@rigour-labs/core 6.9.0 → 6.10.0-rc.1

package/dist/deep/pr-review.d.ts

@@ -1,5 +1,6 @@
 import type { DeepFinding, InferenceOptions, InferenceProvider } from '../inference/types.js';
 import type { CodeContext } from './code-context.js';
+import { type SettledCheck } from '../review/settled-checks.js';
 import type { RelatedChange } from './related-changes.js';
 export interface FocusItem {
     file: string;
@@ -19,6 +20,8 @@ export interface PrReviewInput {
     /** The repository's own rules that apply to this change, already rendered. */
     rules?: string;
     prBody?: string;
+    /** What Rigour's checks already found on the change: listed as settled; a finding of the same kind at one of their lines is dropped. */
+    settled?: SettledCheck[];
 }
 export interface PrReviewResult {
     findings: DeepFinding[];

package/dist/deep/pr-review.js

@@ -14,6 +14,7 @@ import { REVIEW_CATEGORIES } from './code-review-prompt.js';
 import { parseFindings } from './parse-findings.js';
 import { diffSections } from './pr-diff.js';
 import { runToolLoop } from './tool-loop.js';
+import { againstSettled, settledLine, settledSection } from '../review/settled-checks.js';
 const BUDGET = { maxToolCalls: 24, maxTurns: 14 };
 const MAX_DIFF_CHARS = 80_000;
 const MAX_FINDINGS = 5;
@@ -21,7 +22,12 @@ const PR_BODY_CHARS = 1500;
 export async function reviewPullRequest(provider, input, inference) {
     const { prompt, sentDiff } = buildPrPrompt(input);
     const loop = await runToolLoop(provider, prompt, input.cwd, inference, BUDGET);
-    const findings = parseFindings(loop.text).slice(0, MAX_FINDINGS);
+    // A model finding of the same kind as a check's, on its line, is that check's finding said again: dropped. Anything
+    // else there is a different problem on a line a check also flags: kept, and it says so.
+    const findings = parseFindings(loop.text).flatMap(f => {
+        const against = againstSettled(f, input.settled ?? []);
+        return against.same ? [] : [against.alsoAt.length ? { ...f, alsoAt: against.alsoAt.join('; ') } : f];
+    }).slice(0, MAX_FINDINGS);
     const files = new Set([...diffSections(input.diff).map(s => s.file), ...loop.toolbox.reads.keys(), ...findings.map(f => f.file)]);
     const shown = `${sentDiff}\n${loop.toolbox.readText}`;
     return { findings, contexts: [...files].flatMap(file => wholeFile(input.cwd, file, shown)), toolCalls: loop.toolCalls };
@@ -61,6 +67,7 @@ export function buildPrPrompt(input) {
         input.prBody ? `PR DESCRIPTION (what the author intended):\n${input.prBody.slice(0, PR_BODY_CHARS)}` : '',
         input.rules ?? '',
         input.lessons ?? '',
+        settledSection((input.settled ?? []).map(settledLine)),
         contracts ? `BOTH SIDES OF A CALL CHANGED (check these contracts first):\n${contracts}` : '',
         focus ? `LOOK FIRST (riskiest changed functions, and what to check):\n${focus}` : '',
         `PR DIFF (new-side line numbers on the left; "-" lines were removed):\n${sentDiff}`,

package/dist/gates/context.js

@@ -93,8 +93,10 @@ export class ContextGate extends Gate {
             const casing = this.detectCasing(match[1]);
             this.addPattern(patterns, 'function', { casing, file, count: 1 });
         }
-        // Class declarations
-        const classMatches = content.matchAll(/class\s+([A-Za-z_$][A-Za-z0-9_$]*)/g);
+        // Class declarations: `class` opening a line (after modifiers: C# partial, Kotlin enum/inner/value/annotation
+        // and the rest), its name on the same line. Not the end of
+        // `dataclass`, and not the word in a comment or a string ("# this class of errors").
+        const classMatches = content.matchAll(/^[ \t]*(?:(?:export|default|abstract|public|private|protected|internal|final|sealed|static|data|open|partial|enum|inner|value|annotation)[ \t]+)*class[ \t]+([A-Za-z_$][A-Za-z0-9_$]*)/gm);
         for (const match of classMatches) {
             const casing = this.detectCasing(match[1]);
             this.addPattern(patterns, 'class', { casing, file, count: 1 });

package/dist/gates/deep-analysis.js

@@ -159,7 +159,7 @@ export class DeepAnalysisGate extends Gate {
         this.config.onProgress?.(`  Reviewing the PR as a whole (${focus.length} risky function(s) first)...`);
         try {
             const result = await reviewPullRequest(this.provider, { cwd, diff: options.diff, focus, related, lessons: lessonsSection(lessonsForDiff(cwd, options.diff, this.config.reviewLessons)),
-                rules: rulesSection(rulesForDiff(cwd, options.diff, this.config.repoRules)), prBody: options.prBody }, inferenceOptions(this.config));
+                rules: rulesSection(rulesForDiff(cwd, options.diff, this.config.repoRules)), prBody: options.prBody, settled: options.settled }, inferenceOptions(this.config));
             this.recordPass({ findings: [], chunksTotal: 1, chunksFailed: 0 });
             this.outcome.findingsProposed = result.findings.length;
             this.outcome.findingsWithdrawn = 0;
@@ -239,7 +239,7 @@ export class DeepAnalysisGate extends Gate {
         return provider;
     }
     toFailure(finding) {
-        const failure = this.createFailure(finding.description, [finding.file], finding.suggestion, `[${finding.category}] ${finding.description.substring(0, 80)}`, finding.line, undefined, finding.severity);
+        const failure = this.createFailure(finding.alsoAt ? `${finding.description} (Rigour's checks also flag this line, for another reason: ${finding.alsoAt}.)` : finding.description, [finding.file], finding.suggestion, `[${finding.category}] ${finding.description.substring(0, 80)}`, finding.line, undefined, finding.severity);
         return { ...failure, confidence: finding.confidence, source: 'llm', category: finding.category, verified: finding.verified };
     }
 }

package/dist/gates/deprecated-apis.js

@@ -18,6 +18,7 @@
  *   Java   — Deprecated JDK APIs (Date, Vector, Hashtable, etc.)
  *
  */
+import { codeColumns } from '../utils/code-mask.js';
 import { Gate } from './base.js';
 import { FileScanner } from '../utils/scanner.js';
 import { Logger } from '../utils/logger.js';
@@ -146,7 +147,7 @@ export class DeprecatedApisGate extends Gate {
             if (trimmed.startsWith('//') || trimmed.startsWith('*') || trimmed.startsWith('/*'))
                 continue;
             for (const rule of NODE_DEPRECATED_RULES) {
-                if (rule.pattern.test(line)) {
+                if (callIn(line, rule.pattern, file)) {
                     deprecated.push({
                         file, line: i + 1,
                         api: rule.api,
@@ -166,7 +167,7 @@ export class DeprecatedApisGate extends Gate {
             if (trimmed.startsWith('//') || trimmed.startsWith('*'))
                 continue;
             for (const rule of WEB_DEPRECATED_RULES) {
-                if (rule.pattern.test(line)) {
+                if (callIn(line, rule.pattern, file)) {
                     deprecated.push({
                         file, line: i + 1,
                         api: rule.api,
@@ -186,7 +187,7 @@ export class DeprecatedApisGate extends Gate {
             if (trimmed.startsWith('#'))
                 continue;
             for (const rule of PYTHON_DEPRECATED_RULES) {
-                if (rule.pattern.test(line)) {
+                if (callIn(line, rule.pattern, file)) {
                     deprecated.push({
                         file, line: i + 1,
                         api: rule.api,
@@ -206,7 +207,7 @@ export class DeprecatedApisGate extends Gate {
             if (trimmed.startsWith('//'))
                 continue;
             for (const rule of GO_DEPRECATED_RULES) {
-                if (rule.pattern.test(line)) {
+                if (callIn(line, rule.pattern, file)) {
                     deprecated.push({
                         file, line: i + 1,
                         api: rule.api, reason: rule.reason,
@@ -224,7 +225,7 @@ export class DeprecatedApisGate extends Gate {
             if (trimmed.startsWith('//') || trimmed.startsWith('/*'))
                 continue;
             for (const rule of CSHARP_DEPRECATED_RULES) {
-                if (rule.pattern.test(line)) {
+                if (callIn(line, rule.pattern, file)) {
                     deprecated.push({
                         file, line: i + 1,
                         api: rule.api, reason: rule.reason,
@@ -242,7 +243,7 @@ export class DeprecatedApisGate extends Gate {
             if (trimmed.startsWith('//') || trimmed.startsWith('/*') || trimmed.startsWith('*'))
                 continue;
             for (const rule of JAVA_DEPRECATED_RULES) {
-                if (rule.pattern.test(line)) {
+                if (callIn(line, rule.pattern, file)) {
                     deprecated.push({
                         file, line: i + 1,
                         api: rule.api, reason: rule.reason,
@@ -253,3 +254,17 @@ export class DeprecatedApisGate extends Gate {
         }
     }
 }
+/**
+ * Whether a rule matches this line where it is code: every match is tried, and one that starts in a string literal or a
+ * comment (utils/code-mask.ts) is not a use of the API. Every rule here is a call or an import.
+ */
+function callIn(line, pattern, file) {
+    if (!pattern.test(line))
+        return false;
+    const isCode = codeColumns(line, path.extname(file).slice(1));
+    const every = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`);
+    for (const m of line.matchAll(every))
+        if (isCode(m.index ?? 0))
+            return true;
+    return false;
+}

package/dist/gates/inconsistent-error-handling.d.ts

@@ -11,6 +11,9 @@
  * 3. Compare handling strategies within each cluster
  * 4. Flag types with >2 distinct handling patterns across files
  *
+ * A handler that only hands the error to a helper (`return handle_value_error(e)`) is no strategy of its own: the
+ * helper holds the handling, so it is counted as neither consistent nor not.
+ *
  * Examples of inconsistency:
  * - File A: catch(e) { console.log(e) }
  * - File B: catch(e) { throw new AppError(e) }

package/dist/gates/inconsistent-error-handling.js

@@ -11,6 +11,9 @@
  * 3. Compare handling strategies within each cluster
  * 4. Flag types with >2 distinct handling patterns across files
  *
+ * A handler that only hands the error to a helper (`return handle_value_error(e)`) is no strategy of its own: the
+ * helper holds the handling, so it is counted as neither consistent nor not.
+ *
  * Examples of inconsistency:
  * - File A: catch(e) { console.log(e) }
  * - File B: catch(e) { throw new AppError(e) }
@@ -24,6 +27,12 @@ import { Logger } from '../utils/logger.js';
 import { languageAdapters } from './language-adapters/index.js';
 import fs from 'fs-extra';
 import path from 'path';
+const DELEGATE = 'delegate';
+/** One call and nothing else, returned or awaited or not: `return handle(e)`, `report.failed(x, e);`, `{ await retry(e) }`. */
+const DELEGATION = /^(?:return\s+)?(?:await\s+)?[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\s*\([^\n]*\)\s*;?$/;
+function delegates(body) {
+    return DELEGATION.test(body.trim().replace(/^\{\s*/, '').replace(/\s*\}$/, '').trim());
+}
 export class InconsistentErrorHandlingGate extends Gate {
     config;
     constructor(config = {}) {
@@ -65,7 +74,7 @@ export class InconsistentErrorHandlingGate extends Gate {
                         file,
                         line: fact.startLine,
                         errorType: fact.type,
-                        strategy: fact.strategy,
+                        strategy: fact.strategy === 'other' && delegates(fact.body) ? DELEGATE : fact.strategy,
                         rawPattern: fact.body.split('\n')[0]?.trim() || '',
                     });
                 }
@@ -90,6 +99,8 @@ export class InconsistentErrorHandlingGate extends Gate {
             // Count unique strategies
             const strategies = new Map();
             for (const handler of typeHandlers) {
+                if (handler.strategy === DELEGATE)
+                    continue;
                 const existing = strategies.get(handler.strategy) || [];
                 existing.push(handler);
                 strategies.set(handler.strategy, existing);

package/dist/gates/runner.js

@@ -35,6 +35,7 @@ import { DeprecatedDependenciesGate } from './deprecated-dependencies.js';
 import { execa } from 'execa';
 import { Logger } from '../utils/logger.js';
 import { FileSystemCache } from '../services/filesystem-cache.js';
+import { onChangedLines, settledChecks } from '../review/settled-checks.js';
 export class GateRunner {
     config;
     gates = [];
@@ -213,7 +214,8 @@ export class GateRunner {
         // 3. Run Deep Analysis (if enabled)
         let deepStats = undefined;
         if (deepOptions?.enabled) {
-            const deep = await runDeepAnalysis(this.config, { cwd, ignore, patterns }, deepOptions);
+            // What the checks found on the change's lines is settled: the model is told so and never reports it again.
+            const deep = await runDeepAnalysis(this.config, { cwd, ignore, patterns }, { ...deepOptions, settled: settledChecks(onChangedLines(failures, deepOptions.focusLines)) });
             failures.push(...deep.failures);
             summary['deep-analysis'] = deep.summary;
             deepStats = deep.stats;

package/dist/gates/security-patterns-data.d.ts

@@ -11,4 +11,10 @@ export declare const VULNERABILITY_PATTERNS: {
     description: string;
     cwe: string;
     languages: string[];
+    /**
+     * `anywhere` for a pattern about a string's contents (a secret in a literal, a header value, a template): it matches
+     * inside strings. Every other pattern is an API used as a call or a statement, and counts only when its match starts
+     * in code, not in a string literal or a comment (utils/code-mask.ts).
+     */
+    where?: 'anywhere';
 }[];

package/dist/gates/security-patterns-data.js

@@ -68,7 +68,8 @@ export const VULNERABILITY_PATTERNS = [
     {
         type: 'hardcoded_secrets',
         // A secret literal has no whitespace: `hidePassword: 'Hide password'` is a UI label, not a credential.
-        regex: /(?:password|secret|api_key|apikey|auth_token|access_token|private_key)\s*[:=]\s*['"][^'"\s]{8,}['"]/gi,
+        regex: /(?:password|secret|api_key|apikey|auth_token|access_token|private_key)['"]?\s*[:=]\s*['"][^'"\s]{8,}['"]/gi, // a key may be quoted: JSON, a Python dict, a JS object
+        where: 'anywhere',
         severity: 'critical',
         description: 'Hardcoded secret detected in code',
         cwe: 'CWE-798',
@@ -77,6 +78,7 @@ export const VULNERABILITY_PATTERNS = [
     {
         type: 'hardcoded_secrets',
         regex: /(?:sk-|pk-|rk-|ghp_|gho_|ghu_|ghs_|ghr_)[a-zA-Z0-9]{20,}/g,
+        where: 'anywhere',
         severity: 'critical',
         description: 'API key pattern detected (OpenAI, GitHub, etc.)',
         cwe: 'CWE-798',
@@ -85,6 +87,7 @@ export const VULNERABILITY_PATTERNS = [
     {
         type: 'hardcoded_secrets',
         regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g,
+        where: 'anywhere',
         severity: 'critical',
         description: 'Private key embedded in source code',
         cwe: 'CWE-798',
@@ -138,6 +141,7 @@ export const VULNERABILITY_PATTERNS = [
     {
         type: 'redos',
         regex: /\(\?:[^)]*\+[^)]*\)\+|\([^)]*\*[^)]*\)\+|\(\.\*\)\{/g,
+        where: 'anywhere',
         severity: 'medium',
         description: 'Regex with nested quantifiers — potential ReDoS',
         cwe: 'CWE-1333',
@@ -171,6 +175,7 @@ export const VULNERABILITY_PATTERNS = [
     {
         type: 'overly_permissive',
         regex: /(?:Access-Control-Allow-Origin|x-powered-by)['"`,\s:]+\*/gi,
+        where: 'anywhere',
         severity: 'high',
         description: 'Wildcard Access-Control-Allow-Origin header',
         cwe: 'CWE-942',
@@ -188,6 +193,7 @@ export const VULNERABILITY_PATTERNS = [
     {
         type: 'unsafe_output',
         regex: /\$\{[^}]*(?:req\.|params|query|body|input|user)[^}]*\}.*(?:html|template|render)/gi,
+        where: 'anywhere',
         severity: 'high',
         description: 'User input interpolated into template/HTML output',
         cwe: 'CWE-79',

package/dist/gates/security-patterns.js

@@ -12,6 +12,7 @@
  * - Insecure Randomness
  * - Command Injection
  */
+import { codeOffsets } from '../utils/code-mask.js';
 import { Gate } from './base.js';
 import { FileScanner } from '../utils/scanner.js';
 import { Logger } from '../utils/logger.js';
@@ -138,6 +139,8 @@ export class SecurityPatternsGate extends Gate {
                 });
             }
         }
+        // A call written in a message or a comment is not a call: a pattern of that kind counts only from code.
+        const isCode = codeOffsets(content, ext);
         for (const pattern of VULNERABILITY_PATTERNS) {
             // Check if pattern applies to this file type
             if (!pattern.languages.includes('*') && !pattern.languages.includes(ext)) {
@@ -147,6 +150,8 @@ export class SecurityPatternsGate extends Gate {
             pattern.regex.lastIndex = 0;
             let match;
             while ((match = pattern.regex.exec(content)) !== null) {
+                if (pattern.where !== 'anywhere' && !isCode(match.index))
+                    continue;
                 // For hardcoded_secrets: filter out placeholder/dummy values and env var names
                 if (pattern.type === 'hardcoded_secrets' && this.isDummySecretValue(match[0])) {
                     continue;

package/dist/gates/side-effect-analysis/index.js

@@ -42,7 +42,7 @@ import { LANG_MAP, FILE_GLOBS, stripStrings,
 // Detectors
 isTimerCreation, getTimerCleanupPatterns, isProcessSpawn, getProcessCleanupPatterns, isUnboundedLoop, containsIO, isFileWatcher, extractWatchedPath, extractWritePath, pathsOverlap, findWriteInBody, hasDebounceProtection, isResourceOpen, getResourceClosePatterns, isExitHandler, 
 // Loop/recursion
-hasRetryLimit, hasCatchWithContinue, hasBaseCase, hasDepthParameter, 
+hasRetryLimit, hasCatchWithContinue, hasBaseCase, selfCallPattern, hasDepthParameter, 
 // Variable binding
 extractVariableBinding, hasCleanupForVariable, 
 // Go defer
@@ -481,15 +481,13 @@ export class SideEffectAnalysisGate extends Gate {
             const bodyLines = lines.slice(func.start + 1, func.end);
             const body = bodyLines.join('\n');
             // Check if function calls itself
-            const escaped = func.name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-            const selfCallPat = new RegExp(`\\b${escaped}\\s*\\(`);
-            if (!selfCallPat.test(body))
+            if (!selfCallPattern(func.name, func.params).test(body))
                 continue;
             // Check for depth/limit parameter in function signature
             if (hasDepthParameter(func.params))
                 continue;
             // Check for base case BEFORE recursive call (ordering matters)
-            if (hasBaseCase(bodyLines, func.name))
+            if (hasBaseCase(bodyLines, func.name, func.params))
                 continue;
             // Only flag if there's I/O in the recursive function
             // (pure recursion = stack overflow, not a side-effect issue)

package/dist/gates/side-effect-helpers/pattern-detection.d.ts

@@ -45,12 +45,18 @@ export declare function extractFunctionDefs(lines: string[], lang: SideEffectLan
     end: number;
     params: string;
 }[];
+/**
+ * A call of the function by its own name: bare (`walk(`), or on `self`, `cls`, `this` or the function's own Go receiver
+ * (`self.crawl(`, `w.walk(` in `func (w *Walker) walk`). A call of another object's method that shares the name
+ * (`subprocess.run(` inside `def run`) is not one. `header` is the function's declaration line.
+ */
+export declare function selfCallPattern(funcName: string, header?: string): RegExp;
 /**
  * Check if a function has a base case (return/break before recursive call).
  * Smart: actually checks that the base case comes BEFORE the recursive call,
  * not just that both exist somewhere in the body.
  */
-export declare function hasBaseCase(bodyLines: string[], funcName: string): boolean;
+export declare function hasBaseCase(bodyLines: string[], funcName: string, header?: string): boolean;
 /**
  * Check if a function has a depth/limit parameter (implies bounded recursion).
  * Smarter than just checking for the word "depth" anywhere — checks the

package/dist/gates/side-effect-helpers/pattern-detection.js

@@ -156,14 +156,24 @@ function getFuncDefPatterns(lang) {
             ];
     }
 }
+/**
+ * A call of the function by its own name: bare (`walk(`), or on `self`, `cls`, `this` or the function's own Go receiver
+ * (`self.crawl(`, `w.walk(` in `func (w *Walker) walk`). A call of another object's method that shares the name
+ * (`subprocess.run(` inside `def run`) is not one. `header` is the function's declaration line.
+ */
+export function selfCallPattern(funcName, header = '') {
+    const escaped = funcName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const receiver = /^\s*func\s*\(\s*([A-Za-z_]\w*)\s/.exec(header)?.[1];
+    const owners = ['self', 'cls', 'this', ...(receiver ? [receiver] : [])].join('|');
+    return new RegExp(`(?:(?<![\\w$.])|(?<=\\b(?:${owners})\\.))${escaped}\\s*\\(`);
+}
 /**
  * Check if a function has a base case (return/break before recursive call).
  * Smart: actually checks that the base case comes BEFORE the recursive call,
  * not just that both exist somewhere in the body.
  */
-export function hasBaseCase(bodyLines, funcName) {
-    const escapedName = funcName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    const selfCallPat = new RegExp(`\\b${escapedName}\\s*\\(`);
+export function hasBaseCase(bodyLines, funcName, header = '') {
+    const selfCallPat = selfCallPattern(funcName, header);
     let foundBaseReturn = false;
     for (const line of bodyLines) {
         const stripped = stripStrings(line);

package/dist/inference/types.d.ts

@@ -92,6 +92,8 @@ export interface DeepFinding {
     suggestion: string;
     /** LLM confidence score 0.0-1.0 */
     confidence: number;
+    /** The titles of Rigour's checks that also flag this line, for a different problem (deep/pr-review.ts). */
+    alsoAt?: string;
 }
 /**
  * Result of a deep analysis batch.

package/dist/review/review.d.ts

@@ -37,6 +37,8 @@ export interface ReviewResult {
     excludedOutsideChangedLines: number;
     /** Findings the base already had: counted, not reported (baseline.ts). */
     preexisting: number;
+    /** A diff given with no base whose change HEAD already holds (committed work): nothing was compared, so nothing was dropped as the base's. */
+    baseUnknown?: boolean;
     changedLines: Record<string, Set<number>>;
     report: Report | null;
     deepError?: string;

package/dist/review/review.js

@@ -42,7 +42,7 @@ export async function reviewChange(input) {
     const deep = input.deep ? { ...input.deep, focusLines: changedLinesByFile(changedLines), removedLines: removedByFile(diff), diff } : undefined;
     // The team's `commands:` run at push (toolchain.ts), where a failure blocks; here they would only cost time.
     const report = await new GateRunner({ ...input.config, commands: {} }).run(input.cwd, await normalizeScopePatterns(input.cwd, targets), deep);
-    const preexisting = await dropPreexisting(input, report, targets);
+    const { preexisting, baseUnknown } = await dropPreexisting(input, report, targets);
     if (input.diffTests && deep)
         report.failures.push(...await diffTestFailures(input.cwd, input.source, deep));
     // The review's own checks, each recorded in the summary beside the gates, so a report says everything that ran.
@@ -91,6 +91,7 @@ export async function reviewChange(input) {
         unlocated: split.unlocated,
         excludedOutsideChangedLines: split.outside,
         preexisting,
+        ...(baseUnknown ? { baseUnknown } : {}),
         changedLines,
         report,
         gateErrors,
@@ -101,23 +102,47 @@ export async function reviewChange(input) {
         ...(checkedGoal ? { goal: checkedGoal } : {}),
     };
 }
-/** Drop the rules' findings the base already had; returns how many. Model findings stay: the model reviews only the change. */
+/**
+ * Drop the rules' findings the base already had; returns how many. Model findings stay: the model reviews only the change.
+ * A diff given with no `--base` is compared with HEAD, which is right for uncommitted work. When HEAD already holds the
+ * change (a diff of committed work), HEAD is no base: every finding would look like the base's, so none is dropped and
+ * `baseUnknown` says why.
+ */
 async function dropPreexisting(input, report, targets) {
     if (input.config.review?.show_preexisting)
-        return 0;
+        return { preexisting: 0 };
+    if (input.diff !== undefined && input.source?.mode !== 'base' && input.source?.mode !== 'since' && headHolds(input.cwd, input.diff))
+        return { preexisting: 0, baseUnknown: true };
     const commit = baseCommit(input.cwd, input.source ?? (input.diff ? undefined : { mode: 'working' }));
     const rules = report.failures.filter(f => f.provenance !== 'deep-analysis');
     if (!commit || rules.length === 0)
-        return 0;
+        return { preexisting: 0 };
     try {
         const { preexisting } = splitIntroduced(rules, await baseFindings(input.cwd, input.config, commit, targets));
         const old = new Set(preexisting);
         report.failures = report.failures.filter(f => !old.has(f));
-        return old.size;
+        return { preexisting: old.size };
     }
     catch {
-        return 0; // the comparison is a courtesy; it never fails a review
+        return { preexisting: 0 }; // the comparison is a courtesy; it never fails a review
+    }
+}
+/** Whether HEAD already has a file as the diff leaves it (its `index <before>..<after>` blob), read in one `git ls-tree`. */
+function headHolds(cwd, diff) {
+    const after = new Map();
+    for (const m of diff.matchAll(/^diff --git a\/.+? b\/(.+)\n(?:(?!diff --git ).*\n)*?index [0-9a-f]+\.\.([0-9a-f]+)/gm)) {
+        if (!/^0+$/.test(m[2]))
+            after.set(m[1], m[2]);
     }
+    if (after.size === 0)
+        return false;
+    const tree = spawnSync('git', ['ls-tree', '-z', 'HEAD', '--', ...after.keys()], { cwd, encoding: 'utf8', timeout: 10_000, maxBuffer: 64 * 1024 * 1024 });
+    if (tree.status !== 0)
+        return false;
+    return tree.stdout.split('\0').some(line => {
+        const m = /^\d+ blob ([0-9a-f]+)\t(.+)$/.exec(line);
+        return !!m && !!after.get(m[2]) && m[1].startsWith(after.get(m[2]));
+    });
 }
 /** Every path the diff touches (including deletions, which parseDiff drops) that steers Rigour itself. */
 function controlFiles(diff) {

package/dist/review/reviewer/context.js

@@ -20,6 +20,7 @@ import { reviewedKeys } from '../ledger.js';
 import { textSimilarity } from './consensus.js';
 import { defaultExec, GH_TIMEOUT_MS } from './exec.js';
 import { VerdictStore } from './store.js';
+import { MAX_SETTLED, settledChecks, settledLine, settledSection } from '../settled-checks.js';
 export const REVIEW_DISMISSALS = path.join('.rigour', 'dismissed-review-items.json');
 const MAX_DOCS = 10;
 /** Team standards a judge is shown with the lessons about the changed files. */
@@ -29,7 +30,6 @@ const JUDGE_FILE_LESSONS = 30;
 const JUDGE_LESSONS_PER_FILE = 3;
 /** Rules from the repository's own rules files a judge is asked to answer, most relevant first. */
 const JUDGE_RULES = 15;
-const MAX_SETTLED = 40;
 export function readReviewDismissals(cwd) {
     try {
         const parsed = JSON.parse(fs.readFileSync(path.join(cwd, REVIEW_DISMISSALS), 'utf8'));
@@ -68,7 +68,7 @@ export function dismissedAs(item, dismissals) {
 }
 /** A review's result as the reviewer's inputs: its hints, and what its checks found, as settled. */
 export function reviewerInputs(review) {
-    return { hints: review.hints.join('\n'), checks: review.findings.map(f => `${f.files?.[0] ?? '?'}${f.line ? `:${f.line}` : ''} ${f.title}`) };
+    return { hints: review.hints.join('\n'), checks: settledChecks(review.findings).map(settledLine) };
 }
 /** The ids of the served lessons the judge said this change repeats; an answer that names no served lesson says nothing. */
 export function lessonsApplied(answers, served) {
@@ -95,7 +95,7 @@ export function buildContext(input) {
     if (rules.length)
         sections.push(`## Rules this repository wrote for itself that apply to this change (answer every one in rules, by id)\n${rules.map(r => `- [${r.id}] (${r.source}, ${r.requirement ? 'requirement' : 'guidance'}) ${r.text}`).join('\n')}`);
     if (input.checks.length)
-        sections.push(`## Already found by Rigour's checks: they block on their own, so do not report them again\n${input.checks.slice(0, MAX_SETTLED).map(c => `- ${c}`).join('\n')}`);
+        sections.push(settledSection(input.checks));
     const rejected = input.lessons === 'off' ? [] : rejectedForDiff(input.cwd, input.diff).map(l => {
         const no = l.evidence.filter(e => e.kind === 'rejected').at(-1);
         return `- this team decided against: ${l.text}${no?.author ? ` (rejected by ${no.author}${no.detail ? `: ${no.detail}` : ''})` : ''}`;

package/dist/review/reviewer/store.d.ts

@@ -41,6 +41,19 @@ export interface ReviewCost {
     /** What every run reported costing; a judge that reports no dollars adds none. */
     actualUsd: number;
     runs: number;
+    /** A verdict reused instead of run: for the same content on another commit (`content`). Runs and actual cost are 0. */
+    cache?: 'content';
+}
+/**
+ * A verdict, findable by the content it reviewed rather than its commit: a rebase, an amend, a cherry-pick or the same
+ * change on another branch reads it instead of paying again. `cited` is the merge-base blob of every file its items cite:
+ * a later base under one of them makes the entry stale.
+ */
+export interface ContentEntry {
+    verdict: string;
+    head: string;
+    at: string;
+    cited: Record<string, string>;
 }
 /** What one judge cost per character here, frozen once, at the orchestrator's first review: `null` without enough single reviews. */
 export interface CostBaseline {
@@ -52,6 +65,10 @@ export declare class VerdictStore {
     private readonly dir;
     private constructor();
     static open(cwd: string, exec: Exec): Promise<VerdictStore | undefined>;
+    /** The verdict reviewed under this content key, unless it is older than CONTENT_TTL_MS or its verdict is gone. */
+    contentEntry(key: string): ContentEntry | undefined;
+    /** Keeps a content entry; past CONTENT_KEPT, the oldest are removed. */
+    recordContent(key: string, entry: ContentEntry): void;
     verdictPath(head: string, fingerprint: string): string;
     /** The open items beside a verdict, by id; what a delta review is asked to carry or resolve. */
     openPath(verdictPath: string): string;

package/dist/review/reviewer/store.js

@@ -12,6 +12,10 @@ import { GH_TIMEOUT_MS } from './exec.js';
 function localDay(at = new Date()) {
     return `${at.getFullYear()}-${String(at.getMonth() + 1).padStart(2, '0')}-${String(at.getDate()).padStart(2, '0')}`;
 }
+/** Content entries kept, newest first; older ones are removed when a new one is written. */
+const CONTENT_KEPT = 500;
+/** A content entry older than this is not reused. */
+const CONTENT_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 const COSTS_KEPT = 200;
 export class VerdictStore {
     dir;
@@ -26,6 +30,25 @@ export class VerdictStore {
         fs.mkdirSync(path.join(dir, 'branches'), { recursive: true });
         return new VerdictStore(dir);
     }
+    /** The verdict reviewed under this content key, unless it is older than CONTENT_TTL_MS or its verdict is gone. */
+    contentEntry(key) {
+        const entry = this.readJson(path.join(this.dir, 'content', `${key}.json`));
+        if (!entry || Date.now() - Date.parse(entry.at) > CONTENT_TTL_MS || !fs.existsSync(entry.verdict))
+            return undefined;
+        return entry;
+    }
+    /** Keeps a content entry; past CONTENT_KEPT, the oldest are removed. */
+    recordContent(key, entry) {
+        const dir = path.join(this.dir, 'content');
+        fs.mkdirSync(dir, { recursive: true });
+        this.writeJson(path.join(dir, `${key}.json`), entry);
+        const files = fs.readdirSync(dir).filter(f => f.endsWith('.json'));
+        if (files.length <= CONTENT_KEPT)
+            return;
+        const byAge = files.map(f => ({ f, at: fs.statSync(path.join(dir, f)).mtimeMs })).sort((a, b) => a.at - b.at);
+        for (const { f } of byAge.slice(0, files.length - CONTENT_KEPT))
+            fs.rmSync(path.join(dir, f), { force: true });
+    }
     verdictPath(head, fingerprint) {
         return path.join(this.dir, `${head}.${fingerprint.slice(0, 8)}.json`);
     }

package/dist/review/reviewer/usage.js

@@ -17,6 +17,7 @@ export function reviewerUsage(result, trigger) {
         refused: mode?.refused?.length ?? 0,
         judges: result.reviewers.length,
         cached: result.cached,
+        ...(result.cache ? { cache: result.cache } : {}),
         confirmed: result.items.length,
         disputed: result.disputed.length,
         dropped: result.dropped.length,

package/dist/review/reviewer.d.ts

@@ -68,6 +68,8 @@ export interface ReviewerResult {
     costUsd?: number;
     /** What every run of this fresh review reported costing, failed runs included: the number its cost row and its thread event carry. */
     spentUsd?: number;
+    /** A verdict reused for the same content reviewed on another commit: nothing ran. */
+    cache?: 'content';
     /** The repository's own rules the judge answered, and how. */
     rules?: {
         checked: number;

package/dist/review/reviewer.js

@@ -29,7 +29,7 @@ import { mergeImpact } from './reviewer/merge-impact.js';
 import { applyPanel, parseAnswers, runPanel } from './reviewer/panel.js';
 import { crossExamPrompt, deltaBlock, goalStep, mergeBlock, PROMPT_VERSION, renderPrompt } from './reviewer/prompt.js';
 import { BASELINE_MIN_SINGLES, focusBlock, formatLedger, ledger, passLimit, runPasses, SPECIALISTS, SPECIALISTS_KEY, splitNeeds } from './reviewer/orchestrator.js';
-import { MAX_PARTS, parseHunks, planPasses, reviewable, triage } from './reviewer/triage.js';
+import { MAX_PARTS, parseHunks, planPasses, reviewable, skipped, triage } from './reviewer/triage.js';
 import { modelGoalItems, parseGoal } from '../goal/goal.js';
 import { resolveSwitch } from '../switches.js';
 import { resolveReviewer } from './reviewer/settings.js';
@@ -250,6 +250,27 @@ async function review(cwd, base, config, exec, progress, options) {
     const size = reviewable(hunks);
     const shared = reviews.markdown.length + body.length + context.text.length + (options.hints?.trim() || 'none\n').length + (goalText?.length ?? 0);
     const projectedSingle = shared + size.chars;
+    // The same content, reviewed on another commit (a rebase, an amend, a cherry-pick, another branch): its verdict, once the
+    // base under every file it cites is checked unchanged. Only a full review: a delta depends on the verdict before it.
+    const contentKey = scope === 'full' ? sha([inputsKey, modeRecord.ran, reviewerVersions, context.key, reviewableBlobs(fullDiff)]) : undefined;
+    const reused = contentKey && !options.force ? store.contentEntry(contentKey) : undefined;
+    if (reused && sameBlobs(reused.cited, await baseBlobs(git, baseSha, Object.keys(reused.cited)))) {
+        const verdict = store.readJson(reused.verdict);
+        if (verdict) {
+            why = `same content as the verdict on ${reused.head.slice(0, 9)}`;
+            const accounted = decide(verdict, undefined, verify, prior, dismissals);
+            store.writeJson(verdictFile, { ...verdict, inputs: { head, base: baseSha, scope, why, mode: modeRecord, reviewers, versions: reviewerVersions, authors: [...authors], fingerprint, human_reviews: reviews.count, reviews_before: options.reviewsBefore ?? null, since: null, at: new Date().toISOString(), cache: 'content', from: reused.head } });
+            store.writeJson(openFile, accounted.open);
+            store.writeJson(store.decidedPath(verdictFile), accounted);
+            // A reused verdict ran nothing: it credits the savings ledger with what one judge would have been given.
+            if (modeRecord.asked === 'orchestrator' || (modeRecord.asked === 'single' && modeRecord.ran === 'single')) {
+                store.recordCost({ at: new Date().toISOString(), mode: modeRecord.asked === 'orchestrator' ? 'orchestrator' : 'single', lines: size.lines, projectedSingleChars: projectedSingle, ...(modeRecord.asked === 'orchestrator' ? { projectedChars: 0 } : {}), actualChars: 0, actualUsd: 0, runs: 0, cache: 'content' });
+            }
+            if (branch !== 'HEAD')
+                store.recordBranch(branch, { head, verdict: verdictFile, mode: scope, rulesHash, reviewsKey: reviews.key, inputsKey });
+            return { ...withRecord(accounted, verdict, true), cache: 'content' };
+        }
+    }
     // The orchestrator's plan: which specialists the change needs, hunk by hunk, as one combined pass. A change over the
     // judge's limit is split by hunk only when the savings ledger covers the split's extra. Nothing to review: no pass.
     const picked = orchestrate ? triage(hunks, { humanReviews: reviews.count, rulesAndLessons: context.rules.length + context.lessons, goal: goalItems.length > 0 }) : new Map();
@@ -504,6 +525,10 @@ async function review(cwd, base, config, exec, progress, options) {
         recordReviewCost();
         if (branch !== 'HEAD')
             store.recordBranch(branch, { head, verdict: verdictFile, mode: scope, rulesHash, reviewsKey: reviews.key, inputsKey });
+        if (contentKey) {
+            const cited = [...new Set(verdict.findings.map(f => f.file).filter((file) => !!file))];
+            store.recordContent(contentKey, { verdict: verdictFile, head, at: new Date().toISOString(), cited: await baseBlobs(git, baseSha, cited) });
+        }
         return { ...withRecord(accounted, verdict, false), spentUsd: spentUsd() };
     }
     finally {
@@ -637,3 +662,29 @@ function names(target, file) {
     const after = target[at + file.length];
     return (before === undefined || /[\s/'"=]/.test(before)) && (after === undefined || /[\s'":)]/.test(after));
 }
+/** The reviewable diff as content: each file's path and its before and after blobs, sorted. Lockfiles and generated files are left out. */
+function reviewableBlobs(diff) {
+    const files = [];
+    for (const block of diff.split(/^(?=diff --git )/m)) {
+        const file = /^diff --git a\/.+? b\/(.+)$/m.exec(block)?.[1];
+        if (!file || skipped(file))
+            continue;
+        files.push(`${file} ${/^index ([0-9a-f]+\.\.[0-9a-f]+)/m.exec(block)?.[1] ?? 'no-index'}`);
+    }
+    return files.sort().join('\n');
+}
+/** Each file's blob at `commit`, in one `git ls-tree`; a file the commit does not have is ''. */
+async function baseBlobs(git, commit, files) {
+    const blobs = Object.fromEntries(files.map(file => [file, '']));
+    if (files.length === 0)
+        return blobs;
+    for (const line of (await git(['ls-tree', commit, '--', ...files])).split('\n')) {
+        const m = /^\d+ blob ([0-9a-f]+)\t(.+)$/.exec(line);
+        if (m && m[2] in blobs)
+            blobs[m[2]] = m[1];
+    }
+    return blobs;
+}
+function sameBlobs(a, b) {
+    return Object.keys(a).every(file => a[file] === b[file]);
+}

package/dist/review/settled-checks.d.ts

@@ -0,0 +1,39 @@
+/**
+ * What Rigour's checks already found on a change, as a model reviewer is told it: settled, blocking on their own, never
+ * to be reported again. The judge (reviewer/context.ts) and the deep PR review (deep/pr-review.ts) both say it this way,
+ * so neither spends a model's turn on what a free check proves.
+ */
+/** A check's finding where it sits; `kind` is the check's id. */
+export interface SettledCheck {
+    file: string;
+    line?: number;
+    title: string;
+    kind?: string;
+}
+/** What a model finding is against the settled checks: the same issue as one (drop it), or on a line one flags (keep it, say so). */
+export declare function againstSettled(finding: {
+    file: string;
+    line?: number;
+    category: string;
+}, settled: SettledCheck[]): {
+    same: boolean;
+    alsoAt: string[];
+};
+/** The findings on a change's lines (`focusLines`, per file); every finding when there is no change to scope to. */
+export declare function onChangedLines<F extends {
+    files?: string[];
+    line?: number;
+}>(findings: F[], focusLines: Record<string, number[]> | undefined): F[];
+/** The most settled items (findings, dismissals, refuted points) a prompt lists. */
+export declare const MAX_SETTLED = 40;
+/** Findings as settled checks: their first file, line and title. */
+export declare function settledChecks(findings: Array<{
+    id?: string;
+    files?: string[];
+    line?: number;
+    title: string;
+}>): SettledCheck[];
+/** One line per finding: `file:line title`. */
+export declare function settledLine(check: SettledCheck): string;
+/** The prompt section; empty when there is nothing settled. */
+export declare function settledSection(lines: string[]): string;

package/dist/review/settled-checks.js

@@ -0,0 +1,47 @@
+/**
+ * What Rigour's checks already found on a change, as a model reviewer is told it: settled, blocking on their own, never
+ * to be reported again. The judge (reviewer/context.ts) and the deep PR review (deep/pr-review.ts) both say it this way,
+ * so neither spends a model's turn on what a free check proves.
+ */
+/**
+ * The model reviewer's categories (deep/code-review-prompt.ts) each check's findings belong to: a model finding of one of
+ * them, on a check's line, is the check's finding said again. A check missing here matches no category, so a model finding
+ * on its line is always kept.
+ */
+const CHECK_CATEGORIES = {
+    'security-patterns': ['security'],
+    'deprecated-apis': ['security', 'api_misuse'],
+    'semantic-bugs': ['correctness'],
+    'hallucinated-imports': ['api_misuse', 'correctness'],
+    'promise-safety': ['error_handling'],
+    'offset-paging': ['scalability'],
+    'unbounded-window': ['scalability'],
+};
+/** What a model finding is against the settled checks: the same issue as one (drop it), or on a line one flags (keep it, say so). */
+export function againstSettled(finding, settled) {
+    const here = settled.filter(c => c.line !== undefined && c.file === finding.file && c.line === finding.line);
+    return { same: here.some(c => !!c.kind && (CHECK_CATEGORIES[c.kind] ?? []).includes(finding.category)), alsoAt: here.map(c => c.title) };
+}
+/** The findings on a change's lines (`focusLines`, per file); every finding when there is no change to scope to. */
+export function onChangedLines(findings, focusLines) {
+    if (!focusLines)
+        return findings;
+    return findings.filter(f => {
+        const lines = focusLines[f.files?.[0] ?? ''];
+        return !!lines && (f.line === undefined || lines.includes(f.line));
+    });
+}
+/** The most settled items (findings, dismissals, refuted points) a prompt lists. */
+export const MAX_SETTLED = 40;
+/** Findings as settled checks: their first file, line and title. */
+export function settledChecks(findings) {
+    return findings.map(f => ({ file: f.files?.[0] ?? '?', ...(f.line ? { line: f.line } : {}), title: f.title, ...(f.id ? { kind: f.id } : {}) }));
+}
+/** One line per finding: `file:line title`. */
+export function settledLine(check) {
+    return `${check.file}${check.line ? `:${check.line}` : ''} ${check.title}`;
+}
+/** The prompt section; empty when there is nothing settled. */
+export function settledSection(lines) {
+    return lines.length ? `## Already found by Rigour's checks: they block on their own, so do not report them again\n${lines.slice(0, MAX_SETTLED).map(c => `- ${c}`).join('\n')}` : '';
+}

package/dist/review/unused-exports.js

@@ -5,7 +5,7 @@
  * dead exports pile up in agent-written code. Only exports on added lines are checked. Another
  * file uses an export when it names the symbol as a whole word AND points at the module: an import,
  * re-export, dynamic import or mock whose specifier ends in the module's name (its folder's, for an
- * index file). A same-named word elsewhere, such as an unrelated route parameter, is not a use, and
+ * index file), or the name of a barrel that re-exports the module with `export * from` (a chain of them too). A same-named word elsewhere, such as an unrelated route parameter, is not a use, and
  * neither is a test: an export only its tests import is dead in production, and exporting a thing
  * for its test is the habit that keeps it so. What a framework calls by convention (SvelteKit and
  * Next.js route modules, hooks, serverless functions) is never reported.
@@ -111,10 +111,50 @@ export function unusedExportFailures(cwd, diff, config) {
     if (!users)
         return []; // git could not answer: say nothing rather than guess
     const points = pointsAtCache(cwd);
+    const barrels = barrelsOf(cwd);
     return candidates
-        .filter(exp => ![...(users.get(exp.name) ?? [])].some(user => !isOwnFile(user, exp) && !isTestFile(user) && points(user, exp.file)))
+        .filter(exp => {
+        const modules = [exp.file, ...reExporters(exp.file, barrels)];
+        return ![...(users.get(exp.name) ?? [])].some(user => !isOwnFile(user, exp) && !isTestFile(user) && modules.some(module => points(user, module)));
+    })
         .map(exp => unused(exp, !settings.block));
 }
+const STAR_EXPORT = /^\s*export\s*\*\s*from\s*['"](\.{1,2}\/[^'"]+)['"]/gm;
+/** Per module (path without extension), the barrel files that re-export all of it with `export * from './module'`: one git grep. */
+function barrelsOf(cwd) {
+    const barrels = new Map();
+    const found = spawnSync('git', ['grep', '--untracked', '-l', '-E', 'export[[:space:]]*\\*[[:space:]]*from', '--', '.'], { cwd, encoding: 'utf8', timeout: GIT_TIMEOUT_MS, maxBuffer: 64 * 1024 * 1024 });
+    if (found.status !== 0)
+        return barrels;
+    for (const barrel of found.stdout.split('\n').filter(file => CODE.test(file))) {
+        let text = '';
+        try {
+            text = fs.readFileSync(path.join(cwd, barrel), 'utf8');
+        }
+        catch {
+            continue;
+        }
+        for (const match of text.matchAll(STAR_EXPORT)) {
+            const module = withoutExtension(path.posix.join(path.posix.dirname(barrel), match[1]));
+            barrels.set(module, [...(barrels.get(module) ?? []), barrel]);
+        }
+    }
+    return barrels;
+}
+/** Every barrel that re-exports `file`, directly or through other barrels. */
+function reExporters(file, barrels) {
+    const seen = new Set();
+    const queue = [withoutExtension(file)];
+    while (queue.length) {
+        for (const barrel of barrels.get(queue.shift()) ?? []) {
+            if (seen.has(barrel))
+                continue;
+            seen.add(barrel);
+            queue.push(withoutExtension(barrel));
+        }
+    }
+    return [...seen];
+}
 /**
  * In a project that emits declarations, an exported type named elsewhere in its own file is part
  * of another export's signature (TypeScript requires it to stay exported); in an application it is not.

package/dist/types/index.d.ts

@@ -3784,4 +3784,10 @@ export interface DeepOptions {
     independent?: boolean;
     /** The change's unified diff (from reviewChange): a cloud agentic review reads the PR as a whole. */
     diff?: string;
+    /** What Rigour's checks already found on the change's lines (the runner fills it): settled, never reported again. */
+    settled?: Array<{
+        file: string;
+        line?: number;
+        title: string;
+    }>;
 }

package/dist/utils/code-mask.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Which characters of a source file are code, and which sit inside a string literal or a line comment: what tells a
+ * call (`subprocess.call(cmd, shell=True)`) from the same text in a message (`MSG = "subprocess.call(...)"`).
+ *
+ * The string literals are the ones `stripStrings` already strips (side-effect-helpers/types.ts): `"…"`, `'…'` and
+ * `` `…` ``, with backslash escapes. A line comment starts at `#` (Python, Ruby, shell) or `//` (the C family) outside
+ * a string. Every line starts as code: nothing carries to the next line, so a regex literal holding a quote (`/"/`) or
+ * an unclosed quote affects only its own line and can never hide a real call below it.
+ *
+ * Two limits, both narrowing a false positive and never losing a match the gates made before:
+ * - a string or a block comment spanning lines (a Python `"""` docstring, a multi-line template literal, `/* … *\/`)
+ *   is read as code past its first line, as before;
+ * - code inside a string interpolation (Python `f"{…}"`, JS `${…}`, Ruby `#{…}`) is string, so a call written inside
+ *   one does not count as a call.
+ */
+/** For one line, whether column `col` is code. `ext` is the file's extension, which decides the comment marker. */
+export declare function codeColumns(line: string, ext: string): (col: number) => boolean;
+/** For a whole file, whether the character at `offset` is code: line by line, each line starting as code. */
+export declare function codeOffsets(content: string, ext: string): (offset: number) => boolean;

package/dist/utils/code-mask.js

@@ -0,0 +1,67 @@
+/**
+ * Which characters of a source file are code, and which sit inside a string literal or a line comment: what tells a
+ * call (`subprocess.call(cmd, shell=True)`) from the same text in a message (`MSG = "subprocess.call(...)"`).
+ *
+ * The string literals are the ones `stripStrings` already strips (side-effect-helpers/types.ts): `"…"`, `'…'` and
+ * `` `…` ``, with backslash escapes. A line comment starts at `#` (Python, Ruby, shell) or `//` (the C family) outside
+ * a string. Every line starts as code: nothing carries to the next line, so a regex literal holding a quote (`/"/`) or
+ * an unclosed quote affects only its own line and can never hide a real call below it.
+ *
+ * Two limits, both narrowing a false positive and never losing a match the gates made before:
+ * - a string or a block comment spanning lines (a Python `"""` docstring, a multi-line template literal, `/* … *\/`)
+ *   is read as code past its first line, as before;
+ * - code inside a string interpolation (Python `f"{…}"`, JS `${…}`, Ruby `#{…}`) is string, so a call written inside
+ *   one does not count as a call.
+ */
+const LITERAL = {
+    '"': /"(?:[^"\\]|\\.)*"/y,
+    "'": /'(?:[^'\\]|\\.)*'/y,
+    '`': /`(?:[^`\\]|\\.)*`/y,
+};
+const HASH_COMMENTS = new Set(['py', 'rb', 'sh', 'bash', 'zsh', 'yml', 'yaml', 'toml', 'r', 'pl']);
+/** For one line, whether column `col` is code. `ext` is the file's extension, which decides the comment marker. */
+export function codeColumns(line, ext) {
+    const hash = HASH_COMMENTS.has(ext.toLowerCase());
+    const masked = new Uint8Array(line.length);
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if ((hash && c === '#') || (!hash && c === '/' && line[i + 1] === '/')) {
+            masked.fill(1, i);
+            break;
+        }
+        const literal = LITERAL[c];
+        if (!literal)
+            continue;
+        literal.lastIndex = i;
+        const m = literal.exec(line);
+        if (!m)
+            continue; // an unclosed quote: the rest of the line stays code
+        masked.fill(1, i, i + m[0].length);
+        i += m[0].length - 1;
+    }
+    return col => col < 0 || col >= line.length || masked[col] === 0;
+}
+/** For a whole file, whether the character at `offset` is code: line by line, each line starting as code. */
+export function codeOffsets(content, ext) {
+    const starts = [0];
+    for (let i = 0; i < content.length; i++)
+        if (content[i] === '\n')
+            starts.push(i + 1);
+    const lines = new Map();
+    return offset => {
+        let lo = 0;
+        let hi = starts.length - 1;
+        while (lo < hi) {
+            const mid = (lo + hi + 1) >> 1;
+            if (starts[mid] <= offset)
+                lo = mid;
+            else
+                hi = mid - 1;
+        }
+        if (!lines.has(lo)) {
+            const end = lo + 1 < starts.length ? starts[lo + 1] - 1 : content.length;
+            lines.set(lo, codeColumns(content.slice(starts[lo], end), ext));
+        }
+        return lines.get(lo)(offset - starts[lo]);
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.9.0",
+  "version": "6.10.0-rc.1",
   "description": "Rigour's review engine: deterministic gates on changed lines, rules and lessons learned from your team's fixes, and per-check precision from what you fix versus dismiss, across TypeScript, JavaScript, Python, Go, Ruby and C#.",
   "engines": {
     "node": ">=22.13"
@@ -75,11 +75,11 @@
     "@anthropic-ai/sdk": "^0.132.1",
     "pg": "^8.16.3",
     "openai": "^5.23.2",
-    "@rigour-labs/brain-darwin-arm64": "6.9.0",
-    "@rigour-labs/brain-darwin-x64": "6.9.0",
-    "@rigour-labs/brain-linux-arm64": "6.9.0",
-    "@rigour-labs/brain-linux-x64": "6.9.0",
-    "@rigour-labs/brain-win-x64": "6.9.0"
+    "@rigour-labs/brain-darwin-x64": "6.10.0-rc.1",
+    "@rigour-labs/brain-darwin-arm64": "6.10.0-rc.1",
+    "@rigour-labs/brain-linux-x64": "6.10.0-rc.1",
+    "@rigour-labs/brain-linux-arm64": "6.10.0-rc.1",
+    "@rigour-labs/brain-win-x64": "6.10.0-rc.1"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",