vigiles 29.0.0 → 29.1.0

package/dist/core/compile.js

@@ -781,7 +781,10 @@ function yamlScalar(value) {
     // A JSON string IS a YAML double-quoted scalar, escaping included.
     return JSON.stringify(value);
 }
-function renderSkillFrontmatter(spec, profile = "claude-code") {
+function renderSkillFrontmatter(spec, 
+// Downstream of the SkillFrontmatterProfile alias (src/core/dialect.ts).
+// eslint-disable-next-line local/no-harness-names -- goes away with that alias
+profile = "claude-code") {
     const fm = [
         "---",
         `name: ${yamlScalar(spec.name)}`,
@@ -789,6 +792,8 @@ function renderSkillFrontmatter(spec, profile = "claude-code") {
     ];
     // The CC-only keys below are inert in a minimal (Codex/OpenCode) SKILL.md, so
     // they're omitted entirely under that profile.
+    // Downstream of the SkillFrontmatterProfile alias (src/core/dialect.ts).
+    // eslint-disable-next-line local/no-harness-names -- goes away with that alias
     if (profile === "claude-code") {
         if (spec.disableModelInvocation !== undefined) {
             fm.push(`disable-model-invocation: ${String(spec.disableModelInvocation)}`);
@@ -894,7 +899,10 @@ function compileSkill(spec, options = {}) {
     spec = (0, skill_normalize_js_1.foldLegacyPostcondition)(spec);
     const basePath = options.basePath ?? process.cwd();
     const specFile = options.specFile ?? "SKILL.md.spec.ts";
-    const profile = options.dialect?.skillFrontmatter ?? "claude-code";
+    const profile = 
+    // Downstream of the SkillFrontmatterProfile alias (src/core/dialect.ts).
+    // eslint-disable-next-line local/no-harness-names -- goes away with that alias
+    options.dialect?.skillFrontmatter ?? "claude-code";
     const errors = [];
     // Verify spec file naming
     if (!specFile.endsWith(".spec.ts")) {

package/dist/core/config-schema.js

@@ -285,6 +285,10 @@ exports.VigilesConfigError = VigilesConfigError;
 exports.REPLACED_KEYS = [
     {
         key: "harness",
+        // The literal OLD config text this migration notice quotes back at the user:
+        // a historical artefact, not a fact about a harness, so there is no port to
+        // read it off. This is the one exemption here that is not debt.
+        // eslint-disable-next-line local/no-harness-names -- quoted legacy config
         was: '"harness": ["claude-code", "codex"]',
         now: "a KEY per harness",
     },
@@ -298,6 +302,10 @@ exports.REPLACED_KEYS = [
 function replacedKeyMessage(present) {
     return (`.vigilesrc.json: ${present.map((k) => `"${k.key}"`).join(" and ")} ` +
         `${present.length === 1 ? "was" : "were"} replaced by one nested key, "harnesses".\n` +
+        // A worked EXAMPLE config in a diagnostic, and real debt: with a third
+        // adapter this sample goes stale, so it wants rendering from the adapter
+        // registry rather than two names typed out here.
+        // eslint-disable-next-line local/no-harness-names -- example config text
         `  Write:  { "harnesses": { "claude-code": { "roots": [".ai"] }, "codex": {} } }\n` +
         present.map((k) => `  - ${k.was}  →  ${k.now}`).join("\n") +
         `\n  The old harness ARRAY's order silently decided what got read: one order graded the ` +

package/dist/core/lethal-trifecta.js

@@ -545,6 +545,11 @@ const PREAPPROVAL_NOTE = "`allowed-tools:` does NOT fence a skill — it PRE-APP
  * omits them under `"minimal"`).
  */
 function dialectSupportsSkillFence(dialect) {
+    // Downstream of the SkillFrontmatterProfile alias (src/core/dialect.ts). This
+    // function is the clearest argument for fixing it there: it already HAS a
+    // capability name — "supports skill fence" — and reaches it by comparing an
+    // adapter name.
+    // eslint-disable-next-line local/no-harness-names -- goes away with that alias
     return dialect.skillFrontmatter === "claude-code";
 }
 /**

package/dist/core/surface-discovery.js

@@ -414,6 +414,10 @@ function unclaimedSurfaceFindings(paths, layouts, declared) {
         ...d,
         message: `${d.dir}/ holds ${plural(d.kind, d.count)} that no harness vigiles knows about reads, ` +
             `so none of it is in this grade. Three ways out: keep it where it is and say so in ` +
+            // A worked EXAMPLE config in a diagnostic, and real debt: it names a
+            // harness the repo being audited may not even target, while `layouts` is
+            // already in scope here and knows which one it does.
+            // eslint-disable-next-line local/no-harness-names -- example config text
             `.vigilesrc.json (\`{"harnesses":{"claude-code":{"roots":["${d.root === "" ? "." : d.root}"]}}}\` ` +
             `— see docs/configuration.md), audit it on its own ` +
             `(\`vigiles audit ${d.root === "" ? "." : d.root}\`), or move it somewhere a harness ` +

package/dist/scan.js

@@ -40,7 +40,18 @@ const node_path_1 = require("node:path");
 // Claude Code default), and only the generic one takes the `ExcludeSet` that
 // makes `.vigilesrc.json#exclude` reach surface discovery.
 const plugin_loader_js_1 = require("./plugin-loader.js");
+// 🔴 A FINDING, NOT A FORMALITY, and one nothing else in the repo could see: this
+// module is listed as a harness-agnostic detector, yet it imports the Claude Code
+// adapter to use as a DEFAULT (`scanPlugin`'s `dialect`/`layout` parameters, and
+// four more sites below). `boundaries/dependencies` does not catch it because it
+// deliberately leaves this file unclassified; the CC-literal rule does not catch
+// it because `\.claude` needs the dot and this path spells `/claude-code/`.
+// Keeping the CC default is the stated backwards-compatibility guarantee, so this
+// is real debt with a known shape — the default belongs to the CALLER (the CLI
+// already resolves an adapter), not to the detector.
+// eslint-disable-next-line local/no-harness-names -- see above
 const layout_js_1 = require("./adapters/claude-code/layout.js");
+// eslint-disable-next-line local/no-harness-names -- see above
 const dialect_js_1 = require("./adapters/claude-code/dialect.js");
 const plugin_loader_js_2 = require("./plugin-loader.js");
 const score_core_js_1 = require("./score-core.js");

package/dist/test-coverage.js

@@ -76,6 +76,11 @@ const assert_never_js_1 = require("./core/assert-never.js");
 const ts_runner_caps_js_1 = require("./ts-runner-caps.js");
 const glob_1 = require("glob");
 const layout_js_1 = require("./core/layout.js");
+// 🔴 Same finding as src/scan.ts: a module listed as a harness-agnostic detector
+// importing the Claude Code adapter for a DEFAULT. Invisible to both existing
+// fences — unclassified for `boundaries/dependencies`, and `\.claude` does not
+// match `/claude-code/`. The default belongs to the caller, not the detector.
+// eslint-disable-next-line local/no-harness-names -- see above
 const layout_js_2 = require("./adapters/claude-code/layout.js");
 const coverage_evidence_js_1 = require("./coverage-evidence.js");
 const coverage_artifact_js_1 = require("./coverage-artifact.js");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigiles",
-  "version": "29.0.0",
+  "version": "29.1.0",
   "description": "Audit, test and measure the harness your AI agent runs on — grade your CLAUDE.md / AGENTS.md, skills, subagents and hooks, run them against a scripted model, and measure whether they actually fire.",
   "keywords": [
     "claude-code",