vigiles 10.0.0 → 12.0.0

package/dist/cli.js

@@ -17,6 +17,7 @@ const generate_types_js_1 = require("./core/generate-types.js");
 const generate_harness_js_1 = require("./core/generate-harness.js");
 const capability_diff_js_1 = require("./core/capability-diff.js");
 const validate_js_1 = require("./core/validate.js");
+const eval_lock_js_1 = require("./eval-lock.js");
 const cli_flags_js_1 = require("./cli-flags.js");
 const setup_plan_js_1 = require("./setup-plan.js");
 const types_js_1 = require("./core/types.js");
@@ -678,6 +679,13 @@ function lintExitCode(report) {
         report.frontmatterValidErrors > 0 ||
         report.mcpHookErrors > 0 ||
         report.preferCompiledHookErrors > 0 ||
+        report.lethalTrifectaErrors > 0 ||
+        report.skillResourceErrors > 0 ||
+        report.skillFenceErrors > 0 ||
+        report.pluginLayoutErrors > 0 ||
+        report.delegationTrifectaErrors > 0 ||
+        report.hookBlockErrors > 0 ||
+        report.hookMatcherErrors > 0 ||
         report.symbolRefErrors > 0 ||
         report.mcpRefErrors > 0)
         return 2;
@@ -1028,6 +1036,29 @@ async function runLint(restArgs, flags, config) {
     // 7n. Prefer-compiled-hooks — ONE discovery nudge (not per-hook) toward
     // compiled `vigiles/hook` artifacts when hand-written hooks ship. Recommendation.
     const preferCompiledHooks = checkPreferCompiledHooks(config, silent, adapter);
+    // 7o. Lethal-trifecta — a unit (subagent / model-invocable skill) whose tools
+    // hold all three legs (read-private + ingest-untrusted + exfiltrate) is a
+    // prompt-injection exfil path (Rule of Two). Capability SET-intersection.
+    const lethalTrifecta = checkLethalTrifecta(config, silent, adapter);
+    // 7p. Skill-resource — a SKILL.md body referencing a bundled file that doesn't
+    // exist on disk under the skill dir (the agent gets nothing). FP-safe.
+    const skillResources = checkSkillResourceResolves(config, silent, adapter);
+    // 7q. Skill-missing-fence — a SKILL.md opening with `name:`/`description:` but no
+    // `---` fence loads as plain body (invisible — no name/description/trigger).
+    const skillFence = checkSkillMissingFence(config, silent, adapter);
+    // 7r. Plugin-dir-layout — functional surface dirs (skills/agents/commands) nested
+    // inside the `.claude-plugin/` manifest dir where the harness can't see them.
+    const pluginLayout = checkPluginDirLayout(config, silent, adapter);
+    // 7s. Delegation-trifecta — a lethal trifecta that emerges across a delegation
+    // edge (a subagent's own ∪ delegated-to capability) though no single unit trips it.
+    const delegationTrifecta = checkDelegationTrifecta(config, silent, adapter);
+    // 7t. Hook-block-ineffective — a hook that looks like it blocks but silently
+    // doesn't (block decision on a non-blocking event, or the legacy `decision`
+    // field on a permission-gated event). The #1 verified hook pain (#19009).
+    const hookBlock = checkHookBlockIneffective(config, silent, adapter);
+    // 7u. Hook-matcher — a hook `matcher` that never fires (tool-name typo, or a
+    // malformed/undeclared MCP form).
+    const hookMatcher = checkHookMatcher(config, silent, adapter);
     // 8. Validate vigiles builder calls inside markdown code blocks. Default
     // is to validate every ref; illustrative blocks opt out via
     // `<!-- vigiles:ignore -->` (single block) or
@@ -1095,6 +1126,20 @@ async function runLint(restArgs, flags, config) {
         mcpHookErrors: mcpHookTargets.errors,
         preferCompiledHookIssues: preferCompiledHooks.issues,
         preferCompiledHookErrors: preferCompiledHooks.errors,
+        lethalTrifectaIssues: lethalTrifecta.issues,
+        lethalTrifectaErrors: lethalTrifecta.errors,
+        skillResourceIssues: skillResources.issues,
+        skillResourceErrors: skillResources.errors,
+        skillFenceIssues: skillFence.issues,
+        skillFenceErrors: skillFence.errors,
+        pluginLayoutIssues: pluginLayout.issues,
+        pluginLayoutErrors: pluginLayout.errors,
+        delegationTrifectaIssues: delegationTrifecta.issues,
+        delegationTrifectaErrors: delegationTrifecta.errors,
+        hookBlockIssues: hookBlock.issues,
+        hookBlockErrors: hookBlock.errors,
+        hookMatcherIssues: hookMatcher.issues,
+        hookMatcherErrors: hookMatcher.errors,
         docRefErrors: docRefReport.errors.length,
         symbolRefErrors,
         mcpRefErrors,
@@ -1557,7 +1602,19 @@ function specReferencedElsewhere(specFile, ejectedFile) {
 /** Full GitHub Actions workflow that wires the production `zernie/vigiles@v1`
  * Action (lint pillar) and, when the test pillar is set up, a deterministic
  * harness job. */
-function vigilesWorkflow(plan) {
+/** The npm package(s) that provide each harness's CLI binary — the deterministic
+ * harness tier spawns the real agent CLI against a mock model (no API key). A repo
+ * targeting both harnesses installs both. */
+function harnessTestBinaries(harnesses) {
+    const pkgs = [];
+    if (harnesses.includes("claude"))
+        pkgs.push("@anthropic-ai/claude-code");
+    if (harnesses.includes("codex"))
+        pkgs.push("@openai/codex");
+    // Fall back to Claude Code if the set is somehow empty (back-compatible default).
+    return (pkgs.length > 0 ? pkgs : ["@anthropic-ai/claude-code"]).join(" ");
+}
+function vigilesWorkflow(plan, harnesses) {
     const harness = plan.test
         ? `
   harness:
@@ -1571,8 +1628,23 @@ function vigilesWorkflow(plan) {
         with:
           node-version: "20"
       - run: npm install
-      - run: npm i -g @anthropic-ai/claude-code # mock tier needs the binary, no API key
+      - run: npm i -g ${harnessTestBinaries(harnesses)} # mock tier needs the binary, no API key
       - run: npx vigiles test
+
+  eval-check:
+    # Eval staleness gate — real-model evals run LOCALLY on your subscription
+    # (\`npx vigiles eval --update\`, which commits a lock); this job VERIFIES those
+    # committed results against the current inputs with NO model call. It stays a
+    # green no-op until you commit your first lock. See docs/harness-testing.md.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - uses: zernie/vigiles@v1
+        with:
+          command: eval-check
 `
         : "";
     return `name: vigiles
@@ -1643,7 +1715,7 @@ function rewriteRemovedSubcommands(content) {
  * commit hint). An existing workflow is never clobbered unless `--force`, but a
  * STALE one (old bare-`npx vigiles` API, or a removed subcommand) is reported
  * loudly instead of silently skipped — and rewritten in place with `--force`. */
-function wireGha(plan) {
+function wireGha(plan, harnesses) {
     const dir = (0, node_path_1.resolve)(process.cwd(), ".github", "workflows");
     const path = (0, node_path_1.resolve)(dir, "vigiles.yml");
     const rel = ".github/workflows/vigiles.yml";
@@ -1664,7 +1736,7 @@ function wireGha(plan) {
         }
         else if (workflowUsesStaleApi(content)) {
             if (plan.force) {
-                (0, node_fs_1.writeFileSync)(path, vigilesWorkflow(plan));
+                (0, node_fs_1.writeFileSync)(path, vigilesWorkflow(plan, harnesses));
                 console.log(`✓ Regenerated ${rel} (was a stale bare \`npx vigiles\`)`);
                 return [rel];
             }
@@ -1680,7 +1752,7 @@ function wireGha(plan) {
     }
     if (!(0, node_fs_1.existsSync)(dir))
         (0, node_fs_1.mkdirSync)(dir, { recursive: true });
-    (0, node_fs_1.writeFileSync)(path, vigilesWorkflow(plan));
+    (0, node_fs_1.writeFileSync)(path, vigilesWorkflow(plan, harnesses));
     console.log("✓ Created .github/workflows/vigiles.yml (uses zernie/vigiles@v1)");
     return [".github/workflows/vigiles.yml"];
 }
@@ -2086,6 +2158,36 @@ function installPlugins(harnesses) {
         console.log("");
         reportInstall(plan, runInstall(plan, exec));
     }
+    // Claude Code gets its hooks from the global marketplace plugin; Codex has no
+    // global store, so wire vigiles's proactive nudge hooks into the repo's
+    // .codex/config.toml directly (the idiomatic, repo-committed place).
+    if (harnesses.includes("codex"))
+        wireCodexHooks();
+}
+/**
+ * Wire vigiles's proactive nudge hooks into `.codex/config.toml` (idempotently).
+ * Codex honors `additionalContext` on `PostToolUse`, and these run as direct
+ * `npx vigiles hook-runtime …` commands (no plugin root / vendored script), so a
+ * Codex user gets the same eval-lock + refs nudges a Claude Code user gets from
+ * the marketplace plugin. The pure merge is `applyCodexPluginHooks` (unit-tested
+ * in setup-plan.test.ts) — this only does the read/parse/write IO.
+ */
+function wireCodexHooks() {
+    const path = (0, node_path_1.resolve)(process.cwd(), ".codex", "config.toml");
+    let config = {};
+    if ((0, node_fs_1.existsSync)(path)) {
+        try {
+            config = (0, toml_1.parse)((0, node_fs_1.readFileSync)(path, "utf-8"));
+        }
+        catch {
+            console.log("⚠ .codex/config.toml is not valid TOML — skipping Codex hook wiring (fix it, then re-run `vigiles init`).");
+            return;
+        }
+    }
+    const merged = (0, setup_plan_js_1.applyCodexPluginHooks)(config);
+    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(path), { recursive: true });
+    (0, node_fs_1.writeFileSync)(path, (0, hook_install_js_1.serializeConfig)(merged, "toml"));
+    console.log("✓ Wired the eval-lock + refs nudge hooks into .codex/config.toml (commit it)");
 }
 /** Add/upgrade `vigiles` in the project's `devDependencies` (and move it out of
  * `dependencies` if it's there). Returns the files it wrote (for the commit
@@ -2249,7 +2351,7 @@ async function setup(args) {
     // CI — the production Action (+ a harness job when Pillar 2 is on).
     if (plan.gha) {
         console.log("");
-        written.push(...wireGha(plan));
+        written.push(...wireGha(plan, harnesses));
     }
     // Plugin/skill install — per-harness (Claude marketplace / Codex direct).
     if (plan.plugin) {
@@ -2673,6 +2775,211 @@ function checkDescriptionOverlap(config, silent, adapter) {
     }
     return { issues: found.length, errors: sev === "error" ? found.length : 0 };
 }
+/**
+ * Apply the `lethal-trifecta` rule: a unit (subagent / model-invocable skill)
+ * whose declared tools hold all three legs (read-private + ingest-untrusted +
+ * exfiltrate) is a prompt-injection exfil path (Meta's Rule of Two). Reuses
+ * `scanPlugin`'s `trifectaFindings` (a capability SET-intersection, one detector,
+ * no drift). Warning by default; "error" gates CI. Surfaces across BOTH subagents
+ * and skills, so it is NOT gated on the `subagents` capability — a skill-only
+ * harness still has the surface.
+ */
+function checkLethalTrifecta(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["lethal-trifecta"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).trifectaFindings;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nLethal-trifecta check:\n");
+        for (const t of found) {
+            const msg = `${t.kind} ${t.name}: ${t.finding.message}`;
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${t.path}: ${msg}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", msg, t.path);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `skill-resource-resolves` rule: a SKILL.md body referencing a bundled
+ * file (`scripts/`/`references/`/`assets/` or a relative markdown link with an
+ * extension) that doesn't exist on disk — the agent reads the instruction and gets
+ * nothing. Reuses `scanPlugin`'s `skillResourceIssues` (high-precision / FP-safe,
+ * one detector, no drift). Warning by default; "error" gates CI.
+ */
+function checkSkillResourceResolves(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["skill-resource-resolves"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).skillResourceIssues;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nSkill-resource check:\n");
+        for (const s of found) {
+            const msg = `${s.name}: bundled resource "${s.finding.ref}" (line ${String(s.finding.line)}) is referenced but missing — the agent reads the instruction and gets nothing.`;
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${s.path}: ${msg}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", msg, s.path);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `skill-missing-fence` rule: a SKILL.md that opens with
+ * frontmatter-looking keys (`name:`/`description:`) but no `---` fence loads as
+ * pure body — no name, no description, no trigger (the skill is invisible).
+ * Reuses `scanPlugin`'s `skillFenceIssues` (one detector, no drift). Warning by
+ * default; "error" gates CI.
+ */
+function checkSkillMissingFence(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["skill-missing-fence"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).skillFenceIssues;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nSkill-missing-fence check:\n");
+        for (const s of found) {
+            const msg = `${s.name}: ${s.finding.message}`;
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${s.path}: ${msg}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", msg, s.path);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `plugin-dir-layout` rule: functional surface dirs (skills/agents/
+ * commands) nested inside the `.claude-plugin/` manifest dir where the harness
+ * can't see them (the #1 plugin-author mistake). Reuses `scanPlugin`'s
+ * `pluginLayoutIssues` (one detector, no drift). Warning by default; "error"
+ * gates CI.
+ */
+function checkPluginDirLayout(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["plugin-dir-layout"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).pluginLayoutIssues;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nPlugin-dir-layout check:\n");
+        for (const p of found) {
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${p.message}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", p.message);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `delegation-trifecta` rule: a lethal trifecta that EMERGES across a
+ * delegation edge — a subagent whose effective (own ∪ delegated-to) capability
+ * holds all three legs though no single unit does. Reuses `scanPlugin`'s
+ * `delegationTrifecta` (one detector, no drift). Warning by default; "error"
+ * gates CI. Surfaces across the subagent graph, so it is NOT gated on a
+ * capability the way a surface-specific rule is.
+ */
+function checkDelegationTrifecta(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["delegation-trifecta"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).delegationTrifecta;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nDelegation-trifecta check:\n");
+        for (const d of found) {
+            const msg = `${d.finding.name}: ${d.finding.message}`;
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${d.path}: ${msg}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", msg, d.path);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `hook-block-ineffective` rule: a hook that LOOKS like it blocks but
+ * silently doesn't — a block decision (`exit 2` / `decision` / `permissionDecision`)
+ * on a non-blocking event, or the legacy top-level `decision` field on a
+ * permission-gated event (#19009, the #1 verified hook pain). Reuses `scanPlugin`'s
+ * `hookBlockFindings` (one detector, no drift). Warning by default; "error" gates CI.
+ */
+function checkHookBlockIneffective(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["hook-block-ineffective"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    if (!adapter.capabilities.shellHooks) {
+        reportNotApplicable("Hook-block check", "shell hooks", adapter, silent);
+        return { issues: 0, errors: 0 };
+    }
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).hookBlockFindings;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nHook-block check:\n");
+        for (const h of found) {
+            const where = h.scriptPath ?? "(inline)";
+            const msg = `[${h.event}] ${where}: ${h.message}`;
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${msg}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", msg, h.scriptPath ?? undefined);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `hook-matcher` rule: a hook `matcher` string that silently never
+ * fires — a tool-name typo (`bash`→`Bash`) or a malformed/undeclared MCP form.
+ * Reuses `scanPlugin`'s `hookMatcherFindings` (one detector, no drift). Warning
+ * by default; "error" gates CI.
+ */
+function checkHookMatcher(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["hook-matcher"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    if (!adapter.capabilities.shellHooks) {
+        reportNotApplicable("Hook-matcher check", "shell hooks", adapter, silent);
+        return { issues: 0, errors: 0 };
+    }
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).hookMatcherFindings;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nHook-matcher check:\n");
+        for (const m of found) {
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${m.message}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", m.message);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
 /**
  * Apply the `mcp-hook-target-resolves` rule: a `type: "mcp_tool"` hook action
  * that's incomplete (no `server`/`tool`) or targets a server the plugin doesn't
@@ -3157,10 +3464,55 @@ async function handleGenerateHarness(args, restArgs) {
  * tier needs it, just like the node:test suite). `--trials=N` is forwarded to
  * eval scripts via the `VIGILES_TRIALS` env var.
  */
+/**
+ * Resolve the eval LOCK env from the `eval` flags. `--update` records each named
+ * eval's report to a committed `.vigiles/eval-locks/<name>.lock.json` (run locally
+ * on your subscription); `--check` (CI) verifies the committed result against the
+ * current inputs WITHOUT a model call. `--check` is a green NO-OP until the first
+ * lock is committed (smooth adoption). Returns the env to thread, or `"skip"` to
+ * exit green now. `--check`+`--update` together is a usage error (exit 2). The
+ * behavior epoch comes from `.vigilesrc.json` `eval.apiVersion` (committed).
+ */
+function resolveEvalLockEnv(args) {
+    const wantCheck = args.includes("--check");
+    const wantUpdate = args.includes("--update");
+    if (wantCheck && wantUpdate) {
+        console.error("vigiles eval: --check and --update are mutually exclusive (one verifies, one records).");
+        process.exit(2);
+    }
+    if (wantCheck &&
+        !(0, eval_lock_js_1.anyLocksCommitted)((0, node_path_1.resolve)(process.cwd(), eval_lock_js_1.DEFAULT_LOCK_DIR))) {
+        console.log("ℹ vigiles eval --check: no committed eval locks found — nothing to verify.\n" +
+            "  Run `vigiles eval --update` locally (on your subscription) and commit the\n" +
+            "  lock to enable the CI staleness gate.");
+        return "skip";
+    }
+    const env = {};
+    if (wantCheck)
+        env.VIGILES_EVAL_LOCK = "check";
+    if (wantUpdate)
+        env.VIGILES_EVAL_LOCK = "update";
+    if (wantCheck || wantUpdate) {
+        const apiVersion = (0, validate_js_1.loadConfig)().eval?.apiVersion;
+        if (apiVersion !== undefined)
+            env.VIGILES_EVAL_API_VERSION = String(apiVersion);
+    }
+    return env;
+}
 function handleRunScripts(kind, args, restArgs) {
     const cwd = process.cwd();
     // Harness/eval scripts may be authored in JS or TS (see run-scripts.ts).
     const defaultGlob = (0, run_scripts_js_1.scriptGlob)(kind === "test" ? "harness" : "eval");
+    // The eval LOCK flags (`--check`/`--update`) are resolved BEFORE file discovery
+    // so mutual-exclusion + the cold-start no-op are honored regardless of file
+    // count. Returns the env to thread to scripts, or `"skip"` to exit green now.
+    let lockEnv = {};
+    if (kind === "eval") {
+        const r = resolveEvalLockEnv(args);
+        if (r === "skip")
+            return;
+        lockEnv = r;
+    }
     const files = (0, run_scripts_js_1.discoverScripts)(restArgs, defaultGlob, cwd);
     // `--min=N`: a CI gate asserts at least N scripts actually RAN — so a bad path,
     // a renamed file, or a glob that matched nothing fails LOUD instead of passing
@@ -3189,7 +3541,7 @@ function handleRunScripts(kind, args, restArgs) {
     // it's part of the measurement definition, so it belongs in the spec
     // (`model` / `minModel`), version-controlled, not a hidden override.
     const trialsFlag = args.find((a) => a.startsWith("--trials="));
-    const env = {};
+    const env = { ...lockEnv };
     if (trialsFlag)
         env.VIGILES_TRIALS = trialsFlag.split("=")[1];
     console.log(`Running ${String(files.length)} ${kind} file(s):\n`);
@@ -3368,6 +3720,8 @@ function printUsage(command) {
     console.log("                                 --serve opens a LIVE local report whose buttons create specs in one click (own repo only; loopback + token-guarded) · --no-serve to skip the prompt");
     console.log("  vigiles test [files...]        Run *.harness.mjs deterministic harness tests");
     console.log("  vigiles eval [files...]        Run *.eval.mjs real-model harness evals (--trials=N, --min=N, --no-skip)");
+    console.log("                                 --update records each named eval's result to a committed lock (run locally on your subscription)");
+    console.log("                                 --check verifies committed eval results against current inputs WITHOUT a model — the CI staleness gate");
     console.log("  vigiles scaffold-test [dir]    Generate a starter test for each untested skill/agent/hook (--write, --json)");
     console.log("");
     console.log("Examples:");
@@ -3683,6 +4037,9 @@ async function handleHookRuntime(kind, restArgs) {
         case "refs":
             refsHookCommand();
             return;
+        case "eval-lock-nudge":
+            evalLockNudgeHookCommand();
+            return;
         case "effect-enter":
             (0, effect_region_js_1.setEffectActive)(process.cwd());
             console.log("Effect boundary entered.");
@@ -3729,6 +4086,45 @@ const INSTRUCTION_FILE = /^(SKILL|CLAUDE|AGENTS)\.md$/;
 function isInstructionFile(file) {
     return INSTRUCTION_FILE.test((0, node_path_1.basename)(file));
 }
+/**
+ * PostToolUse-hook entrypoint: when the agent edits an eval input (a `SKILL.md`
+ * trigger surface or an `*.eval.*` script), and committed eval locks exist, inject
+ * a NON-BLOCKING reminder to re-run `vigiles eval --update`. Self-gating (silent
+ * until a lock is committed), never blocks, never runs an eval — a reminder, not a
+ * gate (the gate is `eval --check` in CI). The harness-neutral nudge lives in
+ * `evalLockNudge`; both CC and Codex deliver it as `additionalContext` on
+ * `PostToolUse` (confirmed — see docs/harness-testing-codex.md).
+ */
+function evalLockNudgeHookCommand() {
+    let raw = "";
+    try {
+        raw = (0, node_fs_1.readFileSync)(0, "utf-8");
+    }
+    catch {
+        /* no stdin → nothing to do */
+    }
+    let file = "";
+    try {
+        const j = JSON.parse(raw);
+        file = j.tool_input?.file_path ?? "";
+    }
+    catch {
+        /* malformed → nothing to do */
+    }
+    if (!file)
+        return;
+    const cwd = process.cwd();
+    const target = (0, node_path_1.relative)(cwd, (0, node_path_1.resolve)(cwd, file)) || file;
+    const msg = (0, eval_lock_js_1.evalLockNudge)(target, (0, node_path_1.resolve)(cwd, eval_lock_js_1.DEFAULT_LOCK_DIR));
+    if (!msg)
+        return;
+    process.stdout.write(JSON.stringify({
+        hookSpecificOutput: {
+            hookEventName: "PostToolUse",
+            additionalContext: msg,
+        },
+    }) + "\n");
+}
 /**
  * PostToolUse-hook entrypoint: when the agent edits an instruction file, force
  * every code reference to carry a file-qualified mark (`path.ext#symbol`) and
@@ -3904,31 +4300,63 @@ async function installHookFile(file, adapter, registeredProviders = []) {
         : (0, hook_install_js_1.mergeHooksJson)(existing, compiled.hooks, file);
     (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(settingsAbs), { recursive: true });
     (0, node_fs_1.writeFileSync)(settingsAbs, (0, hook_install_js_1.serializeConfig)(merged, format));
-    // Honest gap (no silent skips): the gate/deny path is exit-2 and cross-harness,
-    // but an inject/react hook's OUTPUT shape is confirmed only for Claude Code. On
-    // another harness it would emit CC-shaped output that may not be read — exactly
-    // the silent failure this feature exists to prevent. Flag it, loudly.
+    // No silent skips: warn loudly only where a hook's OUTPUT genuinely may not
+    // apply on this harness. INJECT's `additionalContext` shape is now CONFIRMED
+    // shared with Codex (per the official hooks docs), so an inject hook only
+    // warns when its event isn't in the harness's `injectableEvents`. REACT's
+    // output is still Claude-Code-confirmed only. The gate (deny→exit 2) path is
+    // cross-harness and never warns.
     const role = (0, hook_program_js_1.dispatchKind)(program);
-    const warning = adapter.name !== "claude-code" && (role === "inject" || role === "react")
-        ? `${role} output is only confirmed for Claude Code. On ${adapter.name}, ` +
-            `the gate (deny→exit 2) path works, but this hook's ${role} output is ` +
-            `CC-shaped and unverified — it may silently not apply. Use a gate hook on ` +
-            `${adapter.name} for now, or confirm against the real binary first ` +
-            `(research/compiled-hooks-codex.md §Deferred).`
-        : undefined;
+    const event = typeof program.on === "string" ? program.on : "";
+    const injectable = adapter.hookProtocol?.injectableEvents ?? [];
+    const matcher = (0, hook_program_js_1.hookRouting)(program).matcher;
+    let warning;
+    if (adapter.name !== "claude-code") {
+        if (role === "inject" && !injectable.includes(event)) {
+            warning =
+                `this inject hook targets "${event}", which ${adapter.name} does not ` +
+                    `honor for additionalContext — the injected text won't reach the agent. ` +
+                    `Use an event ${adapter.name} supports: ${injectable.join(", ")}.`;
+        }
+        else if (role === "react") {
+            warning =
+                `react output is confirmed only for Claude Code; on ${adapter.name} this ` +
+                    `hook's react output is unverified (the gate deny→exit 2 path IS ` +
+                    `cross-harness). Confirm against the real binary first.`;
+        }
+        else if (matcher !== undefined) {
+            // A tool-matched gate carries TOOL NAMES in its matcher. vigiles does not
+            // yet translate tool vocabularies across dialects, so a matcher authored
+            // with Claude Code names (`Edit`/`Write`/`Bash`) won't fire on a harness
+            // that names the same tools differently (Codex: `apply_patch`/`shell`).
+            // Warn LOUDLY rather than report a silently-non-firing success.
+            warning =
+                `this hook matches tool(s) "${matcher}" — if those are Claude Code tool ` +
+                    `names, they may not match ${adapter.name}'s vocabulary (e.g. ` +
+                    `apply_patch/shell), so the hook may not fire. Verify the matcher uses ` +
+                    `${adapter.name}'s tool names (cross-dialect matcher translation is not ` +
+                    `yet automatic).`;
+        }
+    }
     return { role, settingsPath: adapter.layout.settingsPath, warning };
 }
 /**
  * Compile + install every hook (explicit paths, else discovered under
- * `.vigiles/hooks/`) into the active harness's config. Returns false if any
- * hook failed to compile.
+ * `.vigiles/hooks/`) into EVERY enabled harness's config. A typed hook is
+ * harness-neutral, so when a repo targets both harnesses the SAME hook is merged
+ * into `.claude/settings.json` AND `.codex/config.toml` (each in its native
+ * format, with per-harness warnings) — never just the first. The harness set is
+ * resolved from the `--harness=` flag, else `config.harness`, else auto-detect.
+ * Returns false if any hook failed to compile for any harness.
  */
-async function installHooks(hookFiles, harnessFlag) {
+async function installHooks(hookFiles, harnessFlag, configHarness) {
     if (hookFiles.length === 0)
         return true;
-    const adapter = harnessFlag
-        ? (0, adapter_registry_js_1.resolveAdapter)(process.cwd(), harnessFlag)
-        : (0, adapter_registry_js_1.detectAdapterResult)(process.cwd()).adapter;
+    const adapters = (0, adapter_registry_js_1.resolveHarnessAdapters)({
+        root: process.cwd(),
+        flag: harnessFlag,
+        configHarness,
+    });
     // Validate registered providers first → the names a hook's provider() ref may
     // resolve to (an unsafe provider fails the whole compile, like a bad hook).
     let registeredProviders;
@@ -3945,10 +4373,13 @@ async function installHooks(hookFiles, harnessFlag) {
     let ok = true;
     for (const file of hookFiles) {
         try {
-            const r = await installHookFile(file, adapter, registeredProviders);
-            console.log(`✓ ${file} → ${r.settingsPath} (role: ${r.role}, harness: ${adapter.name})`);
-            if (r.warning)
-                console.warn(`⚠ ${r.warning}`);
+            // Fan out: the same compiled hook lands in each enabled harness's config.
+            for (const adapter of adapters) {
+                const r = await installHookFile(file, adapter, registeredProviders);
+                console.log(`✓ ${file} → ${r.settingsPath} (role: ${r.role}, harness: ${adapter.name})`);
+                if (r.warning)
+                    console.warn(`⚠ ${r.warning}`);
+            }
         }
         catch (e) {
             if (e instanceof hook_program_js_1.HookCompileError) {
@@ -4532,7 +4963,7 @@ async function main() {
             let valid = true;
             if (specs.length > 0)
                 valid = (await compile(specs, config, { harnessFlag })) && valid;
-            valid = (await installHooks(hooks, harnessFlag)) && valid;
+            valid = (await installHooks(hooks, harnessFlag, config.harness)) && valid;
             // Keep an existing whole-harness registry in sync (cheap, opt-in) so the
             // user never hand-runs `generate-harness`. Skipped when no harness.gen.ts.
             if (specs.length > 0)

package/dist/core/CLAUDE.md.spec.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("./spec.js").ClaudeSpec;
+export default _default;
+//# sourceMappingURL=CLAUDE.md.spec.d.ts.map