vigiles 21.0.2 → 23.0.0

package/dist/coverage-evidence.js

@@ -1,10 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SURFACE_TOKEN = void 0;
+exports.strongerEvidence = strongerEvidence;
 exports.isColocatedTest = isColocatedTest;
 exports.prepareTest = prepareTest;
 exports.isEvalScript = isEvalScript;
 exports.hookScriptRefs = hookScriptRefs;
 exports.evidenceFor = evidenceFor;
+exports.hasSurfaceToken = hasSurfaceToken;
+exports.discoveryGlob = discoveryGlob;
+exports.matchesSurfaceGlob = matchesSurfaceGlob;
 exports.countEvidence = countEvidence;
 exports.formatEvidence = formatEvidence;
 exports.declaredSurfaceName = declaredSurfaceName;
@@ -92,8 +97,31 @@ exports.declaredSurfaceName = declaredSurfaceName;
  * impossible there and its count is 0 — see `test-coverage-files.ts`.
  */
 const frontmatter_read_js_1 = require("./core/frontmatter-read.js");
+const minimatch_1 = require("minimatch");
 const posix_path_js_1 = require("./posix-path.js");
 const source_refs_js_1 = require("./core/source-refs.js");
+/**
+ * Rank, strongest first — what "the STRONGEST evidence" is measured against.
+ *
+ * It exists because `coverageOf` promised strongest-not-first-found while
+ * actually keeping the first match, which was harmless only while `colocated`
+ * was the sole surviving tier: one tier cannot be out-ranked. Adding
+ * `configured` made the promise load-bearing again — a surface with both a
+ * colocated harness and a configured suite would otherwise be reported as
+ * whichever the glob list happened to yield first, so the provenance summary
+ * would depend on the ORDER of a config array. Colocation ranks higher because
+ * it is the stronger statement: the filesystem enforces the binding rather than
+ * a pattern asserting it.
+ */
+const EVIDENCE_RANK = {
+    executed: 0,
+    colocated: 1,
+    configured: 2,
+};
+/** Is `a` stronger evidence than `b`? */
+function strongerEvidence(a, b) {
+    return EVIDENCE_RANK[a] < EVIDENCE_RANK[b];
+}
 /**
  * Is `testPath` the colocated test OF this surface — NAMED after it, SITTING
  * BESIDE it?
@@ -252,20 +280,80 @@ function hookScriptRefs(manifestText, layout, exists) {
  * `colocated` is passed in because placement is a path question the two twins
  * answer with their own (disk vs POSIX-string) path helpers.
  */
-function evidenceFor(_surface, _test, colocated) {
-    return colocated ? "colocated" : null;
+function evidenceFor(_surface, _test, colocated, configured = false) {
+    if (colocated)
+        return "colocated";
+    return configured ? "configured" : null;
+}
+/**
+ * The `{surface}` placeholder in a user's `testGlobs` — the ONE thing that makes
+ * a centralized test layout expressible without weakening what coverage MEANS.
+ *
+ * The retired `declared` and `name-mentioned` tiers died because they could
+ * credit a surface no test touched: a mention is a substring, and a substring
+ * matched this file's own fixtures. `{surface}` cannot do that. The user writes
+ * `tests/{surface}/evals/promptfooconfig*.yaml`, and the placeholder is replaced
+ * with the surface's NAME before matching — so the binding between test and
+ * surface is still the name, exactly as under colocation. Only the PLACE moves.
+ *
+ * What it costs, stated plainly because it is the argument colocation was chosen
+ * on: `ls` beside the skill no longer answers "is this tested?" — you have to
+ * know where the project keeps its tests. That is a real loss, and it is why
+ * this is opt-in per repo rather than a second default. A project that has
+ * already centralized its suites has paid that cost anyway.
+ */
+exports.SURFACE_TOKEN = "{surface}";
+/** Does this glob delegate its surface binding to the placeholder? */
+function hasSurfaceToken(glob) {
+    return glob.includes(exports.SURFACE_TOKEN);
+}
+/**
+ * The pattern to DISCOVER files with: the placeholder widened to `*` so one
+ * glob pass finds every candidate. Narrowing back to the right surface happens
+ * at match time — discovery must stay surface-agnostic or it would be one glob
+ * pass per surface.
+ */
+function discoveryGlob(glob) {
+    return glob.split(exports.SURFACE_TOKEN).join("*");
+}
+/**
+ * Does this test file sit at a `{surface}` path configured FOR THIS SURFACE?
+ *
+ * The placeholder is replaced with the surface's own name, so
+ * `tests/{surface}/evals/*.yaml` credits `tests/mysql-designer/evals/x.yaml` to
+ * `mysql-designer` and to nothing else. A glob WITHOUT the placeholder returns
+ * false here on purpose: a plain custom glob widens what counts as a test file,
+ * which it always did, but it says nothing about WHICH surface the file is for
+ * — and inferring that from a substring is exactly the retired `name-mentioned`
+ * tier that credited surfaces nothing had touched.
+ *
+ * `minimatch` (already a direct dependency, pure JS) so the browser twin can
+ * share this instead of growing a second matcher that disagrees.
+ */
+function matchesSurfaceGlob(surface, testPath, globs) {
+    const test = posixly(testPath);
+    return globs.some((g) => {
+        if (!hasSurfaceToken(g))
+            return false;
+        return (0, minimatch_1.minimatch)(test, g.split(exports.SURFACE_TOKEN).join(surface.name), {
+            dot: true,
+        });
+    });
 }
 /** Tally a list of decisions by evidence kind. */
 function countEvidence(decisions) {
     let executed = 0;
     let colocated = 0;
+    let configured = 0;
     for (const d of decisions) {
         if (d.evidence === "executed")
             executed += 1;
+        else if (d.evidence === "configured")
+            configured += 1;
         else
             colocated += 1;
     }
-    return { executed, colocated };
+    return { executed, colocated, configured };
 }
 /**
  * One line naming how the coverage was established. Printed wherever a coverage
@@ -287,6 +375,11 @@ function formatEvidence(counts) {
         parts.push(`${String(counts.colocated)} colocated — a test NAMED after the surface, ` +
             `in the surface's own place. This says the file EXISTS, not that it ran`);
     }
+    if (counts.configured > 0) {
+        parts.push(`${String(counts.configured)} configured — a test NAMED after the surface ` +
+            `at a \`{surface}\` path you configured. Same name binding as colocation, ` +
+            `different place; still only says the file EXISTS`);
+    }
     if (parts.length === 0)
         return "";
     return `How coverage was decided: ${parts.join("; ")}.`;

package/dist/eval.d.ts

@@ -724,6 +724,16 @@ export interface TriggerRateReport {
      * description). A non-zero count is the whole-harness measurement.
      */
     readonly competitors: number;
+    /**
+     * The plugin namespace the skills actually installed under — the `<plugin>`
+     * half of the `<plugin>:<skill>` id `skillResolved` matches.
+     *
+     * Reported because with `skillsDir` the name is chosen by the packager, not by
+     * the caller, so the single most common cause of a 0% run was a value the
+     * caller had no way to know. Optional so a report recorded before this field
+     * still parses.
+     */
+    readonly namespace?: string;
     /**
      * Runs EXCLUDED because the turn errored / was rate-limited (detected by the
      * driver's `runError`), present only when > 0. These are NOT counted in `n` or

package/dist/eval.js

@@ -1577,6 +1577,7 @@ function resolveTriggerPluginDir(spec) {
         pluginDir,
         packaged,
         competitors: Math.max(0, countSkills(pluginDir) - 1),
+        namespace: underTestSource(spec).name,
     };
 }
 /** Run one prompt set × trials through `runner`, aggregating fired counts. */
@@ -1683,7 +1684,7 @@ async function measureTriggerRateWith(spec, runner, parse = parseClaudeRun, runE
         throw new Error(`measureTriggerRate: model "${model}" is below the minimum "${minModel}" — ` +
             "trigger-rate under-measures selection on a weaker model " +
             "(raise the model, or lower `minModel` for a deliberately cheap run).");
-    const { pluginDir, packaged, competitors } = resolveTriggerPluginDir(spec);
+    const { pluginDir, packaged, competitors, namespace } = resolveTriggerPluginDir(spec);
     const cfg = {
         trials: spec.trials ?? 1,
         // Sonnet, not haiku: trigger-rate is a selection measurement and haiku
@@ -1729,6 +1730,7 @@ async function measureTriggerRateWith(spec, runner, parse = parseClaudeRun, runE
                 n: relevant.n,
                 perPrompt: relevant.perPrompt,
                 competitors,
+                namespace,
                 errored: positiveOrUndefined(relevant.errored),
                 usage: aggregateUsage(relevant.usages),
             };
@@ -1833,8 +1835,17 @@ function formatTriggerRateReport(report) {
     // must not be second-guessed; a checker that hedges on good data gets ignored.
     if (report.n > 0 && report.rate === 0)
         lines.push("⚠ nothing fired on ANY prompt. That is usually SETUP, not the description — check, in order:\n" +
-            "  1. the id in `fired` — `skillResolved` matches the NAMESPACED id " +
-            "(`<plugin>:<skill>`); a bare name silently never matches;\n" +
+            // The runtime RESOLVED the namespace before spending a token, so it
+            // prints the id that should have matched instead of telling the reader
+            // to go work it out. With `skillsDir` the name is not even the user's
+            // choice — the packager picks it — so "check the id" was advice about a
+            // value they had never seen.
+            (report.namespace !== undefined
+                ? "  1. the id in `fired` — your skills installed under " +
+                    `\`${report.namespace}\`, so \`skillResolved\` matches ` +
+                    `\`${report.namespace}:<skill>\`; a bare name silently never matches;\n`
+                : "  1. the id in `fired` — `skillResolved` matches the NAMESPACED id " +
+                    "(`<plugin>:<skill>`); a bare name silently never matches;\n") +
             "  2. the install field — a loose `.claude/skills` dir needs `skillsDir`, " +
             "not `pluginDir` (which wants a full plugin manifest);\n" +
             "  3. the `fixture` — a run starts in an EMPTY cwd, so a prompt about a " +

package/dist/plugin-loader.js

@@ -254,6 +254,40 @@ function materializeSurfaces(root, layout, files, sources) {
             counts[surface] = (counts[surface] ?? 0) + Object.keys(tree).length;
         }
     };
+    /**
+     * Read the path-scoped RULES dir (`.claude/rules/*.md` on Claude Code).
+     *
+     * DELIBERATELY NOT a `surfaceDirs` entry, and the distinction is the whole
+     * design: `surfaceDirs` decides whether a directory counts as a LOADABLE
+     * MACHINE, and rules are instructions, not an invocable surface — folding them
+     * in would silently change what "an empty machine" means for every harness.
+     * So they are read here, added to `files` for the checks that read text
+     * (frontmatter-valid, the rule map), and left out of `counts` and
+     * `hasLoadable`. A layout with no `rulesDir` reads nothing and behaves exactly
+     * as before. Closes #175.3: a whole instruction layer the audit could not see.
+     */
+    const materializeRules = () => {
+        const dir = layout.rulesDir;
+        if (!dir)
+            return;
+        // Read BOTH candidate bases, and NOT the resolved `scopes`. Rules are not
+        // tied to where the invocable surfaces live: a repo can keep its skills at
+        // the root (a published plugin) while its rules sit under `.claude/`, and
+        // keying off scopes then read the wrong directory and found nothing —
+        // measured on exactly that shape while building this.
+        //
+        // Each base keys at its own real path (`rules/…` and `.claude/rules/…`), so
+        // a repo with both loses neither and nothing collides.
+        const bases = [
+            "",
+            ...(layout.userSurfaceRoot !== undefined ? [layout.userSurfaceRoot] : []),
+        ];
+        for (const base of bases) {
+            const tree = surfaceTree((0, node_path_1.join)(root, base, dir));
+            for (const [rel, content] of Object.entries(tree))
+                add((0, node_path_1.join)(base, dir, rel), content, (0, node_path_1.join)(root, base, dir, rel));
+        }
+    };
     const source = (0, surface_scopes_js_1.surfaceSource)(layout, {
         hasRootSkillFile: (0, node_fs_1.existsSync)((0, node_path_1.join)(root, "SKILL.md")),
         skillName: (0, node_path_1.basename)(root),
@@ -280,6 +314,7 @@ function materializeSurfaces(root, layout, files, sources) {
             (0, surface_scopes_js_1.assertDistinctScopeKeys)(source.scopes, layout.name);
             for (const scope of source.scopes)
                 materializeScope(scope, scope.base === "" ? rootTrees : userTrees);
+            materializeRules();
             return { counts, scopes: source.scopes };
         }
         /* v8 ignore next 2 -- exhaustiveness guard, unreachable given SurfaceSource */

package/dist/run-hook.d.ts

@@ -163,10 +163,30 @@ export interface HookRunResult extends ScriptRunResult {
     /** Parsed stdout JSON if the hook emitted a JSON decision, else null. */
     readonly json: HookOutput | null;
     /**
-     * Normalized decision: a deny/block via exit 2, `decision:"block"`, or
-     * `permissionDecision:"deny"` all set `blocked = true`.
+     * Normalized decision: the dangerous call did NOT go through. Set by exit 2,
+     * `decision:"block"`, `permissionDecision:"deny"`, or the harness's
+     * halt-the-turn field (Claude Code `{"continue": false}` — see
+     * {@link HookRunResult.haltsTurn}).
+     *
+     * The halt case was missing until 2026-08-31 (#174), and the shape of that bug
+     * is worth keeping written down: `verifyGuardrail` reads this field, so a real
+     * `PreToolUse` guard that stopped every one of the disaster battery's commands
+     * was reported by `assertBlocksDisasters` as blocking NONE of them. A tool
+     * whose stated job is catching a guard that looks fine and silently does
+     * nothing said the opposite about a working guard — the same false-confidence
+     * failure, with the sign flipped.
      */
     readonly blocked: boolean;
+    /**
+     * The hook halted the WHOLE TURN rather than denying one call — the harness's
+     * `haltsTurnField` came back `false`.
+     *
+     * Reported separately because it is strictly stronger than a deny and the two
+     * are worth telling apart when a test asks WHICH mechanism fired. `blocked`
+     * stays the question nearly every caller means ("did the action happen?"), so
+     * a halt sets both.
+     */
+    readonly haltsTurn: boolean;
     /**
      * The decision the hook expressed, preferring the structured
      * `permissionDecision` ("allow"|"deny"|"ask") then legacy `decision`
@@ -183,6 +203,7 @@ export declare function parseHookOutput(stdout: string): HookOutput | null;
 export declare function decideHook(exitCode: number, json: HookOutput | null, protocol?: HookProtocol): {
     blocked: boolean;
     decision: HookRunResult["decision"];
+    haltsTurn: boolean;
 };
 /**
  * The hook layer over {@link runScriptWith}: serialize the event to stdin, run

package/dist/run-hook.js

@@ -130,9 +130,16 @@ function parseHookOutput(stdout) {
 function decideHook(exitCode, json, protocol = hook_protocol_js_1.claudeCodeHookProtocol) {
     const permission = json?.hookSpecificOutput?.permissionDecision;
     const decision = permission ?? json?.decision;
+    // The halt field is read from the PORT, never hard-coded: `"continue"` is a
+    // documented Claude Code fact and an unverified one for Codex, so the harness
+    // that has it declares it (core ⊄ adapter). `=== false` and not falsy —
+    // an absent field must not read as a halt.
+    const haltField = protocol.haltsTurnField;
+    const haltsTurn = haltField !== undefined && json?.[haltField] === false;
     const blocked = exitCode === protocol.blockExitCode ||
+        haltsTurn ||
         (decision !== undefined && protocol.denyDecisionValues.includes(decision));
-    return { blocked, decision };
+    return { blocked, decision, haltsTurn };
 }
 /**
  * The hook layer over {@link runScriptWith}: serialize the event to stdin, run
@@ -143,8 +150,8 @@ function decideHook(exitCode, json, protocol = hook_protocol_js_1.claudeCodeHook
 function runHookWith(command, input, opts, deps) {
     const res = (0, run_script_js_1.runScriptWith)(command, JSON.stringify(input), opts, deps);
     const json = parseHookOutput(res.stdout);
-    const { blocked, decision } = decideHook(res.exitCode, json);
-    return { ...res, json, blocked, decision };
+    const { blocked, decision, haltsTurn } = decideHook(res.exitCode, json);
+    return { ...res, json, blocked, decision, haltsTurn };
 }
 /**
  * Run a hook command, piping `input` as JSON to its stdin, and report the exit

package/dist/scan-core.d.ts

@@ -30,6 +30,11 @@ export interface SurfaceClassifier {
      * one. Null for a path this classifier does not call an agent.
      */
     readonly agentName: (f: string) => string | null;
+    /**
+     * A path-scoped RULES file (`<rulesDir>/<name>.md`) — an INSTRUCTION surface,
+     * not an invocable one. Always false for a layout with no `rulesDir`.
+     */
+    readonly isRule: (f: string) => boolean;
 }
 export declare function makeClassifier(layout: PluginLayout): SurfaceClassifier;
 /** The plugin-root + materialize-root + dialect context skill scanning needs. */

package/dist/scan-core.js

@@ -146,9 +146,13 @@ function makeClassifier(layout) {
     const skill = at(layout.skillDir);
     const agent = at(layout.agentDir);
     const command = at(layout.commandDir);
+    const rules = at(layout.rulesDir ?? "");
     const skillRe = skill ? new RegExp(`${skill}[^/]+/SKILL\\.md$`) : null;
     const agentRe = agent ? new RegExp(`${agent}${layout_js_1.AGENT_FILE_LEAF_RE}$`) : null;
     const commandRe = command ? new RegExp(`${command}.+\\.md$`) : null;
+    // Flat `<rulesDir>/<name>.md`, like commands. A layout without a rules dir
+    // yields null and every path below answers false — the additive default.
+    const ruleRe = rules ? new RegExp(`${rules}[^/]+\\.md$`) : null;
     // A subagent lives under the plugin's `agents/` dir AT ANY DEPTH (the harness
     // reads it recursively — see AGENT_FILE_LEAF_RE for the vendor's wording and
     // the measurement), but never under ANOTHER surface dir. Two real-world
@@ -191,6 +195,7 @@ function makeClassifier(layout) {
         isSkill,
         isAgent,
         isCommand: (f) => commandRe?.test(f) ?? false,
+        isRule: (f) => ruleRe?.test(f) ?? false,
         agentName: (f) => isAgent(f) ? (0, layout_js_1.agentSurfaceName)(f, layout.agentDir) : null,
     };
 }
@@ -746,7 +751,11 @@ function frontmatterValueIssuesFor(files, cls) {
 function malformedFrontmatterFor(files, cls) {
     const out = [];
     for (const [path, md] of Object.entries(files)) {
-        if (!cls.isSkill(path) && !cls.isAgent(path))
+        // Rules join skills + agents here: `.claude/rules/*.md` carries a `paths:`
+        // frontmatter key that SCOPES the instruction, so unparseable YAML there
+        // silently changes which files the rule applies to — the same defect this
+        // check exists for, on a surface no layout named until now (#175.3).
+        if (!cls.isSkill(path) && !cls.isAgent(path) && !cls.isRule(path))
             continue;
         if (!(0, frontmatter_read_js_1.readFrontmatter)(md).malformed)
             continue;

package/dist/spec-hooks.d.mts

@@ -0,0 +1,35 @@
+type ResolveContext = {
+    parentURL?: string;
+    conditions: string[];
+};
+type Resolved = {
+    url: string;
+    format?: string | null;
+    shortCircuit?: boolean;
+};
+type NextResolve = (specifier: string, context: ResolveContext) => Resolved | Promise<Resolved>;
+type LoadContext = {
+    format?: string | null;
+    conditions: string[];
+};
+type Loaded = {
+    format: string;
+    source?: string | ArrayBuffer;
+    shortCircuit?: boolean;
+};
+type NextLoad = (url: string, context: LoadContext) => Loaded | Promise<Loaded>;
+/**
+ * `./x.js` → `./x.ts` when the sibling exists.
+ *
+ * This is the TypeScript ESM convention (`tsc` under `nodenext` requires the
+ * `.js` extension in the source), which `tsx` implements and native Node does
+ * not. It is the ONE divergence that matters in practice: this repository's own
+ * dogfood specs import `src/core/spec.js`, a file that does not exist on disk.
+ * Attempted only AFTER normal resolution fails, so it can never shadow a real
+ * `.js` file.
+ */
+export declare function resolve(specifier: string, context: ResolveContext, nextResolve: NextResolve): Promise<Resolved>;
+/** Transpile `.ts`/`.mts` with the TypeScript this package already ships. */
+export declare function load(url: string, context: LoadContext, nextLoad: NextLoad): Promise<Loaded>;
+export {};
+//# sourceMappingURL=spec-hooks.d.mts.map

package/dist/spec-hooks.mjs

@@ -0,0 +1,68 @@
+/**
+ * Module customization hooks for the spec host — vigiles' OWN loader for `.ts`
+ * specs, replacing "whichever loader happens to be installed".
+ *
+ * Why vigiles owns this rather than shelling to `tsx`:
+ *
+ *   - **No install, no network.** `typescript` is already a runtime dependency
+ *     of this package (`dependencies`, and `core/compile-generator.ts` uses it),
+ *     so `ts.transpileModule` costs nothing extra. The bug that started this
+ *     work was a consuming repo without `tsx`, where `npx tsx` went to the
+ *     registry and every one of 50 specs blew a 15s budget.
+ *   - **One resolution contract.** Before this, a spec's module resolution
+ *     depended on the user's Node version and on which loader won — so a spec
+ *     could load locally and fail in CI under different rules. A tool that
+ *     audits other tools for that kind of quiet divergence should not have it.
+ *
+ * Scope is deliberately small and documented as such: `.ts`/`.mts` sources, the
+ * `./x.js` → `./x.ts` specifier rewrite, and bare specifiers. NOT tsconfig
+ * `paths`, JSX, or decorator configuration — specs are configuration modules,
+ * not applications.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import ts from "typescript";
+const TS_SOURCE = /\.m?ts$/;
+/**
+ * `./x.js` → `./x.ts` when the sibling exists.
+ *
+ * This is the TypeScript ESM convention (`tsc` under `nodenext` requires the
+ * `.js` extension in the source), which `tsx` implements and native Node does
+ * not. It is the ONE divergence that matters in practice: this repository's own
+ * dogfood specs import `src/core/spec.js`, a file that does not exist on disk.
+ * Attempted only AFTER normal resolution fails, so it can never shadow a real
+ * `.js` file.
+ */
+export async function resolve(specifier, context, nextResolve) {
+    try {
+        return await nextResolve(specifier, context);
+    }
+    catch (err) {
+        if (specifier.endsWith(".js") && context.parentURL) {
+            const candidate = new URL(specifier.slice(0, -3) + ".ts", context.parentURL);
+            if (existsSync(fileURLToPath(candidate))) {
+                return { url: candidate.href, format: "module", shortCircuit: true };
+            }
+        }
+        throw err;
+    }
+}
+/** Transpile `.ts`/`.mts` with the TypeScript this package already ships. */
+export async function load(url, context, nextLoad) {
+    if (!TS_SOURCE.test(new URL(url).pathname))
+        return nextLoad(url, context);
+    const fileName = fileURLToPath(url);
+    const { outputText } = ts.transpileModule(readFileSync(fileName, "utf-8"), {
+        fileName,
+        compilerOptions: {
+            module: ts.ModuleKind.ESNext,
+            target: ts.ScriptTarget.ES2022,
+            // Erasing types is the whole job; anything that changes SEMANTICS is not
+            // ours to decide for a spec.
+            verbatimModuleSyntax: false,
+            isolatedModules: true,
+        },
+    });
+    return { format: "module", source: outputText, shortCircuit: true };
+}
+//# sourceMappingURL=spec-hooks.mjs.map

package/dist/spec-host.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=spec-host.d.mts.map

package/dist/spec-host.mjs

@@ -0,0 +1,79 @@
+/**
+ * The spec host — a child process that loads specs and streams results as NDJSON.
+ *
+ * ONE host per CLI command, not one per spec: Node startup and the TypeScript
+ * load are paid once, then each spec costs a transpile.
+ *
+ * 🔴 **Why a child process at all, when `import()` works in-process.** Because a
+ * module evaluation cannot be cancelled once started. `Promise.race` returns
+ * control to the caller but the evaluation keeps running and holds the event
+ * loop, so a spec that stalls at top level hangs `compile`, `test` and `audit`
+ * with no bound. A child can be killed. That is the entire argument, and it is
+ * why the in-process loader this replaced could not be repaired: it also had to
+ * answer "did the module body already run?" to know whether re-running was
+ * safe, and Node does not expose that bit — `ERR_MODULE_NOT_FOUND` and
+ * `SyntaxError` each occur both before and during evaluation.
+ *
+ * Protocol, one JSON object per line each way:
+ *   in   {"path":"<abs path to spec>"}
+ *   out  {"path":"…","phase":"start"}          — emitted BEFORE evaluation
+ *   out  {"path":"…","ok":true,"value":{…}}
+ *   out  {"path":"…","ok":false,"error":"…"}
+ *
+ * The `start` line is what makes a hang diagnosable: when the parent's deadline
+ * fires, the last `start` without a result NAMES the spec that stalled. Before
+ * this, a stalled load produced N identical failures and no culprit.
+ *
+ * Values cross as JSON, which is not a new constraint — the previous `npx tsx`
+ * path already did `JSON.stringify` in the child and `JSON.parse` in the parent,
+ * so every spec that has ever loaded survived this round trip. Spec types carry
+ * no functions; TypeScript is the authoring layer, the value is data.
+ */
+import { register } from "node:module";
+import { pathToFileURL } from "node:url";
+register(new URL("./spec-hooks.mjs", import.meta.url));
+function say(line) {
+    process.stdout.write(JSON.stringify(line) + "\n");
+}
+async function loadOne(path) {
+    say({ path, phase: "start" });
+    try {
+        const mod = (await import(pathToFileURL(path).href));
+        // CJS interop can nest the default one level deeper.
+        const raw = mod.default;
+        const value = raw && typeof raw === "object" && "default" in raw ? raw.default : raw;
+        if (value === undefined) {
+            say({ path, ok: false, error: "the spec has no default export." });
+            return;
+        }
+        say({ path, ok: true, value });
+    }
+    catch (err) {
+        say({
+            path,
+            ok: false,
+            error: err instanceof Error ? (err.stack ?? err.message) : String(err),
+        });
+    }
+}
+// Requests are serialised: a spec may depend on module state a previous one set
+// up, and interleaving would make a hang impossible to attribute.
+let queue = Promise.resolve();
+let buffered = "";
+process.stdin.setEncoding("utf-8");
+process.stdin.on("data", (chunk) => {
+    buffered += chunk;
+    let nl;
+    while ((nl = buffered.indexOf("\n")) >= 0) {
+        const line = buffered.slice(0, nl).trim();
+        buffered = buffered.slice(nl + 1);
+        if (!line)
+            continue;
+        const { path } = JSON.parse(line);
+        queue = queue.then(() => loadOne(path));
+    }
+});
+process.stdin.on("end", () => {
+    queue.then(() => process.exit(0));
+});
+//# sourceMappingURL=spec-host.mjs.map

package/dist/test-coverage-files.js

@@ -202,26 +202,28 @@ function isColocated(surface, testPath) {
     return (0, coverage_evidence_js_1.isColocatedTest)(surface, testPath);
 }
 /** Mirror of test-coverage.ts `coverageOf` — strongest evidence across tests. */
-function coverageOf(surface, tests) {
+function coverageOf(surface, tests, globs) {
     let best = null;
     for (const t of tests) {
         if (t.path === surface.path)
             continue;
-        const ev = (0, coverage_evidence_js_1.evidenceFor)(surface, t, isColocated(surface, t.path));
+        const ev = (0, coverage_evidence_js_1.evidenceFor)(surface, t, isColocated(surface, t.path), (0, coverage_evidence_js_1.matchesSurfaceGlob)(surface, t.path, globs));
         if (!ev)
             continue;
-        if (!best)
+        // Rank, do not first-win: with a colocated harness AND a configured
+        // suite the reported provenance must not depend on glob order.
+        if (!best || (0, coverage_evidence_js_1.strongerEvidence)(ev, best.evidence))
             best = { surface, evidence: ev, by: t.path };
     }
     return best;
 }
 /** Mirror of test-coverage.ts `tierOf` — one tier's covered/untested split. */
-function tierOf(considered, tests) {
+function tierOf(considered, tests, globs) {
     const covered = [];
     const untested = [];
     const decisions = [];
     for (const s of considered) {
-        const decision = coverageOf(s, tests);
+        const decision = coverageOf(s, tests, globs);
         if (decision) {
             covered.push(s);
             decisions.push(decision);
@@ -252,12 +254,19 @@ repoName) {
     ];
     const considered = surfaces.filter((s) => !s.ignored);
     const tests = discoverTests(files);
-    const union = tierOf(considered, tests);
+    // NO configured `{surface}` globs here, and that is a property of this twin
+    // rather than a gap: the browser engine reads a file MAP, not a repo, so there
+    // is no `.vigilesrc.json` for a user to have configured. Passing an empty list
+    // makes `matchesSurfaceGlob` false for everything, so this path behaves exactly
+    // as it did before the tier existed. Said out loud because a silent asymmetry
+    // between the twins is how they drift.
+    const noConfiguredGlobs = [];
+    const union = tierOf(considered, tests, noConfiguredGlobs);
     return {
         untested: [...union.untested],
         decisions: union.decisions,
-        harness: tierOf(considered, tests.filter((t) => !(0, coverage_evidence_js_1.isEvalScript)((0, posix_path_js_1.basename)(t.path)))),
-        evals: tierOf(considered, tests.filter((t) => (0, coverage_evidence_js_1.isEvalScript)((0, posix_path_js_1.basename)(t.path)))),
+        harness: tierOf(considered, tests.filter((t) => !(0, coverage_evidence_js_1.isEvalScript)((0, posix_path_js_1.basename)(t.path))), noConfiguredGlobs),
+        evals: tierOf(considered, tests.filter((t) => (0, coverage_evidence_js_1.isEvalScript)((0, posix_path_js_1.basename)(t.path))), noConfiguredGlobs),
     };
 }
 //# sourceMappingURL=test-coverage-files.js.map