vigiles 27.1.2 → 27.1.3

package/dist/core/frontmatter-read.js

@@ -124,12 +124,35 @@ function salvageField(block, key) {
         .replace(/["']$/, "")
         .trim() || undefined);
 }
-/** Salvage a list field from the raw block (single-line key only). */
+/** Salvage a list field from the raw block (single-line key only).
+ *
+ *  THE WRAPPER QUOTES COME OFF HERE, not in `splitList`, so both paths hand the
+ *  tokenizer the SAME shape. On valid YAML js-yaml has already removed a scalar's
+ *  surrounding quotes; only this regex salvage hands them through, and leaving
+ *  that asymmetry in place made `tools: "Bash(git status *), Read"` tokenize as
+ *  `Bash(git` · `status` · `*)` · `Read` — the opening YAML quote read as a shell
+ *  quote, so the parens stopped counting as structure and the grant's own spaces
+ *  split it. That is the phantom-tool failure #217 warned about, in the
+ *  false-EXPOSED direction (`bashGrantIsUnbounded` answers "unbounded" when it
+ *  cannot recognise a grant), and it was a REGRESSION: the older comma-only
+ *  parser recovered this input correctly.
+ *
+ *  Only a MATCHED pair is stripped, and only when it wraps the whole value — an
+ *  unbalanced leading quote is left alone rather than guessed at. */
 function salvageList(block, key) {
     const match = new RegExp(`^${key}:[ \\t]*(.*)$`, "m").exec(block);
     if (!match)
         return null;
-    return splitList(match[1]);
+    return splitList(stripWrapperQuotes(match[1]));
+}
+/** Remove ONE matched pair of quotes wrapping an entire scalar. */
+function stripWrapperQuotes(raw) {
+    const v = raw.trim();
+    const q = v[0];
+    if ((q === '"' || q === "'") && v.length >= 2 && v[v.length - 1] === q) {
+        return v.slice(1, -1);
+    }
+    return v;
 }
 /**
  * Split a tool-list string into trimmed, de-quoted tokens.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigiles",
-  "version": "27.1.2",
+  "version": "27.1.3",
   "description": "Audit, test and measure the harness your AI agent runs on — grade your CLAUDE.md / AGENTS.md, skills, subagents and hooks, run them against a scripted model, and measure whether they actually fire.",
   "keywords": [
     "claude-code",