vigiles 15.0.2 → 15.0.3

package/dist/core/bash-effects.d.ts

@@ -131,4 +131,45 @@ export interface NormalizedLeaf {
  * failure → []. A leaf with a dynamic head is skipped (can't be normalized).
  */
 export declare function leafCommandsNormalized(command: string): NormalizedLeaf[];
+/**
+ * Every simple command's argv, POSITIONALLY, each word reconstructed at source
+ * level — the primitive a caller needs to tell an EXECUTED PROGRAM from a DATA
+ * OPERAND.
+ *
+ * 🔴 WHY POSITION, AND WHY A THIRD EXTRACTOR. `leafCommands` DROPS the words it
+ * cannot reduce to a literal, so `"$GUARD" --flag` yields `["--flag"]` — a
+ * dynamic head silently promotes an argument into head position, which is worse
+ * than useless to a positional reader. `leafCommandsNormalized` skips such a leaf
+ * outright AND basenames the head, so `./hooks/x.sh` loses the path a file
+ * resolver needs. This one keeps every word in its slot (an unreconstructable
+ * word becomes `""`) and keeps the head's spelling.
+ *
+ * Wrappers are still resolved through (`env FOO=1 bash x.sh` → `bash x.sh`)
+ * using the same wrapper table as the normalized extractor, not a second copy.
+ *
+ * 🔴 ONLY THE LEAVES THAT UNCONDITIONALLY RUN, and this used to be a blanket
+ * `Walk` over every `CallExpr` in the tree. A syntactic leaf is not an executed
+ * command: `false && bash hooks/pre.sh` and `true || bash hooks/pre.sh` never run
+ * the hook, and `if false; then bash hooks/x.sh; fi` and a function BODY do not
+ * run at all where they are written — yet all four were reported as executed
+ * programs. For the one caller (coverage attribution) that is a FALSE GRANT: a
+ * hook credited with a run that never happened. Same class as attributing a data
+ * operand, one level up in the grammar.
+ *
+ * So the tree is DESCENDED, not walked, and only through positions whose children
+ * always execute: a statement list, both sides of a PIPELINE, a subshell, a
+ * block. `&&`/`||` contribute their LEFT side only — the right is conditional.
+ * Every other construct (`if`, `while`, `until`, `for`, `case`, a function
+ * declaration, `time`, …) is not entered at all: whether its body ran is a
+ * runtime fact this parse cannot have, and abstaining costs one warning while
+ * guessing costs a false claim that something was tested.
+ *
+ * ⚠️ THE MEASURED COST, stated rather than assumed: `cd /repo && bash hooks/x.sh`
+ * now yields NOTHING, because the hook sits on the right of `&&`. That idiom has
+ * a first-class replacement — `runHook(cmd, event, { cwd })` — which is how this
+ * repo's own examples already write it.
+ *
+ * Parse failure → `[]`.
+ */
+export declare function leafArgvSource(command: string): string[][];
 //# sourceMappingURL=bash-effects.d.ts.map

package/dist/core/bash-effects.js

@@ -28,6 +28,7 @@ exports.classifyBashCommand = classifyBashCommand;
 exports.isReadOnlyBash = isReadOnlyBash;
 exports.leafCommands = leafCommands;
 exports.leafCommandsNormalized = leafCommandsNormalized;
+exports.leafArgvSource = leafArgvSource;
 // mvdan-sh is a CJS package (GopherJS build) with no bundled TypeScript types.
 // The project compiles to CommonJS (Node16, no "type":"module"), so plain
 // require() works and is the idiomatic pattern here (see linters.ts).
@@ -719,6 +720,283 @@ function leafCommandsNormalized(command) {
     });
     return out;
 }
+/**
+ * Reconstruct a Word's SOURCE-level text: quotes unwrapped, parameter references
+ * kept verbatim (`${CLAUDE_PROJECT_DIR}` → `$CLAUDE_PROJECT_DIR`). `null` when a
+ * segment cannot be reconstructed at all (command substitution, arithmetic,
+ * process substitution).
+ *
+ * The twin of {@link normalizeParts}, and deliberately NOT the same function.
+ * `normalizeParts` answers "what OPERATION is this" and therefore collapses
+ * `$HOME` to `~` and gives up on every other parameter; a caller that needs the
+ * PATH a word names can use neither behaviour — `$CLAUDE_PROJECT_DIR/.claude/hooks/x.sh`
+ * has to survive as written, because a file resolver matches it by suffix.
+ */
+function sourceParts(parts) {
+    if (!parts)
+        return null;
+    let out = "";
+    for (const p of parts) {
+        const t = sh.syntax.NodeType(p);
+        if (t === "Lit" || t === "SglQuoted") {
+            out += p.Value ?? "";
+        }
+        else if (t === "DblQuoted") {
+            const inner = sourceParts(p.Parts);
+            if (inner === null)
+                return null;
+            out += inner;
+        }
+        else if (t === "ParamExp") {
+            const name = p.Param?.Value;
+            if (!name)
+                return null;
+            out += `$${name}`;
+        }
+        else {
+            return null; // CmdSubst / ArithmExp / ProcSubst / … → unreconstructable
+        }
+    }
+    return out;
+}
+/**
+ * Every simple command's argv, POSITIONALLY, each word reconstructed at source
+ * level — the primitive a caller needs to tell an EXECUTED PROGRAM from a DATA
+ * OPERAND.
+ *
+ * 🔴 WHY POSITION, AND WHY A THIRD EXTRACTOR. `leafCommands` DROPS the words it
+ * cannot reduce to a literal, so `"$GUARD" --flag` yields `["--flag"]` — a
+ * dynamic head silently promotes an argument into head position, which is worse
+ * than useless to a positional reader. `leafCommandsNormalized` skips such a leaf
+ * outright AND basenames the head, so `./hooks/x.sh` loses the path a file
+ * resolver needs. This one keeps every word in its slot (an unreconstructable
+ * word becomes `""`) and keeps the head's spelling.
+ *
+ * Wrappers are still resolved through (`env FOO=1 bash x.sh` → `bash x.sh`)
+ * using the same wrapper table as the normalized extractor, not a second copy.
+ *
+ * 🔴 ONLY THE LEAVES THAT UNCONDITIONALLY RUN, and this used to be a blanket
+ * `Walk` over every `CallExpr` in the tree. A syntactic leaf is not an executed
+ * command: `false && bash hooks/pre.sh` and `true || bash hooks/pre.sh` never run
+ * the hook, and `if false; then bash hooks/x.sh; fi` and a function BODY do not
+ * run at all where they are written — yet all four were reported as executed
+ * programs. For the one caller (coverage attribution) that is a FALSE GRANT: a
+ * hook credited with a run that never happened. Same class as attributing a data
+ * operand, one level up in the grammar.
+ *
+ * So the tree is DESCENDED, not walked, and only through positions whose children
+ * always execute: a statement list, both sides of a PIPELINE, a subshell, a
+ * block. `&&`/`||` contribute their LEFT side only — the right is conditional.
+ * Every other construct (`if`, `while`, `until`, `for`, `case`, a function
+ * declaration, `time`, …) is not entered at all: whether its body ran is a
+ * runtime fact this parse cannot have, and abstaining costs one warning while
+ * guessing costs a false claim that something was tested.
+ *
+ * ⚠️ THE MEASURED COST, stated rather than assumed: `cd /repo && bash hooks/x.sh`
+ * now yields NOTHING, because the hook sits on the right of `&&`. That idiom has
+ * a first-class replacement — `runHook(cmd, event, { cwd })` — which is how this
+ * repo's own examples already write it.
+ *
+ * Parse failure → `[]`.
+ */
+function leafArgvSource(command) {
+    let file;
+    try {
+        file = sh.syntax.NewParser().Parse(command, "cmd.sh");
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    const emit = (node) => {
+        if (!node.Args?.length)
+            return;
+        const argv = node.Args.map((w) => sourceParts(w.Parts) ?? "");
+        // `command -v x` DESCRIBES x; it does not run it. Without this the wrapper
+        // table unwrapped both words and the operand looked executed.
+        if (inspectsOnly(argv))
+            return;
+        // The wrapper table keys on the BASENAME head (`/usr/bin/env` is `env`), so
+        // detection runs on a basenamed copy while the returned words stay verbatim.
+        // Wrappers only ever drop words off the FRONT, so a count maps the result
+        // back onto the original spellings.
+        const probe = [normalizeHead(argv[0] ?? ""), ...argv.slice(1)];
+        const dropped = probe.length - stripWrappers(probe).argv.length;
+        out.push(argv.slice(dropped));
+    };
+    // Both return TRUE when control provably does not continue past this node in
+    // the ENCLOSING shell — the list stops there.
+    const stmts = (list) => {
+        for (const st of list ?? [])
+            if (descend(st))
+                return true;
+        return false;
+    };
+    const descend = (node) => {
+        if (!node)
+            return false;
+        switch (sh.syntax.NodeType(node)) {
+            case "Stmt":
+                // `cmd &` runs in a background SUBSHELL, so a terminator inside it never
+                // reaches this shell (measured: `exit 0 & ./x.sh` runs `./x.sh`).
+                return descend(node.Cmd) && node.Background !== true;
+            case "CallExpr":
+                emit(node);
+                return terminates(node);
+            case "BinaryCmd":
+                // `&&` (10) and `||` (11) short-circuit, so only X is certain; a
+                // PIPELINE (`|` 12, `|&` 13) runs both sides.
+                if (node.Op === PIPE_OP || node.Op === PIPE_ALL_OP) {
+                    descend(node.X);
+                    descend(node.Y);
+                    // Each side of a pipeline is its own subshell — `exit 0 | cat; ./x.sh`
+                    // runs `./x.sh` (measured).
+                    return false;
+                }
+                return descend(node.X);
+            case "Subshell":
+                stmts(node.Stmts);
+                return false; // `( exit 0 ); ./x.sh` runs `./x.sh` (measured)
+            case "Block":
+                return stmts(node.Stmts); // `{ exit 0; }; ./x.sh` does NOT (measured)
+            case "FuncDecl":
+                // A declaration executes nothing, so it neither contributes leaves nor
+                // terminates: `f() { exit 0; }; ./x.sh` runs `./x.sh` (measured).
+                return false;
+            default:
+                // A conditional or deferred body — not entered, because whether it ran
+                // is a runtime fact this parse cannot have. But whether control REACHES
+                // the next statement is a separate question, and if the body can
+                // terminate the shell the answer is unknown, so the list stops here.
+                return mayTerminate(node);
+        }
+    };
+    stmts(file.Stmts);
+    return out;
+}
+/**
+ * Does this simple command end the shell, so that nothing after it in the same
+ * list runs? MEASURED against bash 5.2 and dash on 2026-08-12 — the numbers and
+ * the disagreement below are why this is not read off a POSIX table:
+ *
+ * ```
+ *                                     bash            dash
+ * exit 0; ./x.sh                      x NOT run       x NOT run
+ * return 0; ./x.sh                    x RAN (+error)  x NOT run
+ * exec ./x.sh; echo AFTER             AFTER not run   AFTER not run
+ * exec > /dev/null; ./x.sh            x RAN           x RAN
+ * ```
+ *
+ *  - `exit` — unconditional, both shells.
+ *  - `return` — the two shells DISAGREE at top level: bash prints "can only
+ *    `return' from a function or sourced script" and carries on; dash stops.
+ *    `leafArgvSource` never enters a `FuncDecl`, so every `return` it can see is
+ *    one of those top-level ones. Where the shells disagree the rule is to
+ *    abstain, and for a coverage probe abstaining means NOT crediting what
+ *    follows — so it truncates. Under bash that under-credits by one line; the
+ *    other choice would be a false grant under `/bin/sh`, which is the shell
+ *    `spawnSync(..., { shell: true })` actually uses.
+ *  - `exec` — only with a command. `exec > file` (redirections and nothing else)
+ *    just rewires the current shell and execution continues; that is the neighbour
+ *    this rule would most easily get wrong, and the measurement above is why it
+ *    does not. The exec'd program itself is emitted as a leaf like any other.
+ */
+function terminates(call) {
+    const head = call.Args?.[0] ? getLiteral(call.Args[0]) : null;
+    if (head === "exit" || head === "return")
+        return true;
+    // `exec` with at least one more word. A word that is only an option
+    // (`exec -c`) counts too: mistaking it for a terminator drops later leaves,
+    // which is the silent direction.
+    return head === "exec" && (call.Args?.length ?? 0) > 1;
+}
+/**
+ * Could this un-entered construct end the shell? A conservative YES stops the
+ * statement list, because `if [ -z "$X" ]; then exit 1; fi; bash hooks/x.sh` does
+ * not necessarily reach the hook (measured: with the branch taken, `./x.sh` does
+ * NOT run).
+ *
+ * Deliberately conservative in the direction of SILENCE: an `exit` that could
+ * only ever run inside a nested subshell still stops the list, costing one
+ * coverage line. The common guard shape is untouched — a conditional containing
+ * no terminator answers `false`, so `if …; then echo warn; fi; bash hooks/x.sh`
+ * still attributes the hook.
+ */
+function mayTerminate(node) {
+    let found = false;
+    sh.syntax.Walk(node, (n) => {
+        if (found)
+            return false;
+        // A function BODY is not executed where it is written, so a `return`/`exit`
+        // inside one says nothing about control here.
+        if (sh.syntax.NodeType(n) === "FuncDecl")
+            return false;
+        if (sh.syntax.NodeType(n) === "CallExpr" && terminates(n))
+            found = true;
+        return !found;
+    });
+    return found;
+}
+/**
+ * Is this leaf an INSPECTION rather than an execution? Then it contributes no
+ * executed program, however script-shaped its operand.
+ *
+ * Same family as the interpreter's parse-only flags (`bash -n`, `node --check`):
+ * a word that turns "run this" into "tell me about this". Bash 5.2's own
+ * `help command`: *"Execute a simple command or display information about
+ * commands."*
+ *
+ * MEASURED, bash 5.2, with a marker file the script touches — `ran` is whether
+ * the operand actually executed:
+ *
+ * ```
+ *   command -v ./pre.sh     ran=no    prints ./pre.sh
+ *   command -V ./pre.sh     ran=no    prints "./pre.sh is ./pre.sh"
+ *   command -pv ./pre.sh    ran=no
+ *   command -vp ./pre.sh    ran=no
+ *   command -Vp ./pre.sh    ran=no
+ *   command -p ./pre.sh     ran=YES   ← -p is a PATH choice, not an inspection
+ *   command ./pre.sh        ran=YES
+ * ```
+ *
+ * ⚠️ THE REST OF THE WRAPPER TABLE WAS ASKED THE SAME QUESTION, and `command` is
+ * the only member with an inspect-only mode. Run against this build, the
+ * neighbours the finding names attribute NOTHING ALREADY — not by a rule, but
+ * because they are not wrappers at all, so their operand is never reached:
+ *
+ * ```
+ *   commandRefs("type hooks/pre.sh")   → []      (ran=no)
+ *   commandRefs("which hooks/pre.sh")  → []      (ran=no)
+ *   commandRefs("hash hooks/pre.sh")   → []      (ran=no)
+ * ```
+ *
+ * `sudo -v` (validate) and `sudo -l` (list) take no command operand, so there is
+ * nothing to attribute; `xargs -t` PRINTS what it runs and then runs it, so it
+ * is not an inspection. Deliberately left out: `env`, `nice`, `timeout`,
+ * `nohup` — none has an inspect mode (`--help`/`--version` exit without an
+ * operand, so they cannot misattribute one).
+ *
+ * ⚠️ SCOPED TO THE COVERAGE EXTRACTOR ON PURPOSE. `leafArgvSource` has exactly
+ * one caller and it is attribution; the SAFETY extractor (`leafCommands`, a
+ * blanket walk) is untouched, keeping the opposite default established when the
+ * statement-list truncation landed.
+ */
+function inspectsOnly(argv) {
+    if (normalizeHead(argv[0] ?? "") !== "command")
+        return false;
+    for (const w of argv.slice(1)) {
+        if (!w.startsWith("-") || w === "-")
+            return false; // reached the operand
+        if (w === "--")
+            return false;
+        if (/^-[pvV]+$/.test(w) && /[vV]/.test(w))
+            return true;
+    }
+    return false;
+}
+/** `BinaryCmd.Op` for `|` and `|&` — the two that run BOTH sides. */
+const PIPE_OP = 12;
+const PIPE_ALL_OP = 13;
 /** Normalize a Stmt's redirections into {@link LeafRedirect}s (source order). */
 function normalizeRedirects(redirs) {
     return redirs.map((r) => {

package/dist/core/foreign-runner.d.ts

@@ -0,0 +1,185 @@
+/**
+ * Refuse to spend model calls when somebody else's test runner owns this process.
+ *
+ * ## The failure this removes
+ *
+ * A vigiles eval spawns `claude` and spends real money. It is meant to run on a
+ * schedule, from `vigiles eval`. But an author who names one `foo.test.mjs` — a
+ * name vigiles used to CREDIT as coverage — hands it to every default `npx vitest`
+ * / `npx jest` run in the repository, because that name matches their default
+ * patterns exactly (read out of the installed packages):
+ *
+ *   vitest  ** /*.{test,spec}.?(c|m)[jt]s?(x)
+ *   jest    ** /?(*.)+(spec|test).?([mc])[jt]s?(x)
+ *           ** /__tests__/** /*.?([mc])[jt]s?(x)   ← everything in that directory
+ *
+ * Measured 2026-08-11: a bare project with `.claude/skills/foo/foo.test.mjs` and a
+ * plain `npx vitest run` — it executed. "It lives under a dot-directory, nothing
+ * else will find it" is false. The bill arrives silently, on every push, in CI.
+ *
+ * The naming half is fixed elsewhere (those globs no longer count). This is the
+ * part that does not depend on anybody obeying a convention: the money cannot be
+ * spent from inside a foreign runner, whatever the file is called.
+ *
+ * ## 🪦 THE STATIC HALF WAS DELETED 2026-08-12, AND THIS IS NOW THE WHOLE DEFENCE
+ *
+ * There used to be a companion, `core/foreign-runner-tests.ts`: a lexical gate
+ * that read every file under a harness surface dir, decided FROM THE TEXT whether
+ * it drives an agent (`runEval(`, `runHarnessTest(`, …), and warned in the audit
+ * report when a default vitest/jest glob would collect it. It is gone, with its
+ * test file and the disk walker in `scan.ts` that fed it.
+ *
+ * It was deleted under a rule that file pre-registered, not on a whim:
+ *
+ * > A seventh false positive is not another bug to fix — it is the measurement
+ * > saying the lexical rule cannot be made tight enough, and the answer then is
+ * > to DELETE the gate and let the money guard be the whole defence.
+ *
+ * THE SEVENTH ARRIVED: `function testDriver(runEval) { runEval(fake); }`. The
+ * binding check looked at declarations and import aliases but never at PARAMETER
+ * lists, so an ordinary offline unit test injecting a fake was reported as
+ * spawning a real agent. Run, not argued — the gate over one file of that shape
+ * returned one finding, whose warning read *"It calls `runEval`, which spawns an
+ * agent"* and told the author to rename the file. That sentence was false about
+ * that file.
+ *
+ * Six shapes had already been narrowed away one at a time, and this one had been
+ * SELF-DISCLOSED in the file as a known residual ("costs one warning and needs a
+ * scope analysis this module cannot have"). Pre-disclosure is not a defence: a
+ * pre-registered stopping rule exists precisely to stop "we know, it is
+ * acceptable" from running forever, so the count was honoured rather than
+ * reasoned around.
+ *
+ * The measurement agreed independently. Across three corpora (this repo, a
+ * 43-harness consumer repo, five vendored third-party plugin repos — 3 613 js/ts
+ * files), and re-measured at deletion time over this repo's 941 files:
+ *
+ *   true positives, ever                                            0
+ *   distinct false-positive shapes reported                         7
+ *
+ * Its only demonstrated effect on a real repository was an effect of NOT firing.
+ * Every error it made was the expensive kind: the remedy it printed is "rename
+ * this file", so a false warning costs someone a working test, while a missed
+ * warning costs nothing — the refusal below already fires at all four spawn doors
+ * (`judge.ts`, `eval.ts`, `scan-behavioral.ts`, `adapters/codex/eval.ts`), so a
+ * miss is at most a less friendly notice, never a bill.
+ *
+ * ⚠️ WHAT IS GENUINELY LOST: the early, report-time heads-up. An author who names
+ * a harness test `foo.test.mjs` now learns it at the refusal below rather than in
+ * the audit. That is the trade, made knowingly — an advisory that has never once
+ * been right is not worth a warning that has been wrong seven times.
+ *
+ * The removal is PINNED, not merely done: `scan-vendor.test.ts` still asserts that
+ * no `COLLECTS AND EXECUTES` warning appears on the vendored corpus, so bringing
+ * the gate back fails a test instead of passing silently.
+ *
+ * ## Why not an environment variable
+ *
+ * The obvious version is `process.env.VITEST`. It was proposed and rejected: that
+ * variable can sit in a `.env` or in a CI environment for unrelated reasons, and
+ * then a legitimate scheduled eval refuses to run — a guard that fires on correct
+ * input is a guard people delete.
+ *
+ * `process.argv[1]` is the path node was actually started with, which no stray
+ * configuration can forge. Measured, same spike:
+ *
+ *   under `npx vitest run`   → …/node_modules/vitest/dist/workers/forks.js
+ *   under `node foo.eval.mjs`→ …/foo.eval.mjs
+ *   under `vigiles eval`     → the script vigiles spawned
+ *
+ * So the check is a POSITIVE identification of a known runner, not "am I the entry
+ * point". Positive is the conservative direction here: an unrecognised wrapper
+ * runs (and may cost money) rather than a legitimate run being blocked by a
+ * pattern nobody predicted.
+ *
+ * ## 🔴 `node --test` HAS NO argv SIGNAL AT ALL, and the line that claimed one
+ * was dead from the day it was written
+ *
+ * `["node --test", ["node_modules/.bin/node--test"]]` used to sit in the table
+ * below. It was added by analogy with the npx-installed runners and never
+ * measured. There is no such binary: Node's test runner is a FLAG on node
+ * itself, so nothing under `node_modules/.bin/` can appear in `argv[1]`, and the
+ * entry could not fire under any invocation. That is worse than its absence — it
+ * READ as coverage while the paid tier stayed reachable from a legacy harness
+ * named `*.test.mjs`, a name Node's own default patterns collect.
+ *
+ * Measured 2026-08-12 (Node 22.22, a fixture printing its own process facts):
+ *
+ *   node --test foo.test.mjs
+ *     argv[1]           = /abs/foo.test.mjs   ← the TEST FILE, no runner in sight
+ *     execArgv          = []                  ← the flag is not here either
+ *     NODE_TEST_CONTEXT = child-v8            ← the only signal
+ *
+ *   node --test --experimental-test-isolation=none foo.test.mjs
+ *     argv[1]           = foo.test.mjs
+ *     execArgv          = ["--test", "--experimental-test-isolation=none"]
+ *     NODE_TEST_CONTEXT = undefined           ← in-process: no child, no var
+ *
+ * The two modes therefore need two different facts, and both are read here.
+ *
+ * ⚠️ THIS IS NOT THE `process.env.VITEST` IDIOM REJECTED ABOVE, and the
+ * difference is the reason it is allowed. `VITEST` is a USER-VISIBLE CONVENTION:
+ * a person can put it in a `.env` or a CI job for unrelated reasons, so a guard
+ * reading it fires on correct input. `NODE_TEST_CONTEXT` is set by NODE ITSELF in
+ * the child it spawns — the internal protocol between runner and test process,
+ * which nobody writes into their own environment. Same for `execArgv`: the flag
+ * list node was launched with (`--test` is explicitly refused inside
+ * `NODE_OPTIONS` — verified — so it cannot arrive from a stray env either). Do
+ * not "fix" this back into an argv fragment: for `node --test` an argv signal
+ * does not exist, so the choice is these facts or no detection at all.
+ *
+ * Pure: facts in, a name or null out. No process access, no filesystem.
+ */
+/**
+ * The process facts identifying Node's own test runner, which leaves no trace in
+ * `argv[1]`. Passed in rather than read, so the decision stays pure.
+ */
+export interface NodeTestFacts {
+    /** `process.execArgv` — carries `--test` when the runner is IN-PROCESS. */
+    readonly execArgv?: readonly string[];
+    /** `process.env.NODE_TEST_CONTEXT` — node sets it in the test CHILD it spawns. */
+    readonly nodeTestContext?: string | undefined;
+}
+/**
+ * The foreign test runner that started this process, or `null`.
+ *
+ * `argv1` is `process.argv[1]`; `node` carries the two facts that identify Node's
+ * built-in runner (see the header). Both are passed in rather than read, so the
+ * decision is a pure function the tests drive with values measured from real runs.
+ */
+export declare function foreignRunner(argv1: string | undefined, node?: NodeTestFacts): string | null;
+/**
+ * The refusal message. Separate from the check so a test can assert the WORDS —
+ * a guard that stops a run without saying what to do instead is a support ticket.
+ */
+export declare function foreignRunnerRefusal(runner: string, what: string): string;
+/**
+ * Refuse to spend model budget when a foreign test runner started this process.
+ *
+ * 🔴 CALL THIS AT EVERY REAL-MODEL SPAWN. It used to live privately in `eval.ts`
+ * and be called from exactly one place — `spawnAgent`, the real `claude` runner —
+ * on the reasoning that the composition root funnels every paid path. Measured
+ * 2026-08-12: it funnels ONE of four.
+ *
+ *   src/eval.ts               spawn(claudeCodeRuntime.agentBinary)  guarded
+ *   src/adapters/codex/eval.ts  spawnSync("codex", …)               UNGUARDED
+ *   src/judge.ts                spawnSync("claude", …)              UNGUARDED
+ *   src/scan-behavioral.ts      spawnSync("claude", …)              UNGUARDED
+ *
+ * `measureTriggerRate(spec, { evalDriver })` calls the injected driver's runner
+ * DIRECTLY, so a Codex eval collected by a stray `npx vitest run` spent real
+ * money on every push while the guard looked complete. The irony is worth
+ * recording: the untested-skill nudge now tells Codex users to pass
+ * `{ evalDriver }` — the product recommends the shape that bypassed the guard.
+ *
+ * Lives here, in a module that imports NOTHING, so any adapter can call it
+ * without a cycle. `foreignRunner` stays pure; this is the one impure wrapper,
+ * and it is impure precisely so callers cannot forget to pass the facts.
+ *
+ * ⚠️ CALL IT OUTSIDE ANY `try` THAT SWALLOWS. `judge` and `deriveAttackReal` both
+ * wrap their spawn in `try { … } catch { return fallback }`, so a refusal thrown
+ * inside would be caught and downgraded to a score of 0 / a canned string — a
+ * silent wrong answer instead of a stop. Both call it before the `try`.
+ */
+export declare function refuseUnderForeignRunner(what: string): void;
+//# sourceMappingURL=foreign-runner.d.ts.map