a draft') });
-        }
-        finally {
-            PR = { ...PR, isDraft: false };
-        }
-    });
-    it('starts detached with a pid the status reports, and a newer start for the branch ends the older one', async () => {
-        const head = git('rev-parse', 'HEAD');
-        const sleeper = [process.execPath, '-e', 'setTimeout(() => {}, 20000)'];
-        const log = await startBackgroundReview(repo, { head, branch: 'feature', base: 'main' }, sleeper, exec);
-        expect(log).toMatch(/feature\.log$/);
-        const first = (await reviewStatus(repo, 'feature', exec))?.running;
-        expect(first).toMatchObject({ head });
-        expect(alive(first.pid)).toBe(true);
-        await startBackgroundReview(repo, { head: 'b'.repeat(40), branch: 'feature', base: 'main' }, sleeper, exec);
-        const second = (await reviewStatus(repo, 'feature', exec))?.running;
-        expect(second?.pid).not.toBe(first.pid);
-        for (let waited = 0; alive(first.pid) && waited < 3000; waited += 50)
-            await new Promise(resolve => setTimeout(resolve, 50)); // under load the signal lands later
-        expect(alive(first.pid)).toBe(false);
-        process.kill(second.pid);
-    });
-});
-function alive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}

package/dist/review/reviewer/context.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/review/reviewer/context.test.js

@@ -1,45 +0,0 @@
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { describe, expect, it } from 'vitest';
-import { buildContext, dismissedAs } from './context.js';
-const dismissal = { id: 'abcdef0123', file: 'src/x.ts', line: 40, class: 'correctness', issue: 'cache key built from user id may collide', reason: 'ids are unique per tenant', at: '2026-10-06' };
-const finding = (over) => ({ id: 'ffff000011', kind: 'finding', class: 'correctness', file: 'src/x.ts', line: 40, issue: 'cache key built from the user id may collide', consequence: 'two users share an entry', ...over });
-describe('a dismissal', () => {
-    it('covers the same finding re-worded nearby', () => {
-        expect(dismissedAs(finding({}), [dismissal])).toBe(dismissal);
-        expect(dismissedAs(finding({ line: 42, issue: 'the cache key built from user id may collide' }), [dismissal])).toBe(dismissal);
-        expect(dismissedAs(finding({ id: 'abcdef0123', issue: 'anything at all' }), [dismissal])).toBe(dismissal); // its own id
-    });
-    it('never hides a different bug, even on the same line and in the same class', () => {
-        expect(dismissedAs(finding({ issue: 'cache entry never invalidated when the user changes' }), [dismissal])).toBeUndefined();
-        expect(dismissedAs(finding({ line: 42, issue: 'cache entry never invalidated when user id changes' }), [dismissal])).toBeUndefined();
-        expect(dismissedAs(finding({ line: 80 }), [dismissal])).toBeUndefined(); // far away
-        expect(dismissedAs(finding({ class: 'production-cost' }), [dismissal])).toBeUndefined();
-        expect(dismissedAs({ ...finding({}), kind: 'prior' }, [dismissal])).toBeUndefined(); // a human's point is never dismissed this way
-    });
-});
-describe('what the judges are told the team knows', () => {
-    it('shows verified lessons by default, candidates too with all, none when off, each with the words it came from', () => {
-        const repo = fs.mkdtempSync(path.join(os.tmpdir(), 'context-'));
-        try {
-            const lesson = { file: 'src/a.ts', symbols: ['save'], createdAt: '', updatedAt: '' };
-            fs.mkdirSync(path.join(repo, '.rigour'));
-            fs.writeFileSync(path.join(repo, '.rigour', 'review-lessons.json'), JSON.stringify({ version: 1, lessons: [
-                    { ...lesson, id: 'v', text: 'Make every save idempotent on retry.', state: 'verified', evidence: [{ pr: 3, comment: 'a', author: 'p', said: 'A retry here saves twice.' }, { pr: 4, comment: 'b', author: 'p' }] },
-                    { ...lesson, id: 'c', text: 'Log the save id on failure.', state: 'candidate', evidence: [{ pr: 5, comment: 'c', author: 'p' }] },
-                ] }));
-            const diff = 'diff --git a/src/a.ts b/src/a.ts\n--- a/src/a.ts\n+++ b/src/a.ts\n@@ -0,0 +1,1 @@\n+export const save = 1;\n';
-            const told = (lessons) => buildContext({ cwd: repo, stateRoot: repo, dismissals: [], diff, router: undefined, lessons, previousPanel: undefined, touched: new Set(), docs: [], checks: [] }).text;
-            expect(told()).toContain('src/a.ts: Make every save idempotent on retry. (in their words: "A retry here saves twice.") (acted on in PR #3, #4)');
-            expect(told()).not.toContain('Log the save id');
-            expect(told('all')).toContain('Log the save id on failure.');
-            expect(told('off')).not.toContain('idempotent');
-            fs.writeFileSync(path.join(repo, 'AGENTS.md'), '- Every call to `save` in `src/a.ts` must be idempotent on retry.\n');
-            expect(told()).toMatch(/## Rules this repository wrote for itself[^\n]*\n- \[[0-9a-f]{10}\] \(AGENTS\.md, requirement\) Every call to `save` in `src\/a\.ts` must be idempotent on retry\./);
-        }
-        finally {
-            fs.rmSync(repo, { recursive: true, force: true });
-        }
-    });
-});

package/dist/review/reviewer/exec.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/review/reviewer/exec.test.js

@@ -1,59 +0,0 @@
-import os from 'os';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { defaultExec, githubToken } from './exec.js';
-describe('running a command', () => {
-    it('passes the command\'s own output through', async () => {
-        const result = await defaultExec(process.execPath, ['-e', 'process.stdout.write("out"); process.stderr.write("err"); process.exit(3)'], { cwd: os.tmpdir(), timeoutMs: 30_000 });
-        expect(result).toEqual({ exitCode: 3, stdout: 'out', stderr: 'err' });
-    });
-    it('gives the command an ended stdin, so one that reads it never waits and one that exits at once never fails', async () => {
-        const reader = await defaultExec(process.execPath, ['-e', 'let n = 0; process.stdin.on("data", d => n += d.length).on("end", () => process.stdout.write(`read ${n}`))'], { cwd: os.tmpdir(), timeoutMs: 30_000 });
-        expect(reader).toEqual({ exitCode: 0, stdout: 'read 0', stderr: '' });
-        const runs = await Promise.all(Array.from({ length: 50 }, () => defaultExec(process.execPath, ['-e', 'process.stdout.write("ok")'], { cwd: os.tmpdir(), timeoutMs: 30_000 })));
-        expect(runs.every(r => r.exitCode === 0 && r.stdout === 'ok')).toBe(true);
-    });
-    it('keeps a variable the command must not see out of its environment, and passes the rest through', async () => {
-        process.env.RIGOUR_TEST_SECRET = 'gateway-key';
-        process.env.RIGOUR_TEST_KEPT = 'kept';
-        try {
-            const print = ['-e', 'process.stdout.write(JSON.stringify({ secret: process.env.RIGOUR_TEST_SECRET ?? null, kept: process.env.RIGOUR_TEST_KEPT ?? null, added: process.env.RIGOUR_TEST_ADDED ?? null }))'];
-            const hidden = await defaultExec(process.execPath, print, { cwd: os.tmpdir(), timeoutMs: 30_000, env: { RIGOUR_TEST_ADDED: 'added' }, unset: ['RIGOUR_TEST_SECRET'] });
-            expect(JSON.parse(hidden.stdout)).toEqual({ secret: null, kept: 'kept', added: 'added' });
-            const inherited = await defaultExec(process.execPath, print, { cwd: os.tmpdir(), timeoutMs: 30_000 });
-            expect(JSON.parse(inherited.stdout)).toEqual({ secret: 'gateway-key', kept: 'kept', added: null });
-        }
-        finally {
-            delete process.env.RIGOUR_TEST_SECRET;
-            delete process.env.RIGOUR_TEST_KEPT;
-        }
-    });
-    it('says why a command that never answered failed: not started, or timed out', async () => {
-        const missing = await defaultExec('rigour-no-such-command', [], { cwd: os.tmpdir(), timeoutMs: 30_000 });
-        expect(missing.exitCode).not.toBe(0);
-        expect(missing.stderr).toContain('rigour-no-such-command'); // ENOENT on Unix, "is not recognized" on Windows
-        const slow = await defaultExec(process.execPath, ['-e', 'setTimeout(() => {}, 10_000)'], { cwd: os.tmpdir(), timeoutMs: 200 });
-        expect(slow.exitCode).not.toBe(0);
-        expect(slow.stderr).toMatch(/timed out/i);
-    });
-});
-describe('the token GitHub is read with', () => {
-    afterEach(() => { vi.unstubAllEnvs(); });
-    const gh = (tokens, asked) => async (_command, args) => {
-        asked.push(args);
-        const user = args[args.indexOf('--user') + 1];
-        const token = args.includes('--user') ? tokens[user] : tokens.active;
-        return token ? { exitCode: 0, stdout: `${token}\n`, stderr: '' } : { exitCode: 1, stdout: '', stderr: 'no account' };
-    };
-    it('is an explicit token first, then the named account, and the active account only when none is named', async () => {
-        vi.stubEnv('GH_TOKEN', '');
-        vi.stubEnv('GITHUB_TOKEN', '');
-        const asked = [];
-        const tokens = { active: 'other-employer', work: 'work-token' };
-        expect(await githubToken(os.tmpdir(), 'work', gh(tokens, asked))).toBe('work-token');
-        expect(await githubToken(os.tmpdir(), undefined, gh(tokens, asked))).toBe('other-employer');
-        await expect(githubToken(os.tmpdir(), 'missing', gh(tokens, asked))).rejects.toThrow('GitHub account missing is named for reading');
-        expect(asked).toEqual([['auth', 'token', '--user', 'work'], ['auth', 'token'], ['auth', 'token', '--user', 'missing']]); // a named account never falls back to the active one
-        vi.stubEnv('GITHUB_TOKEN', 'ci-token');
-        expect(await githubToken(os.tmpdir(), 'work', gh(tokens, asked))).toBe('ci-token');
-    });
-});

package/dist/review/reviewer/inputs.test.d.ts

@@ -1 +0,0 @@
-export {};