@vibe-agent-toolkit/agent-skills 0.2.0-rc.5 → 0.2.0-rc.7

package/dist/validators/compat-detectors.js

@@ -11,6 +11,8 @@
  */
 import { CODE_REGISTRY } from '@vibe-agent-toolkit/schema';
 import { buildEvidence, deriveObservationsFromEvidence, EXTERNAL_CLI_BINARIES, } from '../evidence/index.js';
+import { parseFrontmatter } from '../parsers/frontmatter-parser.js';
+import { allowedToolsOf } from '../schemas/allowed-tools.js';
 const SHELL_LANGUAGES = new Set(['bash', 'sh', 'shell', 'zsh']);
 const LOCAL_SHELL_TOOLS = ['Bash', 'Edit', 'Write', 'NotebookEdit'];
 const BROWSER_AUTH_PATTERNS = [
@@ -21,11 +23,13 @@ const BROWSER_AUTH_PATTERNS = [
     { patternId: 'BROWSER_AUTH_AWS_SSO_LOGIN', re: /(^|[\s;|&])aws\s+sso\s+login\b/m, description: "'aws sso login' in shell" },
     { patternId: 'BROWSER_AUTH_WEBBROWSER_OPEN', re: /\bwebbrowser\.open\s*\(/, description: 'webbrowser.open() call' },
 ];
-// Minimal frontmatter peek for the allowed-tools list. Skill-validator
-// does full YAML parsing elsewhere; here we only need the one field,
-// so a narrow regex is cheaper than re-parsing.
+// The frontmatter span, on `\n`-normalized content, used ONLY to locate the
+// line the `allowed-tools:` key sits on. The value is read through
+// `parseFrontmatter`, never from this regex. YAML lets the key be quoted and
+// pads before the colon (`"allowed-tools": …`, `allowed-tools : …`); those
+// parsed fine but the locator missed them, so the evidence went out with no line.
 const FRONTMATTER_RE = /^---\n([\s\S]*?)\n---/;
-const ALLOWED_TOOLS_RE = /^allowed-tools:\s*\[([^\]]*)\]/m;
+const ALLOWED_TOOLS_KEY_RE = /^(?:"allowed-tools"|'allowed-tools'|allowed-tools)\s*:/m;
 const PROSE_TOOL_RE = /\b(Bash|Edit|Write|NotebookEdit)\s+tool\b/;
 /**
  * Locate the line number (1-based) within `content` where `index` falls.
@@ -50,28 +54,51 @@ function* iterCodeBlocks(content) {
         yield { language, body, line, bodyIndex };
     }
 }
-function allowedToolsList(content) {
-    const fm = FRONTMATTER_RE.exec(content);
-    if (!fm)
+/**
+ * The `allowed-tools:` declarations a SKILL.md carries and the 1-based line of
+ * the key; `{ tools: [], line: 0 }` when the key is absent or the frontmatter
+ * does not parse (the skill validator names that file
+ * `SKILL_MISSING_FRONTMATTER` on the same run — nothing is read out of it here).
+ *
+ * 🚩 This used to be a hand parser that saw ONLY the `[…]` flow form and split
+ * it on commas. Claude Code's documented spelling is space-separated, and a
+ * block sequence is valid YAML, so `allowed-tools: Read Bash` and a `- Bash`
+ * list both read as NO declaration and the local-shell capability reported
+ * clean over them. The value now goes through the same `parseFrontmatter` the
+ * validator uses and the same `allowedToolsOf` the settings-compat checker uses.
+ */
+export function allowedToolsDeclarations(content) {
+    // A block that is not a mapping (empty, `~`, a scalar, a sequence) is a parse
+    // FAILURE at the seam — `parseFrontmatter` refuses it — so there is no shape
+    // left for this reader to guard against on its own.
+    const parsed = parseFrontmatter(content);
+    if (!parsed.success)
         return { tools: [], line: 0 };
-    const fmBody = fm[1] ?? '';
-    const at = ALLOWED_TOOLS_RE.exec(fmBody);
-    if (!at)
+    const tools = allowedToolsOf(parsed.frontmatter['allowed-tools']) ?? [];
+    if (tools.length === 0)
         return { tools: [], line: 0 };
-    const raw = at[1] ?? '';
-    // Locate the line of the allowed-tools entry within the original content.
-    const fmStart = fm.index;
-    const atLineInFm = fmBody.slice(0, at.index).split('\n').length - 1;
-    // +2 to account for the leading '---\n' line of the frontmatter.
-    const line = lineForIndex(content, fmStart) + atLineInFm + 1;
-    const tools = raw.split(',').map(s => s.trim()).filter(s => s.length > 0);
+    // Locate the line of the key. parseFrontmatter normalized CRLF; do the same.
+    const normalized = content.replaceAll('\r\n', '\n');
+    const fmBody = FRONTMATTER_RE.exec(normalized)?.[1] ?? '';
+    const at = ALLOWED_TOOLS_KEY_RE.exec(fmBody);
+    // The opening `---` is line 1, so the key's line is 1 + its line within the body.
+    const line = at ? 1 + lineForIndex(fmBody, at.index) : 0;
     return { tools, line };
 }
+/**
+ * The tool a declaration names: `Bash(git:*)` and `Bash` both declare Bash.
+ * The parenthesised part scopes the grant; it does not change which tool the
+ * skill needs.
+ */
+function toolNameOf(declaration) {
+    const paren = declaration.indexOf('(');
+    return paren === -1 ? declaration : declaration.slice(0, paren);
+}
 export function collectLocalShellEvidence(content, filePath, locationRoot) {
     const out = [];
     // Frontmatter allowed-tools
-    const { tools, line: atLine } = allowedToolsList(content);
-    const matchedTool = tools.find(t => LOCAL_SHELL_TOOLS.includes(t));
+    const { tools, line: atLine } = allowedToolsDeclarations(content);
+    const matchedTool = tools.find(t => LOCAL_SHELL_TOOLS.includes(toolNameOf(t)));
     if (matchedTool !== undefined) {
         out.push(buildEvidence('ALLOWED_TOOLS_LOCAL_SHELL', filePath, locationRoot, `allowed-tools includes ${matchedTool}`, atLine || undefined));
     }

package/dist/validators/compat-detectors.js.map

@@ -1 +1 @@
-{"version":3,"file":"compat-detectors.js","sourceRoot":"","sources":["../../src/validators/compat-detectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAwC,MAAM,4BAA4B,CAAC;AAGjG,OAAO,EACL,aAAa,EACb,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAG9B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAChE,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,CAAU,CAAC;AAE7E,MAAM,qBAAqB,GAA0E;IACnG,EAAE,SAAS,EAAE,iCAAiC,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,EAAE,kBAAkB,EAAE;IACxG,EAAE,SAAS,EAAE,6BAA6B,EAAE,EAAE,EAAE,oCAAoC,EAAE,WAAW,EAAE,sBAAsB,EAAE;IAC3H,EAAE,SAAS,EAAE,uBAAuB,EAAE,EAAE,EAAE,0BAA0B,EAAE,WAAW,EAAE,qBAAqB,EAAE;IAC1G,EAAE,SAAS,EAAE,2BAA2B,EAAE,EAAE,EAAE,qCAAqC,EAAE,WAAW,EAAE,8BAA8B,EAAE;IAClI,EAAE,SAAS,EAAE,4BAA4B,EAAE,EAAE,EAAE,iCAAiC,EAAE,WAAW,EAAE,0BAA0B,EAAE;IAC3H,EAAE,SAAS,EAAE,8BAA8B,EAAE,EAAE,EAAE,yBAAyB,EAAE,WAAW,EAAE,wBAAwB,EAAE;CACpH,CAAC;AAEF,uEAAuE;AACvE,qEAAqE;AACrE,gDAAgD;AAChD,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,gBAAgB,GAAG,iCAAiC,CAAC;AAC3D,MAAM,aAAa,GAAG,2CAA2C,CAAC;AAOlE;;GAEG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,KAAa;IAClD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,QAAQ,CAAC,CAAC,cAAc,CACtB,OAAe;IAEf,MAAM,aAAa,GAAG,6BAA6B,CAAC;IACpD,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAChD,wDAAwD;QACxD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxB,0EAA0E;IAC1E,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC;IACzB,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACpE,iEAAiE;IACjE,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,QAAgB,EAChB,YAAoB;IAEpB,MAAM,GAAG,GAAqB,EAAE,CAAC;IAEjC,4BAA4B;IAC5B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAE,iBAAuC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CACN,aAAa,CACX,2BAA2B,EAC3B,QAAQ,EACR,YAAY,EACZ,0BAA0B,WAAW,EAAE,EACvC,MAAM,IAAI,SAAS,CACpB,CACF,CAAC;IACJ,CAAC;IAED,gDAAgD;IAChD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,UAAU,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CACN,aAAa,CACX,kCAAkC,EAClC,QAAQ,EACR,YAAY,EACZ,UAAU,CAAC,CAAC,CAAC,EACb,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CACxC,CACF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CACN,aAAa,CACX,oBAAoB,EACpB,QAAQ,EACR,YAAY,EACZ,SAAS,KAAK,CAAC,QAAQ,QAAQ,EAC/B,KAAK,CAAC,IAAI,CACX,CACF,CAAC;YACF,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,wFAAwF;IACxF,+CAA+C;IAC/C,uFAAuF;IACvF,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,cAAc,MAAM,QAAQ,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,QAAgB,EAChB,YAAoB;IAEpB,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QACxD,KAAK,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,qBAAqB,EAAE,CAAC;YAC1D,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,wEAAwE;YACxE,qEAAqE;YACrE,0CAA0C;YAC1C,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,gBAAgB,CAAC;YACtD,GAAG,CAAC,IAAI,CACN,aAAa,CACX,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,GAAG,MAAM,4BAA4B,EACrC,WAAW,CACZ,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,QAAgB,EAChB,YAAoB;IAEpB,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,qBAAqB,EAAE,CAAC;QACnE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,GAAG,CAAC,IAAI,CACN,aAAa,CACX,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAC/B,CACF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAAC;IACjE,2BAA2B;IAC3B,kCAAkC;IAClC,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,UAAU,kBAAkB,CAAC,QAAmC;IACpE,OAAO,8BAA8B,CAAC,QAAQ,EAAE;QAC9C,oBAAoB,EAAE,6BAA6B;QACnD,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAgB,EAAE,QAAgB;IACnE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAiB,CAAC;IACnC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,eAAe;QAC/B,IAAI;QACJ,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ;QACR,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,QAAgB,EAChB,YAAoB;IAEpB,MAAM,QAAQ,GAAqB;QACjC,GAAG,yBAAyB,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC;QAC7D,GAAG,0BAA0B,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC;QAC9D,GAAG,0BAA0B,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC;KAC/D,CAAC;IACF,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAClD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"compat-detectors.js","sourceRoot":"","sources":["../../src/validators/compat-detectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAwC,MAAM,4BAA4B,CAAC;AAGjG,OAAO,EACL,aAAa,EACb,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAChE,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,CAAU,CAAC;AAE7E,MAAM,qBAAqB,GAA0E;IACnG,EAAE,SAAS,EAAE,iCAAiC,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,EAAE,kBAAkB,EAAE;IACxG,EAAE,SAAS,EAAE,6BAA6B,EAAE,EAAE,EAAE,oCAAoC,EAAE,WAAW,EAAE,sBAAsB,EAAE;IAC3H,EAAE,SAAS,EAAE,uBAAuB,EAAE,EAAE,EAAE,0BAA0B,EAAE,WAAW,EAAE,qBAAqB,EAAE;IAC1G,EAAE,SAAS,EAAE,2BAA2B,EAAE,EAAE,EAAE,qCAAqC,EAAE,WAAW,EAAE,8BAA8B,EAAE;IAClI,EAAE,SAAS,EAAE,4BAA4B,EAAE,EAAE,EAAE,iCAAiC,EAAE,WAAW,EAAE,0BAA0B,EAAE;IAC3H,EAAE,SAAS,EAAE,8BAA8B,EAAE,EAAE,EAAE,yBAAyB,EAAE,WAAW,EAAE,wBAAwB,EAAE;CACpH,CAAC;AAEF,4EAA4E;AAC5E,mEAAmE;AACnE,6EAA6E;AAC7E,2EAA2E;AAC3E,kFAAkF;AAClF,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,oBAAoB,GAAG,yDAAyD,CAAC;AACvF,MAAM,aAAa,GAAG,2CAA2C,CAAC;AAOlE;;GAEG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,KAAa;IAClD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,QAAQ,CAAC,CAAC,cAAc,CACtB,OAAe;IAEf,MAAM,aAAa,GAAG,6BAA6B,CAAC;IACpD,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAChD,wDAAwD;QACxD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,8EAA8E;IAC9E,6EAA6E;IAC7E,oDAAoD;IACpD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAEtD,6EAA6E;IAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,EAAE,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7C,kFAAkF;IAClF,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,WAAmB;IACrC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,QAAgB,EAChB,YAAoB;IAEpB,MAAM,GAAG,GAAqB,EAAE,CAAC;IAEjC,4BAA4B;IAC5B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAE,iBAAuC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CACN,aAAa,CACX,2BAA2B,EAC3B,QAAQ,EACR,YAAY,EACZ,0BAA0B,WAAW,EAAE,EACvC,MAAM,IAAI,SAAS,CACpB,CACF,CAAC;IACJ,CAAC;IAED,gDAAgD;IAChD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,UAAU,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CACN,aAAa,CACX,kCAAkC,EAClC,QAAQ,EACR,YAAY,EACZ,UAAU,CAAC,CAAC,CAAC,EACb,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CACxC,CACF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CACN,aAAa,CACX,oBAAoB,EACpB,QAAQ,EACR,YAAY,EACZ,SAAS,KAAK,CAAC,QAAQ,QAAQ,EAC/B,KAAK,CAAC,IAAI,CACX,CACF,CAAC;YACF,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,wFAAwF;IACxF,+CAA+C;IAC/C,uFAAuF;IACvF,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,cAAc,MAAM,QAAQ,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,QAAgB,EAChB,YAAoB;IAEpB,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QACxD,KAAK,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,qBAAqB,EAAE,CAAC;YAC1D,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,wEAAwE;YACxE,qEAAqE;YACrE,0CAA0C;YAC1C,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,gBAAgB,CAAC;YACtD,GAAG,CAAC,IAAI,CACN,aAAa,CACX,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,GAAG,MAAM,4BAA4B,EACrC,WAAW,CACZ,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,QAAgB,EAChB,YAAoB;IAEpB,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,qBAAqB,EAAE,CAAC;QACnE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,GAAG,CAAC,IAAI,CACN,aAAa,CACX,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAC/B,CACF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAAC;IACjE,2BAA2B;IAC3B,kCAAkC;IAClC,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,UAAU,kBAAkB,CAAC,QAAmC;IACpE,OAAO,8BAA8B,CAAC,QAAQ,EAAE;QAC9C,oBAAoB,EAAE,6BAA6B;QACnD,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAgB,EAAE,QAAgB;IACnE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAiB,CAAC;IACnC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,eAAe;QAC/B,IAAI;QACJ,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ;QACR,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,QAAgB,EAChB,YAAoB;IAEpB,MAAM,QAAQ,GAAqB;QACjC,GAAG,yBAAyB,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC;QAC7D,GAAG,0BAA0B,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC;QAC9D,GAAG,0BAA0B,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC;KAC/D,CAAC;IACF,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAClD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC"}

package/dist/validators/marketplace-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"marketplace-validator.d.ts","sourceRoot":"","sources":["../../src/validators/marketplace-validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,iBAAiB,EAAqB,MAAM,kBAAkB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAKnD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACxC,eAAe,EAAE,MAAM,EACvB,OAAO,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,gBAAgB,CAAC,CAsF3B"}
+{"version":3,"file":"marketplace-validator.d.ts","sourceRoot":"","sources":["../../src/validators/marketplace-validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,iBAAiB,EAAqB,MAAM,kBAAkB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAKnD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACxC,eAAe,EAAE,MAAM,EACvB,OAAO,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,gBAAgB,CAAC,CA8F3B"}

package/dist/validators/marketplace-validator.js

@@ -88,6 +88,12 @@ export async function validateMarketplace(marketplacePath, options) {
             name: result.data.name,
             ...(result.data.description !== undefined && { description: result.data.description }),
             ...(result.data.version !== undefined && { version: result.data.version }),
+            // The denominator a consumer needs to judge a plugin walk: a string
+            // `source` is a relative path into this marketplace's own tree, and the
+            // consumer resolves it against the root it chose. Sources, not a count —
+            // a count is satisfied by walking the WRONG directories.
+            pluginEntries: result.data.plugins.length,
+            localPluginSources: result.data.plugins.flatMap((entry) => typeof entry.source === 'string' ? [{ name: entry.name, source: entry.source }] : []),
         };
     }
     return validationResult;

package/dist/validators/marketplace-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"marketplace-validator.js","sourceRoot":"","sources":["../../src/validators/marketplace-validator.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,yBAAyB,EAAE,eAAe,EAAwB,MAAM,4BAA4B,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,EAA0B,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,MAAM,gBAAgB,GAAG,aAAsB,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,eAAuB,EACvB,OAA2B;IAE3B,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IACjG,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC;IAE/G,gCAAgC;IAChC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,gCAAgC;YACzC,QAAQ;YACR,GAAG,EAAE,oFAAoF;SACzF,CAAC,CAAC;QAEH,OAAO;YACN,IAAI,EAAE,eAAe;YACrB,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,8BAA8B;YACvC,MAAM;YACN,WAAW,EAAE,eAAe,CAAC,MAAM,CAAC;SACpC,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,IAAI,eAAwB,CAAC;IAC7B,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,YAAY,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAC3D,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;YACxG,QAAQ;YACR,GAAG,EAAE,4CAA4C;SACjD,CAAC,CAAC;QAEH,OAAO;YACN,IAAI,EAAE,eAAe;YACrB,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,sCAAsC;YAC/C,MAAM;YACN,WAAW,EAAE,eAAe,CAAC,MAAM,CAAC;SACpC,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,QAAQ;gBACR,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC9B,GAAG,EAAE,qBAAqB,CAAC,QAAQ,CAAC;aACpC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAEjD,MAAM,gBAAgB,GAAqB;QAC1C,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,gBAAgB;QACtB,MAAM;QACN,OAAO,EACN,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,WAAW;QAC/E,MAAM;QACN,WAAW,EAAE,eAAe,CAAC,MAAM,CAAC;KACpC,CAAC;IAEF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,gBAAgB,CAAC,QAAQ,GAAG;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;SAC1E,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC;AACzB,CAAC"}
+{"version":3,"file":"marketplace-validator.js","sourceRoot":"","sources":["../../src/validators/marketplace-validator.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,yBAAyB,EAAE,eAAe,EAAwB,MAAM,4BAA4B,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,EAA0B,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,MAAM,gBAAgB,GAAG,aAAsB,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,eAAuB,EACvB,OAA2B;IAE3B,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IACjG,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC;IAE/G,gCAAgC;IAChC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,gCAAgC;YACzC,QAAQ;YACR,GAAG,EAAE,oFAAoF;SACzF,CAAC,CAAC;QAEH,OAAO;YACN,IAAI,EAAE,eAAe;YACrB,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,8BAA8B;YACvC,MAAM;YACN,WAAW,EAAE,eAAe,CAAC,MAAM,CAAC;SACpC,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,IAAI,eAAwB,CAAC;IAC7B,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,YAAY,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAC3D,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;YACxG,QAAQ;YACR,GAAG,EAAE,4CAA4C;SACjD,CAAC,CAAC;QAEH,OAAO;YACN,IAAI,EAAE,eAAe;YACrB,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,sCAAsC;YAC/C,MAAM;YACN,WAAW,EAAE,eAAe,CAAC,MAAM,CAAC;SACpC,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,QAAQ;gBACR,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC9B,GAAG,EAAE,qBAAqB,CAAC,QAAQ,CAAC;aACpC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAEjD,MAAM,gBAAgB,GAAqB;QAC1C,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,gBAAgB;QACtB,MAAM;QACN,OAAO,EACN,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,WAAW;QAC/E,MAAM;QACN,WAAW,EAAE,eAAe,CAAC,MAAM,CAAC;KACpC,CAAC;IAEF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,gBAAgB,CAAC,QAAQ,GAAG;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1E,oEAAoE;YACpE,wEAAwE;YACxE,yEAAyE;YACzE,yDAAyD;YACzD,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;YACzC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACzD,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CACpF;SACD,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC;AACzB,CAAC"}

package/dist/validators/mcp-tool-qualification.d.ts

@@ -0,0 +1,158 @@
+/**
+ * MCP_TOOL_NAME_UNQUALIFIED — a skill document tells an agent to call an MCP
+ * tool by its bare name, in a document that elsewhere spells that same tool
+ * fully-qualified.
+ *
+ * Anthropic's skill-authoring guidance: "Without the server prefix, Claude may
+ * fail to locate the tool, especially when multiple MCP servers are available."
+ * VAT's own `vat skill review` checklist has carried this as a `[A]` manual item
+ * marked "Not enforced by any validation code; a shift-left candidate awaiting
+ * corpus evidence per docs/validation-rule-design.md, since a bare identifier in
+ * prose is only a defect when the skill actually drives MCP." The reservation is
+ * exactly right, and it is what shapes the detector below.
+ *
+ * ## The document supplies its own vocabulary
+ *
+ * A bare snake_case identifier is not evidence of anything — `page_size`,
+ * `next_page_token` and `whiteboard_id` are all over these documents. What makes
+ * an identifier an MCP *tool name* is that the SAME document also writes it
+ * fully-qualified, in one of the two spellings a reader will meet:
+ *
+ * - `mcp__<server>__<tool>` — the Claude Code form, also how `allowed-tools`
+ *   frontmatter names them.
+ * - `ServerName:tool_name` — the API form Anthropic's guidance prescribes.
+ *
+ * So the detector never guesses. It reads the qualified names the document
+ * already contains, and then reports the places that document names one of those
+ * same tools bare. A document that does not drive MCP has an empty vocabulary and
+ * cannot produce a finding — which dissolves the checklist's reservation rather
+ * than arguing with it.
+ *
+ * ## Prose supplies the vocabulary; frontmatter does not
+ *
+ * Leading YAML frontmatter is stripped here, in the detector, before anything is
+ * read from it. An `allowed-tools:` list of `mcp__…` names is a manifest, not the
+ * document contradicting itself, so it must not seed the vocabulary — and a bare
+ * name in the body below it is then simply a document that never qualified the
+ * tool at all.
+ *
+ * Enforcing that HERE rather than at each call site is deliberate, and it is the
+ * only place it has ever held. ⛔ An earlier version of this paragraph said the
+ * SKILL.md lane in `packaging-validator.ts` "happened to pass a
+ * frontmatter-stripped slice" while the bundled-`.md` lane passed whole files.
+ * It does not and never did: `parseFileCached(...).content` is the raw source
+ * verbatim — that file says so itself, 190 lines above the call — so BOTH lanes
+ * fed frontmatter to the detector until this stripping landed.
+ *
+ * ## The uppercase rule in the API form, and why it is load-bearing
+ *
+ * The server half must be spelled the way Anthropic's own examples spell one —
+ * uppercase FIRST, no underscore (`GitHub:create_issue`,
+ * `BigQuery:bigquery_schema`). Without that rule the
+ * pattern also matches two things that are emphatically not MCP tools:
+ *
+ * - **Node builtin specifiers** — `node:child_process` yields a "tool" named
+ *   `child_process`, and VAT's own `packages/utils/README.md` then reports a
+ *   finding on a table of exported function names.
+ * - **OAuth scope strings** — `whiteboard:read:list_whiteboards` and
+ *   `cloud_recording:read:list_user_recordings`, both live in a partner-built
+ *   plugin in the install corpus.
+ *
+ * Neither was visible on the two adopter corpora; both were visible on the
+ * authoring project, which is precisely the population check
+ * `docs/validation-rule-design.md` requires and the reason it requires it.
+ *
+ * ## Measured fire rate, re-measured 2026-09-07
+ *
+ * Population = documents that spell at least one MCP tool fully-qualified.
+ *
+ * | Corpus | docs | population | firing | occurrences |
+ * |---|---|---|---|---|
+ * | VAT itself (`packages/**\/*.md`, dist + node_modules excluded) | 206 | 3 | **0** | 0 |
+ * | installed skills (`SKILL.md` under `~/.claude/plugins`, `~/.claude/skills`) | 678 | 28 | 7 | 11 |
+ *
+ * ⛔ **Every number this table used to carry was taken by the camelCase-blind
+ * matcher, so re-taking them was not optional.** A corpus measured by a matcher
+ * that cannot see a whole family of names has already excluded that family from
+ * its own population count, and "zero false positives" over such a corpus is a
+ * statement about the blindness as much as about the rule. Both rows above were
+ * re-run with the fixed detector, driving the exported functions directly, over
+ * a corpus re-enumerated on the day.
+ *
+ * What moved, A/B on the same files with HEAD's module and this one:
+ *
+ * - **Authoring project: population 2 → 3.** One document newly enters the
+ *   population, because it spells two camelCase tools (`generateHaiku`,
+ *   `generateName`) that the old matcher could not see at all. Firing stays 0.
+ * - **Installed skills: nothing moved** — 28 / 7 / 11 before and after,
+ *   character for character, with no vocabulary entry gained or lost. The
+ *   installed corpus is snake_case throughout, which is Anthropic's own
+ *   convention and therefore exactly the population least able to expose this
+ *   defect. Its silence is not evidence the defect was small.
+ * - The corpus itself grew 677 → 678 `SKILL.md` between the two measurement
+ *   dates; the delta above is A/B on the SAME 678 files, so it is a property of
+ *   the detector rather than of the corpus.
+ *
+ * All 11 occurrences were read: every one names a tool bare that the same
+ * document qualifies in its own prose. Zero false positives.
+ *
+ * The SHIPPED command was re-run on the same corpus rather than trusted to
+ * agree with the probe — `vat audit --user`, 852 skills scanned, reproducing
+ * the installed-skills row occurrence for occurrence and line for line (plus
+ * the 4 linked-file occurrences `docs/validation-codes.md` records, which the
+ * probe above does not traverse).
+ *
+ * The frontmatter-including detector, run over the same 678 documents, reports
+ * 19 occurrences from the same 7 documents. The extra 8 are four copies of one
+ * skill naming `create_repository` and `create_branch` bare, whose only
+ * qualified spelling is its `allowed-tools:` frontmatter.
+ *
+ * ⛔ Those 8 WERE shipped. This paragraph used to claim the SKILL.md lane had
+ * "always passed a frontmatter-stripped slice" and that the 19 therefore
+ * described the probe rather than the product. `parseFileCached(...).content` is
+ * the raw file, frontmatter and all, so the shipped lane emitted every one of
+ * them. The 19 → 11 delta is a real behaviour change this detector made, not a
+ * correction to a probe.
+ *
+ * `warning`, not `error`: with a single MCP server mounted the bare name
+ * usually resolves, so the skill is degraded rather than broken.
+ */
+import { type ValidationIssue } from '@vibe-agent-toolkit/schema';
+/**
+ * Every MCP tool name `content` spells fully-qualified in its body, in either
+ * spelling. Frontmatter supplies nothing; see the module docstring.
+ *
+ * Exported for tests: this set IS the detector's premise, and pinning it directly
+ * is cheaper and clearer than inferring it from emitted issues.
+ */
+export declare function qualifiedMcpToolNames(content: string): Set<string>;
+/**
+ * Emit one `MCP_TOOL_NAME_UNQUALIFIED` per (line, bare tool name).
+ *
+ * Per instance rather than per document, each carrying the bare tool name as
+ * `link`, because `applyAllowFilter` matches an allow glob against `location` OR
+ * `link`. That is what lets an adopter waive one identifier:
+ *
+ * ```yaml
+ * validation:
+ *   allow:
+ *     MCP_TOOL_NAME_UNQUALIFIED:
+ *       - paths: ["get_me"]
+ *         reason: "Named bare in the availability-probe step on purpose; the
+ *                  qualified form is three lines above."
+ * ```
+ *
+ * …while a different bare tool name in the same document still fires. Waiver
+ * granularity is the emitter's decision, not the allow machinery's.
+ *
+ * Only inline code spans count. An agent copies what is in a code span; the same
+ * word in running prose is discussion of the tool rather than an instruction to
+ * call it. This is a design choice, not a measured one — the corpus numbers in
+ * the module docstring were all taken with the code-span rule already applied, so
+ * nothing here says what admitting prose would have cost.
+ *
+ * @param content Raw markdown of one skill document, frontmatter and all.
+ * @param docLocation Project-relative path of that document, for the anchor.
+ */
+export declare function collectUnqualifiedMcpToolIssues(content: string, docLocation: string, issues: ValidationIssue[]): void;
+//# sourceMappingURL=mcp-tool-qualification.d.ts.map

package/dist/validators/mcp-tool-qualification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-tool-qualification.d.ts","sourceRoot":"","sources":["../../src/validators/mcp-tool-qualification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsHG;AAEH,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAgRjF;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAElE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,eAAe,EAAE,GACxB,IAAI,CA6CN"}