@vibe-agent-toolkit/cli 0.1.41-rc.6 → 0.1.41-rc.8

package/dist/utils/relativize-paths.js

@@ -0,0 +1,67 @@
+/**
+ * Re-basing report `path` values onto the run's single stated root.
+ *
+ * A report states its coordinate system ONCE — `root:` — and every `path`
+ * beneath it is relative to that. Producers keep absolute paths internally on
+ * purpose: an absolute path is the identity every internal map keys on (compat
+ * results, visited-path de-duplication, registry caches), and unlike a
+ * `location` it is trivially recoverable, since an absolute path plus a known
+ * root yields the relative form. Re-basing therefore happens once, at the
+ * document boundary, and this module is that one place.
+ *
+ * Deliberately NOT a deep walk over every `path`-named property: re-basing is
+ * not idempotent (`relative(root, someRelativeValue)` resolves the value
+ * against the process cwd and produces nonsense), so a helper that guesses
+ * which values are absolute would silently corrupt an already-relative one.
+ * The caller names the nested carriers it owns instead.
+ */
+import { issueLocation } from '@vibe-agent-toolkit/utils';
+/**
+ * Re-base one absolute path onto `root`, as a forward-slashed relative path.
+ *
+ * Pointing a report AT a single resource makes that resource the root, which
+ * relativizes to the empty string. That is spelled `.` — the POSIX name for
+ * "the root itself" — so no consumer has to special-case a blank value, and
+ * `join(root, path)` still resolves.
+ */
+export function relativizePath(absolutePath, root) {
+    const relative = issueLocation(absolutePath, root);
+    return relative === '' ? '.' : relative;
+}
+/** Whether an unknown value is shaped like something this module can re-base. */
+function isPathEntry(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof value.path === 'string');
+}
+function relativizeEntry(entry, root, nestedKeys) {
+    const out = { ...entry, path: relativizePath(entry.path, root) };
+    // The nested carriers are named by the caller, so they are not on T's known
+    // keys; the bag view is the only way to reach them without demanding every
+    // caller widen its own result type.
+    const bag = out;
+    for (const key of nestedKeys) {
+        const nested = bag[key];
+        if (!Array.isArray(nested))
+            continue;
+        bag[key] = nested.map((item) => isPathEntry(item) ? relativizeEntry(item, root, nestedKeys) : item);
+    }
+    return out;
+}
+/**
+ * Re-base the `path` of every entry — and of every entry inside the nested
+ * carriers named by `nestedKeys`, at any depth — onto `root`.
+ *
+ * Returns new objects; the input is never mutated.
+ *
+ * @param entries - Report entries carrying absolute `path` values.
+ * @param root - The single root the document states.
+ * @param nestedKeys - Names of array-valued properties whose elements also
+ *   carry an absolute `path` (audit passes `['linkedFiles']`). Omitting a
+ *   carrier leaves its paths absolute, which is how a document ends up in two
+ *   coordinate systems — so a producer that adds a carrier must name it here.
+ */
+export function relativizePathEntries(entries, root, nestedKeys = []) {
+    return entries.map((entry) => relativizeEntry(entry, root, nestedKeys));
+}
+//# sourceMappingURL=relativize-paths.js.map

package/dist/utils/relativize-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relativize-paths.js","sourceRoot":"","sources":["../../src/utils/relativize-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,YAAoB,EAAE,IAAY;IAC/D,MAAM,QAAQ,GAAG,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACnD,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,iFAAiF;AACjF,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CACvD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,KAAQ,EACR,IAAY,EACZ,UAA6B;IAE7B,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;IACjE,4EAA4E;IAC5E,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,GAAG,GAAG,GAAyC,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QACrC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,EAAE,CACtC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAqB,EACrB,IAAY,EACZ,aAAgC,EAAE;IAElC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;AAC1E,CAAC"}

package/dist/utils/resource-loader.d.ts

@@ -11,6 +11,18 @@ export interface ResourceLoadResult {
     registry: ResourceRegistry;
     gitTracker: GitTracker | undefined;
 }
+/**
+ * Scope resource include patterns to a subdirectory of the crawl base.
+ *
+ * Pure, and exported so the scoping rule is testable without a filesystem.
+ * `relDir` is base-relative with forward slashes; `''` means "the base itself",
+ * for which the patterns are already correctly scoped.
+ *
+ * The patterns in {@link DEFAULT_RESOURCE_INCLUDE} are all `**`-rooted, so
+ * prefixing is enough: picomatch's `**` matches zero segments, meaning
+ * `docs/**\/*.md` still matches `docs/a.md`.
+ */
+export declare function scopeIncludeToSubtree(include: readonly string[], relDir: string): string[];
 /**
  * Load resources from a path with config support
  *
@@ -20,8 +32,15 @@ export interface ResourceLoadResult {
  * 3. Create registry and crawl
  *
  * Behavior:
- * - When path argument provided: use as baseDir, ignore config patterns (use defaults)
- * - When no path argument: use project root as baseDir, apply config patterns
+ * - When no path argument: crawl the project root, applying the config's
+ *   `resources.include` and `resources.exclude` patterns.
+ * - When a path argument is provided: still crawl on the project-root basis (so
+ *   the config's root-relative globs remain meaningful), with `include` replaced
+ *   by the default resource patterns scoped to that subtree and the config's
+ *   `exclude` still applied. A path argument says WHICH tree to scan; it does
+ *   not license scanning files the project excluded.
+ * - When the path argument lies outside the project root, the config's patterns
+ *   describe a different tree: they are dropped, with a warning.
  *
  * Per CLI-boundary rule (spec §5): `projectRoot` MUST be resolved by the
  * caller using one of the policy helpers in `project-root-policy.ts`. This

package/dist/utils/resource-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-loader.d.ts","sourceRoot":"","sources":["../../src/utils/resource-loader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,KAAK,aAAa,EAEnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,aAAa,GAAG,SAAS,CAAC;IAClC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC,CA2D7B"}
+{"version":3,"file":"resource-loader.d.ts","sourceRoot":"","sources":["../../src/utils/resource-loader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAEL,gBAAgB,EAEhB,KAAK,aAAa,EAEnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,UAAU,EAA4B,MAAM,2BAA2B,CAAC;AAGjF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,aAAa,GAAG,SAAS,CAAC;IAClC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;CACpC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAK1F;AAkED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC,CAuD7B"}

package/dist/utils/resource-loader.js

@@ -1,9 +1,79 @@
 /**
  * Utilities for loading and crawling resources
  */
-import { ResourceRegistry, } from '@vibe-agent-toolkit/resources';
-import { GitTracker } from '@vibe-agent-toolkit/utils';
+import { existsSync, statSync } from 'node:fs';
+import { DEFAULT_RESOURCE_INCLUDE, ResourceRegistry, } from '@vibe-agent-toolkit/resources';
+import { GitTracker, safePath, toForwardSlash } from '@vibe-agent-toolkit/utils';
 import { loadConfig } from './config-loader.js';
+/**
+ * Scope resource include patterns to a subdirectory of the crawl base.
+ *
+ * Pure, and exported so the scoping rule is testable without a filesystem.
+ * `relDir` is base-relative with forward slashes; `''` means "the base itself",
+ * for which the patterns are already correctly scoped.
+ *
+ * The patterns in {@link DEFAULT_RESOURCE_INCLUDE} are all `**`-rooted, so
+ * prefixing is enough: picomatch's `**` matches zero segments, meaning
+ * `docs/**\/*.md` still matches `docs/a.md`.
+ */
+export function scopeIncludeToSubtree(include, relDir) {
+    if (relDir === '') {
+        return [...include];
+    }
+    return include.map((pattern) => `${relDir}/${pattern}`);
+}
+/**
+ * Build the crawl options for an explicit path argument.
+ *
+ * The path argument RESTATES which tree to scan; it does not license scanning
+ * files the project has declared out of bounds. So `exclude` — a "never treat
+ * this as a resource" statement about node_modules, build output, vendored
+ * trees, and deliberately-broken test fixtures — is applied either way, while
+ * the path replaces `include`.
+ *
+ * That is only expressible by keeping `baseDir` at the project root: config
+ * globs are declared relative to the project root, so re-basing the crawl onto
+ * the path argument (the previous behavior) silently voided every one of them.
+ * Instead the path argument becomes an include PREFIX on the same basis.
+ */
+function crawlOptionsForPath(pathArg, projectRoot, config, logger) {
+    const resolved = safePath.resolve(pathArg);
+    // safePath.relative already normalizes, but toForwardSlash makes the
+    // separator assumption in the `../` test below explicit on Windows too.
+    const normalizedRelDir = toForwardSlash(safePath.relative(projectRoot, resolved));
+    if (normalizedRelDir === '..' || normalizedRelDir.startsWith('../')) {
+        // Outside the project root, so the config's root-relative globs describe a
+        // different tree and genuinely cannot apply. Say so rather than dropping
+        // them silently — silent dropping is the bug this function exists to fix.
+        logger.warn(`${resolved} is outside projectRoot ${projectRoot}; ` +
+            `resources include/exclude patterns from the config do not apply to it`);
+        return { baseDir: resolved };
+    }
+    assertCrawlableDirectory(resolved);
+    return {
+        baseDir: projectRoot,
+        include: scopeIncludeToSubtree(DEFAULT_RESOURCE_INCLUDE, normalizedRelDir),
+        ...(config?.resources?.exclude ? { exclude: config.resources.exclude } : {}),
+    };
+}
+/**
+ * Fail loudly on a path argument that cannot be crawled.
+ *
+ * The crawler used to perform this check itself, because it received the path
+ * argument as its `baseDir`. Now that `baseDir` is the project root, a bad path
+ * argument would otherwise degrade into a glob that matches nothing — a green
+ * run reporting `filesScanned: 0`.
+ */
+function assertCrawlableDirectory(resolved) {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI path argument, resolved above
+    if (!existsSync(resolved)) {
+        throw new Error(`Path does not exist: ${resolved}`);
+    }
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI path argument, existence checked above
+    if (!statSync(resolved).isDirectory()) {
+        throw new Error(`Path is not a directory: ${resolved}`);
+    }
+}
 /**
  * Load resources from a path with config support
  *
@@ -13,8 +83,15 @@ import { loadConfig } from './config-loader.js';
  * 3. Create registry and crawl
  *
  * Behavior:
- * - When path argument provided: use as baseDir, ignore config patterns (use defaults)
- * - When no path argument: use project root as baseDir, apply config patterns
+ * - When no path argument: crawl the project root, applying the config's
+ *   `resources.include` and `resources.exclude` patterns.
+ * - When a path argument is provided: still crawl on the project-root basis (so
+ *   the config's root-relative globs remain meaningful), with `include` replaced
+ *   by the default resource patterns scoped to that subtree and the config's
+ *   `exclude` still applied. A path argument says WHICH tree to scan; it does
+ *   not license scanning files the project excluded.
+ * - When the path argument lies outside the project root, the config's patterns
+ *   describe a different tree: they are dropped, with a warning.
  *
  * Per CLI-boundary rule (spec §5): `projectRoot` MUST be resolved by the
  * caller using one of the policy helpers in `project-root-policy.ts`. This
@@ -48,14 +125,11 @@ export async function loadResourcesWithConfig(pathArg, projectRoot, logger) {
     const registry = new ResourceRegistry(registryOptions);
     let crawlOptions;
     if (pathArg) {
-        // Path argument provided: crawl from that directory with default patterns
-        // Ignore config patterns because they're relative to project root
+        // Path argument provided: narrow the scan to that subtree, but keep the
+        // project's exclude patterns — see crawlOptionsForPath.
         logger.debug(`Path argument provided: ${pathArg}`);
-        logger.debug('Using default patterns (ignoring config)');
-        crawlOptions = {
-            baseDir: pathArg,
-            // Use defaults from ResourceRegistry.crawl (will use **/*.md)
-        };
+        crawlOptions = crawlOptionsForPath(pathArg, projectRoot, config, logger);
+        logger.debug(`Crawling ${crawlOptions.baseDir} with include: ${JSON.stringify(crawlOptions.include)}`);
     }
     else {
         // No path argument: crawl from projectRoot with config patterns

package/dist/utils/resource-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-loader.js","sourceRoot":"","sources":["../../src/utils/resource-loader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,GAGjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAWhD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA2B,EAC3B,WAAmB,EACnB,MAAc;IAEd,yDAAyD;IACzD,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAEvC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,+BAA+B,KAAK,CAAC,SAAS,gBAAgB,CAAC,CAAC;IAE7E,4BAA4B;IAC5B,oEAAoE;IACpE,MAAM,eAAe,GAA4B;QAC/C,OAAO,EAAE,WAAW;QACpB,UAAU;KACX,CAAC;IACF,IAAI,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;QACnC,eAAe,CAAC,MAAM,GAAG,MAAM,CAAC;IAClC,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAEvD,IAAI,YAAY,CAAC;IAEjB,IAAI,OAAO,EAAE,CAAC;QACZ,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAEzD,YAAY,GAAG;YACb,OAAO,EAAE,OAAO;YAChB,8DAA8D;SAC/D,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,gEAAgE;QAChE,MAAM,CAAC,KAAK,CAAC,4BAA4B,WAAW,EAAE,CAAC,CAAC;QAExD,YAAY,GAAG;YACb,OAAO,EAAE,WAAW;YACpB,oDAAoD;YACpD,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,oDAAoD;YACpD,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAEnC,OAAO;QACL,QAAQ,EAAE,OAAO,IAAI,WAAW;QAChC,WAAW;QACX,MAAM;QACN,QAAQ;QACR,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resource-loader.js","sourceRoot":"","sources":["../../src/utils/resource-loader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,EACL,wBAAwB,EACxB,gBAAgB,GAIjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEjF,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAWhD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA0B,EAAE,MAAc;IAC9E,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,WAAmB,EACnB,MAAiC,EACjC,MAAc;IAEd,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IAElF,IAAI,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,CAAC,IAAI,CACT,GAAG,QAAQ,2BAA2B,WAAW,IAAI;YACnD,uEAAuE,CAC1E,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAED,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAEnC,OAAO;QACL,OAAO,EAAE,WAAW;QACpB,OAAO,EAAE,qBAAqB,CAAC,wBAAwB,EAAE,gBAAgB,CAAC;QAC1E,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAAC,QAAgB;IAChD,wGAAwG;IACxG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,iHAAiH;IACjH,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA2B,EAC3B,WAAmB,EACnB,MAAc;IAEd,yDAAyD;IACzD,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAEvC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,+BAA+B,KAAK,CAAC,SAAS,gBAAgB,CAAC,CAAC;IAE7E,4BAA4B;IAC5B,oEAAoE;IACpE,MAAM,eAAe,GAA4B;QAC/C,OAAO,EAAE,WAAW;QACpB,UAAU;KACX,CAAC;IACF,IAAI,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;QACnC,eAAe,CAAC,MAAM,GAAG,MAAM,CAAC;IAClC,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAEvD,IAAI,YAA0B,CAAC;IAE/B,IAAI,OAAO,EAAE,CAAC;QACZ,wEAAwE;QACxE,wDAAwD;QACxD,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;QACnD,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,YAAY,YAAY,CAAC,OAAO,kBAAkB,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;SAAM,CAAC;QACN,gEAAgE;QAChE,MAAM,CAAC,KAAK,CAAC,4BAA4B,WAAW,EAAE,CAAC,CAAC;QAExD,YAAY,GAAG;YACb,OAAO,EAAE,WAAW;YACpB,oDAAoD;YACpD,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,oDAAoD;YACpD,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAEnC,OAAO;QACL,QAAQ,EAAE,OAAO,IAAI,WAAW;QAChC,WAAW;QACX,MAAM;QACN,QAAQ;QACR,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/utils/skill-packaging-config.d.ts

@@ -9,7 +9,8 @@
  * Most fields are a shallow override: a per-skill value replaces the default
  * outright. `files:` is the exception — see below.
  */
-import { type SkillPackagingConfig } from '@vibe-agent-toolkit/agent-skills';
+import { type DeclaredEvalSuite, type SkillPackagingConfig } from '@vibe-agent-toolkit/agent-skills';
+import type { SkillsConfig } from '@vibe-agent-toolkit/resources';
 /**
  * Merge defaults with per-skill overrides, dropping undefined values.
  *
@@ -25,4 +26,24 @@ import { type SkillPackagingConfig } from '@vibe-agent-toolkit/agent-skills';
  * the build did — the exact class of divergence this module exists to prevent.
  */
 export declare function mergeSkillPackagingConfig(defaults: Record<string, unknown> | undefined, perSkillOverrides: Record<string, unknown> | undefined): SkillPackagingConfig;
+/**
+ * The PROJECT's declared eval suites: one {@link DeclaredEvalSuite} per discovered
+ * skill, from the same discovery + merge every lane already runs.
+ *
+ * Test input never ships, and that rule is project-wide rather than per-skill — a file
+ * ANY skill declares as its eval suite is an answer key, and no other skill's bundle may
+ * carry it. Every lane that packages or models a bundle therefore needs the whole
+ * project's declarations, not just the subject's.
+ *
+ * Build this ONCE per invocation, from the UNFILTERED discovery, and pass the same array
+ * down to every skill:
+ *   - unfiltered, because `--skill x` narrows what is BUILT, never what counts as test
+ *     input; a suite excluded from the run is still an answer key;
+ *   - once, because assembling it per skill would walk the project's whole skills config
+ *     inside a per-skill loop — a per-item cost against whole-corpus work.
+ */
+export declare function collectDeclaredEvalSuites(skillsConfig: SkillsConfig | undefined, discovered: ReadonlyArray<{
+    name: string;
+    sourcePath: string;
+}>): DeclaredEvalSuite[];
 //# sourceMappingURL=skill-packaging-config.d.ts.map

package/dist/utils/skill-packaging-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-packaging-config.d.ts","sourceRoot":"","sources":["../../src/utils/skill-packaging-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAoB,KAAK,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAE/F;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC7C,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACrD,oBAAoB,CAmBtB"}
+{"version":3,"file":"skill-packaging-config.d.ts","sourceRoot":"","sources":["../../src/utils/skill-packaging-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAoB,KAAK,iBAAiB,EAAE,KAAK,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACvH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAGlE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC7C,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACrD,oBAAoB,CAmBtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,YAAY,GAAG,SAAS,EACtC,UAAU,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9D,iBAAiB,EAAE,CAUrB"}

package/dist/utils/skill-packaging-config.js

@@ -10,6 +10,7 @@
  * outright. `files:` is the exception — see below.
  */
 import { mergeFilesConfig } from '@vibe-agent-toolkit/agent-skills';
+import { safePath } from '@vibe-agent-toolkit/utils';
 /**
  * Merge defaults with per-skill overrides, dropping undefined values.
  *
@@ -42,4 +43,29 @@ export function mergeSkillPackagingConfig(defaults, perSkillOverrides) {
     }
     return packagingConfig;
 }
+/**
+ * The PROJECT's declared eval suites: one {@link DeclaredEvalSuite} per discovered
+ * skill, from the same discovery + merge every lane already runs.
+ *
+ * Test input never ships, and that rule is project-wide rather than per-skill — a file
+ * ANY skill declares as its eval suite is an answer key, and no other skill's bundle may
+ * carry it. Every lane that packages or models a bundle therefore needs the whole
+ * project's declarations, not just the subject's.
+ *
+ * Build this ONCE per invocation, from the UNFILTERED discovery, and pass the same array
+ * down to every skill:
+ *   - unfiltered, because `--skill x` narrows what is BUILT, never what counts as test
+ *     input; a suite excluded from the run is still an answer key;
+ *   - once, because assembling it per skill would walk the project's whole skills config
+ *     inside a per-skill loop — a per-item cost against whole-corpus work.
+ */
+export function collectDeclaredEvalSuites(skillsConfig, discovered) {
+    if (skillsConfig === undefined)
+        return [];
+    const { defaults, config: perSkillConfig } = skillsConfig;
+    return discovered.map((skill) => ({
+        skillDir: safePath.resolve(skill.sourcePath, '..'),
+        config: mergeSkillPackagingConfig(defaults, perSkillConfig?.[skill.name]),
+    }));
+}
 //# sourceMappingURL=skill-packaging-config.js.map

package/dist/utils/skill-packaging-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-packaging-config.js","sourceRoot":"","sources":["../../src/utils/skill-packaging-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,gBAAgB,EAA6B,MAAM,kCAAkC,CAAC;AAE/F;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA6C,EAC7C,iBAAsD;IAEtD,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,iBAAiB,EAAE,CAAC;IACrD,MAAM,eAAe,GAAyB,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACvB,eAA2C,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAkC,CAAC;IAC1E,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC,OAAO,CAAkC,CAAC;IACpF,IAAI,YAAY,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,WAAW,GAAG,gBAAgB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,eAAe,CAAC,KAAK,GAAG,WAAW,CAAC;QACtC,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC"}
+{"version":3,"file":"skill-packaging-config.js","sourceRoot":"","sources":["../../src/utils/skill-packaging-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,gBAAgB,EAAqD,MAAM,kCAAkC,CAAC;AAEvH,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA6C,EAC7C,iBAAsD;IAEtD,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,iBAAiB,EAAE,CAAC;IACrD,MAAM,eAAe,GAAyB,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACvB,eAA2C,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAkC,CAAC;IAC1E,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC,OAAO,CAAkC,CAAC;IACpF,IAAI,YAAY,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,WAAW,GAAG,gBAAgB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,eAAe,CAAC,KAAK,GAAG,WAAW,CAAC;QACtC,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CACvC,YAAsC,EACtC,UAA+D;IAE/D,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1C,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,YAAY,CAAC;IAC1D,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC;QAClD,MAAM,EAAE,yBAAyB,CAC/B,QAA+C,EAC/C,cAAc,EAAE,CAAC,KAAK,CAAC,IAAI,CAAwC,CACpE;KACF,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/utils/validate-help-files.d.ts

@@ -6,9 +6,10 @@
  * rather than runtime errors when users request verbose help.
  */
 /**
- * Validate that all required help files exist
+ * Validate the help-docs directory in BOTH directions.
  *
- * @throws {Error} If any required help file is missing
+ * @throws {Error} If a required help file is missing, or a shipped doc is
+ *   classified as neither command-served nor prose-only.
  */
 export declare function validateHelpFiles(): void;
 //# sourceMappingURL=validate-help-files.d.ts.map

package/dist/utils/validate-help-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-help-files.d.ts","sourceRoot":"","sources":["../../src/utils/validate-help-files.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAmBH;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAuBxC"}
+{"version":3,"file":"validate-help-files.d.ts","sourceRoot":"","sources":["../../src/utils/validate-help-files.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA0CH;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAkDxC"}

package/dist/utils/validate-help-files.js

@@ -5,13 +5,17 @@
  * This provides "fail fast" behavior - missing help files cause build failure
  * rather than runtime errors when users request verbose help.
  */
-import { existsSync } from 'node:fs';
+import { existsSync, readdirSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { safePath } from '@vibe-agent-toolkit/utils';
 /**
- * Required help documentation files
- * Each entry maps to a file in packages/cli/docs/
+ * Files `loadVerboseHelp()` is actually asked for by a command.
+ *
+ * This list must stay in step with the `loadVerboseHelp(...)` call sites —
+ * each entry is a document some `--help --verbose` path will read at runtime,
+ * and a missing one degrades to an in-band "Help Documentation Not Found" page
+ * that still exits 0.
  */
 const REQUIRED_HELP_FILES = [
     'index.md', // Root-level verbose help (vat --help --verbose)
@@ -20,9 +24,28 @@ const REQUIRED_HELP_FILES = [
     'agent.md', // Agent command verbose help (vat agent --help --verbose)
 ];
 /**
- * Validate that all required help files exist
+ * Shipped docs that NO command serves — reference pages, reached only by a
+ * prose link from `docs/index.md`, this repo's CLAUDE.md, or the README.
+ *
+ * Recorded explicitly because the forward check alone cannot see them: they are
+ * published in the npm package (`files: ["docs"]`) and read like verbose help,
+ * so an author can reasonably expect `vat audit --help --verbose` to print
+ * `audit.md` when in fact nothing does. Every file in `docs/` must be in this
+ * set or in {@link REQUIRED_HELP_FILES}, so adding a page forces the author to
+ * say which it is.
+ */
+const PROSE_ONLY_HELP_FILES = new Set([
+    'audit.md',
+    'doctor.md',
+    'mcp.md',
+    'skills.md',
+    'skill-test.md',
+]);
+/**
+ * Validate the help-docs directory in BOTH directions.
  *
- * @throws {Error} If any required help file is missing
+ * @throws {Error} If a required help file is missing, or a shipped doc is
+ *   classified as neither command-served nor prose-only.
  */
 export function validateHelpFiles() {
     const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -42,6 +65,26 @@ export function validateHelpFiles() {
             `These files must exist for verbose help (--help --verbose) to work.\n` +
             `Create them before building the CLI package.`);
     }
+    // Reverse direction: a doc nobody serves and nobody classified.
+    const required = new Set(REQUIRED_HELP_FILES);
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- docsDir is derived from this module's own location
+    const present = readdirSync(docsDir).filter(f => f.endsWith('.md'));
+    const unclassified = present.filter(f => !required.has(f) && !PROSE_ONLY_HELP_FILES.has(f));
+    if (unclassified.length > 0) {
+        const fileList = unclassified.map(f => `  - docs/${f}`).join('\n');
+        throw new Error(`Unclassified help documentation files:\n${fileList}\n\n` +
+            `Every file in packages/cli/docs/ ships in the npm package and must be\n` +
+            `either served by a command (add it to REQUIRED_HELP_FILES and call\n` +
+            `loadVerboseHelp('<name>') from that command's help path) or recorded as\n` +
+            `reference-only (add it to PROSE_ONLY_HELP_FILES). Without this, a page can\n` +
+            `be written, published, and never reachable from any --help --verbose.`);
+    }
+    const stalelyClassified = [...PROSE_ONLY_HELP_FILES].filter(f => !present.includes(f));
+    if (stalelyClassified.length > 0) {
+        throw new Error(`PROSE_ONLY_HELP_FILES lists files that no longer exist:\n` +
+            stalelyClassified.map(f => `  - docs/${f}`).join('\n') +
+            `\n\nRemove the stale entries.`);
+    }
 }
 /**
  * Run validation if this file is executed directly

package/dist/utils/validate-help-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-help-files.js","sourceRoot":"","sources":["../../src/utils/validate-help-files.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD;;;GAGG;AACH,MAAM,mBAAmB,GAAG;IAC1B,UAAU,EAAO,iDAAiD;IAClE,cAAc,EAAG,kEAAkE;IACnF,QAAQ,EAAS,sDAAsD;IACvE,UAAU,EAAO,0DAA0D;CACnE,CAAC;AAEX;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAEnD,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,KAAK,MAAM,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,qHAAqH;QACrH,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,+CAA+C,QAAQ,MAAM;YAC7D,uEAAuE;YACvE,8CAA8C,CAC/C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,IAAI,CAAC;QACH,iBAAiB,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,OAAO,CAAC,KAAK,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"validate-help-files.js","sourceRoot":"","sources":["../../src/utils/validate-help-files.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG;IAC1B,UAAU,EAAO,iDAAiD;IAClE,cAAc,EAAG,kEAAkE;IACnF,QAAQ,EAAS,sDAAsD;IACvE,UAAU,EAAO,0DAA0D;CACnE,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,UAAU;IACV,WAAW;IACX,QAAQ;IACR,WAAW;IACX,eAAe;CAChB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAEnD,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,KAAK,MAAM,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,qHAAqH;QACrH,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,+CAA+C,QAAQ,MAAM;YAC7D,uEAAuE;YACvE,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,mBAAmB,CAAC,CAAC;IACtD,yHAAyH;IACzH,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5F,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,2CAA2C,QAAQ,MAAM;YACzD,yEAAyE;YACzE,sEAAsE;YACtE,2EAA2E;YAC3E,8EAA8E;YAC9E,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,CAAC,GAAG,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,2DAA2D;YAC3D,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACtD,+BAA+B,CAChC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,IAAI,CAAC;QACH,iBAAiB,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,OAAO,CAAC,KAAK,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/utils/verdict-helpers.d.ts

@@ -27,15 +27,24 @@ export declare function verdictToIssue(verdict: Verdict, location: string): Vali
  * config-level targets only. Plugin-level and marketplace-level targets
  * are surfaced by the analyzer (`vat audit --compat`) which has its own
  * walk over plugin / marketplace manifests.
+ *
+ * Takes the skill's path plus the anchor root and re-bases internally rather
+ * than accepting a pre-rendered `location`. That is deliberate: when this took
+ * a caller-supplied location string, each of the four call sites got its own
+ * chance to answer "relative to what?" and three answered "absolute" — one
+ * `vat skill review --yaml` document ended up carrying two coordinate systems,
+ * and `vat skills validate` leaked a full home-directory path. Owning the
+ * re-base here makes that unrepresentable at every call site at once.
  */
-export declare function computeConfigVerdicts(observations: readonly Observation[], configTargets: ReadonlyArray<Target> | undefined, location: string): ValidationIssue[];
+export declare function computeConfigVerdicts(observations: readonly Observation[], configTargets: ReadonlyArray<Target> | undefined, skillSourcePath: string, locationRoot: string): ValidationIssue[];
 /**
  * Mutate a PackagingValidationResult in place to include compat verdicts
  * derived from the result's observations and the configured targets.
  *
- * Verdict issues land in `allErrors` and the appropriate active bucket
- * based on resolved severity (warning → activeWarnings; info stays only
- * in allErrors). Verdicts are not allow-filterable.
+ * Verdict issues land in `allErrors`, which is the sole container for every
+ * emitted issue regardless of severity — callers derive the active partition
+ * with `activeErrorsOf` / `activeWarningsOf` rather than reading a second
+ * pre-filtered copy. Verdicts are not allow-filterable.
  */
-export declare function applyConfigVerdicts(result: PackagingValidationResult, configTargets: ReadonlyArray<Target> | undefined, skillSourcePath: string): void;
+export declare function applyConfigVerdicts(result: PackagingValidationResult, configTargets: ReadonlyArray<Target> | undefined, skillSourcePath: string, locationRoot: string): void;
 //# sourceMappingURL=verdict-helpers.d.ts.map

package/dist/utils/verdict-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verdict-helpers.d.ts","sourceRoot":"","sources":["../../src/utils/verdict-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,yBAAyB,EAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,OAAO,EACb,MAAM,wCAAwC,CAAC;AAEhD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAUlF;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,SAAS,WAAW,EAAE,EACpC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,EAChD,QAAQ,EAAE,MAAM,GACf,eAAe,EAAE,CAiBnB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,yBAAyB,EACjC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,EAChD,eAAe,EAAE,MAAM,GACtB,IAAI,CAgBN"}
+{"version":3,"file":"verdict-helpers.d.ts","sourceRoot":"","sources":["../../src/utils/verdict-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,yBAAyB,EAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,OAAO,EACb,MAAM,wCAAwC,CAAC;AAGhD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAUlF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,SAAS,WAAW,EAAE,EACpC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,EAChD,eAAe,EAAE,MAAM,EACvB,YAAY,EAAE,MAAM,GACnB,eAAe,EAAE,CAkBnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,yBAAyB,EACjC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,EAChD,eAAe,EAAE,MAAM,EACvB,YAAY,EAAE,MAAM,GACnB,IAAI,CAcN"}

package/dist/utils/verdict-helpers.js

@@ -14,6 +14,7 @@
  */
 import { CODE_REGISTRY } from '@vibe-agent-toolkit/agent-schema';
 import { computeVerdicts, resolveEffectiveTargets, } from '@vibe-agent-toolkit/claude-marketplace';
+import { issueLocation } from '@vibe-agent-toolkit/utils';
 /**
  * Convert a verdict into a ValidationIssue using CODE_REGISTRY for severity,
  * fix and reference. Pure function — no I/O.
@@ -36,8 +37,16 @@ export function verdictToIssue(verdict, location) {
  * config-level targets only. Plugin-level and marketplace-level targets
  * are surfaced by the analyzer (`vat audit --compat`) which has its own
  * walk over plugin / marketplace manifests.
+ *
+ * Takes the skill's path plus the anchor root and re-bases internally rather
+ * than accepting a pre-rendered `location`. That is deliberate: when this took
+ * a caller-supplied location string, each of the four call sites got its own
+ * chance to answer "relative to what?" and three answered "absolute" — one
+ * `vat skill review --yaml` document ended up carrying two coordinate systems,
+ * and `vat skills validate` leaked a full home-directory path. Owning the
+ * re-base here makes that unrepresentable at every call site at once.
  */
-export function computeConfigVerdicts(observations, configTargets, location) {
+export function computeConfigVerdicts(observations, configTargets, skillSourcePath, locationRoot) {
     if (observations.length === 0) {
         return [];
     }
@@ -50,31 +59,25 @@ export function computeConfigVerdicts(observations, configTargets, location) {
         observations: [...observations],
         targets: effectiveTargets,
     });
+    const location = issueLocation(skillSourcePath, locationRoot);
     return verdicts.map(v => verdictToIssue(v, location));
 }
 /**
  * Mutate a PackagingValidationResult in place to include compat verdicts
  * derived from the result's observations and the configured targets.
  *
- * Verdict issues land in `allErrors` and the appropriate active bucket
- * based on resolved severity (warning → activeWarnings; info stays only
- * in allErrors). Verdicts are not allow-filterable.
+ * Verdict issues land in `allErrors`, which is the sole container for every
+ * emitted issue regardless of severity — callers derive the active partition
+ * with `activeErrorsOf` / `activeWarningsOf` rather than reading a second
+ * pre-filtered copy. Verdicts are not allow-filterable.
  */
-export function applyConfigVerdicts(result, configTargets, skillSourcePath) {
-    const verdictIssues = computeConfigVerdicts(result.observations, configTargets, skillSourcePath);
+export function applyConfigVerdicts(result, configTargets, skillSourcePath, locationRoot) {
+    const verdictIssues = computeConfigVerdicts(result.observations, configTargets, skillSourcePath, locationRoot);
     if (verdictIssues.length === 0) {
         return;
     }
-    for (const issue of verdictIssues) {
-        result.allErrors.push(issue);
-        if (issue.severity === 'error') {
-            result.activeErrors.push(issue);
-        }
-        else if (issue.severity === 'warning') {
-            result.activeWarnings.push(issue);
-        }
-    }
-    if (result.activeErrors.length > 0) {
+    result.allErrors.push(...verdictIssues);
+    if (result.allErrors.some(issue => issue.severity === 'error')) {
         result.status = 'error';
     }
 }

package/dist/utils/verdict-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"verdict-helpers.js","sourceRoot":"","sources":["../../src/utils/verdict-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAwB,MAAM,kCAAkC,CAAC;AAKvF,OAAO,EACL,eAAe,EACf,uBAAuB,GAGxB,MAAM,wCAAwC,CAAC;AAEhD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,QAAgB;IAC/D,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,eAAe;QAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ;QACR,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAAoC,EACpC,aAAgD,EAChD,QAAgB;IAEhB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;QAC/C,aAAa,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC;QAC3E,aAAa,EAAE,SAAS;QACxB,kBAAkB,EAAE,SAAS;KAC9B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,eAAe,CAAC;QAC/B,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC;QAC/B,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAiC,EACjC,aAAgD,EAChD,eAAuB;IAEvB,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;IACjG,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;aAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC;IAC1B,CAAC;AACH,CAAC"}
+{"version":3,"file":"verdict-helpers.js","sourceRoot":"","sources":["../../src/utils/verdict-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAwB,MAAM,kCAAkC,CAAC;AAKvF,OAAO,EACL,eAAe,EACf,uBAAuB,GAGxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,QAAgB;IAC/D,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,eAAe;QAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ;QACR,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAAoC,EACpC,aAAgD,EAChD,eAAuB,EACvB,YAAoB;IAEpB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;QAC/C,aAAa,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC;QAC3E,aAAa,EAAE,SAAS;QACxB,kBAAkB,EAAE,SAAS;KAC9B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,eAAe,CAAC;QAC/B,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC;QAC/B,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,aAAa,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAiC,EACjC,aAAgD,EAChD,eAAuB,EACvB,YAAoB;IAEpB,MAAM,aAAa,GAAG,qBAAqB,CACzC,MAAM,CAAC,YAAY,EACnB,aAAa,EACb,eAAe,EACf,YAAY,CACb,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IACD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC;IAC1B,CAAC;AACH,CAAC"}