vigiles 33.1.0 → 33.3.0

package/dist/audit-score.js

@@ -450,12 +450,12 @@ function evaluated(r, firingMeasured) {
             score: null,
             weight: 1,
             advisory: true,
-            findings: ["no surface whose firing could be measured"],
+            findings: ["no surface a real model could be measured on"],
         };
     }
     const unevaluated = r.unevaluated ?? evaluable;
     const evalCovered = evaluable - unevaluated;
-    const gap = `${String(unevaluated)} ${pluralizeLabel(unevaluated, "surface(s) whose firing was never measured")}`;
+    const gap = `${String(unevaluated)} ${pluralizeLabel(unevaluated, "surface(s) never measured with a real model")}`;
     // Nothing on disk measures firing AND nothing ran this session → the question
     // was never asked. Say that, and name the command — do NOT score it a 0.
     if (evalCovered === 0 && !firingMeasured) {

package/dist/check.d.ts

@@ -137,6 +137,26 @@ export declare function onlyTools(allowed: readonly string[]): Check<Trace>;
 export declare function skill(id: string): Check<Trace>;
 /** The agent's final output contains a substring / matches a RegExp. */
 export declare function output(matcher: string | RegExp): Check<Trace>;
+/**
+ * EVERY reply of the run contains a substring / matches a RegExp — for a rule
+ * about each reply ("end with a status block"), where `output` sees only the
+ * last one. A run with no replies fails: there is nothing the rule held for.
+ *
+ * @experimental The matcher may grow a function form, and a check may come to
+ * be attached to a spec rule (vigiles#323).
+ */
+export declare function experimental_eachReply(matcher: string | Readonly<RegExp>): Readonly<Check<Trace>>;
+/**
+ * How many replies of the run match, within bounds — `{ max: 1 }` is "at most
+ * one status block for one user message", which a Stop hook that makes the
+ * agent reply again can break while `output` still shows one.
+ *
+ * @experimental See {@link experimental_eachReply}.
+ */
+export declare function experimental_replyCount(matcher: string | Readonly<RegExp>, opts: {
+    readonly min?: number;
+    readonly max?: number;
+}): Readonly<Check<Trace>>;
 /** A hook fired for this event (e.g. `"PreToolUse"`, `"Stop"`). */
 export declare function hookFired(event: string): Check<Trace>;
 /**

package/dist/check.js

@@ -8,6 +8,8 @@ exports.notTool = notTool;
 exports.onlyTools = onlyTools;
 exports.skill = skill;
 exports.output = output;
+exports.experimental_eachReply = experimental_eachReply;
+exports.experimental_replyCount = experimental_replyCount;
 exports.hookFired = hookFired;
 exports.received = received;
 exports.turns = turns;
@@ -75,6 +77,29 @@ function truncate(s, n = 120) {
     const flat = s.replace(/\s+/g, " ").trim();
     return flat.length > n ? `${flat.slice(0, n)}…` : flat;
 }
+/**
+ * Does `text` match? A RegExp is copied first: with `g` / `y`, `test` advances
+ * `lastIndex` on the object it is called on, so reusing the caller's object
+ * would miss on its second reply or its second trial.
+ */
+const matches = (matcher, text) => typeof matcher === "string"
+    ? text.includes(matcher)
+    : new RegExp(matcher).test(text);
+/** A matcher as the report prints it: the string, or the RegExp literal. */
+const show = (matcher) => typeof matcher === "string" ? matcher : `/${matcher.source}/${matcher.flags}`;
+/** Why a reply check cannot run: the trace carries no replies to read. */
+const NO_REPLIES = "the run has no `replies` (the harness does not tell replies apart, or the run was not streamed — pass `transcript: true`)";
+/** Why a `{ min, max }` bound cannot mean anything, or null when it can. */
+function boundsProblem(opts) {
+    const given = [opts.min, opts.max].filter((n) => n !== undefined);
+    if (given.length === 0)
+        return "give `min`, `max` or both";
+    if (given.some((n) => !Number.isInteger(n) || n < 0))
+        return "bounds are whole numbers, 0 or more";
+    if (opts.min !== undefined && opts.max !== undefined && opts.min > opts.max)
+        return `min ${String(opts.min)} is above max ${String(opts.max)}`;
+    return null;
+}
 // ---------------------------------------------------------------------------
 // Trace checks (an agent run — runHarness / runEval)
 // ---------------------------------------------------------------------------
@@ -248,7 +273,7 @@ function output(matcher) {
     return {
         kind: "output",
         eval: (t) => {
-            const pass = isRe ? matcher.test(t.output) : t.output.includes(matcher);
+            const pass = matches(matcher, t.output);
             return pass
                 ? ok(`output matched ${String(matcher)}`)
                 : no(`expected output to ${isRe ? "match" : "contain"} ${String(matcher)}; got "${truncate(t.output) || "(empty)"}"`);
@@ -256,6 +281,66 @@ function output(matcher) {
         toJSON: () => ({ kind: "output", matcher: String(matcher), regex: isRe }),
     };
 }
+/**
+ * EVERY reply of the run contains a substring / matches a RegExp — for a rule
+ * about each reply ("end with a status block"), where `output` sees only the
+ * last one. A run with no replies fails: there is nothing the rule held for.
+ *
+ * @experimental The matcher may grow a function form, and a check may come to
+ * be attached to a spec rule (vigiles#323).
+ */
+function experimental_eachReply(matcher) {
+    return {
+        kind: "eachReply",
+        eval: (t) => {
+            if (t.replies === undefined)
+                return no(NO_REPLIES);
+            if (t.replies.length === 0)
+                return no("the run wrote no replies");
+            const miss = t.replies.findIndex((r) => !matches(matcher, r));
+            return miss === -1
+                ? ok(`all ${String(t.replies.length)} replies matched ${show(matcher)}`)
+                : no(`reply ${String(miss + 1)} of ${String(t.replies.length)} did not match ${show(matcher)}: "${truncate(t.replies[miss] ?? "") || "(empty)"}"`);
+        },
+        toJSON: () => ({
+            kind: "eachReply",
+            matcher: show(matcher),
+            regex: typeof matcher !== "string",
+        }),
+    };
+}
+/**
+ * How many replies of the run match, within bounds — `{ max: 1 }` is "at most
+ * one status block for one user message", which a Stop hook that makes the
+ * agent reply again can break while `output` still shows one.
+ *
+ * @experimental See {@link experimental_eachReply}.
+ */
+function experimental_replyCount(matcher, opts) {
+    const problem = boundsProblem(opts);
+    if (problem !== null)
+        throw new Error(`replyCount: ${problem}`);
+    return {
+        kind: "replyCount",
+        eval: (t) => {
+            if (t.replies === undefined)
+                return no(NO_REPLIES);
+            const n = t.replies.filter((r) => matches(matcher, r)).length;
+            const pass = (opts.min === undefined || n >= opts.min) &&
+                (opts.max === undefined || n <= opts.max);
+            const bound = `min ${String(opts.min ?? "-")}, max ${String(opts.max ?? "-")}`;
+            const says = `${String(n)} of ${String(t.replies.length)} replies matched ${show(matcher)} (${bound})`;
+            return pass ? ok(says) : no(`expected ${bound}; ${says}`);
+        },
+        toJSON: () => ({
+            kind: "replyCount",
+            matcher: show(matcher),
+            regex: typeof matcher !== "string",
+            min: opts.min,
+            max: opts.max,
+        }),
+    };
+}
 /** A hook fired for this event (e.g. `"PreToolUse"`, `"Stop"`). */
 function hookFired(event) {
     return {
@@ -284,7 +369,7 @@ function received(matcher) {
             const text = t.modelRequests
                 .map((r) => `${r.system} ${r.messages.map((m) => m.text).join(" ")}`)
                 .join(" ");
-            const pass = isRe ? matcher.test(text) : text.includes(matcher);
+            const pass = matches(matcher, text);
             return pass
                 ? ok(`the model received ${String(matcher)}`)
                 : no(`expected the model to receive ${String(matcher)} (a slash-command expansion or injected context); ${t.modelRequests.length === 0 ? "no requests captured (eval tier captures none — use runHarness)" : `got "${truncate(text)}"`}`);

package/dist/cli-main.js

@@ -39,11 +39,13 @@ const frame_js_1 = require("./core/frame.js");
 const surface_discovery_js_1 = require("./core/surface-discovery.js");
 const scan_trigger_suggest_js_1 = require("./scan-trigger-suggest.js");
 const install_reader_js_1 = require("./core/install-reader.js");
+const skill_links_js_1 = require("./skill-links.js");
 const plugin_declaration_js_1 = require("./plugin-declaration.js");
 const local_files_tracked_js_1 = require("./local-files-tracked.js");
 const local_files_js_1 = require("./local-files.js");
 const scan_behavioral_js_1 = require("./scan-behavioral.js");
 const adapter_registry_js_1 = require("./adapter-registry.js");
+const layout_js_1 = require("./core/layout.js");
 const skill_harness_js_1 = require("./skill-harness.js");
 const leaderboard_js_1 = require("./leaderboard.js");
 const optimize_js_1 = require("./optimize.js");
@@ -3177,29 +3179,226 @@ function reportInstall(plan, outcome) {
 }
 /**
  * Install vigiles's skills/hooks for the chosen harness(es) via the per-harness
- * `planPluginInstall` decision — Claude Code through the GLOBAL plugin
- * marketplace (nothing vendored into the repo), Codex via AGENTS.md-direct (no
- * global store). The decision is pure and unit-tested; this is the thin IO.
+ * `planPluginInstall` decision. Two carriers: the SKILLS are linked into the
+ * repo (`linkVigilesSkills`), so every clone and container has them after
+ * `npm install`; the GLOBAL install runs where it carries something the links
+ * cannot (`shouldRunGlobalInstall` — Claude Code's plugin carries the hooks).
+ * The decisions are pure and unit-tested; this is the thin IO.
+ *
+ * Returns the links it created or relinked, for the commit hint.
  */
 function installPlugins(harnesses) {
     const { execSync: exec } = require("node:child_process");
     const plans = (0, setup_plan_js_1.planPluginInstall)(harnesses, {
         hasClaude: harnesses.includes("claude") && harnessBinaryPresent("claude"),
     });
-    for (const plan of plans) {
+    const written = plans.flatMap((plan) => {
         console.log("");
-        reportInstall(plan, runInstall(plan, exec));
-    }
+        const home = plan.linkSkills ? harnessSkillsHome(plan.harness) : null;
+        const outcome = home === null ? null : linkVigilesSkills(home, process.cwd());
+        if (outcome !== null)
+            (0, skill_links_js_1.formatSkillLinks)(outcome).forEach((l) => {
+                console.log(l);
+            });
+        const linked = outcome !== null && (0, skill_links_js_1.skillLinksUsable)(outcome);
+        if ((0, setup_plan_js_1.shouldRunGlobalInstall)(plan, linked))
+            reportInstall(plan, runInstall(plan, exec));
+        else
+            console.log(`  No global ${plan.harness} skills install — the linked skills replace it, in every clone.`);
+        return outcome === null ? [] : changedLinks(outcome);
+    });
     // Claude Code gets its hooks from the global marketplace plugin; Codex has no
     // global store, so wire vigiles's proactive nudge hooks into the repo's
     // .codex/config.toml directly (the idiomatic, repo-committed place).
     if (harnesses.includes("codex"))
         wireCodexHooks();
     // Claude Code additionally gets a committed DECLARATION, so a collaborator who
-    // clones and never runs `init` is told the project wants this plugin instead
-    // of hitting the silence that costs a day. It does not install anything.
+    // clones and never runs `init` is told the project wants this plugin (its
+    // hooks) instead of silence. It does not install anything.
     if (harnesses.includes("claude"))
         declareVigilesPlugin();
+    return written;
+}
+/** The repo-relative skills home of the harness `init` calls `name`, or null. */
+function harnessSkillsHome(name) {
+    const adapter = (0, adapter_registry_js_1.getAdapter)(name);
+    return adapter === undefined ? null : (0, layout_js_1.skillsHome)(adapter.layout);
+}
+/** The repo-relative paths of the links this run created or rewrote — the ones git sees change. */
+function changedLinks(outcome) {
+    return outcome.kind === "linked"
+        ? outcome.results
+            .filter((r) => r.status === "created" || r.status === "relinked")
+            .map((r) => `${outcome.physicalHome}/${r.name}`)
+        : [];
+}
+/** The manifest file name the skill-linking code reads. */
+const PACKAGE_JSON = "package.json";
+/** One top-level field of `<dir>/package.json`, or undefined. Never throws. */
+function packageField(dir, field) {
+    try {
+        const pkg = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(dir, PACKAGE_JSON), "utf-8"));
+        return typeof pkg === "object" && pkg !== null
+            ? Object.entries(pkg).find(([k]) => k === field)?.[1]
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** `package.json`'s `name`, or null. Never throws. */
+function packageNameAt(dir) {
+    const name = packageField(dir, "name");
+    return typeof name === "string" ? name : null;
+}
+/** A thrown value's message. */
+function errorText(e) {
+    return e instanceof Error ? e.message : String(e);
+}
+/** A path's real location, or null when it does not resolve. Never throws. */
+function realOrNull(path) {
+    try {
+        return (0, node_fs_1.realpathSync)(path);
+    }
+    catch {
+        return null;
+    }
+}
+/** What occupies `path`, for `planSkillLinks`. */
+function observeSkillEntry(path) {
+    const st = (0, node_fs_1.lstatSync)(path, { throwIfNoEntry: false });
+    if (st === undefined)
+        return { kind: "missing" };
+    if (st.isSymbolicLink())
+        return {
+            kind: "link",
+            target: (0, node_fs_1.readlinkSync)(path),
+            resolvesTo: realOrNull(path),
+        };
+    return st.isDirectory() ? { kind: "directory" } : { kind: "file" };
+}
+const LINK_IO = {
+    // "dir" matters only on Windows, where a directory link must say so.
+    symlink: (target, path) => {
+        (0, node_fs_1.symlinkSync)(target, path, "dir");
+    },
+    rename: node_fs_1.renameSync,
+    unlink: node_fs_1.unlinkSync,
+};
+/** Carry out one decision. A failed `symlink` is reported, never thrown. */
+function applySkillLink(decision, absHome) {
+    switch (decision.action) {
+        case "keep":
+            return { name: decision.name, status: "present" };
+        case "refuse":
+            return {
+                name: decision.name,
+                status: "skipped",
+                reason: decision.reason,
+            };
+        case "create":
+        case "replace":
+            try {
+                // Only a link `decideSkillLink` proved ours is ever replaced.
+                (0, skill_links_js_1.writeSkillLink)(LINK_IO, (0, node_path_1.join)(absHome, decision.name), decision.target, decision.action);
+                return {
+                    name: decision.name,
+                    status: decision.action === "replace" ? "relinked" : "created",
+                };
+            }
+            catch (e) {
+                const code = e instanceof Error && "code" in e && typeof e.code === "string"
+                    ? e.code
+                    : "";
+                return {
+                    name: decision.name,
+                    status: "skipped",
+                    reason: (0, skill_links_js_1.linkFailureReason)(code, errorText(e)),
+                };
+            }
+    }
+}
+/**
+ * Why `init` must not write under `absHome`, or null when it may. `.claude` or
+ * its `skills` can be a link to a dotfiles directory outside the repo; creating
+ * the home would follow it and put links where no commit of this repo reaches.
+ * What `mkdir -p` would write through is the nearest part of the path that
+ * already exists, so that is the part judged.
+ */
+function homeEscape(project, home, absHome) {
+    const nearest = (p) => (0, node_fs_1.lstatSync)(p, { throwIfNoEntry: false }) === undefined
+        ? nearest((0, node_path_1.dirname)(p))
+        : p;
+    const anchor = nearest(absHome);
+    const real = realOrNull(anchor);
+    if (real === null)
+        return `${(0, node_path_1.relative)(project, anchor)} is a link that does not resolve, so ${home} cannot be created`;
+    return (0, skill_links_js_1.isWithinProject)(project, real)
+        ? null
+        : `${home} leads to ${real}, outside the repository, and a link written there would not travel with a clone`;
+}
+/** The outcome when `init` makes no links, with the reason it prints. */
+function notLinked(reason) {
+    return { kind: "not-linked", reason };
+}
+/**
+ * Link vigiles's shipped skills into `home` (repo-relative) — the IO half of
+ * `src/skill-links.ts`, which decides everything: where the package is, what
+ * each entry becomes, and what the report says.
+ */
+function linkVigilesSkills(home, cwd) {
+    // Physical, so the relative target computed against the (physical) skills
+    // home is right even when the checkout sits under a symlink (macOS /tmp).
+    const project = (0, node_fs_1.realpathSync)(cwd);
+    const site = (0, skill_links_js_1.locatePackage)(project, {
+        isPackage: (dir) => packageNameAt(dir) === skill_links_js_1.VIGILES_PACKAGE,
+        isRepoRoot: (dir) => (0, node_fs_1.existsSync)((0, node_path_1.join)(dir, ".git")),
+        isWorkspaceRoot: (dir) => (0, node_fs_1.existsSync)((0, node_path_1.join)(dir, "pnpm-workspace.yaml")) ||
+            packageField(dir, "workspaces") !== undefined,
+    });
+    const pkgText = (0, node_fs_1.existsSync)((0, node_path_1.join)(project, PACKAGE_JSON))
+        ? (0, node_fs_1.readFileSync)((0, node_path_1.join)(project, PACKAGE_JSON), "utf-8")
+        : null;
+    const blocked = (0, skill_links_js_1.linkPrecondition)({
+        isVigilesItself: packageNameAt(project) === skill_links_js_1.VIGILES_PACKAGE,
+        dependsOnVigiles: pkgText !== null && (0, install_reader_js_1.declaresVigilesDependency)(pkgText),
+        installed: site.kind === "installed",
+    });
+    if (blocked !== null)
+        return notLinked(blocked);
+    if (site.kind === "unsure")
+        return notLinked(site.reason);
+    // Names from the installed package when there is one, else from this CLI's
+    // own — the version `init` just declared as the devDependency.
+    const source = site.kind === "installed" ? site.dir : selfRoot();
+    const names = setup_plan_js_1.SHIPPED_SKILLS.filter((n) => (0, node_fs_1.existsSync)((0, node_path_1.join)(source, "skills", n, "SKILL.md")));
+    if (names.length === 0)
+        return notLinked(`no shipped skills found under ${(0, node_path_1.join)(source, "skills")}`);
+    const absHome = (0, node_path_1.resolve)(project, home);
+    const escape = homeEscape(project, home, absHome);
+    if (escape !== null)
+        return notLinked(escape);
+    try {
+        (0, node_fs_1.mkdirSync)(absHome, { recursive: true });
+    }
+    catch (e) {
+        return notLinked(`cannot create ${home}: ${errorText(e)}`);
+    }
+    const physicalHome = (0, node_fs_1.realpathSync)(absHome);
+    const plan = (0, skill_links_js_1.planSkillLinks)({
+        names,
+        site,
+        physicalHome,
+        entries: (n) => observeSkillEntry((0, node_path_1.join)(absHome, n)),
+        realOf: (n) => realOrNull((0, node_path_1.join)(site.dir, "skills", n)),
+    });
+    return {
+        kind: "linked",
+        home,
+        physicalHome: (0, skill_links_js_1.portableTarget)((0, node_path_1.relative)(project, physicalHome)),
+        pending: plan.pending,
+        results: plan.decisions.map((d) => applySkillLink(d, absHome)),
+    };
 }
 /**
  * Write the project-level plugin declaration into `.claude/settings.json`.
@@ -3208,8 +3407,9 @@ function installPlugins(harnesses) {
  * collaborator: an external-source plugin declared project-level does not load
  * until each person installs it on their own machine (the boundary is
  * deliberate — plugins run arbitrary code with the user's privileges). What it
- * buys is that Claude Code then PROMPTS them with the install command, instead
- * of the silence a fresh clone gets today. Silent absence → a prompt.
+ * buys is that Claude Code then PROMPTS them with the install command — for the
+ * HOOKS, which only the plugin carries. The skills reach them through the
+ * committed links (`linkVigilesSkills`), with or without the plugin.
  *
  * MERGES, never clobbers: this file holds the user's hooks, permissions and
  * other plugins. The merge rules are the pure, unit-tested
@@ -3249,8 +3449,9 @@ function declareVigilesPlugin() {
     (0, node_fs_1.writeFileSync)(path, JSON.stringify(edit.settings, null, 2) + "\n");
     console.log("✓ Declared the vigiles plugin in .claude/settings.json (commit it)\n" +
         "  This does NOT install it for anyone else — Claude Code will PROMPT a\n" +
-        "  collaborator to run `claude plugin install vigiles@vigiles`, instead of\n" +
-        "  the silence a fresh clone gets today.\n" +
+        "  collaborator to run `claude plugin install vigiles@vigiles`, which is how\n" +
+        "  they get the hooks. The skills don't wait for it: they come with the\n" +
+        "  linked .claude/skills/ entries.\n" +
         "  Nothing is vendored: the entry is a reference; the plugin still lives in\n" +
         "  the global cache, one copy shared across your repos.");
 }
@@ -3460,10 +3661,9 @@ async function setup(args) {
         console.log("");
         written.push(...wireGha(plan, harnesses));
     }
-    // Plugin/skill install — per-harness (Claude marketplace / Codex direct).
-    if (plan.plugin) {
-        installPlugins(harnesses);
-    }
+    // Skills linked into the repo + the per-harness global install (Claude
+    // marketplace for the hooks / Codex only when nothing could be linked).
+    const linkedSkills = plan.plugin ? installPlugins(harnesses) : [];
     // Agent-specific guidance.
     if (targets.includes("AGENTS.md")) {
         console.log("\n  Codex / Copilot reads AGENTS.md directly — no hooks needed.");
@@ -3483,7 +3683,14 @@ async function setup(args) {
         lint: plan.lint,
         written,
     });
-    printSetupSummary({ plan, strict, targets, adopted, written });
+    printSetupSummary({
+        plan,
+        strict,
+        targets,
+        adopted,
+        // The skill links the plugin step created, so the commit hint names them.
+        written: [...written, ...linkedSkills],
+    });
     // Surface the OTHER mode so both directions are discoverable — the two branches
     // are mutually exclusive (a run is either gate-only or full):
     //   • a gate-only setup → a ONE-LINE nudge to graduate to the full layer;
@@ -3595,6 +3802,18 @@ function harnessLayoutFor(root, config, flag) {
         return adapter_registry_js_1.defaultAdapter.layout;
     }
 }
+/**
+ * The rule that gates each surface kind, one row per kind. `satisfies` makes a
+ * missing row a compile error: the nested ternary this replaced ended in the
+ * hook rule, so a kind it did not name was gated by `untested-hook` and still
+ * compiled.
+ */
+const UNTESTED_RULE = {
+    skill: "untested-skill",
+    agent: "untested-subagent",
+    hook: "untested-hook",
+    "output-style": "untested-output-style",
+};
 /**
  * The `untested-*` rules AS THE DETECTOR TAKES THEM: which kinds this repo
  * enabled, and the discovery options merged from whichever of the three rules
@@ -3611,21 +3830,21 @@ function harnessLayoutFor(root, config, flag) {
  */
 function untestedRules(config) {
     const rules = config?.rules;
-    const skillSev = (0, types_js_1.ruleSeverity)(rules?.["untested-skill"]);
-    const agentSev = (0, types_js_1.ruleSeverity)(rules?.["untested-subagent"]);
-    const hookSev = (0, types_js_1.ruleSeverity)(rules?.["untested-hook"]);
-    const opts = {
-        ...(0, types_js_1.ruleOptions)(rules?.["untested-skill"]),
-        ...(0, types_js_1.ruleOptions)(rules?.["untested-subagent"]),
-        ...(0, types_js_1.ruleOptions)(rules?.["untested-hook"]),
-    };
+    const severity = (kind) => (0, types_js_1.ruleSeverity)(rules?.[UNTESTED_RULE[kind]]);
+    const names = Object.values(UNTESTED_RULE);
+    const opts = names.reduce((acc, rule) => ({
+        ...acc,
+        ...(0, types_js_1.ruleOptions)(rules?.[rule]),
+    }), {});
+    const on = (kind) => severity(kind) !== false;
     return {
-        severity: (kind) => kind === "skill" ? skillSev : kind === "agent" ? agentSev : hookSev,
-        anyEnabled: skillSev !== false || agentSev !== false || hookSev !== false,
+        severity,
+        anyEnabled: names.some((rule) => (0, types_js_1.ruleSeverity)(rules?.[rule]) !== false),
         options: {
-            skills: skillSev !== false,
-            agents: agentSev !== false,
-            hooks: hookSev !== false,
+            skills: on("skill"),
+            agents: on("agent"),
+            hooks: on("hook"),
+            outputStyles: on("output-style"),
             include: opts.include,
             exclude: opts.exclude,
             // Without this the `testExtension` documented on TestCoverageOptions was a

package/dist/core/adapter.d.ts

@@ -182,6 +182,13 @@ export interface InstallReader {
      * outside its own surface.
      */
     readonly repo: (repoRelative: string) => string | null;
+    /**
+     * The stored target of a repo SYMLINK (what `readlink` returns), or null when
+     * the path is not a link, is missing, or is NOT a path this adapter claims.
+     * It answers the one question `repo` cannot: a committed link whose target is
+     * not installed yet reads as null through `repo`, exactly like no link at all.
+     */
+    readonly repoLink: (repoRelative: string) => string | null;
     /**
      * A file under the user's HOME, or null. This is a read of the MACHINE, never
      * of the repository — the plugin-install record lives there — and everything

package/dist/core/config-schema.d.ts

@@ -109,6 +109,15 @@ export declare const vigilesConfigSchema: z.ZodObject<{
             exclude: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
             testExtension: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>], null>]>>;
+        "untested-output-style": z.ZodDefault<z.ZodUnion<readonly [z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>, z.ZodTuple<[z.ZodLiteral<"warn">, z.ZodObject<{
+            include: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
+            exclude: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
+            testExtension: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>], null>, z.ZodTuple<[z.ZodLiteral<"error">, z.ZodObject<{
+            include: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
+            exclude: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
+            testExtension: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>], null>]>>;
         "unmarked-refs": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
         "subagent-tool-contract": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
         "hook-events": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;

package/dist/core/config-schema.js

@@ -141,6 +141,7 @@ const rulesSchema = zod_1.z
     "untested-skill": withOptions(testCoverageConfig).default("warn"),
     "untested-subagent": withOptions(testCoverageConfig).default("warn"),
     "untested-hook": withOptions(testCoverageConfig).default("warn"),
+    "untested-output-style": withOptions(testCoverageConfig).default("warn"),
     "unmarked-refs": severitySchema.default("warn"),
     "subagent-tool-contract": severitySchema.default("warn"),
     "hook-events": severitySchema.default("warn"),

package/dist/core/eval-driver.d.ts

@@ -71,6 +71,14 @@ export interface Trace {
     readonly hooks: readonly HookFire[];
     /** The agent's final answer text (the terminal `result` event), or "". */
     readonly output: string;
+    /**
+     * Every reply the agent ended a turn with, in order — the `output` is only
+     * the last. A run a Stop hook continued has two, and anything the first one
+     * printed (a status footer) shows only here. Text the agent writes before a
+     * tool call is narration, not a reply. Absent when the harness's run output
+     * does not tell replies apart, or the run was not streamed (`transcript: true`).
+     */
+    readonly replies?: readonly string[];
     /**
      * The requests the model received, captured by the scripted mock — each with
      * its `system` prompt and `messages`, flattened to text. Lets a test assert
@@ -153,6 +161,8 @@ export interface ParsedModelRun {
     readonly toolCalls: ToolCall[];
     readonly hooks: HookFire[];
     readonly subagents: SubagentTrace[];
+    /** Every reply, in order; absent when the harness cannot tell them apart. */
+    readonly replies?: readonly string[];
     readonly usage: EvalUsage;
 }
 export type ModelOutputParser = (out: RunOut) => ParsedModelRun;

package/dist/core/frontmatter-read.d.ts

@@ -1,3 +1,34 @@
+/**
+ * Lenient frontmatter reader — ONE reader for the SKILL.md / subagent `---` block,
+ * shared by `scan` and the PreToolUse rail (`agent-runtime`). It is deliberately
+ * fault-tolerant: it audits arbitrary third-party files, so it must never throw
+ * and must salvage the few scalar/list fields it needs even from a block that
+ * isn't valid YAML.
+ *
+ * The strategy is "real parser, with a safety net": try `js-yaml` (so block
+ * scalars, quoted/multi-line values, and flow arrays parse correctly for free);
+ * if the block isn't valid YAML, fall back to a regex salvage of the requested
+ * field and record `malformed: true` (the signal the `frontmatter-valid` rule
+ * reports). A single bad line therefore never blanks out a whole file's metadata.
+ *
+ * This replaces three divergent hand-parsers (the old `readField` in scan.ts and
+ * the regex parse in agent-runtime.ts); `core/frontmatter.ts` is a DIFFERENT
+ * concern (the Level-1 `vigiles:` rule block) and is untouched.
+ */
+/**
+ * 🔴 `js-yaml` IS REQUIRED LAZILY, AND THAT IS A MEASUREMENT, NOT A STYLE. The
+ * same wrapper is in `core/settings-codec.ts` and `core/markdown.ts` with the
+ * reason recorded: a top-level import puts the parser into the module graph of
+ * every HOOK DECISION, because the hook runtime reaches the adapter registry
+ * and from there a layout. This module became reachable that way on 2026-09-21
+ * through `PluginLayout.instructionChain` (a rule's `paths:` frontmatter is
+ * what decides whether it loads at launch) — measured by
+ * `src/hook-runtime-graph.test.ts`: 37 modules became 71 with an eager import.
+ * `tsc` lowers this to CommonJS, so the `require` does not run until a
+ * frontmatter block is actually parsed, and {@link frontmatterBody}, which needs
+ * no YAML at all, never triggers it.
+ */
+export declare const yaml: () => typeof import("js-yaml");
 export interface FrontmatterRead {
     /** Parsed mapping when the block is valid YAML, else null (malformed or scalar). */
     readonly data: Record<string, unknown> | null;

package/dist/core/frontmatter-read.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.yaml = void 0;
 exports.frontmatterBody = frontmatterBody;
 exports.readFrontmatter = readFrontmatter;
 exports.frontmatterScalar = frontmatterScalar;
@@ -35,6 +36,7 @@ exports.frontmatterList = frontmatterList;
  * no YAML at all, never triggers it.
  */
 const yaml = () => require("js-yaml");
+exports.yaml = yaml;
 // Frontmatter is the very first thing in the file. Anchoring at the start — not
 // `(?:^|\n)` — means a `---` horizontal rule in the BODY is never mistaken for
 // frontmatter (which matters for the malformed-YAML verdict). A leading BOM is
@@ -67,7 +69,7 @@ function readFrontmatter(markdown) {
         return { data: null, block: null, malformed: false };
     const block = m[1];
     try {
-        const parsed = yaml().load(block);
+        const parsed = (0, exports.yaml)().load(block);
         if (parsed !== null &&
             typeof parsed === "object" &&
             !Array.isArray(parsed)) {
@@ -82,7 +84,7 @@ function readFrontmatter(markdown) {
         return { data: null, block, malformed: false };
     }
     catch (e) {
-        if (e instanceof yaml().YAMLException)
+        if (e instanceof (0, exports.yaml)().YAMLException)
             return { data: null, block, malformed: true };
         throw e;
     }