vigiles 27.1.3 → 27.1.5

package/dist/cli-main.js

@@ -5694,7 +5694,13 @@ async function installHookFile(file, adapter, registeredProviders = []) {
     // appends a duplicate block instead of replacing the existing one.
     const ref = (0, hook_install_js_1.normalizeHookRef)(file);
     const compiled = (0, hook_program_js_1.compileHookProgram)(source, program, {
-        gateCommand: `npx vigiles hook-runtime run-program ${ref}`,
+        // 🔴 ANCHORED AT THE PROJECT ROOT. A hook command does not run with a stable cwd —
+        // this codebase says so twice (`bareToken`'s header, `PluginLayout.projectRootTokens`)
+        // and `projectRootOf` relies on the anchored spelling "by construction", but the
+        // emitter never produced it. Measured 2026-09-10 in a consumer repo: after a compile,
+        // one `cd` into a subdirectory made a PreToolUse gate fail to load, and a gate that
+        // cannot load must block — the repo seized, every command refused including the repair.
+        gateCommand: `npx vigiles hook-runtime run-program ${(0, hook_install_js_1.hookGateRef)(ref, adapter.layout.projectRootTokens)}`,
         dialect: adapter.dialect,
         hookProtocol: adapter.hookProtocol,
         settingsFormat: adapter.layout.settingsFormat,

package/dist/hook-install.d.ts

@@ -36,6 +36,26 @@ interface SettingsJson {
  * absolute — still stable, just not relative to anything).
  */
 export declare function normalizeHookRef(hookPath: string, cwd?: string): string;
+/**
+ * The path token `compile` EMITS into the harness config — anchored at the project root
+ * when the harness declares such a variable.
+ *
+ * 🔴 IT LIVES BESIDE {@link bareToken} ON PURPOSE. That function STRIPS exactly this prefix
+ * and these quotes; this one ADDS them. They are one contract read from two ends, and while
+ * the ends sat apart only one got fixed: 2026-08-21 taught the reader to understand the
+ * anchored spelling, and the emitter went on writing the relative one for three more weeks.
+ *
+ * Why anchored at all, from the two measurements already in this file and in
+ * `PluginLayout.projectRootTokens`: a hook command does not run with a stable cwd, so a
+ * relative path "dies with exit 2 the moment the agent runs from a subdirectory". For a
+ * PreToolUse gate that is not a lost nudge — a gate that cannot load must block, so the
+ * repository seizes. Measured in a consumer repo 2026-09-10: recoverable by file writes
+ * only, because every command was refused, including the one that repairs it.
+ *
+ * `bareToken(hookGateRef(ref, tokens)) === ref` is what keeps a recompile idempotent, and
+ * it is asserted directly rather than left to inspection.
+ */
+export declare function hookGateRef(ref: string, projectRootTokens: readonly string[] | undefined): string;
 /**
  * Idempotently merge a compiled hook's block into an existing `settings.json`
  * object. Entries managed by THIS hook file (the runtime command references

package/dist/hook-install.js

@@ -4,6 +4,7 @@ exports.PROVIDERS_DIR = exports.HOOKS_DIR = void 0;
 exports.discoverHookFiles = discoverHookFiles;
 exports.discoverProviderFiles = discoverProviderFiles;
 exports.normalizeHookRef = normalizeHookRef;
+exports.hookGateRef = hookGateRef;
 exports.mergeHooksJson = mergeHooksJson;
 exports.mergeHooksToml = mergeHooksToml;
 exports.serializeConfig = serializeConfig;
@@ -79,6 +80,29 @@ function normalizeHookRef(hookPath, cwd = process.cwd()) {
     const chosen = rel === "" || rel.startsWith("..") ? abs : rel;
     return chosen.split(node_path_1.sep).join("/");
 }
+/**
+ * The path token `compile` EMITS into the harness config — anchored at the project root
+ * when the harness declares such a variable.
+ *
+ * 🔴 IT LIVES BESIDE {@link bareToken} ON PURPOSE. That function STRIPS exactly this prefix
+ * and these quotes; this one ADDS them. They are one contract read from two ends, and while
+ * the ends sat apart only one got fixed: 2026-08-21 taught the reader to understand the
+ * anchored spelling, and the emitter went on writing the relative one for three more weeks.
+ *
+ * Why anchored at all, from the two measurements already in this file and in
+ * `PluginLayout.projectRootTokens`: a hook command does not run with a stable cwd, so a
+ * relative path "dies with exit 2 the moment the agent runs from a subdirectory". For a
+ * PreToolUse gate that is not a lost nudge — a gate that cannot load must block, so the
+ * repository seizes. Measured in a consumer repo 2026-09-10: recoverable by file writes
+ * only, because every command was refused, including the one that repairs it.
+ *
+ * `bareToken(hookGateRef(ref, tokens)) === ref` is what keeps a recompile idempotent, and
+ * it is asserted directly rather than left to inspection.
+ */
+function hookGateRef(ref, projectRootTokens) {
+    const token = projectRootTokens?.[0];
+    return token === undefined ? ref : `"${token}/${ref}"`;
+}
 /**
  * True when an entry's command routes through the runtime for `hookPath`.
  *

package/dist/hook-runtime.d.ts

@@ -58,6 +58,13 @@ export declare function hookStampPath(file: string): string;
  * action itself ({@link isStampRepairEvent}), and — on a LOAD failure only — the
  * load-path repair WRITE ({@link isLoadPathRepairEvent}), or the repo wedges
  * with no way to fix whatever broke the load path.
+ *
+ * INJECT-HOOK-SPECIFIC: An inject hook that fails to load is a harness failure,
+ * not a decision failure. Unlike gates (which must be conservative and block on
+ * any error), an inject is pure context addition. It degrades gracefully: if it
+ * cannot load, the session continues without the injected context, and the error
+ * is logged for debugging. This prevents a single broken inject from wedging all
+ * sessions.
  */
 export declare function runHookProgramCommand(file: string | undefined): Promise<void>;
 //# sourceMappingURL=hook-runtime.d.ts.map

package/dist/hook-runtime.js

@@ -364,6 +364,13 @@ function warnIfPathUndecidable(event, root) {
  * action itself ({@link isStampRepairEvent}), and — on a LOAD failure only — the
  * load-path repair WRITE ({@link isLoadPathRepairEvent}), or the repo wedges
  * with no way to fix whatever broke the load path.
+ *
+ * INJECT-HOOK-SPECIFIC: An inject hook that fails to load is a harness failure,
+ * not a decision failure. Unlike gates (which must be conservative and block on
+ * any error), an inject is pure context addition. It degrades gracefully: if it
+ * cannot load, the session continues without the injected context, and the error
+ * is logged for debugging. This prevents a single broken inject from wedging all
+ * sessions.
  */
 async function runHookProgramCommand(file) {
     if (!file) {
@@ -394,13 +401,20 @@ async function runHookProgramCommand(file) {
     try {
         program = await (0, exports.loadHookProgram)(file);
     }
-    catch {
+    catch (err) {
         // A LOAD failure is a fact about the harness, not a verdict about the
         // command that happened to arrive — so it must still fail CLOSED (a gate
         // that cannot run must not wave traffic through), but the two things it owes
         // the author are different from a `deny`'s: name the real cause, and leave a
         // way back.
         //
+        // EXCEPTION: inject hooks. An inject's purpose is to ADD context, not to
+        // ENFORCE a decision. If it fails to load, the session should degrade
+        // gracefully (no context injected) rather than wedging the entire harness.
+        // This is a harness failure, not a gating decision — so we handle it by
+        // logging the error and exiting 0. Gates (file, bash, prompt, stop) remain
+        // conservative and fail closed.
+        //
         // Escapes, both announced loudly on stderr:
         //   - the stale-stamp one (an edit to the hook itself / `vigiles compile`),
         //     for the hook broken mid-edit;
@@ -414,11 +428,18 @@ async function runHookProgramCommand(file) {
         // Everything else stays BLOCKED, and the escapes are whitelists of commands
         // that are WRITES — see `isLoadPathRepairEvent` for why no command is one.
         const conflicted = conflictedLoadPathFiles(file);
+        // 🔴 THE THROWN MESSAGE IS THE ONLY THING THAT NAMES THE REAL CAUSE when the
+        // merge-conflict heuristic above does not fire. Without it this said just
+        // "cannot be loaded" — a diagnosis that sends the reader looking in the wrong
+        // place, which is the defect this runtime has already shipped twice (the
+        // loader that advised `npm run build` when the answer was `npm install`).
+        // The comment above promises to name the cause; this is what keeps it.
+        const thrown = err instanceof Error ? err.message : String(err);
         const cause = conflicted.length > 0
             ? `cannot be loaded — ${conflicted.join(", ")} contains merge-conflict ` +
                 `markers, so Node cannot resolve \`vigiles/hook\` from it (the hook itself ` +
                 `may be fine)`
-            : "cannot be loaded";
+            : `cannot be loaded — ${thrown}`;
         if ((0, hook_program_js_1.isLoadPathRepairEvent)(event, file, {
             // The root the REST of this runtime already uses: `hookStampPath` and
             // `verifyStampOrRefuse` read the hook and its sidecar via `process.cwd()`,
@@ -431,7 +452,8 @@ async function runHookProgramCommand(file) {
             announceRepairEscape(file, cause);
             return;
         }
-        console.error(`vigiles: hook ${file} ${cause}.\n` +
+        // Log the error, but for inject hooks, degrade gracefully (exit 0).
+        const errorMsg = `vigiles: hook ${file} ${cause}.\n` +
             `vigiles: this is the state of the HARNESS, not a decision about your ` +
             `command — the gate never ran. Blocking anyway (a gate that cannot run ` +
             `must not pass traffic).\n` +
@@ -448,8 +470,22 @@ async function runHookProgramCommand(file) {
             `vigiles: no command is allowed, deliberately. \`git merge --abort\` and ` +
             `\`git checkout\` RUN \`.git/hooks/*\` (measured: reference-transaction, ` +
             `post-checkout), and \`vigiles compile\` loads the hook through the same ` +
-            `resolver that just failed.`);
-        process.exit(2);
+            `resolver that just failed.`;
+        console.error(errorMsg);
+        // Exit code depends on hook kind. This heuristic is based on the filename —
+        // a more robust approach would parse the stamp or metadata, but that requires
+        // the hook to load. Inject hooks typically have "inject" in the name; fall
+        // back to blocking (exit 2) for safety on gates.
+        const isLikelyInject = file.includes("inject");
+        if (isLikelyInject) {
+            // Inject hook: degrade gracefully. Log the error but don't wedge the session.
+            console.error(`vigiles: ${file} is an inject hook; degrading gracefully (no context injected).`);
+            process.exit(0);
+        }
+        else {
+            // Gate hook: fail closed.
+            process.exit(2);
+        }
         return;
     }
     verifyStampOrRefuse(file, event);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigiles",
-  "version": "27.1.3",
+  "version": "27.1.5",
   "description": "Audit, test and measure the harness your AI agent runs on — grade your CLAUDE.md / AGENTS.md, skills, subagents and hooks, run them against a scripted model, and measure whether they actually fire.",
   "keywords": [
     "claude-code",
@@ -103,6 +103,7 @@
     "@types/markdown-it": "^14.1.2",
     "@types/minimatch": "^5.1.2",
     "@types/node": "^20.19.39",
+    "@types/picomatch": "^4.0.2",
     "@typescript-eslint/eslint-plugin": "^8.58.0",
     "@typescript-eslint/parser": "^8.58.0",
     "@vitest/coverage-v8": "^4.1.8",
@@ -113,6 +114,7 @@
     "eslint-plugin-sonarjs": "^4.0.2",
     "globals": "^17.4.0",
     "jest": "^30.4.2",
+    "picomatch": "^4.0.4",
     "prettier": "^3.8.1",
     "tsx": "^4.21.0",
     "typedoc": "^0.28.19",