vigiles 10.0.0 → 11.0.0

package/dist/audit-score.d.ts

@@ -3,23 +3,30 @@
  *
  * A single structural-health number (the leaderboard's `scoreReport`) ranks
  * plugins, but it hides WHERE a harness is weak. This buckets the SAME
- * deterministic findings into four categories — Truthfulness, Triggering,
- * Structure, Tested — each a 0–100 ring, as a DIAGNOSTIC breakdown beneath one
- * headline `overall` = `100 − Σ(all graded penalties)` (the SAME summed model as
- * the leaderboard's single health number, via the shared `computeIntegrityScore`
- * — so the two surfaces never disagree). Same detectors, no re-detection
- * (one-detector-no-drift); all deterministic, no execution. (Safety — "do your
- * hooks actually block?" — is NOT an `audit` ring:
- * it requires executing your hooks, which needs cross-platform confinement
- * that isn't shipped yet, so it lives in the `vigiles/testing` API via
- * `guardrail-check`/`assertBlocksDisasters`, where you opt in explicitly.)
+ * deterministic findings into five categories — Truthfulness, Triggering,
+ * Structure, Safety, Tested — each a 0–100 ring, as a DIAGNOSTIC breakdown
+ * beneath one headline `overall` = `100 − Σ(all graded penalties)` (the SAME
+ * summed model as the leaderboard's single health number, via the shared
+ * `computeIntegrityScore` — so the two surfaces never disagree). Same detectors,
+ * no re-detection (one-detector-no-drift); all deterministic, no execution.
+ *
+ * SAFETY is fed by the STATIC lethal-trifecta capability check
+ * (`lethalTrifectaIssues` → `report.trifectaFindings`): a unit holding all three
+ * capability legs is a prompt-injection exfil path detectable from the tool-SET
+ * alone — nothing executes, so it sidesteps the confinement blocker. A `"hard"`
+ * (explicit all-three) finding is GRADED into the overall; a `"advisory"`
+ * (inherits-all) finding is SHOWN in the ring but not graded. NB the EXECUTING
+ * "do your hooks actually block?" disaster-battery is STILL not an `audit` ring:
+ * running arbitrary hooks safely needs cross-platform confinement that isn't
+ * shipped yet, so the battery lives in the `vigiles/testing` API via
+ * `guardrail-check`/`assertBlocksDisasters`, where you opt in explicitly.
  *
  * A category that can't be assessed scores `null` (n/a) and is EXCLUDED from the
  * overall — never a false 0. Pure over the `ScanReport`, so it's fully testable.
  */
 import { type PluginScore } from "./leaderboard.js";
 import type { ScanReport } from "./scan.js";
-export type CategoryKey = "Truthfulness" | "Triggering" | "Structure" | "Tested";
+export type CategoryKey = "Truthfulness" | "Triggering" | "Structure" | "Safety" | "Tested";
 export interface CategoryScore {
     readonly key: CategoryKey;
     /** 0–100, or `null` when the category isn't assessable (n/a — excluded from overall). */
@@ -52,7 +59,7 @@ export interface AuditScore {
     readonly empty: boolean;
 }
 /**
- * Bucket a scan report into the four deterministic Lighthouse categories as a
+ * Bucket a scan report into the five deterministic Lighthouse categories as a
  * DIAGNOSTIC breakdown, with the headline `overall` = `100 − Σ(all graded
  * penalties)` (the shared summed model — NOT the average of the rings — so it
  * equals the leaderboard's single health number). The advisory Tested ring and

package/dist/audit-score.js

@@ -7,16 +7,23 @@ exports.formatAuditScore = formatAuditScore;
  *
  * A single structural-health number (the leaderboard's `scoreReport`) ranks
  * plugins, but it hides WHERE a harness is weak. This buckets the SAME
- * deterministic findings into four categories — Truthfulness, Triggering,
- * Structure, Tested — each a 0–100 ring, as a DIAGNOSTIC breakdown beneath one
- * headline `overall` = `100 − Σ(all graded penalties)` (the SAME summed model as
- * the leaderboard's single health number, via the shared `computeIntegrityScore`
- * — so the two surfaces never disagree). Same detectors, no re-detection
- * (one-detector-no-drift); all deterministic, no execution. (Safety — "do your
- * hooks actually block?" — is NOT an `audit` ring:
- * it requires executing your hooks, which needs cross-platform confinement
- * that isn't shipped yet, so it lives in the `vigiles/testing` API via
- * `guardrail-check`/`assertBlocksDisasters`, where you opt in explicitly.)
+ * deterministic findings into five categories — Truthfulness, Triggering,
+ * Structure, Safety, Tested — each a 0–100 ring, as a DIAGNOSTIC breakdown
+ * beneath one headline `overall` = `100 − Σ(all graded penalties)` (the SAME
+ * summed model as the leaderboard's single health number, via the shared
+ * `computeIntegrityScore` — so the two surfaces never disagree). Same detectors,
+ * no re-detection (one-detector-no-drift); all deterministic, no execution.
+ *
+ * SAFETY is fed by the STATIC lethal-trifecta capability check
+ * (`lethalTrifectaIssues` → `report.trifectaFindings`): a unit holding all three
+ * capability legs is a prompt-injection exfil path detectable from the tool-SET
+ * alone — nothing executes, so it sidesteps the confinement blocker. A `"hard"`
+ * (explicit all-three) finding is GRADED into the overall; a `"advisory"`
+ * (inherits-all) finding is SHOWN in the ring but not graded. NB the EXECUTING
+ * "do your hooks actually block?" disaster-battery is STILL not an `audit` ring:
+ * running arbitrary hooks safely needs cross-platform confinement that isn't
+ * shipped yet, so the battery lives in the `vigiles/testing` API via
+ * `guardrail-check`/`assertBlocksDisasters`, where you opt in explicitly.
  *
  * A category that can't be assessed scores `null` (n/a) and is EXCLUDED from the
  * overall — never a false 0. Pure over the `ScanReport`, so it's fully testable.
@@ -138,6 +145,51 @@ function structure(r) {
         findings: [...findings, ...advisory],
     };
 }
+/**
+ * SAFETY — fed by the STATIC lethal-trifecta check (`report.trifectaFindings`).
+ * A `"hard"` finding (an explicit contract naming all three capability legs) is a
+ * declared prompt-injection exfil path and is GRADED (`W_TRIFECTA` each, the same
+ * weight `reportDeductions` sums into the overall, so the ring and the headline
+ * agree). A `"advisory"` finding (inherits-all) is SHOWN in the ring's findings
+ * but NOT graded — aligned with the inherits-all-is-advisory stance.
+ *
+ * Scores `null` (n/a, excluded from the overall) when there's NO tool-bearing
+ * surface to assess at all — no subagents AND no model-invocable skills. A
+ * user-invoked skill carries no model-driven trifecta risk, so it doesn't count
+ * as an assessable surface. When there ARE assessable surfaces but no trifecta,
+ * the ring is a clean 100.
+ */
+function safety(r) {
+    const modelInvocableSkills = r.skills.filter((s) => !s.userInvoked).length;
+    const assessable = r.agents.length + modelInvocableSkills;
+    if (assessable === 0) {
+        return {
+            key: "Safety",
+            score: null,
+            weight: 1,
+            findings: ["no tool-bearing surface to assess"],
+        };
+    }
+    const hard = r.trifectaFindings.filter((f) => f.finding.severity === "hard");
+    const { score, findings } = scoreFrom([
+        {
+            n: hard.length,
+            weight: leaderboard_js_1.W_TRIFECTA,
+            label: "unit(s) holding all three lethal-trifecta legs (prompt-injection exfil path)",
+        },
+    ]);
+    // inherits-all trifecta findings are ADVISORY: surfaced as a maximal-blast-radius
+    // note but never graded (mirrors the Structure inherits-all advisory).
+    const advisory = r.trifectaFindings
+        .filter((f) => f.finding.severity === "advisory")
+        .map((f) => `${f.name} inherits all tools — maximal trifecta blast radius (advisory)`);
+    return {
+        key: "Safety",
+        score,
+        weight: 1,
+        findings: [...findings, ...advisory],
+    };
+}
 function tested(r) {
     const { score, findings } = scoreFrom([
         { n: r.untested, weight: W_UNTESTED, label: "untested surface(s)" },
@@ -157,7 +209,7 @@ function isEmptyAudit(r) {
     return (0, leaderboard_js_1.isEmptyMachine)(r) && !r.instructions;
 }
 /**
- * Bucket a scan report into the four deterministic Lighthouse categories as a
+ * Bucket a scan report into the five deterministic Lighthouse categories as a
  * DIAGNOSTIC breakdown, with the headline `overall` = `100 − Σ(all graded
  * penalties)` (the shared summed model — NOT the average of the rings — so it
  * equals the leaderboard's single health number). The advisory Tested ring and
@@ -169,6 +221,7 @@ function auditScore(report) {
             "Truthfulness",
             "Triggering",
             "Structure",
+            "Safety",
             "Tested",
         ];
         return {
@@ -187,6 +240,7 @@ function auditScore(report) {
         truthfulness(report),
         triggering(report),
         structure(report),
+        safety(report),
         tested(report),
     ];
     // The headline is the SUMMED model (the shared integrity score), NOT the average

package/dist/cli.js

@@ -678,6 +678,13 @@ function lintExitCode(report) {
         report.frontmatterValidErrors > 0 ||
         report.mcpHookErrors > 0 ||
         report.preferCompiledHookErrors > 0 ||
+        report.lethalTrifectaErrors > 0 ||
+        report.skillResourceErrors > 0 ||
+        report.skillFenceErrors > 0 ||
+        report.pluginLayoutErrors > 0 ||
+        report.delegationTrifectaErrors > 0 ||
+        report.hookBlockErrors > 0 ||
+        report.hookMatcherErrors > 0 ||
         report.symbolRefErrors > 0 ||
         report.mcpRefErrors > 0)
         return 2;
@@ -1028,6 +1035,29 @@ async function runLint(restArgs, flags, config) {
     // 7n. Prefer-compiled-hooks — ONE discovery nudge (not per-hook) toward
     // compiled `vigiles/hook` artifacts when hand-written hooks ship. Recommendation.
     const preferCompiledHooks = checkPreferCompiledHooks(config, silent, adapter);
+    // 7o. Lethal-trifecta — a unit (subagent / model-invocable skill) whose tools
+    // hold all three legs (read-private + ingest-untrusted + exfiltrate) is a
+    // prompt-injection exfil path (Rule of Two). Capability SET-intersection.
+    const lethalTrifecta = checkLethalTrifecta(config, silent, adapter);
+    // 7p. Skill-resource — a SKILL.md body referencing a bundled file that doesn't
+    // exist on disk under the skill dir (the agent gets nothing). FP-safe.
+    const skillResources = checkSkillResourceResolves(config, silent, adapter);
+    // 7q. Skill-missing-fence — a SKILL.md opening with `name:`/`description:` but no
+    // `---` fence loads as plain body (invisible — no name/description/trigger).
+    const skillFence = checkSkillMissingFence(config, silent, adapter);
+    // 7r. Plugin-dir-layout — functional surface dirs (skills/agents/commands) nested
+    // inside the `.claude-plugin/` manifest dir where the harness can't see them.
+    const pluginLayout = checkPluginDirLayout(config, silent, adapter);
+    // 7s. Delegation-trifecta — a lethal trifecta that emerges across a delegation
+    // edge (a subagent's own ∪ delegated-to capability) though no single unit trips it.
+    const delegationTrifecta = checkDelegationTrifecta(config, silent, adapter);
+    // 7t. Hook-block-ineffective — a hook that looks like it blocks but silently
+    // doesn't (block decision on a non-blocking event, or the legacy `decision`
+    // field on a permission-gated event). The #1 verified hook pain (#19009).
+    const hookBlock = checkHookBlockIneffective(config, silent, adapter);
+    // 7u. Hook-matcher — a hook `matcher` that never fires (tool-name typo, or a
+    // malformed/undeclared MCP form).
+    const hookMatcher = checkHookMatcher(config, silent, adapter);
     // 8. Validate vigiles builder calls inside markdown code blocks. Default
     // is to validate every ref; illustrative blocks opt out via
     // `<!-- vigiles:ignore -->` (single block) or
@@ -1095,6 +1125,20 @@ async function runLint(restArgs, flags, config) {
         mcpHookErrors: mcpHookTargets.errors,
         preferCompiledHookIssues: preferCompiledHooks.issues,
         preferCompiledHookErrors: preferCompiledHooks.errors,
+        lethalTrifectaIssues: lethalTrifecta.issues,
+        lethalTrifectaErrors: lethalTrifecta.errors,
+        skillResourceIssues: skillResources.issues,
+        skillResourceErrors: skillResources.errors,
+        skillFenceIssues: skillFence.issues,
+        skillFenceErrors: skillFence.errors,
+        pluginLayoutIssues: pluginLayout.issues,
+        pluginLayoutErrors: pluginLayout.errors,
+        delegationTrifectaIssues: delegationTrifecta.issues,
+        delegationTrifectaErrors: delegationTrifecta.errors,
+        hookBlockIssues: hookBlock.issues,
+        hookBlockErrors: hookBlock.errors,
+        hookMatcherIssues: hookMatcher.issues,
+        hookMatcherErrors: hookMatcher.errors,
         docRefErrors: docRefReport.errors.length,
         symbolRefErrors,
         mcpRefErrors,
@@ -2673,6 +2717,211 @@ function checkDescriptionOverlap(config, silent, adapter) {
     }
     return { issues: found.length, errors: sev === "error" ? found.length : 0 };
 }
+/**
+ * Apply the `lethal-trifecta` rule: a unit (subagent / model-invocable skill)
+ * whose declared tools hold all three legs (read-private + ingest-untrusted +
+ * exfiltrate) is a prompt-injection exfil path (Meta's Rule of Two). Reuses
+ * `scanPlugin`'s `trifectaFindings` (a capability SET-intersection, one detector,
+ * no drift). Warning by default; "error" gates CI. Surfaces across BOTH subagents
+ * and skills, so it is NOT gated on the `subagents` capability — a skill-only
+ * harness still has the surface.
+ */
+function checkLethalTrifecta(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["lethal-trifecta"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).trifectaFindings;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nLethal-trifecta check:\n");
+        for (const t of found) {
+            const msg = `${t.kind} ${t.name}: ${t.finding.message}`;
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${t.path}: ${msg}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", msg, t.path);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `skill-resource-resolves` rule: a SKILL.md body referencing a bundled
+ * file (`scripts/`/`references/`/`assets/` or a relative markdown link with an
+ * extension) that doesn't exist on disk — the agent reads the instruction and gets
+ * nothing. Reuses `scanPlugin`'s `skillResourceIssues` (high-precision / FP-safe,
+ * one detector, no drift). Warning by default; "error" gates CI.
+ */
+function checkSkillResourceResolves(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["skill-resource-resolves"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).skillResourceIssues;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nSkill-resource check:\n");
+        for (const s of found) {
+            const msg = `${s.name}: bundled resource "${s.finding.ref}" (line ${String(s.finding.line)}) is referenced but missing — the agent reads the instruction and gets nothing.`;
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${s.path}: ${msg}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", msg, s.path);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `skill-missing-fence` rule: a SKILL.md that opens with
+ * frontmatter-looking keys (`name:`/`description:`) but no `---` fence loads as
+ * pure body — no name, no description, no trigger (the skill is invisible).
+ * Reuses `scanPlugin`'s `skillFenceIssues` (one detector, no drift). Warning by
+ * default; "error" gates CI.
+ */
+function checkSkillMissingFence(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["skill-missing-fence"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).skillFenceIssues;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nSkill-missing-fence check:\n");
+        for (const s of found) {
+            const msg = `${s.name}: ${s.finding.message}`;
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${s.path}: ${msg}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", msg, s.path);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `plugin-dir-layout` rule: functional surface dirs (skills/agents/
+ * commands) nested inside the `.claude-plugin/` manifest dir where the harness
+ * can't see them (the #1 plugin-author mistake). Reuses `scanPlugin`'s
+ * `pluginLayoutIssues` (one detector, no drift). Warning by default; "error"
+ * gates CI.
+ */
+function checkPluginDirLayout(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["plugin-dir-layout"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).pluginLayoutIssues;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nPlugin-dir-layout check:\n");
+        for (const p of found) {
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${p.message}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", p.message);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `delegation-trifecta` rule: a lethal trifecta that EMERGES across a
+ * delegation edge — a subagent whose effective (own ∪ delegated-to) capability
+ * holds all three legs though no single unit does. Reuses `scanPlugin`'s
+ * `delegationTrifecta` (one detector, no drift). Warning by default; "error"
+ * gates CI. Surfaces across the subagent graph, so it is NOT gated on a
+ * capability the way a surface-specific rule is.
+ */
+function checkDelegationTrifecta(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["delegation-trifecta"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).delegationTrifecta;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nDelegation-trifecta check:\n");
+        for (const d of found) {
+            const msg = `${d.finding.name}: ${d.finding.message}`;
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${d.path}: ${msg}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", msg, d.path);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `hook-block-ineffective` rule: a hook that LOOKS like it blocks but
+ * silently doesn't — a block decision (`exit 2` / `decision` / `permissionDecision`)
+ * on a non-blocking event, or the legacy top-level `decision` field on a
+ * permission-gated event (#19009, the #1 verified hook pain). Reuses `scanPlugin`'s
+ * `hookBlockFindings` (one detector, no drift). Warning by default; "error" gates CI.
+ */
+function checkHookBlockIneffective(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["hook-block-ineffective"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    if (!adapter.capabilities.shellHooks) {
+        reportNotApplicable("Hook-block check", "shell hooks", adapter, silent);
+        return { issues: 0, errors: 0 };
+    }
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).hookBlockFindings;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nHook-block check:\n");
+        for (const h of found) {
+            const where = h.scriptPath ?? "(inline)";
+            const msg = `[${h.event}] ${where}: ${h.message}`;
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${msg}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", msg, h.scriptPath ?? undefined);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `hook-matcher` rule: a hook `matcher` string that silently never
+ * fires — a tool-name typo (`bash`→`Bash`) or a malformed/undeclared MCP form.
+ * Reuses `scanPlugin`'s `hookMatcherFindings` (one detector, no drift). Warning
+ * by default; "error" gates CI.
+ */
+function checkHookMatcher(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["hook-matcher"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    if (!adapter.capabilities.shellHooks) {
+        reportNotApplicable("Hook-matcher check", "shell hooks", adapter, silent);
+        return { issues: 0, errors: 0 };
+    }
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).hookMatcherFindings;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nHook-matcher check:\n");
+        for (const m of found) {
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${m.message}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", m.message);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
 /**
  * Apply the `mcp-hook-target-resolves` rule: a `type: "mcp_tool"` hook action
  * that's incomplete (no `server`/`tool`) or targets a server the plugin doesn't

package/dist/core/CLAUDE.md.spec.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("./spec.js").ClaudeSpec;
+export default _default;
+//# sourceMappingURL=CLAUDE.md.spec.d.ts.map

package/dist/core/CLAUDE.md.spec.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Directory-scoped guidance for working in `src/core/` (the harness-agnostic
+ * detectors + domain).
+ *
+ * The full project rule set is the ROOT `CLAUDE.md` (compiled from
+ * `CLAUDE.md.spec.ts`). This nested spec adds only the discipline that belongs
+ * next to the detectors themselves — Claude Code loads it as directory memory
+ * whenever you work in `src/core/`. Source of truth; `src/core/CLAUDE.md` is a
+ * compiled build artifact (`vigiles compile`).
+ */
+const spec_js_1 = require("./spec.js");
+exports.default = (0, spec_js_1.claude)({
+    sections: {
+        scope: `Working in \`src/core/\`? This is the harness-AGNOSTIC domain (spec, compile, linters, the lint/audit detectors). The root \`CLAUDE.md\` holds the full positioning + rule set — read it first. Two invariants live closest to this code: the core must not import an adapter (\`core ⊄ adapter\`, eslint-enforced) and must not hard-code a Claude Code literal (read it from the injected layout/dialect). This file adds the rule for ADDING or CHANGING a detector.`,
+    },
+    keyFiles: {
+        "src/core/rule-meta.ts": "The RuleMeta registry — every rule's decidability bucket + severity + detector, the single source the detector-meta rule enforces.",
+        "src/core/types.ts": "RulesConfig — the rule-name keys the registry is keyed on.",
+    },
+    rules: {
+        "detector-meta": (0, spec_js_1.guidance)("A deterministic DETECTOR here is one half of a RULE — and a rule is not done until it is DECLARED. Three things move together (sibling of one-detector-no-drift + rules-docs-in-sync): (1) the pure detector function (shared by `lint` AND `audit`, never reimplemented per surface; read the layout/dialect, never a CC literal); (2) its entry in `src/core/rule-meta.ts` — the `Record<RuleName, RuleMeta>` won't typecheck without it — declaring its DECIDABILITY BUCKET (structural-closed = a type could prevent it / external-decidable = needs the world, error-capable / heuristic-behavioral = warn-or-measure-only), surface, defaultSeverity, the detector name, and any upstreamPrevention; (3) its `docs/rules/<name>.md` (the coverage test binds the registry to the docs by an EXACT set match, so a missing meta or doc fails CI). The bucket is the CEILING, not a preference — a heuristic proxy may NEVER default to `error` (it cries wolf); a structural/external fact MAY, once proven FP-safe. Before writing a new detector, CLASSIFY the defect into a bucket — that decides whether it can ever gate. The full model + the prose behind the buckets is the root `lint-rule-calibration` rule and `research/enforcement-model.md`."),
+    },
+});
+//# sourceMappingURL=CLAUDE.md.spec.js.map

package/dist/core/delegation-trifecta.d.ts

@@ -0,0 +1,64 @@
+/**
+ * DELEGATION-TRIFECTA — the lethal trifecta SPLIT across a delegation edge.
+ *
+ * The per-unit {@link lethalTrifectaIssues} (`./lethal-trifecta.ts`) catches a
+ * single subagent / skill that holds all THREE capability legs at once. But the
+ * trifecta can EMERGE across a delegation (or inheritance) edge: a parent that
+ * can only read private data (leg A) delegates to a child that can ingest
+ * untrusted content AND exfiltrate (legs B+C). NEITHER unit trips the per-unit
+ * check, yet the CHAIN — the parent plus everything it can reach — forms the full
+ * trifecta. A prompt injection in the child's untrusted input can pivot back
+ * through the delegation and leak the parent's private data.
+ *
+ * This is CAPABILITY-DIFF ACROSS THE DELEGATION TREE: the EFFECTIVE (combined)
+ * capability of a unit is the union of its own tools plus the tools of every unit
+ * reachable through `delegatesTo`. We classify that effective set and flag a unit
+ * whose effective set is a full trifecta while its OWN set is not.
+ *
+ * NO DOUBLE-REPORT (one-detector-no-drift / don't-cry-wolf): a unit whose OWN
+ * tools already form a full trifecta is SKIPPED here — {@link lethalTrifectaIssues}
+ * owns it. This detector reports ONLY the EMERGENT case the per-unit check can't
+ * see.
+ *
+ * HIGH-PRECISION (FP-safe): if the effective set contains a wildcard (inherits-all)
+ * the unit reaches everything and would always "trifecta" — that maximal-blast-
+ * radius case is the per-unit ADVISORY detector's job, so we SKIP it. We flag ONLY
+ * concrete, explicit tool unions where every leg is supplied by a named tool.
+ *
+ * Pure, no IO. The delegation graph (nodes + directed `delegatesTo` edges) is the
+ * INPUT — this module does not decide where edges come from; a caller supplies them
+ * from the parsed harness. The dialect is injected (core ⊄ adapter), reused for the
+ * underlying leg classification.
+ */
+import type { HarnessDialect } from "./dialect.js";
+import { type TrifectaLegs } from "./lethal-trifecta.js";
+/** One unit (subagent/skill) in the delegation graph. */
+export interface CapabilityNode {
+    readonly name: string;
+    readonly kind: "skill" | "agent";
+    /** This unit's OWN declared tools. [] = none declared. ["*"] = inherits-all (wildcard). */
+    readonly tools: readonly string[];
+    /** Names of units this one can delegate to / inherits capabilities from (directed edges). */
+    readonly delegatesTo: readonly string[];
+}
+/** A trifecta that EMERGES across delegation — present in a unit's effective set but NOT its own. */
+export interface DelegationTrifectaFinding {
+    readonly name: string;
+    readonly kind: "skill" | "agent";
+    /** The delegated-to units (by name) that supplied at least one leg the unit lacks on its own. */
+    readonly via: readonly string[];
+    /** The tools that supplied each leg in the EFFECTIVE (combined) set. */
+    readonly legs: TrifectaLegs;
+    /** Ready-to-show, actionable message. */
+    readonly message: string;
+}
+/**
+ * Find units whose EFFECTIVE (own + delegated) capability set forms a full lethal
+ * trifecta that their OWN set does not — an emergent, cross-delegation exfil path.
+ *
+ * Returns findings in stable order (by node name). See the module header for the
+ * skip rules (own-set already a trifecta → owned by the per-unit detector; an
+ * effective wildcard → owned by the per-unit advisory).
+ */
+export declare function delegationTrifectaIssues(nodes: readonly CapabilityNode[], dialect: HarnessDialect): DelegationTrifectaFinding[];
+//# sourceMappingURL=delegation-trifecta.d.ts.map

package/dist/core/delegation-trifecta.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.delegationTrifectaIssues = delegationTrifectaIssues;
+const lethal_trifecta_js_1 = require("./lethal-trifecta.js");
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+/** A full trifecta = all three legs non-empty. */
+function isFullTrifecta(legs) {
+    return (legs.private.length > 0 &&
+        legs.untrusted.length > 0 &&
+        legs.exfil.length > 0);
+}
+/** Strips a `Tool(restriction)` suffix and returns the base tool name. */
+function baseTool(raw) {
+    return raw.split("(")[0].trim();
+}
+/** True for the wildcard sentinels that mean "inherits-all". */
+function isWildcard(tool) {
+    return tool === "" || tool === "*";
+}
+/**
+ * The set of node names reachable from `start` over `delegatesTo`, INCLUDING
+ * `start` itself. Cycle-safe (a `visited` set). An edge naming a node not in the
+ * map is skipped — its tools can't be resolved.
+ */
+function effectiveReach(start, byName) {
+    const visited = new Set();
+    const stack = [start];
+    while (stack.length > 0) {
+        const name = stack.pop();
+        if (name === undefined || visited.has(name))
+            continue;
+        visited.add(name);
+        const node = byName.get(name);
+        if (node === undefined)
+            continue;
+        for (const next of node.delegatesTo) {
+            if (!visited.has(next))
+                stack.push(next);
+        }
+    }
+    return visited;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Find units whose EFFECTIVE (own + delegated) capability set forms a full lethal
+ * trifecta that their OWN set does not — an emergent, cross-delegation exfil path.
+ *
+ * Returns findings in stable order (by node name). See the module header for the
+ * skip rules (own-set already a trifecta → owned by the per-unit detector; an
+ * effective wildcard → owned by the per-unit advisory).
+ */
+function delegationTrifectaIssues(nodes, dialect) {
+    const byName = new Map();
+    for (const node of nodes)
+        byName.set(node.name, node);
+    const findings = [];
+    for (const node of nodes) {
+        // (b) If the unit's OWN tools already form a full trifecta, the per-unit
+        // detector owns it — never double-report.
+        const ownLegs = (0, lethal_trifecta_js_1.classifyTrifectaLegs)(node.tools, dialect);
+        if (isFullTrifecta(ownLegs))
+            continue;
+        // (c) Effective tools = the de-duplicated union across the reachable set.
+        const reach = effectiveReach(node.name, byName);
+        const effSet = new Set();
+        for (const name of reach) {
+            const reached = byName.get(name);
+            if (reached === undefined)
+                continue;
+            for (const tool of reached.tools)
+                effSet.add(tool);
+        }
+        const effectiveTools = [...effSet];
+        // (d) FP-safe wildcard guard: an inherits-all unit in the reachable set
+        // would always "trifecta" — that's the per-unit advisory's job.
+        if (effectiveTools.some((t) => isWildcard(baseTool(t))))
+            continue;
+        // (e) Classify the effective set.
+        const effLegs = (0, lethal_trifecta_js_1.classifyTrifectaLegs)(effectiveTools, dialect);
+        // (f) Emit ONLY when the effective set is a full trifecta (own set wasn't).
+        if (!isFullTrifecta(effLegs))
+            continue;
+        // The tools that supplied any leg in the effective set.
+        const legTools = new Set([
+            ...effLegs.private,
+            ...effLegs.untrusted,
+            ...effLegs.exfil,
+        ]);
+        // `via` = reachable units (excluding this node) that contribute a leg tool.
+        const via = [];
+        for (const name of reach) {
+            if (name === node.name)
+                continue;
+            const reached = byName.get(name);
+            if (reached === undefined)
+                continue;
+            const contributes = reached.tools.some((t) => legTools.has(baseTool(t)));
+            if (contributes && !via.includes(name))
+                via.push(name);
+        }
+        via.sort();
+        const message = `Subagent "${node.name}" is not a data-leak risk on its own, but combined ` +
+            `with what it delegates to (${via.join(", ")}), the chain can read private ` +
+            `data (${effLegs.private.join(", ")}), ingest untrusted content ` +
+            `(${effLegs.untrusted.join(", ")}), AND exfiltrate ` +
+            `(${effLegs.exfil.join(", ")}) — a prompt injection in the untrusted input ` +
+            `could pivot through the delegation to leak data. Break the delegation or ` +
+            `drop one leg.`;
+        findings.push({
+            name: node.name,
+            kind: node.kind,
+            via,
+            legs: effLegs,
+            message,
+        });
+    }
+    findings.sort((a, b) => a.name.localeCompare(b.name));
+    return findings;
+}
+//# sourceMappingURL=delegation-trifecta.js.map