vigiles 14.7.0 → 14.8.0

package/dist/scan-files.d.ts

@@ -0,0 +1,28 @@
+import type { PluginLayout } from "./core/layout.js";
+import type { HarnessDialect } from "./core/dialect.js";
+import type { LoadedPlugin } from "./plugin-loader.js";
+import type { ScanReport } from "./scan.js";
+/**
+ * The synthetic absolute root every path in a browser scan resolves against. A
+ * pure, deterministic string (never `process.cwd()`), so `join`/`relative` stay
+ * side-effect-free and identical on every machine. Exported so the parity test can
+ * normalize an on-disk report's real absolute root to it before comparing.
+ */
+export declare const BROWSER_ROOT = "/__vigiles_repo__";
+/**
+ * Reconstruct the `LoadedPlugin` shape from a repo-relative file map, exactly as
+ * `loadPlugin` builds it off disk — surface files materialized under the layout's
+ * `materializeRoot`, hook commands with the plugin-root token expanded to
+ * {@link BROWSER_ROOT}, and the same `warnings`.
+ */
+export declare function loadPluginFromFiles(files: Record<string, string>, layout: PluginLayout, repoName?: string): LoadedPlugin;
+/**
+ * Scan an in-memory repo-relative file map and report its surfaces + structural
+ * issues — the browser-safe twin of {@link scanPlugin}. `files` is
+ * `repoRelativePath → content` (as a GitHub fetch yields). Produces a
+ * {@link ScanReport} that {@link buildAuditReport} turns into the exact same
+ * `AuditReport` the CLI's `audit --json` produces over the same files (modulo the
+ * checkout path — see {@link BROWSER_ROOT}).
+ */
+export declare function scanFiles(files: Record<string, string>, layout?: PluginLayout, dialect?: HarnessDialect, repoName?: string): ScanReport;
+//# sourceMappingURL=scan-files.d.ts.map

package/dist/scan-files.js

@@ -0,0 +1,489 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BROWSER_ROOT = void 0;
+exports.loadPluginFromFiles = loadPluginFromFiles;
+exports.scanFiles = scanFiles;
+/**
+ * `scanFiles` — the BROWSER-SAFE deterministic audit engine.
+ *
+ * `scanPlugin` (src/scan.ts) walks a directory on disk. `scanFiles` produces the
+ * SAME {@link ScanReport} over an in-memory `Record<repoRelativePath, content>`
+ * file map — exactly what an in-browser GitHub fetch yields — so the whole
+ * deterministic audit (and the {@link buildAuditReport} it feeds) runs client-side
+ * with NO filesystem, NO `child_process`, NO disk I/O at all.
+ *
+ * It mirrors `scanPlugin`'s body: it (a) reconstructs the `LoadedPlugin` shape
+ * (`{settings.hooks, files, warnings, sources}`) from the map instead of a disk
+ * walk, then (b) runs the SAME pure detectors `scanPlugin` runs (re-exported from
+ * scan.ts — one detector, no drift), then (c) callers hand the result to
+ * `buildAuditReport` unchanged. Every filesystem access in `scanPlugin` maps to a
+ * lookup in the map: `existsSync(p)` → `p in files`, `readFileSync(p)` →
+ * `files[p]`, "is a directory" → `keys.some(k => k.startsWith(p + "/"))`.
+ *
+ * Path model — a SYNTHETIC ROOT ({@link BROWSER_ROOT}): a browser has no real
+ * directory, so we resolve every path against a fixed absolute sentinel. All the
+ * report fields that embed the plugin root on disk (`meta.dir`, a resolved hook
+ * `script`/`command`, a hook-block `scriptPath`) come out rooted at
+ * {@link BROWSER_ROOT} instead of the checkout path. The parity test normalizes
+ * the on-disk report's real absolute root to {@link BROWSER_ROOT} and asserts a
+ * byte-identical {@link buildAuditReport} — the checkout path is the ONE thing that
+ * legitimately differs between the two environments (it names WHERE the repo lives,
+ * not WHAT the harness contains).
+ *
+ * The six filesystem touchpoints in `scanPlugin` are reimplemented here over the
+ * map (never on disk): (1) hook-script resolution — scanHooks/collectHookBlockEntries
+ * take an injected map-backed `exists`; (2) `collectMcpServers`; (3) the `hasSpec`
+ * check; (4) `danglingRefs`; (5) `pluginDirLayoutIssues` (map-backed
+ * existsSync/isDirectory); (6) `findUntestedSurfaces` (its globs → `Object.keys`
+ * filters). `verifyLiveMcpTools` (spawns servers) is NOT part of `scanPlugin` and
+ * is excluded. See research/report-view-and-browser-demo.md.
+ */
+const posix_path_js_1 = require("./posix-path.js");
+const toml_1 = require("@iarna/toml");
+const layout_js_1 = require("./adapters/claude-code/layout.js");
+const dialect_js_1 = require("./adapters/claude-code/dialect.js");
+const hook_normalize_js_1 = require("./core/hook-normalize.js");
+const hook_events_js_1 = require("./core/hook-events.js");
+const mcp_config_js_1 = require("./core/mcp-config.js");
+const mcp_hook_js_1 = require("./core/mcp-hook.js");
+const plugin_dir_layout_js_1 = require("./core/plugin-dir-layout.js");
+const hook_block_ineffective_js_1 = require("./core/hook-block-ineffective.js");
+const hook_matcher_js_1 = require("./core/hook-matcher.js");
+const test_coverage_files_js_1 = require("./test-coverage-files.js");
+const scan_core_js_1 = require("./scan-core.js");
+/**
+ * The synthetic absolute root every path in a browser scan resolves against. A
+ * pure, deterministic string (never `process.cwd()`), so `join`/`relative` stay
+ * side-effect-free and identical on every machine. Exported so the parity test can
+ * normalize an on-disk report's real absolute root to it before comparing.
+ */
+exports.BROWSER_ROOT = "/__vigiles_repo__";
+/** Mirror of loadPlugin's `MAX_SKILL_FILE_BYTES` — surface files over this are skipped. */
+const MAX_SKILL_FILE_BYTES = 256 * 1024;
+/** UTF-8 byte length (mirrors disk `statSync(f).size` for a text file). */
+const byteLen = (s) => new TextEncoder().encode(s).length;
+// ---------------------------------------------------------------------------
+// File-map primitives (repo-relative keys, POSIX-style)
+// ---------------------------------------------------------------------------
+/** `p in files` — a repo-relative path is present as a file key. */
+function hasFile(files, rel) {
+    return Object.prototype.hasOwnProperty.call(files, rel);
+}
+/** "is a directory" — some file key lives UNDER `rel/`. */
+function isDirRel(files, rel) {
+    const prefix = rel === "" ? "" : `${rel}/`;
+    if (rel === "")
+        return Object.keys(files).length > 0;
+    return Object.keys(files).some((k) => k.startsWith(prefix));
+}
+/**
+ * The repo-relative form of an absolute BROWSER_ROOT-rooted path, or `null` when
+ * the path escapes the root (a `../` outside the plugin — never a plugin file).
+ */
+function toRel(absPath) {
+    const rel = (0, posix_path_js_1.relative)(exports.BROWSER_ROOT, absPath);
+    if (rel === "" || rel.startsWith("..") || (0, posix_path_js_1.isAbsolute)(rel))
+        return null;
+    return rel;
+}
+/**
+ * A map-backed `existsSync` over absolute BROWSER_ROOT-rooted paths. Mirrors
+ * node's `fs.existsSync`, which is true for a FILE **or a DIRECTORY** — so a
+ * detector like `pluginDirLayoutIssues` (`exists(dir) && isDirectory(dir)`)
+ * resolves the same in the browser as on disk. File-only here would silently miss
+ * any directory-existence check the CLI reports.
+ */
+function mapExists(files) {
+    return (p) => {
+        const rel = toRel(p);
+        return rel !== null && (hasFile(files, rel) || isDirRel(files, rel));
+    };
+}
+/** A map-backed `isDirectory` over absolute BROWSER_ROOT-rooted paths. */
+function mapIsDirectory(files) {
+    return (p) => {
+        const rel = toRel(p);
+        return rel !== null && isDirRel(files, rel);
+    };
+}
+/** A map-backed `readFileSync` (returns "" on a miss, like the detector default). */
+function mapReadFile(files) {
+    return (p) => {
+        const rel = toRel(p);
+        return rel !== null && hasFile(files, rel) ? files[rel] : "";
+    };
+}
+/**
+ * Read a subtree of the map as `relativeToBase → content`, mirroring
+ * loadPlugin's `readTree(dir, base)` — including its `MAX_SKILL_FILE_BYTES` cap.
+ * `baseRel === ""` reads the whole repo (the single-skill case's `readTree(root,
+ * root)`).
+ */
+function readTreeUnder(files, dirRel, baseRel) {
+    const out = {};
+    const underPrefix = dirRel === "" ? "" : `${dirRel}/`;
+    const basePrefix = baseRel === "" ? "" : `${baseRel}/`;
+    for (const [k, content] of Object.entries(files)) {
+        if (dirRel !== "" && !k.startsWith(underPrefix))
+            continue;
+        if (byteLen(content) > MAX_SKILL_FILE_BYTES)
+            continue;
+        const rel = baseRel === "" ? k : k.slice(basePrefix.length);
+        out[rel] = content;
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Manifest / hooks reading (mirrors plugin-loader.ts readHooks/safeReadManifest)
+// ---------------------------------------------------------------------------
+/** Parse a JSON file's text, or null on any error. */
+function safeParseJson(text) {
+    if (text === undefined)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+/** Parse the layout's manifest (JSON or TOML) from the map, or null. */
+function readManifest(files, layout) {
+    const text = files[layout.manifestPath];
+    if (text === undefined)
+        return null;
+    if (layout.settingsFormat === "toml") {
+        try {
+            return (0, toml_1.parse)(text);
+        }
+        catch {
+            return null;
+        }
+    }
+    return safeParseJson(text);
+}
+/** The `.hooks` field of a JSON file in the map, or undefined. */
+function readHooksJsonFile(files, rel) {
+    return safeParseJson(files[rel])?.hooks;
+}
+/** The `.hooks` of a settings file in the map, in the layout's format. */
+function readSettingsHooks(text, format) {
+    if (format === "json")
+        return safeParseJson(text)?.hooks;
+    try {
+        return (0, toml_1.parse)(text).hooks;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Mirror of plugin-loader.ts `readHooks`, over the file map. */
+function readHooks(files, layout) {
+    const m = readManifest(files, layout);
+    if (m) {
+        if (typeof m.hooks === "string") {
+            return readHooksJsonFile(files, m.hooks.replace(/^\.\//, ""));
+        }
+        if (m.hooks !== undefined)
+            return m.hooks;
+    }
+    if (hasFile(files, layout.hooksConventionPath)) {
+        return readHooksJsonFile(files, layout.hooksConventionPath);
+    }
+    const settings = files[layout.settingsPath];
+    if (settings !== undefined) {
+        return readSettingsHooks(settings, layout.settingsFormat);
+    }
+    return undefined;
+}
+/** Whether the plugin declares any MCP servers (standalone file or manifest key). */
+function hasMcp(files, layout) {
+    if (hasFile(files, layout.mcpConfigFile))
+        return true;
+    return readManifest(files, layout)?.[layout.mcpManifestKey] !== undefined;
+}
+/** Mirror of plugin-loader.ts `surfaceHasLoadable`. */
+function surfaceHasLoadable(layout, surface, tree) {
+    const keys = Object.keys(tree);
+    return surface === layout.skillDir
+        ? keys.some((k) => (0, posix_path_js_1.basename)(k) === "SKILL.md")
+        : keys.some((k) => k.endsWith(".md"));
+}
+/** Mirror of plugin-loader.ts `classifySurfaceSource`, over the file map. */
+function classifySurfaceSource(files, layout, rootTrees, repoName) {
+    if (layout.skillDir && hasFile(files, "SKILL.md")) {
+        // Disk mirrors the CLI: a nameless root SKILL.md takes the audited dir's
+        // basename. In-browser there's no real dir, so use the repo name when the
+        // caller (runAudit) supplies it, else the synthetic BROWSER_ROOT basename.
+        return {
+            kind: "single-skill",
+            skillName: repoName ?? (0, posix_path_js_1.basename)(exports.BROWSER_ROOT),
+        };
+    }
+    const rootHasLoadable = layout.surfaceDirs.some((s) => surfaceHasLoadable(layout, s, rootTrees.get(s) ?? {}));
+    const isPluginShaped = hasFile(files, layout.manifestPath) ||
+        hasFile(files, layout.hooksConventionPath);
+    if (rootHasLoadable || isPluginShaped)
+        return { kind: "root" };
+    if (layout.userSurfaceRoot !== undefined) {
+        return { kind: "user", sub: layout.userSurfaceRoot };
+    }
+    return { kind: "none" };
+}
+/** Mirror of plugin-loader.ts `materializeSurfaces`, over the file map. */
+function materializeSurfaces(files, layout, acc, repoName) {
+    const { out, sources } = acc;
+    const counts = {};
+    const rootTrees = new Map();
+    for (const surface of layout.surfaceDirs) {
+        if (isDirRel(files, surface)) {
+            rootTrees.set(surface, readTreeUnder(files, surface, surface));
+        }
+    }
+    const add = (key, content, onDisk) => {
+        out[key] = content;
+        sources[key] = onDisk;
+    };
+    const source = classifySurfaceSource(files, layout, rootTrees, repoName);
+    switch (source.kind) {
+        case "single-skill": {
+            const tree = readTreeUnder(files, "", "");
+            for (const [rel, content] of Object.entries(tree)) {
+                add((0, posix_path_js_1.join)(layout.materializeRoot, layout.skillDir, source.skillName, rel), content, (0, posix_path_js_1.join)(exports.BROWSER_ROOT, rel));
+            }
+            counts[layout.skillDir] = Object.keys(tree).length;
+            break;
+        }
+        case "root":
+        case "user": {
+            const baseRel = source.kind === "user" ? source.sub : "";
+            for (const surface of layout.surfaceDirs) {
+                const dirRel = baseRel === "" ? surface : `${baseRel}/${surface}`;
+                const tree = source.kind === "root"
+                    ? (rootTrees.get(surface) ?? {})
+                    : isDirRel(files, dirRel)
+                        ? readTreeUnder(files, dirRel, dirRel)
+                        : {};
+                for (const [rel, content] of Object.entries(tree)) {
+                    add((0, posix_path_js_1.join)(layout.materializeRoot, surface, rel), content, (0, posix_path_js_1.join)(exports.BROWSER_ROOT, dirRel, rel));
+                }
+                counts[surface] = Object.keys(tree).length;
+            }
+            break;
+        }
+        case "none":
+            break;
+    }
+    return counts;
+}
+// ---------------------------------------------------------------------------
+// Dangling intra-plugin refs (mirrors plugin-loader.ts danglingRefs)
+// ---------------------------------------------------------------------------
+const INTRA_REF_EXTS = "md|sh|cmd|mjs|cjs|js|ts|py|rb|txt|json";
+function intraRefRe(layout) {
+    return new RegExp(`(?:${layout.intraRefDirs.join("|")})/[A-Za-z0-9._/-]+\\.(?:${INTRA_REF_EXTS})`, "g");
+}
+const NON_PLUGIN_VARS = new Set([
+    "CLAUDE_PROJECT_DIR",
+    "CLAUDE_PROJECT",
+    "HOME",
+    "PWD",
+    "OLDPWD",
+]);
+/** Mirror of plugin-loader.ts `isPluginRooted`. */
+function isPluginRooted(content, idx) {
+    if (idx === 0 || content[idx - 1] !== "/")
+        return true;
+    const seg = /([^\s"'`(=:/]*)$/.exec(content.slice(0, idx - 1))?.[1] ?? "";
+    const varName = /^\$\{?(\w+)\}?$/.exec(seg)?.[1];
+    if (varName !== undefined)
+        return !NON_PLUGIN_VARS.has(varName);
+    return false;
+}
+const DOC_SOURCE_RE = /\.(?:md|markdown|mdx|txt|rst)$/i;
+/** The plugin's executable (non-prose) source-file CONTENTS under the surface dirs. */
+function executableContents(files, layout) {
+    const out = [];
+    for (const surface of layout.intraRefDirs) {
+        if (!isDirRel(files, surface))
+            continue;
+        for (const [k, content] of Object.entries(files)) {
+            if (!k.startsWith(`${surface}/`))
+                continue;
+            if (DOC_SOURCE_RE.test(k))
+                continue;
+            if (byteLen(content) > MAX_SKILL_FILE_BYTES)
+                continue;
+            out.push(content);
+        }
+    }
+    return out;
+}
+/** Mirror of plugin-loader.ts `danglingRefs`, over the file map. */
+function danglingRefs(files, layout) {
+    const re = intraRefRe(layout);
+    const missing = new Set();
+    for (const content of executableContents(files, layout)) {
+        for (const m of content.matchAll(re)) {
+            if (m.index !== undefined && !isPluginRooted(content, m.index))
+                continue;
+            if (!hasFile(files, m[0]))
+                missing.add(m[0]);
+        }
+    }
+    return [...missing];
+}
+// ---------------------------------------------------------------------------
+// Warnings (mirrors plugin-loader.ts pluginWarnings)
+// ---------------------------------------------------------------------------
+function pluginWarnings(files, layout, counts, hooks, materialized) {
+    const warnings = [];
+    if (counts.agents) {
+        warnings.push(`plugin defines ${String(counts.agents)} subagent file(s) under agents/ — these run only under a real model; test them at the eval tier (runEval), not the deterministic mock.`);
+    }
+    if (counts.commands) {
+        warnings.push(`plugin defines ${String(counts.commands)} slash-command file(s) under commands/ — slash-command invocation needs a real model; test at the eval tier.`);
+    }
+    if (hasMcp(files, layout)) {
+        warnings.push(`plugin declares MCP server(s) (${layout.mcpManifestKey} / ${layout.mcpConfigFile}) — the loader does not wire MCP; bring the server up yourself if your test needs it.`);
+    }
+    const dangling = danglingRefs(files, layout);
+    if (dangling.length) {
+        const shown = dangling.slice(0, 5).join(", ");
+        const more = dangling.length > 5 ? `, … (+${String(dangling.length - 5)})` : "";
+        warnings.push(`plugin references ${String(dangling.length)} intra-plugin file(s) that don't exist (broken path / partial vendor): ${shown}${more}`);
+    }
+    if (!hooks && Object.keys(materialized).length === 0) {
+        warnings.push(`nothing was loaded (no hooks, CLAUDE.md, skills, agents, or commands) — the deterministic harness would run an effectively empty machine.`);
+    }
+    return warnings;
+}
+// ---------------------------------------------------------------------------
+// loadPluginFromFiles (mirrors plugin-loader.ts loadPlugin)
+// ---------------------------------------------------------------------------
+/**
+ * Reconstruct the `LoadedPlugin` shape from a repo-relative file map, exactly as
+ * `loadPlugin` builds it off disk — surface files materialized under the layout's
+ * `materializeRoot`, hook commands with the plugin-root token expanded to
+ * {@link BROWSER_ROOT}, and the same `warnings`.
+ */
+function loadPluginFromFiles(files, layout, repoName) {
+    const hooks = readHooks(files, layout);
+    const resolvedHooks = hooks
+        ? JSON.parse(JSON.stringify(hooks).replaceAll(layout.pluginRootToken, exports.BROWSER_ROOT))
+        : undefined;
+    const out = {};
+    const sources = {};
+    const instructionText = files[layout.instructionFile];
+    if (instructionText !== undefined) {
+        out[layout.instructionFile] = instructionText;
+        sources[layout.instructionFile] = (0, posix_path_js_1.join)(exports.BROWSER_ROOT, layout.instructionFile);
+    }
+    const counts = materializeSurfaces(files, layout, { out, sources }, repoName);
+    return {
+        settings: resolvedHooks ? { hooks: resolvedHooks } : {},
+        files: out,
+        sources,
+        warnings: pluginWarnings(files, layout, counts, resolvedHooks, out),
+    };
+}
+// ---------------------------------------------------------------------------
+// collectMcpServers (mirrors scan.ts collectMcpServers)
+// ---------------------------------------------------------------------------
+function collectMcpServers(files, layout) {
+    const servers = {};
+    const collect = (file) => {
+        const text = files[file];
+        if (text === undefined)
+            return;
+        try {
+            const parsed = JSON.parse(text);
+            if (parsed.mcpServers !== null && typeof parsed.mcpServers === "object") {
+                Object.assign(servers, parsed.mcpServers);
+            }
+        }
+        catch {
+            /* malformed JSON is the loader's concern, not this check's */
+        }
+    };
+    collect(".mcp.json");
+    collect(layout.manifestPath);
+    return servers;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Scan an in-memory repo-relative file map and report its surfaces + structural
+ * issues — the browser-safe twin of {@link scanPlugin}. `files` is
+ * `repoRelativePath → content` (as a GitHub fetch yields). Produces a
+ * {@link ScanReport} that {@link buildAuditReport} turns into the exact same
+ * `AuditReport` the CLI's `audit --json` produces over the same files (modulo the
+ * checkout path — see {@link BROWSER_ROOT}).
+ */
+function scanFiles(files, layout = layout_js_1.claudeCodeLayout, dialect = dialect_js_1.claudeCodeDialect, repoName) {
+    const lay = layout;
+    const cls = (0, scan_core_js_1.makeClassifier)(lay);
+    const loaded = loadPluginFromFiles(files, lay, repoName);
+    const exists = mapExists(files);
+    const hookRegs = (0, hook_normalize_js_1.normalizeHooks)(loaded.settings.hooks);
+    const { hooks, inline, manual } = (0, scan_core_js_1.scanHooks)(hookRegs, exports.BROWSER_ROOT, lay.pluginRootToken, exists);
+    const eventNames = (0, hook_normalize_js_1.hookEventNames)(loaded.settings.hooks);
+    const hookEventIssues = (0, hook_events_js_1.confidentHookEventIssues)((0, hook_events_js_1.verifyHookEvents)(eventNames, dialect));
+    const instructions = loaded.files[lay.instructionFile] !== undefined
+        ? {
+            file: lay.instructionFile,
+            hasSpec: hasFile(files, `${lay.instructionFile}.spec.ts`),
+        }
+        : null;
+    const mcpServers = collectMcpServers(files, lay);
+    const declaredServers = Object.keys(mcpServers);
+    const agents = (0, scan_core_js_1.scanAgents)(loaded.files, dialect, declaredServers, cls);
+    const skills = (0, scan_core_js_1.scanSkills)(loaded.files, cls, {
+        root: exports.BROWSER_ROOT,
+        materializeRoot: lay.materializeRoot,
+        dialect,
+        sources: loaded.sources,
+        existsSync: exists,
+    });
+    const puritySummary = (0, scan_core_js_1.summarizePurity)(agents);
+    const { trifectaFindings, skillResourceFindings, skillFenceFindings } = (0, scan_core_js_1.collectSurfaceFindings)(agents, skills);
+    return {
+        dir: exports.BROWSER_ROOT,
+        instructions,
+        skills,
+        agents,
+        hooks,
+        inlineHooks: inline,
+        manualHookCount: manual,
+        commands: Object.keys(loaded.files).filter(cls.isCommand).length,
+        mcp: loaded.warnings.some((w) => w.includes("MCP server")),
+        danglingRefs: danglingRefs(files, lay),
+        hookEventIssues,
+        frontmatterIssues: (0, scan_core_js_1.frontmatterIssuesFor)(loaded.files, cls),
+        frontmatterValueIssues: (0, scan_core_js_1.frontmatterValueIssuesFor)(loaded.files, cls),
+        skillMetaIssues: (0, scan_core_js_1.skillMetaIssuesFor)(loaded.files, cls),
+        mcpIssues: (0, mcp_config_js_1.verifyMcpServers)(mcpServers),
+        mcpHookIssues: (0, mcp_hook_js_1.verifyMcpHookTargets)(loaded.settings.hooks, declaredServers, dialect),
+        descriptionOverlaps: (0, scan_core_js_1.descriptionOverlapsFor)(loaded.files, cls),
+        descriptionBudgetIssues: (0, scan_core_js_1.descriptionBudgetFor)(loaded.files, cls),
+        trifectaFindings,
+        skillResourceIssues: skillResourceFindings,
+        skillFenceIssues: skillFenceFindings,
+        pluginLayoutIssues: (0, plugin_dir_layout_js_1.pluginDirLayoutIssues)((0, posix_path_js_1.join)(exports.BROWSER_ROOT, (0, posix_path_js_1.dirname)(lay.manifestPath)), [...new Set([...lay.surfaceDirs, lay.hooksConventionPath.split("/")[0]])], { existsSync: exists, isDirectory: mapIsDirectory(files) }),
+        delegationTrifecta: (0, scan_core_js_1.collectDelegationTrifecta)(agents, dialect),
+        hookBlockFindings: dialect.noEffectHookEvents
+            ? (0, hook_block_ineffective_js_1.hookBlockIssues)((0, scan_core_js_1.collectHookBlockEntries)(hookRegs, exports.BROWSER_ROOT, lay.pluginRootToken, exists), {
+                noEffectEvents: new Set(dialect.noEffectHookEvents),
+                permissionDecisionEvents: new Set(dialect.permissionDecisionHookEvents ?? []),
+                readFileSync: mapReadFile(files),
+            })
+            : [],
+        hookMatcherFindings: (0, hook_matcher_js_1.hookMatcherIssues)((0, scan_core_js_1.collectHookMatchers)(hookRegs), declaredServers, dialect),
+        malformedFrontmatter: (0, scan_core_js_1.malformedFrontmatterFor)(loaded.files, cls),
+        warnings: loaded.warnings,
+        untested: (0, test_coverage_files_js_1.findUntestedSurfacesInFiles)(files, lay).untested.length,
+        puritySummary,
+    };
+}
+//# sourceMappingURL=scan-files.js.map

package/dist/scan.d.ts

@@ -13,22 +13,23 @@
  */
 import type { PluginLayout } from "./core/layout.js";
 import type { HarnessDialect } from "./core/dialect.js";
-import { type ToolIssue } from "./core/tool-contract.js";
+import type { ToolIssue } from "./core/tool-contract.js";
 import { type HookEventIssue } from "./core/hook-events.js";
 import { type McpIssue } from "./core/mcp-config.js";
-import { type DescriptionOverlap } from "./core/description-overlap.js";
-import { type DescriptionBudgetIssue } from "./core/skill-description-budget.js";
-import { type McpToolIssue } from "./core/mcp-tool.js";
-import { type McpContractToolError } from "./core/mcp.js";
+import type { DescriptionOverlap } from "./core/description-overlap.js";
+import type { DescriptionBudgetIssue } from "./core/skill-description-budget.js";
+import type { McpToolIssue } from "./core/mcp-tool.js";
+import { type McpContractToolError } from "./core/mcp-contract-message.js";
 import { type McpHookIssue } from "./core/mcp-hook.js";
-import { type TrifectaFinding } from "./core/lethal-trifecta.js";
-import { type SkillResourceFinding } from "./core/skill-resources.js";
-import { type SkillFenceFinding } from "./core/skill-missing-fence.js";
+import type { TrifectaFinding } from "./core/lethal-trifecta.js";
+import type { SkillResourceFinding } from "./core/skill-resources.js";
+import type { SkillFenceFinding } from "./core/skill-missing-fence.js";
 import { type PluginLayoutFinding } from "./core/plugin-dir-layout.js";
-import { type DelegationTrifectaFinding } from "./core/delegation-trifecta.js";
+import type { DelegationTrifectaFinding } from "./core/delegation-trifecta.js";
 import { type HookBlockFinding } from "./core/hook-block-ineffective.js";
 import { type HookMatcherFinding } from "./core/hook-matcher.js";
-import { type PurityLevel, type EffectSurface } from "./core/effects.js";
+import type { PurityLevel, EffectSurface } from "./core/effects.js";
+export * from "./scan-core.js";
 export interface ScanSkill {
     readonly name: string;
     readonly path: string;
@@ -276,30 +277,6 @@ export interface ScanReport {
         unrestricted: number;
     };
 }
-/**
- * Per-kind surface classifiers, built from the harness `PluginLayout`'s
- * `skillDir`/`agentDir`/`commandDir` — so adding a harness whose subagents live
- * somewhere other than `agents/` (OpenCode's `.opencode/agent`) needs no change
- * here. Each anchors on a real path boundary (start-of-path or a `/`), so a
- * directory whose NAME merely ends in the keyword isn't misclassified — e.g. the
- * skill `skills/dispatching-parallel-agents/SKILL.md` must NOT register as an
- * agent named "SKILL" (the `-agents/` substring), which real plugins like
- * obra/superpowers ship. See scan.test.ts for the regression cases.
- */
-export interface SurfaceClassifier {
-    readonly isSkill: (f: string) => boolean;
-    readonly isAgent: (f: string) => boolean;
-    readonly isCommand: (f: string) => boolean;
-}
-/**
- * A compiled `vigiles/hook` artifact runs through the `hook-runtime run-program`
- * runtime entrypoint; any other hook command is hand-written (a shell script or
- * an inline one-liner) the author maintains directly. The basis for the
- * `prefer-compiled-hooks` nudge.
- */
-export declare function isManagedHookCommand(command: string): boolean;
-/** The `prefer-compiled-hooks` recommendation message (shared by `lint` + `scan`). */
-export declare function preferCompiledHooksMessage(count: number): string;
 /** Scan a plugin/repo directory and report its surfaces + structural issues. */
 export declare function scanPlugin(dir: string, layout?: PluginLayout, dialect?: HarnessDialect, opts?: {
     sharedDirs?: readonly string[];