vigiles 16.1.1 → 16.1.3

package/dist/core/bash-effects.js

@@ -29,6 +29,7 @@ exports.isReadOnlyBash = isReadOnlyBash;
 exports.leafCommands = leafCommands;
 exports.leafCommandsNormalized = leafCommandsNormalized;
 exports.leafArgvSource = leafArgvSource;
+exports.commandWords = commandWords;
 // mvdan-sh is a CJS package (GopherJS build) with no bundled TypeScript types.
 // The project compiles to CommonJS (Node16, no "type":"module"), so plain
 // require() works and is the idiomatic pattern here (see linters.ts).
@@ -1098,4 +1099,150 @@ function normalizeCallExpr(node, redirs) {
         chdir: stripped.chdir,
     };
 }
+// ===========================================================================
+// FILE-OPERAND extraction (the reference question, not the effect question)
+// ===========================================================================
+/**
+ * Interpreters, and the flags after which the NEXT word is a PROGRAM rather
+ * than a path. `node -e "<js>"`, `python -c "<py>"`, `perl -E "<pl>"`.
+ *
+ * Keyed by the head's basename, so `/usr/local/bin/node` and `node` behave the
+ * same.
+ */
+const INLINE_PROGRAM_FLAGS = new Map([
+    ["node", ["-e", "--eval", "-p", "--print"]],
+    ["nodejs", ["-e", "--eval", "-p", "--print"]],
+    ["bun", ["-e", "--eval", "-p", "--print"]],
+    ["deno", ["-e", "--eval", "-p", "--print"]],
+    ["python", ["-c"]],
+    ["python2", ["-c"]],
+    ["python3", ["-c"]],
+    ["ruby", ["-e"]],
+    ["perl", ["-e", "-E"]],
+    ["php", ["-r"]],
+]);
+/**
+ * Shells, whose `-c` argument is a nested SHELL program. Not program text to be
+ * discarded — program text to be PARSED, so `bash -c 'exec "$ROOT/hooks/x.sh"'`
+ * still yields its script.
+ */
+const SHELL_HEADS = new Set([
+    "sh",
+    "bash",
+    "zsh",
+    "dash",
+    "ksh",
+    "ash",
+    "busybox",
+]);
+/** Guard against a pathological `sh -c 'sh -c "sh -c …"'` nest. */
+const MAX_SHELL_NESTING = 3;
+/**
+ * Every word of every simple command in `command` that could name a FILE, with
+ * inline PROGRAM TEXT removed — the primitive behind "does this hook's script
+ * exist?".
+ *
+ * 🔴 WHY A FOURTH EXTRACTOR, stated against the three that already exist,
+ * because "there is already one that returns words" is exactly the reasoning
+ * that produced the bug this replaces.
+ *
+ *  - `leafCommands` drops every word it cannot reduce to a LITERAL, so
+ *    `${CLAUDE_PLUGIN_ROOT}/hooks/x.sh` — the standard spelling of a hook path —
+ *    disappears entirely. Unusable for a file question.
+ *  - `leafCommandsNormalized` basenames the head, so `./hooks/x.sh` becomes
+ *    `x.sh` and no resolver can find it.
+ *  - `leafArgvSource` keeps the spelling but answers a DIFFERENT question:
+ *    "which leaves unconditionally RUN". It drops the right-hand side of `&&`
+ *    by design, so `cd "$ROOT" && node hooks/x.mjs` yields no script. For
+ *    coverage attribution that abstention is correct; for "must this file
+ *    exist?" it is a miss, because a conditionally-run script still has to be
+ *    on disk.
+ *
+ * So this walks EVERY simple command, keeps every word at source level, and
+ * subtracts only the words that are provably not paths.
+ *
+ * 🔴 WHAT IT SUBTRACTS, and the defect that motivated it. The hook scanner used
+ * to run a regex over the raw command STRING. Against the standard portable
+ * plugin idiom —
+ *
+ *     node -e "(async()=>{…await import(…join(root,'hooks','always-on.mjs'))…})()"
+ *
+ * — it grabbed a character run ending at `.mjs` and reported the hook's script
+ * as `import(require(node:url).pathToFileURL(require(node:path).join(root,hooks,always-on.mjs`,
+ * MISSING. `hooks/always-on.mjs` was 1,766 bytes on disk. Nine such findings
+ * across the 32-repo corpus, contributing to two `F/0` grades. Inside a shell
+ * parse the argument of `-e` is not a word the shell will ever resolve to a
+ * file, so it is not returned.
+ *
+ * ⚠️ HOW MUCH OF THAT THE FLAG TABLE ACTUALLY DID, measured rather than
+ * assumed: none of it, on that corpus. Mutating the `-e`/`-c` subtraction OFF
+ * and re-auditing all three affected repos still yields ZERO false hook-script
+ * findings, because both real payloads are single words that either contain
+ * whitespace or do not end in a script extension, and the caller anchors its
+ * match to a whole word. The table is kept because it is the difference
+ * between a function whose contract ("words that could name a file") is true
+ * and one whose contract is merely true-so-far: without it a JavaScript
+ * program is handed to every caller as a candidate filename, and the next
+ * caller inherits the bug. Recorded here so nobody reads a corpus number back
+ * onto the wrong mechanism.
+ *
+ * Words beginning with `-` are dropped as flags: a flag is not a path, and the
+ * one caller anchors its match to a whole word anyway.
+ *
+ * Returns `null` — not `[]` — when the text does not parse as shell, so a
+ * caller can tell "no file operands" from "no analysis", and cannot silently
+ * treat the second as the first.
+ */
+function commandWords(command) {
+    return commandWordsAt(command, 0);
+}
+function commandWordsAt(command, depth) {
+    let file;
+    try {
+        file = sh.syntax.NewParser().Parse(command, "cmd.sh");
+    }
+    catch {
+        return null;
+    }
+    const out = [];
+    sh.syntax.Walk(file, (node) => {
+        if (sh.syntax.NodeType(node) === "CallExpr" && node.Args?.length)
+            fileOperandsOf(node.Args, depth, out);
+        return true;
+    });
+    return out;
+}
+/**
+ * The file-operand words of ONE simple command, appended to `out`.
+ *
+ * Wrappers are resolved through with the same table `leafArgvSource` uses (it
+ * keys on the BASENAME head, and wrappers only ever drop words off the FRONT,
+ * so a count maps the result back onto the original spellings — not a second
+ * copy of the rule). Flags never name a file, so they are dropped; the word
+ * AFTER an inline-program flag is dropped with them, and the word after a
+ * shell's `-c` is parsed as shell instead.
+ */
+function fileOperandsOf(args, depth, out) {
+    const raw = args.map((w) => sourceParts(w.Parts) ?? "");
+    const probe = [normalizeHead(raw[0] ?? ""), ...raw.slice(1)];
+    const argv = raw.slice(probe.length - stripWrappers(probe).argv.length);
+    const head = normalizeHead(argv[0] ?? "");
+    const programFlags = INLINE_PROGRAM_FLAGS.get(head);
+    const nestsShell = SHELL_HEADS.has(head) && depth < MAX_SHELL_NESTING;
+    for (let i = 0; i < argv.length; i++) {
+        const w = argv[i] ?? "";
+        if (w === "")
+            continue;
+        if (!w.startsWith("-")) {
+            out.push(w);
+            continue;
+        }
+        if (nestsShell && w === "-c") {
+            out.push(...(commandWordsAt(argv[++i] ?? "", depth + 1) ?? []));
+        }
+        else if (programFlags?.includes(w)) {
+            i++; // the program text — not a word any shell resolves to a file
+        }
+    }
+}
 //# sourceMappingURL=bash-effects.js.map

package/dist/core/compile.js

@@ -827,7 +827,12 @@ function compileSkill(spec, options = {}) {
  * detection lives in the shared `verifyToolContract` detector (one-detector-no-
  * drift: compile + scan + the subagent-tool-contract lint rule call the same code). */
 function validateAgentTools(tools, dialect) {
-    return (0, tool_contract_js_1.verifyToolContract)(tools, dialect).map((issue) => ({
+    // `authoringIssues` drops the `conditional` verdicts: `Agent`, `ExitPlanMode`
+    // and the foreground-only built-ins are REAL tools, legitimate to declare, and
+    // erroring on them is what made `tools: Agent, Read, Bash` — a worked example
+    // in the vendor's own docs — fail to compile. Everything else stays an error,
+    // because authoring your own spec is a closed world.
+    return (0, tool_contract_js_1.authoringIssues)((0, tool_contract_js_1.verifyToolContract)(tools, dialect)).map((issue) => ({
         type: "unknown-tool",
         message: issue.message,
     }));

package/dist/core/dialect.d.ts

@@ -22,6 +22,7 @@
  * Which SKILL.md frontmatter keys a harness understands — see
  * `HarnessDialect.skillFrontmatter`.
  */
+import type { HarnessVocabulary } from "./vocabulary.js";
 export type SkillFrontmatterProfile = "claude-code" | "minimal";
 export interface HarnessDialect {
     /** Stable identifier, e.g. "claude-code". */
@@ -83,5 +84,31 @@ export interface HarnessDialect {
      * Optional (additive, non-breaking) — absent ⇒ no tool is known-side-effecting.
      */
     readonly sideEffectingTools?: readonly string[];
+    /**
+     * The hook-event catalog as a {@link HarnessVocabulary} — a status and a
+     * recorded vendor capture per term, rather than bare membership in
+     * `hookEvents`. When present it is what `verifyHookEvents` classifies against,
+     * so a name the catalog doesn't hold produces an `unrecognised` ADVISORY
+     * (naming vigiles's capture as the possibly-stale party) instead of the old
+     * behaviour, where an unknown name drew an accusation or silence depending on
+     * its edit distance to the list.
+     *
+     * Optional (additive, non-breaking). Absent ⇒ one is synthesised from
+     * `hookEvents` via `vocabularyFromLists`, so a legacy adapter keeps working
+     * and its unknowns become advisories rather than silence.
+     */
+    readonly hookEventVocabulary?: HarnessVocabulary;
+    /**
+     * The subagent-tool catalog as a {@link HarnessVocabulary}. Same contract as
+     * `hookEventVocabulary`; absent ⇒ synthesised from `builtinAgentTools`
+     * (available) + `neverAvailableTools` (withheld).
+     *
+     * The third status is why this exists: the vendor removes `Agent` only at the
+     * spawn depth limit and `ExitPlanMode` only outside plan mode, and removes
+     * most built-ins from a background subagent but not a foreground one — so
+     * "available to a subagent" is not a property of the name, and a two-way
+     * split had to encode one of those conditions as an unconditional fact.
+     */
+    readonly subagentToolVocabulary?: HarnessVocabulary;
 }
 //# sourceMappingURL=dialect.d.ts.map

package/dist/core/hook-events.d.ts

@@ -4,31 +4,48 @@
  * (`PreToolUse`, `SessionStart`, …); a TYPO (`PreToolUSe`) means the hook
  * silently never fires — a dead registration no generic JSON linter catches.
  *
- * Like the tool catalog, the event set is NOT closed in practice: frameworks
- * extend it (TheBushidoCollective/han ships a custom runtime with `TeammateIdle`,
- * `WorktreeRemove`, … in its own `hooks.json`). So the audit path (scan/lint) is
- * HIGH-PRECISION — `confidentHookEventIssues` keeps only a close typo
- * (a did-you-mean within edit distance 2), never a bare unrecognized event that
- * may be a custom/future one. ONE detector (one-detector-no-drift): scan + the
- * `hook-events` lint rule call the same code. Dialect injected (core ⊄ adapter).
+ * The event set is NOT closed in practice: the vendor keeps adding events, and
+ * frameworks ship custom runtimes with their own (TheBushidoCollective/han fires
+ * `TeammateIdle`, `WorktreeRemove`, … from its own `hooks.json` — both of which
+ * have since become real Claude Code events). This check used to handle that by
+ * reporting an unknown event ONLY when it sat within edit distance 2 of a known
+ * one. That is not a confidence signal, and it failed both ways at once:
+ * `Setup`, a documented event, was accused of never firing and told to become
+ * `Stop`; twenty-one other documented events drew nothing, because they happened
+ * to be further than two characters from anything in a nine-name list.
+ *
+ * Now every name is CLASSIFIED against the dialect's vocabulary
+ * (`core/vocabulary.ts`) and every verdict is reported — with the severity
+ * coming from the verdict rather than from the caller. An event vigiles doesn't
+ * hold is an `advisory` that names vigiles's own capture as the thing that may
+ * be stale; it is surfaced and never scored, so a newer or custom event cannot
+ * cost anyone a grade. ONE detector (one-detector-no-drift): scan + the
+ * `hook-events` lint rule + compiled-hook `on:` validation call the same code.
+ * Dialect injected (core ⊄ adapter).
  */
 import type { HarnessDialect } from "./dialect.js";
+import { type HarnessVocabulary, type IssueSeverity, type TermVerdict } from "./vocabulary.js";
 export interface HookEventIssue {
     readonly event: string;
-    /** Closest known event (did-you-mean), or null. */
+    /** Which vocabulary verdict produced this — the input to every policy. */
+    readonly verdict: TermVerdict["kind"];
+    /** Closest known event (did-you-mean), or null. Message decoration only. */
     readonly suggestion: string | null;
+    /** `"scored"` counts toward the grade; `"advisory"` never does. */
+    readonly severity: IssueSeverity;
     readonly message: string;
 }
 /**
- * The HIGH-CONFIDENCE subset (what scan / lint act on): only an unrecognized
- * event that's a close typo of a real one. A bare unknown (no near match) is
- * likely a framework/custom event, not a defect — never flagged when auditing.
+ * The event vocabulary this dialect verifies against — its declared one, else a
+ * synthesised one built from the flat `hookEvents` list so an adapter that
+ * predates vocabularies keeps working.
  */
-export declare function confidentHookEventIssues(issues: readonly HookEventIssue[]): HookEventIssue[];
+export declare function hookEventVocabulary(dialect: HarnessDialect): HarnessVocabulary;
 /**
- * Verify hook-event names against the dialect catalog. Returns one issue per
- * unrecognized event. Like the tool-contract check, a suggestion (edit distance
- * ≤ 2) is the confidence signal that an unknown is really a typo of a real event.
+ * Verify hook-event names against the dialect vocabulary. Returns one issue per
+ * name that isn't plainly available, each already carrying its severity — see
+ * {@link scoredIssues} / {@link advisoryIssues} to split them.
  */
 export declare function verifyHookEvents(events: readonly string[], dialect: HarnessDialect): HookEventIssue[];
+export { scoredIssues, advisoryIssues, authoringIssues } from "./vocabulary.js";
 //# sourceMappingURL=hook-events.d.ts.map

package/dist/core/hook-events.js

@@ -1,48 +1,42 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.confidentHookEventIssues = confidentHookEventIssues;
+exports.authoringIssues = exports.advisoryIssues = exports.scoredIssues = void 0;
+exports.hookEventVocabulary = hookEventVocabulary;
 exports.verifyHookEvents = verifyHookEvents;
-const edit_distance_js_1 = require("./edit-distance.js");
-/** Closest known hook event by edit distance (≤ 2) — a confidence signal. */
-function closestEvent(event, dialect) {
-    let best = null;
-    let bestDistance = Infinity;
-    for (const known of dialect.hookEvents) {
-        const d = (0, edit_distance_js_1.editDistance)(event.toLowerCase(), known.toLowerCase());
-        if (d < bestDistance) {
-            bestDistance = d;
-            best = known;
-        }
-    }
-    return bestDistance <= 2 ? best : null;
-}
+const vocabulary_js_1 = require("./vocabulary.js");
 /**
- * The HIGH-CONFIDENCE subset (what scan / lint act on): only an unrecognized
- * event that's a close typo of a real one. A bare unknown (no near match) is
- * likely a framework/custom event, not a defect — never flagged when auditing.
+ * The event vocabulary this dialect verifies against — its declared one, else a
+ * synthesised one built from the flat `hookEvents` list so an adapter that
+ * predates vocabularies keeps working.
  */
-function confidentHookEventIssues(issues) {
-    return issues.filter((i) => i.suggestion !== null);
+function hookEventVocabulary(dialect) {
+    return (dialect.hookEventVocabulary ??
+        (0, vocabulary_js_1.vocabularyFromLists)(`${dialect.name} hook event`, `${dialect.name} adapter (no recorded capture)`, dialect.hookEvents));
 }
 /**
- * Verify hook-event names against the dialect catalog. Returns one issue per
- * unrecognized event. Like the tool-contract check, a suggestion (edit distance
- * ≤ 2) is the confidence signal that an unknown is really a typo of a real event.
+ * Verify hook-event names against the dialect vocabulary. Returns one issue per
+ * name that isn't plainly available, each already carrying its severity — see
+ * {@link scoredIssues} / {@link advisoryIssues} to split them.
  */
 function verifyHookEvents(events, dialect) {
-    const known = new Set(dialect.hookEvents);
+    const vocab = hookEventVocabulary(dialect);
     const issues = [];
     for (const event of events) {
-        if (known.has(event))
+        const issue = (0, vocabulary_js_1.termIssue)(vocab, (0, vocabulary_js_1.classify)(vocab, event), "Hook event", "a hook here never fires");
+        if (issue === null)
             continue;
-        const near = closestEvent(event, dialect);
-        const hint = near ? ` Did you mean "${near}"?` : "";
         issues.push({
             event,
-            suggestion: near,
-            message: `Unknown hook event "${event}" — a hook here never fires. Valid events: ${dialect.hookEvents.join(", ")}.${hint}`,
+            verdict: issue.verdict,
+            suggestion: issue.suggestion,
+            severity: issue.severity,
+            message: issue.message,
         });
     }
     return issues;
 }
+var vocabulary_js_2 = require("./vocabulary.js");
+Object.defineProperty(exports, "scoredIssues", { enumerable: true, get: function () { return vocabulary_js_2.scoredIssues; } });
+Object.defineProperty(exports, "advisoryIssues", { enumerable: true, get: function () { return vocabulary_js_2.advisoryIssues; } });
+Object.defineProperty(exports, "authoringIssues", { enumerable: true, get: function () { return vocabulary_js_2.authoringIssues; } });
 //# sourceMappingURL=hook-events.js.map

package/dist/core/hook-program.js

@@ -679,11 +679,19 @@ function compileHookProgram(source, hook, opts = {}) {
                 `regex (that is why "Edit|Write" works), so it must parse as one.`);
         }
     }
-    // A hook registered under an event the harness never fires is dead — reject it.
+    // A hook registered under an event the harness never fires is dead — reject
+    // it. AUTHORING is a closed world (you are writing this hook now, against the
+    // vigiles you have), so an unrecognised event is still an error — the typo
+    // guarantee this exists for. What changed on 2026-08-17 is the catalog it
+    // asks: this used to throw on `Setup`, `PostCompact`, `ConfigChange` and 19
+    // other REAL events, because vigiles held 9 of the vendor's 31. The fix is the
+    // right vocabulary, not a weaker check. A genuinely newer event still fails
+    // here, and now says so — the message names vigiles's capture as the thing
+    // that may be stale, instead of asserting the event does not exist.
     if (opts.dialect) {
-        const issues = (0, hook_events_js_1.verifyHookEvents)([on], opts.dialect);
-        if (issues.length > 0) {
-            throw new HookCompileError(issues[0].message);
+        const fatal = (0, hook_events_js_1.authoringIssues)((0, hook_events_js_1.verifyHookEvents)([on], opts.dialect));
+        if (fatal.length > 0) {
+            throw new HookCompileError(fatal[0].message);
         }
     }
     // A `needs` entry that isn't a built-in provider never resolves — reject it

package/dist/core/markdown.d.ts

@@ -42,4 +42,57 @@ export interface FencedBlock {
  * so a caller's message points at the real line.
  */
 export declare function fencedCodeBlocks(src: string): FencedBlock[];
+/**
+ * How a reference appeared in the markdown.
+ *
+ * `link` is a DESTINATION — the thing the reader follows: an inline link's
+ * target, or an image's `src`. `code` is a bare backtick span standing on its
+ * own in prose.
+ */
+export type MarkdownRefKind = "link" | "code";
+/** One reference recovered from markdown STRUCTURE. */
+export interface MarkdownRef {
+    readonly kind: MarkdownRefKind;
+    /**
+     * For `link`, the destination exactly as written. For `code`, the span's
+     * content. Never the display text of a link — see {@link markdownRefs}.
+     */
+    readonly value: string;
+    /** 1-based source line the reference sits on. */
+    readonly line: number;
+}
+/**
+ * Every reference a markdown body makes, taken from the PARSE rather than from
+ * the characters.
+ *
+ * 🔴 WHY THIS EXISTS: A LINK'S TEXT IS NOT A REFERENCE. The detector this
+ * replaces ran two regexes over each line — one for `[..](..)`, one for
+ * `` `..` `` — and the second one could not see that it was standing inside the
+ * first. Measured 2026-08-17 on `microsoft/power-platform-skills`:
+ *
+ *     See [`references/dataverse-reference.md` § Setting Lookups](../add-dataverse/references/dataverse-reference.md#setting-lookups)
+ *
+ * The DESTINATION resolves — the file is 23KB and present. The backtick span in
+ * the link's TEXT is a human-readable label for it. vigiles reported the label
+ * as a missing bundled resource, i.e. it accused a correct link of being broken
+ * by reading the half of it that is display. The same shape cost
+ * `rohitg00/pro-workflow` a second false accusation.
+ *
+ * So a code span nested inside a link's (or an image's) text is NOT emitted.
+ * The destination is right there, it is what the agent follows, and it is
+ * returned instead. The bug is not fixed here so much as made unsayable: a
+ * caller of this function is never handed link text at all.
+ *
+ * Fenced and indented code blocks contribute nothing ({@link fencedLineFlags}
+ * decides which lines those are, so no caller re-derives it).
+ *
+ * ⚠️ ONE LINE AT A TIME, and the reason is the line number. Callers report a
+ * reference by source line, and markdown-it's inline tokens carry no line
+ * information — only the enclosing block does — so a paragraph-wide parse would
+ * point every reference in a paragraph at the paragraph's first line. Parsing
+ * each line's inline content keeps the number exact. The cost is a construct
+ * split across two source lines (a link whose `](` sits on the next line),
+ * which is not recovered — the regexes this replaces did not recover it either.
+ */
+export declare function markdownRefs(src: string): MarkdownRef[];
 //# sourceMappingURL=markdown.d.ts.map

package/dist/core/markdown.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fencedLineFlags = fencedLineFlags;
 exports.fencedCodeBlocks = fencedCodeBlocks;
+exports.markdownRefs = markdownRefs;
 /**
  * vigiles — the ONE markdown-structure helper.
  *
@@ -25,6 +26,23 @@ exports.fencedCodeBlocks = fencedCodeBlocks;
 const markdown_it_1 = __importDefault(require("markdown-it"));
 // One reusable parser; parse() is stateless across calls.
 const md = new markdown_it_1.default();
+/**
+ * A SECOND parser, used only by {@link markdownRefs}, with link handling turned
+ * down to "report exactly what the author wrote":
+ *
+ * - `normalizeLink` is neutered because the default percent-ENCODES the
+ *   destination. A detector downstream reads `%NN` as the signature of a URL or
+ *   of a documentation example about escaping spaces, and skips it; letting
+ *   markdown-it encode on the way in would manufacture that signature for any
+ *   destination holding a space or a non-ASCII character.
+ * - `validateLink` is opened because the default silently REFUSES to build a
+ *   link token for schemes it distrusts (`javascript:`, `data:`), which would
+ *   turn "a destination this tool declines to resolve" into "no destination at
+ *   all". Skipping by scheme is the caller's job and it already does it.
+ */
+const mdRefs = new markdown_it_1.default();
+mdRefs.normalizeLink = (url) => url;
+mdRefs.validateLink = () => true;
 /**
  * A boolean per source line (0-based): `true` when the line lies inside a fenced
  * code block (` ``` ` or `~~~`), the delimiter lines included — matching the
@@ -85,4 +103,85 @@ function fencedCodeBlocks(src) {
     }
     return out;
 }
+/**
+ * Every reference a markdown body makes, taken from the PARSE rather than from
+ * the characters.
+ *
+ * 🔴 WHY THIS EXISTS: A LINK'S TEXT IS NOT A REFERENCE. The detector this
+ * replaces ran two regexes over each line — one for `[..](..)`, one for
+ * `` `..` `` — and the second one could not see that it was standing inside the
+ * first. Measured 2026-08-17 on `microsoft/power-platform-skills`:
+ *
+ *     See [`references/dataverse-reference.md` § Setting Lookups](../add-dataverse/references/dataverse-reference.md#setting-lookups)
+ *
+ * The DESTINATION resolves — the file is 23KB and present. The backtick span in
+ * the link's TEXT is a human-readable label for it. vigiles reported the label
+ * as a missing bundled resource, i.e. it accused a correct link of being broken
+ * by reading the half of it that is display. The same shape cost
+ * `rohitg00/pro-workflow` a second false accusation.
+ *
+ * So a code span nested inside a link's (or an image's) text is NOT emitted.
+ * The destination is right there, it is what the agent follows, and it is
+ * returned instead. The bug is not fixed here so much as made unsayable: a
+ * caller of this function is never handed link text at all.
+ *
+ * Fenced and indented code blocks contribute nothing ({@link fencedLineFlags}
+ * decides which lines those are, so no caller re-derives it).
+ *
+ * ⚠️ ONE LINE AT A TIME, and the reason is the line number. Callers report a
+ * reference by source line, and markdown-it's inline tokens carry no line
+ * information — only the enclosing block does — so a paragraph-wide parse would
+ * point every reference in a paragraph at the paragraph's first line. Parsing
+ * each line's inline content keeps the number exact. The cost is a construct
+ * split across two source lines (a link whose `](` sits on the next line),
+ * which is not recovered — the regexes this replaces did not recover it either.
+ */
+function markdownRefs(src) {
+    const lines = src.split("\n");
+    const fenced = fencedLineFlags(src);
+    const out = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i] ?? "";
+        // Cheap reject: no link syntax and no backtick means no reference, and most
+        // lines of a real corpus are that.
+        if (fenced[i] || (!line.includes("`") && !line.includes("](")))
+            continue;
+        for (const tok of mdRefs.parseInline(line, {})) {
+            refsInInline(tok.children ?? [], i + 1, out);
+        }
+    }
+    return out;
+}
+/** Which attribute carries the DESTINATION, per inline token type. */
+const DESTINATION_ATTR = {
+    link_open: "href",
+    image: "src",
+};
+/**
+ * Walk ONE line's inline token stream, appending its references.
+ *
+ * `linkDepth` is the whole point: markdown-it emits `link_open` … `link_close`
+ * around the link's TEXT, so a `code_inline` seen while the depth is non-zero
+ * is display, and its destination has already been recorded.
+ */
+function refsInInline(children, line, out) {
+    let linkDepth = 0;
+    for (const child of children) {
+        if (child.type === "link_close") {
+            linkDepth--;
+            continue;
+        }
+        if (child.type === "link_open")
+            linkDepth++;
+        // An image's alt text is a nested inline stream markdown-it keeps in
+        // `children`; it is display, exactly like link text, so only the `src` is
+        // taken and the alt is not descended into.
+        const destAttr = DESTINATION_ATTR[child.type];
+        const dest = destAttr === undefined ? null : child.attrGet(destAttr);
+        if (dest)
+            out.push({ kind: "link", value: dest, line });
+        else if (child.type === "code_inline" && linkDepth === 0)
+            out.push({ kind: "code", value: child.content, line });
+    }
+}
 //# sourceMappingURL=markdown.js.map

package/dist/core/rule-meta.js

@@ -85,7 +85,7 @@ exports.RULE_META = {
         surface: ["subagent"],
         defaultSeverity: "warn",
         summary: "A subagent's tools: are all real (no never-available / typo).",
-        detector: "confidentToolIssues",
+        detector: "verifyToolContract / scoredIssues",
         upstreamPrevention: "typed agent() vocabulary + compileAgent — an unknown tool is a tsc/compile error",
     },
     "disallowed-tools-contract": {
@@ -113,7 +113,7 @@ exports.RULE_META = {
         surface: ["hook"],
         defaultSeverity: "warn",
         summary: "A hook's event name is one the harness defines (it can fire).",
-        detector: "confidentHookEventIssues",
+        detector: "verifyHookEvents / scoredIssues",
         upstreamPrevention: "compiled hook on: is dialect-validated at compile",
     },
     "hook-script-exists": {