@vibe-agent-toolkit/cli 0.2.0-rc.10 → 0.2.0-rc.12

package/dist/commands/ard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/ard/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAI5C,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,aAAa,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,KAAK,oBAAoB,EAAE,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEtG,yCAAyC;AACzC,wBAAgB,gBAAgB,IAAI,OAAO,CAgF1C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/ard/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAI5C,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,aAAa,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,KAAK,oBAAoB,EAAE,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEtG,yCAAyC;AACzC,wBAAgB,gBAAgB,IAAI,OAAO,CAuF1C"}

package/dist/commands/ard/index.js

@@ -61,16 +61,23 @@ Requirements:
                  \`data\` and emission fails.
 
 Exit Codes:
-  0 - Manifest written — INCLUDING one that advertises nothing. An empty
-      \`entries\` list is a legal ARD document, and skipped surfaces are reported
-      on stderr at this exit code. Gate on \`--format json\` (the report
-      envelope: \`examined\`, \`findings\`, \`summary\`, \`data.entryCount\`,
-      \`data.skippedCount\`; schema: packages/cli/schemas/ard-emit.json), or
-      make both conditions fail with \`--strict\`
-  1 - No \`ard:\` block in the config, or a surface could not be derived. Under
-      \`--strict\`, also an empty manifest or a skipped surface
-  2 - System error (no project root, no config file, invalid config, unexpected
-      internal failure)
+  0 - Manifest written over at least one configured surface. Skipped surfaces
+      are reported on stderr at this exit code. Gate on \`--format json\` (the
+      report envelope: \`examined\`, \`findings\`, \`summary\`, \`gate\`,
+      \`data.entryCount\`, \`data.skippedCount\`; schema:
+      packages/cli/schemas/ard-emit.json), or make skips fail with \`--strict\`
+  1 - No \`ard:\` block, or a surface that could not be derived — each an
+      error-severity finding about the PROJECT (ARD_NOT_CONFIGURED,
+      ARD_DERIVATION_FAILED), with \`data.outputPath\` null as nothing was
+      written. An \`ard:\` block that reaches no surface at all examined
+      nothing, and is refused (RESOURCE_CHECK_BROKEN). Under \`--strict\`, also
+      an empty manifest or a skipped surface (ARD_STRICT_REFUSED). The code is
+      derived from the published report, never chosen beside it
+  2 - The command could not do its job; \`error.code\` says which: USAGE_INVALID
+      (no such project root), CONFIG_INVALID (no config file, or one that does
+      not parse), INPUT_UNREADABLE (a config the OS will not read),
+      RUN_INCOMPLETE (the OS refused the --output write), INTERNAL_ERROR (a
+      VAT defect)
 
 Example:
   $ vat ard emit --format json --strict

package/dist/commands/ard/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/ard/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/D,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,qBAAqB,EACrB,kBAAkB,GAEnB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAqD,MAAM,eAAe,CAAC;AAEtG,yCAAyC;AACzC,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IAE/B,GAAG,CAAC,WAAW,CAAC,oEAAoE,CAAC,CAAC,WAAW,CAC/F,OAAO,EACP;;;;;;;CAOH,CACE,CAAC;IAEF,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,6CAA6C,CAAC;SAC1D,MAAM,CAAC,qBAAqB,EAAE,yBAAyB,kBAAkB,GAAG,CAAC;SAC7E,MAAM,CAAC,sBAAsB,EAAE,qDAAqD,CAAC;SACrF,SAAS;IACR,sEAAsE;IACtE,sEAAsE;IACtE,2DAA2D;IAC3D,IAAI,MAAM,CAAC,mBAAmB,EAAE,uCAAuC,CAAC;SACrE,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACzB,OAAO,CAAC,MAAM,CAAC,CACnB;SACA,MAAM,CACL,UAAU,EACV,kFAAkF,CACnF;SACA,MAAM,CAAC,SAAS,EAAE,2BAA2B,CAAC;SAC9C,MAAM,CAAC,cAAc,CAAC;SACtB,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCL,CACI,CAAC;IAEJ,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/ard/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/D,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,qBAAqB,EACrB,kBAAkB,GAEnB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAqD,MAAM,eAAe,CAAC;AAEtG,yCAAyC;AACzC,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IAE/B,GAAG,CAAC,WAAW,CAAC,oEAAoE,CAAC,CAAC,WAAW,CAC/F,OAAO,EACP;;;;;;;CAOH,CACE,CAAC;IAEF,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,6CAA6C,CAAC;SAC1D,MAAM,CAAC,qBAAqB,EAAE,yBAAyB,kBAAkB,GAAG,CAAC;SAC7E,MAAM,CAAC,sBAAsB,EAAE,qDAAqD,CAAC;SACrF,SAAS;IACR,sEAAsE;IACtE,sEAAsE;IACtE,2DAA2D;IAC3D,IAAI,MAAM,CAAC,mBAAmB,EAAE,uCAAuC,CAAC;SACrE,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACzB,OAAO,CAAC,MAAM,CAAC,CACnB;SACA,MAAM,CACL,UAAU,EACV,kFAAkF,CACnF;SACA,MAAM,CAAC,SAAS,EAAE,2BAA2B,CAAC;SAC9C,MAAM,CAAC,cAAc,CAAC;SACtB,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CL,CACI,CAAC;IAEJ,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/commands/audit/compat-lane-findings.d.ts

@@ -0,0 +1,65 @@
+/**
+ * What the `--compat` and `--settings` lanes of `vat audit` found, as findings.
+ *
+ * The lanes publish their answers as blocks on the plugin's row (`data.files[].compatibility`,
+ * `.settings`). A block is not a finding: a plugin whose skill the org policy blocks was
+ * `status: ok`, `findings: []`, `summary: {0, 0, 0}` beside a stderr line saying a conflict was
+ * found — the human channel and the document disagreeing about one run. Each thing a lane found,
+ * and each thing it could not look at, is therefore ALSO a finding on the plugin's own result, so
+ * the envelope's status, the row's status and the file counts are derived from it like any other.
+ *
+ * Pure: it reads the rendered blocks and decides nothing about severity at run time.
+ */
+import type { ValidationIssue } from '@vibe-agent-toolkit/schema';
+/** A path a lane never examined, as the document renders it: root-relative, with the reason. */
+interface UncheckedPath {
+    readonly path: string;
+    readonly reason: string;
+}
+/** As much of the two rendered blocks as a finding is derived from. */
+export interface CompatLaneAnswer {
+    /** The analyzer's block: its unchecked paths, or the reason it could not run for the plugin at all. */
+    readonly compatibility: {
+        readonly analyzed: false;
+        readonly reason: string;
+    } | {
+        readonly unchecked: readonly UncheckedPath[];
+    };
+    /** The settings block, present iff the run asked for `--settings`. */
+    readonly settings?: {
+        readonly compatible: boolean;
+        readonly conflicts: ReadonlyArray<{
+            readonly detail: string;
+            readonly settingsFile: string;
+            readonly settingsLevel: string;
+        }>;
+        readonly unchecked?: readonly UncheckedPath[];
+    };
+}
+/** A finding the document already carries: as much of it as the dedupe reads. */
+export interface FiledFinding {
+    readonly code: string;
+    readonly location: string;
+}
+/**
+ * The findings one plugin's lane answers amount to:
+ *
+ * - `SETTINGS_POLICY_CONFLICT` for each settings conflict — a tool, a hook, an MCP server or a
+ *   model the plugin declares and the effective settings block — on the plugin;
+ * - `COMPAT_NOT_CHECKED` when the analyzer could not run for the plugin at all, on the plugin;
+ * - `COMPAT_NOT_CHECKED` for each path a lane could not examine, at that path — unless the
+ *   document already carries that path's refusal ({@link SAME_REFUSAL_CODES}), or this call has
+ *   just filed the plugin itself as not checked: one refused path is one finding, however many
+ *   lanes met it.
+ *
+ * Each is a `warning`: the lanes are advisory, as `COMPAT_TARGET_INCOMPATIBLE` and the sibling
+ * verb's `SETTINGS_RULE_SHADOWED` are, so they move the status and the counts and never the exit code.
+ *
+ * @param pluginLocation - The plugin's own row path, root-relative (`.` for the scan root)
+ * @param answer - The two blocks as the document renders them
+ * @param filed - Every finding the document already carries, each with the location it is published at
+ * @returns The lanes' findings for this plugin, conflicts first
+ */
+export declare function compatLaneIssues(pluginLocation: string, answer: CompatLaneAnswer, filed: readonly FiledFinding[]): ValidationIssue[];
+export {};
+//# sourceMappingURL=compat-lane-findings.d.ts.map

package/dist/commands/audit/compat-lane-findings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat-lane-findings.d.ts","sourceRoot":"","sources":["../../../src/commands/audit/compat-lane-findings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAElE,gGAAgG;AAChG,UAAU,aAAa;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,uGAAuG;IACvG,QAAQ,CAAC,aAAa,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAA;KAAE,CAAC;IACjI,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;QAC7B,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;YAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC9H,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;KAC/C,CAAC;CACH;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAyBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,eAAe,EAAE,CAiBpI"}

package/dist/commands/audit/compat-lane-findings.js

@@ -0,0 +1,72 @@
+/**
+ * What the `--compat` and `--settings` lanes of `vat audit` found, as findings.
+ *
+ * The lanes publish their answers as blocks on the plugin's row (`data.files[].compatibility`,
+ * `.settings`). A block is not a finding: a plugin whose skill the org policy blocks was
+ * `status: ok`, `findings: []`, `summary: {0, 0, 0}` beside a stderr line saying a conflict was
+ * found — the human channel and the document disagreeing about one run. Each thing a lane found,
+ * and each thing it could not look at, is therefore ALSO a finding on the plugin's own result, so
+ * the envelope's status, the row's status and the file counts are derived from it like any other.
+ *
+ * Pure: it reads the rendered blocks and decides nothing about severity at run time.
+ */
+/**
+ * The codes that already SAY "this path was not read": the scan's own refusal of it, the
+ * validator's refusal of its frontmatter (the settings check lists that same file as unchecked),
+ * and this lane's own finding for another plugin that holds the path. Only a finding of one of
+ * these at a path makes a `COMPAT_NOT_CHECKED` there a repeat — an unrelated finding that happens
+ * to sit at the same location says nothing about whether the lanes read it.
+ */
+const SAME_REFUSAL_CODES = new Set(['SCAN_PATH_UNREADABLE', 'SKILL_MISSING_FRONTMATTER', 'COMPAT_NOT_CHECKED']);
+const NOT_CHECKED_FIX = 'Make the path readable and well-formed, then re-run; until then the compatibility and settings answers for this plugin do not cover it.';
+function notChecked(location, message) {
+    return { code: 'COMPAT_NOT_CHECKED', severity: 'warning', message, location, fix: NOT_CHECKED_FIX };
+}
+/** Every path either lane could not examine, each once, with the first reason given for it. */
+function uncheckedPaths(answer) {
+    const byPath = new Map();
+    const all = ['unchecked' in answer.compatibility ? answer.compatibility.unchecked : [], answer.settings?.unchecked ?? []].flat();
+    for (const unchecked of all)
+        if (!byPath.has(unchecked.path))
+            byPath.set(unchecked.path, unchecked);
+    return [...byPath.values()];
+}
+/**
+ * The findings one plugin's lane answers amount to:
+ *
+ * - `SETTINGS_POLICY_CONFLICT` for each settings conflict — a tool, a hook, an MCP server or a
+ *   model the plugin declares and the effective settings block — on the plugin;
+ * - `COMPAT_NOT_CHECKED` when the analyzer could not run for the plugin at all, on the plugin;
+ * - `COMPAT_NOT_CHECKED` for each path a lane could not examine, at that path — unless the
+ *   document already carries that path's refusal ({@link SAME_REFUSAL_CODES}), or this call has
+ *   just filed the plugin itself as not checked: one refused path is one finding, however many
+ *   lanes met it.
+ *
+ * Each is a `warning`: the lanes are advisory, as `COMPAT_TARGET_INCOMPATIBLE` and the sibling
+ * verb's `SETTINGS_RULE_SHADOWED` are, so they move the status and the counts and never the exit code.
+ *
+ * @param pluginLocation - The plugin's own row path, root-relative (`.` for the scan root)
+ * @param answer - The two blocks as the document renders them
+ * @param filed - Every finding the document already carries, each with the location it is published at
+ * @returns The lanes' findings for this plugin, conflicts first
+ */
+export function compatLaneIssues(pluginLocation, answer, filed) {
+    const refused = new Set(filed.filter((finding) => SAME_REFUSAL_CODES.has(finding.code)).map((finding) => finding.location));
+    const issues = (answer.settings?.conflicts ?? []).map((conflict) => ({
+        code: 'SETTINGS_POLICY_CONFLICT',
+        severity: 'warning',
+        message: `${conflict.detail} — ${conflict.settingsFile} (${conflict.settingsLevel} settings).`,
+        location: pluginLocation,
+        fix: 'Remove what the policy blocks from the plugin, or change the settings rule the message names.',
+    }));
+    if ('analyzed' in answer.compatibility) {
+        issues.push(notChecked(pluginLocation, `The compatibility analysis could not run for this plugin, so the run has no compatibility answer for it: ${answer.compatibility.reason}`));
+        refused.add(pluginLocation);
+    }
+    for (const { path, reason } of uncheckedPaths(answer)) {
+        if (!refused.has(path))
+            issues.push(notChecked(path, `The compatibility and settings checks could not examine this path, so their answers for the plugin do not cover it: ${reason}`));
+    }
+    return issues;
+}
+//# sourceMappingURL=compat-lane-findings.js.map

package/dist/commands/audit/compat-lane-findings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat-lane-findings.js","sourceRoot":"","sources":["../../../src/commands/audit/compat-lane-findings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA4BH;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,sBAAsB,EAAE,2BAA2B,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAErI,MAAM,eAAe,GAAG,yIAAyI,CAAC;AAElK,SAAS,UAAU,CAAC,QAAgB,EAAE,OAAe;IACnD,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;AACtG,CAAC;AAED,+FAA+F;AAC/F,SAAS,cAAc,CAAC,MAAwB;IAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,MAAM,GAAG,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjI,KAAK,MAAM,SAAS,IAAI,GAAG;QAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAAC,cAAsB,EAAE,MAAwB,EAAE,KAA8B;IAC/G,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5H,MAAM,MAAM,GAAsB,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAmB,EAAE,CAAC,CAAC;QACvG,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC,aAAa,aAAa;QAC9F,QAAQ,EAAE,cAAc;QACxB,GAAG,EAAE,+FAA+F;KACrG,CAAC,CAAC,CAAC;IACJ,IAAI,UAAU,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,4GAA4G,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACnL,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,uHAAuH,MAAM,EAAE,CAAC,CAAC,CAAC;IACzL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/commands/audit/distributed-tree.d.ts

@@ -188,7 +188,7 @@ export declare function isWithin(root: string, absolutePath: string): boolean;
  * Classify the tree holding `skillMdPath`. See this module's header for the
  * reasoning behind each clause and the order they are applied in.
  */
-export declare function classifyScannedSkillTree(skillMdPath: string): Promise<SkillTreeProvenance>;
+export declare function classifyScannedSkillTree(skillMdPath: string, within: string): Promise<SkillTreeProvenance>;
 /**
  * Will a crawl rooted at this SKILL.md's directory actually report the WHOLE
  * subtree beneath it — nested skills included?
@@ -203,7 +203,7 @@ export declare function classifyScannedSkillTree(skillMdPath: string): Promise<S
  * skill, and a scan rooted above `<claudeDir>/skills` reaches an install root
  * from outside one.
  */
-export declare function crawlOwnsSubtree(skillMdPath: string): Promise<boolean>;
+export declare function crawlOwnsSubtree(skillMdPath: string, within: string): Promise<boolean>;
 /**
  * The agent-instruction files present in a skill's own directory, when that
  * directory is a distributed tree. Empty otherwise — including when the caller

package/dist/commands/audit/distributed-tree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distributed-tree.d.ts","sourceRoot":"","sources":["../../../src/commands/audit/distributed-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AAGH,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AACnG,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAOlE,OAAO,EAEL,UAAU,EACX,MAAM,+BAA+B,CAAC;AAKvC;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAShF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,eAAO,MAAM,wBAAwB,EAAE,gBActC,CAAC;AAcF,iEAAiE;AACjE,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,aAAa,GAAG,eAAe,CAAC;AAmClF;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAIpE;AAkBD;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAShG;AA0BD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE5E;AA+BD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC,eAAe,EAAE,CAAC,CAuB5B"}
+{"version":3,"file":"distributed-tree.d.ts","sourceRoot":"","sources":["../../../src/commands/audit/distributed-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AAGH,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AACnG,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAOlE,OAAO,EAEL,UAAU,EACX,MAAM,+BAA+B,CAAC;AAKvC;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAShF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,eAAO,MAAM,wBAAwB,EAAE,gBAmBtC,CAAC;AAcF,iEAAiE;AACjE,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,aAAa,GAAG,eAAe,CAAC;AAsClF;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAIpE;AAmBD;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAShH;AA0BD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE5F;AA+BD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC,eAAe,EAAE,CAAC,CAuB5B"}

package/dist/commands/audit/distributed-tree.js

@@ -168,10 +168,16 @@ export async function getOrCreateGitTracker(gitRoot) {
  * {@link resetGitTrackerCache} itself between phases, exactly as this module's
  * own tests do in `beforeEach`.
  */
-export const gitTrackerForProjectRoot = async (projectRoot) => {
-    const gitRoot = gitFindRoot(projectRoot);
+export const gitTrackerForProjectRoot = (projectRoot) => {
+    let gitRoot;
+    try {
+        gitRoot = gitFindRoot(projectRoot);
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
     if (gitRoot === null) {
-        return undefined;
+        return Promise.resolve(undefined);
     }
     // No catch, deliberately. "Not a repository" and "git did not answer" are
     // both absorbed INSIDE `GitTracker.initialize()` (a null listing, a tracker
@@ -226,9 +232,12 @@ const REPO_SOURCE = 'repo-source';
  * Canonicalising the SKILL.md before deriving the git root is what keeps the
  * second fix honest — the tracker's own keys are built from the root it is given,
  * so a canonical lookup against a non-canonical root would miss every time.
+ *
+ * @param within - The tree `filePath` was crawled in (the audit's scan root), whose links are read
+ *   before the kernel follows them; `filePath` itself when it is the operator's own path
  */
-function canonicalPath(filePath) {
-    return toForwardSlash(normalizePath(safePath.resolve(filePath)));
+function canonicalPath(filePath, within) {
+    return toForwardSlash(normalizePath(safePath.resolve(filePath), within));
 }
 /**
  * True when `absolutePath` is `root` or lies beneath it.
@@ -258,14 +267,16 @@ function isUnderClaudeInstallRoot(canonicalAbsolutePath) {
     const { pluginsDir, skillsDir, marketplacesDir } = getClaudeUserPaths();
     // marketplacesDir is nested under pluginsDir; listed anyway so the set reads as
     // the three install destinations rather than as an accident of layout.
-    return [pluginsDir, skillsDir, marketplacesDir].some((dir) => isWithin(canonicalPath(dir), canonicalAbsolutePath));
+    return [pluginsDir, skillsDir, marketplacesDir].some((dir) => 
+    // An install root is the operator's own configuration (`CLAUDE_CONFIG_DIR`/`HOME`), never a crawled entry.
+    isWithin(canonicalPath(dir, dir), canonicalAbsolutePath));
 }
 /**
  * Classify the tree holding `skillMdPath`. See this module's header for the
  * reasoning behind each clause and the order they are applied in.
  */
-export async function classifyScannedSkillTree(skillMdPath) {
-    const absolute = canonicalPath(skillMdPath);
+export async function classifyScannedSkillTree(skillMdPath, within) {
+    const absolute = canonicalPath(skillMdPath, within);
     const memoized = provenanceCache.get(absolute);
     if (memoized !== undefined) {
         return memoized;
@@ -309,8 +320,8 @@ async function classifyUncached(absolute) {
  * skill, and a scan rooted above `<claudeDir>/skills` reaches an install root
  * from outside one.
  */
-export async function crawlOwnsSubtree(skillMdPath) {
-    return (await classifyScannedSkillTree(skillMdPath)) !== REPO_SOURCE;
+export async function crawlOwnsSubtree(skillMdPath, within) {
+    return (await classifyScannedSkillTree(skillMdPath, within)) !== REPO_SOURCE;
 }
 /**
  * The tree's own directory, spelled as a location a reader can act on.
@@ -365,11 +376,11 @@ function treeLocation(treeRoot, locationRoot) {
 export async function distributedTreeFindings(skillPath, locationRoot, crawlTree) {
     if (!crawlTree)
         return [];
-    const provenance = await classifyScannedSkillTree(skillPath);
+    const provenance = await classifyScannedSkillTree(skillPath, locationRoot);
     if (provenance === REPO_SOURCE)
         return [];
     const treeRoot = safePath.resolve(skillPath, '..');
-    const present = detectPackagedAgentInstructionFiles(treeRoot, locationRoot, []);
+    const present = detectPackagedAgentInstructionFiles(treeRoot, locationRoot, [], []);
     if (provenance === 'distributed')
         return present;
     // Provenance is unknown. Report the unknown, not the files: calling them

package/dist/commands/audit/distributed-tree.js.map

@@ -1 +1 @@
-{"version":3,"file":"distributed-tree.js","sourceRoot":"","sources":["../../../src/commands/audit/distributed-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AAEH,OAAO,EAAE,mCAAmC,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzG,OAAO,EAAE,kBAAkB,EAAyB,MAAM,wCAAwC,CAAC;AAEnG,OAAO,EACL,aAAa,EACb,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,WAAW,EACX,UAAU,GACX,MAAM,+BAA+B,CAAC;AAEvC,iFAAiF;AACjF,MAAM,eAAe,GAA4B,IAAI,GAAG,EAAE,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAe;IACzD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC3B,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAqB,KAAK,EAAE,WAAW,EAAE,EAAE;IAC9E,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,sCAAsC;IACtC,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,eAAe,GAAqC,IAAI,GAAG,EAAE,CAAC;AAEpE,iEAAiE;AACjE,MAAM,UAAU,oBAAoB;IAClC,eAAe,CAAC,KAAK,EAAE,CAAC;IACxB,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,WAAW,GAAwB,aAAa,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,cAAc,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,YAAoB;IACzD,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IACpD,OAAO,cAAc,KAAK,cAAc,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,qBAA6B;IAC7D,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACxE,gFAAgF;IAChF,uEAAuE;IACvE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAC3D,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CACpD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,WAAmB;IAChE,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC9C,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACrD,gFAAgF;IAChF,oEAAoE;IACpE,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,oCAAoC;IACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QACxB,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACxD,OAAO,CAAC,MAAM,wBAAwB,CAAC,WAAW,CAAC,CAAC,KAAK,WAAW,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,YAAY,CAAC,QAAgB,EAAE,YAAoB;IAC1D,OAAO,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,GAAG,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAiB,EACjB,YAAoB,EACpB,SAAkB;IAElB,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,UAAU,KAAK,WAAW;QAAE,OAAO,EAAE,CAAC;IAE1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,mCAAmC,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,UAAU,KAAK,aAAa;QAAE,OAAO,OAAO,CAAC;IAEjD,yEAAyE;IACzE,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,8EAA8E;IAC9E,2EAA2E;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACtD,OAAO;QACL,gBAAgB,CAAC,+BAA+B,EAAE;YAChD,QAAQ;YACR,MAAM,EAAE,GAAG,QAAQ,KAAK,OAAO,CAAC,MAAM,iDAAiD;SACxF,CAAC;KACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"distributed-tree.js","sourceRoot":"","sources":["../../../src/commands/audit/distributed-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AAEH,OAAO,EAAE,mCAAmC,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzG,OAAO,EAAE,kBAAkB,EAAyB,MAAM,wCAAwC,CAAC;AAEnG,OAAO,EACL,aAAa,EACb,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,WAAW,EACX,UAAU,GACX,MAAM,+BAA+B,CAAC;AAEvC,iFAAiF;AACjF,MAAM,eAAe,GAA4B,IAAI,GAAG,EAAE,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAe;IACzD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC3B,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAqB,CAAC,WAAW,EAAE,EAAE;IACxE,IAAI,OAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAc,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,sCAAsC;IACtC,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,eAAe,GAAqC,IAAI,GAAG,EAAE,CAAC;AAEpE,iEAAiE;AACjE,MAAM,UAAU,oBAAoB;IAClC,eAAe,CAAC,KAAK,EAAE,CAAC;IACxB,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,WAAW,GAAwB,aAAa,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,aAAa,CAAC,QAAgB,EAAE,MAAc;IACrD,OAAO,cAAc,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,YAAoB;IACzD,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IACpD,OAAO,cAAc,KAAK,cAAc,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,qBAA6B;IAC7D,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACxE,gFAAgF;IAChF,uEAAuE;IACvE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;IAC3D,2GAA2G;IAC3G,QAAQ,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,qBAAqB,CAAC,CACzD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,WAAmB,EAAE,MAAc;IAChF,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC9C,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACrD,gFAAgF;IAChF,oEAAoE;IACpE,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,oCAAoC;IACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QACxB,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,WAAmB,EAAE,MAAc;IACxE,OAAO,CAAC,MAAM,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,KAAK,WAAW,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,YAAY,CAAC,QAAgB,EAAE,YAAoB;IAC1D,OAAO,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,GAAG,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAiB,EACjB,YAAoB,EACpB,SAAkB;IAElB,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC3E,IAAI,UAAU,KAAK,WAAW;QAAE,OAAO,EAAE,CAAC;IAE1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,mCAAmC,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACpF,IAAI,UAAU,KAAK,aAAa;QAAE,OAAO,OAAO,CAAC;IAEjD,yEAAyE;IACzE,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,8EAA8E;IAC9E,2EAA2E;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACtD,OAAO;QACL,gBAAgB,CAAC,+BAA+B,EAAE;YAChD,QAAQ;YACR,MAAM,EAAE,GAAG,QAAQ,KAAK,OAAO,CAAC,MAAM,iDAAiD;SACxF,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/commands/audit/git-url-clone.d.ts

@@ -2,12 +2,13 @@
  * Shallow-clone-and-cleanup helper for `vat audit <git-url>`.
  *
  * Pipeline:
- *  1. mkdtempSync('vat-audit-')
- *  2. install SIGINT handler that removes the tempdir
+ *  1. makeStagingDir('vat-audit-')
+ *  2. guard every terminating signal: dispose of the tempdir, then die of it — held until the
+ *     tempdir's one disposal (step 6, or the signal's own) has settled
  *  3. git clone --depth 1 --single-branch [--branch <ref>]
  *  4. git rev-parse HEAD → resolved commit SHA
  *  5. yield (tempdir, targetDir, provenance) to caller
- *  6. cleanup in finally — always rm tempdir unless `keepTempForDebug`
+ *  6. dispose of the tempdir, success or failure, unless `keepTempForDebug`
  */
 import { type ParsedGitUrl } from '@vibe-agent-toolkit/utils/git';
 import type { Provenance } from './provenance.js';
@@ -24,9 +25,16 @@ export interface CloneOptions {
     keepTempForDebug: boolean;
 }
 /**
- * Run `body` against a freshly shallow-cloned repo. Always cleans up the
- * tempdir unless `options.keepTempForDebug` is true. Re-raises any error
- * from the clone or from `body`.
+ * Run `body` against a freshly shallow-cloned repo, then dispose of the clone (unless
+ * `options.keepTempForDebug`). `body` must not end the process itself: a caller that exits
+ * does so once this has settled.
+ *
+ * A failure of the clone or of `body` is rethrown unchanged, a clone that will not go recorded
+ * beside it (`suppressedFaultsOf`). Once `body` succeeded, a clone the OS would not remove is
+ * returned as `leftover` beside its value — the work is done, so it is never the refusal.
  */
-export declare function withClonedRepo<T>(parsed: ParsedGitUrl, options: CloneOptions, body: (ctx: CloneAndAuditContext) => Promise<T>): Promise<T>;
+export declare function withClonedRepo<T>(parsed: ParsedGitUrl, options: CloneOptions, body: (ctx: CloneAndAuditContext) => Promise<T>): Promise<{
+    readonly value: T;
+    readonly leftover: unknown;
+}>;
 //# sourceMappingURL=git-url-clone.d.ts.map

package/dist/commands/audit/git-url-clone.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-url-clone.d.ts","sourceRoot":"","sources":["../../../src/commands/audit/git-url-clone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,CAAC,EACpC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,CAAC,GAAG,EAAE,oBAAoB,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9C,OAAO,CAAC,CAAC,CAAC,CAgDZ"}
+{"version":3,"file":"git-url-clone.d.ts","sourceRoot":"","sources":["../../../src/commands/audit/git-url-clone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAMlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAkCD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,CAAC,EACpC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,CAAC,GAAG,EAAE,oBAAoB,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9C,OAAO,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CAoD5D"}

package/dist/commands/audit/git-url-clone.js

@@ -2,57 +2,99 @@
  * Shallow-clone-and-cleanup helper for `vat audit <git-url>`.
  *
  * Pipeline:
- *  1. mkdtempSync('vat-audit-')
- *  2. install SIGINT handler that removes the tempdir
+ *  1. makeStagingDir('vat-audit-')
+ *  2. guard every terminating signal: dispose of the tempdir, then die of it — held until the
+ *     tempdir's one disposal (step 6, or the signal's own) has settled
  *  3. git clone --depth 1 --single-branch [--branch <ref>]
  *  4. git rev-parse HEAD → resolved commit SHA
  *  5. yield (tempdir, targetDir, provenance) to caller
- *  6. cleanup in finally — always rm tempdir unless `keepTempForDebug`
+ *  6. dispose of the tempdir, success or failure, unless `keepTempForDebug`
  */
-import { mkdtempSync, rmSync } from 'node:fs';
 import { cloneGitSource } from '@vibe-agent-toolkit/agent-skills';
-import { normalizedTmpdir, safePath } from '@vibe-agent-toolkit/utils';
+import { ExitCode } from '@vibe-agent-toolkit/schema';
+import { disposeTempDir, disposeTempDirAfterFailure } from '@vibe-agent-toolkit/utils';
+import { handleTerminatingSignals } from '@vibe-agent-toolkit/utils/process';
+import { CommandRefusalError, errorMessageOf, refusalCodeOf } from '../../utils/command-refusal.js';
+import { makeStagingDir } from '../../utils/staging-dir.js';
 /**
- * Run `body` against a freshly shallow-cloned repo. Always cleans up the
- * tempdir unless `options.keepTempForDebug` is true. Re-raises any error
- * from the clone or from `body`.
+ * Clone the source, or refuse. A subpath the clone does not hold, or one that
+ * escapes it, arrives coded (`GIT_SUBPATH_INVALID`) and keeps its own refusal —
+ * `USAGE_INVALID`, the argument's mistake. Anything else the clone step throws
+ * (a clone that fails, a ref it does not have) means the source the operator
+ * named could not be read: `INPUT_UNREADABLE`. Only the clone step is coded; a
+ * failure inside the audit that follows is the audit's own.
+ */
+function cloneSource(parsed, tempdir) {
+    try {
+        return cloneGitSource(parsed, tempdir);
+    }
+    catch (error) {
+        if (refusalCodeOf(error) !== 'INTERNAL_ERROR')
+            throw error;
+        throw new CommandRefusalError('INPUT_UNREADABLE', errorMessageOf(error), { cause: error });
+    }
+}
+/**
+ * Dispose of the clone's tempdir once the work on it is DONE — or, under `keepTempForDebug`,
+ * keep it and say where.
+ *
+ * @returns `undefined`, or the leftover: the classified fault naming a tempdir the OS would not
+ *   remove, for the caller to publish as a warning beside the work it finished
+ */
+async function disposeClone(tempdir, options) {
+    if (options.keepTempForDebug) {
+        process.stderr.write(`[vat: debug — temp dir preserved: ${tempdir}]\n`);
+        return undefined;
+    }
+    return await disposeTempDir(tempdir);
+}
+/**
+ * Run `body` against a freshly shallow-cloned repo, then dispose of the clone (unless
+ * `options.keepTempForDebug`). `body` must not end the process itself: a caller that exits
+ * does so once this has settled.
+ *
+ * A failure of the clone or of `body` is rethrown unchanged, a clone that will not go recorded
+ * beside it (`suppressedFaultsOf`). Once `body` succeeded, a clone the OS would not remove is
+ * returned as `leftover` beside its value — the work is done, so it is never the refusal.
  */
 export async function withClonedRepo(parsed, options, body) {
-    const tempdir = mkdtempSync(safePath.join(normalizedTmpdir(), 'vat-audit-'));
-    const sigintListener = () => {
+    // Through the one classified creation: a temp directory the OS will not make is the environment's fault.
+    const tempdir = await makeStagingDir('vat-audit-');
+    // ONE disposal, whoever starts it: the work's own end (after success or failure) or a signal. It
+    // settles on what it left behind, whichever path started it, so the signal path can name it. The
+    // guard is held until that disposal has SETTLED — a Ctrl-C that also kills `git` fails the clone
+    // step, and a guard released before the failure path's disposal let the pending signal kill the
+    // process half-way through it, the clone left behind.
+    let disposal;
+    const dispose = (start) => (disposal ??= start());
+    // Interrupted: dispose of the clone first, then die of the signal. No report follows a signal, so a
+    // clone that will not go is named on stderr. A repeat (a terminal Ctrl-C under the `vat` wrapper
+    // arrives twice) is swallowed — see `handleTerminatingSignals`.
+    const signalGuard = handleTerminatingSignals({
+        fallbackExitCode: ExitCode.ERROR,
+        cleanup: () => dispose(() => disposeClone(tempdir, options)).then((leftover) => {
+            if (leftover !== undefined)
+                process.stderr.write(`[vat: interrupted — temp dir left behind: ${errorMessageOf(leftover)}]\n`);
+        }, 
+        // A rejection is a refusal to dispose at all (nothing was touched): say that, not "left behind".
+        (error_) => {
+            process.stderr.write(`[vat: interrupted — temp dir not disposed of: ${errorMessageOf(error_)}]\n`);
+        }),
+    });
+    // The work's own disposal, then the guard's release — released even when the disposal REJECTS
+    // (a refusal to dispose at all), so a guard never outlives the work it guarded.
+    const disposeThenRelease = async (start) => {
         try {
-            rmSync(tempdir, { recursive: true, force: true });
+            return await dispose(start);
         }
         finally {
-            process.removeListener('SIGINT', sigintListener);
-            process.kill(process.pid, 'SIGINT');
+            // A signal that arrived meanwhile ends the process once this same disposal has settled.
+            await signalGuard.releaseOrAwaitEnding();
         }
     };
-    process.on('SIGINT', sigintListener);
-    // The audit pipeline calls `process.exit()` on completion
-    // (`handleAuditResults` in audit.ts), which would skip any `finally`
-    // block here. Register an `'exit'` listener so cleanup runs even when
-    // the process is ending — this is Node's documented escape hatch for
-    // "always run this sync cleanup". We still keep the `finally` below so
-    // thrown errors and the non-exit path behave the same.
-    let cleaned = false;
-    const cleanup = () => {
-        if (cleaned)
-            return;
-        cleaned = true;
-        if (options.keepTempForDebug) {
-            process.stderr.write(`[vat: debug — temp dir preserved: ${tempdir}]\n`);
-        }
-        else {
-            rmSync(tempdir, { recursive: true, force: true });
-        }
-    };
-    const exitListener = () => {
-        cleanup();
-    };
-    process.on('exit', exitListener);
+    let value;
     try {
-        const { ref, commit, targetDir } = cloneGitSource(parsed, tempdir);
+        const { ref, commit, targetDir } = cloneSource(parsed, tempdir);
         const { subpath } = parsed;
         const provenance = {
             url: parsed.cloneUrl,
@@ -60,12 +102,13 @@ export async function withClonedRepo(parsed, options, body) {
             commit,
             ...(subpath ? { subpath } : {}),
         };
-        return await body({ tempdir, targetDir, provenance });
+        value = await body({ tempdir, targetDir, provenance });
     }
-    finally {
-        process.removeListener('SIGINT', sigintListener);
-        process.removeListener('exit', exitListener);
-        cleanup();
+    catch (error) {
+        await disposeThenRelease(() => (options.keepTempForDebug ? disposeClone(tempdir, options) : disposeTempDirAfterFailure(tempdir, error)));
+        throw error;
     }
+    const leftover = await disposeThenRelease(() => disposeClone(tempdir, options));
+    return { value, leftover };
 }
 //# sourceMappingURL=git-url-clone.js.map

package/dist/commands/audit/git-url-clone.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-url-clone.js","sourceRoot":"","sources":["../../../src/commands/audit/git-url-clone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAmBvE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAoB,EACpB,OAAqB,EACrB,IAA+C;IAE/C,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,GAAS,EAAE;QAChC,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAErC,0DAA0D;IAC1D,qEAAqE;IACrE,sEAAsE;IACtE,qEAAqE;IACrE,uEAAuE;IACvE,uDAAuD;IACvD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,OAAO,KAAK,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAEjC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,MAAM,UAAU,GAAe;YAC7B,GAAG,EAAE,MAAM,CAAC,QAAQ;YACpB,GAAG;YACH,MAAM;YACN,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC;QACF,OAAO,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IACxD,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACjD,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC7C,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"git-url-clone.js","sourceRoot":"","sources":["../../../src/commands/audit/git-url-clone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAEvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAE7E,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAkB5D;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,MAAoB,EAAE,OAAe;IACxD,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,gBAAgB;YAAE,MAAM,KAAK,CAAC;QAC3D,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,OAAqB;IAChE,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,OAAO,KAAK,CAAC,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAoB,EACpB,OAAqB,EACrB,IAA+C;IAE/C,yGAAyG;IACzG,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,CAAC;IACnD,iGAAiG;IACjG,iGAAiG;IACjG,iGAAiG;IACjG,gGAAgG;IAChG,sDAAsD;IACtD,IAAI,QAAsC,CAAC;IAC3C,MAAM,OAAO,GAAG,CAAC,KAA6B,EAAoB,EAAE,CAAC,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC,CAAC;IAC5F,oGAAoG;IACpG,iGAAiG;IACjG,gEAAgE;IAChE,MAAM,WAAW,GAAG,wBAAwB,CAAC;QAC3C,gBAAgB,EAAE,QAAQ,CAAC,KAAK;QAChC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAC/D,CAAC,QAAQ,EAAE,EAAE;YACX,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/H,CAAC;QACD,iGAAiG;QACjG,CAAC,MAAe,EAAE,EAAE;YAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrG,CAAC,CACF;KACF,CAAC,CAAC;IACH,8FAA8F;IAC9F,gFAAgF;IAChF,MAAM,kBAAkB,GAAG,KAAK,EAAE,KAA6B,EAAoB,EAAE;QACnF,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,wFAAwF;YACxF,MAAM,WAAW,CAAC,oBAAoB,EAAE,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC;IACF,IAAI,KAAQ,CAAC;IACb,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,MAAM,UAAU,GAAe;YAC7B,GAAG,EAAE,MAAM,CAAC,QAAQ;YACpB,GAAG;YACH,MAAM;YACN,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC;QACF,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACzI,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAChF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC"}

package/dist/commands/audit/hierarchical-output.d.ts

@@ -1,5 +1,5 @@
-import type { ValidationResult } from '@vibe-agent-toolkit/agent-skills';
-import { type ValidationIssue } from '@vibe-agent-toolkit/schema';
+import { type ValidationResult } from '@vibe-agent-toolkit/agent-skills';
+import { type SeverityCounts } from '@vibe-agent-toolkit/schema';
 export interface HierarchicalOutput {
     marketplaces: MarketplaceGroup[];
     cachedPlugins: PluginGroup[];
@@ -15,14 +15,38 @@ export interface PluginGroup {
     skills: SkillEntry[];
 }
 export type CacheStatus = 'stale' | 'orphaned' | 'fresh';
+/**
+ * One skill in the `--user` view. Its findings are the report envelope's (each
+ * `location` names the file); the entry carries their distribution, the same
+ * `status` + `summary` pair every `files[]` row carries.
+ */
 export interface SkillEntry {
     name: string;
     /** Path relative to the run root stated once at the top of the report. */
     path: string;
-    status: 'success' | 'warning' | 'error';
-    issues: ValidationIssue[];
+    /** Literal: `findings` iff the skill carries any finding. */
+    status: 'ok' | 'findings';
+    summary: SeverityCounts;
     cacheStatus?: CacheStatus;
 }
+/**
+ * Add misconfiguration issues to standalone skills in wrong locations
+ *
+ * Detects standalone SKILL.md files in ~/.claude/plugins/ that won't be recognized
+ * by Claude Code. These should be either moved to ~/.claude/skills/ or properly
+ * configured as plugins with .claude-plugin/plugin.json.
+ *
+ * Applied to the `--user` run's RESULTS, before the report is built, so the
+ * finding reaches the envelope's `findings` and `summary` and the `files[]` row
+ * as well as the hierarchy. It used to be added inside the hierarchy only: an
+ * error-severity finding the header never counted and the exit code never saw.
+ *
+ * @param results - Validation results to check — every result of the run, so a
+ *   skill-claude-plugin's own plugin result is among them
+ * @param locationRoot - Run root the emitted `location` is expressed relative to
+ * @returns Results with misconfiguration issues added
+ */
+export declare function addMisconfigurationIssues(results: ValidationResult[], locationRoot: string): ValidationResult[];
 /**
  * Build hierarchical output structure from validation results.
  *

package/dist/commands/audit/hierarchical-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hierarchical-output.d.ts","sourceRoot":"","sources":["../../../src/commands/audit/hierarchical-output.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AAGpC,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,aAAa,EAAE,WAAW,EAAE,CAAC;IAC7B,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,gBAAgB,EAAE,UAAU,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IACxC,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAqaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,gBAAgB,EAAE,EAC3B,OAAO,EAAE,OAAO,EAChB,YAAY,EAAE,MAAM,GACnB,kBAAkB,CAyCpB"}
+{"version":3,"file":"hierarchical-output.d.ts","sourceRoot":"","sources":["../../../src/commands/audit/hierarchical-output.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EAAmB,KAAK,cAAc,EAAwB,MAAM,4BAA4B,CAAC;AAGxG,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,aAAa,EAAE,WAAW,EAAE,CAAC;IAC7B,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,gBAAgB,EAAE,UAAU,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,MAAM,EAAE,IAAI,GAAG,UAAU,CAAC;IAC1B,OAAO,EAAE,cAAc,CAAC;IACxB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAuYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAuB/G;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,gBAAgB,EAAE,EAC3B,OAAO,EAAE,OAAO,EAChB,YAAY,EAAE,MAAM,GACnB,kBAAkB,CAuCpB"}