vigiles 38.2.0 → 39.0.0

package/dist/adapters/claude-code/event-capability.js

@@ -1,21 +1,35 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.claudeCodeEventCapabilities = void 0;
+/*
+ * `halt` (doc, § JSON output, read 2026-10-12): `continue` is a universal field
+ * — "If `false`, Claude stops processing entirely after the hook runs" — and
+ * "Every event accepts them, but some events discard them [...]. Each event's
+ * section says so." The six rows that carry `halt` have no such sentence in
+ * their sections (and § JSON output names PreToolUse and PostToolUse: "the stop
+ * applies even when the tool call fails"). § PreCompact and § Notification
+ * each say they discard `continue`; SessionEnd has no turn left to stop.
+ * https://code.claude.com/docs/en/hooks
+ */
 exports.claudeCodeEventCapabilities = {
     capturedFrom: "code.claude.com/docs/en/hooks (claude-code 2.1.273) + inject/veto measured 2026-09-16 headless",
     events: {
         // doc: SessionStart context is prepended to the session. MEASURED 2026-09-16:
         // inject lands; exit 2 is ignored entirely (it is in noEffectHookEvents).
+        // doc (§ Exit code 0, read 2026-10-11): plain stdout is context here — "The
+        // exceptions are `UserPromptSubmit`, `UserPromptExpansion`, `SessionStart`,
+        // and `PostModelSwitch`, where Claude Code adds plain-text stdout as context".
         SessionStart: {
             carries: "session",
-            honours: ["inject"],
+            honours: ["inject", "stdout-context", "halt"],
             matcher: false,
             denyShape: "exit-code",
         },
-        // doc: exit 2 blocks the prompt and erases it; stdout becomes context.
+        // doc: exit 2 blocks the prompt and erases it; plain stdout becomes context
+        // (the same § Exit code 0 sentence as SessionStart).
         UserPromptSubmit: {
             carries: "prompt",
-            honours: ["veto", "inject"],
+            honours: ["veto", "inject", "stdout-context", "halt"],
             matcher: false,
             denyShape: "exit-code",
         },
@@ -26,16 +40,18 @@ exports.claudeCodeEventCapabilities = {
         // assumption nobody had run.
         PreToolUse: {
             carries: "tool",
-            honours: ["veto", "ask", "inject"],
+            honours: ["veto", "ask", "inject", "halt"],
             matcher: true,
             denyShape: "permission-decision",
         },
         // doc: exit 2 feeds stderr back to the MODEL but the tool has already run —
-        // feedback, never a veto. This distinction is why `hook-block-ineffective`
+        // feedback, never a veto. NOT `stdout-context`, and NOT stderr at exit 0:
+        // "Claude never sees stderr from a hook that exits 0" (§ Exit code 0) — the
+        // channel a downstream KB linter used for weeks, delivering nothing. This distinction is why `hook-block-ineffective`
         // does not flag PostToolUse and would cry wolf if it did.
         PostToolUse: {
             carries: "tool",
-            honours: ["feedback", "inject"],
+            honours: ["feedback", "inject", "halt"],
             matcher: true,
             denyShape: "exit-code",
         },
@@ -43,7 +59,7 @@ exports.claudeCodeEventCapabilities = {
         // shape). MEASURED 2026-09-16: inject lands too.
         Stop: {
             carries: "stop",
-            honours: ["veto", "inject"],
+            honours: ["veto", "inject", "halt"],
             matcher: false,
             denyShape: "exit-code",
         },
@@ -51,7 +67,7 @@ exports.claudeCodeEventCapabilities = {
         // it was not measured, and Stop's behaviour is not evidence about it.
         SubagentStop: {
             carries: "stop",
-            honours: ["veto"],
+            honours: ["veto", "halt"],
             matcher: false,
             denyShape: "exit-code",
         },

package/dist/adapters/claude-code/hook-protocol.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.claudeCodeHookProtocol = void 0;
 const hook_condition_js_1 = require("./hook-condition.js");
 const hook_install_js_1 = require("../../hook-install.js");
+const layout_js_1 = require("./layout.js");
 exports.claudeCodeHookProtocol = {
     name: "claude-code",
     blockExitCode: 2,
@@ -55,7 +56,7 @@ exports.claudeCodeHookProtocol = {
     // step the core cannot take: `CompiledHooks` is the application layer's type,
     // and a core port may not name it.
     mergeRegistrations(existing, compiled, managedBy) {
-        return (0, hook_install_js_1.mergeHooksJson)(existing, compiled, managedBy);
+        return (0, hook_install_js_1.mergeHooksJson)(existing, compiled, managedBy, layout_js_1.claudeCodeLayout.projectRootTokens ?? []);
     },
 };
 //# sourceMappingURL=hook-protocol.js.map

package/dist/adapters/codex/hook-protocol.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.codexHookProtocol = void 0;
 const hook_install_js_1 = require("../../hook-install.js");
+const layout_js_1 = require("./layout.js");
 exports.codexHookProtocol = {
     name: "codex",
     blockExitCode: 2,
@@ -35,7 +36,7 @@ exports.codexHookProtocol = {
         return { hooks: { [on]: [entry] } };
     },
     mergeRegistrations(existing, compiled, managedBy) {
-        return (0, hook_install_js_1.mergeHooksToml)(existing, compiled, managedBy);
+        return (0, hook_install_js_1.mergeHooksToml)(existing, compiled, managedBy, layout_js_1.codexLayout.projectRootTokens ?? []);
     },
 };
 //# sourceMappingURL=hook-protocol.js.map

package/dist/cli-flag-check.d.ts

@@ -70,4 +70,40 @@ export declare function unknownFlags(command: string, argv: readonly string[]):
 export declare function nearestFlag(unknown: string, known: readonly FlagSpec[]): string | undefined;
 /** The message printed to stderr for one unrecognised flag. */
 export declare function formatUnknownFlag(command: string, flag: string): string;
+/**
+ * Which of a verb's arguments name a PATH. The CLI runs every command from the
+ * project root it resolves once (`findProjectRoot`), but a path the user types
+ * means "from where I typed it"; these are the arguments re-expressed from the
+ * root before the command runs. One table beside the flag table, so a new
+ * path-valued flag is declared where flags are.
+ */
+interface PathArguments {
+    /**
+     * Which directory the verb runs from. `project`: the resolved project root.
+     * `invocation`: where it was typed — `init` makes THAT directory a project
+     * (a workspace member it sets up must not become its monorepo's root), and
+     * `hook-runtime` takes its root from the harness event, not from a directory.
+     */
+    readonly root: "project" | "invocation";
+    /** Positionals that are paths: all of them, all after the first (a kind), or none. */
+    readonly positionals: "all" | "after-first" | "none";
+    /** `--flag=` specs whose value is a path. */
+    readonly flags: readonly FlagSpec[];
+}
+export declare const PATH_ARGUMENTS: Readonly<Record<Verb, PathArguments>>;
+/**
+ * Whether `command` runs from the resolved project root. A word that is not a
+ * verb (`--version`, a typo) runs nowhere in particular: it is answered where
+ * it was typed.
+ */
+export declare function runsFromProjectRoot(command: string): boolean;
+/**
+ * The verb's arguments (everything after the verb) with each path argument
+ * passed through `rebase`. Flags that do not take a path, words, and `--`
+ * itself are returned unchanged. After `--` every word is an operand: a path
+ * among them is rebased like any other positional, and a dash-led one is never
+ * mistaken for a path-valued flag.
+ */
+export declare function rebasePathArgs(command: string, argv: readonly string[], rebase: (path: string) => string): readonly string[];
+export {};
 //# sourceMappingURL=cli-flag-check.d.ts.map

package/dist/cli-flag-check.js

@@ -39,11 +39,13 @@
  * rejection in a user's face.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.COMMAND_FLAGS = exports.SHARED_FLAGS = void 0;
+exports.PATH_ARGUMENTS = exports.COMMAND_FLAGS = exports.SHARED_FLAGS = void 0;
 exports.knownFlagsFor = knownFlagsFor;
 exports.unknownFlags = unknownFlags;
 exports.nearestFlag = nearestFlag;
 exports.formatUnknownFlag = formatUnknownFlag;
+exports.runsFromProjectRoot = runsFromProjectRoot;
+exports.rebasePathArgs = rebasePathArgs;
 /**
  * Flags every verb accepts: the config overrides applied in `main()` before
  * dispatch (see `applyConfigFlags`) plus the harness override, which the shared
@@ -203,4 +205,73 @@ function formatUnknownFlag(command, flag) {
     lines.push(`  Flags for \`${command}\`: ${[...known].sort().join(" ")}`, `  \`vigiles ${command} --help\` lists them with descriptions.`);
     return lines.join("\n");
 }
+exports.PATH_ARGUMENTS = {
+    init: { root: "invocation", positionals: "none", flags: ["--target="] },
+    compile: { root: "project", positionals: "all", flags: [] },
+    eject: { root: "project", positionals: "all", flags: [] },
+    lint: { root: "project", positionals: "all", flags: ["--json-out="] },
+    test: { root: "project", positionals: "all", flags: [] },
+    eval: { root: "project", positionals: "all", flags: [] },
+    audit: {
+        root: "project",
+        positionals: "all",
+        flags: ["--out=", "--capability-diff=", "--prompts="],
+    },
+    // `generate <kind> [out]`: the kind is a word, the rest are paths.
+    generate: { root: "project", positionals: "after-first", flags: [] },
+    // The harness supplies its argv; its paths are already what it means.
+    "hook-runtime": { root: "invocation", positionals: "none", flags: [] },
+};
+/** The verb's row, or undefined for a word that is not a verb. */
+function pathArgumentsOf(command) {
+    return Object.entries(exports.PATH_ARGUMENTS).find(([verb]) => verb === command)?.[1];
+}
+/**
+ * Whether `command` runs from the resolved project root. A word that is not a
+ * verb (`--version`, a typo) runs nowhere in particular: it is answered where
+ * it was typed.
+ */
+function runsFromProjectRoot(command) {
+    return pathArgumentsOf(command)?.root === "project";
+}
+/** Which of the positional argument indexes are paths, per the verb's spec. */
+function pathPositionalIndexes(positionals, indexes) {
+    switch (positionals) {
+        case "all":
+            return indexes;
+        case "after-first":
+            return indexes.slice(1);
+        case "none":
+            return [];
+    }
+}
+/** A positional word: before `--`, one not led by a dash; after it, every word. */
+function isOperand(arg, index, end) {
+    if (index < end)
+        return !arg.startsWith("-");
+    return index > end;
+}
+/**
+ * The verb's arguments (everything after the verb) with each path argument
+ * passed through `rebase`. Flags that do not take a path, words, and `--`
+ * itself are returned unchanged. After `--` every word is an operand: a path
+ * among them is rebased like any other positional, and a dash-led one is never
+ * mistaken for a path-valued flag.
+ */
+function rebasePathArgs(command, argv, rebase) {
+    const spec = pathArgumentsOf(command);
+    if (!spec)
+        return [...argv];
+    const end = argv.includes("--") ? argv.indexOf("--") : argv.length;
+    const positionalIndexes = argv.flatMap((a, i) => isOperand(a, i, end) ? [i] : []);
+    const pathPositionals = new Set(pathPositionalIndexes(spec.positionals, positionalIndexes));
+    return argv.map((arg, i) => {
+        if (pathPositionals.has(i))
+            return rebase(arg);
+        if (i >= end)
+            return arg;
+        const flag = spec.flags.find((f) => arg.startsWith(f));
+        return flag ? `${flag}${rebase(arg.slice(flag.length))}` : arg;
+    });
+}
 //# sourceMappingURL=cli-flag-check.js.map

package/dist/cli-main.d.ts

@@ -58,6 +58,8 @@ interface LintReport {
     mcpToolErrors: number;
     hookScriptIssues: number;
     hookScriptErrors: number;
+    handWrittenHookIssues: number;
+    handWrittenHookErrors: number;
     disallowedToolIssues: number;
     disallowedToolErrors: number;
     descriptionOverlapIssues: number;
@@ -68,8 +70,6 @@ interface LintReport {
     frontmatterValidErrors: number;
     mcpHookIssues: number;
     mcpHookErrors: number;
-    preferCompiledHookIssues: number;
-    preferCompiledHookErrors: number;
     lethalTrifectaIssues: number;
     lethalTrifectaErrors: number;
     skillResourceIssues: number;