vigiles 22.0.0 → 24.0.0

package/README.md

@@ -163,7 +163,7 @@ Every one of these is **valid markdown** — parses fine, does the wrong thing.
 | `test`  | Does the harness behave?       | No — a scripted stand-in | Every commit             |
 | `eval`  | Does a skill actually help?    | Yes — your subscription  | On demand                |
 
-**One engine, two doors.** `audit` is the local report; **`lint` is the CI gate** that fails the build on the same deterministic checks — broken refs, bad tool contracts, dead hooks, skill collisions (Proofs 1–2). `test` and `eval` go further: past _does it exist_ to _does it work_. (`init` / `compile` / `eject` manage the optional typed-spec layer for the structural rules no linter can express — a graduation step you rarely run by hand.) [How the verbs relate →](docs/commands-and-how-they-relate.md)
+**One engine, two doors.** `audit` is the local report; **`lint` is the CI gate** that fails the build on the same deterministic checks — broken refs, bad tool contracts, dead hooks, skill collisions (Proofs 1–2). `test` and `eval` go further: past _does it exist_ to _does it work_. (`init` / `compile` / `eject` manage the optional typed-spec layer for the structural rules no linter can express — a graduation step you rarely run by hand. If you use a spec, run `compile` in CI too: it is what re-derives that spec's refs, while `lint` verifies the compiled file is intact.) [How the verbs relate →](docs/commands-and-how-they-relate.md)
 
 ### 🔎 Lint — your instructions stop lying
 

package/dist/adapters/claude-code/hook-protocol.js

@@ -6,6 +6,9 @@ exports.claudeCodeHookProtocol = {
     blockExitCode: 2,
     denyDecisionValues: ["block", "deny"],
     eventEnvVars: [],
+    // `{"continue": false}` stops the turn outright and returns `stopReason` to
+    // the agent — a stronger stop than a per-call deny, and a documented one.
+    haltsTurnField: "continue",
     // Events that honor `hookSpecificOutput.additionalContext` (developer-context
     // injection). Covers vigiles's shipped inject hooks: the SessionStart lint
     // summary and the PostToolUse refs / eval-lock nudges.

package/dist/adapters/claude-code/layout.js

@@ -16,6 +16,8 @@ exports.claudeCodeLayout = {
     skillDir: "skills",
     agentDir: "agents",
     commandDir: "commands",
+    // `.claude/rules/*.md` — path-scoped project instructions (see PluginLayout).
+    rulesDir: "rules",
     materializeRoot: ".claude",
     pluginRootToken: "${CLAUDE_PLUGIN_ROOT}",
     // Both names Claude Code uses for the project root (mirrors the

package/dist/adapters/claude-code/run-scripts.js

@@ -24,6 +24,7 @@ exports.formatScriptSummary = formatScriptSummary;
 const node_child_process_1 = require("node:child_process");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
+const node_url_1 = require("node:url");
 const node_fs_1 = require("node:fs");
 const node_os_2 = require("node:os");
 const glob_1 = require("glob");
@@ -250,10 +251,23 @@ async function runScripts(files, cwd, env = {}, opts = {}) {
             return;
         }
         const countFile = (0, node_path_1.join)(countDir, `${String(i)}.count`);
-        const child = (0, node_child_process_1.spawn)("node", argv, {
+        // Resolve a harness's bare `vigiles` import from the CLI's OWN install, so
+        // running the gate does not require installing the package into the
+        // project — which, in a repo that already has a package.json, drags in the
+        // entire dependency tree (measured at 840 packages against vigiles' 42,
+        // #184). Only rescues that specifier, and only after normal resolution
+        // fails, so a locally installed copy still wins.
+        const selfRoot = (0, node_path_1.resolve)(__dirname, "..", "..", "..");
+        const hook = (0, node_url_1.pathToFileURL)((0, node_path_1.join)(selfRoot, "dist", "harness-resolve-hooks.mjs")).href;
+        const child = (0, node_child_process_1.spawn)("node", ["--import", hookImport(hook), ...argv], {
             cwd,
             stdio: ["ignore", "pipe", "pipe"],
-            env: { ...process.env, ...env, [check_count_js_1.CHECK_COUNT_ENV]: countFile },
+            env: {
+                ...process.env,
+                ...env,
+                VIGILES_SELF_ROOT: selfRoot,
+                [check_count_js_1.CHECK_COUNT_ENV]: countFile,
+            },
         });
         const chunks = [];
         child.stdout.on("data", (c) => chunks.push(c));
@@ -376,4 +390,14 @@ function formatScriptSummary(results) {
     }
     return lines.join("\n");
 }
+/**
+ * A `--import` argument that registers the resolver hook without a temp file:
+ * a data: URL calling `module.register`. Inline because writing a shim into the
+ * user's tree to run their tests would be a side effect the runner has no
+ * business having.
+ */
+function hookImport(hookHref) {
+    const src = `import {register} from "node:module";register(${JSON.stringify(hookHref)});`;
+    return `data:text/javascript,${encodeURIComponent(src)}`;
+}
 //# sourceMappingURL=run-scripts.js.map

package/dist/cli-flag-check.js

@@ -78,7 +78,7 @@ exports.COMMAND_FLAGS = {
     ],
     compile: [],
     eject: ["--keep-spec"],
-    lint: ["--summary", "--json"],
+    lint: ["--bundles=", "--summary", "--json", "--json-out="],
     // handleRunScripts (free tier — no lock flags).
     test: ["--min=", "--all", "--yes", "--no-interactive", "--no-skip"],
     // handleRunScripts + resolveEvalLockEnv + the trials knob.
@@ -95,6 +95,7 @@ exports.COMMAND_FLAGS = {
     audit: [
         "--json",
         "--md",
+        "--single",
         "--out=",
         "--no-html",
         "--no-json",

package/dist/cli.d.ts

@@ -9,6 +9,127 @@
  * `self-command-refs.test.ts` did not catch it because it guards against refs to
  * REMOVED commands, not against a list that merely stops growing.
  */
+import type { RuleSeverity } from "./core/types.js";
 /** Reason the most recent `loadSpec()` returned null, or null if it succeeded. */
 export declare function specLoadFailureReason(): string | null;
+/**
+ * Structured lint report used by --json, --summary, and exit-code logic.
+ */
+interface LintReport {
+    hashErrors: number;
+    validationErrors: number;
+    inlineErrors: number;
+    inlineRules: number;
+    frontmatterErrors: number;
+    frontmatterRules: number;
+    specRefIssues: number;
+    specRefErrors: number;
+    duplicatePairs: number;
+    /** Severity of `duplicate-instructions` — carried so the exit code can tier it. */
+    duplicateSeverity: RuleSeverity;
+    coverageEnabled: number;
+    coverageDocumented: number;
+    strengthenSuggestions: number;
+    integrityErrors: number;
+    coverageErrors: number;
+    orphanCount: number;
+    /** Severity of `orphan-docs` — carried so the exit code can tier it (#181). */
+    orphanSeverity: RuleSeverity;
+    untestedSurfaces: number;
+    untestedErrors: number;
+    toolContractIssues: number;
+    toolContractErrors: number;
+    hookEventIssues: number;
+    hookEventErrors: number;
+    frontmatterSchemaIssues: number;
+    frontmatterSchemaErrors: number;
+    mcpConfigIssues: number;
+    mcpConfigErrors: number;
+    skillFrontmatterIssues: number;
+    skillFrontmatterErrors: number;
+    mcpToolIssues: number;
+    mcpToolErrors: number;
+    hookScriptIssues: number;
+    hookScriptErrors: number;
+    disallowedToolIssues: number;
+    disallowedToolErrors: number;
+    descriptionOverlapIssues: number;
+    descriptionOverlapErrors: number;
+    descriptionBudgetIssues: number;
+    descriptionBudgetErrors: number;
+    frontmatterValidIssues: number;
+    frontmatterValidErrors: number;
+    mcpHookIssues: number;
+    mcpHookErrors: number;
+    preferCompiledHookIssues: number;
+    preferCompiledHookErrors: number;
+    lethalTrifectaIssues: number;
+    lethalTrifectaErrors: number;
+    skillResourceIssues: number;
+    skillResourceErrors: number;
+    skillFenceIssues: number;
+    skillFenceErrors: number;
+    pluginLayoutIssues: number;
+    pluginLayoutErrors: number;
+    delegationTrifectaIssues: number;
+    delegationTrifectaErrors: number;
+    hookBlockIssues: number;
+    hookBlockErrors: number;
+    hookMatcherIssues: number;
+    hookMatcherErrors: number;
+    docRefErrors: number;
+    symbolRefErrors: number;
+    mcpRefErrors: number;
+    files: string[];
+    /**
+     * Findings / errors / warnings for the whole run — the same numbers the
+     * human-readable summary line prints, so a consumer never has to reconstruct
+     * them by counting output lines (#183, and the generic-consumer half of #181).
+     */
+    totals?: {
+        findings: number;
+        errors: number;
+        warnings: number;
+    };
+}
+/** Exit codes: 0 clean, 1 warnings only, 2 hard errors. */
+/**
+ * The run's totals, derived from the report itself.
+ *
+ * 🔴 ONE SOURCE, because the two numbers disagreeing IS the bug (#183). The
+ * human-readable log had no total, and counting its `⚠` lines gave a different
+ * number from the JSON — 21 against 88 on a real repo — because some checks print
+ * one line per finding and others one line carrying a count. Both numbers were
+ * right and nothing said why they differed, so "vigiles reports 21 warnings" and
+ * "88 warnings" were equally defensible readings of one run.
+ *
+ * Counted GENERICALLY off the `*Issues` / `*Errors` / count keys rather than a
+ * hand-maintained list, so a rule added later is included by existing, not by
+ * somebody remembering. `orphanCount` and `duplicatePairs` are named explicitly
+ * only because they predate the `*Issues` convention (#181).
+ */
+export declare function lintTotals(report: LintReport): {
+    findings: number;
+    errors: number;
+    warnings: number;
+};
+/**
+ * Nested plugin bundles under a lint root — a directory that is itself a harness
+ * (its own `.claude-plugin/plugin.json`, or its own skills dir) and is NOT the
+ * root being linted.
+ *
+ * 🔴 WHY THIS EXISTS. Every per-surface check reads ONE root, so in a monorepo
+ * holding `skills/` plus `plugins/  * /skills/` the nested skills were never scored
+ * and nothing said so. Measured on a fixture: 4 skills over the description
+ * budget, `lint .` reported 2, exit 0 — a repo reads that as green-with-2 while
+ * the other 2 carry the same defect (#185). The failure is silent, which is the
+ * shape this repo treats as worse than a loud one.
+ *
+ * Deliberately shallow (one level under a container dir): deep recursion would
+ * sweep vendored corpora — this repo's own `test/dogfood/` holds real pinned
+ * third-party plugins — and scoring someone else's vendored plugin as if it were
+ * yours is the false-positive that gets a gate switched off.
+ */
+export declare function discoverNestedBundles(root: string, exclude?: readonly string[]): string[];
+export {};
 //# sourceMappingURL=cli.d.ts.map