vigiles 33.3.0 → 34.0.0

package/action.yml

@@ -19,9 +19,15 @@ inputs:
     required: false
     default: ""
   version:
-    description: "Version of the vigiles npm package to run (e.g. '1', '1.2.3', 'latest'). Use 'local' to run the action's own checkout — for dogfooding via `uses: ./` in this repo's CI."
+    description: >
+      Version of the vigiles npm package to run (e.g. '34', '34.1.2', 'latest').
+      Empty (the default) runs the vigiles THIS repo declares in package.json:
+      the installed copy when node_modules has it, else the version in
+      package-lock.json, else the declared range — and 'latest' only when the
+      repo does not declare vigiles. Use 'local' to run the action's own
+      checkout — for dogfooding via `uses: ./` in this repo's CI.
     required: false
-    default: "latest"
+    default: ""
   max-rules:
     description: "Maximum number of rules per spec file (maps to the CLI's --max-rules)."
     required: false
@@ -109,17 +115,48 @@ runs:
         fi
 
         # Resolve the runner. 'local' runs the action's own build (CI
-        # dogfood via `uses: ./`); any other value runs the published npm
-        # package at that version, so the Action reuses the same tested
-        # artifact users get from `npx vigiles`.
-        version="${VIGILES_VERSION:-latest}"
+        # dogfood via `uses: ./`); an explicit version runs the published npm
+        # package at that version. EMPTY (the default) runs the vigiles this
+        # repo declares, so CI and a local `npx vigiles` are the same version
+        # rather than two pins that drift: the installed copy, else the
+        # lockfile's version, else the declared range; `latest` only when the
+        # repo does not declare vigiles at all.
+        version="${VIGILES_VERSION:-}"
         if [[ "$version" == "local" ]]; then
           runner=(node "${VIGILES_ACTION_PATH}/dist/cli.js")
-        else
+          from="the action's own checkout"
+        elif [[ -n "$version" ]]; then
           runner=(npx --yes "vigiles@${version}")
+          from="the version input"
+        else
+          declared="$(node -e '
+            const fs = require("fs");
+            const read = (f) => { try { return JSON.parse(fs.readFileSync(f, "utf8")); } catch { return null; } };
+            const pkg = read("package.json") ?? {};
+            const spec = pkg.devDependencies?.vigiles ?? pkg.dependencies?.vigiles;
+            if (typeof spec !== "string") { console.log("none"); process.exit(0); }
+            if (fs.existsSync("node_modules/.bin/vigiles")) { console.log("installed"); process.exit(0); }
+            const lock = read("package-lock.json") ?? {};
+            const locked = lock.packages?.["node_modules/vigiles"]?.version ?? lock.dependencies?.vigiles?.version;
+            console.log(typeof locked === "string" ? "lock " + locked : "range " + spec);
+          ' 2>/dev/null || echo none)"
+          case "$declared" in
+            installed)
+              runner=(npx --no-install vigiles)
+              from="this repo's installed vigiles" ;;
+            "lock "*)
+              runner=(npx --yes "vigiles@${declared#lock }")
+              from="package-lock.json" ;;
+            "range "*)
+              runner=(npx --yes "vigiles@${declared#range }")
+              from="the range package.json declares" ;;
+            *)
+              runner=(npx --yes "vigiles@latest")
+              from="latest (this repo does not declare vigiles)" ;;
+          esac
         fi
 
-        echo "vigiles: ${runner[*]} ${args[*]}"
+        echo "vigiles: ${runner[*]} ${args[*]}  (version from ${from})"
 
         # Run, streaming to the log AND capturing for the summary/comment.
         out="$(mktemp)"

package/dist/cli-flag-check.js

@@ -75,6 +75,7 @@ exports.COMMAND_FLAGS = {
         "--no-gha",
         "--no-plugin",
         "--ci-only",
+        "--full",
     ],
     compile: [],
     eject: ["--keep-spec"],

package/dist/cli-main.js

@@ -27,6 +27,7 @@ const generate_harness_js_1 = require("./core/generate-harness.js");
 const capability_diff_js_1 = require("./core/capability-diff.js");
 const validate_js_1 = require("./core/validate.js");
 const eval_lock_js_1 = require("./eval-lock.js");
+const zod_1 = require("zod");
 const cli_flags_js_1 = require("./cli-flags.js");
 const cli_commands_js_1 = require("./cli-commands.js");
 const cli_flag_check_js_1 = require("./cli-flag-check.js");
@@ -2636,6 +2637,9 @@ function vigilesWorkflow(plan, harnesses, hasPackageJson) {
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
+      # No \`version:\` on purpose: the Action runs the vigiles your
+      # package.json declares, so CI and a local \`npx vigiles\` cannot
+      # drift onto two different pins.
       - uses: zernie/vigiles@v1
 `
         : "";
@@ -3036,6 +3040,9 @@ function redirectSyncToolTargets(cwd, targets) {
         `staling the integrity hash.`);
     return out;
 }
+/** The two files `init`'s lint layer generates under `.vigiles/`. */
+const GENERATED_TYPES = ".vigiles/generated.d.ts";
+const GENERATED_SCHEMA = ".vigiles/schema.json";
 /** Pillar 1 — specs + types + schema + compile. Scaffolds a spec for every
  * instruction file (so `--lint` always delivers a spec), but never compiles
  * OVER a hand-written file — that is left to the adopt-spec skill. */
@@ -3081,7 +3088,7 @@ async function setupPillar1(detected, targetValue, harnesses) {
     const outDir = (0, node_path_1.resolve)(cwd, ".vigiles");
     if (!(0, node_fs_1.existsSync)(outDir))
         (0, node_fs_1.mkdirSync)(outDir, { recursive: true });
-    (0, node_fs_1.writeFileSync)((0, node_path_1.resolve)(cwd, ".vigiles/generated.d.ts"), typesResult.dts);
+    (0, node_fs_1.writeFileSync)((0, node_path_1.resolve)(cwd, GENERATED_TYPES), typesResult.dts);
     for (const l of typesResult.linters) {
         console.log(`  ${l.linter}: ${String(l.rules.length)} rules`);
     }
@@ -3089,14 +3096,14 @@ async function setupPillar1(detected, targetValue, harnesses) {
         console.log(`  npm scripts: ${String(typesResult.scripts.length)}`);
     }
     console.log("✓ Generated .vigiles/generated.d.ts");
-    written.push(".vigiles/generated.d.ts");
+    written.push(GENERATED_TYPES);
     const schemaResult = (0, generate_schema_js_1.generateSchema)({
         basePath: cwd,
         linters: (0, validate_js_1.loadConfig)().linters,
     });
-    (0, node_fs_1.writeFileSync)((0, node_path_1.resolve)(cwd, ".vigiles/schema.json"), schemaResult.json);
+    (0, node_fs_1.writeFileSync)((0, node_path_1.resolve)(cwd, GENERATED_SCHEMA), schemaResult.json);
     console.log("✓ Generated .vigiles/schema.json (YAML-LSP frontmatter schema)");
-    written.push(".vigiles/schema.json");
+    written.push(GENERATED_SCHEMA);
     // Compile — but NEVER overwrite an existing hand-written file during `init`:
     // we compile only GREENFIELD targets (the file doesn't exist yet) and targets
     // we already manage (carry our hash). An ADOPTED file is left untouched — the
@@ -3609,8 +3616,24 @@ function printSetupSummary(opts) {
         console.log(`\n  Commit:\n    git add ${files.join(" ")} && git commit -m "Add vigiles"`);
     }
 }
+/** The project config file `init` reads and writes. */
+const VIGILESRC = ".vigilesrc.json";
 async function setup(args) {
     const parsed = (0, setup_plan_js_1.parseSetupArgs)(args);
+    // An already-adopted repo gets the MINIMAL re-run unless a flag asks for more
+    // (#338): re-running `init` to pick up one new piece must not also wire CI,
+    // widen the rules, scaffold files or rewrite a pin. Decided from disk, before
+    // any prompt — the minimal run asks nothing.
+    const state = (0, setup_plan_js_1.adoptionState)({
+        hasConfig: (0, node_fs_1.existsSync)((0, node_path_1.resolve)(process.cwd(), VIGILESRC)),
+        specs: detectProject()
+            .instructionFiles.filter((f) => f.hasSpec)
+            .map((f) => `${f.path}.spec.ts`),
+    });
+    if ((0, setup_plan_js_1.rerunScope)(parsed, state) === "minimal" && state.kind === "adopted") {
+        minimalRerun(parsed, state);
+        return;
+    }
     // Plan: defaults → flags → interactive prompts (only a human at a TTY).
     let plan = (0, setup_plan_js_1.resolvePlan)(parsed);
     const prompted = (0, setup_plan_js_1.shouldPrompt)(parsed, process.stdin.isTTY ?? false);
@@ -3707,6 +3730,152 @@ async function setup(args) {
         console.log("\nℹ Ran the standard setup. Already have a harness, or not a JS/Python repo, and want only the CI integrity gate (nothing installed)? Re-run `npx vigiles init --ci-only`.");
     }
 }
+/**
+ * The minimal re-run on an adopted repo (#338): add what is missing AND safe and
+ * local — the skill links and a missing devDependency — then say what a full
+ * setup would add and the flag that does it. It writes NOTHING else: no CI
+ * workflow, no `.vigilesrc.json` edit, no harness/schema scaffold, no spec for a
+ * hand-written file, no edit to an existing version pin, no global install.
+ * The decisions are pure (`setup-plan.ts`); this is the IO.
+ */
+function minimalRerun(parsed, state) {
+    const plan = (0, setup_plan_js_1.resolvePlan)(parsed);
+    const detected = detectProject();
+    const harnesses = resolveHarnesses(parsed, detected, (0, adapter_registry_js_1.declaredHarnessNames)((0, validate_js_1.loadConfig)().harnesses));
+    console.log(`vigiles is already set up here (found ${state.evidence}) — adding only what is missing.\n`);
+    printDetection(detected, harnesses);
+    const links = plan.plugin ? linkSkillsOnly(harnesses) : [];
+    const devDep = plan.lint || plan.test ? addMissingVigilesDevDep() : [];
+    const written = [...links, ...devDep];
+    if (written.length === 0)
+        console.log("\nNothing was missing.");
+    const followUps = (0, setup_plan_js_1.fullSetupFollowUps)(fullSetupGap(plan, detected, harnesses));
+    if (followUps.length > 0)
+        console.log(`\n${followUps.join("\n")}`);
+    if (written.length > 0)
+        console.log(`\n  Commit:\n    git add ${written.join(" ")} && git commit -m "Update vigiles"`);
+}
+/**
+ * Link the shipped skills for each harness that links them — the safe, local
+ * half of `installPlugins`, without the global install or config wiring.
+ * Returns the links created or rewritten.
+ */
+function linkSkillsOnly(harnesses) {
+    return (0, setup_plan_js_1.planPluginInstall)(harnesses, { hasClaude: false }).flatMap((plan) => {
+        const home = plan.linkSkills ? harnessSkillsHome(plan.harness) : null;
+        if (home === null)
+            return [];
+        const outcome = linkVigilesSkills(home, process.cwd());
+        console.log("");
+        (0, skill_links_js_1.formatSkillLinks)(outcome).forEach((l) => {
+            console.log(l);
+        });
+        return changedLinks(outcome);
+    });
+}
+/** Add vigiles to `devDependencies` only when nothing declares it. */
+function addMissingVigilesDevDep() {
+    const pkgPath = (0, node_path_1.resolve)(process.cwd(), PACKAGE_JSON);
+    if (!(0, node_fs_1.existsSync)(pkgPath))
+        return [];
+    const pkg = readPackageJson(pkgPath);
+    if (pkg === null || pkg.name === "vigiles")
+        return [];
+    const spec = vigilesDepSpec();
+    const devDependencies = (0, setup_plan_js_1.missingVigilesDevDep)(pkg, spec);
+    if (devDependencies === null)
+        return [];
+    (0, node_fs_1.writeFileSync)(pkgPath, JSON.stringify({ ...pkg, devDependencies }, null, 2) + "\n");
+    console.log(`\n✓ Added vigiles@${spec} to devDependencies — run \`npm install\` to fetch it`);
+    return [PACKAGE_JSON];
+}
+/**
+ * The fields of package.json the dependency decisions read. LOOSE on purpose:
+ * every other key is carried through untouched, because the result is written
+ * back and a re-run must not drop a field it never looked at.
+ */
+const packageDepsSchema = zod_1.z.looseObject({
+    name: zod_1.z.string().optional(),
+    dependencies: zod_1.z.record(zod_1.z.string(), zod_1.z.string()).optional(),
+    devDependencies: zod_1.z.record(zod_1.z.string(), zod_1.z.string()).optional(),
+});
+/** package.json parsed for its dependency fields; null when unreadable. */
+function readPackageJson(path) {
+    try {
+        const parsed = packageDepsSchema.safeParse(JSON.parse((0, node_fs_1.readFileSync)(path, "utf-8")));
+        return parsed.success ? parsed.data : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * What a full setup would add here, read from disk — the input to the
+ * follow-up lines. It mirrors the full path's own conditions (the plan's
+ * layers, the existence checks those steps make), so the list names what
+ * `--full` would actually do rather than everything it could.
+ */
+function fullSetupGap(plan, detected, harnesses) {
+    const cwd = process.cwd();
+    const has = (rel) => (0, node_fs_1.existsSync)((0, node_path_1.resolve)(cwd, rel));
+    const config = readProjectConfig((0, node_path_1.resolve)(cwd, VIGILESRC));
+    const pillar1 = plan.lint && plan.scaffoldSpecs;
+    const unspecced = pillar1
+        ? [
+            ...determineTargets(detected, undefined, [...harnesses]),
+            ...discoverAdoptableSurfaces(cwd),
+        ].filter((t, i, all) => all.indexOf(t) === i && !has(`${t}.spec.ts`))
+        : [];
+    const pkg = has(PACKAGE_JSON)
+        ? readPackageJson((0, node_path_1.resolve)(cwd, PACKAGE_JSON))
+        : null;
+    const declared = pkg?.devDependencies?.vigiles ?? pkg?.dependencies?.vigiles ?? null;
+    const spec = vigilesDepSpec();
+    return {
+        workflow: plan.gha && !has(".github/workflows/vigiles.yml"),
+        config: configGap(config, plan.lint),
+        harnessTest: plan.test && !has("vigiles.harness.mjs"),
+        unspecced,
+        generated: pillar1 && !(has(GENERATED_TYPES) && has(GENERATED_SCHEMA)),
+        installs: plan.plugin ? fullInstallLines(harnesses) : [],
+        devDep: declared !== null && declared !== spec && pkg?.name !== "vigiles"
+            ? { from: declared, to: spec }
+            : null,
+    };
+}
+/** Where `.vigilesrc.json` stands against the preset a full setup writes. */
+function configGap(config, lint) {
+    if (config === null)
+        return "missing";
+    return config.extends === undefined && lint ? "no-preset" : "has-preset";
+}
+/** `.vigilesrc.json` as a plain object, or null when absent or unreadable. */
+function readProjectConfig(path) {
+    if (!(0, node_fs_1.existsSync)(path))
+        return null;
+    try {
+        const raw = JSON.parse((0, node_fs_1.readFileSync)(path, "utf-8"));
+        return typeof raw === "object" && raw !== null && !Array.isArray(raw)
+            ? { ...raw }
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The per-machine installs and config wiring the full plugin step would run. */
+function fullInstallLines(harnesses) {
+    return (0, setup_plan_js_1.planPluginInstall)(harnesses, { hasClaude: true }).flatMap((plan) => [
+        ...(plan.globalInstallCarriesHooks && plan.commands.length > 0
+            ? [
+                `install the ${plan.harness} plugin for this machine (${plan.commands.join(" && ")}) and declare it in the project settings`,
+            ]
+            : []),
+        ...(plan.vendors
+            ? [`wire vigiles's nudge hooks into the ${plan.harness} config`]
+            : []),
+    ]);
+}
 /** Canonical, de-duplicated harness names — the keys `harnesses` gets. */
 function harnessConfigKeys(harnesses) {
     return [...new Set(harnesses.map(adapter_registry_js_1.normalizeHarnessName))];
@@ -5446,6 +5615,10 @@ function capabilitiesOfReport(report, dialect) {
 const COMMAND_HELP = {
     init: {
         usage: "  vigiles init [flags]       Set up this repo — specs, plugin, and CI.",
+        detail: [
+            "  Already set up? A re-run only adds what is missing (skill links, the devDependency);",
+            "  --full                     run the whole setup again",
+        ],
     },
     compile: { usage: "  vigiles compile [files...] Compile .spec.ts → .md" },
     eject: {

package/dist/core/config-schema.d.ts

@@ -69,20 +69,20 @@ export declare const vigilesConfigSchema: z.ZodObject<{
         checkboxes: "checkboxes";
     }>>>;
     rules: z.ZodPrefault<z.ZodObject<{
-        "spec-refs": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "orphan-docs": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "duplicate-rules": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "require-instructions-spec": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "require-skill-spec": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        integrity: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        coverage: z.ZodDefault<z.ZodUnion<readonly [z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>, z.ZodTuple<[z.ZodLiteral<"warn">, z.ZodObject<{
+        "spec-refs": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "orphan-docs": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "duplicate-rules": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "require-instructions-spec": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "require-skill-spec": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        integrity: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        coverage: z.ZodDefault<z.ZodUnion<readonly [z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>, z.ZodTuple<[z.ZodLiteral<"warn">, z.ZodObject<{
             linterRules: z.ZodOptional<z.ZodNumber>;
             scripts: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strict>], null>, z.ZodTuple<[z.ZodLiteral<"error">, z.ZodObject<{
             linterRules: z.ZodOptional<z.ZodNumber>;
             scripts: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strict>], null>]>>;
-        "untested-skill": z.ZodDefault<z.ZodUnion<readonly [z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>, z.ZodTuple<[z.ZodLiteral<"warn">, z.ZodObject<{
+        "untested-skill": z.ZodDefault<z.ZodUnion<readonly [z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>, z.ZodTuple<[z.ZodLiteral<"warn">, z.ZodObject<{
             include: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
             exclude: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
             testExtension: z.ZodOptional<z.ZodString>;
@@ -91,7 +91,7 @@ export declare const vigilesConfigSchema: z.ZodObject<{
             exclude: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
             testExtension: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>], null>]>>;
-        "untested-subagent": z.ZodDefault<z.ZodUnion<readonly [z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>, z.ZodTuple<[z.ZodLiteral<"warn">, z.ZodObject<{
+        "untested-subagent": z.ZodDefault<z.ZodUnion<readonly [z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>, z.ZodTuple<[z.ZodLiteral<"warn">, z.ZodObject<{
             include: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
             exclude: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
             testExtension: z.ZodOptional<z.ZodString>;
@@ -100,7 +100,7 @@ export declare const vigilesConfigSchema: z.ZodObject<{
             exclude: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
             testExtension: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>], null>]>>;
-        "untested-hook": z.ZodDefault<z.ZodUnion<readonly [z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>, z.ZodTuple<[z.ZodLiteral<"warn">, z.ZodObject<{
+        "untested-hook": z.ZodDefault<z.ZodUnion<readonly [z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>, z.ZodTuple<[z.ZodLiteral<"warn">, z.ZodObject<{
             include: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
             exclude: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
             testExtension: z.ZodOptional<z.ZodString>;
@@ -109,7 +109,7 @@ export declare const vigilesConfigSchema: z.ZodObject<{
             exclude: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
             testExtension: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>], null>]>>;
-        "untested-output-style": z.ZodDefault<z.ZodUnion<readonly [z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>, z.ZodTuple<[z.ZodLiteral<"warn">, z.ZodObject<{
+        "untested-output-style": z.ZodDefault<z.ZodUnion<readonly [z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>, z.ZodTuple<[z.ZodLiteral<"warn">, z.ZodObject<{
             include: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
             exclude: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
             testExtension: z.ZodOptional<z.ZodString>;
@@ -118,29 +118,29 @@ export declare const vigilesConfigSchema: z.ZodObject<{
             exclude: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<readonly string[], string | string[]>>>;
             testExtension: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>], null>]>>;
-        "unmarked-refs": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "subagent-tool-contract": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "hook-events": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "subagent-frontmatter": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "mcp-config": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "skill-frontmatter": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "mcp-tool-resolves": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "hook-script-exists": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "prefer-compiled-hooks": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "disallowed-tools-contract": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "description-overlap": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "skill-description-budget": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "frontmatter-valid": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "mcp-hook-target-resolves": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "lethal-trifecta": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "skill-resource-resolves": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "skill-missing-fence": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "plugin-dir-layout": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "delegation-trifecta": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "hook-block-ineffective": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "hook-matcher": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "doc-refs": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
-        "instruction-weight": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "warn" | "error", boolean | 0 | 1 | 2 | "warn" | "error" | "off">>>;
+        "unmarked-refs": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "subagent-tool-contract": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "hook-events": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "subagent-frontmatter": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "mcp-config": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "skill-frontmatter": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "mcp-tool-resolves": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "hook-script-exists": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "prefer-compiled-hooks": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "disallowed-tools-contract": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "description-overlap": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "skill-description-budget": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "frontmatter-valid": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "mcp-hook-target-resolves": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "lethal-trifecta": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "skill-resource-resolves": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "skill-missing-fence": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "plugin-dir-layout": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "delegation-trifecta": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "hook-block-ineffective": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "hook-matcher": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "doc-refs": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
+        "instruction-weight": z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodLiteral<"warn">, z.ZodLiteral<"error">, z.ZodLiteral<false>, z.ZodLiteral<"off">, z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<true>]>, z.ZodTransform<false | "error" | "warn", boolean | 0 | 1 | 2 | "error" | "warn" | "off">>>;
     }, z.core.$strict>>;
     files: z.ZodDefault<z.ZodArray<z.ZodString>>;
     maxRules: z.ZodOptional<z.ZodNumber>;
@@ -170,8 +170,27 @@ export declare const vigilesConfigSchema: z.ZodObject<{
         apiVersion: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
     nudge: z.ZodOptional<z.ZodLiteral<"dismissed">>;
+    extends: z.ZodOptional<z.ZodEnum<{
+        "vigiles:recommended": "vigiles:recommended";
+    }>>;
     $schema: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
+/**
+ * Parse a raw `.vigilesrc.json` value — THE one entry point every reader uses.
+ *
+ * 🔴 THE PRESET IS MERGED INTO THE RAW INPUT, BEFORE THE SCHEMA, for one reason:
+ * after parsing, every rule carries a value (the schema fills each default), so
+ * "the user wrote `hook-events: warn`" and "nobody wrote it" are the same
+ * output, and an explicit downgrade could not win over the preset. Before
+ * parsing, the user's own `rules` keys are exactly what they wrote. So the
+ * preset's severities go UNDER them, and the schema then normalizes and
+ * validates the result as if the user had typed both.
+ *
+ * Only a recognized preset with an object (or absent) `rules` is expanded;
+ * anything else is passed through untouched for the schema to refuse with its
+ * own message, so a typo in `extends` is reported, never silently ignored.
+ */
+export declare function parseVigilesConfig(raw: unknown): Readonly<ReturnType<typeof vigilesConfigSchema.safeParse>>;
 /**
  * A `.vigilesrc.json` that cannot be honoured as written.
  *

package/dist/core/config-schema.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.REPLACED_KEYS = exports.VigilesConfigError = exports.vigilesConfigSchema = exports.RULE_NAMES = void 0;
+exports.parseVigilesConfig = parseVigilesConfig;
 exports.replacedKeyMessage = replacedKeyMessage;
 exports.formatConfigIssues = formatConfigIssues;
 /**
@@ -48,6 +49,7 @@ exports.formatConfigIssues = formatConfigIssues;
  */
 const zod_1 = require("zod");
 const edit_distance_js_1 = require("./edit-distance.js");
+const presets_js_1 = require("./presets.js");
 // ---------------------------------------------------------------------------
 // Primitives
 // ---------------------------------------------------------------------------
@@ -232,6 +234,14 @@ exports.vigilesConfigSchema = zod_1.z
     audit: zod_1.z.object({ measure: zod_1.z.boolean().optional() }).strict().optional(),
     eval: zod_1.z.object({ apiVersion: zod_1.z.number().optional() }).strict().optional(),
     nudge: zod_1.z.literal("dismissed").optional(),
+    /**
+     * A named preset whose rule severities apply UNDER `rules` — ESLint's
+     * `extends`. `"vigiles:recommended"` gates the structural group (see
+     * `./presets.ts`); an explicit `rules` entry overrides it. Applied by
+     * {@link parseVigilesConfig}, which is why this key is only VALIDATED here.
+     * Placed after the keys people misspell most: the "Known:" list is capped.
+     */
+    extends: zod_1.z.enum(presets_js_1.PRESET_NAMES).optional(),
     /**
      * The editor's pointer at the published JSON Schema. Accepted, never read.
      *
@@ -262,6 +272,38 @@ exports.vigilesConfigSchema = zod_1.z
     $schema: zod_1.z.string().optional(),
 })
     .strict();
+/**
+ * Parse a raw `.vigilesrc.json` value — THE one entry point every reader uses.
+ *
+ * 🔴 THE PRESET IS MERGED INTO THE RAW INPUT, BEFORE THE SCHEMA, for one reason:
+ * after parsing, every rule carries a value (the schema fills each default), so
+ * "the user wrote `hook-events: warn`" and "nobody wrote it" are the same
+ * output, and an explicit downgrade could not win over the preset. Before
+ * parsing, the user's own `rules` keys are exactly what they wrote. So the
+ * preset's severities go UNDER them, and the schema then normalizes and
+ * validates the result as if the user had typed both.
+ *
+ * Only a recognized preset with an object (or absent) `rules` is expanded;
+ * anything else is passed through untouched for the schema to refuse with its
+ * own message, so a typo in `extends` is reported, never silently ignored.
+ */
+function parseVigilesConfig(raw) {
+    return exports.vigilesConfigSchema.safeParse(withPresetRules(raw));
+}
+/** `raw` with its `extends` preset's rules placed under its own `rules`. */
+function withPresetRules(raw) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+        return raw;
+    const preset = "extends" in raw ? raw.extends : undefined;
+    const rules = "rules" in raw ? raw.rules : undefined;
+    if (!(0, presets_js_1.isPresetName)(preset))
+        return raw;
+    if (rules === undefined)
+        return { ...raw, rules: { ...(0, presets_js_1.presetRules)(preset) } };
+    if (typeof rules !== "object" || rules === null || Array.isArray(rules))
+        return raw;
+    return { ...raw, rules: { ...(0, presets_js_1.presetRules)(preset), ...rules } };
+}
 /**
  * A `.vigilesrc.json` that cannot be honoured as written.
  *

package/dist/core/presets.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Named rule PRESETS a `.vigilesrc.json` can `extends` — the ESLint
+ * `recommended` model, stored as data.
+ *
+ * 🔴 WHY A PRESET READ AT LOAD TIME, NOT RULE LINES WRITTEN AT SETUP TIME. Every
+ * rule's built-in default stays `warn` (`config-schema.ts`); the structural rules
+ * gate only because `init` turns them up. It used to do that by WRITING nine
+ * `"<rule>": "error"` lines into the new repo's config — a snapshot of the group
+ * on the day `init` ran. A repo adopted before a rule joined the group never got
+ * it from an upgrade, and re-running `init` to fetch it rewrote far more than
+ * the rule (#338). `"extends": "vigiles:recommended"` is resolved by the loader
+ * on every run, so the repo follows the group as the installed vigiles ships it,
+ * and an explicit `rules` entry still overrides it.
+ *
+ * ⚠️ ADDING A RULE HERE IS A BREAKING CHANGE (a `!` commit, a semver major): it
+ * can turn a consumer's CI red with no edit on their side. Removing one is not.
+ * ESLint treats `eslint:recommended` the same way.
+ *
+ * Harness-agnostic data: rule names only, no adapter fact.
+ */
+import type { RulesConfig } from "./types.js";
+/**
+ * The rules `vigiles:recommended` raises to `error` — the FP-safe structural
+ * group: each one fires only on a genuine defect (a never-available or typo'd
+ * tool, a subagent missing `name`/`description`, a typo'd hook event, a dead hook
+ * script, a broken MCP reference, two skills that collide in the selector), so a
+ * well-formed harness stays green.
+ *
+ * Deliberately EXCLUDES the workflow rules (`require-instructions-spec`,
+ * `untested-*`): a clean repo fails those until the work is done, so they stay
+ * an explicit opt-in (`init --strict`).
+ */
+export declare const RECOMMENDED_RULES: readonly ["subagent-tool-contract", "subagent-frontmatter", "hook-events", "hook-script-exists", "mcp-config", "mcp-tool-resolves", "mcp-hook-target-resolves", "disallowed-tools-contract", "description-overlap"];
+/** The preset names `extends` accepts. One today; the tuple is the enum. */
+export declare const PRESET_NAMES: readonly ["vigiles:recommended"];
+/** A preset name `extends` accepts. */
+export type PresetName = (typeof PRESET_NAMES)[number];
+/** The preset `init` writes. */
+export declare const RECOMMENDED_PRESET: PresetName;
+/** Whether a raw value names a preset. */
+export declare function isPresetName(value: unknown): value is PresetName;
+/** The rule severities a preset sets, in the config's raw spelling. */
+export declare function presetRules(name: PresetName): Readonly<Partial<Record<keyof RulesConfig, "error">>>;
+//# sourceMappingURL=presets.d.ts.map

package/dist/core/presets.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RECOMMENDED_PRESET = exports.PRESET_NAMES = exports.RECOMMENDED_RULES = void 0;
+exports.isPresetName = isPresetName;
+exports.presetRules = presetRules;
+/**
+ * The rules `vigiles:recommended` raises to `error` — the FP-safe structural
+ * group: each one fires only on a genuine defect (a never-available or typo'd
+ * tool, a subagent missing `name`/`description`, a typo'd hook event, a dead hook
+ * script, a broken MCP reference, two skills that collide in the selector), so a
+ * well-formed harness stays green.
+ *
+ * Deliberately EXCLUDES the workflow rules (`require-instructions-spec`,
+ * `untested-*`): a clean repo fails those until the work is done, so they stay
+ * an explicit opt-in (`init --strict`).
+ */
+exports.RECOMMENDED_RULES = [
+    "subagent-tool-contract",
+    "subagent-frontmatter",
+    "hook-events",
+    "hook-script-exists",
+    "mcp-config",
+    "mcp-tool-resolves",
+    "mcp-hook-target-resolves",
+    "disallowed-tools-contract",
+    "description-overlap",
+];
+/** The preset names `extends` accepts. One today; the tuple is the enum. */
+exports.PRESET_NAMES = ["vigiles:recommended"];
+/** The preset `init` writes. */
+exports.RECOMMENDED_PRESET = "vigiles:recommended";
+/** What each preset sets, as the config would spell it. */
+const PRESETS = {
+    "vigiles:recommended": Object.fromEntries(exports.RECOMMENDED_RULES.map((r) => [r, "error"])),
+};
+/** Whether a raw value names a preset. */
+function isPresetName(value) {
+    return exports.PRESET_NAMES.some((n) => n === value);
+}
+/** The rule severities a preset sets, in the config's raw spelling. */
+function presetRules(name) {
+    return PRESETS[name];
+}
+//# sourceMappingURL=presets.js.map

package/dist/core/validate.js

@@ -147,7 +147,7 @@ function loadConfig(searchFrom, { onInvalid = "throw" } = {}) {
         }
     }
     if (problems.length === 0) {
-        const parsed = config_schema_js_1.vigilesConfigSchema.safeParse(raw);
+        const parsed = (0, config_schema_js_1.parseVigilesConfig)(raw);
         if (parsed.success)
             return parsed.data;
         problems.push(...(0, config_schema_js_1.formatConfigIssues)(parsed.error.issues));

package/dist/setup-plan.d.ts

@@ -77,6 +77,11 @@ export interface ParsedSetupArgs {
      * DISCOVERY row of `cohesive-feature-delivery`.
      */
     ciOnly: boolean;
+    /**
+     * `--full` — run the whole setup even on a repo that already uses vigiles.
+     * Without it, a re-run there is the minimal one (see {@link rerunScope}).
+     */
+    full: boolean;
 }
 /** Parse `init` args into the choices the user pinned. The two pillars are
  * selected with `--lint` / `--test`. */
@@ -87,29 +92,6 @@ export declare function parseSetupArgs(args: readonly string[]): ParsedSetupArgs
  * raw files WITHOUT scaffolding a spec (gate-first-adoption). Non-interactive
  * behaviour is unchanged: bare `init` (lint on) scaffolds as before. */
 export declare function defaultPlan(strict?: boolean): SetupPlan;
-/**
- * Pure config-merge for what `vigiles init` writes to `.vigilesrc.json`: record
- * the `harness` if absent, add strict rule severities if `--strict`, NEVER
- * clobber an existing key. Returns the merged config, or `null` when nothing
- * changed (so the IO layer skips the write). The IO (read/parse/write + the
- * malformed-file guard) stays in cli.ts.
- */
-/**
- * The structural rules `init` gates BY DEFAULT (severity `error`, so a broken
- * surface fails `vigiles lint`). Every one is HIGH-PRECISION / FP-safe — it fires
- * only on a genuine defect (a never-available/typo'd tool, a subagent missing
- * `name`/`description`, a typo'd hook event, a dead hook script, a broken MCP
- * ref, two skills that collide in the selector) — so a well-formed plugin stays
- * green and catching real breakage out of the box never cries wolf.
- *
- * Deliberately EXCLUDES `require-instructions-spec` and the workflow-forcing rules:
- * those make a CLEAN repo fail (you simply haven't written the spec/test yet), so
- * they stay opt-in under `--strict` (progressive adoption — see
- * `STRICT_EXTRA_RULES`).
- *
- * This is the **`structural`** rule group (see research/install-enforcement-dx.md).
- */
-export declare const STRUCTURAL_RULES: readonly ["subagent-tool-contract", "subagent-frontmatter", "hook-events", "hook-script-exists", "mcp-config", "mcp-tool-resolves", "mcp-hook-target-resolves", "disallowed-tools-contract", "description-overlap"];
 /**
  * The **`workflow`** group — the WORKFLOW-FORCING / opinionated tier `--strict`
  * gates, which a clean repo can still fail because you haven't done the work yet:
@@ -135,7 +117,24 @@ export declare const WORKFLOW_RULES: readonly ["require-instructions-spec", "unt
  * (research/install-enforcement-dx.md).
  */
 export declare const NUDGE_RULES: readonly ["skill-description-budget", "frontmatter-valid", "skill-frontmatter", "prefer-compiled-hooks", "unmarked-refs", "lethal-trifecta", "skill-resource-resolves", "skill-missing-fence", "plugin-dir-layout", "delegation-trifecta", "hook-block-ineffective", "hook-matcher", "doc-refs"];
-export declare function mergeProjectConfig(existing: Record<string, unknown>, opts: {
+/**
+ * Pure config-merge for what `vigiles init` writes to `.vigilesrc.json`: record
+ * the harnesses if absent, gate the structural rules by EXTENDING the
+ * `vigiles:recommended` preset (never by writing each rule), add the workflow
+ * rules on `--strict`, and NEVER clobber an existing key or severity. Returns
+ * the merged config, or `null` when nothing changed (so the IO layer skips the
+ * write). The IO (read/parse/write + the malformed-file guard) stays in cli.ts.
+ *
+ * 🔴 THE PRESET, NOT NINE LINES (#338). Written lines are a snapshot of the
+ * structural group on the day `init` ran, so a repo adopted earlier never got a
+ * rule added to the group later; the preset is resolved by the loader on every
+ * run (`src/core/presets.ts`).
+ *
+ * `--report-only` is the exception and stays EXPLICIT: it promises that nothing
+ * fails CI, and extending a preset that later gains a rule at `error` would
+ * break that promise on an upgrade. So it writes the same rules at `warn`.
+ */
+export declare function mergeProjectConfig(existing: Readonly<Record<string, unknown>>, opts: Readonly<{
     /** Canonical harness names this repo targets, in the order to declare them. */
     harnesses: readonly string[];
     strict: boolean;
@@ -144,7 +143,7 @@ export declare function mergeProjectConfig(existing: Record<string, unknown>, op
      * concern, so a test-only setup (`init --test` / `--no-lint`) records the
      * harness but writes NO lint rules. */
     lint?: boolean;
-}): Record<string, unknown> | null;
+}>): Record<string, unknown> | null;
 /**
  * Whether to drop into interactive prompts: a human at a TTY who passed neither
  * `--yes` nor an explicit `--target`, and who hasn't already pinned every choice
@@ -292,6 +291,75 @@ export declare function codexPluginHooks(): CodexPluginHook[];
  * (and every other config key) untouched. Returns a new object.
  */
 export declare function applyCodexPluginHooks(existing: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Whether this repo already uses vigiles, decided from what is ON DISK.
+ *
+ * 🔴 THE SIGNAL IS `.vigilesrc.json` OR A SPEC NEXT TO AN INSTRUCTION FILE, and
+ * deliberately NOT a `vigiles` devDependency: the documented first step on a new
+ * repo can be `npm i -D vigiles` followed by `npx vigiles init`, and that run
+ * must still be the full setup. Every `init` writes `.vigilesrc.json` (it records
+ * the harnesses even on a test-only run), and a hand-written one means the owner
+ * has already configured vigiles. A spec beside `CLAUDE.md`/`AGENTS.md` covers a
+ * repo adopted before the config file existed.
+ */
+export type AdoptionState = {
+    readonly kind: "fresh";
+} | {
+    readonly kind: "adopted";
+    readonly evidence: string;
+};
+/** {@link AdoptionState} from the two disk facts that decide it. */
+export declare function adoptionState(facts: Readonly<{
+    hasConfig: boolean;
+    specs: readonly string[];
+}>): AdoptionState;
+/**
+ * Which setup a run performs: the full one, or the minimal re-run (#338).
+ *
+ * MINIMAL only when the repo is adopted AND the run named nothing that asks for
+ * more. A flag that selects or widens the setup (`--full`, `--strict`,
+ * `--ci-only`, `--report-only`, `--force`, `--target=`, a positive `--lint` /
+ * `--test`) is an explicit request and keeps today's behaviour; the narrowing
+ * flags (`--no-*`, `--harness=`, `--yes`) do not, because they can only make a
+ * run do less.
+ */
+export declare function rerunScope(parsed: Readonly<ParsedSetupArgs>, state: AdoptionState): "full" | "minimal";
+/**
+ * The `devDependencies` a minimal re-run writes, or null to leave package.json
+ * alone. It ADDS vigiles when no dependency field declares it and never edits an
+ * existing declaration: rewriting `^33.3.0` to `^33` loosens a pin the owner
+ * chose, and moving it between fields is a decision, not a missing piece.
+ */
+export declare function missingVigilesDevDep(pkg: Readonly<{
+    dependencies?: Readonly<Record<string, string>>;
+    devDependencies?: Readonly<Record<string, string>>;
+}>, spec: string): Readonly<Record<string, string>> | null;
+/** What a full setup would add on an adopted repo — the facts that decide it. */
+export interface FullSetupGap {
+    /** `.github/workflows/vigiles.yml` is absent (and CI wiring is not opted out). */
+    readonly workflow: boolean;
+    /** `.vigilesrc.json`: absent, present without the preset, or already extending it. */
+    readonly config: "missing" | "no-preset" | "has-preset";
+    /** `vigiles.harness.mjs` is absent (and the test layer is not opted out). */
+    readonly harnessTest: boolean;
+    /** Instruction files and surfaces a full setup would adopt into a spec. */
+    readonly unspecced: readonly string[];
+    /** `.vigiles/generated.d.ts` / `.vigiles/schema.json` would be created. */
+    readonly generated: boolean;
+    /** The global plugin install / hook wiring a full setup would run, one line each. */
+    readonly installs: readonly string[];
+    /** The devDependency rewrite a full setup would make, if any. */
+    readonly devDep: Readonly<{
+        from: string;
+        to: string;
+    }> | null;
+}
+/**
+ * The lines a minimal re-run prints about what it did NOT do: each thing a full
+ * setup would add here, then the flag that does it. Empty when nothing is
+ * missing, so a fully set-up repo is not told to run anything.
+ */
+export declare function fullSetupFollowUps(gap: FullSetupGap): readonly string[];
 /**
  * Resolve the final plan: defaults, then flags, then interactive answers (each
  * layer overrides the previous only where it has an opinion). `--target` pins a

package/dist/setup-plan.js

@@ -10,7 +10,7 @@
  * on a prompt. See docs/agent-setup.md.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SHIPPED_SKILLS = exports.NUDGE_RULES = exports.WORKFLOW_RULES = exports.STRUCTURAL_RULES = void 0;
+exports.SHIPPED_SKILLS = exports.NUDGE_RULES = exports.WORKFLOW_RULES = void 0;
 exports.parseSetupArgs = parseSetupArgs;
 exports.defaultPlan = defaultPlan;
 exports.mergeProjectConfig = mergeProjectConfig;
@@ -21,7 +21,12 @@ exports.planPluginInstall = planPluginInstall;
 exports.shouldRunGlobalInstall = shouldRunGlobalInstall;
 exports.codexPluginHooks = codexPluginHooks;
 exports.applyCodexPluginHooks = applyCodexPluginHooks;
+exports.adoptionState = adoptionState;
+exports.rerunScope = rerunScope;
+exports.missingVigilesDevDep = missingVigilesDevDep;
+exports.fullSetupFollowUps = fullSetupFollowUps;
 exports.resolvePlan = resolvePlan;
+const presets_js_1 = require("./core/presets.js");
 function flagValue(args, prefix) {
     return args.find((a) => a.startsWith(prefix))?.slice(prefix.length);
 }
@@ -48,6 +53,7 @@ function parseSetupArgs(args) {
         gha: args.includes("--no-gha") ? false : undefined,
         plugin: args.includes("--no-plugin") ? false : undefined,
         ciOnly: args.includes("--ci-only"),
+        full: args.includes("--full"),
     };
 }
 /** The non-interactive defaults: both pillars, CI, and the plugin. `scaffoldSpecs`
@@ -66,39 +72,6 @@ function defaultPlan(strict = false) {
         force: false,
     };
 }
-/**
- * Pure config-merge for what `vigiles init` writes to `.vigilesrc.json`: record
- * the `harness` if absent, add strict rule severities if `--strict`, NEVER
- * clobber an existing key. Returns the merged config, or `null` when nothing
- * changed (so the IO layer skips the write). The IO (read/parse/write + the
- * malformed-file guard) stays in cli.ts.
- */
-/**
- * The structural rules `init` gates BY DEFAULT (severity `error`, so a broken
- * surface fails `vigiles lint`). Every one is HIGH-PRECISION / FP-safe — it fires
- * only on a genuine defect (a never-available/typo'd tool, a subagent missing
- * `name`/`description`, a typo'd hook event, a dead hook script, a broken MCP
- * ref, two skills that collide in the selector) — so a well-formed plugin stays
- * green and catching real breakage out of the box never cries wolf.
- *
- * Deliberately EXCLUDES `require-instructions-spec` and the workflow-forcing rules:
- * those make a CLEAN repo fail (you simply haven't written the spec/test yet), so
- * they stay opt-in under `--strict` (progressive adoption — see
- * `STRICT_EXTRA_RULES`).
- *
- * This is the **`structural`** rule group (see research/install-enforcement-dx.md).
- */
-exports.STRUCTURAL_RULES = [
-    "subagent-tool-contract",
-    "subagent-frontmatter",
-    "hook-events",
-    "hook-script-exists",
-    "mcp-config",
-    "mcp-tool-resolves",
-    "mcp-hook-target-resolves",
-    "disallowed-tools-contract",
-    "description-overlap",
-];
 /**
  * The **`workflow`** group — the WORKFLOW-FORCING / opinionated tier `--strict`
  * gates, which a clean repo can still fail because you haven't done the work yet:
@@ -147,41 +120,53 @@ exports.NUDGE_RULES = [
     // than config. See docs/rules/doc-refs.md.
     "doc-refs",
 ];
+/**
+ * Pure config-merge for what `vigiles init` writes to `.vigilesrc.json`: record
+ * the harnesses if absent, gate the structural rules by EXTENDING the
+ * `vigiles:recommended` preset (never by writing each rule), add the workflow
+ * rules on `--strict`, and NEVER clobber an existing key or severity. Returns
+ * the merged config, or `null` when nothing changed (so the IO layer skips the
+ * write). The IO (read/parse/write + the malformed-file guard) stays in cli.ts.
+ *
+ * 🔴 THE PRESET, NOT NINE LINES (#338). Written lines are a snapshot of the
+ * structural group on the day `init` ran, so a repo adopted earlier never got a
+ * rule added to the group later; the preset is resolved by the loader on every
+ * run (`src/core/presets.ts`).
+ *
+ * `--report-only` is the exception and stays EXPLICIT: it promises that nothing
+ * fails CI, and extending a preset that later gains a rule at `error` would
+ * break that promise on an upgrade. So it writes the same rules at `warn`.
+ */
 function mergeProjectConfig(existing, opts) {
-    const config = { ...existing };
-    let changed = false;
     // The NESTED key (#240). `init` writes the declaration with no roots — a repo
     // whose surfaces sit where its harness reads them needs none, and a root is a
-    // fact only the owner knows. Writing the flat `harness`/`surfaceRoots` pair
-    // here would emit a config the loader now REFUSES, which is why this one line
-    // moved with the shape even though the rest of `init` did not.
-    if (config.harnesses === undefined) {
-        config.harnesses = Object.fromEntries(opts.harnesses.map((h) => [h, {}]));
-        changed = true;
-    }
-    // The rule gate belongs to the LINT layer — a test-only setup records the
-    // harness but writes no rules (honoring the positive-flag contract that
-    // `--test` selects only the test pillar).
-    if (opts.lint !== false) {
-        // Gate the FP-safe `structural` group by default; `--strict` adds the
-        // `workflow` group on top. `--report-only` is the orthogonal severity dial —
-        // it writes the SAME rule set at "warn" (nothing fails CI; the
-        // migration/observe mode). Never clobber a severity the user already set —
-        // only fill the undefined ones.
-        const severity = opts.reportOnly ? "warn" : "error";
-        const gate = opts.strict
-            ? [...exports.STRUCTURAL_RULES, ...exports.WORKFLOW_RULES]
-            : [...exports.STRUCTURAL_RULES];
-        const rules = { ...config.rules };
-        for (const r of gate) {
-            if (rules[r] === undefined) {
-                rules[r] = severity;
-                changed = true;
-            }
-        }
-        config.rules = rules;
-    }
-    return changed ? config : null;
+    // fact only the owner knows.
+    const harnesses = existing.harnesses === undefined
+        ? { harnesses: Object.fromEntries(opts.harnesses.map((h) => [h, {}])) }
+        : {};
+    const gate = opts.lint === false ? {} : lintGate(existing, opts);
+    const added = { ...harnesses, ...gate };
+    return Object.keys(added).length === 0 ? null : { ...existing, ...added };
+}
+/**
+ * The lint-layer keys `init` adds: `extends` and/or the `rules` it fills.
+ * Only the keys that CHANGE are returned, so an already-satisfied config
+ * yields `{}` and is not rewritten.
+ */
+function lintGate(existing, opts) {
+    const workflow = opts.strict ? exports.WORKFLOW_RULES : [];
+    const explicit = opts.reportOnly
+        ? [...presets_js_1.RECOMMENDED_RULES, ...workflow]
+        : workflow;
+    const severity = opts.reportOnly ? "warn" : "error";
+    const before = (existing.rules ?? {});
+    // Never clobber a severity the user already set — only fill the undefined ones.
+    const filled = Object.fromEntries(explicit.filter((r) => before[r] === undefined).map((r) => [r, severity]));
+    const rules = Object.keys(filled).length === 0 ? {} : { rules: { ...before, ...filled } };
+    const preset = opts.reportOnly || existing.extends !== undefined
+        ? {}
+        : { extends: presets_js_1.RECOMMENDED_PRESET };
+    return { ...preset, ...rules };
 }
 /**
  * Whether to drop into interactive prompts: a human at a TTY who passed neither
@@ -288,7 +273,7 @@ function gateOnlyInvitation(plan) {
     const gateOnly = !plan.plugin && !plan.scaffoldSpecs;
     if (!gateOnly)
         return null;
-    return "→ Want your agent to maintain this + measure whether your skills fire? Run `npx vigiles init` and choose 'full' (installs the skills). Optional — the gate above already works.";
+    return "→ Want your agent to maintain this + measure whether your skills fire? Run `npx vigiles init --full` and choose 'full' (installs the skills). Optional — the gate above already works.";
 }
 /**
  * The SHIPPED consumer skills (the `skills/` dir, published via `plugin.json`) —
@@ -470,6 +455,87 @@ function applyCodexPluginHooks(existing) {
     }
     return { ...existing, hooks };
 }
+/** {@link AdoptionState} from the two disk facts that decide it. */
+function adoptionState(facts) {
+    if (facts.hasConfig)
+        return { kind: "adopted", evidence: ".vigilesrc.json" };
+    const [spec] = facts.specs;
+    return spec === undefined
+        ? { kind: "fresh" }
+        : { kind: "adopted", evidence: spec };
+}
+/**
+ * Which setup a run performs: the full one, or the minimal re-run (#338).
+ *
+ * MINIMAL only when the repo is adopted AND the run named nothing that asks for
+ * more. A flag that selects or widens the setup (`--full`, `--strict`,
+ * `--ci-only`, `--report-only`, `--force`, `--target=`, a positive `--lint` /
+ * `--test`) is an explicit request and keeps today's behaviour; the narrowing
+ * flags (`--no-*`, `--harness=`, `--yes`) do not, because they can only make a
+ * run do less.
+ */
+function rerunScope(parsed, state) {
+    if (state.kind === "fresh")
+        return "full";
+    const asksForMore = parsed.full ||
+        parsed.strict ||
+        parsed.ciOnly ||
+        parsed.reportOnly ||
+        parsed.force ||
+        parsed.target !== undefined ||
+        parsed.lint === true ||
+        parsed.test === true;
+    return asksForMore ? "full" : "minimal";
+}
+/**
+ * The `devDependencies` a minimal re-run writes, or null to leave package.json
+ * alone. It ADDS vigiles when no dependency field declares it and never edits an
+ * existing declaration: rewriting `^33.3.0` to `^33` loosens a pin the owner
+ * chose, and moving it between fields is a decision, not a missing piece.
+ */
+function missingVigilesDevDep(pkg, spec) {
+    const declared = pkg.dependencies?.vigiles !== undefined ||
+        pkg.devDependencies?.vigiles !== undefined;
+    return declared ? null : { ...pkg.devDependencies, vigiles: spec };
+}
+/**
+ * The lines a minimal re-run prints about what it did NOT do: each thing a full
+ * setup would add here, then the flag that does it. Empty when nothing is
+ * missing, so a fully set-up repo is not told to run anything.
+ */
+function fullSetupFollowUps(gap) {
+    const configLine = {
+        missing: `write .vigilesrc.json with your harnesses and "extends": "${presets_js_1.RECOMMENDED_PRESET}" (structural rules fail CI)`,
+        "no-preset": `add "extends": "${presets_js_1.RECOMMENDED_PRESET}" to .vigilesrc.json (structural rules fail CI)`,
+        "has-preset": null,
+    };
+    const items = [
+        gap.workflow
+            ? "create .github/workflows/vigiles.yml (a CI workflow — new CI minutes)"
+            : null,
+        configLine[gap.config],
+        gap.harnessTest
+            ? "scaffold vigiles.harness.mjs (a starter harness test)"
+            : null,
+        gap.unspecced.length > 0
+            ? `write specs for ${String(gap.unspecced.length)} hand-written file(s): ${gap.unspecced.join(", ")}`
+            : null,
+        gap.generated
+            ? "generate .vigiles/generated.d.ts and .vigiles/schema.json"
+            : null,
+        ...gap.installs,
+        gap.devDep === null
+            ? null
+            : `set the vigiles devDependency to ${gap.devDep.to} (yours: ${gap.devDep.from})`,
+    ].filter((l) => l !== null);
+    return items.length === 0
+        ? []
+        : [
+            "A full setup would also:",
+            ...items.map((l) => `  - ${l}`),
+            "Run `npx vigiles init --full` for that (flags such as --no-gha still apply).",
+        ];
+}
 /**
  * Resolve the final plan: defaults, then flags, then interactive answers (each
  * layer overrides the previous only where it has an opinion). `--target` pins a

package/dist/vigilesrc.schema.json

@@ -1851,6 +1851,12 @@
       "type": "string",
       "const": "dismissed"
     },
+    "extends": {
+      "type": "string",
+      "enum": [
+        "vigiles:recommended"
+      ]
+    },
     "$schema": {
       "type": "string"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigiles",
-  "version": "33.3.0",
+  "version": "34.0.0",
   "description": "Audit, test and measure the harness your AI agent runs on — grade your CLAUDE.md / AGENTS.md, skills, subagents and hooks, run them against a scripted model, and measure whether they actually fire.",
   "keywords": [
     "claude-code",