@vibe-agent-toolkit/cli 0.1.41-rc.7 → 0.1.41

package/dist/commands/validate.js

@@ -28,24 +28,48 @@ import { loadConfig } from '../utils/config-loader.js';
 import { createLogger } from '../utils/logger.js';
 import { writeYamlOutput } from '../utils/output.js';
 import { requireProjectRoot } from '../utils/project-root-policy.js';
-import { aggregatePhaseStatus, exitCodeForPhases, resolveBinPath, runPhase, } from './phase-utils.js';
+import { addRetiredOnlyOption, aggregatePhaseIssueCounts, aggregatePhaseStatus, applyPhaseSelection, decidePhaseSelection, exitCodeForPhases, rejectRetiredOnly, resolveBinPath, runPhase, } from './phase-utils.js';
+import { rejectPositionalArguments } from './positional-args.js';
 /** Surfaces `vat validate` knows how to run, in stable execution order. */
 const VALID_SURFACES = ['resources', 'skills'];
+const VALIDATE_VOCABULARY = {
+    noun: 'Surface',
+    verb: 'validate',
+    validNames: VALID_SURFACES,
+    noop: {
+        // A bare run with nothing configured is a clean no-op (exit 0, per issue
+        // #128's "doesn't check what it doesn't know about") — but silent success
+        // on stdout alone is indistinguishable, to anyone watching only the exit
+        // code, from a run that actually validated something. Warn on stderr so a
+        // config typo (e.g. `recources:`) doesn't masquerade as "all good."
+        warning: 'No resources: or skills: block found in vibe-agent-toolkit.config.yaml — nothing to validate. If this is unexpected, check your config.',
+        note: 'No configured validators (no resources or skills block in vibe-agent-toolkit.config.yaml).',
+    },
+};
+/**
+ * Measured full-run duration on the 90-skill / 1,041-document adopter, cited by
+ * the retired-`--only` message: resources 13.9s + skills 19.3s.
+ */
+const VALIDATE_FULL_RUN_SECONDS = 35;
+/** How this command names itself in every user-facing diagnostic. */
+const COMMAND_NAME = 'vat validate';
 export function createValidateTopLevelCommand() {
     const command = new Command('validate');
-    command
+    addRetiredOnlyOption(command)
         .description('Validate configured surfaces from source (resources + skills) — no build required')
-        .option('--only <surface>', 'Validate only a specific surface: resources, skills')
         .option('--debug', 'Enable debug logging')
+        .option('-v, --verbose', 'Show every finding, not just the collapsed counts')
         .action(validateTopLevelCommand)
         .addHelpText('after', `
 Description:
   Runs the source-level validators (resources, skills) the project's config
   declares — and only those. A surface whose config block is absent is skipped
   (a project with no skills block does not run skill validation; no error, no
-  noise, but a stderr warning if nothing at all is configured). An explicit
-  '--only <surface>' fails for a surface that is unrecognized or unconfigured,
-  so a CI gate cannot silently lose coverage.
+  noise, but a stderr warning if nothing at all is configured).
+
+  A run is a WHOLE run: '--only' was removed (a full run is ~35s, and the flag
+  let a renamed config key silently drop a CI gate's coverage). 'vat build'
+  keeps its '--only', where a phase costs minutes rather than seconds.
 
   Source-level only. Unlike 'vat verify', this never inspects built dist
   artifacts and never requires a build.
@@ -55,17 +79,28 @@ Description:
     skills     → SKILL.md frontmatter and packaging validation (when 'skills:' configured)
 
 Output:
-  YAML summary for each surface → stdout
-    per surface: status (success | error | system-error) plus the child's
-    exitCode, signal, or spawn error — a surface that could not run is never
-    reported as a surface that failed validation.
-  Validation errors → stderr
+  ONE YAML document → stdout
+    per surface: status (success | warning | error | system-error) plus the
+    child's exitCode, signal, or spawn error — a surface that could not run is
+    never reported as a surface that failed validation. The validator's own
+    report is captured and nested under 'report', so the whole run stays a
+    single parseable document ('vat validate | jq' works). A surface's status
+    comes from the validator's REPORTED status, not from its exit code — an
+    exit code cannot express 'warning'.
+  Progress and validation errors → stderr (streamed live)
 
 Exit Codes:
   0 - All configured validators passed (or nothing configured to validate)
-  1 - Validation errors found, or --only named a surface that is unrecognized or unconfigured
+  1 - Validation errors found, or the retired '--only' flag was passed
   2 - System error (this command's own, or propagated from a validator that
-      could not run: exited 2, was killed by a signal, or never spawned)
+      could not run: exited 2, was killed by a signal, was never spawned, or
+      wrote output that could not be parsed), or a usage error such as passing
+      a path
+
+Arguments:
+  None. Scope comes from vibe-agent-toolkit.config.yaml, never from the command
+  line — a path argument is rejected (exit 2) rather than discarded. For a
+  path-scoped run use 'vat resources validate <path>' or 'vat audit <path>'.
 
 Requirements:
   projectRoot: required (errors if no vibe-agent-toolkit.config.yaml or .git/ ancestor)
@@ -75,76 +110,54 @@ Requirements:
 
 Example:
   $ vat validate                       # Validate every configured surface
-  $ vat validate --only skills         # Validate skills only
 `);
     return command;
 }
 /**
- * Build the ordered list of validation phases from the project's config.
+ * Decide which validation surfaces to run.
+ *
  * A surface is included only when its config block is present, so coverage is
- * discovered rather than hand-composed. Config is read from the resolved
- * project root (not the invocation cwd) so a run from a subdirectory still
- * discovers the project's surfaces instead of silently finding nothing.
+ * discovered rather than hand-composed — and with `--only` retired, config
+ * presence is now the ONLY input. There is no longer a way for a caller to
+ * narrow the run, so there is no longer a way for a CI gate to ask for coverage
+ * it cannot get; the class of silent-coverage-loss bug the `--only` failure arms
+ * existed to catch is now unreachable by construction rather than guarded.
+ *
+ * `only` is still passed to {@link decidePhaseSelection} as `undefined`: that
+ * helper is shared with `vat build`, which keeps its own `--only`.
  */
-function buildPhaseList(only, projectRoot) {
-    const config = loadConfig(projectRoot);
+export function selectValidateSurfaces(config, verbose = false) {
+    // Forwarded to every surface, exactly as `vat verify` forwards its own. Both
+    // child validators already accept `-v, --verbose`; only this command lacked
+    // the flag, which made the collapsed warning/info detail unreachable HERE
+    // while the same findings were one `vat skills validate` away.
+    const detail = verbose ? ['--verbose'] : [];
     const phases = [];
-    if ((!only || only === 'resources') && config?.resources) {
-        phases.push({ name: 'resources', args: ['resources', 'validate'] });
+    if (config?.resources) {
+        phases.push({ name: 'resources', args: ['resources', 'validate', ...detail] });
     }
-    if ((!only || only === 'skills') && config?.skills) {
-        phases.push({ name: 'skills', args: ['skills', 'validate'] });
+    if (config?.skills) {
+        phases.push({ name: 'skills', args: ['skills', 'validate', ...detail] });
     }
-    return phases;
+    return decidePhaseSelection(undefined, phases, VALIDATE_VOCABULARY);
 }
-async function validateTopLevelCommand(options) {
+async function validateTopLevelCommand(options, command) {
+    // First, and before requireProjectRoot: `vat validate docs/` used to be
+    // accepted, have its path discarded, run wide over every configured surface
+    // and report success. Nothing below can un-tell that lie, so the run ends
+    // here. (`vat resources validate <path>` is the path-taking form.)
+    rejectPositionalArguments(command.args, COMMAND_NAME, 'validates every source surface vibe-agent-toolkit.config.yaml declares');
+    // Before requireProjectRoot: a retired flag is a usage error, and answering it
+    // with "no vibe-agent-toolkit.config.yaml found" would diagnose the wrong
+    // problem for anyone running the old invocation outside a project.
+    rejectRetiredOnly(options.only, COMMAND_NAME, VALIDATE_FULL_RUN_SECONDS);
     // requireProjectRoot returns the discovered root; read config from there so a
     // subdirectory invocation doesn't load an empty config and falsely pass.
-    const projectRoot = requireProjectRoot(process.cwd(), 'vat validate');
+    const projectRoot = requireProjectRoot(process.cwd(), COMMAND_NAME);
     const logger = createLogger(options.debug ? { debug: true } : {});
     const startTime = Date.now();
-    // `--only` failures — an unrecognized surface name, or a recognized name
-    // that just isn't configured — are both "you asked for a surface that
-    // can't run." Both must exit 1 (not fall through to the generic exit-2
-    // system-error path), so a CI gate differentiating "validation failed"
-    // from "system error" doesn't miss one of the two.
-    const failOnly = (message) => {
-        logger.error(message);
-        writeYamlOutput({
-            status: 'error',
-            phases: [],
-            error: message,
-            duration: `${Date.now() - startTime}ms`,
-        });
-        return process.exit(1);
-    };
     try {
-        if (options.only && !VALID_SURFACES.includes(options.only)) {
-            failOnly(`Unknown surface: ${options.only}. Valid surfaces: ${VALID_SURFACES.join(', ')}`);
-        }
-        const phases = buildPhaseList(options.only, projectRoot);
-        if (phases.length === 0) {
-            // An explicit `--only <surface>` that isn't configured is a failure: the
-            // caller asked for a specific validator that can't run, so a CI gate must
-            // not stay green.
-            if (options.only) {
-                failOnly(`Surface '${options.only}' is not configured in vibe-agent-toolkit.config.yaml — nothing to validate.`);
-            }
-            // A bare run with nothing configured is a clean no-op (exit 0, per
-            // issue #128's "doesn't check what it doesn't know about") — but silent
-            // success on stdout alone is indistinguishable, to anyone watching only
-            // the exit code, from a run that actually validated something. Warn on
-            // stderr so a config typo (e.g. `recources:`) doesn't masquerade as
-            // "all good."
-            logger.warn('No resources: or skills: block found in vibe-agent-toolkit.config.yaml — nothing to validate. If this is unexpected, check your config.');
-            writeYamlOutput({
-                status: 'success',
-                phases: [],
-                note: 'No configured validators (no resources or skills block in vibe-agent-toolkit.config.yaml).',
-                duration: `${Date.now() - startTime}ms`,
-            });
-            process.exit(0);
-        }
+        const phases = applyPhaseSelection(selectValidateSurfaces(loadConfig(projectRoot), options.verbose === true), logger, startTime);
         logger.info(`✅ vat validate (surfaces: ${phases.map((p) => p.name).join(' → ')})`);
         const binPath = resolveBinPath();
         const phaseResults = [];
@@ -155,8 +168,16 @@ async function validateTopLevelCommand(options) {
         // A surface whose validator could not RUN (exit 2, killed, never spawned)
         // is not a surface that failed validation: it exits 2, so a CI gate can
         // tell a broken config from a broken link.
+        // `issueCounts` beside `status` because a status alone cannot express a
+        // three-valued distribution, and this document published none at all: a
+        // consumer that wanted "did anything need acting on" had to either trust a
+        // bare `status` or hand-sum the phases. `status: warning` on a warnings-only
+        // repo is correct and deliberate — `success` means "nothing to act on", not
+        // "nothing to see" — so gate on `issueCounts.errors` or the exit code, both
+        // of which stay 0 through any number of warnings.
         writeYamlOutput({
             status: aggregatePhaseStatus(phaseResults),
+            issueCounts: aggregatePhaseIssueCounts(phaseResults),
             phases: phaseResults,
             duration: `${Date.now() - startTime}ms`,
         });

package/dist/commands/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,QAAQ,GAGT,MAAM,kBAAkB,CAAC;AAE1B,2EAA2E;AAC3E,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAU,CAAC;AAOxD,MAAM,UAAU,6BAA6B;IAC3C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAExC,OAAO;SACJ,WAAW,CAAC,mFAAmF,CAAC;SAChG,MAAM,CAAC,kBAAkB,EAAE,qDAAqD,CAAC;SACjF,MAAM,CAAC,SAAS,EAAE,sBAAsB,CAAC;SACzC,MAAM,CAAC,uBAAuB,CAAC;SAC/B,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCL,CACI,CAAC;IAEJ,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,IAAwB,EAAE,WAAmB;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,WAAW,CAAC,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,OAA+B;IACpE,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,mDAAmD;IACnD,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAS,EAAE;QAC1C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtB,eAAe,CAAC;YACd,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,OAAO;YACd,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI;SACxC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAuC,CAAC,EAAE,CAAC;YAC9F,QAAQ,CAAC,oBAAoB,OAAO,CAAC,IAAI,qBAAqB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAEzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,yEAAyE;YACzE,0EAA0E;YAC1E,kBAAkB;YAClB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,QAAQ,CAAC,YAAY,OAAO,CAAC,IAAI,8EAA8E,CAAC,CAAC;YACnH,CAAC;YAED,mEAAmE;YACnE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,oEAAoE;YACpE,cAAc;YACd,MAAM,CAAC,IAAI,CACT,yIAAyI,CAC1I,CAAC;YACF,eAAe,CAAC;gBACd,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,EAAE;gBACV,IAAI,EAAE,4FAA4F;gBAClG,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI;aACxC,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEnF,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,MAAM,YAAY,GAAkB,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1C,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,2CAA2C;QAC3C,eAAe,CAAC;YACd,MAAM,EAAE,oBAAoB,CAAC,YAAY,CAAC;YAC1C,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI;SACxC,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,QAAQ,GAKT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,2EAA2E;AAC3E,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAU,CAAC;AAExD,MAAM,mBAAmB,GAAoB;IAC3C,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,UAAU;IAChB,UAAU,EAAE,cAAc;IAC1B,IAAI,EAAE;QACJ,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,oEAAoE;QACpE,OAAO,EACL,yIAAyI;QAC3I,IAAI,EAAE,4FAA4F;KACnG;CACF,CAAC;AASF;;;GAGG;AACH,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,qEAAqE;AACrE,MAAM,YAAY,GAAG,cAAc,CAAC;AAEpC,MAAM,UAAU,6BAA6B;IAC3C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAExC,oBAAoB,CAAC,OAAO,CAAC;SAC1B,WAAW,CAAC,mFAAmF,CAAC;SAChG,MAAM,CAAC,SAAS,EAAE,sBAAsB,CAAC;SACzC,MAAM,CAAC,eAAe,EAAE,mDAAmD,CAAC;SAC5E,MAAM,CAAC,uBAAuB,CAAC;SAC/B,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkDL,CACI,CAAC;IAEJ,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAiC,EACjC,OAAO,GAAG,KAAK;IAEf,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,OAA+B,EAC/B,OAAgB;IAEhB,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,mEAAmE;IACnE,yBAAyB,CACvB,OAAO,CAAC,IAAI,EACZ,YAAY,EACZ,wEAAwE,CACzE,CAAC;IAEF,+EAA+E;IAC/E,0EAA0E;IAC1E,mEAAmE;IACnE,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,yBAAyB,CAAC,CAAC;IAEzE,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;IAEpE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAChC,sBAAsB,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,EACzE,MAAM,EACN,SAAS,CACV,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEnF,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,MAAM,YAAY,GAAkB,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1C,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,2CAA2C;QAC3C,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,4EAA4E;QAC5E,kDAAkD;QAClD,eAAe,CAAC;YACd,MAAM,EAAE,oBAAoB,CAAC,YAAY,CAAC;YAC1C,WAAW,EAAE,yBAAyB,CAAC,YAAY,CAAC;YACpD,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI;SACxC,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/dist/commands/verify.d.ts

@@ -5,11 +5,24 @@
  *   1. vat resources validate  (link integrity, collection schemas)
  *   2. vat skills validate     (SKILL.md frontmatter validation)
  *   3. vat claude marketplace validate  (strict marketplace validation, when configured)
- *   4. consistency check  (skill distribution integrity — package.json, plugin assignment)
+ *   4. files-config-dests  (in-process; every `files:` dest exists in the built output)
+ *   5. packaged-content  (in-process; built bundles carry nothing that must not ship)
+ *   6. consistency check  (in-process; skill distribution integrity — package.json, plugin assignment)
+ *
+ * 1–3 are subprocess phases chosen by {@link selectVerifyPhases}; 4–6 run here and
+ * are chosen by `selectInProcessVerifyPhases`. Both sets are config-gated, and both
+ * are announced on startup.
  */
+import { type ValidationIssue } from '@vibe-agent-toolkit/agent-schema';
+import type { ProjectConfig } from '@vibe-agent-toolkit/resources';
 import { Command } from 'commander';
+import { type ConsistencyIssueSeverity } from './consistency-check.js';
+import { type PhaseSelection } from './phase-utils.js';
+import type { DiscoveredSkill } from './skills/command-helpers.js';
 export interface VerifyCommandOptions {
+    /** Retired; declared only so {@link rejectRetiredOnly} can explain the removal. */
     only?: string;
+    verbose?: boolean;
     debug?: boolean;
 }
 export declare function createVerifyTopLevelCommand(): Command;
@@ -23,14 +36,108 @@ export interface FilesDestCheckResult {
 /**
  * Check that all dest paths from the merged files config exist in the built output.
  *
- * Checks each skill's dests in the location(s) where `vat build` actually wrote them:
- *   - Pool skills: `dist/skills/<fsName>/`            (only when that dir exists)
- *   - Tree-copy skills: `dist/.claude/plugins/.../skills/<name>/` (only when that dir exists)
- *
  * A dest is "missing" ONLY when absent from a candidate dir that exists. If a skill
  * has no existing candidate dir, it is not reported (build didn't run for that mode).
  *
+ * @param discovered - The skills this run discovered from `skills.include`. See
+ *   {@link collectBuiltSkillOutputs} for why it is required rather than optional.
  * @returns One result per (skill, outputDir) pair where dests are absent.
  */
-export declare function checkFilesConfigDests(cwd: string): FilesDestCheckResult[];
+export declare function checkFilesConfigDests(cwd: string, discovered: readonly DiscoveredSkill[]): FilesDestCheckResult[];
+/**
+ * Crawl every built skill bundle for repo-internal agent-instruction files.
+ *
+ * The built-skill-bundle arm of `PACKAGED_AGENT_INSTRUCTION_FILE`. Its description
+ * has always claimed three surfaces — a built skill bundle, an installed plugin, a
+ * plugin source directory — but only the two plugin arms had a producer: the skill
+ * lanes inspect SKILL.md plus what links reach from it, so a file that arrives in a
+ * bundle with no link at all was invisible to every command. Measured on an adopter
+ * bundle carrying two of them: `vat audit` reported `filesScanned: 1`, zero issues,
+ * and `vat verify` reported `warnings: 0`.
+ *
+ * UNCONDITIONAL here, with no provenance test: `vat verify` reads the built `dist/`
+ * tree by definition, so every tree this enumerates is distributed output. (`vat
+ * audit` takes an arbitrary path and therefore must answer the provenance question
+ * first — see `appendDistributedTreeFindings` in audit.ts.)
+ *
+ * Explicit `files:` dests are exempt (§8.2): here the config is knowable, and
+ * naming a dest is an instruction to ship that file. A glob match never earns the
+ * exemption — a glob is a net, not a declaration — which is why the exempt set
+ * comes from {@link explicitFilesConfigDests} rather than from every `files:` entry.
+ *
+ * Each bundle's findings are then resolved against that skill's effective
+ * `validation.severity` (see {@link resolveIssueSeverity}), so the opt-out the
+ * code's own `fix` text prescribes actually works here. It did not: this phase
+ * published `detectPackagedAgentInstructionFiles`' raw output straight into the
+ * document, so `severity.PACKAGED_AGENT_INSTRUCTION_FILE: ignore` changed nothing
+ * — measured `warnings: 1` with the override at `skills.defaults`, at
+ * `skills.config.<name>`, and with no override at all.
+ *
+ * `validation.allow` is deliberately NOT applied. Allow is a per-PATH suppression
+ * whose usage is only answerable across a whole run, and this phase would have to
+ * drain a ledger it is not the run of — reporting ALLOW_UNUSED for every entry the
+ * project declares for other lanes. Severity is answerable per unit of work; allow
+ * is not. See `AllowUsageLedger` in `@vibe-agent-toolkit/agent-schema`.
+ *
+ * Locations anchor at `cwd`, the run's stated root, so a reader can open them.
+ *
+ * @param discovered - The skills this run discovered from `skills.include`. See
+ *   {@link collectBuiltSkillOutputs} for why it is required rather than optional.
+ */
+export declare function checkPackagedAgentInstructionFiles(cwd: string, discovered: readonly DiscoveredSkill[]): ValidationIssue[];
+/**
+ * Decide which verification phases to run.
+ *
+ * Config-gated, exactly as `vat validate` is. It used to push `resources` and
+ * `skills` unconditionally, so `vat verify --only skills` in a project with no
+ * `skills:` block exited 0 while `vat validate --only skills` on the same
+ * project exited 1 — same question, opposite verdicts, and a CI gate pinned to
+ * the verify form stayed green forever the moment the config key was renamed.
+ *
+ * `--only` is gone from this command entirely. Measured on a 90-skill project a
+ * full `vat verify` is ~32s, of which the two slowest phases are ~28s — the
+ * filter bought at most ~18s and repeatedly bought a wrong answer with it. Every
+ * run is now a whole run, and `only` is passed to {@link decidePhaseSelection}
+ * as `undefined` (that helper still routes `--only` for `vat validate` and
+ * `vat build`).
+ *
+ * @param configError - The config-load failure, when the config could not be
+ *   read. Every subprocess phase still runs so the CHILD reports the real
+ *   config error (exit 2) instead of this command guessing.
+ * @param verbose - Forwarded to each subprocess phase as `--verbose`. The
+ *   children own their own summarization; this command only relays the request.
+ */
+export declare function selectVerifyPhases(config: ProjectConfig | undefined, configError?: string, verbose?: boolean): PhaseSelection;
+/**
+ * The startup announcement: every phase this run will inspect something with,
+ * in order. A phase that would consult nothing is not named.
+ */
+export declare function formatVerifyAnnouncement(subprocessPhaseNames: readonly string[], config: ProjectConfig | undefined): string;
+/** An in-process phase's finding as it appears in the archived YAML. */
+interface PublishedIssue {
+    severity: ValidationIssue['severity'] | ConsistencyIssueSeverity;
+    code: string;
+    message: string;
+    fix: string;
+    /** Project-relative path of the file to open. Absent when the finding has none. */
+    location?: string;
+    /** 1-based line within {@link PublishedIssue.location}. */
+    line?: number;
+    /** Doc link the code's registry entry carries. */
+    reference?: string;
+}
+/**
+ * Project ONE finding into the archived YAML.
+ *
+ * The whole anchor rides along. This shape used to be `{severity, code, message,
+ * fix}` and the projection destructured exactly those four, so every
+ * `packaged-content` finding reached the document with no `location` — the same
+ * defect this PR fixed one command over in `vat skills build`, where a published
+ * count carried "no `code`, no location and no fix string at ANY verbosity". It
+ * looked survivable only because `materializeIssue` happens to interpolate the
+ * detail into `message` for this one code; that is a coincidence, not a contract,
+ * and stderr is not the document a CI consumer parses.
+ */
+export declare function toPublishedIssue(issue: ValidationIssue): PublishedIssue;
+export {};
 //# sourceMappingURL=verify.d.ts.map

package/dist/commands/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuBpC,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAgB,2BAA2B,IAAI,OAAO,CAqDrD;AAED,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAwCD;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,EAAE,CAkDzE"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,kCAAkC,CAAC;AAO1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWpC,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAWL,KAAK,cAAc,EAEpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAGnE,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAYD,wBAAgB,2BAA2B,IAAI,OAAO,CAqFrD;AAED,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAyID;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,SAAS,eAAe,EAAE,GACrC,oBAAoB,EAAE,CAmBxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,SAAS,eAAe,EAAE,GACrC,eAAe,EAAE,CAWnB;AAwGD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,OAAO,GAChB,cAAc,CA6BhB;AA4CD;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,oBAAoB,EAAE,SAAS,MAAM,EAAE,EACvC,MAAM,EAAE,aAAa,GAAG,SAAS,GAChC,MAAM,CAGR;AAED,wEAAwE;AACxE,UAAU,cAAc;IAGtB,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,GAAG,wBAAwB,CAAC;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,cAAc,CAavE"}