vigiles 27.1.1 → 27.1.3

package/dist/core/frontmatter-read.js

@@ -124,19 +124,115 @@ function salvageField(block, key) {
         .replace(/["']$/, "")
         .trim() || undefined);
 }
-/** Salvage a list field from the raw block (single-line key only). */
+/** Salvage a list field from the raw block (single-line key only).
+ *
+ *  THE WRAPPER QUOTES COME OFF HERE, not in `splitList`, so both paths hand the
+ *  tokenizer the SAME shape. On valid YAML js-yaml has already removed a scalar's
+ *  surrounding quotes; only this regex salvage hands them through, and leaving
+ *  that asymmetry in place made `tools: "Bash(git status *), Read"` tokenize as
+ *  `Bash(git` · `status` · `*)` · `Read` — the opening YAML quote read as a shell
+ *  quote, so the parens stopped counting as structure and the grant's own spaces
+ *  split it. That is the phantom-tool failure #217 warned about, in the
+ *  false-EXPOSED direction (`bashGrantIsUnbounded` answers "unbounded" when it
+ *  cannot recognise a grant), and it was a REGRESSION: the older comma-only
+ *  parser recovered this input correctly.
+ *
+ *  Only a MATCHED pair is stripped, and only when it wraps the whole value — an
+ *  unbalanced leading quote is left alone rather than guessed at. */
 function salvageList(block, key) {
     const match = new RegExp(`^${key}:[ \\t]*(.*)$`, "m").exec(block);
     if (!match)
         return null;
-    return splitList(match[1]);
+    return splitList(stripWrapperQuotes(match[1]));
 }
-/** Split a comma list or inline-array string into trimmed, de-quoted tokens. */
+/** Remove ONE matched pair of quotes wrapping an entire scalar. */
+function stripWrapperQuotes(raw) {
+    const v = raw.trim();
+    const q = v[0];
+    if ((q === '"' || q === "'") && v.length >= 2 && v[v.length - 1] === q) {
+        return v.slice(1, -1);
+    }
+    return v;
+}
+/**
+ * Split a tool-list string into trimmed, de-quoted tokens.
+ *
+ * WHITESPACE IS A SEPARATOR, BUT ONLY AT PAREN DEPTH 0 — and that qualifier is
+ * the whole rule. Claude Code documents three equivalent spellings of
+ * `allowed-tools:`/`disallowed-tools:` (a comma-separated string, a
+ * SPACE-separated string, a YAML list), and its own documented example is
+ * space-separated with spaces INSIDE the tokens:
+ *
+ *   allowed-tools: Bash(git add *) Bash(git commit *) Bash(git status *)
+ *
+ * Until #217 this split on `,` alone, so a space-separated fence arrived as ONE
+ * token that matches no built-in name. That failed in the direction that misleads:
+ * a fence the harness really enforces was reported as closing no lethal-trifecta
+ * leg, so an author who wrote a correct fence was told it did nothing. Reported
+ * with a reproduction by @vlad-ryzhkov, measured on a 22-skill harness where the
+ * separator alone moved Safety 81 → 80 → 81.
+ *
+ * THE NAIVE FIX IS WORSE THAN THE BUG, which is why this is a tokenizer and not
+ * `split(/[,\s]+/)`: that shreds `Bash(git push *)` into `Bash(git`, `push`, `*)`,
+ * and since `bashGrantIsUnbounded()` answers "unbounded" when it cannot recognise
+ * a grant, a BOUNDED grant would start reading as an unbounded one. That is the
+ * false-exposed side of the trade `core/lethal-trifecta.ts` already reasons about
+ * — a scarier verdict for a reason the author cannot see anywhere in their file.
+ *
+ * Quotes are stripped per token AFTER splitting, never treated as a delimiter:
+ * `allowed-tools: "Read Write Glob"` is a YAML-quoted scalar whose VALUE is a
+ * space-separated list, and Claude Code splits it. Treating the quotes as token
+ * boundaries would keep exactly the bug this fixes for every skill that quotes
+ * its list.
+ */
 function splitList(raw) {
-    return raw
-        .replace(/^\[|\]$/g, "")
-        .split(",")
-        .map((t) => t.trim().replace(/^["']|["']$/g, ""))
-        .filter((t) => t.length > 0);
+    const out = [];
+    let token = "";
+    let depth = 0;
+    let quote = null;
+    let escaped = false;
+    const flush = () => {
+        const t = token.trim().replace(/^["']|["']$/g, "");
+        if (t.length > 0)
+            out.push(t);
+        token = "";
+    };
+    for (const ch of raw.trim().replace(/^\[|\]$/g, "")) {
+        if (escaped) {
+            escaped = false;
+            token += ch;
+            continue;
+        }
+        if (ch === "\\" && quote !== "'") {
+            escaped = true;
+            token += ch;
+            continue;
+        }
+        if (quote === null && (ch === '"' || ch === "'"))
+            quote = ch;
+        else if (quote === ch)
+            quote = null;
+        // Depth tracks STRUCTURE, so a parenthesis inside a quoted string is a
+        // character, not a bracket. Without this, `Bash(printf '( %s' foo) Read`
+        // leaves depth at 1 after the grant closes and swallows `Read` into the
+        // same token — on a subagent that denies a tool the author granted, which
+        // is the exact failure this function exists to fix.
+        else if (quote === null) {
+            if (ch === "(")
+                depth++;
+            else if (ch === ")")
+                depth = Math.max(0, depth - 1);
+        }
+        // Quotes deliberately do NOT suppress splitting: `allowed-tools: "Read
+        // Write Glob"` is a YAML-quoted scalar whose VALUE is a space-separated
+        // list, and Claude Code splits it. The quotes come off per token below.
+        if (depth === 0 && (ch === "," || /\s/.test(ch))) {
+            flush();
+            continue;
+        }
+        token += ch;
+    }
+    flush();
+    return out;
 }
 //# sourceMappingURL=frontmatter-read.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigiles",
-  "version": "27.1.1",
+  "version": "27.1.3",
   "description": "Audit, test and measure the harness your AI agent runs on — grade your CLAUDE.md / AGENTS.md, skills, subagents and hooks, run them against a scripted model, and measure whether they actually fire.",
   "keywords": [
     "claude-code",