vigiles 10.0.0 → 11.0.0

package/dist/core/types.d.ts

@@ -220,6 +220,77 @@ export interface RulesConfig {
      * as `scan` (mcpHookIssues).
      */
     "mcp-hook-target-resolves"?: RuleSeverity;
+    /**
+     * Flag a unit (subagent / model-invocable skill) whose declared tools hold all
+     * THREE legs of Simon Willison's "lethal trifecta" — read private data, ingest
+     * untrusted content, AND exfiltrate — a prompt-injection exfil path with no
+     * exploit code (Meta's Rule of Two: allow at most two). A capability SET-
+     * intersection over the declared contract, NOT a text scan; high-precision (only
+     * well-known tools map to a leg). An EXPLICIT all-three contract is a "hard"
+     * finding; an inherits-all unit (no contract → every leg) is "advisory". Default
+     * "warn" (don't-cry-wolf rollout); raise to "error" to gate CI. Same detector as
+     * `scan` (lethalTrifectaIssues). See docs/rules/lethal-trifecta.md.
+     */
+    "lethal-trifecta"?: RuleSeverity;
+    /**
+     * Flag a SKILL.md body referencing a bundled file (`scripts/`/`references/`/
+     * `assets/`, or a relative markdown link with an extension) that doesn't exist
+     * on disk under the skill dir — the agent reads the instruction, gets nothing,
+     * and silently continues. The cross-reference moat applied to the SKILL.md body.
+     * High-precision / FP-safe (skips URLs, `$VAR` tokens, `../` escapes, extension-
+     * less mentions). Default "warn"; raise to "error" to gate CI. Same detector as
+     * `scan` (skillResourceIssues). See docs/rules/skill-resource-resolves.md.
+     */
+    "skill-resource-resolves"?: RuleSeverity;
+    /**
+     * Flag a SKILL.md that opens with frontmatter-looking keys (`name:`,
+     * `description:`, …) but has NO opening `---` fence — the harness loads the
+     * whole file as body, so the skill has no name/description/trigger and is
+     * invisible (never fires). High-precision (a fixed key whitelist; markdown /
+     * prose lines never match). Default "warn"; raise to "error" to gate CI. Same
+     * detector as `scan` (skillFenceIssues). See docs/rules/skill-missing-fence.md.
+     */
+    "skill-missing-fence"?: RuleSeverity;
+    /**
+     * Flag a functional surface directory (skills/agents/commands) nested INSIDE
+     * the `.claude-plugin/` manifest dir, where only `plugin.json` belongs — the
+     * harness can't see it, so the surface is invisible (the #1 plugin-author
+     * mistake). Pure filesystem check, FP-safe. Default "warn"; raise to "error"
+     * to gate CI. Same detector as `scan` (pluginLayoutIssues). See
+     * docs/rules/plugin-dir-layout.md.
+     */
+    "plugin-dir-layout"?: RuleSeverity;
+    /**
+     * Flag a lethal trifecta that EMERGES across a delegation edge — a subagent
+     * whose effective (own ∪ delegated-to) capability holds all three legs though
+     * no single unit does (the combined blast radius). The capability-diff across
+     * the delegation tree; skips units the per-unit `lethal-trifecta` already
+     * flags (no double-report), FP-safe (explicit edges, wildcard-guarded). Default
+     * "warn"; raise to "error" to gate CI. Same detector as `scan`
+     * (delegationTrifecta). See docs/rules/delegation-trifecta.md.
+     */
+    "delegation-trifecta"?: RuleSeverity;
+    /**
+     * Flag a hook that LOOKS like it blocks but silently doesn't — a block decision
+     * (`exit 2` / `decision` / `permissionDecision`) on an event that can't veto, or
+     * the legacy top-level `decision` field on a permission-gated event where only
+     * `hookSpecificOutput.permissionDecision` works (#19009, the #1 verified hook
+     * pain). FP-safe (conservative literal patterns; the blocking-event sets are
+     * read from the dialect, so it runs only where they're declared). Default "warn";
+     * raise to "error" to gate CI. Same detector as `scan` (hookBlockFindings). See
+     * docs/rules/hook-block-ineffective.md.
+     */
+    "hook-block-ineffective"?: RuleSeverity;
+    /**
+     * Flag a hook `matcher` string that silently never fires — a close typo of a
+     * built-in tool (`bash`→`Bash`), or a malformed/undeclared MCP form
+     * (`mcp_memory_*` instead of `mcp__memory__.*`, or a server the plugin doesn't
+     * declare). High-precision (close-typo only; MCP gated on a declared set,
+     * built-ins allowlisted; wildcards/regex skipped). Default "warn"; raise to
+     * "error" to gate CI. Same detector as `scan` (hookMatcherFindings). See
+     * docs/rules/hook-matcher.md.
+     */
+    "hook-matcher"?: RuleSeverity;
 }
 /** Extract severity from a rule value (handles both simple and tuple forms). */
 export declare function ruleSeverity<T>(rule: RuleWithOptions<T> | undefined): RuleSeverity;

package/dist/core/validate.d.ts

@@ -1,5 +1,6 @@
 import type { ParsedRule, ValidationError, ValidationResult, ReadResult, FileResult, ValidatePathsResult, RulesConfig, VigilesConfig, MarkerType, ParseOptions, ValidateOptions, ValidatePathsOptions, ReadOptions } from "./types.js";
 export type { ParsedRule, ValidationError, ValidationResult, ReadResult, FileResult, ValidatePathsResult, RulesConfig, VigilesConfig, MarkerType, ParseOptions, ValidateOptions, ValidatePathsOptions, ReadOptions, };
+export declare const DEFAULT_RULES: Required<RulesConfig>;
 export declare function findInstructionFiles(cwd?: string, configFiles?: string[]): string[];
 export declare function loadConfig(): VigilesConfig;
 export declare function parseRules(content: string, { ruleMarkers }?: ParseOptions): ParsedRule[];

package/dist/core/validate.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_RULES = void 0;
 exports.findInstructionFiles = findInstructionFiles;
 exports.loadConfig = loadConfig;
 exports.parseRules = parseRules;
@@ -28,7 +29,7 @@ const VALID_MARKERS = ["headings", "checkboxes"];
 const INSTRUCTION_FILES = ["CLAUDE.md", "AGENTS.md"];
 // The default instruction file to validate when no config names one.
 const DEFAULT_FILES = [INSTRUCTION_FILES[0]];
-const DEFAULT_RULES = {
+exports.DEFAULT_RULES = {
     "require-instructions-spec": "warn",
     // Default OFF — the consistent `require-<surface>-spec` parallel. Skills are
     // legitimately hand-written, so requiring a .spec.ts per SKILL.md is the wrong
@@ -70,10 +71,31 @@ const DEFAULT_RULES = {
     "frontmatter-valid": "warn",
     // A mcp_tool hook incomplete / targeting an undeclared server — on by default at warn.
     "mcp-hook-target-resolves": "warn",
+    // Lethal-trifecta capability set-intersection (read-private + ingest-untrusted +
+    // exfiltrate in one unit) — WARN by default (don't-cry-wolf rollout); raise to error.
+    "lethal-trifecta": "warn",
+    // A SKILL.md body referencing a missing bundled resource — WARN by default
+    // (don't-cry-wolf rollout, FP-safe); raise to error to gate CI.
+    "skill-resource-resolves": "warn",
+    // A SKILL.md missing its opening `---` fence (invisible skill) — WARN by
+    // default (FP-safe key whitelist); raise to error to gate CI.
+    "skill-missing-fence": "warn",
+    // Functional dirs nested inside `.claude-plugin/` (invisible surfaces) — WARN
+    // by default; raise to error to gate CI.
+    "plugin-dir-layout": "warn",
+    // A lethal trifecta emerging across a delegation edge (combined blast radius) —
+    // WARN by default (don't-cry-wolf rollout); raise to error to gate CI.
+    "delegation-trifecta": "warn",
+    // A hook that looks like it blocks but silently doesn't (#19009) — WARN by
+    // default (FP-safe literal patterns); raise to error to gate CI.
+    "hook-block-ineffective": "warn",
+    // A hook matcher that never fires (tool typo / wrong MCP form) — WARN by
+    // default (high-precision); raise to error to gate CI.
+    "hook-matcher": "warn",
 };
 const DEFAULT_CONFIG = {
     ruleMarkers: ["headings", "checkboxes"],
-    rules: DEFAULT_RULES,
+    rules: exports.DEFAULT_RULES,
     files: DEFAULT_FILES,
 };
 // ---------------------------------------------------------------------------
@@ -99,7 +121,7 @@ function loadConfig() {
         const config = {
             ...DEFAULT_CONFIG,
             ...userConfig,
-            rules: { ...DEFAULT_RULES, ...userConfig.rules },
+            rules: { ...exports.DEFAULT_RULES, ...userConfig.rules },
             files: Array.isArray(userConfig.files) ? userConfig.files : DEFAULT_FILES,
         };
         if (!Array.isArray(config.ruleMarkers) ||
@@ -170,7 +192,7 @@ function parseRules(content, { ruleMarkers } = {}) {
 // Core validation
 // ---------------------------------------------------------------------------
 function validate(content, { ruleMarkers, rules: rulesConfig, filePath, dialect } = {}) {
-    const activeRules = rulesConfig ?? DEFAULT_RULES;
+    const activeRules = rulesConfig ?? exports.DEFAULT_RULES;
     const parsedRules = parseRules(content, { ruleMarkers });
     const enforced = parsedRules.filter((r) => r.enforcement === "enforced").length;
     const guidanceOnly = parsedRules.filter((r) => r.enforcement === "guidance").length;

package/dist/leaderboard.d.ts

@@ -26,6 +26,7 @@ export declare const W_NO_DESCRIPTION = 10;
 export declare const W_DANGLING_REF = 8;
 export declare const W_OVERLAP = 8;
 export declare const W_NO_CONTRACT = 5;
+export declare const W_TRIFECTA = 20;
 /** Map a 0–100 structural-health score to its letter grade (A ≥90 … F <60). */
 export declare function gradeFor(score: number): PluginScore["grade"];
 /** One deduction: a count, its per-item weight, and the label if non-zero. */

package/dist/leaderboard.js

@@ -12,7 +12,7 @@
  * model and stack on top later; this part runs anywhere in CI for free.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.W_NO_CONTRACT = exports.W_OVERLAP = exports.W_DANGLING_REF = exports.W_NO_DESCRIPTION = exports.W_MISSING_HOOK = void 0;
+exports.W_TRIFECTA = exports.W_NO_CONTRACT = exports.W_OVERLAP = exports.W_DANGLING_REF = exports.W_NO_DESCRIPTION = exports.W_MISSING_HOOK = void 0;
 exports.gradeFor = gradeFor;
 exports.reportDeductions = reportDeductions;
 exports.isEmptyMachine = isEmptyMachine;
@@ -49,6 +49,7 @@ exports.W_NO_DESCRIPTION = 10; // a skill with no usable description → can't t
 exports.W_DANGLING_REF = 8; // a referenced intra-plugin file that's missing → broken path
 exports.W_OVERLAP = 8; // a description collision → the wrong skill fires
 exports.W_NO_CONTRACT = 5; // generic small-footgun weight (disallowedTools typo, invalid model/color)
+exports.W_TRIFECTA = 20; // a HARD lethal-trifecta contract (all three legs, explicit) → a declared prompt-injection exfil path
 // Two things are advisory, NOT graded penalties (shown, never scored — see scoreReport):
 //   - untested surfaces — a hardening gap, not breakage.
 //   - an agent that inherits all tools (no `tools:` line) — see reportDeductions for why.
@@ -77,7 +78,17 @@ function reportDeductions(r) {
     const deadTools = r.agents.reduce((n, a) => n + a.toolIssues.length, 0);
     const deadMcpTools = r.agents.reduce((n, a) => n + a.mcpToolIssues.length, 0);
     const deadDisallowed = r.agents.reduce((n, a) => n + a.disallowedToolIssues.length, 0);
+    // HARD lethal-trifecta findings only — an EXPLICIT contract naming all three
+    // legs (a declared exfil path). Advisory (inherits-all) trifecta findings are
+    // surfaced but NEVER graded (aligned with the inherits-all stance), so they're
+    // excluded here.
+    const hardTrifecta = r.trifectaFindings.filter((f) => f.finding.severity === "hard").length;
     return [
+        {
+            n: hardTrifecta,
+            weight: exports.W_TRIFECTA,
+            label: "unit(s) holding all three lethal-trifecta legs (prompt-injection exfil path)",
+        },
         {
             n: missingHooks,
             weight: exports.W_MISSING_HOOK,
@@ -146,6 +157,33 @@ function reportDeductions(r) {
             weight: exports.W_DANGLING_REF,
             label: "mcp_tool hook(s) incomplete / targeting an undeclared server",
         },
+        {
+            n: r.skillResourceIssues.length,
+            weight: exports.W_DANGLING_REF,
+            label: "skill bundled-resource ref(s) that don't resolve on disk",
+        },
+        {
+            n: r.skillFenceIssues.length,
+            weight: exports.W_NO_DESCRIPTION,
+            label: "invisible skill(s) (frontmatter with no opening `---` fence)",
+        },
+        {
+            n: r.pluginLayoutIssues.length,
+            weight: exports.W_NO_DESCRIPTION,
+            label: "functional dir(s) misplaced inside `.claude-plugin/` (invisible)",
+        },
+        {
+            n: r.hookBlockFindings.length,
+            weight: exports.W_MISSING_HOOK,
+            label: "hook(s) that look like they block but silently don't",
+        },
+        {
+            n: r.hookMatcherFindings.length,
+            weight: exports.W_MISSING_HOOK,
+            label: "hook matcher(s) that never fire (typo / wrong MCP form)",
+        },
+        // NB: delegationTrifecta (like the advisory per-unit/inherits-all trifecta) is a
+        // ⚠ RISK, surfaced but NOT graded — only the HARD per-unit trifecta above scores.
         // NB: untested surfaces are NOT a penalty — an untested surface is a hardening
         // gap, not breakage, so it never drags the health score (it's appended as an
         // advisory note below). The score ranks what's BROKEN.
@@ -239,11 +277,11 @@ function formatLeaderboard(scores) {
         const issue = s.issues.length > 0 ? ` — ${s.issues.join("; ")}` : "";
         out.push(`  ${rank}  ${score}    ${s.grade}      ${s.name}${issue}`);
     });
-    out.push("", "Structural health only (no model). Weights: missing hook -15, no-description", "skill -10, broken intra-plugin ref -8, dead tool/MCP ref -8.", "Inherit-all subagents and untested surfaces are advisory — shown, not scored.");
+    out.push("", "Structural health only (no model). Weights: lethal-trifecta unit -20, missing", "hook -15, no-description skill -10, broken intra-plugin ref -8, dead tool/MCP", "ref -8. Inherit-all subagents and untested surfaces are advisory — shown, not", "scored.");
     return out.join("\n");
 }
-const LEADERBOARD_METHOD = "_Structural health only (deterministic, no model): missing hook −15, " +
-    "no-description skill −10, broken intra-plugin / dead-tool ref −8. " +
+const LEADERBOARD_METHOD = "_Structural health only (deterministic, no model): lethal-trifecta unit −20, " +
+    "missing hook −15, no-description skill −10, broken intra-plugin / dead-tool ref −8. " +
     "Inherit-all subagents and untested surfaces are advisory (shown, not " +
     "scored). Behavioural columns (trigger-rate, collisions, egress) stack on top._";
 /**

package/dist/scan.d.ts

@@ -20,6 +20,13 @@ import { type DescriptionOverlap } from "./core/description-overlap.js";
 import { type McpToolIssue } from "./core/mcp-tool.js";
 import { type McpContractToolError } from "./core/mcp.js";
 import { type McpHookIssue } from "./core/mcp-hook.js";
+import { type TrifectaFinding } from "./core/lethal-trifecta.js";
+import { type SkillResourceFinding } from "./core/skill-resources.js";
+import { type SkillFenceFinding } from "./core/skill-missing-fence.js";
+import { type PluginLayoutFinding } from "./core/plugin-dir-layout.js";
+import { type DelegationTrifectaFinding } from "./core/delegation-trifecta.js";
+import { type HookBlockFinding } from "./core/hook-block-ineffective.js";
+import { type HookMatcherFinding } from "./core/hook-matcher.js";
 import { type PurityLevel, type EffectSurface } from "./core/effects.js";
 /** A named writing system. The label `unexpectedScript` reports + the config's expectation parse into this. */
 export type Script = "Latin" | "Cyrillic" | "Han" | "Japanese" | "Korean" | "Arabic" | "Hebrew" | "Greek" | "Devanagari" | "Thai";
@@ -43,6 +50,27 @@ export interface ScanSkill {
      * `audit` trigger tier / `measureTriggerRate`.
      */
     readonly descriptionScript: Script | null;
+    /**
+     * SKILL.md body references to a bundled file (`scripts/`/`references/`/`assets/`
+     * or a relative markdown link with an extension) that don't resolve on disk
+     * under the skill dir — the agent reads the instruction and gets nothing.
+     * Computed by `skillResourceIssues()` (one detector, no drift).
+     */
+    readonly resourceIssues: readonly SkillResourceFinding[];
+    /**
+     * Lethal-trifecta finding when a MODEL-INVOCABLE skill's declared `allowed-tools`
+     * hold all three legs (read-private + ingest-untrusted + exfiltrate), else null.
+     * A user-invoked skill is excluded (it can't be selected by attacker content).
+     * Computed by `lethalTrifectaIssues()` (one detector, no drift).
+     */
+    readonly trifecta: TrifectaFinding | null;
+    /**
+     * Set when the SKILL.md opens with frontmatter-looking keys (`name:`, …) but
+     * has NO opening `---` fence, so the whole file loads as body — no name, no
+     * description, no trigger (the skill is invisible). Computed by
+     * `skillMissingFence()` (one detector, no drift).
+     */
+    readonly fenceIssue: SkillFenceFinding | null;
 }
 export interface ScanAgent {
     readonly name: string;
@@ -68,6 +96,37 @@ export interface ScanAgent {
      * unknown-effect (MCP or unrecognized) tool names in the declared contract.
      */
     readonly effectBuckets: Pick<EffectSurface, "readOnly" | "sideEffecting" | "unknown">;
+    /**
+     * Lethal-trifecta finding when the subagent's declared tools hold all three legs
+     * (read-private + ingest-untrusted + exfiltrate), else null. An inherits-all
+     * agent (no `tools:` line) is the "advisory" case. Computed by
+     * `lethalTrifectaIssues()` (one detector, no drift).
+     */
+    readonly trifecta: TrifectaFinding | null;
+}
+/** A lethal-trifecta finding tagged with the surface (subagent/skill) that holds it. */
+export interface ScanTrifectaFinding {
+    readonly path: string;
+    readonly kind: "subagent" | "skill";
+    readonly name: string;
+    readonly finding: TrifectaFinding;
+}
+/** A SKILL.md body resource reference that doesn't resolve, tagged with the skill path. */
+export interface ScanSkillResourceFinding {
+    readonly path: string;
+    readonly name: string;
+    readonly finding: SkillResourceFinding;
+}
+/** A missing-frontmatter-fence finding tagged with the skill path. */
+export interface ScanSkillFenceFinding {
+    readonly path: string;
+    readonly name: string;
+    readonly finding: SkillFenceFinding;
+}
+/** A delegation-trifecta finding tagged with the subagent path that holds it. */
+export interface ScanDelegationFinding {
+    readonly path: string;
+    readonly finding: DelegationTrifectaFinding;
 }
 /** A skill/agent whose frontmatter is missing a required field (name / description). */
 export interface FrontmatterIssue {
@@ -162,6 +221,53 @@ export interface ScanReport {
     readonly mcpHookIssues: readonly McpHookIssue[];
     /** Pairs of model-invocable skills whose descriptions are near-identical (precision collision). */
     readonly descriptionOverlaps: readonly DescriptionOverlap[];
+    /**
+     * Lethal-trifecta findings across subagents + model-invocable skills — a unit
+     * holding all three legs (read-private + ingest-untrusted + exfiltrate). Each
+     * carries the surface path + kind for reporting/annotations. Shared by `scan`
+     * (the report) and the `lethal-trifecta` lint rule (one detector, no drift).
+     */
+    readonly trifectaFindings: readonly ScanTrifectaFinding[];
+    /**
+     * SKILL.md body references to a bundled resource that doesn't resolve on disk,
+     * across all skills — each carries the skill path for reporting/annotations.
+     * Shared by `scan` and the `skill-resource-resolves` lint rule (one detector, no
+     * drift).
+     */
+    readonly skillResourceIssues: readonly ScanSkillResourceFinding[];
+    /**
+     * Skills whose frontmatter-looking opening has NO `---` fence, so they load as
+     * pure body (invisible — no name/description/trigger). Shared by `scan` and the
+     * `skill-missing-fence` lint rule (one detector, no drift).
+     */
+    readonly skillFenceIssues: readonly ScanSkillFenceFinding[];
+    /**
+     * Functional surface dirs (skills/agents/commands) nested INSIDE the manifest
+     * dir (`.claude-plugin/`) where the harness can't see them. Shared by `scan`
+     * and the `plugin-dir-layout` lint rule (one detector, no drift).
+     */
+    readonly pluginLayoutIssues: readonly PluginLayoutFinding[];
+    /**
+     * Lethal trifectas that EMERGE across a delegation edge — a subagent whose
+     * effective (own ∪ delegated-to) capability holds all three legs though no
+     * single unit does. Shared by `scan` and the `delegation-trifecta` lint rule
+     * (one detector, no drift).
+     */
+    readonly delegationTrifecta: readonly ScanDelegationFinding[];
+    /**
+     * Hooks that LOOK like they block but silently don't — a block decision on a
+     * non-blocking event, or the legacy `decision` field on a permission-gated
+     * event (#19009, the #1 verified hook pain). Shared by `scan` and the
+     * `hook-block-ineffective` lint rule (one detector, no drift). Empty when the
+     * dialect doesn't declare its blocking-event semantics.
+     */
+    readonly hookBlockFindings: readonly HookBlockFinding[];
+    /**
+     * Hook `matcher` strings that silently never fire — a tool-name typo or a
+     * malformed/undeclared MCP form. Shared by `scan` and the `hook-matcher` lint
+     * rule (one detector, no drift).
+     */
+    readonly hookMatcherFindings: readonly HookMatcherFinding[];
     /** Skills/agents whose `---` block isn't valid YAML — informational (may still load via salvage). */
     readonly malformedFrontmatter: readonly FrontmatterParseIssue[];
     readonly warnings: readonly string[];