@vibe-agent-toolkit/agent-skills 0.1.41-rc.7 → 0.1.41

package/dist/test-input.js

@@ -15,6 +15,13 @@
  *      — because "we stopped shipping it" and "the executor can't read it" must not
  *      be the same guarantee.)
  *
+ * The rule is PROJECT-WIDE, not per-skill: a file that ANY skill declares as its eval
+ * suite is test input, and never ships in ANY skill's bundle. Skill A's docs are free
+ * to cite skill B's suite as a worked example — that citation is a reference, not a
+ * reason to package B's answer key inside A. The invariant "the executor's filesystem
+ * contains no answer key" therefore covers every declared suite in the project, not
+ * only the subject's own.
+ *
  * This module is the ONE definition of where a skill's test input lives, shared by
  * every packaging lane, so no lane can answer the question differently.
  */
@@ -34,8 +41,14 @@ function hasConventionalSuite(skillDir) {
     // eslint-disable-next-line security/detect-non-literal-fs-filename -- skillDir is VAT's own resolved skill directory
     return existsSync(safePath.resolve(skillDir, DEFAULT_EVALS_SUBPATH));
 }
+/** True when `candidate` is inside (or equal to) `dir`. Both are absolute. */
+function isInside(candidate, dir) {
+    const c = safePath.resolve(candidate);
+    const d = safePath.resolve(dir);
+    return c === d || c.startsWith(`${d}/`);
+}
 /**
- * Absolute directories holding a skill's declared test input.
+ * Absolute directories holding ONE skill's declared test input.
  *
  * The unit is the DIRECTORY containing the suite file (it also holds the suite's
  * `fixtures/`), except when the suite sits at the skill root — where the "directory"
@@ -56,7 +69,7 @@ function hasConventionalSuite(skillDir) {
  * root `evals/` holding no `evals.json`. Guessing from the name alone would silently
  * drop an author's unrelated directory out of their own bundle.
  */
-export function resolveTestInputDirs(config, skillDir) {
+function declaredTestInputDirs(config, skillDir) {
     if (config.test === undefined && !hasConventionalSuite(skillDir))
         return [];
     const subpath = config.test?.evals ?? DEFAULT_EVALS_SUBPATH;
@@ -67,6 +80,55 @@ export function resolveTestInputDirs(config, skillDir) {
         return [];
     return [safePath.resolve(skillDir, parent)];
 }
+/**
+ * Absolute directories holding declared test input, from the point of view of the
+ * skill being packaged: its OWN suite, plus EVERY other suite the project declares.
+ *
+ * The cross-skill half is not defensive breadth — it is the same rule applied to the
+ * same kind of file. A doc citing another skill's eval suite as a worked example is an
+ * entirely reasonable doc, and the link walker follows those citations. Keyed only to
+ * the subject, this function called another skill's answer key "ordinary content", so
+ * the walker bundled it — with no exclusion and no `PACKAGED_TEST_INPUT` receipt,
+ * because nothing under the subject's config named that path.
+ *
+ * Observed ACTIVE on a 90-skill adopter (2026-07-30, `vat skills build`): a built
+ * bundle contained a file byte-identical to a DIFFERENT skill's real eval suite,
+ * carried under that bundle's own subtree. The answer key shipped. A basename
+ * collision between two such suites does not save anyone — a FILENAME_COLLISION is
+ * REPORTED, not thrown, and the copy still happens.
+ *
+ * Nothing else in the pipeline sees it. `LINK_TO_SKILL_DEFINITION` covers only another
+ * skill's SKILL.md. And the two mechanisms in THIS module that exist to catch a
+ * shipped suite — the `PACKAGED_TEST_INPUT` receipt and the `checkPackagedTestInput`
+ * backstop — are both fed the dirs this function returns, so while those dirs were the
+ * subject's alone, both were structurally blind to another skill's suite. That is why
+ * the fix has to be a project-level INPUT here rather than another check downstream.
+ *
+ * `projectSkills` may include the skill being packaged; dirs are deduplicated, and the
+ * subject's own come first. It is REQUIRED, with no default: a defaulted parameter made
+ * every pre-existing caller silently keep the per-skill behaviour, so the rule above
+ * was written down and shipped as a no-op. A lane that genuinely cannot enumerate the
+ * project's skills passes `[]` at the call site, where the narrowing is visible and has
+ * to be justified in a comment — it can no longer happen by omission.
+ *
+ * SCOPE OF THE CROSS-SKILL HALF — another skill's suite dir travels to this build only
+ * when it lies INSIDE that skill's own directory. A `test.evals` pointing at a SHARED
+ * directory already strips that whole directory from the declaring skill's bundle
+ * (issue #166); honouring it project-wide would turn one skill's over-broad
+ * declaration into a project-wide strip of a directory no single skill owns. The
+ * declaring skill's own build is unchanged — the `config`/`skillDir` pair above is
+ * still taken at face value — so this narrows nothing that worked before.
+ */
+export function resolveTestInputDirs(config, skillDir, projectSkills) {
+    const dirs = new Set(declaredTestInputDirs(config, skillDir));
+    for (const skill of projectSkills) {
+        for (const dir of declaredTestInputDirs(skill.config, skill.skillDir)) {
+            if (isInside(dir, skill.skillDir))
+                dirs.add(dir);
+        }
+    }
+    return [...dirs];
+}
 /**
  * The test-input dirs VAT actually excludes links for: those inside the project
  * root. A dir outside it yields no exclude rule — the walker already refuses to
@@ -103,12 +165,6 @@ export function testInputExcludeRules(testInputDirs, projectRoot) {
     }
     return patterns.length === 0 ? [] : [{ patterns }];
 }
-/** True when `candidate` is inside (or equal to) `dir`. Both are absolute. */
-function isInside(candidate, dir) {
-    const c = safePath.resolve(candidate);
-    const d = safePath.resolve(dir);
-    return c === d || c.startsWith(`${d}/`);
-}
 /**
  * Split `files:` entries into those that may be packaged and those that point into
  * declared test input and therefore must not be.
@@ -139,8 +195,8 @@ export function partitionTestInputFileEntries(filesConfig, projectRoot, testInpu
     return { kept, dropped };
 }
 /**
- * The `files:` entries that will ACTUALLY be packaged for a skill, derived from the
- * skill's own config: {@link resolveTestInputDirs} + the `kept` half of
+ * The `files:` entries that will ACTUALLY be packaged for a skill:
+ * {@link resolveTestInputDirs} + the `kept` half of
  * {@link partitionTestInputFileEntries}.
  *
  * Every lane that models "which `dest` paths will exist after the build" must build
@@ -151,16 +207,20 @@ export function partitionTestInputFileEntries(filesConfig, projectRoot, testInpu
  * and fails. Same input, opposite verdicts, in two commands that are supposed to
  * agree. The packager is the authority on what ships; this is how the read-only
  * lanes borrow its answer instead of guessing.
+ *
+ * `projectSkills` is forwarded to {@link resolveTestInputDirs}, so a `files:` entry
+ * pointing at ANOTHER skill's declared suite is dropped here too. Required for the
+ * same reason it is required there — see that function's note on the no-op default.
  */
-export function packagedFileEntries(config, skillDir, projectRoot) {
-    return partitionTestInputFileEntries(config.files ?? [], projectRoot, resolveTestInputDirs(config, skillDir)).kept;
+export function packagedFileEntries(config, skillDir, projectRoot, projectSkills) {
+    return partitionTestInputFileEntries(config.files ?? [], projectRoot, resolveTestInputDirs(config, skillDir, projectSkills)).kept;
 }
 /** A `PACKAGED_TEST_INPUT` receipt per dropped `files:` entry — a warning, not a failure. */
 export function testInputFileEntryIssues(dropped) {
     return dropped.map((entry) => materializeIssue('PACKAGED_TEST_INPUT', {
         location: toForwardSlash(entry.dest),
         message: `files: entry "${toForwardSlash(entry.source)} -> ${toForwardSlash(entry.dest)}" points into ` +
-            `this skill's declared test input (test.evals) and was NOT packaged — test input, ` +
+            `declared test input (some skill's test.evals) and was NOT packaged — test input, ` +
             `including the expected_output answer key, never ships to consumers.`,
     }));
 }
@@ -200,9 +260,10 @@ export function testInputLinkIssues(excluded, testInputDirs, projectRoot, locati
         seen.add(location);
         issues.push(materializeIssue('PACKAGED_TEST_INPUT', {
             location,
-            message: `Link "${ref.linkHref ?? location}" points into this skill's declared test input ` +
-                `(test.evals). The target is NOT packaged — test input, including the expected_output ` +
-                `answer key, never ships to consumers — so the link is removed from the packaged output.`,
+            message: `Link "${ref.linkHref ?? location}" points into declared test input (some skill's ` +
+                `test.evals — its own or another skill's). The target is NOT packaged — test input, ` +
+                `including the expected_output answer key, never ships to consumers — so the link is ` +
+                `removed from the packaged output.`,
         }));
     }
     return issues;

package/dist/test-input.js.map

@@ -1 +1 @@
-{"version":3,"file":"test-input.js","sourceRoot":"","sources":["../src/test-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAG5G,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAErE;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,qHAAqH;IACrH,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAA0C,EAC1C,QAAgB;IAEhB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAC;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,kFAAkF;IAClF,8EAA8E;IAC9E,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,4BAA4B,CACnC,aAAgC,EAChC,WAAmB;IAEnB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS;QAClD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAgC,EAChC,WAAmB;IAEnB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,4BAA4B,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3E,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,SAAiB,EAAE,GAAW;IAC9C,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B,CAC3C,WAAsC,EACtC,WAAmB,EACnB,aAAgC;IAEhC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC/E,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QACrF,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1E,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAC1E,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAoD,EACpD,QAAgB,EAChB,WAAmB;IAEnB,OAAO,6BAA6B,CAClC,MAAM,CAAC,KAAK,IAAI,EAAE,EAClB,WAAW,EACX,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACvC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,wBAAwB,CAAC,OAAkC;IACzE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3B,gBAAgB,CAAC,qBAAqB,EAAE;QACtC,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QACpC,OAAO,EACL,iBAAiB,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB;YAC9F,mFAAmF;YACnF,qEAAqE;KACxE,CAAC,CACH,CAAC;AACJ,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAoC,EACpC,aAAgC,EAChC,WAAmB,EACnB,eAAuB,WAAW;IAElC,MAAM,YAAY,GAAG,4BAA4B,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC9E,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,SAAS;QACnE,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnB,MAAM,CAAC,IAAI,CACT,gBAAgB,CAAC,qBAAqB,EAAE;YACtC,QAAQ;YACR,OAAO,EACL,SAAS,GAAG,CAAC,QAAQ,IAAI,QAAQ,iDAAiD;gBAClF,uFAAuF;gBACvF,yFAAyF;SAC5F,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC7D,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACrC,gBAAgB,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CACxE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"test-input.js","sourceRoot":"","sources":["../src/test-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAG5G,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAErE;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,qHAAqH;IACrH,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,SAAiB,EAAE,GAAW;IAC9C,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,qBAAqB,CAC5B,MAA0C,EAC1C,QAAgB;IAEhB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAC;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,kFAAkF;IAClF,8EAA8E;IAC9E,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAC9C,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAA0C,EAC1C,QAAgB,EAChB,aAA2C;IAE3C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtE,IAAI,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,4BAA4B,CACnC,aAAgC,EAChC,WAAmB;IAEnB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS;QAClD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAgC,EAChC,WAAmB;IAEnB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,4BAA4B,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3E,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B,CAC3C,WAAsC,EACtC,WAAmB,EACnB,aAAgC;IAEhC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC/E,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QACrF,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1E,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAC1E,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAoD,EACpD,QAAgB,EAChB,WAAmB,EACnB,aAA2C;IAE3C,OAAO,6BAA6B,CAClC,MAAM,CAAC,KAAK,IAAI,EAAE,EAClB,WAAW,EACX,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CACtD,CAAC,IAAI,CAAC;AACT,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,wBAAwB,CAAC,OAAkC;IACzE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3B,gBAAgB,CAAC,qBAAqB,EAAE;QACtC,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QACpC,OAAO,EACL,iBAAiB,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB;YAC9F,mFAAmF;YACnF,qEAAqE;KACxE,CAAC,CACH,CAAC;AACJ,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAoC,EACpC,aAAgC,EAChC,WAAmB,EACnB,eAAuB,WAAW;IAElC,MAAM,YAAY,GAAG,4BAA4B,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC9E,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,SAAS;QACnE,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnB,MAAM,CAAC,IAAI,CACT,gBAAgB,CAAC,qBAAqB,EAAE;YACtC,QAAQ;YACR,OAAO,EACL,SAAS,GAAG,CAAC,QAAQ,IAAI,QAAQ,kDAAkD;gBACnF,qFAAqF;gBACrF,sFAAsF;gBACtF,mCAAmC;SACtC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC7D,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACrC,gBAAgB,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CACxE,CAAC;AACJ,CAAC"}

package/dist/validators/agent-instruction-presence.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Presence-side detection for repo-internal agent-instruction files.
+ *
+ * `LINK_TO_AGENT_INSTRUCTION_FILE` catches the *reference* — a packaged doc
+ * linking a `CLAUDE.md` — and the walker then keeps that file out of the
+ * bundle. It cannot catch the other half: a file that arrives in the
+ * distributed artifact without any link at all. The plugin lane tree-copies its
+ * `source:` directory verbatim, so a `CLAUDE.md` sitting beside `plugin.json`
+ * ships to every consumer, and the orphan check does not object because plugin
+ * artifacts are exempt from skill reachability rules by design.
+ *
+ * This detector reads the built tree directly, so it is blind to how the file
+ * got there. That is the point: link-following, `files:` globs, and verbatim
+ * tree-copies are three routes into a bundle, and only the first is visible to
+ * the walker.
+ */
+import { type ValidationIssue } from '@vibe-agent-toolkit/agent-schema';
+/**
+ * Report every repo-internal agent-instruction file present in a distributed
+ * tree.
+ *
+ * @param rootDir Absolute path to the tree to scan (a packaged skill output
+ *   directory, or a plugin directory about to be published).
+ * @param locationRoot Anchor base for reported locations. Pass the run's stated
+ *   root, not `rootDir`, when the two differ — a location the reader cannot
+ *   open is worse than no location.
+ * @param declaredDests Skill-output-relative dests named by EXPLICIT (non-glob)
+ *   `files:` entries — {@link explicitFilesConfigDests}. Such a dest is NOT
+ *   reported: naming a file in config is an unambiguous instruction to ship it,
+ *   and this finding's remediation is "remove the file", i.e. undo what the
+ *   config sanctioned. Callers that cannot know the config (an installed
+ *   third-party bundle, a plugin tree with no `files:` block) pass `[]` — the
+ *   honest answer, since intent is genuinely unknowable there.
+ *
+ *   REQUIRED, not defaulted: every caller must state its answer, or a lane that
+ *   silently inherits `[]` re-opens the contradiction for the population it
+ *   governs. Matching is EXACT membership, never a prefix test — a directory-ish
+ *   dest must not launder its whole subtree (see {@link explicitFilesConfigDests}).
+ */
+export declare function detectPackagedAgentInstructionFiles(rootDir: string, locationRoot: string, declaredDests: readonly string[]): ValidationIssue[];
+//# sourceMappingURL=agent-instruction-presence.d.ts.map

package/dist/validators/agent-instruction-presence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-instruction-presence.d.ts","sourceRoot":"","sources":["../../src/validators/agent-instruction-presence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAcxE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,eAAe,EAAE,CA8BnB"}

package/dist/validators/agent-instruction-presence.js

@@ -0,0 +1,79 @@
+/**
+ * Presence-side detection for repo-internal agent-instruction files.
+ *
+ * `LINK_TO_AGENT_INSTRUCTION_FILE` catches the *reference* — a packaged doc
+ * linking a `CLAUDE.md` — and the walker then keeps that file out of the
+ * bundle. It cannot catch the other half: a file that arrives in the
+ * distributed artifact without any link at all. The plugin lane tree-copies its
+ * `source:` directory verbatim, so a `CLAUDE.md` sitting beside `plugin.json`
+ * ships to every consumer, and the orphan check does not object because plugin
+ * artifacts are exempt from skill reachability rules by design.
+ *
+ * This detector reads the built tree directly, so it is blind to how the file
+ * got there. That is the point: link-following, `files:` globs, and verbatim
+ * tree-copies are three routes into a bundle, and only the first is visible to
+ * the walker.
+ */
+import { existsSync } from 'node:fs';
+import { crawlDirectorySync, issueLocation, safePath } from '@vibe-agent-toolkit/utils';
+import { normalizeRelPath } from '../files-config.js';
+import { materializeIssue } from './rule-engine/index.js';
+import { AGENT_INSTRUCTION_FILE_PATTERNS, toAnyDepthGlobs } from './validation-rules.js';
+/**
+ * Match each basename at the tree root AND at any depth — the root is the case
+ * that matters most (a `CLAUDE.md` beside `plugin.json` is the observed defect).
+ */
+const INCLUDE_GLOBS = toAnyDepthGlobs(AGENT_INSTRUCTION_FILE_PATTERNS);
+/**
+ * Report every repo-internal agent-instruction file present in a distributed
+ * tree.
+ *
+ * @param rootDir Absolute path to the tree to scan (a packaged skill output
+ *   directory, or a plugin directory about to be published).
+ * @param locationRoot Anchor base for reported locations. Pass the run's stated
+ *   root, not `rootDir`, when the two differ — a location the reader cannot
+ *   open is worse than no location.
+ * @param declaredDests Skill-output-relative dests named by EXPLICIT (non-glob)
+ *   `files:` entries — {@link explicitFilesConfigDests}. Such a dest is NOT
+ *   reported: naming a file in config is an unambiguous instruction to ship it,
+ *   and this finding's remediation is "remove the file", i.e. undo what the
+ *   config sanctioned. Callers that cannot know the config (an installed
+ *   third-party bundle, a plugin tree with no `files:` block) pass `[]` — the
+ *   honest answer, since intent is genuinely unknowable there.
+ *
+ *   REQUIRED, not defaulted: every caller must state its answer, or a lane that
+ *   silently inherits `[]` re-opens the contradiction for the population it
+ *   governs. Matching is EXACT membership, never a prefix test — a directory-ish
+ *   dest must not launder its whole subtree (see {@link explicitFilesConfigDests}).
+ */
+export function detectPackagedAgentInstructionFiles(rootDir, locationRoot, declaredDests) {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- rootDir is a validated build-output path
+    if (!existsSync(rootDir))
+        return [];
+    const declared = new Set(declaredDests.map((d) => normalizeRelPath(d)));
+    // `respectGitignore: false` and an empty `exclude` are both load-bearing: the
+    // subject is BUILT output, which normally lives under a gitignored `dist/`
+    // that the crawler's defaults would skip entirely — the scan would pass by
+    // scanning nothing.
+    const files = crawlDirectorySync({
+        baseDir: rootDir,
+        include: INCLUDE_GLOBS,
+        exclude: [],
+        absolute: true,
+        filesOnly: true,
+        respectGitignore: false,
+    });
+    const issues = [];
+    for (const file of files) {
+        // The declaration is expressed relative to the SCANNED tree (a `files:` dest is
+        // skill-output-relative), while the reported location is relative to
+        // `locationRoot` — the two roots differ whenever a batching caller anchors
+        // elsewhere, so the exemption test must use rootDir and never the location.
+        if (declared.has(normalizeRelPath(safePath.relative(rootDir, file))))
+            continue;
+        const location = issueLocation(file, locationRoot);
+        issues.push(materializeIssue('PACKAGED_AGENT_INSTRUCTION_FILE', { location, detail: location }));
+    }
+    return issues;
+}
+//# sourceMappingURL=agent-instruction-presence.js.map

package/dist/validators/agent-instruction-presence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-instruction-presence.js","sourceRoot":"","sources":["../../src/validators/agent-instruction-presence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAGrC,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAExF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,+BAA+B,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEzF;;;GAGG;AACH,MAAM,aAAa,GAAG,eAAe,CAAC,+BAA+B,CAAC,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,mCAAmC,CACjD,OAAe,EACf,YAAoB,EACpB,aAAgC;IAEhC,+GAA+G;IAC/G,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAExE,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,oBAAoB;IACpB,MAAM,KAAK,GAAG,kBAAkB,CAAC;QAC/B,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,aAAa;QACtB,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;QACf,gBAAgB,EAAE,KAAK;KACxB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,gFAAgF;QAChF,qEAAqE;QACrE,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YAAE,SAAS;QAC/E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/validators/bundled-resource-link-detection.d.ts

@@ -2,13 +2,30 @@
  * Bundled-resource link detector.
  *
  * Emits SKILL_REFERENCES_BUT_NO_LINKS at info severity when a skill
- * directory contains scripts/, references/, or assets/ subdirectories
- * but neither SKILL.md's body nor any transitively linked file points
- * into them via a markdown link.
+ * directory contains a bundled subdirectory (the content-type routing
+ * categories plus the claude-web `references/` layout) holding files that
+ * neither SKILL.md's body nor any transitively linked file points at.
  *
  * Plugin-dev's "Mistake 4: Missing Resource References" — bundled assets
  * the body never links to are dead weight in the install. The author
  * intended progressive disclosure but forgot to wire up the references.
+ *
+ * Two properties are load-bearing:
+ *
+ * 1. **The vocabulary is derived, never re-listed.** A hardcoded list drifts
+ *    from `content-type-routing.ts` — which routes `.md` and every unknown
+ *    extension to `resources/` — and a subdirectory missing from the list
+ *    makes the detector structurally unable to fire on it.
+ *
+ * 2. **Coverage is per file, not per directory.** A single live mention must
+ *    not mask dead siblings: the real `command-development` skill ships 7
+ *    files under `references/` and mentions only 2 of them, and a
+ *    directory-granular check reported nothing at all.
+ *
+ * A file counts as referenced when its skill-relative path appears anywhere
+ * in the body — markdown link target, inline code span, or bare prose alike —
+ * or when link traversal reached it. Fenced code blocks are deliberately NOT
+ * parsed out: that approach was tried and rejected as too fragile.
  */
 import { type ValidationIssue } from '@vibe-agent-toolkit/agent-schema';
 /**

package/dist/validators/bundled-resource-link-detection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundled-resource-link-detection.d.ts","sourceRoot":"","sources":["../../src/validators/bundled-resource-link-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAsDvF;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,YAAY,EAAE,MAAM,GACnB,eAAe,EAAE,CAuBnB"}
+{"version":3,"file":"bundled-resource-link-detection.d.ts","sourceRoot":"","sources":["../../src/validators/bundled-resource-link-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAOH,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,kCAAkC,CAAC;AA4EvF;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,YAAY,EAAE,MAAM,GACnB,eAAe,EAAE,CAgCnB"}

package/dist/validators/bundled-resource-link-detection.js

@@ -2,20 +2,50 @@
  * Bundled-resource link detector.
  *
  * Emits SKILL_REFERENCES_BUT_NO_LINKS at info severity when a skill
- * directory contains scripts/, references/, or assets/ subdirectories
- * but neither SKILL.md's body nor any transitively linked file points
- * into them via a markdown link.
+ * directory contains a bundled subdirectory (the content-type routing
+ * categories plus the claude-web `references/` layout) holding files that
+ * neither SKILL.md's body nor any transitively linked file points at.
  *
  * Plugin-dev's "Mistake 4: Missing Resource References" — bundled assets
  * the body never links to are dead weight in the install. The author
  * intended progressive disclosure but forgot to wire up the references.
+ *
+ * Two properties are load-bearing:
+ *
+ * 1. **The vocabulary is derived, never re-listed.** A hardcoded list drifts
+ *    from `content-type-routing.ts` — which routes `.md` and every unknown
+ *    extension to `resources/` — and a subdirectory missing from the list
+ *    makes the detector structurally unable to fire on it.
+ *
+ * 2. **Coverage is per file, not per directory.** A single live mention must
+ *    not mask dead siblings: the real `command-development` skill ships 7
+ *    files under `references/` and mentions only 2 of them, and a
+ *    directory-granular check reported nothing at all.
+ *
+ * A file counts as referenced when its skill-relative path appears anywhere
+ * in the body — markdown link target, inline code span, or bare prose alike —
+ * or when link traversal reached it. Fenced code blocks are deliberately NOT
+ * parsed out: that approach was tried and rejected as too fragile.
  */
 /* eslint-disable security/detect-non-literal-fs-filename -- skill paths validated upstream */
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { CODE_REGISTRY } from '@vibe-agent-toolkit/agent-schema';
 import { issueLocation, safePath } from '@vibe-agent-toolkit/utils';
-const BUNDLED_SUBDIRS = ['scripts', 'references', 'assets'];
+import { CLAUDE_WEB_REFERENCES_SUBDIR, TARGET_SUBDIR_CATEGORIES } from '../content-type-routing.js';
+/**
+ * Subdirectories a packaged skill may bundle resources into.
+ *
+ * Derived from the content-type routing categories (the single source of
+ * truth for extension→subdirectory mapping) plus the claude-web-specific
+ * `references/` layout name. De-duplicated so promoting `references` to a
+ * routing category later cannot produce a doubled finding.
+ */
+const BUNDLED_SUBDIRS = [
+    ...new Set([...TARGET_SUBDIR_CATEGORIES, CLAUDE_WEB_REFERENCES_SUBDIR]),
+];
+/** How many dead file names the message spells out before summarising. */
+const MAX_LISTED_FILES = 5;
 /** Read SKILL.md content (best-effort) — empty string if unreadable. */
 function readSkillContent(skillPath) {
     try {
@@ -25,40 +55,51 @@ function readSkillContent(skillPath) {
         return '';
     }
 }
-/** Subdirectory exists AND contains at least one file (recursive). */
-function isNonEmptyDir(dir) {
+/**
+ * Every file under `dir`, recursively, as paths relative to `baseDir`
+ * (forward-slash normalised by safePath). Empty when `dir` is absent,
+ * unreadable, or contains no files.
+ */
+function listFilesRelative(dir, baseDir) {
     if (!existsSync(dir))
-        return false;
+        return [];
+    const found = [];
     try {
-        const entries = readdirSync(dir, { withFileTypes: true });
-        for (const entry of entries) {
-            if (entry.isFile())
-                return true;
-            if (entry.isDirectory() && isNonEmptyDir(safePath.join(dir, entry.name))) {
-                return true;
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            const child = safePath.join(dir, entry.name);
+            if (entry.isFile()) {
+                found.push(safePath.relative(baseDir, child));
+            }
+            else if (entry.isDirectory()) {
+                found.push(...listFilesRelative(child, baseDir));
             }
         }
     }
     catch {
-        return false;
+        return [];
     }
-    return false;
+    return found;
 }
-/** Body or linked file references the subdir via path containing `<sub>/`. */
-function bodyMentionsSubdir(body, sub) {
-    // Lightweight check: the sub-dir name occurs as part of a markdown
-    // path, e.g. `(scripts/cli.mjs)` or `[x](references/detail.md)`. We
-    // accept any occurrence of `<sub>/` since false negatives (a real
-    // link the heuristic misses) are worse than false positives at info.
-    return body.includes(`${sub}/`);
+/**
+ * Body points at this file.
+ *
+ * Substring match on the skill-relative path, so `[x](references/a.md)`,
+ * `(./references/a.md)`, `` `references/a.md` `` and a bare prose
+ * `references/a.md` all count. Deliberately liberal: at info severity a
+ * missed finding beats a wrong one.
+ */
+function bodyMentionsFile(body, relPath) {
+    return body.includes(relPath);
+}
+/** Link traversal reached this exact file. */
+function linkedFilesCoverFile(linkedFiles, absPath) {
+    return linkedFiles.has(safePath.resolve(absPath));
 }
-/** Linked file path is inside the subdir. */
-function linkedFilesCoverSubdir(linkedFiles, skillDir, sub) {
-    const subDir = safePath.join(skillDir, sub);
-    return linkedFiles.some((f) => {
-        const rel = safePath.relative(subDir, f);
-        return !rel.startsWith('..') && rel.length > 0;
-    });
+/** Human-readable file list, truncated so the message stays scannable. */
+function summariseFiles(relPaths) {
+    const shown = relPaths.slice(0, MAX_LISTED_FILES).join(', ');
+    const hidden = relPaths.length - MAX_LISTED_FILES;
+    return hidden > 0 ? `${shown} (and ${hidden} more)` : shown;
 }
 /**
  * @param skillPath Absolute path to SKILL.md
@@ -70,19 +111,22 @@ export function detectBundledResourceWithoutLinks(skillPath, skillDir, linkedFil
     const issues = [];
     const body = readSkillContent(skillPath);
     const baseDir = skillDir.length > 0 ? skillDir : dirname(skillPath);
+    const linked = new Set(linkedFiles.map((f) => safePath.resolve(f)));
     for (const sub of BUNDLED_SUBDIRS) {
         const subPath = safePath.join(baseDir, sub);
-        if (!isNonEmptyDir(subPath))
-            continue;
-        if (bodyMentionsSubdir(body, sub))
+        const bundled = listFilesRelative(subPath, baseDir);
+        if (bundled.length === 0)
             continue;
-        if (linkedFilesCoverSubdir(linkedFiles, baseDir, sub))
+        const unreferenced = bundled.filter((rel) => !bodyMentionsFile(body, rel) && !linkedFilesCoverFile(linked, safePath.join(baseDir, rel)));
+        if (unreferenced.length === 0)
             continue;
         const entry = CODE_REGISTRY.SKILL_REFERENCES_BUT_NO_LINKS;
         issues.push({
             severity: entry.defaultSeverity,
             code: 'SKILL_REFERENCES_BUT_NO_LINKS',
-            message: `Skill directory contains "${sub}/" but no markdown link from SKILL.md or linked files points into it.`,
+            message: `Skill directory contains "${sub}/" with ${unreferenced.length} of ${bundled.length} ` +
+                `file(s) that nothing in SKILL.md or its linked files points at: ` +
+                `${summariseFiles(unreferenced)}.`,
             location: issueLocation(subPath, locationRoot),
             fix: entry.fix,
             reference: entry.reference,

package/dist/validators/bundled-resource-link-detection.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundled-resource-link-detection.js","sourceRoot":"","sources":["../../src/validators/bundled-resource-link-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,8FAA8F;AAE9F,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,aAAa,EAAwB,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAGpE,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAU,CAAC;AAErE,wEAAwE;AACxE,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,OAAO,IAAI,CAAC;YAChC,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACzE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,SAAS,kBAAkB,CAAC,IAAY,EAAE,GAAW;IACnD,mEAAmE;IACnE,oEAAoE;IACpE,kEAAkE;IAClE,qEAAqE;IACrE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,6CAA6C;AAC7C,SAAS,sBAAsB,CAC7B,WAA8B,EAC9B,QAAgB,EAChB,GAAW;IAEX,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAC/C,SAAiB,EACjB,QAAgB,EAChB,WAA8B,EAC9B,YAAoB;IAEpB,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEpE,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,IAAI,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QAC5C,IAAI,sBAAsB,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC;YAAE,SAAS;QAEhE,MAAM,KAAK,GAAG,aAAa,CAAC,6BAA6B,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,KAAK,CAAC,eAAe;YAC/B,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,6BAA6B,GAAG,uEAAuE;YAChH,QAAQ,EAAE,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC;YAC9C,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"bundled-resource-link-detection.js","sourceRoot":"","sources":["../../src/validators/bundled-resource-link-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,8FAA8F;AAE9F,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,aAAa,EAAwB,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEpG;;;;;;;GAOG;AACH,MAAM,eAAe,GAAsB;IACzC,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,wBAAwB,EAAE,4BAA4B,CAAC,CAAC;CAChF,CAAC;AAEF,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,wEAAwE;AACxE,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAW,EAAE,OAAe;IACrD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe;IACrD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,8CAA8C;AAC9C,SAAS,oBAAoB,CAAC,WAAgC,EAAE,OAAe;IAC7E,OAAO,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,0EAA0E;AAC1E,SAAS,cAAc,CAAC,QAA2B;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,gBAAgB,CAAC;IAClD,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,MAAM,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAC/C,SAAiB,EACjB,QAAgB,EAChB,WAA8B,EAC9B,YAAoB;IAEpB,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpE,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEnC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CACjC,CAAC,GAAG,EAAE,EAAE,CACN,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAC7F,CAAC;QACF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAExC,MAAM,KAAK,GAAG,aAAa,CAAC,6BAA6B,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,KAAK,CAAC,eAAe;YAC/B,IAAI,EAAE,+BAA+B;YACrC,OAAO,EACL,6BAA6B,GAAG,WAAW,YAAY,CAAC,MAAM,OAAO,OAAO,CAAC,MAAM,GAAG;gBACtF,kEAAkE;gBAClE,GAAG,cAAc,CAAC,YAAY,CAAC,GAAG;YACpC,QAAQ,EAAE,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC;YAC9C,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/validators/compat-detectors.d.ts

@@ -15,14 +15,19 @@ export interface DetectorOutput {
     evidence: EvidenceRecord[];
     observations: Observation[];
 }
-export declare function collectLocalShellEvidence(content: string, filePath: string): EvidenceRecord[];
-export declare function collectExternalCLIEvidence(content: string, filePath: string): EvidenceRecord[];
-export declare function collectBrowserAuthEvidence(content: string, filePath: string): EvidenceRecord[];
+export declare function collectLocalShellEvidence(content: string, filePath: string, locationRoot: string): EvidenceRecord[];
+export declare function collectExternalCLIEvidence(content: string, filePath: string, locationRoot: string): EvidenceRecord[];
+export declare function collectBrowserAuthEvidence(content: string, filePath: string, locationRoot: string): EvidenceRecord[];
 export declare function deriveObservations(evidence: readonly EvidenceRecord[]): Observation[];
 /**
  * Convert a capability Observation into a ValidationIssue using the
  * default severity, fix, and reference from CODE_REGISTRY.
  */
 export declare function observationToIssue(obs: Observation, location: string): ValidationIssue;
-export declare function runCompatDetectors(content: string, filePath: string): DetectorOutput;
+/**
+ * @param locationRoot - The ONE base every emitted evidence `location.file` is
+ *   expressed relative to. Required, so a producer cannot emit an absolute
+ *   location by omission.
+ */
+export declare function runCompatDetectors(content: string, filePath: string, locationRoot: string): DetectorOutput;
 //# sourceMappingURL=compat-detectors.d.ts.map

package/dist/validators/compat-detectors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compat-detectors.d.ts","sourceRoot":"","sources":["../../src/validators/compat-detectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAiC,KAAK,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEvG,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AA8BxE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,YAAY,EAAE,WAAW,EAAE,CAAC;CAC7B;AAoED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CA+C7F;AASD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CA4B9F;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CAe9F;AAQD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,WAAW,EAAE,CAKrF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAWtF;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,CAQpF"}
+{"version":3,"file":"compat-detectors.d.ts","sourceRoot":"","sources":["../../src/validators/compat-detectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAiC,KAAK,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEvG,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AA2BxE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,YAAY,EAAE,WAAW,EAAE,CAAC;CAC7B;AA6CD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,cAAc,EAAE,CAkDlB;AASD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,cAAc,EAAE,CA6BlB;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,cAAc,EAAE,CAgBlB;AAQD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,WAAW,EAAE,CAKrF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAWtF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,cAAc,CAQhB"}