vigiles 27.0.0 → 27.1.0

package/dist/adapters/claude-code/run-scripts.d.ts

@@ -160,6 +160,19 @@ export interface RunScriptsEnv {
     readonly all: boolean;
     /** `--yes` / `--no-interactive` — agent/CI mode: never prompt. */
     readonly yes: boolean;
+    /**
+     * `--check` — VERIFY committed eval locks rather than measure. `decideLock`
+     * in check mode returns only `replay` (the recorded report, no model call) or
+     * `stale` (a failure), NEVER `run` — so this path cannot spend quota, and the
+     * quota consent below must not stand in its way.
+     *
+     * Measured 2026-09-09: the CI `eval-check` step had never once executed. With
+     * no lock committed anywhere, `eval --check` short-circuited on
+     * `anyLocksCommitted` and returned "skip"; the first repo to commit a lock got
+     * past that early return, reached this gate, and was refused exit 2. A gate
+     * that is green because it never runs is the failure this repo keeps naming.
+     */
+    readonly lockCheck: boolean;
 }
 /**
  * Consent gate for a bare (no-target) `vigiles eval`. `eval` runs the REAL model

package/dist/adapters/claude-code/run-scripts.js

@@ -346,6 +346,9 @@ function decideRunScripts(o) {
         return { kind: "run" };
     if (o.all || o.yes)
         return { kind: "run" };
+    // Verifying a lock is not spending quota — see `lockCheck`.
+    if (o.lockCheck)
+        return { kind: "run" };
     // A bounded no-target run (0 = no-op, 1 = a single obviously-intended eval) is
     // not the footgun; the footgun is fanning out over the whole tree.
     if (o.matchedCount <= 1)

package/dist/cli-main.js

@@ -4907,6 +4907,7 @@ async function handleRunScripts(kind, args, restArgs, excludes) {
         isTTY: (process.stdin.isTTY ?? false) && (process.stdout.isTTY ?? false),
         all: args.includes("--all"),
         yes: args.includes("--yes") || args.includes("--no-interactive"),
+        lockCheck: args.includes("--check"),
     });
     if (runDecision.kind === "refuse") {
         console.error(`✗ vigiles eval: ${String(runDecision.count)} eval file(s) matched the whole tree, and each ` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigiles",
-  "version": "27.0.0",
+  "version": "27.1.0",
   "description": "Audit, test and measure the harness your AI agent runs on — grade your CLAUDE.md / AGENTS.md, skills, subagents and hooks, run them against a scripted model, and measure whether they actually fire.",
   "keywords": [
     "claude-code",