vigiles 12.6.0 → 12.8.0

package/dist/rule-inventory.js

@@ -0,0 +1,327 @@
+"use strict";
+/**
+ * Rule-inventory — the deterministic, foreign-safe teaser surface of the
+ * `audit` rule-compile tier (design: `research/audit-rule-compile-tier.md`).
+ *
+ * Finds prose rules in a `CLAUDE.md` / `AGENTS.md` that map to an off-the-shelf
+ * lint rule, and whether that rule already appears in the repo's lint config.
+ * The remedy for a documented-but-unconfigured intent is a one-line config
+ * change, not synthesis — so this is a cheap, high-value nudge.
+ *
+ * NO model. NO config execution (textual grep only — never resolves/executes
+ * `eslint.config.js`, which would be the RCE path). HIGH PRECISION by
+ * construction: only rule-name / code-token-shaped keywords are matched, and
+ * only as whole tokens. Bare prose words are excluded on purpose — a raw
+ * keyword match (`token`, `!`, `await`, `secret`, `silently`, …) sprays false
+ * positives on real instruction files (measured: 107 raw hits over 4 real
+ * CLAUDE.md files, ~all garbage). The model-driven analysis (extract → classify
+ * → compile → gate → run) lives in the OPT-IN tier, not here.
+ *
+ * MULTI-LINTER by shape, ESLint-first by data. The matcher is linter-agnostic;
+ * each mapping is keyed by linter, so adding Ruff / Clippy / Pylint / RuboCop /
+ * Stylelint is additive DATA (a curation task), not a refactor. The OPT-IN tier
+ * should resolve "is this rule enabled" via vigiles's existing multi-linter
+ * `checkLinterRule` engine (which execs the config) — kept out of this
+ * exec-free, foreign-safe surface on purpose.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTENT_MAP = void 0;
+exports.matchesWholeToken = matchesWholeToken;
+exports.buildRuleInventory = buildRuleInventory;
+/**
+ * Curated from agent-rules-compiler's `rule-map.json`, keeping ONLY the
+ * specific (rule-name / code-token) keywords and dropping every bare-word
+ * trigger the FP measurement flagged (`token`, `secret`, `password`, `await`,
+ * `!`, `aria`, `silently`, `prefix`, `complexity`, `barrel`, `cycle`, …).
+ *
+ * ESLint-only today — Ruff/Clippy/Pylint/RuboCop/Stylelint entries append here
+ * with their own `linter` + rule-name keywords, no code change.
+ */
+exports.INTENT_MAP = [
+    {
+        intent: "no console.log / use the logger",
+        linter: "eslint",
+        keywords: ["console.log", "no-console"],
+        rule: "no-console",
+        configFix: '"no-console": "error"',
+    },
+    {
+        intent: "no `any` type",
+        linter: "eslint",
+        keywords: ["no-explicit-any", "@typescript-eslint/no-explicit-any"],
+        rule: "@typescript-eslint/no-explicit-any",
+        inRecommended: true,
+        configFix: '"@typescript-eslint/no-explicit-any": "error"',
+    },
+    {
+        intent: "no eslint-disable / no linter suppressors",
+        linter: "eslint",
+        keywords: ["eslint-disable", "eslint-comments/no-use"],
+        rule: "eslint-comments/no-use",
+        configFix: "enable eslint-comments/no-use OR linterOptions.noInlineConfig: true",
+    },
+    {
+        intent: "no @ts-ignore / @ts-expect-error abuse",
+        linter: "eslint",
+        keywords: [
+            "@ts-ignore",
+            "ts-expect-error",
+            "ban-ts-comment",
+            "@typescript-eslint/ban-ts-comment",
+        ],
+        rule: "@typescript-eslint/ban-ts-comment",
+        inRecommended: true,
+        configFix: '"@typescript-eslint/ban-ts-comment": "error"',
+    },
+    {
+        intent: "no hardcoded secrets",
+        linter: "eslint",
+        keywords: ["no-secrets"],
+        rule: "no-secrets/no-secrets",
+        configFix: "add eslint-plugin-no-secrets rule no-secrets/no-secrets",
+    },
+    {
+        intent: "no empty catch / no swallowed errors",
+        linter: "eslint",
+        keywords: ["no-empty"],
+        rule: "no-empty",
+        inRecommended: true,
+        configFix: '"no-empty": ["error", {"allowEmptyCatch": false}]',
+    },
+    {
+        intent: "no var / prefer const-let",
+        linter: "eslint",
+        keywords: ["no-var", "prefer-const"],
+        rule: "no-var",
+        configFix: '"no-var": "error"',
+    },
+    {
+        intent: "strict equality ===",
+        linter: "eslint",
+        keywords: ["eqeqeq"],
+        rule: "eqeqeq",
+        configFix: '"eqeqeq": "error"',
+    },
+    {
+        intent: "template literals over concatenation",
+        linter: "eslint",
+        keywords: ["prefer-template"],
+        rule: "prefer-template",
+        configFix: '"prefer-template": "error"',
+    },
+    {
+        intent: "no debugger",
+        linter: "eslint",
+        keywords: ["no-debugger"],
+        rule: "no-debugger",
+        inRecommended: true,
+        configFix: '"no-debugger": "error"',
+    },
+    {
+        intent: "restricted / deprecated imports",
+        linter: "eslint",
+        keywords: ["no-restricted-imports", "import/no-restricted-paths"],
+        rule: "no-restricted-imports",
+        configFix: '"no-restricted-imports": ["error", {…}]',
+    },
+    {
+        intent: "no circular deps",
+        linter: "eslint",
+        keywords: ["import/no-cycle", "no-cycle"],
+        rule: "import/no-cycle",
+        configFix: '"import/no-cycle": "error"',
+    },
+    {
+        intent: "function length / complexity caps",
+        linter: "eslint",
+        keywords: [
+            "max-lines-per-function",
+            "max-depth",
+            "max-params",
+            "max-statements",
+        ],
+        rule: "max-lines-per-function",
+        configFix: '"max-lines-per-function": ["error", 40]',
+    },
+    {
+        intent: "no unused vars",
+        linter: "eslint",
+        keywords: ["no-unused-vars", "@typescript-eslint/no-unused-vars"],
+        rule: "@typescript-eslint/no-unused-vars",
+        inRecommended: true,
+        configFix: '"@typescript-eslint/no-unused-vars": "error"',
+    },
+    {
+        intent: "no non-null assertion",
+        linter: "eslint",
+        keywords: [
+            "no-non-null-assertion",
+            "@typescript-eslint/no-non-null-assertion",
+        ],
+        rule: "@typescript-eslint/no-non-null-assertion",
+        inRecommended: true,
+        configFix: '"@typescript-eslint/no-non-null-assertion": "error"',
+    },
+    {
+        intent: "no floating promises",
+        linter: "eslint",
+        keywords: [
+            "no-floating-promises",
+            "@typescript-eslint/no-floating-promises",
+        ],
+        rule: "@typescript-eslint/no-floating-promises",
+        inRecommended: true,
+        configFix: '"@typescript-eslint/no-floating-promises": "error"',
+    },
+    {
+        intent: "react hooks deps",
+        linter: "eslint",
+        keywords: ["react-hooks/exhaustive-deps", "exhaustive-deps"],
+        rule: "react-hooks/exhaustive-deps",
+        configFix: '"react-hooks/exhaustive-deps": "error"',
+    },
+    // Added from the hand-verified rule-adherence corpus (real repos: motion,
+    // mapbox) — both are documented in the wild and have an off-the-shelf rule.
+    {
+        intent: "no default exports",
+        linter: "eslint",
+        keywords: ["import/no-default-export", "no-default-export"],
+        rule: "import/no-default-export",
+        configFix: '"import/no-default-export": "error"',
+    },
+    {
+        intent: "no TODO / FIXME comments",
+        linter: "eslint",
+        keywords: ["no-warning-comments"],
+        rule: "no-warning-comments",
+        configFix: '"no-warning-comments": ["error", {"terms": ["todo", "fixme"], "location": "anywhere"}]',
+    },
+];
+/** Escape a keyword for use inside a RegExp. */
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * A keyword matches only as a WHOLE token: bounded by start/end or a
+ * non-`[\w/@.-]` character on each side (so `no-console` matches in
+ * `` `no-console` `` and `enforce no-console;` but `no-console-x` does not,
+ * and prose containing the substring elsewhere never trips it).
+ */
+function matchesWholeToken(text, keyword) {
+    const re = new RegExp(`(^|[^\\w/@.-])${escapeRe(keyword)}([^\\w/@.-]|$)`, "i");
+    return re.test(text);
+}
+/**
+ * Build the deterministic rule inventory. Pure: caller passes the instruction
+ * file text (concatenated CLAUDE.md/AGENTS.md) and the lint config text (any
+ * `eslint.config.*` / `.eslintrc*` / `ruff.toml` / … contents concatenated, or
+ * "" if none). Returns one item per documented intent whose keyword resolves.
+ * `not-in-config` items are the actionable nudges.
+ */
+/** ESLint re-exports some core rules under `@typescript-eslint/`; treat the base
+ * and scoped names as the same rule when checking the config text (so a repo that
+ * has base `no-unused-vars` satisfies the `@typescript-eslint/no-unused-vars`
+ * intent, and vice-versa). oxlint/biome use the SAME rule names, so once their
+ * config files are in the read set this handles them for free. */
+function variantsOf(rule) {
+    const TS = "@typescript-eslint/";
+    if (rule.startsWith(TS))
+        return [rule, rule.slice(TS.length)];
+    if (!rule.includes("/"))
+        return [rule, TS + rule];
+    return [rule];
+}
+/** True if the rule (or a base/scoped variant) appears in the config text. */
+function ruleInConfig(configText, rule) {
+    return variantsOf(rule).some((v) => matchesWholeToken(configText, v));
+}
+/**
+ * Whether the rule (or a variant) is EXPLICITLY disabled in the config text —
+ * `"no-console": "off"`, `no-console: 0`, `"no-console": ["off", …]`. Distinct
+ * from mere presence ({@link ruleInConfig}): a documented rule that the config
+ * turns OFF is a contradiction (docs say enforce, config disables), not an
+ * enforcement. Textual only — never resolves/executes the config (the RCE path).
+ * Conservative: matches only a literal off/0 severity right after the rule key,
+ * so a real `"error"`/`"warn"`/`1`/`2` never trips it.
+ */
+function ruleSetOff(configText, rule) {
+    return variantsOf(rule).some((v) => {
+        const re = new RegExp(`["']?${escapeRe(v)}["']?\\s*:\\s*(?:\\[\\s*)?["']?(?:off|0)\\b`, "i");
+        return re.test(configText);
+    });
+}
+/** Index of the first WHOLE-token occurrence of `keyword` in `text` (the keyword
+ * itself, not the boundary char), or -1. */
+function firstTokenIndex(text, keyword) {
+    const re = new RegExp(`(^|[^\\w/@.-])(${escapeRe(keyword)})([^\\w/@.-]|$)`, "i");
+    const m = re.exec(text);
+    return m ? m.index + m[1].length : -1;
+}
+/**
+ * Whether the matched mention is a documented opt-OUT ("`no-explicit-any` is off
+ * intentionally", "we disable X") rather than a norm to enforce. When the author
+ * deliberately turns a rule off, a not-in-config state is CONSISTENT, not a gap —
+ * nudging them to enable it is actively wrong advice (found dogfooding
+ * pmndrs/react-spring). Deterministic negation window around the matched token;
+ * conservative on purpose — only strong off/disable cues, so it never suppresses
+ * a genuine "enforce this" nudge. */
+function isDocumentedOptOut(text, keyword) {
+    const idx = firstTokenIndex(text, keyword);
+    if (idx < 0)
+        return false;
+    // Test the context on EITHER SIDE of the token, never the token itself — else
+    // the cue `disable` would match inside the rule name `eslint-disable` and
+    // self-suppress every mention of it. Left/right windows are separate strings.
+    // NB: `disabled` (full word) not `disable` — `disable` would match inside the
+    // rule name `eslint-disable`, which can appear in a NEIGHBOURING token's window.
+    const CUE = /\b(?:off|disabled|not enforced|not enabled|turned off)\b/i;
+    const left = text.slice(Math.max(0, idx - 48), idx);
+    const right = text.slice(idx + keyword.length, idx + keyword.length + 48);
+    return CUE.test(left) || CUE.test(right);
+}
+/** A `recommended`-style preset extend anywhere in the config text — evidence
+ * that preset-enabled rules may already be on even when not named literally.
+ * Coarse on purpose: presence of a preset downgrades a not-named preset rule to
+ * `preset-maybe` (no false "unenforced" alarm) rather than claiming it's off. */
+function extendsRecommended(configText) {
+    return /recommended/i.test(configText);
+}
+function buildRuleInventory(instructionText, configText, options = {}) {
+    const linters = options.linters;
+    const items = [];
+    for (const m of exports.INTENT_MAP) {
+        if (linters && !linters.includes(m.linter))
+            continue;
+        const matched = m.keywords.find((kw) => matchesWholeToken(instructionText, kw));
+        if (!matched)
+            continue;
+        const off = ruleSetOff(configText, m.rule);
+        const inConfig = ruleInConfig(configText, m.rule);
+        // A rule the author documents as deliberately OFF, and whose config agrees
+        // (absent, or literally set to off), is consistent — not a gap. Skip it so we
+        // never nudge "enable X" against an intentional opt-out, and never flag a
+        // documented opt-out as a contradiction.
+        if (isDocumentedOptOut(instructionText, matched) && (off || !inConfig)) {
+            continue;
+        }
+        // Precedence: an explicit off/0 is a contradiction even though the rule name
+        // is technically "in config" — so it must be checked before `in-config`.
+        const configState = off
+            ? "contradiction"
+            : inConfig
+                ? "in-config"
+                : m.inRecommended && extendsRecommended(configText)
+                    ? "preset-maybe"
+                    : "not-in-config";
+        items.push({
+            intent: m.intent,
+            linter: m.linter,
+            matched,
+            rule: m.rule,
+            configState,
+            configFix: m.configFix,
+        });
+    }
+    return items;
+}
+//# sourceMappingURL=rule-inventory.js.map

package/dist/rule-routing.d.ts

@@ -0,0 +1,46 @@
+import { type LinterName } from "./rule-inventory.js";
+/** How a routed rule would be enforced (a MECHANISM ladder, not a 1-10 score). */
+export type RuleCategory = "reuse" | "hook" | "semantic" | "unrouted";
+export type RuleMechanism = "config-line" | "hook" | "prose" | "compile";
+/** One segmented, deterministically-routed rule with provenance. */
+export interface RoutedRule {
+    /** Normalized atomic rule text (from the segmenter). */
+    readonly text: string;
+    /** Verbatim source slice — for a UI highlight. */
+    readonly quote: string;
+    readonly file: string | undefined;
+    readonly lineStart: number;
+    readonly lineEnd: number;
+    /** Segmenter confidence that this IS a rule (3/3 cues → high, 2/3 → medium). */
+    readonly confidence: "high" | "medium";
+    readonly category: RuleCategory;
+    readonly mechanism: RuleMechanism;
+    /** reuse only: the off-the-shelf rule that enforces it. */
+    readonly rule?: string;
+    /** reuse only: the linter that rule belongs to. */
+    readonly linter?: LinterName;
+}
+export interface RuleRouting {
+    /** How many atomic rules were routed (after the confidence filter). */
+    readonly segmented: number;
+    readonly counts: Record<RuleCategory, number>;
+    readonly rules: readonly RoutedRule[];
+}
+export interface RouteOptions {
+    /**
+     * Minimum segmenter confidence to route. The segmenter emits `high` (3/3 cues
+     * — an imperative rule) and `medium` (2/3). For the audit PREVIEW we default to
+     * `high` only: precision over recall. A doc-heavy instruction file (e.g. a
+     * keyFiles index of "`path` — description" bullets) trips the medium tier with
+     * non-rules, which would bury the real rules and overstate "unrouted". Pass
+     * `"medium"` to include both.
+     */
+    readonly minConfidence?: "high" | "medium";
+}
+/**
+ * Segment the instruction file and route every atomic rule deterministically.
+ * Pure: the caller passes the concatenated instruction text (and an optional
+ * source path for provenance). Returns per-category counts + the routed rules.
+ */
+export declare function routeRules(instructionText: string, file?: string, options?: RouteOptions): RuleRouting;
+//# sourceMappingURL=rule-routing.d.ts.map

package/dist/rule-routing.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.routeRules = routeRules;
+/**
+ * rule-routing.ts — the deterministic (no-model) State-B routing PREVIEW.
+ *
+ * `rule-inventory.ts` answers a narrow question ("which prose lines name an
+ * off-the-shelf lint rule, and is it enabled?"). This goes one honest step
+ * further: it SEGMENTS the whole instruction file into atomic rules
+ * ({@link segmentInstructions}) and routes each one into the class that a real
+ * enforcement path would take — WITHOUT running a model:
+ *
+ *   reuse    → the rule text names an off-the-shelf lint rule ({@link INTENT_MAP})
+ *              → mechanism: flip one config line.
+ *   hook     → an ACTION rule a linter can't see (git push, rm -rf, "before you
+ *              commit") → mechanism: a pre-commit / PreToolUse hook.
+ *   semantic → a judgment call ("readable", "single responsibility") no checker
+ *              can honestly decide → mechanism: stays prose.
+ *   unrouted → none of the above fired deterministically → mechanism: the opt-in
+ *              `compile` tier routes it (reuse / synthesize / hook / prose).
+ *
+ * HONESTY BY CONSTRUCTION: the deterministic tier NEVER claims a rule is
+ * "synthesizable" — deciding that a custom rule can be written (and gating it)
+ * is exactly the work the opt-in model tier does. Everything this file can't
+ * pin to a concrete cue is `unrouted` ("compile to find out"), not a promise.
+ *
+ * Pure, deterministic, dependency-free. Reuses `rule-inventory`'s hardened
+ * whole-token matcher + `INTENT_MAP`, and `segment`'s Tier-A segmenter.
+ */
+const segment_js_1 = require("./segment.js");
+const rule_inventory_js_1 = require("./rule-inventory.js");
+/** The mechanism each category maps to — a fixed, honest ladder. */
+const MECHANISM = {
+    reuse: "config-line",
+    hook: "hook",
+    semantic: "prose",
+    unrouted: "compile",
+};
+/**
+ * ACTION-rule cues — things a linter never sees (git, filesystem, shell,
+ * process). A hook is the right gate, not a lint rule. Ported from the compiler's
+ * classifier; deliberately specific so it doesn't grab a lint rule that merely
+ * mentions a file.
+ */
+const HOOK_CUES = [
+    /\bgit\s+push\b/i,
+    // "push … to main/master/prod" — tolerate backticks/adverbs between (real
+    // phrasings: "push directly to `main`", "pushing straight to master").
+    /\bpush\w*\b[^.\n]{0,24}\b(main|master|prod)\b/i,
+    /\bforce[- ]?push/i,
+    /--no-verify/i,
+    /\bnever\s+commit\b/i,
+    // "before you/each/every commit", "before committing".
+    /\bbefore\s+(you\s+|each\s+|every\s+)?commit(ting)?\b/i,
+    /\brun\b[^.\n]{0,20}\btests?\b[^.\n]{0,14}\bbefore\b/i,
+    /\bsigned-off-by\b/i,
+    /\b(don'?t|do not|never)\s+edit\b.*\b(generated|\.pb\.|_mock|proto-gen|lock)/i,
+    /\bgenerated\s+files?\b/i,
+    /\bco[- ]?authored[- ]?by\b/i,
+    /\brm\s+-rf\b/i,
+    /\bcurl\b.*\|\s*(sh|bash)/i,
+    /\bchmod\b/i,
+];
+/**
+ * Judgment / no-checker cues — a rule no linter can honestly decide, so it stays
+ * labeled prose. Ported from the compiler's classifier (the static markers only —
+ * no ruleMap dependency, to keep this file model-free and dep-free).
+ */
+const SEMANTIC_CUES = [
+    /\bself[- ]?documenting\b/i,
+    /\bclear(er)?\s+(names?|code|over clever)/i,
+    /\breadable\b/i,
+    /\bkeep it simple\b/i,
+    /\bover[- ]?engineer/i,
+    /\bsingle responsibility\b/i,
+    /\bcomposition over inheritance\b/i,
+    /\bmeaningful\b/i,
+    /\bidiomatic\b/i,
+    /\bwhere (it )?makes sense\b/i,
+    /\bappropriate(ly)?\b/i,
+    /\bsolid\s+principles?\b/i,
+    /\bbest practices?\b/i,
+    /\bclean code\b/i,
+];
+/**
+ * Route one atomic rule. Order matters: an ACTION cue (git push) wins over a
+ * rule-name mention ("never commit console.log" is a hook, not a lint rule);
+ * reuse (a concrete off-the-shelf rule) wins over a soft semantic cue.
+ */
+function classify(text) {
+    if (HOOK_CUES.some((re) => re.test(text)))
+        return { category: "hook" };
+    for (const m of rule_inventory_js_1.INTENT_MAP) {
+        if (m.keywords.some((kw) => (0, rule_inventory_js_1.matchesWholeToken)(text, kw))) {
+            return { category: "reuse", rule: m.rule, linter: m.linter };
+        }
+    }
+    if (SEMANTIC_CUES.some((re) => re.test(text)))
+        return { category: "semantic" };
+    return { category: "unrouted" };
+}
+/**
+ * Segment the instruction file and route every atomic rule deterministically.
+ * Pure: the caller passes the concatenated instruction text (and an optional
+ * source path for provenance). Returns per-category counts + the routed rules.
+ */
+function routeRules(instructionText, file, options = {}) {
+    const minConfidence = options.minConfidence ?? "high";
+    const segments = (0, segment_js_1.segmentInstructions)(instructionText, file).filter((s) => minConfidence === "medium" || s.confidence === "high");
+    const rules = segments.map((s) => {
+        const c = classify(s.text);
+        return {
+            text: s.text,
+            quote: s.exactQuote,
+            file: s.file,
+            lineStart: s.lineStart,
+            lineEnd: s.lineEnd,
+            confidence: s.confidence,
+            category: c.category,
+            mechanism: MECHANISM[c.category],
+            ...(c.rule ? { rule: c.rule } : {}),
+            ...(c.linter ? { linter: c.linter } : {}),
+        };
+    });
+    const counts = {
+        reuse: 0,
+        hook: 0,
+        semantic: 0,
+        unrouted: 0,
+    };
+    for (const r of rules)
+        counts[r.category]++;
+    return { segmented: segments.length, counts, rules };
+}
+//# sourceMappingURL=rule-routing.js.map

package/dist/scaffold-test.js

@@ -210,7 +210,7 @@ function safetySection(input, sideEffecting) {
 // --- Safety (deterministic) — generated from ${input.name}'s side-effecting tools: ${sideEffecting.join(", ")} ---
 // In a real run, replace this constructed Trace with a real \`runHarness\` /
 // \`measure\` turn (use interceptTools so a real model's attempt is DENIED, never
-// executed — see docs/eval-architecture.md). The checks below are derived from the
+// executed — see research/eval-architecture.md). The checks below are derived from the
 // declared tools contract — the agent's "hole" asserted to stay in its lane.
 {
   const trace = {

package/dist/scan.d.ts

@@ -301,7 +301,10 @@ export declare function isManagedHookCommand(command: string): boolean;
 /** The `prefer-compiled-hooks` recommendation message (shared by `lint` + `scan`). */
 export declare function preferCompiledHooksMessage(count: number): string;
 /** Scan a plugin/repo directory and report its surfaces + structural issues. */
-export declare function scanPlugin(dir: string, layout?: PluginLayout, dialect?: HarnessDialect): ScanReport;
+export declare function scanPlugin(dir: string, layout?: PluginLayout, dialect?: HarnessDialect, opts?: {
+    sharedDirs?: readonly string[];
+    sharedDirsRoot?: string;
+}): ScanReport;
 /**
  * LIVE MCP tool resolution for a scanned plugin — the dynamic check no static
  * linter can do: it STARTS each declared MCP server and checks every

package/dist/scan.js

@@ -151,11 +151,18 @@ function onDiskPath(materializedKey, materializeRoot) {
         : materializedKey;
 }
 function scanSkills(files, cls, ctx) {
-    const { root, materializeRoot, dialect } = ctx;
+    const { root, materializeRoot, dialect, sharedDirs } = ctx;
+    // `sharedDirs` are declared relative to the REPO root (config location), which
+    // is `root` for a whole-repo scan but a PARENT when the scan is scoped to a
+    // subdir. Resolve them against that, not the scoped subdir.
+    const sharedDirsRoot = ctx.sharedDirsRoot ?? root;
     const out = [];
     for (const [path, md] of Object.entries(files)) {
         if (!cls.isSkill(path))
             continue;
+        // Prefer the real on-disk dir (a `.claude/skills/…` skill materializes under
+        // the same canonical key as a repo-root one, but lives elsewhere on disk).
+        const onDiskDir = ctx.sources?.[path];
         const fm = frontmatter(md);
         // A skill's trigger surface is its frontmatter `description` OR — when that's
         // absent — Claude Code's fallback to the first body paragraph. Only when
@@ -166,8 +173,18 @@ function scanSkills(files, cls, ctx) {
         // Bundled-resource refs resolve against the skill's OWN dir (resources ship
         // beside the SKILL.md), built from the plugin root + the file's ON-DISK dir
         // (the materialize-root prefix the loader added is stripped back off).
-        const skillDir = (0, node_path_1.resolve)(root, (0, node_path_1.dirname)(onDiskPath(path, materializeRoot)));
-        const resourceIssues = (0, skill_resources_js_1.skillResourceIssues)(skillBody(md), skillDir);
+        const skillDir = onDiskDir
+            ? (0, node_path_1.dirname)(onDiskDir)
+            : (0, node_path_1.resolve)(root, (0, node_path_1.dirname)(onDiskPath(path, materializeRoot)));
+        // Bundled refs resolve against the skill's OWN dir. A repo that shares a
+        // top-level tree across skills (`sharedDirs` in .vigilesrc.json) ALSO resolves
+        // a ref under one of those declared dirs against the repo root — OPT-IN, so a
+        // repo that doesn't set it is byte-identical to before (no masking of a real
+        // missing bundled resource). See feedback P1-4.
+        const resourceIssues = (0, skill_resources_js_1.skillResourceIssues)(skillBody(md), skillDir, {
+            repoRoot: sharedDirsRoot,
+            sharedDirs,
+        });
         // The lethal trifecta is a property of what a unit CAN do, which for a skill is
         // its declared `allowed-tools` (the CC skill tool contract). Only a model-
         // invocable skill can be hijacked by attacker content, so a user-invoked one is
@@ -702,7 +719,7 @@ function summarizePurity(agents) {
     }, { pure: 0, bounded: 0, unrestricted: 0 });
 }
 /** Scan a plugin/repo directory and report its surfaces + structural issues. */
-function scanPlugin(dir, layout, dialect = dialect_js_1.claudeCodeDialect) {
+function scanPlugin(dir, layout, dialect = dialect_js_1.claudeCodeDialect, opts = {}) {
     const lay = layout ?? layout_js_1.claudeCodeLayout;
     const cls = makeClassifier(lay);
     const loaded = (0, plugin_loader_js_1.loadPlugin)(dir, lay);
@@ -734,6 +751,9 @@ function scanPlugin(dir, layout, dialect = dialect_js_1.claudeCodeDialect) {
         root: (0, node_path_1.resolve)(dir),
         materializeRoot: lay.materializeRoot,
         dialect,
+        sources: loaded.sources,
+        sharedDirs: opts.sharedDirs,
+        sharedDirsRoot: opts.sharedDirsRoot,
     });
     const puritySummary = summarizePurity(agents);
     const { trifectaFindings, skillResourceFindings, skillFenceFindings } = collectSurfaceFindings(agents, skills);
@@ -958,7 +978,18 @@ function formatScanReport(r) {
     out.push(...section("MCP hook targets", r.mcpHookIssues.map((i) => `  ✗ ${i.message}`)));
     out.push(...section("Description overlap (precision risk)", r.descriptionOverlaps.map((o) => `  ⚠ ${o.message}`)));
     out.push(...section("Description budget (trigger-signal risk)", r.descriptionBudgetIssues.map((o) => `  ⚠ ${o.message}`)));
-    out.push(...section("Lethal trifecta (prompt-injection exfil risk)", r.trifectaFindings.map((t) => `  ${t.finding.severity === "hard" ? "✗" : "⚠"} ${t.kind} ${t.name} (${t.path}): ${t.finding.message}`)));
+    out.push(...section("Lethal trifecta (prompt-injection exfil risk)", 
+    // The section header already carries the count. HARD findings name their
+    // specific legs (keep the message). ADVISORY (inherits-all) findings all
+    // carry the SAME boilerplate paragraph — at bulk that's a wall of identical
+    // text, so collapse each to a one-liner (feedback P2-6). Gate on "no NEW
+    // trifecta" with `vigiles lint` (the lethal-trifecta rule), not by eyeballing.
+    r.trifectaFindings.map((t) => {
+        const mark = t.finding.severity === "hard" ? "✗" : "⚠";
+        return t.finding.severity === "hard"
+            ? `  ${mark} ${t.kind} ${t.name} (${t.path}): ${t.finding.message}`
+            : `  ${mark} ${t.kind} ${t.name} (${t.path}) — inherits-all contract holds all three legs (declare a tools list dropping one)`;
+    })));
     out.push(...section("Skill bundled resources", r.skillResourceIssues.map((s) => `  ✗ ${s.name}: ${s.finding.ref} (line ${String(s.finding.line)}) — bundled resource not found`)));
     out.push(...section("Invisible skills (missing frontmatter fence)", r.skillFenceIssues.map((s) => `  ✗ ${s.name} (${s.path}): opens with \`${s.finding.key}:\` but no \`---\` fence — loads as body, never fires`)));
     out.push(...section("Misplaced plugin directories", r.pluginLayoutIssues.map((p) => `  ✗ ${p.message}`)));

package/dist/segment.d.ts

@@ -0,0 +1,33 @@
+/**
+ * segment.ts — Tier-A deterministic (no-model) segmenter.
+ *
+ * Splits a CLAUDE.md / AGENTS.md into ATOMIC candidate rules with provenance.
+ * Pure, deterministic, strict TS, no external deps.
+ *
+ * Design bias: PRECISION over recall. A missed rule costs a row; a garbage
+ * atom costs credibility. When in doubt we UNDER-split and REJECT.
+ */
+/** A single atomic candidate rule extracted from an instructions file. */
+export interface SegmentedRule {
+    /** Normalized rule text (bullet marker stripped, continuation joined, whitespace collapsed). */
+    text: string;
+    /** Source file path (as supplied by the caller), or undefined. */
+    file: string | undefined;
+    /** 1-based inclusive start line in the source. */
+    lineStart: number;
+    /** 1-based inclusive end line in the source. */
+    lineEnd: number;
+    /** Verbatim slice of the source spanning [lineStart..lineEnd] — for UI highlight. */
+    exactQuote: string;
+    /** 3/3 cues => "high"; 2/3 => "medium". (Rejected candidates are never emitted.) */
+    confidence: "high" | "medium";
+}
+/**
+ * Split a CLAUDE.md / AGENTS.md into atomic candidate rules with provenance.
+ *
+ * Deterministic Tier-A heuristic. Code fences and tables are excluded from
+ * candidacy. Candidate units are (a) list items with attached continuation
+ * lines and (b) sentences of paragraphs under a rule-ish heading.
+ */
+export declare function segmentInstructions(markdown: string, file?: string): SegmentedRule[];
+//# sourceMappingURL=segment.d.ts.map