vigiles 10.0.0 → 12.0.0

package/dist/eval.js

@@ -22,7 +22,6 @@ exports.aggregateUsage = aggregateUsage;
 exports.isDatedModel = isDatedModel;
 exports.modelTier = modelTier;
 exports.belowModelFloor = belowModelFloor;
-exports.harnessVersionKey = harnessVersionKey;
 exports.ephemeralRunEnv = ephemeralRunEnv;
 exports.seedEphemeralHome = seedEphemeralHome;
 exports.isRateLimited = isRateLimited;
@@ -71,6 +70,7 @@ const runtime_js_1 = require("./adapters/claude-code/runtime.js");
 const proofs_js_1 = require("./core/proofs.js");
 const harness_test_js_1 = require("./harness-test.js");
 const eval_cache_js_1 = require("./eval-cache.js");
+const eval_lock_js_1 = require("./eval-lock.js");
 const stats_js_1 = require("./stats.js");
 const tool_intercept_js_1 = require("./tool-intercept.js");
 const tool_stub_js_1 = require("./tool-stub.js");
@@ -640,32 +640,22 @@ function belowModelFloor(model, floor) {
     const f = modelTier(floor);
     return m !== null && f !== null && m < f;
 }
-/**
- * Reduce a raw `--version` string to the **major.minor** cache-key token. We key
- * the cache on major.minor, NOT the patch: a patch release rarely changes agent
- * behaviour, so keying patches would churn the cache on every release for no
- * signal; a minor/major bump is where the system prompt / tool defs actually move.
- * (If a specific patch is known to matter, clear the cache or bump
- * `CACHE_FORMAT_VERSION`.) Falls back to the trimmed raw string when no semver is
- * found. Pure + tested.
- */
-function harnessVersionKey(raw) {
-    const m = /(\d+)\.(\d+)\.\d+/.exec(raw);
-    return m ? `${m[1]}.${m[2]}` : raw.trim();
-}
 /* v8 ignore start -- spawns the real harness binary; memoized, cache-path only */
 let cachedHarnessVersion;
 /**
- * The harness binary version (`claude --version`) reduced to major.minor, for the
- * cache key — so a CLI **minor/major** upgrade (new system prompt / tool defs)
- * invalidates a stale replay, while patches don't churn it. Memoized (one spawn
- * per process), resolved only on the cache path, "unknown" if the binary isn't
- * found (then it doesn't partition the key).
+ * The harness binary version (`claude --version`), reduced to its
+ * behaviorally-significant token by the runtime port's
+ * {@link HarnessRuntime.versionKey} — so a Claude Code **minor/major** upgrade
+ * (new system prompt / tool defs) invalidates a stale replay while patches don't
+ * churn it. The reduction is per-harness (CC → `major.minor`, Codex → `""`) and
+ * lives on the adapter, not here. Memoized (one spawn per process), resolved only
+ * on the cache path, "unknown" if the binary isn't found (then it doesn't
+ * partition the key).
  */
 function harnessVersion() {
     if (cachedHarnessVersion === undefined) {
         try {
-            cachedHarnessVersion = harnessVersionKey((0, node_child_process_1.execSync)(`${runtime_js_1.claudeCodeRuntime.agentBinary} --version`, {
+            cachedHarnessVersion = runtime_js_1.claudeCodeRuntime.versionKey((0, node_child_process_1.execSync)(`${runtime_js_1.claudeCodeRuntime.agentBinary} --version`, {
                 encoding: "utf-8",
                 stdio: ["ignore", "pipe", "ignore"],
             }));
@@ -983,15 +973,141 @@ function aggregateArms(armNames, results) {
     }
     return { arms, totalCostUsd };
 }
+function resolveLock(over) {
+    return {
+        mode: over?.mode ?? (0, eval_lock_js_1.lockModeFromEnv)(),
+        dir: over?.dir ?? (0, node_path_1.resolve)(process.cwd(), eval_lock_js_1.DEFAULT_LOCK_DIR),
+        evalApiVersion: over?.evalApiVersion ?? (0, eval_lock_js_1.evalApiVersionFromEnv)(),
+    };
+}
+/** Emit a vigiles message (GitHub annotation under Actions, else stderr/stdout). */
+function emitLockMessage(msg, warn) {
+    if (process.env.GITHUB_ACTIONS)
+        console.log(`::${warn ? "warning" : "notice"}::${msg}`);
+    else if (warn)
+        console.warn(msg);
+    else
+        console.log(msg);
+}
+/**
+ * Run a named eval through the lock. `off` → just `produce()`. `check` → replay a
+ * matching committed lock (NO model call) or throw "stale". `update` → `produce()`,
+ * write the lock, print the human-facing delta. The model is driven ONLY on the
+ * run path — never on a clean `check`, which is what keeps the CI gate binary-free.
+ * A lock-on run with no `name` is a LOUD skip (the lock needs a name to key the file).
+ */
+async function withEvalLock(args, produce) {
+    const { lock } = args;
+    if (lock.mode === "off")
+        return produce();
+    if (!args.name) {
+        // An unnamed eval can't be keyed to a lock. In `check` (the CI gate) running
+        // it would call the model — violating the no-model-in-CI contract and failing
+        // for missing auth — so FAIL LOUDLY instead of silently hitting the model.
+        // `update` (local, model available) keeps producing: the eval just isn't gated.
+        if (lock.mode === "check") {
+            throw new Error(`vigiles eval --check: an unnamed eval cannot run in CI — it has no ` +
+                `committed lock to replay, and running it would call the model. Add a ` +
+                `\`name\` to the spec to gate it, or exclude it from the --check run.`);
+        }
+        emitLockMessage(`vigiles eval --${lock.mode}: skipped the lock for an unnamed eval — set ` +
+            `\`name\` on the spec to enable the staleness gate for it.`, true);
+        return produce();
+    }
+    if (!isDatedModel(args.model))
+        warnFloatingModel(args.model);
+    const inputsHash = (0, eval_lock_js_1.evalInputsHash)({
+        model: args.model,
+        evalApiVersion: lock.evalApiVersion,
+        inputs: args.inputs,
+    });
+    const existing = (0, eval_lock_js_1.readLock)(lock.dir, args.name);
+    const decision = (0, eval_lock_js_1.decideLock)(lock.mode, args.name, inputsHash, existing);
+    if (decision.kind === "stale")
+        throw new Error(decision.reason);
+    if (decision.kind === "replay")
+        return decision.report;
+    const report = await produce();
+    const builtLock = (0, eval_lock_js_1.buildLock)({
+        name: args.name,
+        inputsHash,
+        model: args.model,
+        harnessVersionKey: harnessVersion(),
+        evalApiVersion: lock.evalApiVersion,
+        builtAt: new Date().toISOString(),
+        report,
+    });
+    const deltas = existing ? (0, eval_lock_js_1.diffReportNumbers)(existing.report, report) : [];
+    (0, eval_lock_js_1.writeLock)(lock.dir, builtLock);
+    emitLockMessage((0, eval_lock_js_1.formatLockUpdate)(args.name, deltas, existing === null), false);
+    return report;
+}
+/**
+ * Strip the machine-specific plugin-root prefix from a resolved value before it
+ * enters the lock hash. `resolveHarness` expands `${PLUGIN_ROOT}` in a plugin's
+ * hook commands to the checkout's ABSOLUTE path, so a lock recorded at
+ * `/home/dev/...` would be falsely STALE when `--check` recomputes it at
+ * `/home/runner/...` in CI (or any other machine). Normalizing the prefix back to
+ * a token makes the hash location-independent. No-op when there's no plugin root.
+ */
+function stripPluginRoot(value, absRoot) {
+    if (absRoot === "")
+        return value;
+    const json = JSON.stringify(value);
+    // A hookless plugin resolves to `settings: undefined`, which `JSON.stringify`
+    // returns as `undefined` (not a string) — pass it through rather than `.split`
+    // a non-string (which would throw before the eval can run).
+    if (json === undefined)
+        return value;
+    return JSON.parse(json.split(absRoot).join("${PLUGIN_ROOT}"));
+}
 /**
- * The eval orchestration — every arm × trial via `runner`, run through the cache
- * and a rate-limit retry, with at most `concurrency` in flight and an optional
- * `maxCostUsd` budget cap; metric + usage computed per run and aggregated per
- * arm. Exported with an injectable `runner` so the loop, `measure` context,
- * caching, pooling, and aggregation are unit-testable without spawning a model
- * (pass a fake returning canned stream-json). `runEval` is this with the real
- * agent runner.
+ * Resolve each arm's model-affecting inputs into a canonical object for the lock
+ * hash — WITHOUT running the model (it reads files + hashes plugin dirs only). The
+ * trial count is excluded (a sample-size knob, not a behavior input); `measure` is
+ * excluded by design (the script re-asserts against the replayed report).
  */
+function evalArmsInputs(spec, cfg) {
+    const arms = {};
+    for (const [name, arm] of Object.entries(spec.arms)) {
+        const resolved = (0, plugin_loader_js_1.resolveHarness)({
+            plugin: arm.plugin,
+            settings: arm.settings,
+            files: { ...spec.fixture, ...arm.files },
+        });
+        // The plugin root `resolveHarness` expanded into the resolved files/settings
+        // is this checkout's absolute path — normalize it out so the hash is the same
+        // on the dev's machine and in CI (else every plugin-with-root-hooks eval is
+        // falsely stale across machines).
+        const absRoot = arm.plugin ? (0, node_path_1.resolve)(process.cwd(), arm.plugin) : "";
+        arms[name] = {
+            model: arm.model ?? cfg.model,
+            tools: [...cfg.tools].sort(),
+            files: stripPluginRoot(resolved.files, absRoot),
+            settings: stripPluginRoot(resolved.settings, absRoot),
+            pluginDirHash: arm.pluginDir ? (0, eval_cache_js_1.hashDir)(arm.pluginDir) : undefined,
+            interceptTools: arm.interceptTools
+                ? (0, tool_intercept_js_1.serializeIntercepts)(arm.interceptTools)
+                : undefined,
+        };
+    }
+    // Tool stubs (`spec.stubs`) are written onto PATH before each trial, so a
+    // change to a canned CLI output IS a model-facing input change — fold a
+    // canonical (name-sorted) view into the hash so `--check` catches it. Sorted
+    // for a stable key regardless of declaration order; an empty list is the
+    // byte-identical-to-before default. Each ToolStub is plain serializable data.
+    const stubs = [...(spec.stubs ?? [])].sort((a, b) => a.name.localeCompare(b.name));
+    // `ephemeralEnv` swaps the trial's environment (scrubbed env + throwaway HOME
+    // vs the inherited process env), which can move tool/hook/agent behavior — a
+    // model-facing input, so it belongs in the hash. Normalize to a bool so a
+    // record under one mode can't be replayed under the other with the same hash.
+    return {
+        task: spec.task,
+        arms,
+        stubs,
+        ephemeralEnv: spec.ephemeralEnv === true,
+    };
+}
 async function runEvalWith(spec, runner) {
     const trials = spec.trials ?? 5;
     const spacing = (spec.spacingSec ?? 4) * 1000;
@@ -1024,9 +1140,16 @@ async function runEvalWith(spec, runner) {
             await sleep(spacing);
         return { armName: unit.armName, skipped: false, row, usage };
     };
-    const results = await runPool(units, concurrency, worker);
-    const { arms, totalCostUsd } = aggregateArms(Object.keys(spec.arms), results);
-    return { name: spec.name ?? "eval", trials, arms, totalCostUsd, aborted };
+    const lock = resolveLock(spec.lock);
+    // Resolve the lock inputs only when the lock is active (off skips the
+    // resolveHarness/hashDir work). `check` replays the committed report below
+    // without ever entering the run pool — so no model is driven in CI.
+    const inputs = lock.mode === "off" ? undefined : evalArmsInputs(spec, cfg);
+    return withEvalLock({ name: spec.name, inputs, model: cfg.model, lock }, async () => {
+        const results = await runPool(units, concurrency, worker);
+        const { arms, totalCostUsd } = aggregateArms(Object.keys(spec.arms), results);
+        return { name: spec.name ?? "eval", trials, arms, totalCostUsd, aborted };
+    });
 }
 /** Render one metric: `name=mean±se pass^k=…` (se/pass^k shown when measured). */
 function formatMetric(name, mean, stat) {
@@ -1065,6 +1188,7 @@ function formatEvalReport(report) {
 exports.claudeEvalDriver = {
     runner: spawnAgent,
     parse: parseClaudeRun,
+    harness: "claude-code",
 };
 /**
  * Package loose `<skillsDir>/<name>/SKILL.md` skills into a throwaway plugin dir
@@ -1439,7 +1563,7 @@ function assertTriggerDiversity(spec) {
         });
     }
 }
-async function measureTriggerRateWith(spec, runner, parse = parseClaudeRun, runError) {
+async function measureTriggerRateWith(spec, runner, parse = parseClaudeRun, runError, harness = "claude-code") {
     // Deterministic gate FIRST — before spending a token (or packaging a skillsDir).
     assertTriggerDiversity(spec);
     // Model floor (default Sonnet): trigger-rate under-measures selection on a
@@ -1469,26 +1593,50 @@ async function measureTriggerRateWith(spec, runner, parse = parseClaudeRun, runE
         parse,
         runError,
     };
+    const lock = resolveLock(spec.lock);
     try {
-        const relevant = await runTriggerSet(spec.prompts, cfg, runner);
-        const base = {
-            rate: relevant.n > 0 ? relevant.fired / relevant.n : 0,
-            n: relevant.n,
-            perPrompt: relevant.perPrompt,
-            competitors,
-            errored: positiveOrUndefined(relevant.errored),
-        };
-        if ((spec.irrelevantPrompts?.length ?? 0) === 0)
-            return base;
-        const irrelevant = await runTriggerSet(spec.irrelevantPrompts ?? [], cfg, runner);
-        const fires = relevant.fired + irrelevant.fired;
-        return {
-            ...base,
-            errored: positiveOrUndefined(relevant.errored + irrelevant.errored),
-            falsePositiveRate: irrelevant.n > 0 ? irrelevant.fired / irrelevant.n : 0,
-            precision: fires > 0 ? relevant.fired / fires : undefined,
-            perIrrelevant: irrelevant.perPrompt,
-        };
+        // The lock hashes the skill UNDER TEST (its dir contents) + the prompts +
+        // model + tools — the inputs that steer whether it fires. `--check` replays
+        // the committed report with no model; `--update` records it. Resolved only
+        // when the lock is active. `trials` is excluded (a sample-size knob).
+        const triggerInputs = lock.mode === "off"
+            ? undefined
+            : {
+                pluginDirHash: (0, eval_cache_js_1.hashDir)(pluginDir),
+                prompts: [...spec.prompts],
+                irrelevantPrompts: spec.irrelevantPrompts
+                    ? [...spec.irrelevantPrompts]
+                    : undefined,
+                model: cfg.model,
+                tools: [...cfg.tools].sort(),
+                fixture: spec.fixture,
+                competitors,
+                // The harness the driver runs is a model-facing input — a Claude vs
+                // Codex run can fire a skill differently — so a recorded report is
+                // STALE if the eval is switched to another harness.
+                harness,
+            };
+        return await withEvalLock({ name: spec.name, inputs: triggerInputs, model: cfg.model, lock }, async () => {
+            const relevant = await runTriggerSet(spec.prompts, cfg, runner);
+            const base = {
+                rate: relevant.n > 0 ? relevant.fired / relevant.n : 0,
+                n: relevant.n,
+                perPrompt: relevant.perPrompt,
+                competitors,
+                errored: positiveOrUndefined(relevant.errored),
+            };
+            if ((spec.irrelevantPrompts?.length ?? 0) === 0)
+                return base;
+            const irrelevant = await runTriggerSet(spec.irrelevantPrompts ?? [], cfg, runner);
+            const fires = relevant.fired + irrelevant.fired;
+            return {
+                ...base,
+                errored: positiveOrUndefined(relevant.errored + irrelevant.errored),
+                falsePositiveRate: irrelevant.n > 0 ? irrelevant.fired / irrelevant.n : 0,
+                precision: fires > 0 ? relevant.fired / fires : undefined,
+                perIrrelevant: irrelevant.perPrompt,
+            };
+        });
     }
     finally {
         // Remove the throwaway plugin dir we built from a loose `skillsDir`.
@@ -1506,7 +1654,7 @@ async function measureTriggerRateWith(spec, runner, parse = parseClaudeRun, runE
  */
 async function measureTriggerRate(spec, opts = {}) {
     const d = opts.evalDriver ?? exports.claudeEvalDriver;
-    return measureTriggerRateWith(spec, d.runner, d.parse, d.runError);
+    return measureTriggerRateWith(spec, d.runner, d.parse, d.runError, d.harness ?? "claude-code");
 }
 /* v8 ignore stop */
 /** Format a trigger-rate report: overall %, then each prompt's rate. */

package/dist/leaderboard.d.ts

@@ -26,6 +26,7 @@ export declare const W_NO_DESCRIPTION = 10;
 export declare const W_DANGLING_REF = 8;
 export declare const W_OVERLAP = 8;
 export declare const W_NO_CONTRACT = 5;
+export declare const W_TRIFECTA = 20;
 /** Map a 0–100 structural-health score to its letter grade (A ≥90 … F <60). */
 export declare function gradeFor(score: number): PluginScore["grade"];
 /** One deduction: a count, its per-item weight, and the label if non-zero. */

package/dist/leaderboard.js

@@ -12,7 +12,7 @@
  * model and stack on top later; this part runs anywhere in CI for free.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.W_NO_CONTRACT = exports.W_OVERLAP = exports.W_DANGLING_REF = exports.W_NO_DESCRIPTION = exports.W_MISSING_HOOK = void 0;
+exports.W_TRIFECTA = exports.W_NO_CONTRACT = exports.W_OVERLAP = exports.W_DANGLING_REF = exports.W_NO_DESCRIPTION = exports.W_MISSING_HOOK = void 0;
 exports.gradeFor = gradeFor;
 exports.reportDeductions = reportDeductions;
 exports.isEmptyMachine = isEmptyMachine;
@@ -49,6 +49,7 @@ exports.W_NO_DESCRIPTION = 10; // a skill with no usable description → can't t
 exports.W_DANGLING_REF = 8; // a referenced intra-plugin file that's missing → broken path
 exports.W_OVERLAP = 8; // a description collision → the wrong skill fires
 exports.W_NO_CONTRACT = 5; // generic small-footgun weight (disallowedTools typo, invalid model/color)
+exports.W_TRIFECTA = 20; // a HARD lethal-trifecta contract (all three legs, explicit) → a declared prompt-injection exfil path
 // Two things are advisory, NOT graded penalties (shown, never scored — see scoreReport):
 //   - untested surfaces — a hardening gap, not breakage.
 //   - an agent that inherits all tools (no `tools:` line) — see reportDeductions for why.
@@ -77,7 +78,17 @@ function reportDeductions(r) {
     const deadTools = r.agents.reduce((n, a) => n + a.toolIssues.length, 0);
     const deadMcpTools = r.agents.reduce((n, a) => n + a.mcpToolIssues.length, 0);
     const deadDisallowed = r.agents.reduce((n, a) => n + a.disallowedToolIssues.length, 0);
+    // HARD lethal-trifecta findings only — an EXPLICIT contract naming all three
+    // legs (a declared exfil path). Advisory (inherits-all) trifecta findings are
+    // surfaced but NEVER graded (aligned with the inherits-all stance), so they're
+    // excluded here.
+    const hardTrifecta = r.trifectaFindings.filter((f) => f.finding.severity === "hard").length;
     return [
+        {
+            n: hardTrifecta,
+            weight: exports.W_TRIFECTA,
+            label: "unit(s) holding all three lethal-trifecta legs (prompt-injection exfil path)",
+        },
         {
             n: missingHooks,
             weight: exports.W_MISSING_HOOK,
@@ -146,6 +157,33 @@ function reportDeductions(r) {
             weight: exports.W_DANGLING_REF,
             label: "mcp_tool hook(s) incomplete / targeting an undeclared server",
         },
+        {
+            n: r.skillResourceIssues.length,
+            weight: exports.W_DANGLING_REF,
+            label: "skill bundled-resource ref(s) that don't resolve on disk",
+        },
+        {
+            n: r.skillFenceIssues.length,
+            weight: exports.W_NO_DESCRIPTION,
+            label: "invisible skill(s) (frontmatter with no opening `---` fence)",
+        },
+        {
+            n: r.pluginLayoutIssues.length,
+            weight: exports.W_NO_DESCRIPTION,
+            label: "functional dir(s) misplaced inside `.claude-plugin/` (invisible)",
+        },
+        {
+            n: r.hookBlockFindings.length,
+            weight: exports.W_MISSING_HOOK,
+            label: "hook(s) that look like they block but silently don't",
+        },
+        {
+            n: r.hookMatcherFindings.length,
+            weight: exports.W_MISSING_HOOK,
+            label: "hook matcher(s) that never fire (typo / wrong MCP form)",
+        },
+        // NB: delegationTrifecta (like the advisory per-unit/inherits-all trifecta) is a
+        // ⚠ RISK, surfaced but NOT graded — only the HARD per-unit trifecta above scores.
         // NB: untested surfaces are NOT a penalty — an untested surface is a hardening
         // gap, not breakage, so it never drags the health score (it's appended as an
         // advisory note below). The score ranks what's BROKEN.
@@ -239,11 +277,11 @@ function formatLeaderboard(scores) {
         const issue = s.issues.length > 0 ? ` — ${s.issues.join("; ")}` : "";
         out.push(`  ${rank}  ${score}    ${s.grade}      ${s.name}${issue}`);
     });
-    out.push("", "Structural health only (no model). Weights: missing hook -15, no-description", "skill -10, broken intra-plugin ref -8, dead tool/MCP ref -8.", "Inherit-all subagents and untested surfaces are advisory — shown, not scored.");
+    out.push("", "Structural health only (no model). Weights: lethal-trifecta unit -20, missing", "hook -15, no-description skill -10, broken intra-plugin ref -8, dead tool/MCP", "ref -8. Inherit-all subagents and untested surfaces are advisory — shown, not", "scored.");
     return out.join("\n");
 }
-const LEADERBOARD_METHOD = "_Structural health only (deterministic, no model): missing hook −15, " +
-    "no-description skill −10, broken intra-plugin / dead-tool ref −8. " +
+const LEADERBOARD_METHOD = "_Structural health only (deterministic, no model): lethal-trifecta unit −20, " +
+    "missing hook −15, no-description skill −10, broken intra-plugin / dead-tool ref −8. " +
     "Inherit-all subagents and untested surfaces are advisory (shown, not " +
     "scored). Behavioural columns (trigger-rate, collisions, egress) stack on top._";
 /**

package/dist/scan.d.ts

@@ -20,6 +20,13 @@ import { type DescriptionOverlap } from "./core/description-overlap.js";
 import { type McpToolIssue } from "./core/mcp-tool.js";
 import { type McpContractToolError } from "./core/mcp.js";
 import { type McpHookIssue } from "./core/mcp-hook.js";
+import { type TrifectaFinding } from "./core/lethal-trifecta.js";
+import { type SkillResourceFinding } from "./core/skill-resources.js";
+import { type SkillFenceFinding } from "./core/skill-missing-fence.js";
+import { type PluginLayoutFinding } from "./core/plugin-dir-layout.js";
+import { type DelegationTrifectaFinding } from "./core/delegation-trifecta.js";
+import { type HookBlockFinding } from "./core/hook-block-ineffective.js";
+import { type HookMatcherFinding } from "./core/hook-matcher.js";
 import { type PurityLevel, type EffectSurface } from "./core/effects.js";
 /** A named writing system. The label `unexpectedScript` reports + the config's expectation parse into this. */
 export type Script = "Latin" | "Cyrillic" | "Han" | "Japanese" | "Korean" | "Arabic" | "Hebrew" | "Greek" | "Devanagari" | "Thai";
@@ -43,6 +50,27 @@ export interface ScanSkill {
      * `audit` trigger tier / `measureTriggerRate`.
      */
     readonly descriptionScript: Script | null;
+    /**
+     * SKILL.md body references to a bundled file (`scripts/`/`references/`/`assets/`
+     * or a relative markdown link with an extension) that don't resolve on disk
+     * under the skill dir — the agent reads the instruction and gets nothing.
+     * Computed by `skillResourceIssues()` (one detector, no drift).
+     */
+    readonly resourceIssues: readonly SkillResourceFinding[];
+    /**
+     * Lethal-trifecta finding when a MODEL-INVOCABLE skill's declared `allowed-tools`
+     * hold all three legs (read-private + ingest-untrusted + exfiltrate), else null.
+     * A user-invoked skill is excluded (it can't be selected by attacker content).
+     * Computed by `lethalTrifectaIssues()` (one detector, no drift).
+     */
+    readonly trifecta: TrifectaFinding | null;
+    /**
+     * Set when the SKILL.md opens with frontmatter-looking keys (`name:`, …) but
+     * has NO opening `---` fence, so the whole file loads as body — no name, no
+     * description, no trigger (the skill is invisible). Computed by
+     * `skillMissingFence()` (one detector, no drift).
+     */
+    readonly fenceIssue: SkillFenceFinding | null;
 }
 export interface ScanAgent {
     readonly name: string;
@@ -68,6 +96,37 @@ export interface ScanAgent {
      * unknown-effect (MCP or unrecognized) tool names in the declared contract.
      */
     readonly effectBuckets: Pick<EffectSurface, "readOnly" | "sideEffecting" | "unknown">;
+    /**
+     * Lethal-trifecta finding when the subagent's declared tools hold all three legs
+     * (read-private + ingest-untrusted + exfiltrate), else null. An inherits-all
+     * agent (no `tools:` line) is the "advisory" case. Computed by
+     * `lethalTrifectaIssues()` (one detector, no drift).
+     */
+    readonly trifecta: TrifectaFinding | null;
+}
+/** A lethal-trifecta finding tagged with the surface (subagent/skill) that holds it. */
+export interface ScanTrifectaFinding {
+    readonly path: string;
+    readonly kind: "subagent" | "skill";
+    readonly name: string;
+    readonly finding: TrifectaFinding;
+}
+/** A SKILL.md body resource reference that doesn't resolve, tagged with the skill path. */
+export interface ScanSkillResourceFinding {
+    readonly path: string;
+    readonly name: string;
+    readonly finding: SkillResourceFinding;
+}
+/** A missing-frontmatter-fence finding tagged with the skill path. */
+export interface ScanSkillFenceFinding {
+    readonly path: string;
+    readonly name: string;
+    readonly finding: SkillFenceFinding;
+}
+/** A delegation-trifecta finding tagged with the subagent path that holds it. */
+export interface ScanDelegationFinding {
+    readonly path: string;
+    readonly finding: DelegationTrifectaFinding;
 }
 /** A skill/agent whose frontmatter is missing a required field (name / description). */
 export interface FrontmatterIssue {
@@ -162,6 +221,53 @@ export interface ScanReport {
     readonly mcpHookIssues: readonly McpHookIssue[];
     /** Pairs of model-invocable skills whose descriptions are near-identical (precision collision). */
     readonly descriptionOverlaps: readonly DescriptionOverlap[];
+    /**
+     * Lethal-trifecta findings across subagents + model-invocable skills — a unit
+     * holding all three legs (read-private + ingest-untrusted + exfiltrate). Each
+     * carries the surface path + kind for reporting/annotations. Shared by `scan`
+     * (the report) and the `lethal-trifecta` lint rule (one detector, no drift).
+     */
+    readonly trifectaFindings: readonly ScanTrifectaFinding[];
+    /**
+     * SKILL.md body references to a bundled resource that doesn't resolve on disk,
+     * across all skills — each carries the skill path for reporting/annotations.
+     * Shared by `scan` and the `skill-resource-resolves` lint rule (one detector, no
+     * drift).
+     */
+    readonly skillResourceIssues: readonly ScanSkillResourceFinding[];
+    /**
+     * Skills whose frontmatter-looking opening has NO `---` fence, so they load as
+     * pure body (invisible — no name/description/trigger). Shared by `scan` and the
+     * `skill-missing-fence` lint rule (one detector, no drift).
+     */
+    readonly skillFenceIssues: readonly ScanSkillFenceFinding[];
+    /**
+     * Functional surface dirs (skills/agents/commands) nested INSIDE the manifest
+     * dir (`.claude-plugin/`) where the harness can't see them. Shared by `scan`
+     * and the `plugin-dir-layout` lint rule (one detector, no drift).
+     */
+    readonly pluginLayoutIssues: readonly PluginLayoutFinding[];
+    /**
+     * Lethal trifectas that EMERGE across a delegation edge — a subagent whose
+     * effective (own ∪ delegated-to) capability holds all three legs though no
+     * single unit does. Shared by `scan` and the `delegation-trifecta` lint rule
+     * (one detector, no drift).
+     */
+    readonly delegationTrifecta: readonly ScanDelegationFinding[];
+    /**
+     * Hooks that LOOK like they block but silently don't — a block decision on a
+     * non-blocking event, or the legacy `decision` field on a permission-gated
+     * event (#19009, the #1 verified hook pain). Shared by `scan` and the
+     * `hook-block-ineffective` lint rule (one detector, no drift). Empty when the
+     * dialect doesn't declare its blocking-event semantics.
+     */
+    readonly hookBlockFindings: readonly HookBlockFinding[];
+    /**
+     * Hook `matcher` strings that silently never fire — a tool-name typo or a
+     * malformed/undeclared MCP form. Shared by `scan` and the `hook-matcher` lint
+     * rule (one detector, no drift).
+     */
+    readonly hookMatcherFindings: readonly HookMatcherFinding[];
     /** Skills/agents whose `---` block isn't valid YAML — informational (may still load via salvage). */
     readonly malformedFrontmatter: readonly FrontmatterParseIssue[];
     readonly warnings: readonly string[];