vigiles 16.0.1 → 16.1.0

package/dist/core/compile.js

@@ -654,6 +654,14 @@ function renderSkillFrontmatter(spec, profile = "claude-code") {
             // ambiguous scalar, so the restriction was lost on the CC round-trip. (#107)
             fm.push(`allowed-tools: [${spec.tools.join(", ")}]`);
         }
+        if (spec.disallowedTools && spec.disallowedTools.length > 0) {
+            // 🔴 `disallowed-tools`, HYPHENATED — that is a skill's fence. A subagent's
+            // key is `disallowedTools:` (camelCase) and a different reader parses it, so
+            // writing the agent spelling here emits a key nothing looks at: inert, and
+            // inert in the direction that reads as protection. Same class as the #107
+            // defect two lines up, where `tools:` on a skill silently lost the contract.
+            fm.push(`disallowed-tools: [${spec.disallowedTools.join(", ")}]`);
+        }
     }
     fm.push("", "---");
     return fm.join("\n");
@@ -779,6 +787,15 @@ function compileSkill(spec, options = {}) {
             errors.push({ type: "purity-violation", message: v.message });
         }
     }
+    // A fence entry that is a close typo of a real tool blocks NOTHING while reading
+    // as protection — the same high-precision check a subagent's `disallowedTools`
+    // gets. Skipped without a dialect, like the purity check above, because the tool
+    // catalog is what a typo is measured against.
+    if (spec.disallowedTools && options.dialect) {
+        for (const issue of (0, tool_contract_js_1.disallowedToolIssues)(spec.disallowedTools, options.dialect)) {
+            errors.push({ type: "unknown-tool", message: issue.message });
+        }
+    }
     const sections = renderSkillSections(spec);
     // Over-long inline code blocks are WARNINGS, not errors — they don't block
     // compilation (so adoption always compiles), just nudge toward file().

package/dist/core/spec.d.ts

@@ -448,6 +448,25 @@ export interface SkillSpec {
      * against that floor — compile rejects a tool looser than the declared level.
      */
     readonly tools?: readonly string[];
+    /**
+     * Tools this skill may NEVER use — rendered to the `disallowed-tools:`
+     * frontmatter key (hyphenated for skills; a subagent's key is `disallowedTools:`,
+     * and they are read by different parsers, so the spelling is not interchangeable).
+     *
+     * 🔴 This is NOT the symmetric twin of `tools` and the asymmetry is the whole
+     * reason it exists. `allowed-tools:` on a skill is a PRE-APPROVAL — it waives the
+     * permission prompt for what it lists and removes nothing from the pool, so a
+     * skill that declares only `Read` can still call `Bash`. `disallowed-tools:` is
+     * the only key measured to actually take a tool away. A skill without it inherits
+     * every tool the session grants, which is why `audit` reports each such skill as
+     * holding all three lethal-trifecta legs — including skills whose `tools` list
+     * looks tightly scoped.
+     *
+     * Entries are checked like a subagent's: a close typo of a real tool name blocks
+     * nothing and is reported, because a fence with a misspelled name reads as
+     * protection while granting everything.
+     */
+    readonly disallowedTools?: readonly string[];
     /**
      * Declare this skill's purity floor — compile rejects a tool contract looser
      * than it. `"pure"` allows only read-only tools; `"bounded"` also allows

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigiles",
-  "version": "16.0.1",
+  "version": "16.1.0",
   "description": "Audit, test and measure the harness your AI agent runs on — grade your CLAUDE.md / AGENTS.md, skills, subagents and hooks, run them against a scripted model, and measure whether they actually fire.",
   "keywords": [
     "claude-code",