@vibe-agent-toolkit/cli 0.2.0-rc.7 → 0.2.0-rc.9

package/dist/utils/skill-packaging-config.js

@@ -9,7 +9,8 @@
  * Most fields are a shallow override: a per-skill value replaces the default
  * outright. `files:` is the exception — see below.
  */
-import { mergeFilesConfig } from '@vibe-agent-toolkit/agent-skills';
+import { basename } from 'node:path';
+import { mergeFilesConfig, } from '@vibe-agent-toolkit/agent-skills';
 import { safePath } from '@vibe-agent-toolkit/utils';
 /**
  * Merge defaults with per-skill overrides, dropping undefined values.
@@ -43,6 +44,60 @@ export function mergeSkillPackagingConfig(defaults, perSkillOverrides) {
     }
     return packagingConfig;
 }
+/**
+ * THE `skills.config` entry a plugin-local skill packages under, for both lanes that
+ * ask: the Claude plugin build that packages it and `vat verify` that checks what it
+ * packaged. Keyed by the skill's declared name; its directory path under the plugin's
+ * `skills/` (`group/nested`) and that path's trailing segment are fallbacks for a
+ * config keyed by directory. Two lookups were two effective configs for one skill —
+ * verify checked `files:` dests and severity overrides the build never applied.
+ */
+export function pluginLocalSkillConfigEntry(config, skill) {
+    return config?.[skill.skillName] ?? config?.[skill.skillDirPath] ?? config?.[basename(skill.skillDirPath)];
+}
+/**
+ * Is this skill distributed through the POOL (`dist/skills/<name>`)?
+ *
+ * THE predicate for `publish`, read off the MERGED config so that
+ * `skills.defaults.publish` counts; every lane that decides whether a pool bundle
+ * is built, expected or assigned asks this and nothing else. The consistency
+ * check used to read `skills.config.<name>.publish` alone, so a project-wide
+ * `skills.defaults.publish: false` parsed and changed nothing — and `vat build`
+ * and `vat verify` never read the flag at all: two contracts for one key.
+ *
+ * `publish: false` names an IN-PLACE skill: validated at source by `vat validate`
+ * / `vat skills validate`, never bundled by `vat build`, never expected by
+ * `vat verify`. Default `true`.
+ *
+ * `publish` scopes the POOL only. A plugin-local skill (a git-tracked skill directory
+ * under a plugin's `skills/` — see `indexPluginLocalSkills`) ships with its
+ * plugin by LOCATION: the claude phase packages it and verify expects it whatever
+ * this returns. A skill that is both discovered by `skills.include` and
+ * plugin-local therefore skips the pool with `publish: false` and still ships in
+ * its plugin.
+ *
+ * `publish` is a distribution flag, not a packaging knob — the packaging
+ * validator never reads it — so it is declared on the project-config schema and
+ * carried through the merge generically like every other key; it is read here
+ * off the merged record rather than off a typed field of the validator's config.
+ */
+export function isSkillPublished(packaging) {
+    const { publish } = packaging;
+    return publish ?? true;
+}
+/**
+ * Classify one discovered skill — {@link isSkillPublished} over its merged config, then
+ * plugin-local by the directory holding its `SKILL.md` (`pluginLocal`, from
+ * `indexPluginLocalSkills`: the skill dirs the plugin build actually packages). A
+ * plugin-local skill is never `in-place`: it ships with its plugin, so every lane that
+ * reports in-place skills (`vat build`, `vat verify`, the consistency check) asks this,
+ * not the flag alone.
+ */
+export function publishScope(skill, packaging, pluginLocal) {
+    if (isSkillPublished(packaging))
+        return 'pool';
+    return pluginLocal.locationOf(skill.sourcePath) === undefined ? 'in-place' : 'plugin-only';
+}
 /**
  * The PROJECT's declared eval suites: one {@link DeclaredEvalSuite} per discovered
  * skill, from the same discovery + merge every lane already runs.

package/dist/utils/skill-packaging-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-packaging-config.js","sourceRoot":"","sources":["../../src/utils/skill-packaging-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,gBAAgB,EAAqD,MAAM,kCAAkC,CAAC;AAEvH,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA6C,EAC7C,iBAAsD;IAEtD,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,iBAAiB,EAAE,CAAC;IACrD,MAAM,eAAe,GAAyB,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACvB,eAA2C,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAkC,CAAC;IAC1E,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC,OAAO,CAAkC,CAAC;IACpF,IAAI,YAAY,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,WAAW,GAAG,gBAAgB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,eAAe,CAAC,KAAK,GAAG,WAAW,CAAC;QACtC,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CACvC,YAAsC,EACtC,UAA+D;IAE/D,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1C,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,YAAY,CAAC;IAC1D,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC;QAClD,MAAM,EAAE,yBAAyB,CAC/B,QAA+C,EAC/C,cAAc,EAAE,CAAC,KAAK,CAAC,IAAI,CAAwC,CACpE;KACF,CAAC,CAAC,CAAC;AACN,CAAC"}
+{"version":3,"file":"skill-packaging-config.js","sourceRoot":"","sources":["../../src/utils/skill-packaging-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EACL,gBAAgB,GAIjB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA6C,EAC7C,iBAAsD;IAEtD,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,iBAAiB,EAAE,CAAC;IACrD,MAAM,eAAe,GAAyB,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACvB,eAA2C,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAkC,CAAC;IAC1E,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC,OAAO,CAAkC,CAAC;IACpF,IAAI,YAAY,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,WAAW,GAAG,gBAAgB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,eAAe,CAAC,KAAK,GAAG,WAAW,CAAC;QACtC,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAA+C,EAC/C,KAAoE;IAEpE,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAA+B;IAC9D,MAAM,EAAE,OAAO,EAAE,GAAG,SAAkC,CAAC;IACvD,OAAO,OAAO,IAAI,IAAI,CAAC;AACzB,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,KAA6B,EAC7B,SAA+B,EAC/B,WAAkC;IAElC,IAAI,gBAAgB,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/C,OAAO,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC;AAC7F,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CACvC,YAAsC,EACtC,UAA+D;IAE/D,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1C,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,YAAY,CAAC;IAC1D,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC;QAClD,MAAM,EAAE,yBAAyB,CAC/B,QAA+C,EAC/C,cAAc,EAAE,CAAC,KAAK,CAAC,IAAI,CAAwC,CACpE;KACF,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/utils/url-redact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url-redact.d.ts","sourceRoot":"","sources":["../../src/utils/url-redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAexD"}
+{"version":3,"file":"url-redact.d.ts","sourceRoot":"","sources":["../../src/utils/url-redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAaxD"}

package/dist/utils/url-redact.js

@@ -26,13 +26,11 @@
  * @returns The input with any URL-format credentials removed.
  */
 export function redactUrlCredentials(url) {
-    let parsed;
-    try {
-        parsed = new URL(url);
-    }
-    catch {
+    // Not a URL: nothing to redact. Asked as a question rather than caught as a
+    // throw, so the only thing that reads as "not a URL" is exactly that.
+    if (!URL.canParse(url))
         return url;
-    }
+    const parsed = new URL(url);
     if (parsed.username === '' && parsed.password === '') {
         return url;
     }

package/dist/utils/url-redact.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-redact.js","sourceRoot":"","sources":["../../src/utils/url-redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;IACrB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;IACrB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"url-redact.js","sourceRoot":"","sources":["../../src/utils/url-redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAE5B,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;IACrB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;IACrB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC"}

package/dist/utils/user-context-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-context-scanner.d.ts","sourceRoot":"","sources":["../../src/utils/user-context-scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAQ,KAAK,UAAU,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGxE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC;IAC/C,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAAC,CAuCD"}
+{"version":3,"file":"user-context-scanner.d.ts","sourceRoot":"","sources":["../../src/utils/user-context-scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAQ,KAAK,UAAU,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGxE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC;IAC/C,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAAC,CAqCD"}

package/dist/utils/user-context-scanner.js

@@ -30,7 +30,6 @@ export async function scanUserContext() {
     const unreadable = [];
     // Scan plugins directory (SKILL.md and .claude-plugin directories)
     let plugins = [];
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- User's home directory is safe
     if (existsSync(pluginsDir)) {
         const pluginsScan = await scan({
             path: pluginsDir,
@@ -42,7 +41,6 @@ export async function scanUserContext() {
     }
     // Scan skills directory (SKILL.md files)
     let skills = [];
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- User's home directory is safe
     if (existsSync(skillsDir)) {
         const skillsScan = await scan({
             path: skillsDir,

package/dist/utils/user-context-scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-context-scanner.js","sourceRoot":"","sources":["../../src/utils/user-context-scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAmB,MAAM,+BAA+B,CAAC;AAItE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IAYnC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACvD,MAAM,UAAU,GAAuB,EAAE,CAAC;IAE1C,mEAAmE;IACnE,IAAI,OAAO,GAAiB,EAAE,CAAC;IAC/B,oGAAoG;IACpG,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;YAC7B,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,CAAC,aAAa,EAAE,sBAAsB,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IAED,yCAAyC;IACzC,IAAI,MAAM,GAAiB,EAAE,CAAC;IAC9B,oGAAoG;IACpG,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC;YAC5B,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,CAAC,aAAa,CAAC;SACzB,CAAC,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,uCAAuC;IACvC,MAAM,YAAY,GAAiB,EAAE,CAAC;IAEtC,OAAO;QACL,OAAO;QACP,MAAM;QACN,YAAY;QACZ,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"user-context-scanner.js","sourceRoot":"","sources":["../../src/utils/user-context-scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAmB,MAAM,+BAA+B,CAAC;AAItE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IAYnC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACvD,MAAM,UAAU,GAAuB,EAAE,CAAC;IAE1C,mEAAmE;IACnE,IAAI,OAAO,GAAiB,EAAE,CAAC;IAC/B,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;YAC7B,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,CAAC,aAAa,EAAE,sBAAsB,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IAED,yCAAyC;IACzC,IAAI,MAAM,GAAiB,EAAE,CAAC;IAC9B,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC;YAC5B,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,CAAC,aAAa,CAAC;SACzB,CAAC,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,uCAAuC;IACvC,MAAM,YAAY,GAAiB,EAAE,CAAC;IAEtC,OAAO;QACL,OAAO;QACP,MAAM;QACN,YAAY;QACZ,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/utils/validate-help-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-help-files.d.ts","sourceRoot":"","sources":["../../src/utils/validate-help-files.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2CH;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAkDxC"}
+{"version":3,"file":"validate-help-files.d.ts","sourceRoot":"","sources":["../../src/utils/validate-help-files.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA4CH;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAgDxC"}

package/dist/utils/validate-help-files.js

@@ -8,6 +8,7 @@
 import { existsSync, readdirSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { ExitCode } from '@vibe-agent-toolkit/schema';
 import { safePath } from '@vibe-agent-toolkit/utils';
 import { isEntrypoint } from '@vibe-agent-toolkit/utils/process';
 /**
@@ -55,7 +56,6 @@ export function validateHelpFiles() {
     const missingFiles = [];
     for (const filename of REQUIRED_HELP_FILES) {
         const helpPath = safePath.join(docsDir, filename);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- path is constructed from known safe components
         if (!existsSync(helpPath)) {
             missingFiles.push(filename);
         }
@@ -68,7 +68,6 @@ export function validateHelpFiles() {
     }
     // Reverse direction: a doc nobody serves and nobody classified.
     const required = new Set(REQUIRED_HELP_FILES);
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- docsDir is derived from this module's own location
     const present = readdirSync(docsDir).filter(f => f.endsWith('.md'));
     const unclassified = present.filter(f => !required.has(f) && !PROSE_ONLY_HELP_FILES.has(f));
     if (unclassified.length > 0) {
@@ -101,12 +100,12 @@ if (isEntrypoint(import.meta.url)) {
     try {
         validateHelpFiles();
         console.log('✓ All required help documentation files exist');
-        process.exit(0);
+        process.exit(ExitCode.OK);
     }
     catch (error) {
         console.error('✗ Help file validation failed:');
         console.error(error.message);
-        process.exit(1);
+        process.exit(ExitCode.FINDINGS);
     }
 }
 //# sourceMappingURL=validate-help-files.js.map

package/dist/utils/validate-help-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-help-files.js","sourceRoot":"","sources":["../../src/utils/validate-help-files.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG;IAC1B,UAAU,EAAO,iDAAiD;IAClE,cAAc,EAAG,kEAAkE;IACnF,QAAQ,EAAS,sDAAsD;IACvE,UAAU,EAAO,0DAA0D;CACnE,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,UAAU;IACV,WAAW;IACX,QAAQ;IACR,WAAW;IACX,eAAe;CAChB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAEnD,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,KAAK,MAAM,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,qHAAqH;QACrH,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,+CAA+C,QAAQ,MAAM;YAC7D,uEAAuE;YACvE,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,mBAAmB,CAAC,CAAC;IACtD,yHAAyH;IACzH,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5F,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,2CAA2C,QAAQ,MAAM;YACzD,yEAAyE;YACzE,sEAAsE;YACtE,2EAA2E;YAC3E,8EAA8E;YAC9E,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,CAAC,GAAG,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,2DAA2D;YAC3D,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACtD,+BAA+B,CAChC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,iBAAiB,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,OAAO,CAAC,KAAK,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"validate-help-files.js","sourceRoot":"","sources":["../../src/utils/validate-help-files.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG;IAC1B,UAAU,EAAO,iDAAiD;IAClE,cAAc,EAAG,kEAAkE;IACnF,QAAQ,EAAS,sDAAsD;IACvE,UAAU,EAAO,0DAA0D;CACnE,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,UAAU;IACV,WAAW;IACX,QAAQ;IACR,WAAW;IACX,eAAe;CAChB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAEnD,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,KAAK,MAAM,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,+CAA+C,QAAQ,MAAM;YAC7D,uEAAuE;YACvE,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,mBAAmB,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5F,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,2CAA2C,QAAQ,MAAM;YACzD,yEAAyE;YACzE,sEAAsE;YACtE,2EAA2E;YAC3E,8EAA8E;YAC9E,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,CAAC,GAAG,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,2DAA2D;YAC3D,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACtD,+BAA+B,CAChC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,iBAAiB,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,OAAO,CAAC,KAAK,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/utils/vat-bin-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vat-bin-path.d.ts","sourceRoot":"","sources":["../../src/utils/vat-bin-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAUH;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAO1C"}
+{"version":3,"file":"vat-bin-path.d.ts","sourceRoot":"","sources":["../../src/utils/vat-bin-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAUH;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAM1C"}

package/dist/utils/vat-bin-path.js

@@ -40,7 +40,6 @@ const HERE = dirname(fileURLToPath(import.meta.url));
 export function resolveVatBinPath() {
     // Compiled tree: packages/cli/dist/utils/vat-bin-path.js → packages/cli/dist/bin.js
     const compiled = safePath.resolve(HERE, '../bin.js');
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- internal path
     if (existsSync(compiled))
         return compiled;
     // Source tree (vitest): packages/cli/src/utils/vat-bin-path.ts → packages/cli/dist/bin.js

package/dist/utils/vat-bin-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"vat-bin-path.js","sourceRoot":"","sources":["../../src/utils/vat-bin-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,oFAAoF;IACpF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACrD,oFAAoF;IACpF,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,0FAA0F;IAC1F,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"vat-bin-path.js","sourceRoot":"","sources":["../../src/utils/vat-bin-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,oFAAoF;IACpF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,0FAA0F;IAC1F,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;AACrD,CAAC"}

package/dist/version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;GAEG;AAgBH,eAAO,MAAM,OAAO,EAAE,MAA4B,CAAC;AAEnD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAuBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,cAAc,GAAG,IAAI,EAC9B,UAAU,EAAE,MAAM,GACjB,MAAM,CAER"}
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;GAEG;AAeH,eAAO,MAAM,OAAO,EAAE,MAA4B,CAAC;AAEnD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAuBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,cAAc,GAAG,IAAI,EAC9B,UAAU,EAAE,MAAM,GACjB,MAAM,CAER"}

package/dist/version.js

@@ -7,9 +7,7 @@ import { fileURLToPath } from 'node:url';
 import { safePath } from '@vibe-agent-toolkit/utils';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 // Read version from package.json at build time
-const packageJson = JSON.parse(
-// eslint-disable-next-line security/detect-non-literal-fs-filename -- path resolved from known __dirname and constant package.json name
-readFileSync(safePath.resolve(__dirname, '../package.json'), 'utf-8'));
+const packageJson = JSON.parse(readFileSync(safePath.resolve(__dirname, '../package.json'), 'utf-8'));
 export const version = packageJson.version;
 /**
  * The version line alone: `<ver>` plus whatever the cwd-derived context adds.

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAG,OAAO,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,+CAA+C;AAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK;AAC5B,wIAAwI;AACxI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CACtE,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAW,WAAW,CAAC,OAAO,CAAC;AAOnD;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAW,EAAE,OAA8B;IACpE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,CAAC;IACb,CAAC;IAED,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,GAAG,GAAG,SAAS,OAAO,CAAC,IAAI,IAAI,SAAS,GAAG,CAAC;QACrD,KAAK,OAAO;YACV,OAAO,GAAG,GAAG,YAAY,OAAO,CAAC,IAAI,IAAI,SAAS,GAAG,CAAC;QACxD,KAAK,QAAQ;YACX,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,OAA8B,EAC9B,UAAkB;IAElB,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,eAAe,UAAU,EAAE,CAAC;AACvE,CAAC"}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAG,OAAO,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,+CAA+C;AAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAC5B,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CACtE,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAW,WAAW,CAAC,OAAO,CAAC;AAOnD;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAW,EAAE,OAA8B;IACpE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,CAAC;IACb,CAAC;IAED,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,GAAG,GAAG,SAAS,OAAO,CAAC,IAAI,IAAI,SAAS,GAAG,CAAC;QACrD,KAAK,OAAO;YACV,OAAO,GAAG,GAAG,YAAY,OAAO,CAAC,IAAI,IAAI,SAAS,GAAG,CAAC;QACxD,KAAK,QAAQ;YACX,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,OAA8B,EAC9B,UAAkB;IAElB,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,eAAe,UAAU,EAAE,CAAC;AACvE,CAAC"}

package/docs/audit.md

@@ -28,7 +28,7 @@ vat audit [git-url-or-path] [options]
 ### Options
 
 - `--user` - Audit user-level Claude plugins installation (`~/.claude/plugins`)
-- `-r, --recursive` - Scan directories recursively for all resource types
+- `--no-recursive` - Scan the top level only (recursive scanning is the default; there is no `--recursive` flag)
 - `--compat` - Run compatibility analysis for each plugin; adds a `compatibility:` block to its entry (see [Compatibility and settings blocks](#compatibility-and-settings-blocks))
 - `--settings [file]` - Check each plugin against Claude settings (auto-discovered, or the given file); adds a `settings:` block. Requires `--compat`
 - `--debug` - Enable debug logging (outputs to stderr)
@@ -207,19 +207,13 @@ hierarchical:
                   message: Skill exceeds recommended length
 ```
 
-## Two verdicts: `status` and the exit code
+## `status` and the exit code
 
-`vat audit` publishes two verdicts, and they answer different questions.
-
-| Verdict | Answers | Where to read it |
-|---|---|---|
-| `status` in the YAML report | **What was found** — the worst actionable severity across the findings | stdout |
-| The process exit code | **Whether the run completed** | `$?` |
-
-So a tree with errors produces `status: error` beside **exit 0**, and both are
-correct. That pair surprises people because `status` means something wider
-everywhere else in this CLI, where it moves with the exit code. Here it does not,
-because this command is a report rather than a gate.
+The YAML `status` describes the findings — the worst actionable severity across
+them — and the exit code follows it, exactly as in every other command of this
+CLI. `vat audit` used to be the one exception ("advisory": exit 0 over
+`status: error`), which a CI author reading the shared contract got wrong on
+exactly this verb.
 
 A run that audited **zero files** is refused, not passed. An existing directory
 with nothing auditable in it — plugins that moved, a wrong subdirectory, an
@@ -227,26 +221,25 @@ excluded tree, files no lane recognises — used to publish `status: success`
 beside `filesScanned: 0`, which is the same document a clean tree produces. It
 now publishes `status: error` with one non-overridable `RESOURCE_CHECK_BROKEN`
 finding under a top-level `issues:` key (the claim is about the run, so it is
-not a `files[]` row and does not count toward `filesScanned`). The exit code is
-still `0`: the run completed; it just is not a verdict.
+not a `files[]` row and does not count toward `filesScanned`), and exits `1`.
 
-**Gate CI on the report, never on this command's exit code** — read `status` and
-`issueCounts` out of the YAML (see [CI/CD Integration](#cicd-integration) for a
-worked example), or reach for a command whose exit code *is* the verdict:
-`vat skills validate` and `vat skills build` exit `1` on validation errors, and
-`vat skills validate` also exits `1` when its `skills.include` globs discover no
-skill — so a typo'd glob fails the gate there instead of passing it.
+What still sets audit apart from `vat skills validate` is not the exit code but
+what it shows: audit ignores `validation.allow` (every finding is reported and
+counted) and reads `validation.severity` from three scopes. `validation.severity`
+is therefore the dial that decides what gates — set a code to `warning` and it
+stops moving the exit code; set it to `ignore` and it disappears from the report.
 
 ## Exit Codes
 
-`vat audit` is **advisory by design** — it reports every issue it detects but does not block on validation severity. Use `vat skills validate` or `vat skills build` for gated checks (those commands exit `1` on validation errors).
+The three-way contract every command shares:
 
-- **0** - Always, when the audit completes — including when the report says `status: error`. The findings are in the report; check `status` and `summary` in the YAML output to decide whether action is needed. That includes the environment refusing part of the subject: a path that does not exist or is not a recognisable resource is reported as `UNKNOWN_FORMAT` (error), and a directory or file the scan could not read — permission denied, a vanished mount — as `SCAN_PATH_UNREADABLE` (warning), with every readable sibling still validated. A governing `vibe-agent-toolkit.config.yaml` that cannot be loaded, or whose `skills.include` reaches a directory the crawl cannot list, is warned about once on stderr and filed as `SCAN_PATH_UNREADABLE` on the config file or the directory; the skills it governs are validated config-free rather than dropped. Degrading beats destroying, and the report says where it degraded.
-- **2** - The audit could not run at all, so there is no report to read: `--user` with no Claude config directory installed, a git URL that could not be cloned, or an internal failure (a validator defect). Invalid config, missing paths and permission problems are **not** exit 2 — they are findings, above.
+- **0** - The audit completed with nothing at error severity. Warnings and informational findings are in the report, not the exit code.
+- **1** - The audit completed and reports `status: error`: at least one error-severity finding, or zero files audited. A directory or file INSIDE the tree that the scan could not read — permission denied, a vanished mount — is `SCAN_PATH_UNREADABLE` (warning): the run is degraded, not failed, every readable sibling is still validated, and the refused path is reported under `summary.pathsUnreadable` rather than counted in `filesScanned` — so a root with nothing readable audited zero files and is refused like an empty tree. A governing `vibe-agent-toolkit.config.yaml` that cannot be loaded, or whose `skills.include` reaches a directory the crawl cannot list, is warned about once on stderr and filed as `SCAN_PATH_UNREADABLE` on the config file or the directory; the skills it governs are validated config-free rather than dropped. Degrading beats destroying, and the report says where it degraded.
+- **2** - The audit could not run at all, so there is no report to read: the path does not exist or is a file no audit lane recognises (the same ending `vat resources validate` and `vat skill review` give that argument), `--user` with no Claude config directory installed, a git URL that could not be cloned, an unknown flag, or an internal failure (a validator defect). An invalid config and a permission problem inside the tree are **not** exit 2 — they are findings, above.
 
 ## Validation Configuration
 
-Audit honors `validation.severity` from `vibe-agent-toolkit.config.yaml`: setting a code to `ignore` hides it from the report, and every other level is applied as written — a code raised to `error` is reported as an error, a code lowered to `warning` as a warning. It changes **which findings are reported and at what severity**, never whether the command fails (see [Two verdicts](#two-verdicts-status-and-the-exit-code)). Audit does **not** apply `validation.allow` (per-path allow entries); for that, use `vat skills validate` or `vat skills build`.
+Audit honors `validation.severity` from `vibe-agent-toolkit.config.yaml`: setting a code to `ignore` hides it from the report, and every other level is applied as written — a code raised to `error` is reported as an error, a code lowered to `warning` as a warning. It changes **which findings are reported and at what severity**, and through them the exit code — a code at `error` gates, one lowered to `warning` does not (see [`status` and the exit code](#status-and-the-exit-code)). Audit does **not** apply `validation.allow` (per-path allow entries); for that, use `vat skills validate` or `vat skills build`.
 
 Three scopes are read, least specific first — a more specific one naming the same code wins:
 
@@ -282,16 +275,15 @@ Errors prevent the resource from being used correctly:
 - **Missing manifests/frontmatter**: Resource structure is invalid
 - **Schema validation failures**: Manifest/frontmatter doesn't match expected format
 - **Broken links**: Links to non-existent files (Skills only)
-- **Reserved words in names**: Using reserved words like "help", "exit" (Skills only)
+- **Reserved words in names**: `anthropic` or `claude` in a skill name (`RESERVED_WORD_IN_NAME`, a warning — Claude Code rejects non-certified skills using them)
 - **XML tags in frontmatter**: XML-like tags in name/description (Skills only)
-- **Windows-style backslashes**: Path separators should be forward slashes (Skills only)
 
 ### Warnings (Should Fix)
 
 Warnings indicate potential issues but don't prevent usage:
 
 - **Skill exceeds recommended length**: Over 5000 lines (Skills only)
-- **Compat smells**: Skill requires a runtime capability that isn't available on every surface (browser auth, local shell, external CLI) — see `COMPAT_*` codes in `docs/validation-codes.md`.
+- **Capability observations**: Skill requires a runtime capability that isn't available on every surface — `CAPABILITY_BROWSER_AUTH`, `CAPABILITY_LOCAL_SHELL`, `CAPABILITY_EXTERNAL_CLI` (info); with `--compat`, the per-target verdicts `COMPAT_TARGET_INCOMPATIBLE` / `COMPAT_TARGET_NEEDS_REVIEW` (warning) and `COMPAT_TARGET_UNDECLARED` (info). See `docs/validation-codes.md`.
 
 ## Error Codes Reference
 
@@ -327,13 +319,12 @@ Warnings indicate potential issues but don't prevent usage:
 | `SKILL_MISSING_NAME` | error | `name` field missing from frontmatter | Add `name` field |
 | `SKILL_MISSING_DESCRIPTION` | error | `description` field missing from frontmatter | Add `description` field |
 | `SKILL_NAME_INVALID` | error | Name contains invalid characters | Use only letters, numbers, hyphens, underscores |
-| `SKILL_DESCRIPTION_TOO_LONG` | error | Description exceeds 500 characters | Shorten description |
+| `SKILL_DESCRIPTION_TOO_LONG` | error | Description exceeds 1024 characters (the frontmatter schema limit; `SKILL_DESCRIPTION_OVER_CLAUDE_CODE_LIMIT` warns earlier at 250, where the Claude Code `/skills` listing truncates) | Shorten description |
 | `RESERVED_WORD_IN_NAME` | warning | Name contains `anthropic` or `claude`; Claude Code rejects non-certified skills using these words | Rename the skill to avoid these words |
 | `SKILL_NAME_XML_TAGS` | error | Name contains XML-like tags | Remove XML tags from name |
 | `SKILL_DESCRIPTION_XML_TAGS` | error | Description contains XML-like tags | Remove XML tags from description |
 | `SKILL_DESCRIPTION_EMPTY` | error | Description is empty or whitespace | Provide meaningful description |
 | `SKILL_MISCONFIGURED_LOCATION` | error | Standalone skill in `~/.claude/plugins/` won't be recognized | Move to `~/.claude/skills/` for standalone skills, or add `.claude-plugin/plugin.json` for a proper plugin |
-| `PATH_STYLE_WINDOWS` | error | Windows-style backslashes in paths | Use forward slashes (/) instead |
 | `LINK_INTEGRITY_BROKEN` | error | Link to non-existent file | Fix or remove broken link |
 
 ### Skill Warnings
@@ -341,9 +332,12 @@ Warnings indicate potential issues but don't prevent usage:
 | Code | Severity | Description | Fix |
 |------|----------|-------------|-----|
 | `SKILL_TOO_LONG` | warning | Skill exceeds 5000 lines | Consider splitting into multiple skills |
-| `COMPAT_REQUIRES_BROWSER_AUTH` | warning | Skill needs browser login (MSAL, SSO, OAuth) | See `docs/validation-codes.md#compat_requires_browser_auth` |
-| `COMPAT_REQUIRES_LOCAL_SHELL` | warning | Skill needs local shell/environment tools (Bash, Edit, Write, NotebookEdit) | See `docs/validation-codes.md#compat_requires_local_shell` |
-| `COMPAT_REQUIRES_EXTERNAL_CLI` | warning | Skill invokes unbundled CLI (az, aws, gcloud, etc.) | See `docs/validation-codes.md#compat_requires_external_cli` |
+| `CAPABILITY_BROWSER_AUTH` | info | Skill needs browser login (MSAL, SSO, OAuth) | See `docs/validation-codes.md#capability_browser_auth` |
+| `CAPABILITY_LOCAL_SHELL` | info | Skill needs local shell/environment tools (Bash, Edit, Write, NotebookEdit) | See `docs/validation-codes.md#capability_local_shell` |
+| `CAPABILITY_EXTERNAL_CLI` | info | Skill invokes an unbundled CLI (az, aws, gcloud, etc.) | See `docs/validation-codes.md#capability_external_cli` |
+| `COMPAT_TARGET_INCOMPATIBLE` | warning | With `--compat`: a declared target cannot run the skill | See `docs/validation-codes.md#compat_target_incompatible` |
+| `COMPAT_TARGET_NEEDS_REVIEW` | warning | With `--compat`: a declared target may not run the skill | See `docs/validation-codes.md#compat_target_needs_review` |
+| `COMPAT_TARGET_UNDECLARED` | info | With `--compat`: the skill declares no `targets` | See `docs/validation-codes.md#compat_target_undeclared` |
 
 ### Format Detection Errors
 
@@ -361,10 +355,12 @@ Structured YAML report for programmatic parsing:
 root: /abs/path/to/scan/root   # The ONE absolute path in the document
 status: success | warning | error
 summary:
-  filesScanned: number
+  filesScanned: number        # Files the audit READ — never a path it could not
   filesPassed: number         # Files with no ACTIONABLE issues (info-only counts as passed)
   filesWithWarnings: number   # Files whose worst actionable severity is warning
   filesWithErrors: number     # Files carrying at least one error
+  pathsUnreadable: number     # `files[]` rows that are a refused path (SCAN_PATH_UNREADABLE),
+                              #   outside every count above: files.length === filesScanned + pathsUnreadable
 issueCounts:                  # FINDINGS, not files — same field name and meaning
   errors: number              #   as the `issueCounts` on each entry below,
   warnings: number            #   plus the run-level `issues` when present
@@ -529,7 +525,7 @@ This scans:
 Scan directory tree for all resources:
 
 ```bash
-vat audit ./resources --recursive
+vat audit ./resources
 ```
 
 Finds and validates:
@@ -546,21 +542,17 @@ Use in CI pipeline:
 #!/bin/bash
 set -e
 
-# Audit all resources (always exits 0 unless system error)
-vat audit --recursive > audit-report.yaml
-
-# Check YAML status field — audit itself doesn't fail on validation errors
-STATUS=$(grep '^status:' audit-report.yaml | awk '{print $2}')
-if [ "$STATUS" = "error" ]; then
-  echo "Audit report contains validation errors"
+# Audit all resources: exit 1 on an error-severity finding, 2 if the audit could not run
+if ! vat audit > audit-report.yaml; then
+  echo "Audit found errors (or could not run) — see the report"
   cat audit-report.yaml
   exit 1
 fi
 
-echo "Audit clean — no validation errors in report"
+echo "Audit clean — no error-severity findings"
 ```
 
-To gate on validation errors directly (exits `1` automatically), use `vat skills validate` instead:
+To gate with `validation.allow` honoured (audit ignores it), use `vat skills validate` instead:
 
 ```bash
 #!/bin/bash
@@ -582,7 +574,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v1
       - run: npm install -g vibe-agent-toolkit
-      - run: vat audit --recursive
+      - run: vat audit
 ```
 
 ## Troubleshooting
@@ -601,7 +593,7 @@ jobs:
 - Ensure plugin has `.claude-plugin/plugin.json` or `.claude-plugin/marketplace.json`
 - Ensure registry files are named `installed_plugins.json` or `known_marketplaces.json`
 - Ensure skill files are named `SKILL.md`
-- Use `--recursive` to scan subdirectories
+- Scanning is recursive by default; make sure you did not pass `--no-recursive`
 
 ### "Permission denied" on Windows
 
@@ -616,7 +608,7 @@ jobs:
 **Solution**: Redirect stdout to file, only show stderr:
 
 ```bash
-vat audit --recursive > audit.yaml 2>&1
+vat audit > audit.yaml 2>&1
 if [ $? -ne 0 ]; then
   echo "Audit failed, see audit.yaml"
   exit 1
@@ -706,10 +698,10 @@ governing context rather than a single top-level `projectRoot`:
   reported as ungoverned (an audit finding, not a fatal error). This lets `vat
   audit` work on external community trees, downloaded plugin bundles, and
   monorepos with multiple sub-package configs.
-- **Config**: accept defaults. Per-skill `validation.severity` and
-  `validation.allow` overrides come from whichever
-  `vibe-agent-toolkit.config.yaml` each skill walks up to. The audit itself
-  always exits 0 (advisory) regardless of severity outcomes.
+- **Config**: accept defaults. Per-skill `validation.severity` overrides come
+  from whichever `vibe-agent-toolkit.config.yaml` each skill walks up to;
+  `validation.allow` is not applied by audit (see the config section above).
+  The exit code follows the report's `status`, like every other command.
 
 The per-skill walk-up is cached via a module-level two-layer cache and pre-warmed
 during top-down descent for efficiency on large trees.
@@ -717,11 +709,10 @@ during top-down descent for efficiency on large trees.
 See [Roots and Config — Canonical Concepts](../../../docs/concepts/roots-and-config.md)
 for the `projectRoot` ladder and the audit walk-up model. See
 [`docs/skill-quality-and-compatibility.md`](../../../docs/skill-quality-and-compatibility.md)
-for VAT's advisory-audit stance.
+for VAT's audit stance.
 
 ## Related Commands
 
-- `vat agent audit <path>` - Legacy skill-only audit (deprecated)
 - `vat doctor` - Check environment and installation health
 - `vat resources validate` - Validate markdown resources (links, anchors)
 

package/docs/doctor.md

@@ -35,6 +35,7 @@ providing actionable suggestions for any problems found.
 **Exit Codes:**
 - `0` - No check failed (an undetermined check is reported in the output, not fatal)
 - `1` - One or more checks failed
+- `2` - Doctor itself could not run (an internal failure, an unknown flag); no verdict was produced
 
 **Output:** Human-friendly formatted text with emojis. The summary always prints the
 full outcome distribution and, when the concise view hides checks, how many it hid —

package/docs/index.md

@@ -106,6 +106,7 @@ Diagnose vat setup and environment health
 
 - `0` - No check failed (a check that could not be determined is reported as ❓, not fatal)
 - `1` - One or more checks failed
+- `2` - Doctor itself could not run (an internal failure; no verdict was produced)
 
 **Creates/modifies:** None (read-only diagnostics)
 
@@ -169,7 +170,7 @@ Execute agent locally for testing
 **Exit codes:**
 
 - `0` - Execution succeeded
-- `1` - Execution failed
+- `2` - Execution failed (the agent could not run, or threw)
 
 **Creates/modifies:** Depends on agent behavior
 
@@ -198,9 +199,8 @@ Run a packaged skill's eval suite in a headless, context-isolated Claude session
 **Exit codes:**
 
 - `0` - Run completed, all expectations passed
-- `1` - Harness broke (internal error, stall, timeout)
-- `2` - Preflight failure (bad config, unresolvable required companion, auth guard)
-- `3` - Bootstrap failure
+- `1` - Run completed and at least one eval failed
+- `2` - The harness could not run; a `Reason: internal | preflight | bootstrap` line on stderr says why
 - `4` - Eval failure (run completed, expectations did not all pass)
 
 **Creates/modifies:** A harness directory (removed unless `--keep`)
@@ -237,7 +237,8 @@ Create vector embeddings for semantic search over documentation
 **Exit codes:**
 
 - `0` - Indexing succeeded
-- `1` - Indexing failed
+- `1` - Indexing completed but some resources could not be indexed (the report names them)
+- `2` - Indexing could not run (no provider, unreadable config)
 
 **Creates/modifies:**
 
@@ -268,7 +269,7 @@ Search indexed documentation semantically
 **Exit codes:**
 
 - `0` - Search succeeded
-- `1` - Search failed (no index, query error)
+- `2` - Search could not run (no index, query error)
 
 **Creates/modifies:** None (read-only query)
 
@@ -428,7 +429,6 @@ its policy. The full matrix and rationale live in
 Place `vibe-agent-toolkit.config.yaml` at project root:
 
 ```yaml
-version: 1
 resources:
   include:
     - "docs/**/*.md"
@@ -440,9 +440,17 @@ resources:
 
 ## Exit Code Summary
 
-- `0` - Success (validation passed, scan completed, build succeeded)
-- `1` - Expected failures (validation errors, broken links, build failures)
-- `2` - System errors (invalid config, directory not found, missing dependencies)
+One contract, every command:
+
+- `0` - **OK.** The command ran and found nothing at error severity. Warnings and informational findings are in the document, not the exit code (a command that offers `--strict` promotes warnings).
+- `1` - **Findings.** The command ran to completion and what it examined failed its gate: an error-severity finding, a failed eval, a broken link, a partial index.
+- `2` - **Error.** The command could not do its job: a usage mistake (unknown flag or verb, a retired `--only`), a root path that does not exist or is not something the verb can act on, an unreadable config, a missing dependency, an internal failure (a crash anywhere in a command ends on `2`, never on Node's default `1`). Where a verb has more than one such cause it says which on stderr (`vat skill test run` prints `Reason: …`) — never in a fourth exit code. A path INSIDE a tree that the command cannot read is a finding, not an error: `vat audit` degrades it to `SCAN_PATH_UNREADABLE` and exits `0` or `1` on what it could read.
+
+A CI wrapper reads `$?` the same way for every verb:
+
+```bash
+case $? in 0) ;; 1) echo findings ;; *) echo broken; exit 1 ;; esac
+```
 
 ## Output Formats
 

package/docs/rag.md

@@ -279,7 +279,6 @@ rebuild the database from your markdown source files.
 RAG respects the same `vibe-agent-toolkit.config.yaml` patterns as other commands:
 
 ```yaml
-version: 1
 resources:
   include:
     - "docs/**/*.md"

package/docs/resources.md

@@ -196,7 +196,6 @@ behind RFC-3986-compliant leading-`/` resolution.
 Place `vibe-agent-toolkit.config.yaml` at project root:
 
 ```yaml
-version: 1
 resources:
   include:
     - "docs/**/*.md"