vigiles 14.12.1 → 14.13.0

package/dist/audit-score.d.ts

@@ -14,10 +14,13 @@
  * (`lethalTrifectaIssues` → `report.trifectaFindings`): a unit holding all three
  * capability legs is a prompt-injection exfil path detectable from the tool-SET
  * alone — nothing executes, so it sidesteps the confinement blocker. A `"hard"`
- * (explicit all-three) finding is GRADED into the overall at a REDUCED weight
- * (`W_TRIFECTA=10`, HALF the old 20 — a DING, not a fail: it dents the grade
- * without a catastrophic F for a pattern official plugins ship by design); a
- * `"advisory"` (inherits-all) finding is SHOWN in the ring but not graded. NB the EXECUTING
+ * (explicit all-three) finding AND an `"advisory"` (inherits-all) one are BOTH
+ * graded — an inherited contract holds the three legs implicitly and every other
+ * capability besides, so grading only the explicit case made hardening LOWER the
+ * score. The cost is capped against the SHARE of the surface exposed
+ * (`W_TRIFECTA=10` per unit, `W_TRIFECTA_MAX=30` total — a DING, not a fail: it
+ * dents the grade without a catastrophic F for a pattern official plugins ship by
+ * design). NB the EXECUTING
  * "do your hooks actually block?" disaster-battery is STILL not an `audit` ring:
  * running arbitrary hooks safely needs cross-platform confinement that isn't
  * shipped yet, so the battery lives in the `vigiles/testing` API via

package/dist/audit-score.js

@@ -18,10 +18,13 @@ exports.formatAuditScore = formatAuditScore;
  * (`lethalTrifectaIssues` → `report.trifectaFindings`): a unit holding all three
  * capability legs is a prompt-injection exfil path detectable from the tool-SET
  * alone — nothing executes, so it sidesteps the confinement blocker. A `"hard"`
- * (explicit all-three) finding is GRADED into the overall at a REDUCED weight
- * (`W_TRIFECTA=10`, HALF the old 20 — a DING, not a fail: it dents the grade
- * without a catastrophic F for a pattern official plugins ship by design); a
- * `"advisory"` (inherits-all) finding is SHOWN in the ring but not graded. NB the EXECUTING
+ * (explicit all-three) finding AND an `"advisory"` (inherits-all) one are BOTH
+ * graded — an inherited contract holds the three legs implicitly and every other
+ * capability besides, so grading only the explicit case made hardening LOWER the
+ * score. The cost is capped against the SHARE of the surface exposed
+ * (`W_TRIFECTA=10` per unit, `W_TRIFECTA_MAX=30` total — a DING, not a fail: it
+ * dents the grade without a catastrophic F for a pattern official plugins ship by
+ * design). NB the EXECUTING
  * "do your hooks actually block?" disaster-battery is STILL not an `audit` ring:
  * running arbitrary hooks safely needs cross-platform confinement that isn't
  * shipped yet, so the battery lives in the `vigiles/testing` API via
@@ -183,12 +186,14 @@ function structure(r) {
 }
 /**
  * SAFETY — fed by the STATIC lethal-trifecta check (`report.trifectaFindings`), a
- * GRADED ring. A `"hard"` finding (an explicit contract naming all three
- * capability legs) is a prompt-injection exfil path and is GRADED at a REDUCED
- * weight (`W_TRIFECTA=10` each — HALF the old 20, a DING not a fail; the same
- * weight `reportDeductions` sums into the overall, so the ring and the headline
- * agree). A `"advisory"` finding (inherits-all) is SHOWN in the ring's findings
- * but NOT graded — aligned with the inherits-all-is-advisory stance.
+ * GRADED ring. EVERY unit holding all three capability legs counts, whether the
+ * contract NAMED them (`"hard"`) or INHERITED them (`"advisory"` — no `tools:` /
+ * `allowed-tools:` line, so it holds all three legs implicitly AND every other
+ * capability besides). Grading only the explicit case made the ring non-monotone:
+ * declaring a tool contract — a genuine risk REDUCTION — could only ever lower the
+ * score. The penalty is the shared {@link trifectaExposure} (capped against the
+ * share of the surface exposed), the SAME number `reportDeductions` sums into the
+ * overall, so the ring and the headline agree.
  *
  * Scores `null` (n/a, excluded from the overall) when there's NO tool-bearing
  * surface to assess at all — no subagents AND no model-invocable skills. A
@@ -197,9 +202,8 @@ function structure(r) {
  * the ring is a clean 100.
  */
 function safety(r) {
-    const modelInvocableSkills = r.skills.filter((s) => !s.userInvoked).length;
-    const assessable = r.agents.length + modelInvocableSkills;
-    if (assessable === 0) {
+    const exposure = (0, score_core_js_1.trifectaExposure)(r);
+    if (exposure.assessable === 0) {
         return {
             key: "Safety",
             score: null,
@@ -207,24 +211,23 @@ function safety(r) {
             findings: ["no tool-bearing surface to assess"],
         };
     }
-    const hard = r.trifectaFindings.filter((f) => f.finding.severity === "hard");
-    const { score, findings } = scoreFrom([
-        {
-            n: hard.length,
-            weight: score_core_js_1.W_TRIFECTA,
-            label: score_core_js_1.TRIFECTA_LABEL,
-        },
-    ]);
-    // inherits-all trifecta findings are ADVISORY: surfaced as a maximal-blast-radius
-    // note but never graded (mirrors the Structure inherits-all advisory).
-    const advisory = r.trifectaFindings
-        .filter((f) => f.finding.severity === "advisory")
-        .map((f) => `${f.name} inherits all tools — the "lethal trifecta" (reads data, reaches the web, runs commands), so a prompt injection could exfiltrate secrets (advisory)`);
+    const findings = [];
+    if (exposure.exposed > 0) {
+        findings.push(`${String(exposure.exposed)} of ${String(exposure.assessable)} ` +
+            pluralizeLabel(exposure.exposed, score_core_js_1.TRIFECTA_LABEL));
+    }
+    // NAME the inherited ones: they're both the worst (every capability, not just
+    // the three legs) and the cheapest to fix — declare a contract that drops a leg.
+    for (const f of r.trifectaFindings) {
+        if (f.finding.severity !== "advisory")
+            continue;
+        findings.push(`${f.name} inherits all tools — the "lethal trifecta" (reads data, reaches the web, runs commands) plus every other capability, so a prompt injection could exfiltrate secrets`);
+    }
     return {
         key: "Safety",
-        score,
+        score: Math.max(0, 100 - exposure.penalty),
         weight: 1,
-        findings: [...findings, ...advisory],
+        findings,
     };
 }
 function tested(r) {

package/dist/cli.js

@@ -69,6 +69,7 @@ const adopt_js_1 = require("./core/adopt.js");
 const coverage_js_1 = require("./core/coverage.js");
 const orphans_js_1 = require("./core/orphans.js");
 const doc_refs_js_1 = require("./core/doc-refs.js");
+const load_hook_js_1 = require("./load-hook.js");
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -4566,33 +4567,11 @@ function refsHookCommand() {
 // compile it to a harness block, run it as the hooks-block command.
 // ---------------------------------------------------------------------------
 /**
- * Load a compiled-hook program's default export. JS module formats
- * (`.mjs`/`.cjs`/`.js`) load via dynamic import directly; a TypeScript hook
- * loads only under a TS-capable runtime (tsx / Node >= 23.6) — otherwise an
- * actionable error points at authoring it as `.mjs`.
+ * Load a compiled-hook program's default export — the SHARED loader, also the
+ * public `vigiles/testing` `loadHook` a `.harness.mjs` test uses, so a hook that
+ * loads in a test loads identically here (one loader, no drift).
  */
-async function loadHookProgram(file) {
-    const abs = (0, node_path_1.resolve)(process.cwd(), file);
-    const { pathToFileURL } = require("node:url");
-    let mod;
-    try {
-        mod = (await import(pathToFileURL(abs).href));
-    }
-    catch (e) {
-        if (/\.(?:m|c)?ts$/.test(file)) {
-            throw new hook_program_js_1.HookCompileError(`Cannot load TypeScript hook "${file}" in this Node runtime. Run under ` +
-                `tsx (npx tsx …) / Node >= 23.6, or author the hook as a .mjs file.`);
-        }
-        throw new hook_program_js_1.HookCompileError(`Cannot load hook "${file}": ${e.message}`);
-    }
-    // Unwrap the ESM/CJS double-default that `export default` can produce.
-    const program = mod.default?.default ?? mod.default;
-    if (!program || typeof program !== "object") {
-        throw new hook_program_js_1.HookCompileError(`${file} has no default-exported hook program ` +
-            `(use \`export default defineHook({…})\`).`);
-    }
-    return program;
-}
+const loadHookProgram = load_hook_js_1.loadHook;
 /** Load a registered provider (`.vigiles/providers/<name>`) → its definition. */
 async function loadProvider(file) {
     const abs = (0, node_path_1.resolve)(process.cwd(), file);
@@ -4643,14 +4622,19 @@ function hookStampPath(file) {
  * outside the sanctioned API does NOT compile (capability = API surface). The
  * emitted block routes the live event to `hook-runtime run-program`; a
  * tamper-evident stamp sidecar lets the runtime refuse a hand-edited artifact.
- * The merge is idempotent (keyed by the hook PATH), so recompiling updates in
- * place and never clobbers the user's own hooks.
+ * The merge is idempotent (keyed by the hook FILE via `normalizeHookRef`, not by
+ * the string the user typed — `x.hook.ts` and `./x.hook.ts` are the same wiring),
+ * so recompiling updates in place and never clobbers the user's own hooks.
  */
 async function installHookFile(file, adapter, registeredProviders = []) {
     const source = (0, node_fs_1.readFileSync)((0, node_path_1.resolve)(process.cwd(), file), "utf-8");
     const program = await loadHookProgram(file);
+    // Emit the CANONICAL path so two spellings of the same file produce the same
+    // command — the merge key and the emitted command must agree, or recompiling
+    // appends a duplicate block instead of replacing the existing one.
+    const ref = (0, hook_install_js_1.normalizeHookRef)(file);
     const compiled = (0, hook_program_js_1.compileHookProgram)(source, program, {
-        gateCommand: `npx vigiles hook-runtime run-program ${file}`,
+        gateCommand: `npx vigiles hook-runtime run-program ${ref}`,
         dialect: adapter.dialect,
         hookProtocol: adapter.hookProtocol,
         settingsFormat: adapter.layout.settingsFormat,
@@ -4668,8 +4652,8 @@ async function installHookFile(file, adapter, registeredProviders = []) {
             : JSON.parse((0, node_fs_1.readFileSync)(settingsAbs, "utf-8"))
         : {};
     const merged = format === "toml"
-        ? (0, hook_install_js_1.mergeHooksToml)(existing, compiled.hooks, file)
-        : (0, hook_install_js_1.mergeHooksJson)(existing, compiled.hooks, file);
+        ? (0, hook_install_js_1.mergeHooksToml)(existing, compiled.hooks, ref)
+        : (0, hook_install_js_1.mergeHooksJson)(existing, compiled.hooks, ref);
     (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(settingsAbs), { recursive: true });
     (0, node_fs_1.writeFileSync)(settingsAbs, (0, hook_install_js_1.serializeConfig)(merged, format));
     // No silent skips: warn loudly only where a hook's OUTPUT genuinely may not

package/dist/core/bash-effects.d.ts

@@ -50,6 +50,33 @@ export declare function isReadOnlyBash(command: string): boolean;
  * native `Bash(git:*)` glob (issue #30519) and a hand-written `grep` both miss.
  */
 export declare function leafCommands(command: string): string[][];
+/**
+ * One redirection attached to a simple command (`cmd > f`, `cmd 2>> log`).
+ *
+ * The parser used to DROP these: `echo x > out.md` normalized to a leaf whose
+ * every field (`head`/`argv`/`args`/`flags`/`assigns`) mentioned only `echo` and
+ * `x`, so the file the command actually WROTE appeared nowhere. That made the
+ * single most common write shape invisible to any matcher built on the leaf.
+ */
+export interface LeafRedirect {
+    /** The operator as written: `>`, `>>`, `>|`, `&>`, `&>>`, `<`, `<<`, `>&`, … */
+    readonly op: string;
+    /**
+     * The redirection target, quote-unwrapped and `$HOME`-canonicalized like every
+     * other word. `null` when the target is dynamic (`> "$out"`, `> $(f)`) — present
+     * but unresolvable, never silently dropped. For an fd-dup (`2>&1`) this is the
+     * fd, not a path; for a heredoc it's the delimiter.
+     */
+    readonly target: string | null;
+    /** The explicit source fd (`2> f` → 2), or `null` when omitted. */
+    readonly fd: number | null;
+    /**
+     * True iff this redirection CREATES OR MODIFIES the file named by `target` —
+     * `>`, `>>`, `>|`, `&>`, `&>>`. False for input (`<`, `<<`, `<<<`) and for fd
+     * duplication (`2>&1`), whose "target" is an fd, not a path.
+     */
+    readonly writes: boolean;
+}
 /** A single simple command, normalized to its operation form. */
 export interface NormalizedLeaf {
     /** Head normalized to its basename, backslash-stripped: `/bin/rm`→`rm`, `\rm`→`rm`. */
@@ -80,6 +107,11 @@ export interface NormalizedLeaf {
     readonly assigns: ReadonlyMap<string, string | null>;
     /** True iff a command-level assignment for ANY of `names` is present (resolved or not). */
     hasAssign(...names: readonly string[]): boolean;
+    /**
+     * The redirections attached to this leaf, in source order — see
+     * {@link LeafRedirect}. Empty for a command with no redirection.
+     */
+    readonly redirects: readonly LeafRedirect[];
 }
 /**
  * Extract every simple command as a {@link NormalizedLeaf} — the operation-level
@@ -90,6 +122,11 @@ export interface NormalizedLeaf {
  * compares against the OPERATION rather than the surface tokens, so it is robust
  * to quoting, interpreter path, backslash escaping, flag aliasing, and $HOME/~.
  *
+ * Each leaf also carries its REDIRECTIONS ({@link LeafRedirect}), which live on
+ * the enclosing `Stmt` rather than the `CallExpr` — walking CallExprs alone
+ * dropped them, hiding the file a command writes. Every CallExpr in the mvdan AST
+ * IS a `Stmt.Cmd`, so iterating statements finds exactly the same leaves.
+ *
  * Purely additive: reuses the same mvdan-sh parse, changes nothing above. Parse
  * failure → []. A leaf with a dynamic head is skipped (can't be normalized).
  */

package/dist/core/bash-effects.js

@@ -42,6 +42,27 @@ const sh = _sh;
 //   61 = <<  (Hdoc — input)          63 = <<< (HereStr — input)
 // ---------------------------------------------------------------------------
 const WRITE_REDIR_OPS = new Set([54, 55, 60, 64, 65]);
+/**
+ * Op code → the operator as WRITTEN, so a normalized leaf can REPORT the
+ * redirection it carries instead of a bare number. Pinned by
+ * `bash-effects-normalized.test.ts`, which re-derives every entry by parsing the
+ * operator itself — an mvdan-sh upgrade that renumbers a token fails there
+ * LOUDLY instead of silently misclassifying a write as a read.
+ */
+const REDIR_OP_NAMES = new Map([
+    [54, ">"],
+    [55, ">>"],
+    [56, "<"],
+    [57, "<>"],
+    [58, "<&"],
+    [59, ">&"],
+    [60, ">|"],
+    [61, "<<"],
+    [62, "<<-"],
+    [63, "<<<"],
+    [64, "&>"],
+    [65, "&>>"],
+]);
 // ---------------------------------------------------------------------------
 // Shell-escape heads: commands that dispatch arbitrary code as an argument.
 // We treat ALL of these as undecidable regardless of their flags.
@@ -671,6 +692,11 @@ function stripWrappers(argv) {
  * compares against the OPERATION rather than the surface tokens, so it is robust
  * to quoting, interpreter path, backslash escaping, flag aliasing, and $HOME/~.
  *
+ * Each leaf also carries its REDIRECTIONS ({@link LeafRedirect}), which live on
+ * the enclosing `Stmt` rather than the `CallExpr` — walking CallExprs alone
+ * dropped them, hiding the file a command writes. Every CallExpr in the mvdan AST
+ * IS a `Stmt.Cmd`, so iterating statements finds exactly the same leaves.
+ *
  * Purely additive: reuses the same mvdan-sh parse, changes nothing above. Parse
  * failure → []. A leaf with a dynamic head is skipped (can't be normalized).
  */
@@ -684,13 +710,27 @@ function leafCommandsNormalized(command) {
     }
     const out = [];
     sh.syntax.Walk(file, (node) => {
-        const leaf = normalizeCallExpr(node);
+        if (sh.syntax.NodeType(node) !== "Stmt" || !node.Cmd)
+            return true;
+        const leaf = normalizeCallExpr(node.Cmd, node.Redirs ?? []);
         if (leaf)
             out.push(leaf);
         return true;
     });
     return out;
 }
+/** Normalize a Stmt's redirections into {@link LeafRedirect}s (source order). */
+function normalizeRedirects(redirs) {
+    return redirs.map((r) => {
+        const fd = Number(r.N?.Value);
+        return {
+            op: REDIR_OP_NAMES.get(r.Op) ?? String(r.Op),
+            target: r.Word ? normalizeParts(r.Word.Parts) : null,
+            fd: Number.isInteger(fd) ? fd : null,
+            writes: WRITE_REDIR_OPS.has(r.Op),
+        };
+    });
+}
 /** Collect a CallExpr's leading `NAME=value` env-assignments into a name→value map. */
 function collectAssigns(node) {
     const assigns = new Map();
@@ -704,8 +744,11 @@ function collectAssigns(node) {
     }
     return assigns;
 }
-/** Normalize a single CallExpr node to a {@link NormalizedLeaf}, or null if it isn't one / has a dynamic head. */
-function normalizeCallExpr(node) {
+/**
+ * Normalize a single CallExpr node (plus the redirections of the `Stmt` that
+ * wraps it) to a {@link NormalizedLeaf}, or null if it isn't one / has a dynamic head.
+ */
+function normalizeCallExpr(node, redirs) {
     if (sh.syntax.NodeType(node) !== "CallExpr" || !node.Args?.length)
         return null;
     const headRaw = normalizeParts(node.Args[0]?.Parts);
@@ -734,6 +777,7 @@ function normalizeCallExpr(node) {
         hasFlag: (...names) => names.some((n) => flags.has(n)),
         assigns,
         hasAssign: (...names) => names.some((n) => assigns.has(n)),
+        redirects: normalizeRedirects(redirs),
     };
 }
 //# sourceMappingURL=bash-effects.js.map

package/dist/core/hook-program.d.ts

@@ -87,11 +87,41 @@ export interface CommandView {
     /** True iff the command is provably side-effecting (bash-effects classifier). */
     isSideEffecting(): boolean;
     /**
-     * True iff a leaf command references a path under one of the prefixes (e.g.
+     * True iff a leaf command MENTIONS a path under one of the prefixes (e.g.
      * `~/.ssh`, `.env`) — the secret-read / sensitive-path matcher. Sees the path
      * however the command is wrapped (`cd x && cat ~/.ssh/id_rsa`).
+     *
+     * MENTIONS, not writes. `grep -c x notes/S.md` touches `notes` — so does
+     * `rm -rf notes`. Pairing this with {@link isSideEffecting}, which classifies
+     * the WHOLE command line, does NOT recover the difference: a plain read whose
+     * line happens to be side-effecting for an unrelated reason (`grep -c x
+     * notes/S.md 2>/dev/null`) matches both and gets blocked. To gate WRITES to a
+     * directory, use {@link writesTo}; conflating the two is the trap.
      */
     touches(prefixes: readonly string[]): boolean;
+    /**
+     * True iff a leaf command CREATES OR MODIFIES a file under one of the prefixes
+     * — the "don't let Bash write here" matcher, and the precise counterpart to
+     * {@link touches}. Two sources, both AST-backed:
+     *
+     * - **Redirection targets** — `cmd > f`, `cmd >> f`, `cmd >| f`, `cmd &> f`.
+     *   This is the single most common write shape, and it lives on the statement,
+     *   not in any argv.
+     * - **File-writing programs**, at the argv positions that actually name the
+     *   file written: `sed -i`, `cp`/`mv`/`install` (destination), `tee`, `dd of=`,
+     *   `truncate`, `shred`.
+     *
+     * A path merely READ never matches — `cat a/paper.md`, `grep x a/paper.md`,
+     * `cp a/paper.md /tmp/x` (the source is read, `/tmp/x` is the write) are all
+     * false for `writesTo(["a"])`. Quoting is handled by the parser, so a write
+     * QUOTED inside another command does not match: in
+     * `echo 'echo y > a/paper.md' > /tmp/note.txt` the only real target is
+     * `/tmp/note.txt`.
+     *
+     * Deletion is a different question and is deliberately NOT reported here —
+     * pair with `runs("rm")` if a gate cares about removal too.
+     */
+    writesTo(prefixes: readonly string[]): boolean;
     /**
      * True iff the command pipes into a BARE shell interpreter (`curl … | sh`,
      * `… | bash -s`) — the remote-code-execution shape. High-signal: a shell leaf

package/dist/core/hook-program.js

@@ -112,8 +112,85 @@ function tokenUnder(token, prefix) {
 function isBareShellLeaf(argv) {
     return (SHELLS.has(argv[0] ?? "") && argv.slice(1).every((a) => a.startsWith("-")));
 }
+// ---------------------------------------------------------------------------
+// writesTo — which argv positions of a known file-writing program name the file
+// it WRITES. Deliberately small and high-precision: an unlisted head contributes
+// no write target (the redirection half above already covers `cmd > f`), so this
+// never guesses. Anything that only READS its operands (cat/grep/…) is absent by
+// construction.
+// ---------------------------------------------------------------------------
+/** Options that consume a SEPARATE following token, per writer head. */
+const WRITER_VALUE_OPTS = {
+    sed: new Set(["-e", "--expression", "-f", "--file", "-l", "--line-length"]),
+    truncate: new Set(["-s", "--size", "-r", "--reference"]),
+    tee: new Set(["-p", "--output-error"]),
+    install: new Set(["-m", "--mode", "-o", "--owner", "-g", "--group", "-t"]),
+    cp: new Set(["-t", "--target-directory", "-S", "--suffix"]),
+    mv: new Set(["-t", "--target-directory", "-S", "--suffix"]),
+    shred: new Set(["-n", "--iterations", "-s", "--size"]),
+    dd: new Set(),
+};
+/** The non-option operands of a leaf, with each option's separate value skipped. */
+function operandsOf(leaf) {
+    const valueOpts = WRITER_VALUE_OPTS[leaf.head] ?? new Set();
+    const out = [];
+    for (let i = 0; i < leaf.args.length; i++) {
+        const a = leaf.args[i];
+        if (a === undefined)
+            continue;
+        if (a === "--") {
+            out.push(...leaf.args.slice(i + 1).filter((x) => x !== undefined));
+            break;
+        }
+        if (a.length > 1 && a.startsWith("-")) {
+            if (valueOpts.has(a))
+                i++; // this option's value is not an operand
+            continue;
+        }
+        out.push(a);
+    }
+    return out;
+}
+/**
+ * The paths a leaf WRITES, by head. Empty for anything not known to write —
+ * including every read-only command, so a read can never be mistaken for a write.
+ */
+function writeTargetsOf(leaf) {
+    const operands = operandsOf(leaf);
+    switch (leaf.head) {
+        case "sed":
+            // Only `sed -i` edits in place; otherwise it writes to stdout. The first
+            // operand is the SCRIPT unless it was supplied via -e/-f.
+            if (!leaf.hasFlag("i", "in-place"))
+                return [];
+            return leaf.hasFlag("e", "expression", "f", "file")
+                ? operands
+                : operands.slice(1);
+        case "cp":
+        case "mv":
+        case "install":
+            // The LAST operand is the destination; every earlier one is read.
+            return operands.length >= 2 ? operands.slice(-1) : [];
+        case "tee":
+        case "truncate":
+        case "shred":
+            return operands;
+        case "dd":
+            // `dd if=src of=dest` — only the output file is written.
+            return leaf.args.flatMap((a) => a.startsWith("of=") ? [a.slice(3)] : []);
+        default:
+            return [];
+    }
+}
 function commandView(raw) {
     const leaves = (0, bash_effects_js_1.leafCommands)(raw);
+    // The operation-normalized leaves carry the redirections (and quote-unwrapped,
+    // wrapper-resolved argv) that `writesTo` needs; `leafCommands` cannot see them.
+    const normalized = (0, bash_effects_js_1.leafCommandsNormalized)(raw);
+    const writeTargets = normalized.flatMap((leaf) => [
+        ...leaf.redirects.flatMap((r) => r.writes && r.target !== null ? [r.target] : []),
+        ...writeTargetsOf(leaf),
+    ]);
     return {
         raw,
         runs(program, opts) {
@@ -122,6 +199,7 @@ function commandView(raw) {
         },
         isSideEffecting: () => (0, bash_effects_js_1.classifyBashCommand)(raw) === "side-effecting",
         touches: (prefixes) => leaves.some((argv) => argv.slice(1).some((tok) => prefixes.some((p) => tokenUnder(tok, p)))),
+        writesTo: (prefixes) => writeTargets.some((t) => prefixes.some((p) => tokenUnder(t, p))),
         pipesToShell: () => leaves.some(isBareShellLeaf),
     };
 }

package/dist/harness-assert.d.ts

@@ -60,6 +60,27 @@ export declare function assertHookAllowed(r: HookRunResult): void;
 export declare function assertHookDenies(hook: AnyHook, event: RawHookEvent): void;
 /** Assert a COMPILED hook allows an event (in-process). The twin of {@link assertHookDenies}. */
 export declare function assertHookAllows(hook: AnyHook, event: RawHookEvent): void;
+/**
+ * Assert a COMPILED **react** hook emits a `notice(…)` for an event, optionally
+ * matching its message — the react-tier twin of {@link assertHookDenies}.
+ *
+ * A react hook can't block, so the gate assertions don't apply to it, and there
+ * was no assertion that did. That left `notice()` a live trap: its message goes
+ * to **stderr**, so a probe built on `execFileSync` (which returns stdout only)
+ * sees nothing and reports a perfectly healthy react hook as DEAD — measured
+ * against three real hooks on 2026-08-03. Reading the reaction in-process means
+ * stdout-vs-stderr never enters into it.
+ */
+export declare function assertHookNotices(hook: AnyHook, event: RawHookEvent, matcher?: string | RegExp): void;
+/**
+ * Assert a COMPILED **react** hook stays silent for an event — it returns
+ * `nothing()` (a `"none"` reaction). The twin of {@link assertHookNotices}: together they pin both
+ * halves of a react hook's behaviour — it fires when it should, and (the half
+ * that actually regresses) it does NOT fire when it shouldn't.
+ *
+ * A `run(…)` reaction is not silent for this purpose: the hook still reacted.
+ */
+export declare function assertHookSilent(hook: AnyHook, event: RawHookEvent): void;
 /** Anything carrying recorded egress attempts (a runHook recordEgress result). */
 interface HasEgress {
     readonly egress: readonly EgressAttempt[];

package/dist/harness-assert.js

@@ -10,6 +10,8 @@ exports.assertHookBlocked = assertHookBlocked;
 exports.assertHookAllowed = assertHookAllowed;
 exports.assertHookDenies = assertHookDenies;
 exports.assertHookAllows = assertHookAllows;
+exports.assertHookNotices = assertHookNotices;
+exports.assertHookSilent = assertHookSilent;
 exports.egressHosts = egressHosts;
 exports.assertNoEgress = assertNoEgress;
 exports.assertEgressOnly = assertEgressOnly;
@@ -167,6 +169,49 @@ function assertHookAllows(hook, event) {
         fail(`expected the hook to allow, got ${describeOutcome(o)}`);
     }
 }
+/**
+ * Assert a COMPILED **react** hook emits a `notice(…)` for an event, optionally
+ * matching its message — the react-tier twin of {@link assertHookDenies}.
+ *
+ * A react hook can't block, so the gate assertions don't apply to it, and there
+ * was no assertion that did. That left `notice()` a live trap: its message goes
+ * to **stderr**, so a probe built on `execFileSync` (which returns stdout only)
+ * sees nothing and reports a perfectly healthy react hook as DEAD — measured
+ * against three real hooks on 2026-08-03. Reading the reaction in-process means
+ * stdout-vs-stderr never enters into it.
+ */
+function assertHookNotices(hook, event, matcher) {
+    const o = (0, hook_program_js_1.runHookProgram)(hook, event);
+    if (o.kind !== "reaction" || o.reaction.kind !== "notice") {
+        fail(`expected the hook to notice, got ${describeOutcome(o)}`);
+    }
+    if (matcher === undefined)
+        return;
+    const { message } = o.reaction;
+    const matched = typeof matcher === "string"
+        ? message.includes(matcher)
+        : matcher.test(message);
+    if (!matched) {
+        fail(`expected the notice to match ${String(matcher)}, got ${JSON.stringify(message)}`);
+    }
+}
+/**
+ * Assert a COMPILED **react** hook stays silent for an event — it returns
+ * `nothing()` (a `"none"` reaction). The twin of {@link assertHookNotices}: together they pin both
+ * halves of a react hook's behaviour — it fires when it should, and (the half
+ * that actually regresses) it does NOT fire when it shouldn't.
+ *
+ * A `run(…)` reaction is not silent for this purpose: the hook still reacted.
+ */
+function assertHookSilent(hook, event) {
+    const o = (0, hook_program_js_1.runHookProgram)(hook, event);
+    if (o.kind !== "reaction") {
+        fail(`expected a react hook, got ${describeOutcome(o)}`);
+    }
+    if (o.reaction.kind !== "none") {
+        fail(`expected the hook to stay silent, got ${describeOutcome(o)}`);
+    }
+}
 const hostPort = (e) => `${e.host}:${String(e.port)}`;
 /** The `host:port` strings a run attempted, e.g. `["registry.npmjs.org:443"]`. */
 function egressHosts(r) {

package/dist/hook-install.d.ts

@@ -20,6 +20,22 @@ interface SettingsJson {
     hooks?: Record<string, HookEntry[]>;
     [k: string]: unknown;
 }
+/**
+ * The CANONICAL form of a hook-source reference — how the path is written into
+ * the emitted runtime command AND how an existing entry is recognized as "this
+ * hook", so the merge is keyed by the FILE, not by the string the user typed.
+ *
+ * Without this, `vigiles compile x.hook.ts` and `vigiles compile ./x.hook.ts`
+ * wired the SAME file twice: the second run's `hookPath` (`./x.hook.ts`) wasn't a
+ * substring of the first run's command (`… run-program x.hook.ts`), so nothing
+ * was replaced and a second `{matcher, hooks:[…]}` block was appended. A few
+ * iterations of an edit-compile loop left duplicate wirings that all fire.
+ *
+ * Canonical = POSIX separators, no `./` prefix, resolved against the cwd and made
+ * relative when it lives under it (an absolute path outside the repo is kept
+ * absolute — still stable, just not relative to anything).
+ */
+export declare function normalizeHookRef(hookPath: string, cwd?: string): string;
 /**
  * Idempotently merge a compiled hook's block into an existing `settings.json`
  * object. Entries managed by THIS hook file (the runtime command references

package/dist/hook-install.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PROVIDERS_DIR = exports.HOOKS_DIR = void 0;
 exports.discoverHookFiles = discoverHookFiles;
 exports.discoverProviderFiles = discoverProviderFiles;
+exports.normalizeHookRef = normalizeHookRef;
 exports.mergeHooksJson = mergeHooksJson;
 exports.mergeHooksToml = mergeHooksToml;
 exports.serializeConfig = serializeConfig;
@@ -18,9 +19,11 @@ exports.serializeConfig = serializeConfig;
  * result into the active harness's native config (`.claude/settings.json` JSON
  * / `config.toml` TOML) — so the harness is actually wired, not handed a
  * paste-this block. The merge is idempotent: an entry is keyed by the runtime
- * command's hook PATH, so recompiling updates in place and never duplicates,
- * while a user's own hand-written hooks are preserved untouched. One source dir
- * also means basenames are unique, so the stamp can key on the basename safely.
+ * command's hook path, CANONICALIZED ({@link normalizeHookRef}) so it identifies
+ * the FILE rather than the string the user typed — recompiling updates in place
+ * and never duplicates, while a user's own hand-written hooks are preserved
+ * untouched. One source dir also means basenames are unique, so the stamp can key
+ * on the basename safely.
  */
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
@@ -49,9 +52,40 @@ function discoverHookFiles(cwd) {
 function discoverProviderFiles(cwd) {
     return discoverSources(cwd, exports.PROVIDERS_DIR);
 }
-/** True when an entry's command routes through the runtime for `hookPath`. */
+/**
+ * The CANONICAL form of a hook-source reference — how the path is written into
+ * the emitted runtime command AND how an existing entry is recognized as "this
+ * hook", so the merge is keyed by the FILE, not by the string the user typed.
+ *
+ * Without this, `vigiles compile x.hook.ts` and `vigiles compile ./x.hook.ts`
+ * wired the SAME file twice: the second run's `hookPath` (`./x.hook.ts`) wasn't a
+ * substring of the first run's command (`… run-program x.hook.ts`), so nothing
+ * was replaced and a second `{matcher, hooks:[…]}` block was appended. A few
+ * iterations of an edit-compile loop left duplicate wirings that all fire.
+ *
+ * Canonical = POSIX separators, no `./` prefix, resolved against the cwd and made
+ * relative when it lives under it (an absolute path outside the repo is kept
+ * absolute — still stable, just not relative to anything).
+ */
+function normalizeHookRef(hookPath, cwd = process.cwd()) {
+    const abs = (0, node_path_1.resolve)(cwd, hookPath);
+    const rel = (0, node_path_1.relative)(cwd, abs);
+    const chosen = rel === "" || rel.startsWith("..") ? abs : rel;
+    return chosen.split(node_path_1.sep).join("/");
+}
+/**
+ * True when an entry's command routes through the runtime for `hookPath`.
+ *
+ * Compares CANONICALIZED path tokens rather than testing for a raw substring:
+ * `./x.hook.ts` and `x.hook.ts` are the same file (so the entry is replaced,
+ * which also de-duplicates settings written by an older version), while
+ * `x.hook.ts` and `my-x.hook.ts` are not (a substring test said they were).
+ */
 function managesHook(entry, hookPath) {
-    return entry.hooks.some((h) => h.command.includes(hookPath));
+    const ref = normalizeHookRef(hookPath);
+    return entry.hooks.some((h) => h.command
+        .split(/\s+/)
+        .some((token) => token !== "" && normalizeHookRef(token) === ref));
 }
 /**
  * Idempotently merge a compiled hook's block into an existing `settings.json`
@@ -77,7 +111,8 @@ function toTomlEntries(entries) {
 function mergeHooksToml(existing, compiled, hookPath) {
     const hooks = { ...(existing.hooks ?? {}) };
     for (const [event, entries] of Object.entries(compiled)) {
-        const kept = (hooks[event] ?? []).filter((e) => !e.command.includes(hookPath));
+        // Same canonical-path keying as the JSON merge (one flat command per entry).
+        const kept = (hooks[event] ?? []).filter((e) => !managesHook({ hooks: [{ type: "command", command: e.command }] }, hookPath));
         hooks[event] = [...kept, ...toTomlEntries(entries)];
     }
     return { ...existing, hooks };

package/dist/hook.d.ts

@@ -50,5 +50,5 @@ export type { Decision, HookMode, GateAction, CommandView, PathView, ResponseVie
 export { provide, dangerously, defineProvider, provider, } from "./core/hook-providers.js";
 export type { ProviderName, ProviderResults, HookCtx, NeedSpec, InlineProvider, RegisteredProvider, RegisteredRef, ProviderRegistry, } from "./core/hook-providers.js";
 export { leafCommandsNormalized } from "./core/bash-effects.js";
-export type { NormalizedLeaf } from "./core/bash-effects.js";
+export type { NormalizedLeaf, LeafRedirect } from "./core/bash-effects.js";
 //# sourceMappingURL=hook.d.ts.map

package/dist/load-hook.d.ts

@@ -0,0 +1,24 @@
+import { type AnyHook } from "./core/hook-program.js";
+/**
+ * Load a compiled-hook program's default export from `file`.
+ *
+ * JS module formats (`.mjs`/`.cjs`/`.js`) load via dynamic import directly; a
+ * TypeScript hook (`.ts`/`.mts`/`.cts`) loads only under a TS-capable runtime
+ * (tsx, or Node >= 23.6 with type stripping) — otherwise the error says so and
+ * points at authoring the hook as `.mjs`.
+ *
+ * ```js
+ * import { loadHook, assertHookDenies } from "vigiles/testing";
+ *
+ * const guard = await loadHook(".vigiles/hooks/guard.mjs");
+ * assertHookDenies(guard, {
+ *   tool_name: "Bash",
+ *   tool_input: { command: "git push --force" },
+ * });
+ * ```
+ *
+ * @throws {HookCompileError} when the file can't be imported, or has no
+ * default-exported hook program.
+ */
+export declare function loadHook(file: string): Promise<AnyHook>;
+//# sourceMappingURL=load-hook.d.ts.map

package/dist/load-hook.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadHook = loadHook;
+/**
+ * `loadHook` — load a compiled-hook program from a FILE.
+ *
+ * The in-process assertions (`assertHookDenies` / `assertHookAllows` /
+ * `assertHookNotices` / `assertHookSilent`) take the hook OBJECT, but a
+ * `.harness.mjs` test only has the hook's PATH — and the loader that turns one
+ * into the other lived privately inside `cli.ts`. So the intended in-process test
+ * path was unreachable from the file format `vigiles test` actually runs, and
+ * authors fell back to spawning the runtime as a subprocess: exactly the plumbing
+ * compiled hooks exist to remove. Measured 2026-08-03.
+ *
+ * This is now the ONE loader — the CLI runtime calls it too, so a hook that loads
+ * in a test loads identically in production (one loader, no drift).
+ */
+const node_path_1 = require("node:path");
+const node_url_1 = require("node:url");
+const hook_program_js_1 = require("./core/hook-program.js");
+/**
+ * Load a compiled-hook program's default export from `file`.
+ *
+ * JS module formats (`.mjs`/`.cjs`/`.js`) load via dynamic import directly; a
+ * TypeScript hook (`.ts`/`.mts`/`.cts`) loads only under a TS-capable runtime
+ * (tsx, or Node >= 23.6 with type stripping) — otherwise the error says so and
+ * points at authoring the hook as `.mjs`.
+ *
+ * ```js
+ * import { loadHook, assertHookDenies } from "vigiles/testing";
+ *
+ * const guard = await loadHook(".vigiles/hooks/guard.mjs");
+ * assertHookDenies(guard, {
+ *   tool_name: "Bash",
+ *   tool_input: { command: "git push --force" },
+ * });
+ * ```
+ *
+ * @throws {HookCompileError} when the file can't be imported, or has no
+ * default-exported hook program.
+ */
+async function loadHook(file) {
+    const abs = (0, node_path_1.resolve)(process.cwd(), file);
+    let mod;
+    try {
+        mod = (await import((0, node_url_1.pathToFileURL)(abs).href));
+    }
+    catch (e) {
+        if (/\.(?:m|c)?ts$/.test(file)) {
+            throw new hook_program_js_1.HookCompileError(`Cannot load TypeScript hook "${file}" in this Node runtime. Run under ` +
+                `tsx (npx tsx …) / Node >= 23.6, or author the hook as a .mjs file.`);
+        }
+        throw new hook_program_js_1.HookCompileError(`Cannot load hook "${file}": ${e.message}`);
+    }
+    // Unwrap the ESM/CJS double-default that `export default` can produce.
+    const program = mod.default?.default ?? mod.default;
+    if (!program || typeof program !== "object") {
+        throw new hook_program_js_1.HookCompileError(`${file} has no default-exported hook program ` +
+            `(use \`export default defineHook({…})\`).`);
+    }
+    return program;
+}
+//# sourceMappingURL=load-hook.js.map

package/dist/scan.js

@@ -457,8 +457,12 @@ function formatScanReport(r) {
         r.pluginLayoutIssues.length +
         r.hookBlockFindings.length +
         r.hookMatcherFindings.length +
-        // HARD trifectas render ✗ and are graded into the score, so they count; the
-        // ADVISORY (inherits-all) ones and the delegation-trifecta ⚠ risk do NOT.
+        // Only HARD trifectas (✗) count as STRUCTURAL defects here. Both severities are
+        // now GRADED (see trifectaExposure — an inherits-all unit holds the three legs
+        // implicitly and everything else besides), but this line tallies structural
+        // defects, not the safety axis; promoting every idiomatic inherits-all unit to
+        // "broken" in the CLI summary is a separate, louder call. The delegation-trifecta
+        // ⚠ risk is ungraded and does NOT count either.
         r.trifectaFindings.filter((t) => t.finding.severity === "hard").length;
     out.push(broken === 0
         ? "✓ no structural issues found"

package/dist/score-core.d.ts

@@ -36,6 +36,15 @@ export declare const W_DANGLING_REF = 8;
 export declare const W_OVERLAP = 8;
 export declare const W_NO_CONTRACT = 5;
 export declare const W_TRIFECTA = 10;
+/**
+ * CAP on the TOTAL lethal-trifecta penalty, charged against the SHARE of the
+ * model-invocable surface that holds the trifecta (see {@link trifectaExposure}).
+ * A pure per-unit count saturates the clamp on any sizeable harness — which is
+ * how the old model reported a HARDENED harness as strictly worse than its
+ * unhardened self. Same value as the `feature-dev` anchor (3-of-3 units → −30),
+ * so a fully-exposed harness still lands on a C-band ding, never an automatic F.
+ */
+export declare const W_TRIFECTA_MAX = 30;
 /**
  * The one canonical, jargon-free finding string for a HARD lethal-trifecta unit —
  * shared by the Safety category card (audit-score) AND the verdict sentence / overall
@@ -53,7 +62,51 @@ export interface Deduction {
     readonly n: number;
     readonly weight: number;
     readonly label: string;
+    /**
+     * TOTAL penalty for this deduction, overriding the default `n × weight`. Only
+     * used where the cost is not linear in the count — today that's the trifecta
+     * exposure penalty, which is capped against the share of the surface affected
+     * (see {@link trifectaExposure}). `n` still drives the human-readable label.
+     */
+    readonly points?: number;
+}
+/** The graded lethal-trifecta exposure of a report. */
+export interface TrifectaExposure {
+    /** Units holding all three legs — EXPLICIT (`hard`) and INHERITED alike. */
+    readonly exposed: number;
+    /** Model-invocable units that could hold them (subagents + non-user-invoked skills). */
+    readonly assessable: number;
+    /** The graded penalty, `min(W_TRIFECTA × exposed, W_TRIFECTA_MAX × exposed/assessable)`. */
+    readonly penalty: number;
 }
+/**
+ * The lethal-trifecta exposure a report incurs — the ONE number the Safety ring
+ * and the overall grade both read.
+ *
+ * TWO properties this model must have, both learned the hard way from dogfooding
+ * (2026-08-03, a 35-skill repo):
+ *
+ * 1. **MONOTONE in risk.** A unit that INHERITS all tools holds the full trifecta
+ *    *implicitly* and is strictly WORSE than one whose explicit `allowed-tools`
+ *    happens to name all three legs — it holds every other capability too. The old
+ *    model graded the explicit case at −10 and left the inherited case UNGRADED, so
+ *    declaring a tool contract (a genuine risk reduction) could only ever LOWER the
+ *    score: a repo measured 70 with 31 of 35 units inheriting everything, then 0
+ *    after `allowed-tools` was added to all 35 and the units holding the full
+ *    trifecta fell 35/35 → 17/35. The tool called the safer configuration strictly
+ *    worse and said nothing about the unsafe one. So BOTH severities count here.
+ *
+ * 2. **Non-saturating.** With a flat per-unit weight, 35 exposed units and 17
+ *    exposed units both blow past the clamp and score 0 — halving your exposure
+ *    shows up as no change at all. So the total is ALSO capped against the SHARE
+ *    of the model-invocable surface that is exposed: a 35-unit harness with 3
+ *    exposed units is genuinely safer than a 3-unit harness where all 3 are.
+ *
+ * The `min` of the two keeps every existing calibration anchor for small harnesses
+ * (1 exposed unit of 1 → −10; the `feature-dev` 3-of-3 shape → −30 → C) while
+ * giving a large harness real resolution (34/35 → −29, 17/35 → −15).
+ */
+export declare function trifectaExposure(r: ScanReport): TrifectaExposure;
 /**
  * The COMPLETE graded-penalty list a report incurs — the single source of truth
  * BOTH the leaderboard's single health number and the audit's category rings

package/dist/score-core.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TRIFECTA_LABEL = exports.W_TRIFECTA = exports.W_NO_CONTRACT = exports.W_OVERLAP = exports.W_DANGLING_REF = exports.W_NO_DESCRIPTION = exports.W_MISSING_HOOK = void 0;
+exports.TRIFECTA_LABEL = exports.W_TRIFECTA_MAX = exports.W_TRIFECTA = exports.W_NO_CONTRACT = exports.W_OVERLAP = exports.W_DANGLING_REF = exports.W_NO_DESCRIPTION = exports.W_MISSING_HOOK = void 0;
 exports.gradeFor = gradeFor;
+exports.trifectaExposure = trifectaExposure;
 exports.reportDeductions = reportDeductions;
 exports.isEmptyMachine = isEmptyMachine;
 exports.computeIntegrityScore = computeIntegrityScore;
@@ -14,7 +15,16 @@ exports.W_NO_DESCRIPTION = 10; // a skill with no usable description → can't t
 exports.W_DANGLING_REF = 8; // a referenced intra-plugin file that's missing → broken path
 exports.W_OVERLAP = 8; // a description collision → the wrong skill fires
 exports.W_NO_CONTRACT = 5; // generic small-footgun weight (disallowedTools typo, invalid model/color)
-exports.W_TRIFECTA = 10; // a HARD lethal-trifecta contract (all three legs, explicit) → a prompt-injection exfil path. HALF the old 20: a DING, not a fail — a trifecta is a real risk worth surfacing in the grade, but official plugins ship the pattern by design, so it dents the score (e.g. feature-dev's 3 hard units → −30 → C) without a catastrophic F.
+exports.W_TRIFECTA = 10; // per-unit cost of a lethal-trifecta unit (all three legs, explicit OR inherited) → a prompt-injection exfil path. HALF the old 20: a DING, not a fail — a trifecta is a real risk worth surfacing in the grade, but official plugins ship the pattern by design, so it dents the score (e.g. feature-dev's 3-of-3 hard units → −30 → C) without a catastrophic F.
+/**
+ * CAP on the TOTAL lethal-trifecta penalty, charged against the SHARE of the
+ * model-invocable surface that holds the trifecta (see {@link trifectaExposure}).
+ * A pure per-unit count saturates the clamp on any sizeable harness — which is
+ * how the old model reported a HARDENED harness as strictly worse than its
+ * unhardened self. Same value as the `feature-dev` anchor (3-of-3 units → −30),
+ * so a fully-exposed harness still lands on a C-band ding, never an automatic F.
+ */
+exports.W_TRIFECTA_MAX = 30;
 /**
  * The one canonical, jargon-free finding string for a HARD lethal-trifecta unit —
  * shared by the Safety category card (audit-score) AND the verdict sentence / overall
@@ -28,8 +38,8 @@ exports.TRIFECTA_LABEL = 'unit(s) can read data, reach the web, and run commands
 // Two things are advisory, NOT graded penalties (shown, never scored — see scoreReport):
 //   - untested surfaces — a hardening gap, not breakage.
 //   - an agent that inherits all tools (no `tools:` line) — see reportDeductions for why.
-//   - an inherits-all (severity "advisory") trifecta finding — shown by the Safety
-//     ring but never scored; only the HARD, explicit all-three-legs finding grades.
+// NB: an inherits-all TRIFECTA finding (severity "advisory") IS graded — see
+// trifectaExposure. Only the tool-CONTRACT nudge above stays ungraded.
 /** Map a 0–100 structural-health score to its letter grade (A ≥90 … F <60). */
 function gradeFor(score) {
     if (score >= 90)
@@ -42,6 +52,49 @@ function gradeFor(score) {
         return "D";
     return "F";
 }
+/**
+ * The lethal-trifecta exposure a report incurs — the ONE number the Safety ring
+ * and the overall grade both read.
+ *
+ * TWO properties this model must have, both learned the hard way from dogfooding
+ * (2026-08-03, a 35-skill repo):
+ *
+ * 1. **MONOTONE in risk.** A unit that INHERITS all tools holds the full trifecta
+ *    *implicitly* and is strictly WORSE than one whose explicit `allowed-tools`
+ *    happens to name all three legs — it holds every other capability too. The old
+ *    model graded the explicit case at −10 and left the inherited case UNGRADED, so
+ *    declaring a tool contract (a genuine risk reduction) could only ever LOWER the
+ *    score: a repo measured 70 with 31 of 35 units inheriting everything, then 0
+ *    after `allowed-tools` was added to all 35 and the units holding the full
+ *    trifecta fell 35/35 → 17/35. The tool called the safer configuration strictly
+ *    worse and said nothing about the unsafe one. So BOTH severities count here.
+ *
+ * 2. **Non-saturating.** With a flat per-unit weight, 35 exposed units and 17
+ *    exposed units both blow past the clamp and score 0 — halving your exposure
+ *    shows up as no change at all. So the total is ALSO capped against the SHARE
+ *    of the model-invocable surface that is exposed: a 35-unit harness with 3
+ *    exposed units is genuinely safer than a 3-unit harness where all 3 are.
+ *
+ * The `min` of the two keeps every existing calibration anchor for small harnesses
+ * (1 exposed unit of 1 → −10; the `feature-dev` 3-of-3 shape → −30 → C) while
+ * giving a large harness real resolution (34/35 → −29, 17/35 → −15).
+ */
+function trifectaExposure(r) {
+    const exposed = r.trifectaFindings.length;
+    // The assessable surface mirrors the Safety ring's own n/a rule: subagents plus
+    // model-invocable skills (a user-invoked skill can't be hijacked by attacker
+    // content, so it is neither exposed nor assessable). Never below the exposed
+    // count — a finding always comes FROM a unit, so a report that carries findings
+    // without the units (a hand-built fixture) still charges for them.
+    const assessable = Math.max(r.agents.length + r.skills.filter((s) => !s.userInvoked).length, exposed);
+    if (exposed === 0 || assessable === 0) {
+        return { exposed, assessable, penalty: 0 };
+    }
+    const perUnit = exports.W_TRIFECTA * exposed;
+    // Never round a real finding away to a free 0 on a very large harness.
+    const share = Math.max(1, Math.round((exports.W_TRIFECTA_MAX * exposed) / assessable));
+    return { exposed, assessable, penalty: Math.min(perUnit, share) };
+}
 /**
  * The COMPLETE graded-penalty list a report incurs — the single source of truth
  * BOTH the leaderboard's single health number and the audit's category rings
@@ -55,17 +108,17 @@ function reportDeductions(r) {
     const deadTools = r.agents.reduce((n, a) => n + a.toolIssues.length, 0);
     const deadMcpTools = r.agents.reduce((n, a) => n + a.mcpToolIssues.length, 0);
     const deadDisallowed = r.agents.reduce((n, a) => n + a.disallowedToolIssues.length, 0);
-    // HARD lethal-trifecta findings only — an EXPLICIT contract naming all three
-    // legs (a prompt-injection exfil path). Graded at W_TRIFECTA=10 (HALF the old
-    // 20): a DING that surfaces a real risk in the grade without a catastrophic F
-    // for an accepted design pattern official plugins ship. Advisory (inherits-all)
-    // trifecta findings are surfaced but NEVER graded (aligned with the inherits-all
-    // stance), so they're excluded here.
-    const hardTrifecta = r.trifectaFindings.filter((f) => f.finding.severity === "hard").length;
+    // Lethal-trifecta EXPOSURE — every unit holding all three legs, whether it
+    // declared them (`hard`) or inherited them (an inherits-all contract holds them
+    // implicitly AND everything else, so it can't be the cheaper of the two). Capped
+    // against the share of the surface affected so the model stays monotone in risk
+    // and doesn't saturate — see trifectaExposure for the measured failure this fixes.
+    const trifecta = trifectaExposure(r);
     return [
         {
-            n: hardTrifecta,
+            n: trifecta.exposed,
             weight: exports.W_TRIFECTA,
+            points: trifecta.penalty,
             label: exports.TRIFECTA_LABEL,
         },
         {
@@ -189,7 +242,7 @@ function computeIntegrityScore(deductions) {
     for (const d of deductions) {
         if (d.n <= 0)
             continue;
-        penalty += d.n * d.weight;
+        penalty += d.points ?? d.n * d.weight;
     }
     return { score: Math.max(0, 100 - penalty), penalty };
 }

package/dist/testing.d.ts

@@ -15,6 +15,7 @@ export type { HookRunResult, RunHookOptions, HookInput, HookOutput, HookProperty
 export { runEval, measure, measureArms, measureTriggerRate, assertRates, assertPromptDiversity, checkPromptDiversity, checkReportToJUnit, formatCheckReport, formatEvalReport, formatTriggerRateReport, claudeEvalDriver, parseClaudeRun, stubSkillBody, } from "./eval.js";
 export type { EvalArm, EvalDriver, EvalSpec, EvalReport, EvalUsage, MeasureSpec, ArmsMeasureSpec, ArmReport, ArmUsage, ArmsCheckReport, CheckRate, CheckReport, MetricStat, Metrics, ModelOutputParser, ParsedModelRun, PromptDiversityIssue, PromptTriggerStat, RunContext, RunOut, SelectionTrialResult, TriggerRateReport, TriggerRateSpec, AgentRunArgs, AgentRunner, } from "./eval.js";
 export * from "./harness-assert.js";
+export { loadHook } from "./load-hook.js";
 export * from "./check.js";
 export { hookFired } from "./check.js";
 export { judge } from "./judge.js";

package/dist/testing.js

@@ -30,7 +30,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.runHarness = exports.runHarnessTest = exports.judge = exports.hookFired = exports.stubSkillBody = exports.parseClaudeRun = exports.claudeEvalDriver = exports.formatTriggerRateReport = exports.formatEvalReport = exports.formatCheckReport = exports.checkReportToJUnit = exports.checkPromptDiversity = exports.assertPromptDiversity = exports.assertRates = exports.measureTriggerRate = exports.measureArms = exports.measure = exports.runEval = exports.propertyHook = exports.runHook = void 0;
+exports.runHarness = exports.runHarnessTest = exports.judge = exports.hookFired = exports.loadHook = exports.stubSkillBody = exports.parseClaudeRun = exports.claudeEvalDriver = exports.formatTriggerRateReport = exports.formatEvalReport = exports.formatCheckReport = exports.checkReportToJUnit = exports.checkPromptDiversity = exports.assertPromptDiversity = exports.assertRates = exports.measureTriggerRate = exports.measureArms = exports.measure = exports.runEval = exports.propertyHook = exports.runHook = void 0;
 // --- unit tier: runHook ---
 var run_hook_js_1 = require("./run-hook.js");
 Object.defineProperty(exports, "runHook", { enumerable: true, get: function () { return run_hook_js_1.runHook; } });
@@ -52,6 +52,14 @@ Object.defineProperty(exports, "claudeEvalDriver", { enumerable: true, get: func
 Object.defineProperty(exports, "parseClaudeRun", { enumerable: true, get: function () { return eval_js_1.parseClaudeRun; } });
 Object.defineProperty(exports, "stubSkillBody", { enumerable: true, get: function () { return eval_js_1.stubSkillBody; } });
 __exportStar(require("./harness-assert.js"), exports);
+// The compiled-hook LOADER. The in-process assertions above take the hook
+// OBJECT, but a `.harness.mjs` test only has its PATH — without this the
+// intended in-process test path is unreachable from the file format
+// `vigiles test` actually runs, and authors fall back to spawning the runtime as
+// a subprocess (the very plumbing compiled hooks exist to remove). Same loader
+// the CLI runtime uses, so a hook that loads in a test loads identically in prod.
+var load_hook_js_1 = require("./load-hook.js");
+Object.defineProperty(exports, "loadHook", { enumerable: true, get: function () { return load_hook_js_1.loadHook; } });
 // The declarative check vocabulary is now first-class at the front door. Its
 // `hookFired` (a `Check<Trace>`) supersedes the legacy boolean predicate of the
 // same name — the explicit re-export below wins over the two `export *`s.

package/dist/unit.d.ts

@@ -12,6 +12,7 @@
  * `vigiles/e2e`.
  */
 export * from "./harness-assert.js";
+export { loadHook } from "./load-hook.js";
 export { runHook, parseHookOutput, decideHook, propertyHook, } from "./run-hook.js";
 export type { HookInput, HookOutput, HookRunResult, RunHookOptions, HookPropertyResult, } from "./run-hook.js";
 export * from "./check.js";

package/dist/unit.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.formatGuardrailReport = exports.assertBlocksDisasters = exports.unblockedDisasters = exports.verifyGuardrail = exports.DISASTER_CATALOG = exports.hookFired = exports.propertyHook = exports.decideHook = exports.parseHookOutput = exports.runHook = void 0;
+exports.formatGuardrailReport = exports.assertBlocksDisasters = exports.unblockedDisasters = exports.verifyGuardrail = exports.DISASTER_CATALOG = exports.hookFired = exports.propertyHook = exports.decideHook = exports.parseHookOutput = exports.runHook = exports.loadHook = void 0;
 /**
  * `vigiles/unit` — the **no-capability** harness-testing surface.
  *
@@ -29,6 +29,11 @@ exports.formatGuardrailReport = exports.assertBlocksDisasters = exports.unblocke
  * `vigiles/e2e`.
  */
 __exportStar(require("./harness-assert.js"), exports);
+// The compiled-hook loader belongs to the no-capability tier: it imports a local
+// module and nothing else. Without it the in-process assertions above are
+// unreachable from a test that only knows the hook's PATH.
+var load_hook_js_1 = require("./load-hook.js");
+Object.defineProperty(exports, "loadHook", { enumerable: true, get: function () { return load_hook_js_1.loadHook; } });
 var run_hook_js_1 = require("./run-hook.js");
 Object.defineProperty(exports, "runHook", { enumerable: true, get: function () { return run_hook_js_1.runHook; } });
 Object.defineProperty(exports, "parseHookOutput", { enumerable: true, get: function () { return run_hook_js_1.parseHookOutput; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigiles",
-  "version": "14.12.1",
+  "version": "14.13.0",
   "description": "Lint & test the harness your AI agent runs on — verify the references in your CLAUDE.md / AGENTS.md and test that your hooks and skills actually work.",
   "keywords": [
     "claude-code",