vigiles 26.2.0 → 27.0.0

package/dist/audit-score.js

@@ -308,7 +308,7 @@ function safety(r) {
 }
 /**
  * TESTED — DETERMINISTIC harness coverage only (`*.harness.*`, plus any custom
- * `testGlobs`):
+ * `include`):
  * free, milliseconds, every push. It answers "does this gate still catch what it
  * claims?" The real-model tier is a SEPARATE ring ({@link evaluated}) because it
  * differs on cost, on cadence AND on the question it answers — folding both into

package/dist/cli-commands.d.ts

@@ -7,7 +7,7 @@
  *
  * VERBS are typed by a human/agent/CI. HOOK_RUNTIME_KINDS are the hidden runtime
  * entrypoints under `vigiles hook-runtime <kind>`, emitted into hooks configs and
- * never typed by hand. A behavioural test asserts the dispatch (`src/cli.ts`)
+ * never typed by hand. A behavioural test asserts the dispatch (`src/cli-main.ts`)
  * recognizes exactly these, so this list can't silently drift from the code.
  */
 /** Human-facing verbs (printed in help; typed by a human/agent/CI). */

package/dist/cli-commands.js

@@ -8,7 +8,7 @@
  *
  * VERBS are typed by a human/agent/CI. HOOK_RUNTIME_KINDS are the hidden runtime
  * entrypoints under `vigiles hook-runtime <kind>`, emitted into hooks configs and
- * never typed by hand. A behavioural test asserts the dispatch (`src/cli.ts`)
+ * never typed by hand. A behavioural test asserts the dispatch (`src/cli-main.ts`)
  * recognizes exactly these, so this list can't silently drift from the code.
  */
 Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cli-main.d.ts

@@ -0,0 +1,146 @@
+/**
+ * vigiles CLI — verify your agent harness is real, and prove it works.
+ *
+ * The verbs and their one-liners live in ONE place, `COMMAND_HELP` + `HELP_GROUPS`
+ * near the bottom of this file, and `--help` prints from that table. A second list
+ * here would be a copy that rots — this docblock WAS that copy: it named four
+ * commands and omitted `audit`, `test`, `eval` and `eject`, four of the eight, and
+ * `self-command-refs.test.ts` did not catch it because it guards against refs to
+ * REMOVED commands, not against a list that merely stops growing.
+ */
+import { type ExcludeSet } from "./exclude.js";
+import type { RuleSeverity } from "./core/types.js";
+/** Reason the most recent `loadSpec()` returned null, or null if it succeeded. */
+export declare function specLoadFailureReason(): string | null;
+/**
+ * Structured lint report used by --json, --summary, and exit-code logic.
+ */
+interface LintReport {
+    hashErrors: number;
+    validationErrors: number;
+    inlineErrors: number;
+    inlineRules: number;
+    frontmatterErrors: number;
+    frontmatterRules: number;
+    specRefIssues: number;
+    specRefErrors: number;
+    duplicatePairs: number;
+    /** Severity of `duplicate-instructions` — carried so the exit code can tier it. */
+    duplicateSeverity: RuleSeverity;
+    coverageEnabled: number;
+    coverageDocumented: number;
+    strengthenSuggestions: number;
+    integrityErrors: number;
+    coverageErrors: number;
+    orphanCount: number;
+    /** Severity of `orphan-docs` — carried so the exit code can tier it (#181). */
+    orphanSeverity: RuleSeverity;
+    untestedSurfaces: number;
+    untestedErrors: number;
+    toolContractIssues: number;
+    toolContractErrors: number;
+    hookEventIssues: number;
+    hookEventErrors: number;
+    frontmatterSchemaIssues: number;
+    frontmatterSchemaErrors: number;
+    mcpConfigIssues: number;
+    mcpConfigErrors: number;
+    skillFrontmatterIssues: number;
+    skillFrontmatterErrors: number;
+    mcpToolIssues: number;
+    mcpToolErrors: number;
+    hookScriptIssues: number;
+    hookScriptErrors: number;
+    disallowedToolIssues: number;
+    disallowedToolErrors: number;
+    descriptionOverlapIssues: number;
+    descriptionOverlapErrors: number;
+    descriptionBudgetIssues: number;
+    descriptionBudgetErrors: number;
+    frontmatterValidIssues: number;
+    frontmatterValidErrors: number;
+    mcpHookIssues: number;
+    mcpHookErrors: number;
+    preferCompiledHookIssues: number;
+    preferCompiledHookErrors: number;
+    lethalTrifectaIssues: number;
+    lethalTrifectaErrors: number;
+    skillResourceIssues: number;
+    skillResourceErrors: number;
+    skillFenceIssues: number;
+    skillFenceErrors: number;
+    pluginLayoutIssues: number;
+    pluginLayoutErrors: number;
+    delegationTrifectaIssues: number;
+    delegationTrifectaErrors: number;
+    hookBlockIssues: number;
+    hookBlockErrors: number;
+    hookMatcherIssues: number;
+    hookMatcherErrors: number;
+    docRefErrors: number;
+    symbolRefErrors: number;
+    mcpRefErrors: number;
+    files: string[];
+    /**
+     * Findings / errors / warnings for the whole run — the same numbers the
+     * human-readable summary line prints, so a consumer never has to reconstruct
+     * them by counting output lines (#183, and the generic-consumer half of #181).
+     */
+    totals?: {
+        findings: number;
+        errors: number;
+        warnings: number;
+    };
+}
+/** Exit codes: 0 clean, 1 warnings only, 2 hard errors. */
+/**
+ * The run's totals, derived from the report itself.
+ *
+ * 🔴 ONE SOURCE, because the two numbers disagreeing IS the bug (#183). The
+ * human-readable log had no total, and counting its `⚠` lines gave a different
+ * number from the JSON — 21 against 88 on a real repo — because some checks print
+ * one line per finding and others one line carrying a count. Both numbers were
+ * right and nothing said why they differed, so "vigiles reports 21 warnings" and
+ * "88 warnings" were equally defensible readings of one run.
+ *
+ * Counted GENERICALLY off the `*Issues` / `*Errors` / count keys rather than a
+ * hand-maintained list, so a rule added later is included by existing, not by
+ * somebody remembering. `orphanCount` and `duplicatePairs` are named explicitly
+ * only because they predate the `*Issues` convention (#181).
+ */
+export declare function lintTotals(report: LintReport): {
+    findings: number;
+    errors: number;
+    warnings: number;
+};
+/**
+ * Nested plugin bundles under a lint root — a directory that is itself a harness
+ * (its own `.claude-plugin/plugin.json`, or its own skills dir) and is NOT the
+ * root being linted.
+ *
+ * 🔴 WHY THIS EXISTS. Every per-surface check reads ONE root, so in a monorepo
+ * holding `skills/` plus `plugins/  * /skills/` the nested skills were never scored
+ * and nothing said so. Measured on a fixture: 4 skills over the description
+ * budget, `lint .` reported 2, exit 0 — a repo reads that as green-with-2 while
+ * the other 2 carry the same defect (#185). The failure is silent, which is the
+ * shape this repo treats as worse than a loud one.
+ *
+ * Deliberately shallow (one level under a container dir): deep recursion would
+ * sweep vendored corpora — this repo's own `test/dogfood/` holds real pinned
+ * third-party plugins — and scoring someone else's vendored plugin as if it were
+ * yours is the false-positive that gets a gate switched off.
+ */
+export declare function discoverNestedBundles(root: string, excludes: ExcludeSet): string[];
+/** Dispatch the skill-runtime subcommands. Returns false if unrecognized. */
+/**
+ * `vigiles hook-runtime <kind> [args]` — the hidden umbrella for RUNTIME
+ * entrypoints: the executables the harness invokes via a block `vigiles compile`
+ * emits into your hooks config, NEVER typed by a human. They stay off the help
+ * surface by design — verbs are typed, runtime entrypoints are emitted (the
+ * cohesive-cli-surface rule). Renaming a `<kind>` breaks every already-emitted
+ * block, so it is a breaking change.
+ */
+export declare function handleHookRuntime(kind: string | undefined, restArgs: string[]): Promise<void>;
+export declare function main(): Promise<void>;
+export {};
+//# sourceMappingURL=cli-main.d.ts.map