vigiles 15.0.0 → 15.0.2

package/dist/core/types.d.ts

@@ -297,12 +297,16 @@ export interface RulesConfig {
      */
     "hook-block-ineffective"?: RuleSeverity;
     /**
-     * Flag a hook `matcher` string that silently never fires — a close typo of a
-     * built-in tool (`bash`→`Bash`), or a malformed/undeclared MCP form
-     * (`mcp_memory_*` instead of `mcp__memory__.*`, or a server the plugin doesn't
-     * declare). High-precision (close-typo only; MCP gated on a declared set,
-     * built-ins allowlisted; wildcards/regex skipped). Default "warn"; raise to
-     * "error" to gate CI. Same detector as `scan` (hookMatcherFindings). See
+     * Flag a hook `matcher` string that doesn't fire the way it reads — a close
+     * typo of a built-in tool (`bash`→`Bash`), a matcher that doesn't COMPILE, an
+     * MCP pattern that can match no tool name at all (`mcp_memory_*` instead of
+     * `mcp__memory__.*`), an MCP pattern too narrow for real server naming
+     * (`mcp__[^_]+__[^_]+` can't cross the `_` in `mcp__Google_Calendar__…`), or a
+     * server the plugin doesn't declare. A matcher is a PATTERN, so patterns are
+     * validated by compiling and probing, never by literal shape. High-precision
+     * (close-typo only; MCP gated on a declared set, built-ins allowlisted;
+     * match-all and alternation skipped). Default "warn"; raise to "error" to gate
+     * CI. Same detector as `scan` (hookMatcherFindings). See
      * docs/rules/hook-matcher.md.
      */
     "hook-matcher"?: RuleSeverity;

package/dist/core/validate.js

@@ -94,8 +94,9 @@ exports.DEFAULT_RULES = {
     // A hook that looks like it blocks but silently doesn't (#19009) — WARN by
     // default (FP-safe literal patterns); raise to error to gate CI.
     "hook-block-ineffective": "warn",
-    // A hook matcher that never fires (tool typo / wrong MCP form) — WARN by
-    // default (high-precision); raise to error to gate CI.
+    // A hook matcher that doesn't fire as written (tool typo, an MCP pattern
+    // that matches no tool name, or one too narrow for real server names) — WARN
+    // by default (high-precision); raise to error to gate CI.
     "hook-matcher": "warn",
 };
 const DEFAULT_CONFIG = {

package/dist/eval.js

@@ -75,6 +75,7 @@ const harness_test_js_1 = require("./harness-test.js");
 const eval_cache_js_1 = require("./eval-cache.js");
 const eval_lock_js_1 = require("./eval-lock.js");
 const stats_js_1 = require("./stats.js");
+const check_count_js_1 = require("./check-count.js");
 const tool_intercept_js_1 = require("./tool-intercept.js");
 const tool_stub_js_1 = require("./tool-stub.js");
 function writeFiles(cwd, files) {
@@ -1165,6 +1166,9 @@ function evalArmsInputs(spec, cfg) {
     };
 }
 async function runEvalWith(spec, runner) {
+    // Tell the CLI runner this script exercised the harness, so a file that runs
+    // NOTHING can be told apart from one that ran and passed. See check-count.ts.
+    (0, check_count_js_1.recordCheck)();
     const trials = spec.trials ?? 5;
     const spacing = (spec.spacingSec ?? 4) * 1000;
     const concurrency = spec.concurrency ?? 1;
@@ -1637,6 +1641,8 @@ function assertTriggerDiversity(spec) {
     }
 }
 async function measureTriggerRateWith(spec, runner, parse = parseClaudeRun, runError, harness = "claude-code") {
+    // Tell the CLI runner this script exercised the harness (see check-count.ts).
+    (0, check_count_js_1.recordCheck)();
     // Deterministic gate FIRST — before spending a token (or packaging a skillsDir).
     assertTriggerDiversity(spec);
     // Model floor (default Sonnet): trigger-rate under-measures selection on a

package/dist/harness-assert.js

@@ -64,6 +64,7 @@ exports.assertTriggerRate = assertTriggerRate;
 const harness_test_js_1 = require("./harness-test.js");
 const hook_program_js_1 = require("./core/hook-program.js");
 const check_js_1 = require("./check.js");
+const check_count_js_1 = require("./check-count.js");
 const agent_result_js_1 = require("./adapters/claude-code/agent-result.js");
 const stats_js_1 = require("./stats.js");
 const eval_baseline_js_1 = require("./eval-baseline.js");
@@ -142,6 +143,15 @@ function assertHookAllowed(r) {
         fail(`expected the hook to allow, but it blocked (exit ${String(r.exitCode)}, decision ${String(r.decision)})`);
     }
 }
+/**
+ * `runHookProgram`, counted. An in-process hook decision is an observation the
+ * CLI runner can see — without it, a `*.harness.*` file that only tests compiled
+ * hooks would look like it did nothing at all. See check-count.ts.
+ */
+function runCountedHookProgram(hook, event) {
+    (0, check_count_js_1.recordCheck)();
+    return (0, hook_program_js_1.runHookProgram)(hook, event);
+}
 /** Render a {@link HookProgramOutcome} for an assertion message. */
 function describeOutcome(o) {
     if (o.kind === "decision")
@@ -157,14 +167,14 @@ function describeOutcome(o) {
  * check, use {@link assertHookBlocked} over `runHook`.)
  */
 function assertHookDenies(hook, event) {
-    const o = (0, hook_program_js_1.runHookProgram)(hook, event);
+    const o = runCountedHookProgram(hook, event);
     if (o.kind !== "decision" || o.decision.kind !== "deny") {
         fail(`expected the hook to deny, got ${describeOutcome(o)}`);
     }
 }
 /** Assert a COMPILED hook allows an event (in-process). The twin of {@link assertHookDenies}. */
 function assertHookAllows(hook, event) {
-    const o = (0, hook_program_js_1.runHookProgram)(hook, event);
+    const o = runCountedHookProgram(hook, event);
     if (o.kind !== "decision" || o.decision.kind !== "allow") {
         fail(`expected the hook to allow, got ${describeOutcome(o)}`);
     }
@@ -181,7 +191,7 @@ function assertHookAllows(hook, event) {
  * stdout-vs-stderr never enters into it.
  */
 function assertHookNotices(hook, event, matcher) {
-    const o = (0, hook_program_js_1.runHookProgram)(hook, event);
+    const o = runCountedHookProgram(hook, event);
     if (o.kind !== "reaction" || o.reaction.kind !== "notice") {
         fail(`expected the hook to notice, got ${describeOutcome(o)}`);
     }
@@ -204,7 +214,7 @@ function assertHookNotices(hook, event, matcher) {
  * A `run(…)` reaction is not silent for this purpose: the hook still reacted.
  */
 function assertHookSilent(hook, event) {
-    const o = (0, hook_program_js_1.runHookProgram)(hook, event);
+    const o = runCountedHookProgram(hook, event);
     if (o.kind !== "reaction") {
         fail(`expected a react hook, got ${describeOutcome(o)}`);
     }

package/dist/harness-test.js

@@ -46,6 +46,7 @@ const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const adapter_conformance_js_1 = require("./adapter-conformance.js");
+const check_count_js_1 = require("./check-count.js");
 const runtime_js_1 = require("./adapters/claude-code/runtime.js");
 const mock_model_js_1 = require("./mock-model.js");
 const plugin_loader_js_1 = require("./adapters/claude-code/plugin-loader.js");
@@ -410,6 +411,9 @@ function makeResult(cwd, out, parsed, turns, modelRequests) {
  * only — requesting confinement for another harness throws.
  */
 async function runHarnessTest(spec, opts = {}) {
+    // Tell the CLI runner this script exercised the harness, so a file that runs
+    // NOTHING can be told apart from one that ran and passed. See check-count.ts.
+    (0, check_count_js_1.recordCheck)();
     const adapter = opts.adapter;
     // Default (no adapter): the unchanged Claude Code driver — keeps the
     // sandbox/confined path and behaviour byte-for-byte identical.

package/dist/run-script.js

@@ -35,6 +35,7 @@ const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const egress_js_1 = require("./egress.js");
 const sandbox_js_1 = require("./sandbox.js");
+const check_count_js_1 = require("./check-count.js");
 /**
  * The run orchestration with injectable spawn seams: pick direct vs. confined
  * via the safe-by-default policy (`decideSandbox`), then assemble the result.
@@ -42,6 +43,11 @@ const sandbox_js_1 = require("./sandbox.js");
  * with fake spawners — no real bwrap.
  */
 function runScriptWith(command, stdin, opts, deps) {
+    // Tell the CLI runner this script exercised the harness, so a `*.harness.*`
+    // file that runs NOTHING can be told apart from one that ran and passed. Here,
+    // at the primitive, so `runHook` and a bare `runScript` both count. See
+    // check-count.ts.
+    (0, check_count_js_1.recordCheck)();
     // Allowlisted egress is its own confined path (bwrap netns + slirp4netns +
     // nft); it can't run unconfined, so it refuses outright when the tooling is
     // absent rather than falling back to a direct run that ignores the allowlist.

package/dist/scan-core.js

@@ -69,6 +69,44 @@ function frontmatter(md) {
         color: (0, frontmatter_read_js_1.frontmatterScalar)(fm, "color"),
     };
 }
+/**
+ * Whether this unit's declared TOOL CONTRACT is unreadable — the frontmatter
+ * block exists but is not valid YAML.
+ *
+ * 🔴 WHY SCORING MUST NOT USE THE SALVAGE. The shared reader is deliberately
+ * lenient: on a block js-yaml rejects it falls back to a regex salvage, so the
+ * live PreToolUse rail still has *something* to enforce and the other fields
+ * keep working. That is right for a rail and wrong for a SCORE. Measured
+ * 2026-08-08: `readFrontmatter(bad)` returns `{data: null, malformed: true}` —
+ * the tool KNOWS the block is broken — while `frontmatterList(…, "allowed-tools")`
+ * on the same block returns `["Read","Bash"]`, the narrow contract the author
+ * MEANT. Strict js-yaml on it throws `bad indentation of a mapping entry`. So a
+ * unit whose contract a strict loader rejects was graded as though it had
+ * declared exactly that narrow contract: the Safety ring read BETTER than the
+ * truth, on the optimistic branch, in the tool whose own thesis is that the
+ * presence of a declaration is not the enforcement of it.
+ *
+ * The trifecta detector is therefore told the list is a SALVAGE, and reads it as
+ * one: it can only make the verdict worse (a salvaged all-three still convicts),
+ * and anything short of that falls back to what a strict loader really yields —
+ * no contract, i.e. inherits-all. The finding says which happened, so the author
+ * can tell a dropped grade from a real capability. Strictly one-directional, the
+ * same shape as the inherits-all monotonicity fix (#119). `frontmatter-valid`
+ * reports the broken block itself; this is the half that stops the SCORE
+ * disagreeing with it.
+ *
+ * DELIBERATELY NOT WIDER. The typo / never-available / MCP-server /
+ * disallowed-tools cross-references keep using the salvage: they are diagnostics,
+ * and suppressing them on a malformed file DELETES findings, which moves the
+ * grade the optimistic way — the direction this whole fix exists to close. A real
+ * vendored plugin in `test/dogfood` proves the point: `madappgang-frontend`'s
+ * `tester.md` has both a malformed description and an explicit all-three-legs
+ * tool list, and its `AskUserQuestion` never-available finding is true whether or
+ * not the block parses.
+ */
+function contractIsUnreadable(md) {
+    return (0, frontmatter_read_js_1.readFrontmatter)(md).malformed;
+}
 function escapeRe(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -257,11 +295,17 @@ function scanSkills(files, cls, ctx) {
         // invocable skill can be hijacked by attacker content, so a user-invoked one is
         // excluded. A skill with no `allowed-tools` line inherits all → advisory.
         const skillTools = (0, agent_tools_js_1.parseAgentToolList)(md, "allowed-tools");
+        // Whether that list came out of a block a strict loader REJECTS — in which
+        // case it is a salvage, and the trifecta detector must read it as one. See
+        // `contractIsUnreadable`.
+        const contractUnreadable = contractIsUnreadable(md);
         // No `allowed-tools:` line (null) → inherits all → wildcard sentinel; an
         // EXPLICIT empty `[]` means zero tools → no trifecta (don't collapse them).
         const trifecta = userInvoked
             ? null
-            : (0, lethal_trifecta_js_1.lethalTrifectaIssues)(skillTools ?? ["*"], dialect);
+            : (0, lethal_trifecta_js_1.lethalTrifectaIssues)(skillTools ?? ["*"], dialect, {
+                contractUnreadable,
+            });
         out.push({
             name: fm.name ?? skillName(path),
             // Report the real on-disk path, not the synthetic materialize key (E1).
@@ -323,6 +367,14 @@ ctx) {
         if (!cls.isAgent(path))
             continue;
         const tools = (0, agent_tools_js_1.parseAgentTools)(md);
+        // Whether that list came out of a block a strict loader REJECTS — see
+        // `contractIsUnreadable`. Scoped to the trifecta (the Safety ring) on
+        // purpose: the typo / MCP / disallowed-tools cross-references below are
+        // DIAGNOSTICS, and dropping them on a malformed file would delete real
+        // findings — moving the grade in the optimistic direction this fix exists to
+        // stop. A salvage is too weak to earn a unit a clean bill of health; it is
+        // plenty strong enough to convict.
+        const contractUnreadable = contractIsUnreadable(md);
         // An inherits-all agent (no `tools:` line) grants access to every tool
         // including every side-effecting one — pass the wildcard sentinel so
         // effectSurface correctly classifies it as `"unrestricted"`.
@@ -359,7 +411,9 @@ ctx) {
             // inherits-all agent (no `tools:` line → tools === null) is the advisory
             // case — pass the wildcard sentinel so it's distinguished from an EXPLICIT
             // empty `tools: []` (zero tools → no trifecta). One detector, no drift.
-            trifecta: (0, lethal_trifecta_js_1.lethalTrifectaIssues)(tools ?? ["*"], dialect),
+            trifecta: (0, lethal_trifecta_js_1.lethalTrifectaIssues)(tools ?? ["*"], dialect, {
+                contractUnreadable,
+            }),
         });
     }
     return out.sort((a, b) => a.name.localeCompare(b.name));

package/dist/scan.d.ts

@@ -257,9 +257,10 @@ export interface ScanReport {
      */
     readonly hookBlockFindings: readonly HookBlockFinding[];
     /**
-     * Hook `matcher` strings that silently never fire — a tool-name typo or a
-     * malformed/undeclared MCP form. Shared by `scan` and the `hook-matcher` lint
-     * rule (one detector, no drift).
+     * Hook `matcher` strings that don't fire as written — a tool-name typo, a
+     * matcher that doesn't compile, an MCP pattern that matches no tool name or is
+     * too narrow for real server naming, or an undeclared MCP server. Shared by
+     * `scan` and the `hook-matcher` lint rule (one detector, no drift).
      */
     readonly hookMatcherFindings: readonly HookMatcherFinding[];
     /** Skills/agents whose `---` block isn't valid YAML — informational (may still load via salvage). */

package/dist/scan.js

@@ -431,7 +431,7 @@ function formatScanReport(r) {
     out.push(...section("Misplaced plugin directories", r.pluginLayoutIssues.map((p) => `  ✗ ${p.message}`)));
     out.push(...section("Lethal trifecta across delegation (blast radius)", r.delegationTrifecta.map((d) => `  ⚠ ${d.finding.name} (${d.path}): ${d.finding.message}`)));
     out.push(...section("Ineffective hook guards (false confidence)", r.hookBlockFindings.map((h) => `  ✗ [${h.event}] ${h.scriptPath ?? "(inline)"}: ${h.message}`)));
-    out.push(...section("Hook matchers that never fire", r.hookMatcherFindings.map((m) => `  ✗ ${m.message}`)));
+    out.push(...section("Hook matchers that don't fire as written", r.hookMatcherFindings.map((m) => `  ✗ ${m.message}`)));
     const facts = [];
     if (r.commands > 0)
         facts.push(`Commands: ${String(r.commands)}`);

package/dist/score-core.js

@@ -212,7 +212,7 @@ function reportDeductions(r) {
         {
             n: r.hookMatcherFindings.length,
             weight: exports.W_MISSING_HOOK,
-            label: "hook matcher(s) that never fire (typo / wrong MCP form)",
+            label: "hook matcher(s) that don't fire as written (dead, or too narrow for real MCP names)",
         },
         // NB: delegationTrifecta (like the advisory per-unit/inherits-all trifecta) is a
         // ⚠ RISK, surfaced but NOT graded — only the HARD per-unit trifecta above scores.

package/dist/testing.d.ts

@@ -10,6 +10,7 @@
  * boundary forbids importing `src/adapters/*` from here. See
  * `research/adapter-api-design.md`.
  */
+export { recordCheck } from "./check-count.js";
 export { runScript } from "./run-script.js";
 export type { RunScriptOptions, ScriptRunResult } from "./run-script.js";
 export { runHook, propertyHook } from "./run-hook.js";

package/dist/testing.js

@@ -30,7 +30,15 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.runHarness = exports.runHarnessTest = exports.judge = exports.hookFired = exports.loadHook = exports.stubSkillBody = exports.parseClaudeRun = exports.claudeEvalDriver = exports.formatTriggerRateReport = exports.formatEvalReport = exports.formatCheckReport = exports.checkReportToJUnit = exports.checkPromptDiversity = exports.assertPromptDiversity = exports.assertRates = exports.measureTriggerRate = exports.measureArms = exports.measure = exports.runEval = exports.propertyHook = exports.runHook = exports.runScript = void 0;
+exports.runHarness = exports.runHarnessTest = exports.judge = exports.hookFired = exports.loadHook = exports.stubSkillBody = exports.parseClaudeRun = exports.claudeEvalDriver = exports.formatTriggerRateReport = exports.formatEvalReport = exports.formatCheckReport = exports.checkReportToJUnit = exports.checkPromptDiversity = exports.assertPromptDiversity = exports.assertRates = exports.measureTriggerRate = exports.measureArms = exports.measure = exports.runEval = exports.propertyHook = exports.runHook = exports.runScript = exports.recordCheck = void 0;
+// --- reporting: how much did this script actually do? ---
+// `vigiles test` can otherwise see only an exit code, so a file that runs NOTHING
+// prints the same `✓` as one that ran and passed (measured 2026-08-08 on a file
+// exporting an object of tests nobody calls). The tiers below count themselves;
+// call `recordCheck()` yourself when you assert some OTHER way — `node:assert`,
+// vitest's `expect` — so those are visible to the runner too. See check-count.ts.
+var check_count_js_1 = require("./check-count.js");
+Object.defineProperty(exports, "recordCheck", { enumerable: true, get: function () { return check_count_js_1.recordCheck; } });
 // --- unit tier: runScript (the primitive) + runHook (it, plus a decision) ---
 // `runScript` runs any program and reports what it DID (exit, both streams,
 // writes, egress). `runHook` is that plus the hook protocol: event to stdin,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigiles",
-  "version": "15.0.0",
+  "version": "15.0.2",
   "description": "Lint & test the harness your AI agent runs on — verify the references in your CLAUDE.md / AGENTS.md and test that your hooks and skills actually work.",
   "keywords": [
     "claude-code",