Package Exports

This package does not declare an exports field, so the exports above have been automatically detected and optimized by JSPM instead. If any package subpath is missing, it is recommended to post an issue to the original package (@rigour-labs/cli) to support the "exports" field. If that is not possible, create a JSPM override to customize the exports field for this package.

Readme

@rigour-labs/cli

AI Agent Governance CLI — quality gates, DLP, drift detection, and deep analysis. Rigour governs what goes IN (DLP), what comes OUT (quality gates), and what gets PERSISTED (memory governance).

Core gates run locally. Deep analysis can run local or cloud provider mode.

🚀 Quick Start

npx @rigour-labs/cli scan     # Zero-config scan (auto-detect stack)
npx @rigour-labs/cli init     # Initialize config, hooks, DLP, governance
npx @rigour-labs/cli check    # Verify code quality (27+ gates)
npx @rigour-labs/cli run -- claude "Build feature X"  # Agent loop

🍺 Homebrew

brew tap rigour-labs/tap
brew install rigour

🛑 The Problem

AI agents are powerful but ungoverned. They claim success based on narrative, not execution. Credentials get cached in agent memory. Imports get hallucinated. Code quality drifts across sessions.

Rigour breaks this cycle with deterministic PASS/FAIL gates, credential interception, and memory governance — all local-first.

🔄 How It Works

Agent writes code → Rigour checks → FAIL? → Fix Packet → Agent retries → PASS ✓
DLP: User input → Credential scan → BLOCK before agent sees it
Memory: Agent writes CLAUDE.md → Rigour intercepts → Forces rigour_remember (DLP-scanned)

⚙️ Quality Gates (27+ Deterministic)

Structural & Security Gates

Gate	Description
File Size	Max lines per file (default: 300-500)
Content Hygiene	No TODO/FIXME comments allowed
AST Analysis	Cyclomatic complexity, method count, nesting depth, function length
Required Docs	SPEC.md, ARCH.md, README must exist
File Guard	Protected paths, max files changed
Security Patterns	XSS, SQL injection, hardcoded secrets, command injection, path traversal
Frontend Secret Exposure	API keys in client-side bundles
Deprecated APIs	Node, Python, Web, Go, C#, Java deprecated usage
Test Quality	Empty tests, tautological assertions, mock-heavy, snapshot abuse
Side-Effect Safety	Unbounded timers, recursive depth, resource lifecycle, retry loops

AI-Native Drift Detection

Gate	Description
Hallucinated Imports	Imports referencing non-existent modules (JS/TS, Python, Go, Ruby, C#, Rust, Java, Kotlin)
Phantom APIs	Non-existent stdlib/framework methods the LLM invented
Promise Safety	Unhandled async, unsafe JSON.parse, floating fetch across 6 languages
Duplication Drift	Three-pass: MD5 exact → AST Jaccard (tree-sitter) → semantic embedding (384D cosine)
Style Drift	Naming conventions, error handling, import style fingerprinted against project baseline
Logic Drift	Comparison operators (>= → >), branch counts, return statements tracked per function
Context Window Artifacts	Quality degradation within long files — clean top, messy bottom
Inconsistent Error Handling	Same error type handled differently across sessions
Dependency Bloat	Unused deps, heavy alternatives (moment→dayjs), duplicate purpose packages

Agent Governance

Gate	Description
Memory Governance	Blocks agent writes to CLAUDE.md, .clinerules, .windsurf/memories/
Skills Governance	Blocks agent writes to .claude/skills/, .cursor/rules/
Governance DLP	Scans content written to any governed file for credentials

Two-Score System

Every failure carries a provenance tag (ai-drift, traditional, security, governance) and contributes to two sub-scores: AI Health Score (0–100) and Structural Score (0–100).

🔒 AI Agent DLP (Data Loss Prevention)

Real-time credential interception via PreToolUse hooks — blocks credentials before agents see them.

29 credential patterns: AWS, GCP, Azure, OpenAI, Anthropic, GitHub, Stripe, private keys, database URLs, JWTs, CI/CD tokens
Anti-evasion: Unicode normalization, zero-width char removal, bidi control stripping, Shannon entropy detection (>4.5 bits)
Compliance mapped: SOC2-CC6.1, HIPAA-164.312, PCI-DSS-3.4/3.5/6.5, OWASP-A2, CWE-798

🔗 Real-Time Hooks

Two-tier supervision: inline hooks (<200ms per file write) + checkpoint suite (full gates).

rigour hooks init                    # auto-detect tool, install hooks + DLP
rigour hooks init --tool all         # all tools at once
rigour hooks init --block            # exit code 2 on failures (strict mode)
rigour hooks init --no-dlp           # skip DLP hooks
rigour hooks check --files src/a.ts  # manual fast check

Supported tools: Claude Code, Cursor, Cline, Windsurf — each with quality (post-write) and DLP (pre-write) hooks.

🧠 Deep Analysis (LLM-Powered)

Five-signal extraction → LLM interpretation → deterministic verification pipeline.

rigour check --deep                  # Local sidecar (Qwen2.5-Coder-0.5B, any CPU)
rigour check --deep --pro            # Full model (Qwen2.5-Coder-1.5B)
rigour check --deep --provider claude -k sk-ant-xxx  # Cloud BYOK

🌐 Multi-Language Support

Hallucinated import detection with stdlib whitelists and dependency manifest parsing:

JS/TS (Node.js builtins, package.json) · Python (160+ stdlib, local modules) · Go (150+ stdlib, go.mod) · Ruby (80+ stdlib, Gemfile) · C#/.NET (.NET 8 namespaces, .csproj) · Rust (std/core/alloc, Cargo.toml) · Java (java/javax/jakarta, build.gradle/pom.xml) · Kotlin (kotlin/kotlinx + Java interop, build.gradle.kts)

🛠️ Commands

Command	Purpose
`rigour scan`	Zero-config stack-aware scan (auto-detect)
`rigour scan --deep`	Zero-config + local LLM deep analysis
`rigour init`	Setup config, hooks, DLP, governance
`rigour check`	Full repository quality gates
`rigour check --ci`	CI mode with minimal output
`rigour check --deep`	+ local LLM analysis
`rigour hooks init`	Install real-time hooks for detected tools
`rigour hooks check --files ...`	Fast hook gates on specific files
`rigour explain`	Detailed explanation of failures
`rigour run`	Supervisor loop for agent refinement
`rigour run --supervised`	Full supervisor mode (iterative command + gate loop)
`rigour studio`	Dashboard for monitoring
`rigour brain`	Local memory status (SQLite)
`rigour brain --compact`	Prune old findings, reclaim disk
`rigour doctor`	Diagnose install + deep readiness
`rigour export-audit`	Export compliance audit report (JSON/Markdown)
`rigour demo`	Live demo on synthetic or real repos
`rigour settings`	Manage API keys and provider config

🤖 Works With

Claude Code: rigour run -- claude "..." + real-time hooks
Cursor: Via MCP server + .cursor/hooks.json
Cline: Via MCP server + .clinerules/hooks/ scripts
Windsurf: Via MCP server + .windsurf/hooks.json
Gemini: Via MCP server (rigour_check, rigour_explain)
GitHub Actions: npx @rigour-labs/cli check --ci

📖 Documentation

📚 Full Documentation →

Quick Links
Getting Started	Install and run in 60 seconds
CLI Reference	All commands and options
Configuration	Customize quality gates
MCP Integration	AI agent setup

🧪 CI Integration

- run: npx @rigour-labs/cli check --ci

@rigour-labs/cli

Package Exports

Readme

@rigour-labs/cli

🚀 Quick Start

🍺 Homebrew

🛑 The Problem

🔄 How It Works

⚙️ Quality Gates (27+ Deterministic)

Structural & Security Gates

AI-Native Drift Detection

Agent Governance

Two-Score System

🔒 AI Agent DLP (Data Loss Prevention)

🔗 Real-Time Hooks

🧠 Deep Analysis (LLM-Powered)

🌐 Multi-Language Support

🛠️ Commands

🤖 Works With

📖 Documentation

🧪 CI Integration

📜 License