vigiles 2.5.0 → 3.0.0

package/action.yml

@@ -1,25 +1,161 @@
 name: "vigiles"
-description: "Compile typed specs to instruction files and verify integrity"
+description: "Verify the references in your agent instruction files (CLAUDE.md/AGENTS.md) and compile typed specs — in CI."
+author: "zernie"
 branding:
   icon: "check-circle"
   color: "orange"
 
 inputs:
   command:
-    description: "Command to run: 'compile' or 'audit' (default: audit)"
+    description: "Which vigiles command to run: 'audit' (verify references + integrity + coverage) or 'compile' (specs → markdown)."
     required: false
     default: "audit"
   paths:
-    description: "Comma-separated paths to .spec.ts files (compile) or .md files (audit). Auto-discovers by default."
+    description: "Comma- or space-separated paths to operate on (.md files for audit, .spec.ts files for compile). Auto-discovers when empty."
     required: false
+    default: ""
+  version:
+    description: "Version of the vigiles npm package to run (e.g. '1', '1.2.3', 'latest'). Use 'local' to run the action's own checkout — for dogfooding via `uses: ./` in this repo's CI."
+    required: false
+    default: "latest"
   max-rules:
-    description: "Maximum number of rules per spec file"
+    description: "Maximum number of rules per spec file (maps to the CLI's --max-rules)."
     required: false
+    default: ""
   catalog-only:
-    description: "Only check that linter rules exist, skip config-enabled checks (true/false)"
+    description: "Only check that linter rules exist; skip config-enabled checks (maps to the CLI's --catalog-only). 'true' or 'false'."
     required: false
     default: "false"
+  working-directory:
+    description: "Directory to run vigiles in."
+    required: false
+    default: "."
+  comment:
+    description: "On pull_request events, post/update a sticky PR comment with the result ('true' or 'false'). Requires `pull-requests: write`."
+    required: false
+    default: "true"
+  github-token:
+    description: "Token used to post the PR comment. Defaults to the workflow token."
+    required: false
+    default: ${{ github.token }}
+
+outputs:
+  valid:
+    description: "'true' if vigiles passed (exit 0), 'false' otherwise."
+    value: ${{ steps.vigiles.outputs.valid }}
 
 runs:
-  using: "node20"
-  main: "dist/action.js"
+  using: "composite"
+  steps:
+    - id: vigiles
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      env:
+        # Inputs are passed through the environment (never interpolated into
+        # the script body) so a value can't break out of the command line.
+        VIGILES_COMMAND: ${{ inputs.command }}
+        VIGILES_PATHS: ${{ inputs.paths }}
+        VIGILES_VERSION: ${{ inputs.version }}
+        VIGILES_MAX_RULES: ${{ inputs.max-rules }}
+        VIGILES_CATALOG_ONLY: ${{ inputs.catalog-only }}
+        VIGILES_ACTION_PATH: ${{ github.action_path }}
+        VIGILES_COMMENT: ${{ inputs.comment }}
+        GH_TOKEN: ${{ inputs.github-token }}
+      run: |
+        set -euo pipefail
+
+        cmd="${VIGILES_COMMAND:-audit}"
+        args=("$cmd")
+
+        # paths: split on commas and whitespace into positional args.
+        paths="${VIGILES_PATHS:-}"
+        if [[ -n "${paths// /}" ]]; then
+          IFS=', ' read -r -a _paths <<< "$paths"
+          args+=("${_paths[@]}")
+        fi
+
+        max_rules="${VIGILES_MAX_RULES:-}"
+        if [[ -n "${max_rules// /}" ]]; then
+          args+=("--max-rules=${max_rules}")
+        fi
+
+        if [[ "${VIGILES_CATALOG_ONLY:-false}" == "true" ]]; then
+          args+=("--catalog-only")
+        fi
+
+        # Resolve the runner. 'local' runs the action's own build (CI
+        # dogfood via `uses: ./`); any other value runs the published npm
+        # package at that version, so the Action reuses the same tested
+        # artifact users get from `npx vigiles`.
+        version="${VIGILES_VERSION:-latest}"
+        if [[ "$version" == "local" ]]; then
+          runner=(node "${VIGILES_ACTION_PATH}/dist/cli.js")
+        else
+          runner=(npx --yes "vigiles@${version}")
+        fi
+
+        echo "vigiles: ${runner[*]} ${args[*]}"
+
+        # Run, streaming to the log AND capturing for the summary/comment.
+        out="$(mktemp)"
+        set +e
+        GITHUB_ACTIONS=true "${runner[@]}" "${args[@]}" 2>&1 | tee "$out"
+        status="${PIPESTATUS[0]}"
+        set -e
+
+        if [[ "$status" -eq 0 ]]; then
+          echo "valid=true" >> "$GITHUB_OUTPUT"
+          headline="✅ \`vigiles ${cmd}\` passed"
+        else
+          echo "valid=false" >> "$GITHUB_OUTPUT"
+          headline="❌ \`vigiles ${cmd}\` failed (exit ${status})"
+          echo "::error::vigiles ${cmd} failed (exit ${status})"
+        fi
+
+        # Build a markdown report (cap the log tail so a huge run stays sane).
+        report="$(mktemp)"
+        {
+          echo "## vigiles"
+          echo
+          echo "$headline"
+          echo
+          echo '<details><summary>Output</summary>'
+          echo
+          echo '```'
+          tail -c 60000 "$out"
+          echo '```'
+          echo
+          echo '</details>'
+        } > "$report"
+
+        # Job summary (always, when available) — the modern run-page output.
+        if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
+          cat "$report" >> "$GITHUB_STEP_SUMMARY"
+        fi
+
+        # Sticky PR comment (pull_request events only, best-effort): find the
+        # prior vigiles comment by marker and update it in place, else create.
+        marker="<!-- vigiles-action -->"
+        if [[ "${VIGILES_COMMENT:-true}" == "true" \
+              && "${GITHUB_EVENT_NAME:-}" == "pull_request" \
+              && -n "${GH_TOKEN:-}" ]] && command -v gh >/dev/null 2>&1; then
+          pr="$(jq -r '.pull_request.number // empty' "${GITHUB_EVENT_PATH:-/dev/null}")"
+          if [[ -n "$pr" ]]; then
+            body="$(printf '%s\n%s\n' "$marker" "$(cat "$report")")"
+            repo="${GITHUB_REPOSITORY}"
+            cid="$(gh api "repos/${repo}/issues/${pr}/comments" --paginate \
+              --jq "map(select(.body | startswith(\"${marker}\"))) | .[0].id // empty" \
+              2>/dev/null || true)"
+            if [[ -n "$cid" ]]; then
+              gh api -X PATCH "repos/${repo}/issues/comments/${cid}" -f body="$body" >/dev/null \
+                && echo "Updated PR comment #${cid}" \
+                || echo "::warning::could not update PR comment (need pull-requests: write?)"
+            else
+              gh api -X POST "repos/${repo}/issues/${pr}/comments" -f body="$body" >/dev/null \
+                && echo "Posted PR comment" \
+                || echo "::warning::could not post PR comment (need pull-requests: write?)"
+            fi
+          fi
+        fi
+
+        exit "$status"

package/dist/action-gate.d.ts

@@ -1,4 +1,4 @@
-import { type RuntimeGate } from "./skill-runtime.js";
+import { type RuntimeGate } from "./adapters/claude-code/skill-runtime.js";
 export interface ActionGate {
     /** Tool name to gate, e.g. "Write" | "Edit" | "Bash". */
     readonly on: string;

package/dist/action-gate.js

@@ -21,7 +21,7 @@ exports.loadActionGates = loadActionGates;
  */
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
-const skill_runtime_js_1 = require("./skill-runtime.js");
+const skill_runtime_js_1 = require("./adapters/claude-code/skill-runtime.js");
 /** The file path an action touched, for `{file}` substitution. */
 function fileOf(event) {
     const i = event.input ?? {};

package/dist/adapter-conformance.d.ts

@@ -0,0 +1,30 @@
+import type { HarnessAdapter } from "./core/adapter.js";
+export interface ConformanceResult {
+    readonly ok: boolean;
+    readonly failures: readonly string[];
+}
+/** Check an adapter against the port contracts; returns the (possibly empty) failure list. */
+export declare function checkAdapterConformance(adapter: HarnessAdapter): ConformanceResult;
+/** Throw if the adapter fails conformance — drop this in an adapter's test suite. */
+export declare function assertAdapterConformance(adapter: HarnessAdapter): void;
+/**
+ * Guard for the pillar-2 entry points (runHarnessTest/runEval): a pillar-1-only
+ * adapter (Cursor, Devin, Amp, Amazon Q) has no mockable transport, so driving
+ * the deterministic/eval tiers against it would hang or spawn nothing. Calling
+ * this up front turns that into a clear, immediate error. Returns the narrowed
+ * runtime+modelMock so the caller can use them without re-checking for undefined.
+ */
+export declare function assertHarnessTestable(adapter: HarnessAdapter): {
+    runtime: NonNullable<HarnessAdapter["runtime"]>;
+    modelMock: NonNullable<HarnessAdapter["modelMock"]>;
+};
+/**
+ * Behavioural conformance the pure checks can't reach: write a minimal settings
+ * file in the adapter's declared `settingsFormat` (with a hook), load it through
+ * the adapter's `layout`, and assert the hooks actually came back. This is what
+ * catches a layout that points at the right file but in the wrong format (the
+ * JSON-vs-TOML trap) — the pure checker would pass it, the agent would silently
+ * run with zero hooks. Does filesystem IO, so it's a separate opt-in assert.
+ */
+export declare function assertAdapterLoadsHooks(adapter: HarnessAdapter): void;
+//# sourceMappingURL=adapter-conformance.d.ts.map

package/dist/adapter-conformance.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAdapterConformance = checkAdapterConformance;
+exports.assertAdapterConformance = assertAdapterConformance;
+exports.assertHarnessTestable = assertHarnessTestable;
+exports.assertAdapterLoadsHooks = assertAdapterLoadsHooks;
+/**
+ * Adapter conformance kit — the reusable check every `HarnessAdapter` runs, so
+ * authoring one is guided and safe rather than "hope it's wired right". It
+ * verifies each port is populated AND a behavioural invariant: the adapter's
+ * dialect actually drives tool-contract verification (its own built-in tool is
+ * accepted). A third-party adapter author runs `assertAdapterConformance(myAdapter)`
+ * in their test suite. See `docs/authoring-an-adapter.md`.
+ */
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const compile_js_1 = require("./core/compile.js");
+const spec_js_1 = require("./core/spec.js");
+const plugin_loader_js_1 = require("./plugin-loader.js");
+/** Check an adapter against the port contracts; returns the (possibly empty) failure list. */
+function checkAdapterConformance(adapter) {
+    const failures = [];
+    const need = (cond, msg) => {
+        if (!cond)
+            failures.push(msg);
+    };
+    const caps = adapter.capabilities;
+    // Widen to boolean so a malformed (non-TS) adapter that set this false is still
+    // caught at runtime — the literal `true` type would make a direct check redundant.
+    const refVerification = caps.referenceVerification;
+    need(adapter.name.length > 0, "name is empty");
+    need(refVerification, "capabilities.referenceVerification must be true (every adapter does pillar 1)");
+    // --- Pillar 1 (always required): dialect + layout ---
+    need(adapter.dialect.builtinAgentTools.length > 0, "dialect has no builtinAgentTools");
+    need(adapter.dialect.instructionTargets.length > 0, "dialect has no instructionTargets");
+    need(adapter.layout.instructionFile.length > 0, "layout.instructionFile is empty");
+    need(adapter.layout.manifestPath.length > 0, "layout.manifestPath is empty");
+    need(adapter.layout.surfaceDirs.length > 0, "layout has no surfaceDirs");
+    need(typeof adapter.detect === "function", "detect is not a function");
+    // --- Pillar 2 transport ports: required ONLY for the capabilities the
+    // adapter declares. A pillar-1-only adapter (harnessTesting:false) may omit
+    // runtime/modelMock; a code-module-hook adapter (shellHooks:false) may omit
+    // hookProtocol — and conformance must NOT demand a fake one. The flip side:
+    // if it CLAIMS the capability, the port must be there and populated.
+    const portNames = [
+        ["dialect", adapter.dialect.name],
+        ["layout", adapter.layout.name],
+    ];
+    if (caps.harnessTesting) {
+        need(adapter.runtime !== undefined, "capabilities.harnessTesting is true but runtime is missing");
+        need(adapter.modelMock !== undefined, "capabilities.harnessTesting is true but modelMock is missing");
+        if (adapter.runtime) {
+            need(adapter.runtime.agentBinary.length > 0, "runtime.agentBinary is empty");
+            need(adapter.runtime.modelBaseUrlEnv.length > 0, "runtime.modelBaseUrlEnv is empty");
+            portNames.push(["runtime", adapter.runtime.name]);
+        }
+        if (adapter.modelMock) {
+            need(adapter.modelMock.modelEndpoint.length > 0, "modelMock.modelEndpoint is empty");
+            portNames.push(["modelMock", adapter.modelMock.name]);
+        }
+    }
+    else {
+        need(adapter.runtime === undefined && adapter.modelMock === undefined, "capabilities.harnessTesting is false — omit runtime/modelMock (a pillar-1-only adapter must not ship a half-wired transport)");
+    }
+    if (caps.shellHooks) {
+        need(adapter.hookProtocol !== undefined, "capabilities.shellHooks is true but hookProtocol is missing");
+        if (adapter.hookProtocol) {
+            need(Number.isInteger(adapter.hookProtocol.blockExitCode), "hookProtocol.blockExitCode is not an integer");
+            portNames.push(["hookProtocol", adapter.hookProtocol.name]);
+        }
+    }
+    else {
+        need(adapter.hookProtocol === undefined, "capabilities.shellHooks is false — omit hookProtocol (hooks are code modules, not shell processes)");
+    }
+    // Cross-port invariants — the kind of mismatch a copy-paste authoring slip
+    // produces, that no single-port check would catch. Only the present ports.
+    for (const [port, name] of portNames) {
+        need(name === adapter.name, `${port}.name "${name}" != adapter.name "${adapter.name}"`);
+    }
+    need(adapter.layout.pluginRootToken === adapter.dialect.pluginRootToken, "layout.pluginRootToken and dialect.pluginRootToken disagree");
+    need(adapter.dialect.instructionTargets.includes(adapter.layout.instructionFile), `layout.instructionFile "${adapter.layout.instructionFile}" is not one of dialect.instructionTargets`);
+    need(adapter.layout.settingsFormat === "json" ||
+        adapter.layout.settingsFormat === "toml", `layout.settingsFormat "${adapter.layout.settingsFormat}" is not "json" | "toml"`);
+    // Behavioural: the dialect drives the compiler — its own built-in tool must
+    // pass the subagent tool-contract check under this dialect.
+    const tool = adapter.dialect.builtinAgentTools[0];
+    if (tool) {
+        const spec = (0, spec_js_1.agent)({
+            name: "conformance",
+            description: "conformance probe",
+            tools: [tool],
+            body: "probe",
+        });
+        const r = (0, compile_js_1.compileAgent)(spec, {
+            specFile: "conformance.md.spec.ts",
+            dialect: adapter.dialect,
+        });
+        need(!r.errors.some((e) => e.type === "unknown-tool"), `dialect rejects its own built-in tool "${tool}"`);
+    }
+    return { ok: failures.length === 0, failures };
+}
+/** Throw if the adapter fails conformance — drop this in an adapter's test suite. */
+function assertAdapterConformance(adapter) {
+    const r = checkAdapterConformance(adapter);
+    if (!r.ok) {
+        throw new Error(`Adapter "${adapter.name}" failed conformance:\n  - ${r.failures.join("\n  - ")}`);
+    }
+}
+/**
+ * Guard for the pillar-2 entry points (runHarnessTest/runEval): a pillar-1-only
+ * adapter (Cursor, Devin, Amp, Amazon Q) has no mockable transport, so driving
+ * the deterministic/eval tiers against it would hang or spawn nothing. Calling
+ * this up front turns that into a clear, immediate error. Returns the narrowed
+ * runtime+modelMock so the caller can use them without re-checking for undefined.
+ */
+function assertHarnessTestable(adapter) {
+    if (!adapter.capabilities.harnessTesting ||
+        !adapter.runtime ||
+        !adapter.modelMock) {
+        throw new Error(`Adapter "${adapter.name}" does not support harness testing (pillar 2): it is reference-verification-only (no mockable runtime). Use it for compile/scan/audit, not runHarnessTest/runEval.`);
+    }
+    return { runtime: adapter.runtime, modelMock: adapter.modelMock };
+}
+/**
+ * Behavioural conformance the pure checks can't reach: write a minimal settings
+ * file in the adapter's declared `settingsFormat` (with a hook), load it through
+ * the adapter's `layout`, and assert the hooks actually came back. This is what
+ * catches a layout that points at the right file but in the wrong format (the
+ * JSON-vs-TOML trap) — the pure checker would pass it, the agent would silently
+ * run with zero hooks. Does filesystem IO, so it's a separate opt-in assert.
+ */
+function assertAdapterLoadsHooks(adapter) {
+    const dir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "vigiles-conformance-"));
+    try {
+        const settingsAbs = (0, node_path_1.join)(dir, adapter.layout.settingsPath);
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(settingsAbs), { recursive: true });
+        const content = adapter.layout.settingsFormat === "toml"
+            ? '[[hooks.PreToolUse]]\ncommand = "echo conformance"\n'
+            : JSON.stringify({
+                hooks: { PreToolUse: [{ command: "echo conformance" }] },
+            });
+        (0, node_fs_1.writeFileSync)(settingsAbs, content);
+        const loaded = (0, plugin_loader_js_1.loadPlugin)(dir, adapter.layout);
+        if (!loaded.settings.hooks) {
+            throw new Error(`Adapter "${adapter.name}": loadPlugin read no hooks from a ${adapter.layout.settingsFormat} settings file at ${adapter.layout.settingsPath} — the settings-format wiring is broken.`);
+        }
+    }
+    finally {
+        (0, node_fs_1.rmSync)(dir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=adapter-conformance.js.map

package/dist/adapter-registry.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Adapter registry — the composition-root list the CLI uses to auto-detect which
+ * harness a repo targets. The library API selects an adapter by import
+ * (`vigiles/claude-code`); the CLI can't, so it walks this registry. Claude Code
+ * is the default, so detection is backwards-compatible: an undetected repo (or a
+ * repo with no adapter markers) resolves to Claude Code exactly as before.
+ *
+ * Adding a harness = add its `HarnessAdapter` to `ADAPTERS` (and a
+ * `vigiles/<harness>` export). Order matters only if two adapters could both
+ * match a repo; `detect()` returns a specificity score so the strongest signal
+ * wins regardless of order.
+ */
+import type { HarnessAdapter } from "./core/adapter.js";
+/** The default adapter when detection finds no harness markers. */
+export declare const defaultAdapter: HarnessAdapter;
+/** All registered adapters. detect() specificity (not order) breaks ties. */
+export declare const ADAPTERS: readonly HarnessAdapter[];
+/** The result of auto-detecting a harness from a repo's layout. */
+export interface DetectResult {
+    readonly adapter: HarnessAdapter;
+    /** True when detection found no harness markers and fell back to the default. */
+    readonly fallback: boolean;
+    /**
+     * Other adapters that matched at the same top specificity — a non-empty list
+     * means the repo looks like more than one harness (e.g. a CLAUDE.md + an
+     * AGENTS.md), so the pick is ambiguous; resolve with `--harness`.
+     */
+    readonly ambiguousWith: readonly string[];
+}
+/** Auto-detect the harness for a repo at `root` by highest detect() specificity. */
+export declare function detectAdapterResult(root: string): DetectResult;
+/** The detected adapter (highest specificity), else the default (Claude Code). */
+export declare function detectAdapter(root: string): HarnessAdapter;
+/** Look up a registered adapter by `name` (e.g. for a `--harness` override). */
+export declare function getAdapter(name: string): HarnessAdapter | undefined;
+/**
+ * Resolve the adapter for a command: an explicit `--harness <name>` wins (throws
+ * if unknown); otherwise auto-detect from `root`. The single entry point the CLI
+ * uses so detection + override live in one place.
+ */
+export declare function resolveAdapter(root: string, harness?: string): HarnessAdapter;
+//# sourceMappingURL=adapter-registry.d.ts.map

package/dist/adapter-registry.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ADAPTERS = exports.defaultAdapter = void 0;
+exports.detectAdapterResult = detectAdapterResult;
+exports.detectAdapter = detectAdapter;
+exports.getAdapter = getAdapter;
+exports.resolveAdapter = resolveAdapter;
+const adapter_js_1 = require("./adapters/claude-code/adapter.js");
+const adapter_js_2 = require("./adapters/codex/adapter.js");
+/** The default adapter when detection finds no harness markers. */
+exports.defaultAdapter = adapter_js_1.claudeCodeAdapter;
+/** All registered adapters. detect() specificity (not order) breaks ties. */
+exports.ADAPTERS = [
+    adapter_js_1.claudeCodeAdapter,
+    adapter_js_2.codexAdapter,
+];
+/** Auto-detect the harness for a repo at `root` by highest detect() specificity. */
+function detectAdapterResult(root) {
+    const scored = exports.ADAPTERS.map((a) => ({ a, score: a.detect(root) })).filter((s) => s.score > 0);
+    if (scored.length === 0) {
+        return { adapter: exports.defaultAdapter, fallback: true, ambiguousWith: [] };
+    }
+    const top = Math.max(...scored.map((s) => s.score));
+    const winners = scored.filter((s) => s.score === top).map((s) => s.a);
+    return {
+        adapter: winners[0],
+        fallback: false,
+        ambiguousWith: winners.slice(1).map((a) => a.name),
+    };
+}
+/** The detected adapter (highest specificity), else the default (Claude Code). */
+function detectAdapter(root) {
+    return detectAdapterResult(root).adapter;
+}
+/** Look up a registered adapter by `name` (e.g. for a `--harness` override). */
+function getAdapter(name) {
+    return exports.ADAPTERS.find((a) => a.name === name);
+}
+/**
+ * Resolve the adapter for a command: an explicit `--harness <name>` wins (throws
+ * if unknown); otherwise auto-detect from `root`. The single entry point the CLI
+ * uses so detection + override live in one place.
+ */
+function resolveAdapter(root, harness) {
+    if (harness !== undefined) {
+        const a = getAdapter(harness);
+        if (!a) {
+            const known = exports.ADAPTERS.map((x) => x.name).join(", ");
+            throw new Error(`Unknown harness "${harness}". Known: ${known}.`);
+        }
+        return a;
+    }
+    return detectAdapter(root);
+}
+//# sourceMappingURL=adapter-registry.js.map

package/dist/adapter.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `vigiles/adapter` — the harness-adapter authoring kit.
+ *
+ * Everything you need to teach vigiles a new harness, in one import: the five
+ * port interfaces to implement, the `HarnessAdapter` bundle that groups them,
+ * the conformance kit to validate yours, and the registry the CLI detects
+ * through. vigiles ships a Claude Code adapter; building your own is welcome and
+ * supported — see `docs/authoring-an-adapter.md`.
+ *
+ *   import {
+ *     type HarnessAdapter, type HarnessDialect, type PluginLayout,
+ *     type HarnessRuntime, type HookProtocol, type ModelMock,
+ *     assertAdapterConformance,
+ *   } from "vigiles/adapter";
+ *
+ *   export const myHarnessAdapter: HarnessAdapter = { name: "my-harness", … };
+ */
+export type { HarnessAdapter, AdapterCapabilities } from "./core/adapter.js";
+export type { HarnessDialect } from "./core/dialect.js";
+export type { PluginLayout } from "./core/layout.js";
+export type { HarnessRuntime } from "./core/runtime.js";
+export type { HookProtocol } from "./core/hook-protocol.js";
+export type { ModelMock } from "./core/model-mock.js";
+export { checkAdapterConformance, assertAdapterConformance, assertAdapterLoadsHooks, assertHarnessTestable, type ConformanceResult, } from "./adapter-conformance.js";
+export { ADAPTERS, defaultAdapter, detectAdapter, detectAdapterResult, resolveAdapter, getAdapter, type DetectResult, } from "./adapter-registry.js";
+//# sourceMappingURL=adapter.d.ts.map

package/dist/adapter.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAdapter = exports.resolveAdapter = exports.detectAdapterResult = exports.detectAdapter = exports.defaultAdapter = exports.ADAPTERS = exports.assertHarnessTestable = exports.assertAdapterLoadsHooks = exports.assertAdapterConformance = exports.checkAdapterConformance = void 0;
+var adapter_conformance_js_1 = require("./adapter-conformance.js");
+Object.defineProperty(exports, "checkAdapterConformance", { enumerable: true, get: function () { return adapter_conformance_js_1.checkAdapterConformance; } });
+Object.defineProperty(exports, "assertAdapterConformance", { enumerable: true, get: function () { return adapter_conformance_js_1.assertAdapterConformance; } });
+Object.defineProperty(exports, "assertAdapterLoadsHooks", { enumerable: true, get: function () { return adapter_conformance_js_1.assertAdapterLoadsHooks; } });
+Object.defineProperty(exports, "assertHarnessTestable", { enumerable: true, get: function () { return adapter_conformance_js_1.assertHarnessTestable; } });
+var adapter_registry_js_1 = require("./adapter-registry.js");
+Object.defineProperty(exports, "ADAPTERS", { enumerable: true, get: function () { return adapter_registry_js_1.ADAPTERS; } });
+Object.defineProperty(exports, "defaultAdapter", { enumerable: true, get: function () { return adapter_registry_js_1.defaultAdapter; } });
+Object.defineProperty(exports, "detectAdapter", { enumerable: true, get: function () { return adapter_registry_js_1.detectAdapter; } });
+Object.defineProperty(exports, "detectAdapterResult", { enumerable: true, get: function () { return adapter_registry_js_1.detectAdapterResult; } });
+Object.defineProperty(exports, "resolveAdapter", { enumerable: true, get: function () { return adapter_registry_js_1.resolveAdapter; } });
+Object.defineProperty(exports, "getAdapter", { enumerable: true, get: function () { return adapter_registry_js_1.getAdapter; } });
+//# sourceMappingURL=adapter.js.map

package/dist/adapters/claude-code/adapter.d.ts

@@ -0,0 +1,3 @@
+import type { HarnessAdapter } from "../../core/adapter.js";
+export declare const claudeCodeAdapter: HarnessAdapter;
+//# sourceMappingURL=adapter.d.ts.map

package/dist/adapters/claude-code/adapter.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claudeCodeAdapter = void 0;
+/**
+ * claudeCodeAdapter — the Claude Code `HarnessAdapter`: the five port
+ * implementations bundled, plus a `detect` that recognizes a Claude Code repo
+ * (a `.claude-plugin/` manifest, a `.claude/settings.json`, or a `CLAUDE.md`).
+ * This is the reference adapter a second harness (Codex, Gemini, …) mirrors.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const dialect_js_1 = require("./dialect.js");
+const layout_js_1 = require("./layout.js");
+const runtime_js_1 = require("./runtime.js");
+const hook_protocol_js_1 = require("./hook-protocol.js");
+const model_mock_js_1 = require("./model-mock.js");
+const harness_test_js_1 = require("./harness-test.js");
+exports.claudeCodeAdapter = {
+    name: "claude-code",
+    // The reference harness: every tier. Mockable transport (Anthropic SSE) and
+    // shell hooks (exit 2 / decision JSON) — both pillars, all tiers.
+    capabilities: {
+        referenceVerification: true,
+        harnessTesting: true,
+        shellHooks: true,
+    },
+    dialect: dialect_js_1.claudeCodeDialect,
+    layout: layout_js_1.claudeCodeLayout,
+    runtime: runtime_js_1.claudeCodeRuntime,
+    hookProtocol: hook_protocol_js_1.claudeCodeHookProtocol,
+    modelMock: model_mock_js_1.claudeCodeModelMock,
+    harnessTestDriver: harness_test_js_1.claudeCodeDriver,
+    detect(root) {
+        // Most specific signal wins: a plugin manifest (3) > repo settings (2) >
+        // a bare CLAUDE.md (1, weak — many tools also read it / AGENTS.md).
+        const has = (rel) => (0, node_fs_1.existsSync)((0, node_path_1.join)(root, rel));
+        if (has(layout_js_1.claudeCodeLayout.manifestPath))
+            return 3;
+        if (has(layout_js_1.claudeCodeLayout.settingsPath))
+            return 2;
+        if (has(layout_js_1.claudeCodeLayout.instructionFile))
+            return 1;
+        return 0;
+    },
+};
+//# sourceMappingURL=adapter.js.map

package/dist/{agent-result.d.ts → adapters/claude-code/agent-result.d.ts}

@@ -17,7 +17,7 @@
  * third `malformed` track for a worker that didn't honor its contract (no block,
  * bad JSON, or a shape that doesn't match the declared schema).
  */
-import type { OutputContract } from "./spec.js";
+import type { OutputContract } from "../../core/spec.js";
 /** The outcome of parsing a worker's result block. */
 export type ParsedAgentResult<S = Record<string, unknown>, E = Record<string, unknown>> = {
     readonly kind: "ok";

package/dist/adapters/claude-code/dialect.d.ts

@@ -0,0 +1,13 @@
+/**
+ * claudeCodeDialect — the Claude Code adapter's `HarnessDialect` (format axis).
+ * The concrete dialect is DEFINED here, in the adapter, symmetric with the other
+ * four ports (`claudeCodeLayout`/`Runtime`/`HookProtocol`/`ModelMock`): the core
+ * holds only the `HarnessDialect` interface and never a harness's vocabulary. The
+ * compiler/validator receive this by injection (`compileAgent(spec, { dialect })`,
+ * the CLI/composition root supplies it). A second harness defines its own dialect
+ * in its adapter (e.g. `src/adapters/codex/dialect.ts` exporting `codexDialect`).
+ */
+import type { HarnessDialect } from "../../core/dialect.js";
+export declare const claudeCodeDialect: HarnessDialect;
+export type { HarnessDialect } from "../../core/dialect.js";
+//# sourceMappingURL=dialect.d.ts.map

package/dist/adapters/claude-code/dialect.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claudeCodeDialect = void 0;
+exports.claudeCodeDialect = {
+    name: "claude-code",
+    // The tool contract a subagent may declare — the rails it runs on. Anything
+    // else must be an MCP tool, else it's a typo / nonexistent tool.
+    builtinAgentTools: [
+        "Read",
+        "Write",
+        "Edit",
+        "Bash",
+        "Grep",
+        "Glob",
+        "WebSearch",
+        "WebFetch",
+        "NotebookEdit",
+        "TodoWrite",
+        "Task",
+        "Skill",
+    ],
+    // Tools the platform never exposes to a subagent, whatever the list says — so
+    // a subagent listing one is a guaranteed-dead reference only a compiler catches.
+    neverAvailableTools: [
+        "Agent",
+        "AskUserQuestion",
+        "EnterPlanMode",
+        "ExitPlanMode",
+        "ScheduleWakeup",
+        "WaitForMcpServers",
+    ],
+    mcpToolPattern: /^mcp__[a-z0-9_-]+__[a-z0-9_-]+$/i,
+    hookEvents: [
+        "PreToolUse",
+        "PostToolUse",
+        "PreSession",
+        "PostSession",
+        "Notification",
+    ],
+    // Claude Code natively reads CLAUDE.md only — it does NOT auto-load AGENTS.md
+    // (anthropics/claude-code#34235 is open; AGENTS.md works solely via an
+    // `@AGENTS.md` import inside CLAUDE.md or a symlink). AGENTS.md is the
+    // cross-tool standard (Codex's native target), not a CC dialect fact; vigiles's
+    // tool-agnostic recognition of it lives in validate.ts's INSTRUCTION_FILES.
+    instructionTargets: ["CLAUDE.md"],
+    pluginRootToken: "${CLAUDE_PLUGIN_ROOT}",
+    // Claude Code reads the full SKILL.md frontmatter set (description,
+    // disable-model-invocation, argument-hint, …).
+    skillFrontmatter: "claude-code",
+};
+//# sourceMappingURL=dialect.js.map

package/dist/adapters/claude-code/egress-entry.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=egress-entry.d.ts.map