@rigour-labs/core 6.7.10 → 6.8.1-rc.1

package/dist/storage/local-memory.test.js

@@ -1,55 +0,0 @@
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-/** An in-memory stand-in for the local SQLite store: records writes, answers the two reads under test. */
-const db = vi.hoisted(() => ({
-    writes: [],
-    patterns: [],
-    findings: [],
-    reset() { this.writes = []; this.patterns = []; this.findings = []; },
-}));
-vi.mock('./db.js', () => {
-    const store = {
-        run: async (sql) => { db.writes.push(sql.trim().split(/\s+/).slice(0, 3).join(' ')); return { changes: 1, lastID: 0 }; },
-        get: async () => undefined,
-        all: async (sql) => (sql.includes('FROM patterns') ? db.patterns : sql.includes('FROM findings') ? db.findings : []),
-        exec: async () => undefined,
-        transaction: async (work) => work(store),
-        close: async () => undefined,
-    };
-    return { openDatabase: async () => store };
-});
-const { checkLocalPatterns, persistAndReinforce } = await import('./local-memory.js');
-let repo;
-beforeEach(() => {
-    db.reset();
-    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'local-memory-'));
-    fs.mkdirSync(path.join(repo, 'src'));
-});
-afterEach(() => fs.rmSync(repo, { recursive: true, force: true }));
-const failure = (id, line) => ({ id, title: id, details: 'x', severity: 'medium', provenance: 'traditional', files: ['src/a.ts'], line });
-describe('persistAndReinforce', () => {
-    it('reinforces each category once per scan, however many findings it has', async () => {
-        await persistAndReinforce(repo, { status: 'FAIL', failures: [failure('content-check', 1), failure('content-check', 2), failure('content-check', 3), failure('ast', 4)], stats: {} });
-        expect(db.writes.filter(w => w.startsWith('INSERT INTO patterns'))).toHaveLength(2);
-    });
-});
-describe('checkLocalPatterns', () => {
-    const remembered = (scanTime) => ({ file: 'src/a.ts', line: 3, category: 'security', description: 'token logged', confidence: 0.9, scan_time: scanTime });
-    it('replays a remembered finding while its file is unchanged since that scan, once', async () => {
-        fs.writeFileSync(path.join(repo, 'src/a.ts'), 'log(token)\n');
-        const after = fs.statSync(path.join(repo, 'src/a.ts')).mtimeMs + 1000;
-        db.patterns = [{ pattern: 'security', strength: 0.9 }];
-        db.findings = [remembered(after), remembered(after)];
-        const findings = await checkLocalPatterns(repo, ['src/a.ts']);
-        expect(findings.map(f => f.description)).toEqual(['[Local Memory] token logged']);
-    });
-    it('never replays a finding for a file edited since, which may be the fix', async () => {
-        fs.writeFileSync(path.join(repo, 'src/a.ts'), 'log(redact(token))\n');
-        const before = fs.statSync(path.join(repo, 'src/a.ts')).mtimeMs - 1000;
-        db.patterns = [{ pattern: 'security', strength: 0.9 }];
-        db.findings = [remembered(before)];
-        expect(await checkLocalPatterns(repo, ['src/a.ts'])).toEqual([]);
-    });
-});

package/dist/storage/share-memory.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/share-memory.test.js

@@ -1,34 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-const db = vi.hoisted(() => ({ rows: [], outbox: 0, reset() { this.rows = []; this.outbox = 0; } }));
-vi.mock('./db.js', () => {
-    const store = {
-        run: async (sql, ...params) => {
-            if (sql.includes('INSERT INTO lessons'))
-                db.rows.push({ id: params[0], visibility: 'team', state: 'candidate', kind: 'memory', subject: params[4] });
-            if (sql.includes('INSERT INTO sync_outbox'))
-                db.outbox++;
-            return { changes: 1, lastID: 0 };
-        },
-        get: async (sql, ...params) => (sql.includes("kind = 'memory'") ? db.rows.find(r => r.subject === params[1]) : undefined),
-        all: async () => [],
-        exec: async () => undefined,
-        close: async () => undefined,
-    };
-    return { openDatabase: async () => store };
-});
-vi.mock('./local-encryption.js', () => ({ encryptLocalPayload: async (v) => JSON.stringify(v), decryptLocalPayload: async (v) => JSON.parse(v) }));
-vi.mock('./team-store.js', () => ({ loadTeamConfiguration: async () => null }));
-const { shareMemoryLesson } = await import('./lessons.js');
-beforeEach(() => db.reset());
-describe('shareMemoryLesson', () => {
-    it('stores a team candidate of kind memory, once per memory', async () => {
-        const first = await shareMemoryLesson(process.cwd(), 'retries', 'Use withRetry from lib/net.');
-        const again = await shareMemoryLesson(process.cwd(), 'retries', 'Use withRetry from lib/net.');
-        expect(first).toBe(again);
-        expect(db.rows).toEqual([{ id: first, visibility: 'team', state: 'candidate', kind: 'memory', subject: 'retries: Use withRetry from lib/net.' }]);
-    });
-    it('queues nothing for sync until team mode is configured', async () => {
-        await shareMemoryLesson(process.cwd(), 'naming', 'Hooks are named useX.');
-        expect(db.outbox).toBe(0);
-    });
-});

package/dist/storage/team-diagnostics.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/team-diagnostics.test.js

@@ -1,51 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { diagnoseMissingMembership, explainTeamConnectionError } from './team-diagnostics.js';
-import { TEAM_SCHEMA } from './team-schema.js';
-function pool(rows) {
-    return {
-        query: async () => {
-            if (rows instanceof Error)
-                throw rows;
-            return { rows, rowCount: rows.length };
-        },
-    };
-}
-describe('explainTeamConnectionError', () => {
-    it('explains an untrusted certificate chain with the CA fix', () => {
-        const message = explainTeamConnectionError(Object.assign(new Error('self-signed certificate in certificate chain'), { code: 'SELF_SIGNED_CERT_IN_CHAIN' }));
-        expect(message).toContain('NODE_EXTRA_CA_CERTS');
-        expect(message).toContain('sslmode=verify-full');
-    });
-    it('points a missing schema at init-schema', () => {
-        expect(explainTeamConnectionError({ code: '42P01', message: 'relation "rigour.memberships" does not exist' })).toContain('rigour team init-schema');
-    });
-    it('explains a rejected login and an unreachable host', () => {
-        expect(explainTeamConnectionError({ code: '28P01', message: 'password authentication failed' })).toContain('rejected the login');
-        expect(explainTeamConnectionError({ code: 'ECONNREFUSED', message: 'connect ECONNREFUSED' })).toContain('Cannot reach');
-    });
-    it('passes other errors through', () => {
-        expect(explainTeamConnectionError(new Error('something else'))).toBe('something else');
-    });
-});
-describe('diagnoseMissingMembership', () => {
-    it('names row-level security without a policy as the cause', async () => {
-        const message = await diagnoseMissingMembership(pool([{ table_name: 'memberships' }, { table_name: 'meta' }]));
-        expect(message).toContain('rigour.memberships and rigour.meta');
-        expect(message).toContain('init-schema');
-    });
-    it('reports a missing membership when nothing hides it', async () => {
-        expect(await diagnoseMissingMembership(pool([]))).toContain('no membership');
-    });
-    it('falls back to the membership message when the catalog cannot be read', async () => {
-        expect(await diagnoseMissingMembership(pool(new Error('permission denied')))).toContain('no membership');
-    });
-});
-describe('team schema', () => {
-    it('protects every team table with row-level security and a read policy', () => {
-        for (const table of ['lessons', 'memberships', 'meta']) {
-            expect(TEAM_SCHEMA).toContain(`ALTER TABLE rigour.${table} ENABLE ROW LEVEL SECURITY;`);
-        }
-        expect(TEAM_SCHEMA).toContain('CREATE POLICY memberships_read_own ON rigour.memberships FOR SELECT USING (db_role = current_user);');
-        expect(TEAM_SCHEMA).toContain('CREATE POLICY meta_read ON rigour.meta FOR SELECT USING (true);');
-    });
-});

package/dist/storage/team-scope.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/team-scope.test.js

@@ -1,22 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { repositoryAllowed, withheldReason } from './team-scope.js';
-const scope = { organizationId: 'acme', repositories: ['github.com/acme/*', 'https://GitLab.com/Acme/api'] };
-describe('team scope', () => {
-    it('sends lessons only from the repositories the team lists', () => {
-        expect(repositoryAllowed('https://github.com/acme/web', scope)).toBe(true);
-        expect(repositoryAllowed('https://gitlab.com/acme/api', scope)).toBe(true);
-        expect(repositoryAllowed('https://gitlab.com/acme/api-internal', scope)).toBe(false);
-        expect(repositoryAllowed('https://github.com/other-org/web', scope)).toBe(false);
-        expect(repositoryAllowed('https://github.com/acme-evil/web', scope)).toBe(false);
-    });
-    it('sends nothing when the team lists no repositories', () => {
-        expect(repositoryAllowed('https://github.com/acme/web', { organizationId: 'acme' })).toBe(false);
-    });
-    it('keeps personal lessons and unknown repositories on the machine, and says why', () => {
-        expect(withheldReason('personal', 'https://github.com/acme/web', scope)).toBe('personal lesson');
-        expect(withheldReason('personal', 'https://github.com/acme/web', { ...scope, syncPersonal: true })).toBeNull();
-        expect(withheldReason('team', undefined, scope)).toBe('repository unknown on this machine');
-        expect(withheldReason('team', 'https://github.com/other-org/web', scope)).toContain('github.com/other-org/web');
-        expect(withheldReason('team', 'https://github.com/acme/web', scope)).toBeNull();
-    });
-});

package/dist/storage/team-store.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/team-store.test.js

@@ -1,11 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { validateTeamDatabaseUrl } from './team-store.js';
-describe('team database configuration', () => {
-    it('requires TLS for remote PostgreSQL URLs', () => {
-        expect(() => validateTeamDatabaseUrl('postgresql://user:pass@db.example.com/rigour')).toThrow(/sslmode/);
-        expect(() => validateTeamDatabaseUrl('postgresql://user:pass@db.example.com/rigour?sslmode=verify-full')).not.toThrow();
-    });
-    it('rejects non-PostgreSQL URLs', () => {
-        expect(() => validateTeamDatabaseUrl('mysql://localhost/rigour')).toThrow(/postgres/);
-    });
-});

package/dist/storage/team-sync-scope.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/team-sync-scope.test.js

@@ -1,100 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-/** The outbox and repositories a machine holds, and what reached the team database. */
-const state = vi.hoisted(() => ({ outbox: [], repos: new Map(), sent: [], refuse: new Set(), meta: new Map(), remote: [], since: [] }));
-vi.mock('./db.js', () => ({
-    openDatabase: async () => ({
-        all: async () => state.outbox.filter(o => o.synced_at == null),
-        get: async (sql, id) => sql.includes('FROM meta')
-            ? (state.meta.has(id) ? { value: state.meta.get(id) } : undefined)
-            : (state.repos.has(id) ? { canonical_uri: state.repos.get(id) } : undefined),
-        run: async (sql, ...p) => {
-            if (sql.startsWith('INSERT INTO meta'))
-                state.meta.set(p[0], p[1]);
-            if (sql.startsWith('UPDATE sync_outbox SET synced_at')) {
-                const id = p.at(-1);
-                Object.assign(state.outbox.find(o => o.id === id) ?? {}, { synced_at: p[0], last_error: p.length === 3 ? p[1] : null });
-            }
-            return { changes: 1 };
-        },
-        close: async () => undefined,
-    }),
-}));
-vi.mock('./local-encryption.js', () => ({ encryptLocalPayload: async (v) => JSON.stringify(v), decryptLocalPayload: async (v) => JSON.parse(v) }));
-vi.mock('pg', () => ({
-    Pool: class {
-        async query(sql, params) {
-            if (sql.includes('INSERT INTO rigour.lessons')) {
-                if (state.refuse.has(params[0]))
-                    throw Object.assign(new Error('new row violates row-level security policy for table "lessons"'), { code: '42501' });
-                state.sent.push(params[0]);
-                return { rowCount: 1, rows: [] };
-            }
-            if (sql.includes('FROM rigour.lessons')) {
-                state.since.push(params[3]);
-                return { rowCount: 0, rows: state.remote.filter(row => row.updated_at > params[3]) };
-            }
-            return { rowCount: 1, rows: [] };
-        }
-        async end() { }
-    },
-}));
-const { syncTeamOutbox } = await import('./team-store.js');
-const queue = (id, repositoryId, visibility) => state.outbox.push({ id: `outbox-${id}`, payload_json: JSON.stringify({ id, repositoryId, visibility, evidence: {} }), synced_at: null });
-const TEAM_ENV = {
-    RIGOUR_ORGANIZATION_ID: 'acme', RIGOUR_TEAM_ID: 'web', RIGOUR_ACTOR_ID: 'dev-1',
-    RIGOUR_TEAM_DATABASE_URL: 'postgresql://localhost/rigour', RIGOUR_TEAM_REPOSITORIES: 'github.com/acme/*',
-};
-const saved = { ...process.env };
-beforeEach(() => {
-    Object.assign(process.env, TEAM_ENV);
-    delete process.env.RIGOUR_TEAM_SYNC_PERSONAL;
-    state.outbox = [];
-    state.sent = [];
-    state.refuse = new Set();
-    state.meta = new Map();
-    state.remote = [];
-    state.since = [];
-    state.repos = new Map([['r-team', 'https://github.com/acme/web'], ['r-other', 'https://github.com/other-org/app']]);
-    queue('l-team', 'r-team', 'team');
-    queue('l-other', 'r-other', 'team');
-    queue('l-personal', 'r-team', 'personal');
-    queue('l-unknown', 'r-gone', 'team');
-});
-afterEach(() => { process.env = { ...saved }; });
-describe('team sync scope', () => {
-    it("sends only the team's own shared lessons and says what it kept back", async () => {
-        expect(await syncTeamOutbox({ dryRun: true })).toMatchObject({ pending: 1, withheld: 3 });
-        expect(state.sent).toEqual([]);
-        const result = await syncTeamOutbox();
-        expect(result).toMatchObject({ synced: 1, withheld: 3 });
-        expect(state.sent).toEqual(['l-team']);
-        const reasons = Object.fromEntries(state.outbox.map(o => [o.id, o.last_error]));
-        expect(reasons['outbox-l-other']).toContain('github.com/other-org/app');
-        expect(reasons['outbox-l-personal']).toContain('personal lesson');
-        expect(reasons['outbox-l-unknown']).toContain('repository unknown');
-        expect(await syncTeamOutbox({ dryRun: true })).toMatchObject({ pending: 0, withheld: 0 }); // never retried
-    });
-    it('sets aside a lesson the database refuses and sends the rest of the queue', async () => {
-        state.outbox = [];
-        queue('l-refused', 'r-team', 'team'); // queued first: it must not hold back what comes after
-        queue('l-team', 'r-team', 'team');
-        state.refuse.add('l-refused');
-        expect(await syncTeamOutbox()).toMatchObject({ synced: 1 });
-        expect(state.sent).toEqual(['l-team']);
-        expect(state.outbox.find(o => o.id === 'outbox-l-refused').last_error).toContain('refused by the team database: new row violates row-level security');
-        expect(await syncTeamOutbox({ dryRun: true })).toMatchObject({ pending: 0 }); // not tried again
-    });
-    it('pulls only what changed since the last pull, re-reading a margin for slow clocks', async () => {
-        const lesson = (id, updated) => ({ id, repository_id: 'r-team', actor_id: 'dev-2', team_id: 'web', visibility: 'team', state: 'promoted', kind: 'k', subject: 's', evidence_json: {}, confidence: 1, source: 'x', supersedes_id: null, created_at: updated, updated_at: updated });
-        const HOUR = 3_600_000;
-        state.remote = [lesson('a', 10 * HOUR), lesson('b', 20 * HOUR)];
-        expect(await syncTeamOutbox()).toMatchObject({ pulled: 2 });
-        expect(state.since).toEqual([0]); // the first pull reads everything
-        expect(await syncTeamOutbox()).toMatchObject({ pulled: 1 }); // only b, inside the 15-minute margin
-        expect(state.since[1]).toBe(20 * HOUR - 15 * 60_000);
-    });
-    it('sends nothing when the team lists no repositories', async () => {
-        delete process.env.RIGOUR_TEAM_REPOSITORIES;
-        expect(await syncTeamOutbox({ dryRun: true })).toMatchObject({ pending: 0, withheld: 4 });
-    });
-});

package/dist/storage/team-vector-store.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/team-vector-store.test.js

@@ -1,56 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { getTeamSemanticHealth, upsertTeamLessonEmbedding } from './team-vector-store.js';
-const config = {
-    organizationId: 'acme',
-    teamId: 'platform',
-    actorId: 'alice',
-    databaseUrl: 'postgresql://localhost/rigour',
-    semantic: {
-        provider: 'pgvector',
-        model: 'Xenova/all-MiniLM-L6-v2',
-        dimensions: 384,
-    },
-};
-describe('pgvector team health', () => {
-    it('reports extension, model, and embedding coverage', async () => {
-        const pool = {
-            query: vi.fn(async () => ({ rows: [{
-                        extversion: '0.8.1',
-                        table_ready: true,
-                        indexed_lessons: 12,
-                        missing_lessons: 3,
-                    }] })),
-            end: async () => undefined,
-        };
-        await expect(getTeamSemanticHealth(pool, config)).resolves.toEqual({
-            provider: 'pgvector',
-            status: 'ready',
-            extensionVersion: '0.8.1',
-            model: 'Xenova/all-MiniLM-L6-v2',
-            dimensions: 384,
-            indexedLessons: 12,
-            missingLessons: 3,
-        });
-        expect(pool.query).toHaveBeenCalledWith(expect.stringContaining("lesson.state IN ('validated', 'promoted')"), ['acme', 'platform', 'Xenova/all-MiniLM-L6-v2', 'alice']);
-    });
-    it('fails health checks when vector storage is incomplete', async () => {
-        const pool = {
-            query: async () => ({ rows: [{ extversion: null, table_ready: false }] }),
-            end: async () => undefined,
-        };
-        await expect(getTeamSemanticHealth(pool, config)).rejects.toThrow(/vector extension/);
-    });
-    it('does not embed unvalidated candidate lessons', async () => {
-        const pool = { query: vi.fn(), end: async () => undefined };
-        await expect(upsertTeamLessonEmbedding(pool, config, {
-            id: 'candidate-1',
-            repositoryId: 'repo-1',
-            actorId: 'alice',
-            kind: 'interaction',
-            subject: 'Unverified suggestion',
-            source: 'mcp',
-            state: 'candidate',
-        })).resolves.toBe(false);
-        expect(pool.query).not.toHaveBeenCalled();
-    });
-});

package/dist/storage/telemetry-scope.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/telemetry-scope.test.js

@@ -1,38 +0,0 @@
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterAll, describe, expect, it, vi } from 'vitest';
-/** Every open goes to a scratch database, never ~/.rigour/rigour.db. */
-const dbFile = vi.hoisted(() => require('path').join(require('os').tmpdir(), `rigour-telemetry-${process.pid}.db`));
-vi.mock('./db.js', async (importOriginal) => {
-    const real = await importOriginal();
-    return { ...real, openDatabase: (p) => real.openDatabase(p ?? dbFile) };
-});
-const { openDatabase, isSQLiteAvailable } = await import('./db.js');
-const { getCheckpointMetrics, getContextEvents, recordCheckpointMetric, recordContextEvent } = await import('./context-telemetry.js');
-const repoA = fs.mkdtempSync(path.join(os.tmpdir(), 'telemetry-a-'));
-const repoB = fs.mkdtempSync(path.join(os.tmpdir(), 'telemetry-b-'));
-afterAll(() => {
-    for (const p of [dbFile, `${dbFile}-wal`, `${dbFile}-shm`])
-        fs.rmSync(p, { force: true });
-    for (const dir of [repoA, repoB])
-        fs.rmSync(dir, { recursive: true, force: true });
-});
-describe.runIf(isSQLiteAvailable())('telemetry scoped to its repository', () => {
-    it('migrates idempotently when two processes open the database at once', async () => {
-        const [a, b] = await Promise.all([openDatabase(), openDatabase()]);
-        const columns = (await a.all('PRAGMA table_info(checkpoint_metrics)')).map((c) => c.name);
-        expect(columns).toContain('repository_id');
-        await a.close();
-        await b.close();
-    });
-    it("shows a repository its own checkpoints and context events, never another's", async () => {
-        await recordCheckpointMetric({ checkpointId: 'cp-a', taskId: 't', agentId: 'agent', checkpointTokens: 10, rawStateTokens: 0, replayTokensAvoided: 0 }, repoA);
-        await recordCheckpointMetric({ checkpointId: 'cp-b', taskId: 't', agentId: 'agent', checkpointTokens: 10, rawStateTokens: 0, replayTokensAvoided: 0 }, repoB);
-        await recordContextEvent({ toolName: 'rigour_recall', cacheStatus: 'miss', candidateTokens: 0, returnedTokens: 0 }, repoA);
-        expect((await getCheckpointMetrics(undefined, repoA)).map(m => m.checkpointId)).toEqual(['cp-a']);
-        expect((await getCheckpointMetrics(undefined, repoB)).map(m => m.checkpointId)).toEqual(['cp-b']);
-        expect(await getContextEvents(undefined, repoB)).toEqual([]);
-        expect((await getContextEvents(undefined, repoA)).map(e => e.toolName)).toEqual(['rigour_recall']);
-    });
-});

package/dist/telemetry/telemetry.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/telemetry/telemetry.test.js

@@ -1,64 +0,0 @@
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { countUsage, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, trackUsage } from './telemetry.js';
-let home;
-const env = { RIGOUR_MIXPANEL_TOKEN: 'tok' };
-beforeEach(() => { home = fs.mkdtempSync(path.join(os.tmpdir(), 'telemetry-')); });
-afterEach(() => { fs.rmSync(home, { recursive: true, force: true }); });
-describe('telemetry consent', () => {
-    it('sends nothing until the person says yes, and the environment always wins', () => {
-        expect(isTelemetryEnabled({ env, home })).toBe(false);
-        expect(shouldAskTelemetry(true, { env, home })).toBe(true);
-        setTelemetryEnabled(true, home);
-        expect(isTelemetryEnabled({ env, home })).toBe(true);
-        expect(shouldAskTelemetry(true, { env, home })).toBe(false); // asked once
-        expect(isTelemetryEnabled({ env: { ...env, DO_NOT_TRACK: '1' }, home })).toBe(false);
-        expect(isTelemetryEnabled({ env: { ...env, RIGOUR_TELEMETRY: '0' }, home })).toBe(false);
-        expect(isTelemetryEnabled({ env: { ...env, CI: 'true' }, home })).toBe(false);
-        expect(isTelemetryEnabled({ env: {}, home })).toBe(false); // a build without a token never sends
-    });
-    it('never asks in CI or without a terminal, and keeps one random install id', () => {
-        expect(shouldAskTelemetry(false, { env, home })).toBe(false);
-        expect(shouldAskTelemetry(true, { env: { ...env, GITHUB_ACTIONS: 'true' }, home })).toBe(false);
-        setTelemetryEnabled(true, home);
-        for (const ci of ['JENKINS_URL', 'TF_BUILD', 'TEAMCITY_VERSION']) {
-            expect(isTelemetryEnabled({ env: { ...env, [ci]: 'x' }, home })).toBe(false); // a build agent's stored yes is not a CI opt-in
-            expect(isTelemetryEnabled({ env: { ...env, [ci]: 'x', RIGOUR_TELEMETRY: '1' }, home })).toBe(true);
-        }
-        const first = setTelemetryEnabled(false, home).installId;
-        expect(readTelemetryState(home).installId).toBe(first);
-        expect(first).toMatch(/^[0-9a-f-]{36}$/);
-    });
-});
-describe('telemetry sending', () => {
-    it('sends one event with the install id and no IP, and swallows a failing network', async () => {
-        setTelemetryEnabled(true, home);
-        const fetch = vi.fn().mockResolvedValue({ ok: true });
-        await trackUsage('review_completed', { status: 'PASS', findings_by_gate: { 'semantic-bugs': 1 } }, { env, home, fetch, version: '6.5.0' });
-        const [url, init] = fetch.mock.calls[0];
-        expect(url).toBe('https://api.mixpanel.com/track?ip=0');
-        const [event] = JSON.parse(init.body);
-        expect(event.event).toBe('review_completed');
-        expect(event.properties).toMatchObject({ token: 'tok', distinct_id: readTelemetryState(home).installId, version: '6.5.0', status: 'PASS' });
-        expect(JSON.stringify(event)).not.toContain(home);
-        await expect(trackUsage('x', {}, { env, home, fetch: vi.fn().mockRejectedValue(new Error('offline')) })).resolves.toBeUndefined();
-    });
-    it('counts hot-path activity locally and sends it as one daily event', async () => {
-        setTelemetryEnabled(true, home);
-        const fetch = vi.fn().mockResolvedValue({ ok: true });
-        const day = 24 * 60 * 60 * 1000;
-        countUsage('hook_check', 1, { env, home, now: 0 });
-        countUsage('hook_check', 1, { env, home, now: 1000 });
-        countUsage('mcp:rigour_review', 1, { env, home, now: 2000 });
-        expect(await flushDailyUsage({ env, home, fetch, now: 5000 })).toBe(false); // not a day yet
-        expect(await flushDailyUsage({ env, home, fetch, now: day + 1 })).toBe(true);
-        const [event] = JSON.parse(fetch.mock.calls[0][1].body);
-        expect(event).toMatchObject({ event: 'daily_usage', properties: { hook_check: 2, 'mcp:rigour_review': 1 } });
-        expect(await flushDailyUsage({ env, home, fetch, now: 2 * day + 2 })).toBe(false); // counters reset
-    });
-    it('buckets durations so timing never identifies a run', () => {
-        expect([500, 3000, 20000, 60000, 600000].map(durationBucket)).toEqual(['<1s', '1-5s', '5-30s', '30s-2m', '>2m']);
-    });
-});

package/dist/types/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/types/index.test.js

@@ -1,33 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import yaml from 'yaml';
-import { ConfigSchema } from './index.js';
-describe('rigour.yml', () => {
-    it('still loads a file that sets the settings no check ever read, and keeps everything else', () => {
-        const old = yaml.parse(`
-version: 1
-planned: [Layer boundaries]
-hooks: { enabled: true, tools: [claude], fast_gates: [file-size], timeout_ms: 5000, block_on_failure: true, dlp: false, require_review_ack: true }
-gates:
-  max_file_lines: 300
-  forbid_paths: [secret/]
-  ast: { complexity: 7, max_nesting: 3, max_function_lines: 40 }
-  adaptive: { enabled: true, forced_tier: enterprise }
-  input_validation: { enabled: true, min_secret_length: 12 }
-  deep: { enabled: true, provider: claude, api_key: sk-test, model_name: x, threads: 8, temperature: 0.2 }
-  test_quality: { check_snapshot_abuse: false, ignore_patterns: [x], max_mocks_per_test: 3 }
-`);
-        const config = ConfigSchema.parse(old);
-        expect(config.gates.max_file_lines).toBe(300);
-        expect(config.gates.ast.complexity).toBe(7);
-        expect(config.gates.deep.temperature).toBe(0.2);
-        expect(config.gates.test_quality.max_mocks_per_test).toBe(3);
-        expect(config.hooks.require_review_ack).toBe(true);
-        // What nothing read is dropped, so no code can start depending on it by accident.
-        expect(config).not.toHaveProperty('version');
-        expect(config).not.toHaveProperty('planned');
-        expect(config.gates).not.toHaveProperty('adaptive');
-        expect(config.gates).not.toHaveProperty('input_validation');
-        expect(config.gates.deep).not.toHaveProperty('api_key');
-        expect(config.hooks).not.toHaveProperty('block_on_failure');
-    });
-});

package/dist/utils/command-line.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/command-line.test.js

@@ -1,8 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { splitCommand } from './command-line.js';
-describe('splitCommand', () => {
-    it('splits on spaces and keeps a quoted argument whole, without its quotes', () => {
-        expect(splitCommand('npm run lint')).toEqual({ bin: 'npm', args: ['run', 'lint'] });
-        expect(splitCommand(`vitest run "src/a b.test.ts" --reporter 'dot'`)).toEqual({ bin: 'vitest', args: ['run', 'src/a b.test.ts', '--reporter', 'dot'] });
-    });
-});

package/dist/utils/diff-removed.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/diff-removed.test.js

@@ -1,29 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { parseDiff, removedByFile } from './diff.js';
-const DIFF = `diff --git a/src/a.ts b/src/a.ts
---- a/src/a.ts
-+++ b/src/a.ts
-@@ -1,5 +1,4 @@
- export function load(id: string) {
--  if (!id) return null;
--  audit(id);
-+  audit(id ?? '');
-   return fetch(id);
- }
-@@ -20,2 +19,1 @@
--const legacy = true;
- export const x = 1;
-`;
-describe('removedByFile', () => {
-    it('groups removed lines into blocks anchored at the new-side line', () => {
-        expect(removedByFile(DIFF)).toEqual({
-            'src/a.ts': [
-                { line: 2, text: ['  if (!id) return null;', '  audit(id);'] },
-                { line: 19, text: ['const legacy = true;'] },
-            ],
-        });
-    });
-    it('leaves added-line parsing unchanged', () => {
-        expect([...parseDiff(DIFF)['src/a.ts']]).toEqual([2]);
-    });
-});

package/dist/utils/diff.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/diff.test.js

@@ -1,38 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { changedLinesByFile, parseDiff } from './diff.js';
-const lines = (m) => changedLinesByFile(m);
-describe('parseDiff', () => {
-    it('maps added lines to new-side line numbers', () => {
-        const diff = [
-            'diff --git a/src/a.ts b/src/a.ts',
-            '--- a/src/a.ts',
-            '+++ b/src/a.ts',
-            '@@ -1,3 +1,4 @@',
-            ' const a = 1;',
-            '-const b = 2;',
-            '+const b = 3;',
-            '+const c = 4;',
-            ' export { a };',
-        ].join('\n');
-        expect(lines(parseDiff(diff))).toEqual({ 'src/a.ts': [2, 3] });
-    });
-    it('handles several files and hunks', () => {
-        const diff = [
-            '+++ b/a.ts', '@@ -10,2 +10,3 @@', ' x', '+y', ' z',
-            '+++ b/b.ts', '@@ -1 +1 @@', '-old', '+new',
-        ].join('\n');
-        expect(lines(parseDiff(diff))).toEqual({ 'a.ts': [11], 'b.ts': [1] });
-    });
-    it('does not mistake content lines starting with +++ or --- for headers', () => {
-        const diff = ['+++ b/a.ts', '@@ -1,2 +1,3 @@', ' let i = 0;', '+++i;', '---j;', ' done();'].join('\n');
-        expect(lines(parseDiff(diff))).toEqual({ 'a.ts': [2] });
-    });
-    it('does not count "No newline at end of file" as a line', () => {
-        const diff = ['+++ b/a.ts', '@@ -1,1 +1,2 @@', ' a', '\', '+b'].join('\n');
-        expect(lines(parseDiff(diff))).toEqual({ 'a.ts': [2] });
-    });
-    it('ignores deleted files', () => {
-        const diff = ['diff --git a/gone.ts b/gone.ts', '--- a/gone.ts', '+++ /dev/null', '@@ -1,2 +0,0 @@', '-a', '-b'].join('\n');
-        expect(parseDiff(diff)).toEqual({});
-    });
-});

package/dist/utils/glob-paths.test.d.ts

@@ -1 +0,0 @@
-export {};