vigiles 33.3.0 → 35.0.0

package/dist/setup-plan.js

@@ -10,7 +10,7 @@
  * on a prompt. See docs/agent-setup.md.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SHIPPED_SKILLS = exports.NUDGE_RULES = exports.WORKFLOW_RULES = exports.STRUCTURAL_RULES = void 0;
+exports.SHIPPED_SKILLS = exports.NUDGE_RULES = exports.WORKFLOW_RULES = void 0;
 exports.parseSetupArgs = parseSetupArgs;
 exports.defaultPlan = defaultPlan;
 exports.mergeProjectConfig = mergeProjectConfig;
@@ -21,7 +21,12 @@ exports.planPluginInstall = planPluginInstall;
 exports.shouldRunGlobalInstall = shouldRunGlobalInstall;
 exports.codexPluginHooks = codexPluginHooks;
 exports.applyCodexPluginHooks = applyCodexPluginHooks;
+exports.adoptionState = adoptionState;
+exports.rerunScope = rerunScope;
+exports.missingVigilesDevDep = missingVigilesDevDep;
+exports.fullSetupFollowUps = fullSetupFollowUps;
 exports.resolvePlan = resolvePlan;
+const presets_js_1 = require("./core/presets.js");
 function flagValue(args, prefix) {
     return args.find((a) => a.startsWith(prefix))?.slice(prefix.length);
 }
@@ -48,6 +53,7 @@ function parseSetupArgs(args) {
         gha: args.includes("--no-gha") ? false : undefined,
         plugin: args.includes("--no-plugin") ? false : undefined,
         ciOnly: args.includes("--ci-only"),
+        full: args.includes("--full"),
     };
 }
 /** The non-interactive defaults: both pillars, CI, and the plugin. `scaffoldSpecs`
@@ -66,39 +72,6 @@ function defaultPlan(strict = false) {
         force: false,
     };
 }
-/**
- * Pure config-merge for what `vigiles init` writes to `.vigilesrc.json`: record
- * the `harness` if absent, add strict rule severities if `--strict`, NEVER
- * clobber an existing key. Returns the merged config, or `null` when nothing
- * changed (so the IO layer skips the write). The IO (read/parse/write + the
- * malformed-file guard) stays in cli.ts.
- */
-/**
- * The structural rules `init` gates BY DEFAULT (severity `error`, so a broken
- * surface fails `vigiles lint`). Every one is HIGH-PRECISION / FP-safe — it fires
- * only on a genuine defect (a never-available/typo'd tool, a subagent missing
- * `name`/`description`, a typo'd hook event, a dead hook script, a broken MCP
- * ref, two skills that collide in the selector) — so a well-formed plugin stays
- * green and catching real breakage out of the box never cries wolf.
- *
- * Deliberately EXCLUDES `require-instructions-spec` and the workflow-forcing rules:
- * those make a CLEAN repo fail (you simply haven't written the spec/test yet), so
- * they stay opt-in under `--strict` (progressive adoption — see
- * `STRICT_EXTRA_RULES`).
- *
- * This is the **`structural`** rule group (see research/install-enforcement-dx.md).
- */
-exports.STRUCTURAL_RULES = [
-    "subagent-tool-contract",
-    "subagent-frontmatter",
-    "hook-events",
-    "hook-script-exists",
-    "mcp-config",
-    "mcp-tool-resolves",
-    "mcp-hook-target-resolves",
-    "disallowed-tools-contract",
-    "description-overlap",
-];
 /**
  * The **`workflow`** group — the WORKFLOW-FORCING / opinionated tier `--strict`
  * gates, which a clean repo can still fail because you haven't done the work yet:
@@ -147,41 +120,53 @@ exports.NUDGE_RULES = [
     // than config. See docs/rules/doc-refs.md.
     "doc-refs",
 ];
+/**
+ * Pure config-merge for what `vigiles init` writes to `.vigilesrc.json`: record
+ * the harnesses if absent, gate the structural rules by EXTENDING the
+ * `vigiles:recommended` preset (never by writing each rule), add the workflow
+ * rules on `--strict`, and NEVER clobber an existing key or severity. Returns
+ * the merged config, or `null` when nothing changed (so the IO layer skips the
+ * write). The IO (read/parse/write + the malformed-file guard) stays in cli.ts.
+ *
+ * 🔴 THE PRESET, NOT NINE LINES (#338). Written lines are a snapshot of the
+ * structural group on the day `init` ran, so a repo adopted earlier never got a
+ * rule added to the group later; the preset is resolved by the loader on every
+ * run (`src/core/presets.ts`).
+ *
+ * `--report-only` is the exception and stays EXPLICIT: it promises that nothing
+ * fails CI, and extending a preset that later gains a rule at `error` would
+ * break that promise on an upgrade. So it writes the same rules at `warn`.
+ */
 function mergeProjectConfig(existing, opts) {
-    const config = { ...existing };
-    let changed = false;
     // The NESTED key (#240). `init` writes the declaration with no roots — a repo
     // whose surfaces sit where its harness reads them needs none, and a root is a
-    // fact only the owner knows. Writing the flat `harness`/`surfaceRoots` pair
-    // here would emit a config the loader now REFUSES, which is why this one line
-    // moved with the shape even though the rest of `init` did not.
-    if (config.harnesses === undefined) {
-        config.harnesses = Object.fromEntries(opts.harnesses.map((h) => [h, {}]));
-        changed = true;
-    }
-    // The rule gate belongs to the LINT layer — a test-only setup records the
-    // harness but writes no rules (honoring the positive-flag contract that
-    // `--test` selects only the test pillar).
-    if (opts.lint !== false) {
-        // Gate the FP-safe `structural` group by default; `--strict` adds the
-        // `workflow` group on top. `--report-only` is the orthogonal severity dial —
-        // it writes the SAME rule set at "warn" (nothing fails CI; the
-        // migration/observe mode). Never clobber a severity the user already set —
-        // only fill the undefined ones.
-        const severity = opts.reportOnly ? "warn" : "error";
-        const gate = opts.strict
-            ? [...exports.STRUCTURAL_RULES, ...exports.WORKFLOW_RULES]
-            : [...exports.STRUCTURAL_RULES];
-        const rules = { ...config.rules };
-        for (const r of gate) {
-            if (rules[r] === undefined) {
-                rules[r] = severity;
-                changed = true;
-            }
-        }
-        config.rules = rules;
-    }
-    return changed ? config : null;
+    // fact only the owner knows.
+    const harnesses = existing.harnesses === undefined
+        ? { harnesses: Object.fromEntries(opts.harnesses.map((h) => [h, {}])) }
+        : {};
+    const gate = opts.lint === false ? {} : lintGate(existing, opts);
+    const added = { ...harnesses, ...gate };
+    return Object.keys(added).length === 0 ? null : { ...existing, ...added };
+}
+/**
+ * The lint-layer keys `init` adds: `extends` and/or the `rules` it fills.
+ * Only the keys that CHANGE are returned, so an already-satisfied config
+ * yields `{}` and is not rewritten.
+ */
+function lintGate(existing, opts) {
+    const workflow = opts.strict ? exports.WORKFLOW_RULES : [];
+    const explicit = opts.reportOnly
+        ? [...presets_js_1.RECOMMENDED_RULES, ...workflow]
+        : workflow;
+    const severity = opts.reportOnly ? "warn" : "error";
+    const before = (existing.rules ?? {});
+    // Never clobber a severity the user already set — only fill the undefined ones.
+    const filled = Object.fromEntries(explicit.filter((r) => before[r] === undefined).map((r) => [r, severity]));
+    const rules = Object.keys(filled).length === 0 ? {} : { rules: { ...before, ...filled } };
+    const preset = opts.reportOnly || existing.extends !== undefined
+        ? {}
+        : { extends: presets_js_1.RECOMMENDED_PRESET };
+    return { ...preset, ...rules };
 }
 /**
  * Whether to drop into interactive prompts: a human at a TTY who passed neither
@@ -288,7 +273,7 @@ function gateOnlyInvitation(plan) {
     const gateOnly = !plan.plugin && !plan.scaffoldSpecs;
     if (!gateOnly)
         return null;
-    return "→ Want your agent to maintain this + measure whether your skills fire? Run `npx vigiles init` and choose 'full' (installs the skills). Optional — the gate above already works.";
+    return "→ Want your agent to maintain this + measure whether your skills fire? Run `npx vigiles init --full` and choose 'full' (installs the skills). Optional — the gate above already works.";
 }
 /**
  * The SHIPPED consumer skills (the `skills/` dir, published via `plugin.json`) —
@@ -470,6 +455,87 @@ function applyCodexPluginHooks(existing) {
     }
     return { ...existing, hooks };
 }
+/** {@link AdoptionState} from the two disk facts that decide it. */
+function adoptionState(facts) {
+    if (facts.hasConfig)
+        return { kind: "adopted", evidence: ".vigilesrc.json" };
+    const [spec] = facts.specs;
+    return spec === undefined
+        ? { kind: "fresh" }
+        : { kind: "adopted", evidence: spec };
+}
+/**
+ * Which setup a run performs: the full one, or the minimal re-run (#338).
+ *
+ * MINIMAL only when the repo is adopted AND the run named nothing that asks for
+ * more. A flag that selects or widens the setup (`--full`, `--strict`,
+ * `--ci-only`, `--report-only`, `--force`, `--target=`, a positive `--lint` /
+ * `--test`) is an explicit request and keeps today's behaviour; the narrowing
+ * flags (`--no-*`, `--harness=`, `--yes`) do not, because they can only make a
+ * run do less.
+ */
+function rerunScope(parsed, state) {
+    if (state.kind === "fresh")
+        return "full";
+    const asksForMore = parsed.full ||
+        parsed.strict ||
+        parsed.ciOnly ||
+        parsed.reportOnly ||
+        parsed.force ||
+        parsed.target !== undefined ||
+        parsed.lint === true ||
+        parsed.test === true;
+    return asksForMore ? "full" : "minimal";
+}
+/**
+ * The `devDependencies` a minimal re-run writes, or null to leave package.json
+ * alone. It ADDS vigiles when no dependency field declares it and never edits an
+ * existing declaration: rewriting `^33.3.0` to `^33` loosens a pin the owner
+ * chose, and moving it between fields is a decision, not a missing piece.
+ */
+function missingVigilesDevDep(pkg, spec) {
+    const declared = pkg.dependencies?.vigiles !== undefined ||
+        pkg.devDependencies?.vigiles !== undefined;
+    return declared ? null : { ...pkg.devDependencies, vigiles: spec };
+}
+/**
+ * The lines a minimal re-run prints about what it did NOT do: each thing a full
+ * setup would add here, then the flag that does it. Empty when nothing is
+ * missing, so a fully set-up repo is not told to run anything.
+ */
+function fullSetupFollowUps(gap) {
+    const configLine = {
+        missing: `write .vigilesrc.json with your harnesses and "extends": "${presets_js_1.RECOMMENDED_PRESET}" (structural rules fail CI)`,
+        "no-preset": `add "extends": "${presets_js_1.RECOMMENDED_PRESET}" to .vigilesrc.json (structural rules fail CI)`,
+        "has-preset": null,
+    };
+    const items = [
+        gap.workflow
+            ? "create .github/workflows/vigiles.yml (a CI workflow — new CI minutes)"
+            : null,
+        configLine[gap.config],
+        gap.harnessTest
+            ? "scaffold vigiles.harness.mjs (a starter harness test)"
+            : null,
+        gap.unspecced.length > 0
+            ? `write specs for ${String(gap.unspecced.length)} hand-written file(s): ${gap.unspecced.join(", ")}`
+            : null,
+        gap.generated
+            ? "generate .vigiles/generated.d.ts and .vigiles/schema.json"
+            : null,
+        ...gap.installs,
+        gap.devDep === null
+            ? null
+            : `set the vigiles devDependency to ${gap.devDep.to} (yours: ${gap.devDep.from})`,
+    ].filter((l) => l !== null);
+    return items.length === 0
+        ? []
+        : [
+            "A full setup would also:",
+            ...items.map((l) => `  - ${l}`),
+            "Run `npx vigiles init --full` for that (flags such as --no-gha still apply).",
+        ];
+}
 /**
  * Resolve the final plan: defaults, then flags, then interactive answers (each
  * layer overrides the previous only where it has an opinion). `--target` pins a

package/dist/vigilesrc.schema.json

@@ -1851,6 +1851,12 @@
       "type": "string",
       "const": "dismissed"
     },
+    "extends": {
+      "type": "string",
+      "enum": [
+        "vigiles:recommended"
+      ]
+    },
     "$schema": {
       "type": "string"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigiles",
-  "version": "33.3.0",
+  "version": "35.0.0",
   "description": "Audit, test and measure the harness your AI agent runs on — grade your CLAUDE.md / AGENTS.md, skills, subagents and hooks, run them against a scripted model, and measure whether they actually fire.",
   "keywords": [
     "claude-code",
@@ -83,7 +83,6 @@
     "test:unit": "npm run build && vitest run --project unit",
     "test:integration": "npm run build && vitest run --project integration",
     "test:e2e": "npm run build && vitest run --project e2e",
-    "test:cli-e2e": "bash test/e2e/run.sh",
     "test:harness": "npm run build && node dist/cli.js test",
     "test:eval": "npm run build && node dist/cli.js eval --all",
     "test:vitest": "npm run build && vitest run --project runners",