vigiles 25.0.0 → 26.0.0

package/README.md

@@ -173,7 +173,7 @@ Every path, script, symbol, and rule verified against reality — plus tool cont
 ### 🧪 Test — does the harness actually do its job?
 
 A hook that blocks nothing, a skill that hijacks unrelated prompts, context that never reaches the model — each passes a naive "did it run?" check. That gap is **false confidence**: a guard that looks like it works and silently doesn't. vigiles tests the real thing — hooks block, skills fire, subagents finish what they promised, a stray `git push` is caught before it happens. It drives a scripted stand-in for the model, not a live call, so it needs no key and runs on every commit.
-**[How testing works →](docs/harness-testing.md)**
+**[How testing works →](docs/harness-testing.md)** · Got a safety hook? **[Prove it blocks `rm -rf` and force-push →](docs/harness-testing.md#prove-a-guard-actually-blocks-the-disaster-battery)**
 
 **Nothing you scan leaves your machine.** `lint`, `audit` and the deterministic test tiers make no network call at all — no telemetry, no analytics, no HTTP client in the package. Evals drive your own `claude` CLI on your own subscription, so no third party is introduced. **[What is and isn't transmitted →](docs/safety.md#does-vigiles-send-my-code-anywhere)**
 

package/dist/adapters/claude-code/run-scripts.d.ts

@@ -88,9 +88,12 @@ export declare function interpreterArgs(file: string, caps: NodeCaps, entry?: st
  * Expand the given path/glob patterns into concrete script files. A pattern
  * that is an existing file passes through unchanged; anything else is treated
  * as a glob. Falls back to `defaultGlob` when no patterns are given. Results
- * are deduped and sorted; `node_modules` and `dist` are always ignored.
+ * are deduped and sorted. `ignore` is the repo's ExcludeSet string face
+ * (src/exclude.ts — the floor plus `.vigilesrc.json#exclude`), REQUIRED so a
+ * vendored corpus's own `*.harness.mjs` cannot be discovered and run as ours
+ * (#192). A path given explicitly in `patterns` is still run.
  */
-export declare function discoverScripts(patterns: readonly string[], defaultGlob: string, cwd: string): string[];
+export declare function discoverScripts(patterns: readonly string[], defaultGlob: string, cwd: string, ignore: readonly string[]): string[];
 /** Extra wiring for {@link runScripts}. */
 export interface RunScriptsOptions {
     /**

package/dist/adapters/claude-code/run-scripts.js

@@ -150,9 +150,12 @@ function interpreterArgs(file, caps, entry) {
  * Expand the given path/glob patterns into concrete script files. A pattern
  * that is an existing file passes through unchanged; anything else is treated
  * as a glob. Falls back to `defaultGlob` when no patterns are given. Results
- * are deduped and sorted; `node_modules` and `dist` are always ignored.
+ * are deduped and sorted. `ignore` is the repo's ExcludeSet string face
+ * (src/exclude.ts — the floor plus `.vigilesrc.json#exclude`), REQUIRED so a
+ * vendored corpus's own `*.harness.mjs` cannot be discovered and run as ours
+ * (#192). A path given explicitly in `patterns` is still run.
  */
-function discoverScripts(patterns, defaultGlob, cwd) {
+function discoverScripts(patterns, defaultGlob, cwd, ignore) {
     const globs = patterns.length > 0 ? patterns : [defaultGlob];
     const found = new Set();
     for (const p of globs) {
@@ -173,7 +176,7 @@ function discoverScripts(patterns, defaultGlob, cwd) {
         // looked untested". Coverage learned it; the runner did not.
         for (const m of (0, glob_1.globSync)(p, {
             cwd,
-            ignore: ["node_modules/**", "dist/**"],
+            ignore: [...ignore],
             dot: true,
         })) {
             found.add(m);

package/dist/adapters/codex/eval.d.ts

@@ -61,6 +61,24 @@ export declare function codexSkillFired(run: {
  * turn. Pure fs — unit-testable without a binary.
  */
 export declare function installCodexSkills(pluginDir: string, cwd: string): number;
+/**
+ * Refuse an `effort` this adapter cannot honour, LOUDLY.
+ *
+ * The Claude runner pins the reasoning budget through `--effort` plus the env var
+ * it sits under. Codex exposes no mapping we have measured — its config carries a
+ * `model_reasoning_effort` key, but nothing here has driven the real binary
+ * through it, so claiming support would assert something unverified.
+ *
+ * The alternative — forwarding `task`/`cwd`/`timeoutMs` and dropping `effort` on
+ * the floor, as this runner does today — is the silent CC-only path the
+ * harness-parity rule forbids: a spec would declare `effort: "low"`, the lock
+ * would RECORD `low`, and the run would happen at whatever Codex defaults to.
+ * A stale number is recoverable; a confidently mislabelled one is not.
+ *
+ * Pure so the deferral itself is tested rather than living inside the ignored
+ * subprocess region.
+ */
+export declare function refuseCodexEffort(effort: string | number | undefined): void;
 /**
  * The Codex eval-tier `AgentRunner`: install the run's skills into `.codex/skills`
  * (Codex's discovery path, vs Claude's `--plugin-dir`), then drive a real

package/dist/adapters/codex/eval.js

@@ -32,6 +32,7 @@ exports.parseCodexEvalRun = parseCodexEvalRun;
 exports.codexRunError = codexRunError;
 exports.codexSkillFired = codexSkillFired;
 exports.installCodexSkills = installCodexSkills;
+exports.refuseCodexEffort = refuseCodexEffort;
 exports.codexEvalAgentRunner = codexEvalAgentRunner;
 exports.codexEvalRunner = codexEvalRunner;
 const node_child_process_1 = require("node:child_process");
@@ -172,6 +173,31 @@ function installCodexSkills(pluginDir, cwd) {
     }
     return n;
 }
+/**
+ * Refuse an `effort` this adapter cannot honour, LOUDLY.
+ *
+ * The Claude runner pins the reasoning budget through `--effort` plus the env var
+ * it sits under. Codex exposes no mapping we have measured — its config carries a
+ * `model_reasoning_effort` key, but nothing here has driven the real binary
+ * through it, so claiming support would assert something unverified.
+ *
+ * The alternative — forwarding `task`/`cwd`/`timeoutMs` and dropping `effort` on
+ * the floor, as this runner does today — is the silent CC-only path the
+ * harness-parity rule forbids: a spec would declare `effort: "low"`, the lock
+ * would RECORD `low`, and the run would happen at whatever Codex defaults to.
+ * A stale number is recoverable; a confidently mislabelled one is not.
+ *
+ * Pure so the deferral itself is tested rather than living inside the ignored
+ * subprocess region.
+ */
+function refuseCodexEffort(effort) {
+    if (effort === undefined)
+        return;
+    throw new Error(`effort (${JSON.stringify(effort)}) is not supported on the Codex adapter: ` +
+        `vigiles has not measured a mapping for it, so honouring the spec here ` +
+        `would record an effort the run did not use. Drop \`effort\` for this ` +
+        `harness, or run the eval on Claude Code.`);
+}
 /* v8 ignore start -- real codex subprocess; validated against the binary, not the unit gate */
 /**
  * The Codex eval-tier `AgentRunner`: install the run's skills into `.codex/skills`
@@ -180,6 +206,7 @@ function installCodexSkills(pluginDir, cwd) {
  * codexEvalDriver })` dispatches through.
  */
 function codexEvalAgentRunner(args) {
+    refuseCodexEffort(args.effort);
     if (args.pluginDir)
         installCodexSkills(args.pluginDir, args.cwd);
     return Promise.resolve(codexEvalRunner({

package/dist/cli.d.ts

@@ -9,6 +9,7 @@
  * `self-command-refs.test.ts` did not catch it because it guards against refs to
  * REMOVED commands, not against a list that merely stops growing.
  */
+import { type ExcludeSet } from "./exclude.js";
 import type { RuleSeverity } from "./core/types.js";
 /** Reason the most recent `loadSpec()` returned null, or null if it succeeded. */
 export declare function specLoadFailureReason(): string | null;
@@ -130,6 +131,6 @@ export declare function lintTotals(report: LintReport): {
  * third-party plugins — and scoring someone else's vendored plugin as if it were
  * yours is the false-positive that gets a gate switched off.
  */
-export declare function discoverNestedBundles(root: string, exclude?: readonly string[]): string[];
+export declare function discoverNestedBundles(root: string, excludes: ExcludeSet): string[];
 export {};
 //# sourceMappingURL=cli.d.ts.map