vigiles 25.1.0 → 26.0.1

package/README.md

@@ -173,7 +173,7 @@ Every path, script, symbol, and rule verified against reality — plus tool cont
 ### 🧪 Test — does the harness actually do its job?
 
 A hook that blocks nothing, a skill that hijacks unrelated prompts, context that never reaches the model — each passes a naive "did it run?" check. That gap is **false confidence**: a guard that looks like it works and silently doesn't. vigiles tests the real thing — hooks block, skills fire, subagents finish what they promised, a stray `git push` is caught before it happens. It drives a scripted stand-in for the model, not a live call, so it needs no key and runs on every commit.
-**[How testing works →](docs/harness-testing.md)**
+**[How testing works →](docs/harness-testing.md)** · Got a safety hook? **[Prove it blocks `rm -rf` and force-push →](docs/harness-testing.md#prove-a-guard-actually-blocks-the-disaster-battery)**
 
 **Nothing you scan leaves your machine.** `lint`, `audit` and the deterministic test tiers make no network call at all — no telemetry, no analytics, no HTTP client in the package. Evals drive your own `claude` CLI on your own subscription, so no third party is introduced. **[What is and isn't transmitted →](docs/safety.md#does-vigiles-send-my-code-anywhere)**
 

package/dist/adapters/claude-code/run-scripts.d.ts

@@ -88,9 +88,12 @@ export declare function interpreterArgs(file: string, caps: NodeCaps, entry?: st
  * Expand the given path/glob patterns into concrete script files. A pattern
  * that is an existing file passes through unchanged; anything else is treated
  * as a glob. Falls back to `defaultGlob` when no patterns are given. Results
- * are deduped and sorted; `node_modules` and `dist` are always ignored.
+ * are deduped and sorted. `ignore` is the repo's ExcludeSet string face
+ * (src/exclude.ts — the floor plus `.vigilesrc.json#exclude`), REQUIRED so a
+ * vendored corpus's own `*.harness.mjs` cannot be discovered and run as ours
+ * (#192). A path given explicitly in `patterns` is still run.
  */
-export declare function discoverScripts(patterns: readonly string[], defaultGlob: string, cwd: string): string[];
+export declare function discoverScripts(patterns: readonly string[], defaultGlob: string, cwd: string, ignore: readonly string[]): string[];
 /** Extra wiring for {@link runScripts}. */
 export interface RunScriptsOptions {
     /**

package/dist/adapters/claude-code/run-scripts.js

@@ -150,9 +150,12 @@ function interpreterArgs(file, caps, entry) {
  * Expand the given path/glob patterns into concrete script files. A pattern
  * that is an existing file passes through unchanged; anything else is treated
  * as a glob. Falls back to `defaultGlob` when no patterns are given. Results
- * are deduped and sorted; `node_modules` and `dist` are always ignored.
+ * are deduped and sorted. `ignore` is the repo's ExcludeSet string face
+ * (src/exclude.ts — the floor plus `.vigilesrc.json#exclude`), REQUIRED so a
+ * vendored corpus's own `*.harness.mjs` cannot be discovered and run as ours
+ * (#192). A path given explicitly in `patterns` is still run.
  */
-function discoverScripts(patterns, defaultGlob, cwd) {
+function discoverScripts(patterns, defaultGlob, cwd, ignore) {
     const globs = patterns.length > 0 ? patterns : [defaultGlob];
     const found = new Set();
     for (const p of globs) {
@@ -173,7 +176,7 @@ function discoverScripts(patterns, defaultGlob, cwd) {
         // looked untested". Coverage learned it; the runner did not.
         for (const m of (0, glob_1.globSync)(p, {
             cwd,
-            ignore: ["node_modules/**", "dist/**"],
+            ignore: [...ignore],
             dot: true,
         })) {
             found.add(m);

package/dist/cli.d.ts

@@ -9,6 +9,7 @@
  * `self-command-refs.test.ts` did not catch it because it guards against refs to
  * REMOVED commands, not against a list that merely stops growing.
  */
+import { type ExcludeSet } from "./exclude.js";
 import type { RuleSeverity } from "./core/types.js";
 /** Reason the most recent `loadSpec()` returned null, or null if it succeeded. */
 export declare function specLoadFailureReason(): string | null;
@@ -130,6 +131,6 @@ export declare function lintTotals(report: LintReport): {
  * third-party plugins — and scoring someone else's vendored plugin as if it were
  * yours is the false-positive that gets a gate switched off.
  */
-export declare function discoverNestedBundles(root: string, exclude?: readonly string[]): string[];
+export declare function discoverNestedBundles(root: string, excludes: ExcludeSet): string[];
 export {};
 //# sourceMappingURL=cli.d.ts.map