vigiles 21.0.0 → 21.0.1

package/dist/core/hook-program.d.ts

@@ -24,9 +24,11 @@
  *    OpenCode via the HookProtocol port later — OpenCode hooks ARE in-process TS).
  *
  * Pure core, harness-neutral. HONEST SCOPE (kept in every doc): compile/verify fix
- * the hook's AUTHORING + LOGIC, not DELIVERY — CC's subagent-bypass (#34692) means
- * a PreToolUse hook does not fire for a subagent's tool calls, so a gate is a strong
- * default, never an unbypassable wall. Limits (buy-in, node-startup latency) +
+ * the hook's AUTHORING + LOGIC, not the harness's DELIVERY. #34692 (a subagent's
+ * calls never reaching PreToolUse) is FIXED as of CC 2.1.241 — measured on a stock
+ * install, pinned by src/subagent-delivery.test.ts. A gate is STILL a strong default
+ * rather than an unbypassable wall, because a model can route around a tool
+ * entirely (#45427 / #32376). Limits (buy-in, node-startup latency) +
  * full record in research/hook-pain-points.md.
  */
 import { type BashEffect } from "./bash-effects.js";

package/dist/core/hook-program.js

@@ -64,9 +64,11 @@ exports.isLoadPathRepairEvent = isLoadPathRepairEvent;
  *    OpenCode via the HookProtocol port later — OpenCode hooks ARE in-process TS).
  *
  * Pure core, harness-neutral. HONEST SCOPE (kept in every doc): compile/verify fix
- * the hook's AUTHORING + LOGIC, not DELIVERY — CC's subagent-bypass (#34692) means
- * a PreToolUse hook does not fire for a subagent's tool calls, so a gate is a strong
- * default, never an unbypassable wall. Limits (buy-in, node-startup latency) +
+ * the hook's AUTHORING + LOGIC, not the harness's DELIVERY. #34692 (a subagent's
+ * calls never reaching PreToolUse) is FIXED as of CC 2.1.241 — measured on a stock
+ * install, pinned by src/subagent-delivery.test.ts. A gate is STILL a strong default
+ * rather than an unbypassable wall, because a model can route around a tool
+ * entirely (#45427 / #32376). Limits (buy-in, node-startup latency) +
  * full record in research/hook-pain-points.md.
  */
 const bash_effects_js_1 = require("./bash-effects.js");

package/dist/guardrail-check.d.ts

@@ -14,7 +14,9 @@
  * the hook via {@link runHook} and check the normalized decision is BLOCK. No model,
  * no API key, runs in CI, works on a hand-written hook with NO vigiles spec — it
  * verifies the hook's decision LOGIC, so it sidesteps CC's runtime delivery bugs
- * (subagent-bypass #34692 etc.) which it deliberately does NOT claim to fix.
+ * (the model routing around a tool entirely, #45427 / #32376) which it deliberately
+ * does NOT claim to fix. (#34692, the old subagent-delivery gap, is fixed as of CC
+ * 2.1.241 — see src/subagent-delivery.test.ts.)
  *
  * Pure-ish (wraps the existing runHook tier). The catalog is harness-neutral data;
  * the scaffold-test generator emits a test that calls these, and the same engine

package/dist/guardrail-check.js

@@ -21,7 +21,9 @@ exports.formatGuardrailReport = formatGuardrailReport;
  * the hook via {@link runHook} and check the normalized decision is BLOCK. No model,
  * no API key, runs in CI, works on a hand-written hook with NO vigiles spec — it
  * verifies the hook's decision LOGIC, so it sidesteps CC's runtime delivery bugs
- * (subagent-bypass #34692 etc.) which it deliberately does NOT claim to fix.
+ * (the model routing around a tool entirely, #45427 / #32376) which it deliberately
+ * does NOT claim to fix. (#34692, the old subagent-delivery gap, is fixed as of CC
+ * 2.1.241 — see src/subagent-delivery.test.ts.)
  *
  * Pure-ish (wraps the existing runHook tier). The catalog is harness-neutral data;
  * the scaffold-test generator emits a test that calls these, and the same engine

package/dist/hook.d.ts

@@ -39,11 +39,13 @@
  * inline `provide(name, cmd)` (read-only) or `dangerously(name, cmd)` (the loud
  * escape) right in `needs`. See `research/hook-context-providers.md`.
  *
- * ⚠️ Honest scope: compile/verify fix the hook's AUTHORING + LOGIC. They do NOT
- * change DELIVERY — Claude Code's own subagent-bypass (#34692) means a
- * PreToolUse hook (compiled or hand-written) does not fire for a subagent's
- * tool calls. A gate is a strong default, never an unbypassable wall. See
- * `docs/compiled-hooks.md`.
+ * ⚠️ Honest scope: compile/verify fix the hook's AUTHORING + LOGIC, not the
+ * harness's DELIVERY. The delivery floor MOVED — #34692 (a subagent's tool calls
+ * never reaching PreToolUse) is FIXED as of Claude Code 2.1.241, measured against
+ * a stock registry install and pinned by src/subagent-delivery.test.ts, which goes
+ * red if it regresses. What has NOT changed: a model can still route around a tool
+ * entirely (#45427 / #32376 — a Bash heredoc instead of `Write`), so a gate is a
+ * strong default and is NEVER an unbypassable wall. See `docs/compiled-hooks.md`.
  */
 export { experimental_defineHook, experimental_defineFileGate, experimental_definePromptGate, experimental_defineStopGate, tool, tools, allow, deny, ask, commandView, pathView, gateAction, hookMode, experimental_defineInject, inject, experimental_defineReact, run, notice, nothing, responseView, decideProgram, decideFileGate, decidePromptGate, decideStopGate, runInject, runReact, runHookProgram, decisionExitCode, dispatchKind, hookRouting, hookNeeds, injectionOf, outcomeWrites, matchesTool, invalidToolPatterns, compileHookProgram, checkHookImports, stampHook, verifyHookStamp, HookCompileError, } from "./core/hook-program.js";
 export type { Decision, HookMode, GateAction, CommandView, PathView, ResponseView, BashToolEvent, FileToolEvent, PromptEvent, StopEvent, ReactEvent, SessionEvent, HookProgram, FileGateHook, PromptGateHook, StopGateHook, InjectHook, ReactHook, AnyHook, DispatchKind, Injection, Reaction, RunReaction, CompiledHookProgram, CompileHookOptions, RawHookEvent, HookProgramOutcome, } from "./core/hook-program.js";

package/dist/hook.js

@@ -43,11 +43,13 @@ exports.leafCommandsNormalized = exports.HookStateError = exports.durationSecond
  * inline `provide(name, cmd)` (read-only) or `dangerously(name, cmd)` (the loud
  * escape) right in `needs`. See `research/hook-context-providers.md`.
  *
- * ⚠️ Honest scope: compile/verify fix the hook's AUTHORING + LOGIC. They do NOT
- * change DELIVERY — Claude Code's own subagent-bypass (#34692) means a
- * PreToolUse hook (compiled or hand-written) does not fire for a subagent's
- * tool calls. A gate is a strong default, never an unbypassable wall. See
- * `docs/compiled-hooks.md`.
+ * ⚠️ Honest scope: compile/verify fix the hook's AUTHORING + LOGIC, not the
+ * harness's DELIVERY. The delivery floor MOVED — #34692 (a subagent's tool calls
+ * never reaching PreToolUse) is FIXED as of Claude Code 2.1.241, measured against
+ * a stock registry install and pinned by src/subagent-delivery.test.ts, which goes
+ * red if it regresses. What has NOT changed: a model can still route around a tool
+ * entirely (#45427 / #32376 — a Bash heredoc instead of `Write`), so a gate is a
+ * strong default and is NEVER an unbypassable wall. See `docs/compiled-hooks.md`.
  */
 var hook_program_js_1 = require("./core/hook-program.js");
 // ── the six ENTRY POINTS carry the experimental marking ─────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigiles",
-  "version": "21.0.0",
+  "version": "21.0.1",
   "description": "Audit, test and measure the harness your AI agent runs on — grade your CLAUDE.md / AGENTS.md, skills, subagents and hooks, run them against a scripted model, and measure whether they actually fire.",
   "keywords": [
     "claude-code",