@vibe-agent-toolkit/cli 0.1.41-rc.7 → 0.1.41

package/dist/commands/skills/scope-guard.js

@@ -0,0 +1,86 @@
+/**
+ * The shared `[path]` scope guard for the skills commands that take one.
+ *
+ * `vat skills validate` and `vat skills build` both accept `[path]` meaning
+ * "read the config in THIS directory". Neither checked that the directory
+ * existed or held one, so a mistyped path silently rescoped the run to NOTHING
+ * and still exited 0 — a green tick for a scan that never happened. The two
+ * commands print different words while doing it (`nothing to validate` vs
+ * `nothing to build`), which is the only thing that varies between them.
+ *
+ * One implementation, parameterised by those words. Fixing this for one command
+ * and copying it into the other is how the pair drifts.
+ */
+import { existsSync, statSync } from 'node:fs';
+import { safePath } from '@vibe-agent-toolkit/utils';
+/** The name `loadConfig` looks for in the directory these commands are pointed at. */
+export const CONFIG_FILENAME = 'vibe-agent-toolkit.config.yaml';
+/**
+ * Why the path the operator typed cannot scope this run — or `undefined` when it
+ * can.
+ *
+ * Only an EXPLICIT argument is judged. With no argument the command means "the
+ * current directory", and a cwd that happens to hold no config is the documented
+ * nothing-to-do case, not a mis-scoped run.
+ *
+ * `VAT_TEST_CONFIG` is honoured for the same reason `loadConfig` honours it: when
+ * it is set, the config does not come from the named directory at all, so
+ * demanding one there would reject a scope that is in fact resolvable.
+ *
+ * Pure — returns the message instead of writing it, so both answers are
+ * assertable without capturing a stream.
+ */
+export function unscopableSkillsPath(pathArg) {
+    if (pathArg === undefined)
+        return undefined;
+    const resolved = safePath.resolve(pathArg);
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- a CLI argument is the subject of this check
+    if (!existsSync(resolved))
+        return 'no such directory';
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- ditto; existence was just established
+    if (!statSync(resolved).isDirectory())
+        return 'not a directory';
+    if (process.env['VAT_TEST_CONFIG'] !== undefined)
+        return undefined;
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- ditto
+    if (!existsSync(safePath.join(resolved, CONFIG_FILENAME))) {
+        return `no ${CONFIG_FILENAME} there`;
+    }
+    return undefined;
+}
+/**
+ * The refusal text, as a string.
+ *
+ * Separate from the writing and the exiting so a test can assert what the
+ * operator is told without capturing a stream or trapping `process.exit`.
+ */
+export function unscopablePathMessage(subject, pathArg, reason) {
+    const { command, silentSuccess } = subject;
+    return (`error: '${command}' cannot scope to '${pathArg}' (${reason}).\n` +
+        `\n` +
+        `  '${command} <path>' reads the ${CONFIG_FILENAME} in the directory it is\n` +
+        `  pointed at. This argument used to be accepted and the run silently\n` +
+        `  rescoped to NOTHING: it printed "${silentSuccess}" and exited 0, so an\n` +
+        `  operator who mistyped a path got a green tick for a run that never\n` +
+        `  happened.\n` +
+        `\n` +
+        `  Fix: point '${command}' at a directory holding a ${CONFIG_FILENAME},\n` +
+        `  or run it with no argument to use the current directory.\n` +
+        `  To inspect ONE skill or bundle by path, use: vat audit <path>\n`);
+}
+/**
+ * Refuse to run when the operator scoped the command at something it cannot
+ * read a config from.
+ *
+ * Exit 2, matching `rejectPositionalArguments`: exit 1 on these commands is
+ * documented as "errors found", and reporting a usage error as 1 tells a CI gate
+ * the project's skills are broken when nothing was inspected.
+ */
+export function rejectUnscopablePath(subject, pathArg) {
+    const reason = unscopableSkillsPath(pathArg);
+    if (reason === undefined)
+        return;
+    process.stderr.write(unscopablePathMessage(subject, String(pathArg), reason));
+    process.exit(2);
+}
+//# sourceMappingURL=scope-guard.js.map

package/dist/commands/skills/scope-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-guard.js","sourceRoot":"","sources":["../../../src/commands/skills/scope-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,sFAAsF;AACtF,MAAM,CAAC,MAAM,eAAe,GAAG,gCAAgC,CAAC;AAmBhE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA2B;IAC9D,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,kHAAkH;IAClH,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACtD,4GAA4G;IAC5G,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;QAAE,OAAO,iBAAiB,CAAC;IAEhE,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACnE,4EAA4E;IAC5E,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO,MAAM,eAAe,QAAQ,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA2B,EAC3B,OAAe,EACf,MAAc;IAEd,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAC3C,OAAO,CACL,WAAW,OAAO,sBAAsB,OAAO,MAAM,MAAM,MAAM;QACjE,IAAI;QACJ,MAAM,OAAO,sBAAsB,eAAe,2BAA2B;QAC7E,wEAAwE;QACxE,sCAAsC,aAAa,yBAAyB;QAC5E,wEAAwE;QACxE,eAAe;QACf,IAAI;QACJ,iBAAiB,OAAO,8BAA8B,eAAe,KAAK;QAC1E,8DAA8D;QAC9D,mEAAmE,CACpE,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA2B,EAC3B,OAA2B;IAE3B,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IAEjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/commands/skills/validate-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-command.d.ts","sourceRoot":"","sources":["../../../src/commands/skills/validate-command.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,qBAAqB,IAAI,OAAO,CA0F/C"}
+{"version":3,"file":"validate-command.d.ts","sourceRoot":"","sources":["../../../src/commands/skills/validate-command.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoBpC,wBAAgB,qBAAqB,IAAI,OAAO,CA6G/C"}

package/dist/commands/skills/validate-command.js

@@ -2,16 +2,34 @@
  * Skills validate command - Commander.js wrapper
  */
 import { Command } from 'commander';
+import { rejectUnscopablePath } from './scope-guard.js';
 import { validateCommand } from './validate.js';
+/**
+ * What a mis-scoped `vat skills validate` used to do.
+ *
+ * In a package where the bare invocation validates 13 skills, one mistyped
+ * character rescoped it to nothing and still reported success — the same
+ * "went wide / went narrow and reported success" defect
+ * `rejectPositionalArguments` was added to `vat verify` / `vat validate` /
+ * `vat build` for, arrived at from the opposite direction. `vat skills build`
+ * carried the identical hole and is guarded by the same module.
+ */
+const SCOPE_SUBJECT = {
+    command: 'vat skills validate',
+    silentSuccess: 'nothing to validate',
+};
 export function createValidateCommand() {
     const command = new Command('validate');
     command
         .description('Validate skills for packaging (reads skills config from config yaml)')
         .argument('[path]', 'Path to directory with config yaml (default: current directory)')
         .option('--skill <name>', 'Validate specific skill only')
-        .option('-v, --verbose', 'Show full details including excluded reference paths')
+        .option('-v, --verbose', 'Show all validated skills and every individual finding, including excluded reference paths')
         .option('-d, --debug', 'Enable debug logging')
-        .action(validateCommand)
+        .action(async (pathArg, options) => {
+        rejectUnscopablePath(SCOPE_SUBJECT, pathArg);
+        await validateCommand(pathArg, options);
+    })
         .addHelpText('after', `
 Description:
   Validates skills declared in vibe-agent-toolkit.config.yaml using the
@@ -65,14 +83,30 @@ Validation Config:
 
 Output:
   YAML summary → stdout (for programmatic parsing)
-  Detailed errors → stderr (for human reading)
+  Findings report → stderr (for human reading)
 
-  Output includes:
-    - status: success/error
-    - skillsValidated: number of skills validated
-    - results: per-skill validation details (activeErrors, activeWarnings, ignoredErrors)
+  The stdout summary always publishes:
+    - status: success/warning/error (worst actionable severity in the run)
+    - issueCounts / runIssueCounts: the run total, always with all three
+      buckets, and the run-level (project config) share of it. The run total
+      always equals the sum of the per-skill rows plus runIssueCounts.
+    - skillsValidated: number of skills validated (the true denominator)
     - durationSecs: validation time
 
+  By default, results[] is one row per skill WITH findings — its issue counts
+  and a per-code tally, dominant code first. A skill with no findings is
+  omitted from the listing entirely; a zero count is an absent field, never
+  "errors: 0". stderr prints the same thing as one line per skill.
+
+  --verbose publishes every validated skill (findings or not) with its full
+  detail: allErrors, ignoredErrors, observations, evidence and complete
+  metadata on stdout, one block per individual finding on stderr. That form is
+  meant for redirect-then-grep, not for reading — on a 90-skill repo it is
+  ~30x the default output.
+
+  Run-level findings (validation.allow entries no skill matched) are printed
+  in full in both forms; they belong to the project config, not to any skill.
+
 Exit Codes:
   0 - All validations passed (or all errors allowed by valid config)
   1 - Validation errors found (severity=error, not allowed)

package/dist/commands/skills/validate-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-command.js","sourceRoot":"","sources":["../../../src/commands/skills/validate-command.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,UAAU,qBAAqB;IACnC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAExC,OAAO;SACJ,WAAW,CAAC,sEAAsE,CAAC;SACnF,QAAQ,CAAC,QAAQ,EAAE,iEAAiE,CAAC;SACrF,MAAM,CAAC,gBAAgB,EAAE,8BAA8B,CAAC;SACxD,MAAM,CAAC,eAAe,EAAE,sDAAsD,CAAC;SAC/E,MAAM,CAAC,aAAa,EAAE,sBAAsB,CAAC;SAC7C,MAAM,CAAC,eAAe,CAAC;SACvB,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0EL,CACI,CAAC;IAEJ,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"validate-command.js","sourceRoot":"","sources":["../../../src/commands/skills/validate-command.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,oBAAoB,EAA2B,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAqC,eAAe,EAAE,MAAM,eAAe,CAAC;AAEnF;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAuB;IACxC,OAAO,EAAE,qBAAqB;IAC9B,aAAa,EAAE,qBAAqB;CACrC,CAAC;AAEF,MAAM,UAAU,qBAAqB;IACnC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAExC,OAAO;SACJ,WAAW,CAAC,sEAAsE,CAAC;SACnF,QAAQ,CAAC,QAAQ,EAAE,iEAAiE,CAAC;SACrF,MAAM,CAAC,gBAAgB,EAAE,8BAA8B,CAAC;SACxD,MAAM,CAAC,eAAe,EAAE,4FAA4F,CAAC;SACrH,MAAM,CAAC,aAAa,EAAE,sBAAsB,CAAC;SAC7C,MAAM,CAAC,KAAK,EAAE,OAA2B,EAAE,OAAqC,EAAE,EAAE;QACnF,oBAAoB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC;SACD,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0FL,CACI,CAAC;IAEJ,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/commands/skills/validate.d.ts

@@ -4,7 +4,7 @@
  * Discovers skills from config yaml skills.include/exclude, validates each
  * using validateSkillForPackaging with merged packaging config.
  */
-import { type SeverityCounts } from '@vibe-agent-toolkit/agent-schema';
+import { type SeverityCounts, type ValidationIssue } from '@vibe-agent-toolkit/agent-schema';
 import { type PackagingValidationResult } from '@vibe-agent-toolkit/agent-skills';
 /**
  * Skills validate command options
@@ -16,6 +16,16 @@ export interface SkillsValidateCommandOptions {
 }
 /** The vocabulary of a validation verdict: worst ACTIONABLE severity. */
 type ValidationStatus = 'success' | 'warning' | 'error';
+/**
+ * Findings about the RUN rather than about any one skill — currently the
+ * `validation.allow` entries no skill in the batch matched (ALLOW_UNUSED).
+ *
+ * They are a separate parameter, not folded into a skill's result, because
+ * that is what they are: `validation.allow` is declared once per package, so
+ * attributing "nothing matched this entry" to whichever skill happened to be
+ * validated at the time is what produced 78 warnings from 3 real entries.
+ */
+type RunIssues = readonly ValidationIssue[];
 /**
  * Build the YAML summary object.
  *
@@ -24,12 +34,32 @@ type ValidationStatus = 'success' | 'warning' | 'error';
  * `results.some(r => r.status === 'error') ? 'error' : 'success'` — a two-value
  * collapse that could never report the warning case, and so reported 33 active
  * warnings as `success`.
+ *
+ * The header total counts BOTH the per-skill findings and the run-level ones,
+ * because the exit code does too — dropping run issues from the header would
+ * divorce the published verdict from the code the process actually returns.
+ * That is why `runIssueCounts` exists beside them: on a large real repo the
+ * header read 1814 warnings against a per-skill sum of 1800, and the missing 14
+ * were run-level ALLOW_UNUSED entries published only as a bare LIST. The
+ * identity `issueCounts === Σ results[].issueCounts + runIssueCounts` now holds
+ * by construction, so a consumer can reconcile the two numbers instead of
+ * hand-counting a list to find out whether anything went missing.
+ *
+ * That identity survives the default mode dropping every finding-free skill from
+ * `results[]`, because a dropped row contributes exactly zero to each bucket —
+ * and it survives the default row publishing its counts flat with zero buckets
+ * omitted, because an absent bucket reads as zero. Only the per-asset ROWS omit
+ * zeros: `issueCounts` and `runIssueCounts` keep their complete
+ * `{errors, warnings, info}` shape in both modes, because they are the
+ * reconciliation identity rather than something a reader scans.
  */
-export declare function buildValidateSummary(results: PackagingValidationResult[], duration: number, verbose: boolean): {
+export declare function buildValidateSummary(results: PackagingValidationResult[], duration: number, verbose: boolean, runIssues: RunIssues): {
     status: ValidationStatus;
     issueCounts: SeverityCounts;
+    runIssueCounts: SeverityCounts;
     skillsValidated: number;
     results: unknown[];
+    runIssues: ValidationIssue[];
     durationSecs: number;
 };
 /**
@@ -38,8 +68,19 @@ export declare function buildValidateSummary(results: PackagingValidationResult[
  * Renders every skill with ANY emitted finding, not just the ones that failed
  * the gate: a warning-only or info-only run used to print the success banner and
  * nothing else, so the findings existed only in the YAML on stdout.
+ *
+ * Every skill with findings gets its summary row at every verbosity; `verbose`
+ * picks only which findings are ALSO rendered in full beneath that row, per
+ * {@link issuesToRenderAtVerbosity} — errors always, `warning`/`info` when
+ * asked, `ignore` never. `verbose` deliberately does NOT gate errors: a default
+ * run that collapsed the error it exited 1 on into a count line forced the reader
+ * to re-run with a flag to learn what broke.
+ *
+ * Run-level findings and the banner are printed in full either way — there are
+ * ~14 of the former, and they belong to the project config rather than to any
+ * asset, so there is no row for them to collapse into.
  */
-export declare function formatValidationReportLines(results: PackagingValidationResult[]): string[];
+export declare function formatValidationReportLines(results: PackagingValidationResult[], runIssues: RunIssues, verbose: boolean): string[];
 /**
  * Log validation progress for a single skill.
  *

package/dist/commands/skills/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/commands/skills/validate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAEL,KAAK,yBAAyB,EAG/B,MAAM,kCAAkC,CAAC;AA2B1C;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AASD,yEAAyE;AACzE,KAAK,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAiCxD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,yBAAyB,EAAE,EACpC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,GACf;IACD,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,cAAc,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB,CASA;AA6DD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,yBAAyB,EAAE,GAAG,MAAM,EAAE,CAW1F;AA8BD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,yBAAyB,GAChC,MAAM,EAAE,CAeV;AAwFD;;GAEG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAiFf"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/commands/skills/validate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAKL,KAAK,cAAc,EACnB,KAAK,eAAe,EACrB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAGL,KAAK,yBAAyB,EAG/B,MAAM,kCAAkC,CAAC;AA8B1C;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AASD,yEAAyE;AACzE,KAAK,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAaxD;;;;;;;;GAQG;AACH,KAAK,SAAS,GAAG,SAAS,eAAe,EAAE,CAAC;AA6D5C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,yBAAyB,EAAE,EACpC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,GACnB;IACD,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,cAAc,CAAC;IAC5B,cAAc,EAAE,cAAc,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;CACtB,CA2BA;AAqHD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,yBAAyB,EAAE,EACpC,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,OAAO,GACf,MAAM,EAAE,CAeV;AAkCD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,yBAAyB,GAChC,MAAM,EAAE,CAeV;AAkGD;;GAEG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CA4Ff"}