vigiles 14.13.2 → 14.13.3

package/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
       "name": "vigiles",
       "source": "./",
       "description": "Verify CLAUDE.md/AGENTS.md references, compile typed specs, and test the agent harness",
-      "version": "3.0.0"
+      "version": "4.0.1"
     }
   ]
 }

package/README.md

@@ -256,7 +256,7 @@ Targets Claude Code and Codex out of the box, or [your own harness](docs/authori
 - **Reference** — [CLI](docs/cli.md) · [rules matrix](docs/verifying-instruction-files.md#the-validation-rules--the-full-matrix) · [testing API](docs/testing-api.md) · [full API](https://zernie.github.io/vigiles/api/)
 - **Explanation** — [what it catches](docs/what-vigiles-catches.md) · [how it compares](docs/comparison.md) · [FAQ](docs/faq.md)
 
-**Project** — [Stability](STABILITY.md) · [Related tools](docs/comparison.md#what-vigiles-composes-with)
+**Project** — [Stability](STABILITY.md) · [Related tools](docs/comparison.md#what-vigiles-composes-with) · ships as an [Agent Plugins](https://agent-plugins.org) 1.0.0 plugin ([how to do the same](docs/for-plugin-authors.md#6-ship-it-in-the-portable-agent-plugins-format))
 
 <!-- The "companion to [Feedback Loop Is All You Need](https://zernie.com/blog/feedback-loop-is-all-you-need)"
      link is temporarily removed while AgenticDev paper #1 is under blind review: repo → blog is a

package/dist/core/agent-plugins.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Agent Plugins — the vendor-neutral packaging standard (agent-plugins.org),
+ * v1.0.0. A plugin declares itself with a root `plugin.json` and puts its
+ * components at fixed paths: skills at `skills/<name>/SKILL.md`, MCP servers in
+ * a root `mcp.json`.
+ *
+ * WHY THIS IS NOT AN ADAPTER. The standard is a PACKAGING format, not a harness:
+ * it has no tool catalog, no hook events, no runtime — a plugin shipped this way
+ * still runs inside Claude Code or Codex. So it COMPLEMENTS a harness rather than
+ * replacing one, and a repo commonly carries both manifests side by side (vigiles
+ * itself does). Modelling it as a `HarnessAdapter` would mean inventing a fake
+ * `HarnessDialect` — exactly the half-wired port the conformance kit refuses.
+ *
+ * WHAT THIS MODULE IS FOR. The skills half already works for free: the standard's
+ * `skills/<name>/SKILL.md` is the layout every adapter already reads. The gap is
+ * MCP — the standard puts servers in a root `mcp.json`, which no harness layout
+ * names, so `mcp-config` / `mcp-tool-resolves` / `mcp-hook-target-resolves`
+ * would silently check nothing on a plugin laid out this way. This module tells
+ * the scanner when that file is in play.
+ *
+ * DETECTION IS BY `$schema`, NOT BY FILENAME. `plugin.json` and `mcp.json` are
+ * generic names other tools use too. A plugin is treated as conformant only when
+ * its root manifest pins an `agent-plugins.org` schema — then a sibling
+ * `mcp.json` is unambiguously the standard's, and is read even if it omits its
+ * own `$schema`. Pure (no `node:fs`): the caller injects the read, so the
+ * browser engine can back it with a file map.
+ */
+/** The standard's root manifest filename. */
+export declare const AGENT_PLUGINS_MANIFEST = "plugin.json";
+/** The standard's root MCP-server config filename. */
+export declare const AGENT_PLUGINS_MCP_CONFIG = "mcp.json";
+/**
+ * Does this manifest text declare an Agent Plugins plugin? True only when it
+ * parses and its `$schema` points at the standard — a `plugin.json` belonging to
+ * something else is not claimed.
+ */
+export declare function isAgentPluginsManifest(text: string): boolean;
+/**
+ * The extra MCP config files to read for this root — `[mcp.json]` when the root
+ * manifest declares an Agent Plugins plugin, `[]` otherwise. `readText` returns
+ * the file's contents, or `undefined` when it does not exist.
+ */
+export declare function agentPluginsMcpSources(readText: (file: string) => string | undefined): readonly string[];
+//# sourceMappingURL=agent-plugins.d.ts.map

package/dist/core/agent-plugins.js

@@ -0,0 +1,68 @@
+"use strict";
+/**
+ * Agent Plugins — the vendor-neutral packaging standard (agent-plugins.org),
+ * v1.0.0. A plugin declares itself with a root `plugin.json` and puts its
+ * components at fixed paths: skills at `skills/<name>/SKILL.md`, MCP servers in
+ * a root `mcp.json`.
+ *
+ * WHY THIS IS NOT AN ADAPTER. The standard is a PACKAGING format, not a harness:
+ * it has no tool catalog, no hook events, no runtime — a plugin shipped this way
+ * still runs inside Claude Code or Codex. So it COMPLEMENTS a harness rather than
+ * replacing one, and a repo commonly carries both manifests side by side (vigiles
+ * itself does). Modelling it as a `HarnessAdapter` would mean inventing a fake
+ * `HarnessDialect` — exactly the half-wired port the conformance kit refuses.
+ *
+ * WHAT THIS MODULE IS FOR. The skills half already works for free: the standard's
+ * `skills/<name>/SKILL.md` is the layout every adapter already reads. The gap is
+ * MCP — the standard puts servers in a root `mcp.json`, which no harness layout
+ * names, so `mcp-config` / `mcp-tool-resolves` / `mcp-hook-target-resolves`
+ * would silently check nothing on a plugin laid out this way. This module tells
+ * the scanner when that file is in play.
+ *
+ * DETECTION IS BY `$schema`, NOT BY FILENAME. `plugin.json` and `mcp.json` are
+ * generic names other tools use too. A plugin is treated as conformant only when
+ * its root manifest pins an `agent-plugins.org` schema — then a sibling
+ * `mcp.json` is unambiguously the standard's, and is read even if it omits its
+ * own `$schema`. Pure (no `node:fs`): the caller injects the read, so the
+ * browser engine can back it with a file map.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_PLUGINS_MCP_CONFIG = exports.AGENT_PLUGINS_MANIFEST = void 0;
+exports.isAgentPluginsManifest = isAgentPluginsManifest;
+exports.agentPluginsMcpSources = agentPluginsMcpSources;
+/** The standard's root manifest filename. */
+exports.AGENT_PLUGINS_MANIFEST = "plugin.json";
+/** The standard's root MCP-server config filename. */
+exports.AGENT_PLUGINS_MCP_CONFIG = "mcp.json";
+/** Canonical schema host — a manifest pinning one of these targets the standard. */
+const SCHEMA_PREFIX = "https://agent-plugins.org/schemas/";
+/**
+ * Does this manifest text declare an Agent Plugins plugin? True only when it
+ * parses and its `$schema` points at the standard — a `plugin.json` belonging to
+ * something else is not claimed.
+ */
+function isAgentPluginsManifest(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return false;
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return false;
+    const schema = parsed.$schema;
+    return typeof schema === "string" && schema.startsWith(SCHEMA_PREFIX);
+}
+/**
+ * The extra MCP config files to read for this root — `[mcp.json]` when the root
+ * manifest declares an Agent Plugins plugin, `[]` otherwise. `readText` returns
+ * the file's contents, or `undefined` when it does not exist.
+ */
+function agentPluginsMcpSources(readText) {
+    const manifest = readText(exports.AGENT_PLUGINS_MANIFEST);
+    if (manifest === undefined || !isAgentPluginsManifest(manifest))
+        return [];
+    return [exports.AGENT_PLUGINS_MCP_CONFIG];
+}
+//# sourceMappingURL=agent-plugins.js.map

package/dist/scan-files.js

@@ -45,6 +45,7 @@ const dialect_js_1 = require("./adapters/claude-code/dialect.js");
 const hook_normalize_js_1 = require("./core/hook-normalize.js");
 const hook_events_js_1 = require("./core/hook-events.js");
 const mcp_config_js_1 = require("./core/mcp-config.js");
+const agent_plugins_js_1 = require("./core/agent-plugins.js");
 const mcp_hook_js_1 = require("./core/mcp-hook.js");
 const plugin_dir_layout_js_1 = require("./core/plugin-dir-layout.js");
 const hook_block_ineffective_js_1 = require("./core/hook-block-ineffective.js");
@@ -424,8 +425,9 @@ function loadPluginFromFiles(files, layout, repoName) {
 // ---------------------------------------------------------------------------
 function collectMcpServers(files, layout) {
     const servers = {};
+    const read = (file) => files[file];
     const collect = (file) => {
-        const text = files[file];
+        const text = read(file);
         if (text === undefined)
             return;
         try {
@@ -438,8 +440,16 @@ function collectMcpServers(files, layout) {
             /* malformed JSON is the loader's concern, not this check's */
         }
     };
-    collect(".mcp.json");
-    collect(layout.manifestPath);
+    // Mirrors the fs-backed collector in scan.ts: the layout's own locations plus
+    // the Agent Plugins standard's root `mcp.json` when this repo ships that
+    // manifest (no harness layout names it, so the MCP checks would miss it).
+    for (const file of [
+        layout.mcpConfigFile,
+        layout.manifestPath,
+        ...(0, agent_plugins_js_1.agentPluginsMcpSources)(read),
+    ]) {
+        collect(file);
+    }
     return servers;
 }
 // ---------------------------------------------------------------------------
@@ -502,7 +512,11 @@ function scanFiles(files, layout = layout_js_1.claudeCodeLayout, dialect = diale
         inlineHooks: inline,
         manualHookCount: manual,
         commands: Object.keys(loaded.files).filter(cls.isCommand).length,
-        mcp: loaded.warnings.some((w) => w.includes("MCP server")),
+        // A declared server set counts even when the loader emitted no warning —
+        // otherwise a plugin whose servers come from the Agent Plugins `mcp.json`
+        // reports "MCP servers: no" while the report lists an MCP finding.
+        mcp: loaded.warnings.some((w) => w.includes("MCP server")) ||
+            declaredServers.length > 0,
         danglingRefs: danglingRefs(files, lay, repoName ?? (0, posix_path_js_1.basename)(exports.BROWSER_ROOT)),
         hookEventIssues,
         frontmatterIssues: remap((0, scan_core_js_1.frontmatterIssuesFor)(loaded.files, cls)),

package/dist/scan.js

@@ -41,6 +41,7 @@ const dialect_js_1 = require("./adapters/claude-code/dialect.js");
 const plugin_loader_js_2 = require("./plugin-loader.js");
 const hook_events_js_1 = require("./core/hook-events.js");
 const mcp_config_js_1 = require("./core/mcp-config.js");
+const agent_plugins_js_1 = require("./core/agent-plugins.js");
 const hook_normalize_js_1 = require("./core/hook-normalize.js");
 const mcp_js_1 = require("./core/mcp.js");
 const mcp_contract_message_js_1 = require("./core/mcp-contract-message.js");
@@ -67,12 +68,16 @@ __exportStar(require("./scan-core.js"), exports);
  */
 function collectMcpServers(root, layout) {
     const servers = {};
-    const collect = (file) => {
+    const read = (file) => {
         const p = (0, node_path_1.join)(root, file);
-        if (!(0, node_fs_1.existsSync)(p))
+        return (0, node_fs_1.existsSync)(p) ? (0, node_fs_1.readFileSync)(p, "utf-8") : undefined;
+    };
+    const collect = (file) => {
+        const text = read(file);
+        if (text === undefined)
             return;
         try {
-            const parsed = JSON.parse((0, node_fs_1.readFileSync)(p, "utf-8"));
+            const parsed = JSON.parse(text);
             if (parsed.mcpServers !== null && typeof parsed.mcpServers === "object") {
                 Object.assign(servers, parsed.mcpServers);
             }
@@ -81,8 +86,18 @@ function collectMcpServers(root, layout) {
             /* malformed JSON is the loader's concern, not this check's */
         }
     };
-    collect(".mcp.json");
-    collect(layout.manifestPath);
+    // The harness's own locations (from the layout — never a hard-coded literal),
+    // plus the Agent Plugins standard's root `mcp.json` when the repo ships that
+    // manifest. A plugin in the vendor-neutral format declares its servers there,
+    // which no harness layout names — without this the MCP checks would silently
+    // pass over it.
+    for (const file of [
+        layout.mcpConfigFile,
+        layout.manifestPath,
+        ...(0, agent_plugins_js_1.agentPluginsMcpSources)(read),
+    ]) {
+        collect(file);
+    }
     return servers;
 }
 // Disk-backed IO the moved detectors take by injection (they never import
@@ -172,7 +187,11 @@ function scanPlugin(dir, layout, dialect = dialect_js_1.claudeCodeDialect, opts
         inlineHooks: inline,
         manualHookCount: manual,
         commands: Object.keys(loaded.files).filter(cls.isCommand).length,
-        mcp: loaded.warnings.some((w) => w.includes("MCP server")),
+        // A declared server set counts even when the loader emitted no warning —
+        // otherwise a plugin whose servers come from the Agent Plugins `mcp.json`
+        // reports "MCP servers: no" while the report lists an MCP finding.
+        mcp: loaded.warnings.some((w) => w.includes("MCP server")) ||
+            declaredServers.length > 0,
         danglingRefs: (0, plugin_loader_js_2.danglingRefs)((0, node_path_1.resolve)(dir), lay),
         hookEventIssues,
         frontmatterIssues: remap((0, scan_core_js_1.frontmatterIssuesFor)(loaded.files, cls)),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigiles",
-  "version": "14.13.2",
+  "version": "14.13.3",
   "description": "Lint & test the harness your AI agent runs on — verify the references in your CLAUDE.md / AGENTS.md and test that your hooks and skills actually work.",
   "keywords": [
     "claude-code",
@@ -65,6 +65,7 @@
     "!dist/**/*.test.js",
     "!dist/**/*.test.d.ts",
     "action.yml",
+    "plugin.json",
     ".claude-plugin",
     "hooks",
     "skills",

package/plugin.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+  "name": "vigiles",
+  "version": "4.0.1",
+  "description": "Verify CLAUDE.md/AGENTS.md references, compile typed specs, and test the agent harness",
+  "author": {
+    "name": "zernie",
+    "url": "https://github.com/zernie"
+  },
+  "homepage": "https://vigiles.sh",
+  "repository": "https://github.com/zernie/vigiles",
+  "license": "MIT",
+  "keywords": ["linting", "claude-md", "agents-md", "feedback-loops", "harness"]
+}