vigiles 35.0.0 → 36.0.0

package/dist/adapters/codex/driver.d.ts

@@ -7,6 +7,9 @@ import type { HarnessTestDriver, HarnessDriverContext, ParsedRun } from "../../c
  * `--dangerously-bypass-approvals-and-sandbox` make it run unattended;
  * `--skip-git-repo-check` lets it run in a bare temp dir; `--ignore-user-config`
  * keeps the host's `~/.codex` out. The prompt is the trailing positional.
+ * `ctx.allowedTools` is ignored: `codex exec` runs with approvals bypassed, so
+ * everything is already approved. `ctx.tools` is refused (throws): Codex has no
+ * per-run tool availability.
  * Pure, so the arg shape is unit-tested.
  */
 export declare function buildCodexArgs(ctx: HarnessDriverContext): string[];

package/dist/adapters/codex/driver.js

@@ -26,9 +26,15 @@ const mock_model_js_1 = require("./mock-model.js");
  * `--dangerously-bypass-approvals-and-sandbox` make it run unattended;
  * `--skip-git-repo-check` lets it run in a bare temp dir; `--ignore-user-config`
  * keeps the host's `~/.codex` out. The prompt is the trailing positional.
+ * `ctx.allowedTools` is ignored: `codex exec` runs with approvals bypassed, so
+ * everything is already approved. `ctx.tools` is refused (throws): Codex has no
+ * per-run tool availability.
  * Pure, so the arg shape is unit-tested.
  */
 function buildCodexArgs(ctx) {
+    if (ctx.tools !== undefined) {
+        throw new Error("tools is not supported for codex: it has no per-run tool availability, and a list that withheld nothing would let a test pass over a run where nothing was withheld. Drop tools, or assert on what the agent did.");
+    }
     return [
         "exec",
         "--ignore-user-config",

package/dist/core/harness-driver.d.ts

@@ -108,10 +108,17 @@ export interface HarnessDriverContext {
     /** Whether a settings file was written (CC: pass `--settings`). */
     readonly hasSettings: boolean;
     /**
-     * The ONLY tools the agent has, when the spec lists them; undefined = no
-     * restriction (every tool is offered, the default four are pre-approved).
+     * Which tools EXIST in the session, when the spec lists them (CC: `--tools`);
+     * undefined = every tool exists. A driver whose harness has no such concept
+     * (Codex) throws on one rather than ignore it.
      */
     readonly tools?: readonly string[];
+    /**
+     * Which tools are PRE-APPROVED (CC: `--allowedTools`); undefined = the
+     * default four. It never removes a tool. A driver with no such concept
+     * ignores it.
+     */
+    readonly allowedTools?: readonly string[];
     /** Capture the full event transcript instead of just the final result. */
     readonly transcript: boolean;
     /** Path to a plugin dir to install natively, if any. */

package/dist/harness-test.d.ts

@@ -1,5 +1,5 @@
 import type { HarnessAdapter } from "./core/adapter.js";
-import type { HarnessTestDriver, ToolCall, HookFire, ParsedRun, ModelTurn } from "./core/harness-driver.js";
+import type { HarnessTestDriver, ToolCall, HookFire, ParsedRun, ModelTurn, ModelRequest } from "./core/harness-driver.js";
 import type { Trace, SubagentTrace } from "./core/eval-driver.js";
 export type { Trace, SubagentTrace } from "./core/eval-driver.js";
 import { parseReplies, reachedModel } from "./adapters/claude-code/replies.js";
@@ -53,16 +53,36 @@ export interface HarnessTestSpec {
     /** The user prompt. Default: "go". */
     readonly prompt?: string;
     /**
-     * The ONLY tools the agent has, when you list them: a tool left out is not
-     * offered (`claude --tools`, Claude Code 2.0.31+), `[]` is refused, and a
-     * scripted call to a tool the list leaves out throws before the run starts.
-     * Omitted, nothing is withheld: every tool is offered and Read, Edit, Write and
-     * Bash are pre-approved. Each listed tool is also pre-approved
-     * (`--allowedTools`), so it does not stop on a permission prompt; a permission
-     * rule such as `Bash(git *)` keeps its specifier for the approval and is
-     * offered as plain `Bash`. An MCP tool is not a built-in: left out, it is still
-     * offered but not approved, so a call to it is refused for permission rather
-     * than as "No such tool".
+     * Which tools EXIST in the session (`claude --tools`, Claude Code 2.0.31+). A
+     * tool left out is not offered at all, so a call to it is "No such tool
+     * available". Omitted, every tool exists. This is the field that withholds a
+     * tool. Names only: a permission rule such as `Bash(git *)` is refused (put the
+     * rule in `allowedTools`). `[]` is refused (an agent with no tools is never
+     * served a scripted turn), and a scripted call to a tool the list leaves out
+     * throws before the run starts. An MCP tool is not a built-in, so `--tools`
+     * does not withhold it. Codex has no equivalent, so a run there refuses it.
+     *
+     * | field          | Claude Code flag  | meaning                      |
+     * | -------------- | ----------------- | ---------------------------- |
+     * | `tools`        | `--tools`         | which tools exist            |
+     * | `allowedTools` | `--allowedTools`  | which are pre-approved       |
+     */
+    readonly tools?: readonly string[];
+    /**
+     * Which tools are PRE-APPROVED (`claude --allowedTools`), so they do not stop
+     * on a permission prompt. Takes permission rules (`Bash(git *)`). Omitted:
+     * Read, Edit, Write and Bash are approved. An explicit list REPLACES that
+     * default, so `tools: ["Read", "Write"]` with `allowedTools: ["Skill"]` leaves
+     * Write unapproved. `[]`: nothing is approved.
+     *
+     * It never removes a tool, and leaving a tool out is not a fence: in headless
+     * mode Claude Code refuses only the calls it would have asked about. For Bash
+     * that is a command that creates, changes or removes a file (`touch`, `>`),
+     * inside or outside the working directory; a command with no file effect
+     * (`ls`, `printf`, `id`) runs unapproved. So a refused `touch` proves the
+     * file-change guard is live, not that Bash is withheld. To withhold a tool use
+     * `tools`; to forbid its use put a deny rule in the fixture's
+     * `settings.permissions.deny`.
      */
     readonly allowedTools?: readonly string[];
     /**
@@ -131,20 +151,34 @@ export declare function parseResultEvent(stdout: string): Record<string, unknown
 export declare function parseOutput(stdout: string): string;
 export declare function parseHooks(stdout: string): HookFire[];
 /**
- * The names `--tools` should offer for an `allowedTools` list. `--allowedTools`
- * takes permission rules (`Bash(git *)`); `--tools` takes tool NAMES, and a rule
- * with a specifier there makes the CLI offer no tools at all. So the specifier is
- * dropped (`Bash(git *)` → `Bash`) and repeats collapse. Pure.
+ * The names `--tools` takes for a `tools` list: trimmed and deduplicated.
+ * `--allowedTools` takes permission rules (`Bash(git *)`); `--tools` takes tool
+ * NAMES, and a rule there makes the CLI offer no tools at all. Reducing it to
+ * `Bash` would offer more than the author wrote, so a rule is refused: it
+ * belongs in `allowedTools`. Pure.
  */
-export declare function toolAvailabilityList(allowed: readonly string[]): readonly string[];
+export declare function toolAvailabilityList(tools: readonly string[]): readonly string[];
 /**
- * A scripted call to a tool an EXPLICIT `allowedTools` does not offer. The CLI
- * answers it with "No such tool available" and the run goes on, so a test that
- * scripts the call and then asserts on something else passes over a step that
- * never happened. Returns the message to throw, or undefined. MCP tools are not
- * built-ins, so `--tools` does not withhold them and they are skipped. Pure.
+ * A scripted call to a tool an EXPLICIT `tools` list leaves out. The CLI answers
+ * it with "No such tool available" and the run goes on, so a test that scripts
+ * the call and then asserts on something else passes over a step that never
+ * happened. A tool that exists but is not in `allowedTools` is NOT this: the CLI
+ * refuses it for permission, which is a result a test can assert on. Returns the
+ * message to throw, or undefined. MCP tools are not built-ins, so `--tools` does
+ * not withhold them and they are skipped. Pure.
  */
-export declare function unofferedScriptedTool(model: readonly ModelTurn[], allowed: readonly string[] | undefined): string | undefined;
+export declare function unofferedScriptedTool(model: readonly ModelTurn[], tools: readonly string[] | undefined): string | undefined;
+/**
+ * The agent's own tool results, read off the requests it sent back to the model,
+ * that say a scripted tool does not exist. The CLI answers an unknown name
+ * (`Bsh` for `Bash`, an `mcp__` server that is not configured) with an error
+ * RESULT and carries on, exit 0, so a test that asserts "the call errored and
+ * left no side effect" passes on a typo. `tools` cannot catch it: the pre-flight
+ * skips `mcp__` names and only runs when `tools` is given. Side-channel requests
+ * are the CLI's own bookkeeping and are not read. Returns the message to throw,
+ * or undefined. Pure.
+ */
+export declare function noSuchToolMessage(model: readonly ModelTurn[], requests: readonly ModelRequest[]): string | undefined;
 /**
  * A run on a `claude` that predates `--tools` exits at argument parsing, and
  * commander's "unknown option" says nothing about WHY vigiles passed it. Returns
@@ -204,6 +238,10 @@ export interface RunHarnessTestOptions {
 }
 /** Say so on stderr when side-channel calls arrived and no script turn was served. */
 export declare function warnUnconsumed(count: number, sideChannelCount: number): void;
+/**
+ * What makes a finished run unsound, most specific first, or undefined. Pure.
+ */
+export declare function runProblem(stderr: string, model: readonly ModelTurn[], modelRequests: readonly ModelRequest[], tools?: readonly string[]): string | undefined;
 /**
  * Run the real agent CLI against a scripted mock model, with the given fixture
  * and settings (hooks). Deterministic — same script, same result. Adapter-driven

package/dist/harness-test.js

@@ -8,12 +8,14 @@ exports.parseOutput = parseOutput;
 exports.parseHooks = parseHooks;
 exports.toolAvailabilityList = toolAvailabilityList;
 exports.unofferedScriptedTool = unofferedScriptedTool;
+exports.noSuchToolMessage = noSuchToolMessage;
 exports.unsupportedToolsFlag = unsupportedToolsFlag;
 exports.buildClaudeArgs = buildClaudeArgs;
 exports.parseClaudeRun = parseClaudeRun;
 exports.harnessSpawnEnv = harnessSpawnEnv;
 exports.claudeAvailable = claudeAvailable;
 exports.warnUnconsumed = warnUnconsumed;
+exports.runProblem = runProblem;
 exports.runHarnessTest = runHarnessTest;
 exports.runHarnessTestIn = runHarnessTestIn;
 exports.runHarness = runHarness;
@@ -287,32 +289,66 @@ function parseHooks(stdout) {
  */
 const TOOLS_FLAG_MIN_CLAUDE = "2.0.31";
 /**
- * The names `--tools` should offer for an `allowedTools` list. `--allowedTools`
- * takes permission rules (`Bash(git *)`); `--tools` takes tool NAMES, and a rule
- * with a specifier there makes the CLI offer no tools at all. So the specifier is
- * dropped (`Bash(git *)` → `Bash`) and repeats collapse. Pure.
+ * The names `--tools` takes for a `tools` list: trimmed and deduplicated.
+ * `--allowedTools` takes permission rules (`Bash(git *)`); `--tools` takes tool
+ * NAMES, and a rule there makes the CLI offer no tools at all. Reducing it to
+ * `Bash` would offer more than the author wrote, so a rule is refused: it
+ * belongs in `allowedTools`. Pure.
  */
-function toolAvailabilityList(allowed) {
-    const names = allowed.map((rule) => rule.replace(/\(.*$/, "").trim());
-    return [...new Set(names.filter((n) => n !== ""))];
+function toolAvailabilityList(tools) {
+    const names = tools.map((entry) => entry.trim()).filter((n) => n !== "");
+    const rule = names.find((name) => name.includes("("));
+    if (rule !== undefined) {
+        throw new Error(`tools takes bare tool names, and "${rule}" is a permission rule — put the rule in allowedTools and the name ("${rule.replace(/\(.*$/, "")}") in tools`);
+    }
+    return [...new Set(names)];
 }
 /**
- * A scripted call to a tool an EXPLICIT `allowedTools` does not offer. The CLI
- * answers it with "No such tool available" and the run goes on, so a test that
- * scripts the call and then asserts on something else passes over a step that
- * never happened. Returns the message to throw, or undefined. MCP tools are not
- * built-ins, so `--tools` does not withhold them and they are skipped. Pure.
+ * A scripted call to a tool an EXPLICIT `tools` list leaves out. The CLI answers
+ * it with "No such tool available" and the run goes on, so a test that scripts
+ * the call and then asserts on something else passes over a step that never
+ * happened. A tool that exists but is not in `allowedTools` is NOT this: the CLI
+ * refuses it for permission, which is a result a test can assert on. Returns the
+ * message to throw, or undefined. MCP tools are not built-ins, so `--tools` does
+ * not withhold them and they are skipped. Pure.
  */
-function unofferedScriptedTool(model, allowed) {
-    if (allowed === undefined)
+function unofferedScriptedTool(model, tools) {
+    if (tools === undefined)
         return undefined;
-    const offered = toolAvailabilityList(allowed);
+    const exist = toolAvailabilityList(tools);
     const at = model.findIndex((t) => t.tool !== undefined &&
         !t.tool.startsWith("mcp__") &&
-        !offered.includes(t.tool));
+        !exist.includes(t.tool));
     return at < 0
         ? undefined
-        : `scripted call to "${model[at]?.tool ?? ""}" on turn ${String(at + 1)}, but this run offers only: ${offered.join(", ")} — add it to allowedTools`;
+        : `scripted call to "${model[at]?.tool ?? ""}" on turn ${String(at + 1)}, but this run's tools are only: ${exist.join(", ")} — add it to tools`;
+}
+/**
+ * The agent's own tool results, read off the requests it sent back to the model,
+ * that say a scripted tool does not exist. The CLI answers an unknown name
+ * (`Bsh` for `Bash`, an `mcp__` server that is not configured) with an error
+ * RESULT and carries on, exit 0, so a test that asserts "the call errored and
+ * left no side effect" passes on a typo. `tools` cannot catch it: the pre-flight
+ * skips `mcp__` names and only runs when `tools` is given. Side-channel requests
+ * are the CLI's own bookkeeping and are not read. Returns the message to throw,
+ * or undefined. Pure.
+ */
+function noSuchToolMessage(model, requests) {
+    // The CLI's own wording, inside its error wrapper, for a name the script
+    // calls: the agent calls tools only from the script, so the same words in the
+    // prompt or in a hook's injected text are not a result of this run.
+    const pattern = /<tool_use_error>Error: No such tool available: ([^\s<]+)<\/tool_use_error>/g;
+    const scripted = new Set(model.flatMap((t) => (t.tool === undefined ? [] : [t.tool])));
+    const hit = requests
+        .filter((r) => r.sideChannel !== true)
+        .flatMap((r) => r.messages)
+        .flatMap((m) => [...m.text.matchAll(pattern)].map((x) => x[1]))
+        .find((name) => name !== undefined && scripted.has(name));
+    if (hit === undefined)
+        return undefined;
+    const at = model.findIndex((t) => t.tool === hit);
+    const turn = at < 0 ? "" : ` on turn ${String(at + 1)}`;
+    return `scripted call to "${hit}"${turn}: the CLI answered "No such tool available: ${hit}", so the call never ran and the test would carry on over a step that did not happen. Check the name for a typo; an mcp__ tool also needs its server configured in the fixture.`;
 }
 /**
  * A run on a `claude` that predates `--tools` exits at argument parsing, and
@@ -321,7 +357,7 @@ function unofferedScriptedTool(model, allowed) {
  */
 function unsupportedToolsFlag(stderr) {
     return /unknown option '--tools'/.test(stderr)
-        ? `this \`claude\` does not know \`--tools\`, which runHarnessTest uses to withhold every tool not in \`allowedTools\` (#252). Update Claude Code to ${TOOLS_FLAG_MIN_CLAUDE} or newer. Running without it would hand the agent every tool while the test reads as if it were fenced.`
+        ? `this \`claude\` does not know \`--tools\`, which runHarnessTest passes for the \`tools\` field (which tools exist). Update Claude Code to ${TOOLS_FLAG_MIN_CLAUDE} or newer. Running without it would hand the agent every tool while the test reads as if it were restricted.`
         : undefined;
 }
 /**
@@ -330,7 +366,7 @@ function unsupportedToolsFlag(stderr) {
  * here. Pure, so the arg shape is unit-tested.
  */
 function buildClaudeArgs(spec, hasSettings) {
-    const tools = spec.allowedTools ?? ["Read", "Edit", "Write", "Bash"];
+    const approved = spec.allowedTools ?? ["Read", "Edit", "Write", "Bash"];
     return [
         "-p",
         spec.prompt ?? "go",
@@ -343,18 +379,15 @@ function buildClaudeArgs(spec, hasSettings) {
             ? ["--plugin-dir", (0, node_path_1.resolve)(spec.pluginDir)]
             : []),
         ...(hasSettings ? ["--settings", "settings.json"] : []),
-        // An EXPLICIT list restricts: `--tools` is the AVAILABILITY list, a tool left
-        // out is not offered at all. `--allowedTools` only PRE-APPROVES (it never
-        // restricts), so on its own it left every unnamed tool runnable (#252). An
-        // empty list is `--tools ""` = no tools. With no list, nothing is withheld:
-        // the default four are pre-approved and every other tool stays available.
-        ...(spec.allowedTools === undefined
+        // `tools` = which tools EXIST (`--tools`, the availability list). Omitted:
+        // nothing is withheld.
+        ...(spec.tools === undefined
             ? []
-            : ["--tools", toolAvailabilityList(spec.allowedTools).join(",")]),
-        // Pre-approval for the offered tools, so none stops on a permission prompt
-        // (headless). An empty one approves nothing, so the flag is left out (a bare
+            : ["--tools", toolAvailabilityList(spec.tools).join(",")]),
+        // `allowedTools` = which are PRE-APPROVED (`--allowedTools`); it never
+        // restricts. An empty list approves nothing, so the flag is left out (a bare
         // `--allowedTools` exits before any model turn).
-        ...(tools.length === 0 ? [] : ["--allowedTools", ...tools]),
+        ...(approved.length === 0 ? [] : ["--allowedTools", ...approved]),
     ];
 }
 /** Build the `claude` argv from the driver context — wraps `buildClaudeArgs`. */
@@ -364,7 +397,8 @@ function buildClaudeArgsFromCtx(ctx) {
         prompt: ctx.prompt,
         transcript: ctx.transcript,
         pluginDir: ctx.pluginDir,
-        allowedTools: ctx.tools,
+        tools: ctx.tools,
+        allowedTools: ctx.allowedTools,
     }, ctx.hasSettings);
 }
 /** Parse the `claude` stdout/stream into the unified trace fields. */
@@ -480,15 +514,41 @@ function warnUnconsumed(count, sideChannelCount) {
     if (unconsumed !== undefined)
         console.error(unconsumed);
 }
+/**
+ * `tools` made only of names the CLI does not know leaves the agent with none:
+ * every request then declares no tools, the mock files it as side-channel
+ * traffic, and the script is never served, so the run decides nothing. Requests
+ * that all came in that way, under an explicit `tools`, mean exactly that. No
+ * request at all (a hook stopped the prompt) is a different run. Pure.
+ */
+function toolsResolvedToNothing(tools, requests) {
+    if (tools === undefined || requests.length === 0)
+        return undefined;
+    if (!requests.every((r) => r.sideChannel === true))
+        return undefined;
+    return `tools ${JSON.stringify(tools)} gave the agent no tools: no name in it is a tool this CLI knows, so no request offered a tool and the script was never served. Check the names for typos.`;
+}
+/**
+ * What makes a finished run unsound, most specific first, or undefined. Pure.
+ */
+function runProblem(stderr, model, modelRequests, tools) {
+    return (unsupportedToolsFlag(stderr) ??
+        toolsResolvedToNothing(tools, modelRequests) ??
+        // A typo'd last turn makes the CLI ask once more, so the overrun follows
+        // from it: report the cause, not its effect.
+        noSuchToolMessage(model, modelRequests) ??
+        (0, script_overrun_js_1.overrunMessageFor)(model.length, modelRequests));
+}
 /**
  * A run that proves nothing about the script fails the test instead of coming
- * back as a result: the `claude` on PATH predates `--tools` (#252), or the agent
+ * back as a result: the `claude` on PATH predates `--tools` (needed for `tools`), or the agent
  * asked for a model turn the script did not have and the mock answered with an
- * error rather than an invented turn (#340). Removes the run's directory, since
+ * error rather than an invented turn (#340), or a scripted call named a tool the
+ * CLI does not have. Removes the run's directory, since
  * no result is handed back to clean it up.
  */
-function assertRunSound(cwd, stderr, scripted, modelRequests) {
-    const problem = unsupportedToolsFlag(stderr) ?? (0, script_overrun_js_1.overrunMessageFor)(scripted, modelRequests);
+function assertRunSound(cwd, stderr, model, modelRequests, tools) {
+    const problem = runProblem(stderr, model, modelRequests, tools);
     if (problem === undefined)
         return;
     (0, node_fs_1.rmSync)(cwd, { recursive: true, force: true });
@@ -539,16 +599,30 @@ async function runHarnessTest(spec, opts = {}) {
     refuseUnrunnableSpec(spec);
     return runHarnessTestIn(spec, opts, "inherit");
 }
+/** The driver's view of one run of `spec`. Pure. */
+function driverContext(spec, cwd, hasSettings, mockArgs) {
+    return {
+        prompt: spec.prompt ?? "go",
+        cwd,
+        hasSettings,
+        tools: spec.tools,
+        allowedTools: spec.allowedTools,
+        transcript: spec.transcript ?? false,
+        pluginDir: spec.pluginDir,
+        mockArgs,
+    };
+}
 /**
  * The scripted model tells an agent turn from the CLI's own bookkeeping calls by
  * the tools the request declares (`isMainLoopRequest`). An agent with none is
  * never served a script turn, and the run would decide on nothing.
  */
 function refuseUnrunnableSpec(spec) {
-    if (spec.allowedTools?.length === 0) {
-        throw new Error("allowedTools: [] leaves the agent with no tools, and the scripted model only serves a turn to a request that declares tools — no script turn would be consumed. Name the tools the agent has.");
+    if (spec.tools !== undefined &&
+        toolAvailabilityList(spec.tools).length === 0) {
+        throw new Error("tools: [] leaves the agent with no tools (a list of blank names counts as empty), and the scripted model only serves a turn to a request that declares tools — no script turn would be consumed. Name the tools the agent has.");
     }
-    const unoffered = unofferedScriptedTool(spec.model, spec.allowedTools);
+    const unoffered = unofferedScriptedTool(spec.model, spec.tools);
     if (unoffered !== undefined)
         throw new Error(unoffered);
 }
@@ -585,15 +659,18 @@ async function runHarnessTestIn(spec, opts, home) {
     const cwd = (0, tmp_root_js_1.makeTmpDir)("harness");
     writeFixture(cwd, files, settings);
     const timeoutMs = spec.timeoutMs ?? 60000;
-    const buildArgs = (mockArgs) => driver.buildArgs({
-        prompt: spec.prompt ?? "go",
-        cwd,
-        hasSettings: settings !== undefined,
-        tools: spec.allowedTools,
-        transcript: spec.transcript ?? false,
-        pluginDir: spec.pluginDir,
-        mockArgs,
-    });
+    // A driver refuses a spec it cannot run (Codex and `tools`) inside buildArgs.
+    // That refusal must not leave the run's temp dir behind; the mock, if started,
+    // is closed by the caller's finally.
+    const buildArgs = (mockArgs) => {
+        try {
+            return driver.buildArgs(driverContext(spec, cwd, settings !== undefined, mockArgs));
+        }
+        catch (error) {
+            (0, node_fs_1.rmSync)(cwd, { recursive: true, force: true });
+            throw error;
+        }
+    };
     // Confined path (Claude Code only): the mock is co-launched in the netns, so
     // the agent reaches it over the loopback URL the sandbox sets — Claude Code is
     // env-only (empty mockArgs), so the argv needs no mock-wiring flags.
@@ -612,7 +689,7 @@ async function runHarnessTestIn(spec, opts, home) {
         // warning, which the sandbox path could not emit at all before.
         const { count, sideChannelCount } = (0, mock_model_js_1.splitRequestCounts)(out.requests);
         warnUnconsumed(count, sideChannelCount);
-        assertRunSound(cwd, "", spec.model.length, out.requests);
+        assertRunSound(cwd, "", spec.model, out.requests, spec.tools);
         return check(makeResult(cwd, out, parseClaudeRun(out.stdout), count, out.requests));
     }
     // Direct path: mock runs in this process; the agent reaches it over localhost.
@@ -631,7 +708,7 @@ async function runHarnessTestIn(spec, opts, home) {
         // it (every request arriving without tool declarations, so nothing looked
         // like an agent turn) instead of leaving it to be rediscovered.
         warnUnconsumed(mock.count, mock.sideChannelCount ?? 0);
-        assertRunSound(cwd, out.stderr, spec.model.length, mock.requests);
+        assertRunSound(cwd, out.stderr, spec.model, mock.requests, spec.tools);
         return check(makeResult(cwd, out, driver.parseRun(out.stdout), mock.count, [
             ...mock.requests,
         ]));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigiles",
-  "version": "35.0.0",
+  "version": "36.0.0",
   "description": "Audit, test and measure the harness your AI agent runs on — grade your CLAUDE.md / AGENTS.md, skills, subagents and hooks, run them against a scripted model, and measure whether they actually fire.",
   "keywords": [
     "claude-code",