vigiles 38.2.0 → 39.1.0

package/action.yml

@@ -36,6 +36,16 @@ inputs:
     description: "Only check that linter rules exist; skip config-enabled checks (maps to the CLI's --catalog-only). 'true' or 'false'."
     required: false
     default: "false"
+  preset:
+    description: >
+      Add a preset for this run, on top of the repo's .vigilesrc.json (maps to
+      the CLI's --preset=; lint only). The names are the ones `extends` takes,
+      with or without the `vigiles:` prefix: 'experimental' turns on the checks
+      not yet measured reliable enough to grade on, at warn — so they report
+      and never fail the run. Comma-separate several. Empty (the default) adds
+      none.
+    required: false
+    default: ""
   working-directory:
     description: "Directory to run vigiles in."
     required: false
@@ -80,6 +90,7 @@ runs:
         VIGILES_VERSION: ${{ inputs.version }}
         VIGILES_MAX_RULES: ${{ inputs.max-rules }}
         VIGILES_CATALOG_ONLY: ${{ inputs.catalog-only }}
+        VIGILES_PRESET: ${{ inputs.preset }}
         VIGILES_ACTION_PATH: ${{ github.action_path }}
         VIGILES_COMMENT: ${{ inputs.comment }}
         VIGILES_CAPABILITY_DIFF: ${{ inputs.capability-diff }}
@@ -114,6 +125,13 @@ runs:
           args+=("--catalog-only")
         fi
 
+        # The CLI validates the name (an unknown preset exits 2 naming the
+        # valid ones), so the value is passed through as written.
+        preset="${VIGILES_PRESET:-}"
+        if [[ -n "${preset// /}" ]]; then
+          args+=("--preset=${preset// /}")
+        fi
+
         # Resolve the runner. 'local' runs the action's own build (CI
         # dogfood via `uses: ./`); an explicit version runs the published npm
         # package at that version. EMPTY (the default) runs the vigiles this

package/dist/adapters/claude-code/event-capability.js

@@ -1,21 +1,35 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.claudeCodeEventCapabilities = void 0;
+/*
+ * `halt` (doc, § JSON output, read 2026-10-12): `continue` is a universal field
+ * — "If `false`, Claude stops processing entirely after the hook runs" — and
+ * "Every event accepts them, but some events discard them [...]. Each event's
+ * section says so." The six rows that carry `halt` have no such sentence in
+ * their sections (and § JSON output names PreToolUse and PostToolUse: "the stop
+ * applies even when the tool call fails"). § PreCompact and § Notification
+ * each say they discard `continue`; SessionEnd has no turn left to stop.
+ * https://code.claude.com/docs/en/hooks
+ */
 exports.claudeCodeEventCapabilities = {
     capturedFrom: "code.claude.com/docs/en/hooks (claude-code 2.1.273) + inject/veto measured 2026-09-16 headless",
     events: {
         // doc: SessionStart context is prepended to the session. MEASURED 2026-09-16:
         // inject lands; exit 2 is ignored entirely (it is in noEffectHookEvents).
+        // doc (§ Exit code 0, read 2026-10-11): plain stdout is context here — "The
+        // exceptions are `UserPromptSubmit`, `UserPromptExpansion`, `SessionStart`,
+        // and `PostModelSwitch`, where Claude Code adds plain-text stdout as context".
         SessionStart: {
             carries: "session",
-            honours: ["inject"],
+            honours: ["inject", "stdout-context", "halt"],
             matcher: false,
             denyShape: "exit-code",
         },
-        // doc: exit 2 blocks the prompt and erases it; stdout becomes context.
+        // doc: exit 2 blocks the prompt and erases it; plain stdout becomes context
+        // (the same § Exit code 0 sentence as SessionStart).
         UserPromptSubmit: {
             carries: "prompt",
-            honours: ["veto", "inject"],
+            honours: ["veto", "inject", "stdout-context", "halt"],
             matcher: false,
             denyShape: "exit-code",
         },
@@ -26,16 +40,18 @@ exports.claudeCodeEventCapabilities = {
         // assumption nobody had run.
         PreToolUse: {
             carries: "tool",
-            honours: ["veto", "ask", "inject"],
+            honours: ["veto", "ask", "inject", "halt"],
             matcher: true,
             denyShape: "permission-decision",
         },
         // doc: exit 2 feeds stderr back to the MODEL but the tool has already run —
-        // feedback, never a veto. This distinction is why `hook-block-ineffective`
+        // feedback, never a veto. NOT `stdout-context`, and NOT stderr at exit 0:
+        // "Claude never sees stderr from a hook that exits 0" (§ Exit code 0) — the
+        // channel a downstream KB linter used for weeks, delivering nothing. This distinction is why `hook-block-ineffective`
         // does not flag PostToolUse and would cry wolf if it did.
         PostToolUse: {
             carries: "tool",
-            honours: ["feedback", "inject"],
+            honours: ["feedback", "inject", "halt"],
             matcher: true,
             denyShape: "exit-code",
         },
@@ -43,7 +59,7 @@ exports.claudeCodeEventCapabilities = {
         // shape). MEASURED 2026-09-16: inject lands too.
         Stop: {
             carries: "stop",
-            honours: ["veto", "inject"],
+            honours: ["veto", "inject", "halt"],
             matcher: false,
             denyShape: "exit-code",
         },
@@ -51,7 +67,7 @@ exports.claudeCodeEventCapabilities = {
         // it was not measured, and Stop's behaviour is not evidence about it.
         SubagentStop: {
             carries: "stop",
-            honours: ["veto"],
+            honours: ["veto", "halt"],
             matcher: false,
             denyShape: "exit-code",
         },

package/dist/adapters/claude-code/hook-protocol.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.claudeCodeHookProtocol = void 0;
 const hook_condition_js_1 = require("./hook-condition.js");
 const hook_install_js_1 = require("../../hook-install.js");
+const layout_js_1 = require("./layout.js");
 exports.claudeCodeHookProtocol = {
     name: "claude-code",
     blockExitCode: 2,
@@ -55,7 +56,7 @@ exports.claudeCodeHookProtocol = {
     // step the core cannot take: `CompiledHooks` is the application layer's type,
     // and a core port may not name it.
     mergeRegistrations(existing, compiled, managedBy) {
-        return (0, hook_install_js_1.mergeHooksJson)(existing, compiled, managedBy);
+        return (0, hook_install_js_1.mergeHooksJson)(existing, compiled, managedBy, layout_js_1.claudeCodeLayout.projectRootTokens ?? []);
     },
 };
 //# sourceMappingURL=hook-protocol.js.map

package/dist/adapters/codex/hook-protocol.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.codexHookProtocol = void 0;
 const hook_install_js_1 = require("../../hook-install.js");
+const layout_js_1 = require("./layout.js");
 exports.codexHookProtocol = {
     name: "codex",
     blockExitCode: 2,
@@ -35,7 +36,7 @@ exports.codexHookProtocol = {
         return { hooks: { [on]: [entry] } };
     },
     mergeRegistrations(existing, compiled, managedBy) {
-        return (0, hook_install_js_1.mergeHooksToml)(existing, compiled, managedBy);
+        return (0, hook_install_js_1.mergeHooksToml)(existing, compiled, managedBy, layout_js_1.codexLayout.projectRootTokens ?? []);
     },
 };
 //# sourceMappingURL=hook-protocol.js.map

package/dist/audit-report.d.ts

@@ -22,6 +22,7 @@ import type { RuleInventoryItem } from "./rule-inventory.js";
 import type { RuleRouting } from "./rule-routing.js";
 import type { EvidenceCounts } from "./coverage-evidence.js";
 import type { DeprecatedKeyFilesFinding } from "./deprecated-key-files.js";
+import { type FilteredScan, type UngradedGroup } from "./core/apply-rules.js";
 /**
  * The current schema version. Bump only on a BREAKING change to the shape.
  * v2 (2026-07-15): the rule-map `mechanism` enum value for an unrouted rule
@@ -139,6 +140,16 @@ export interface AuditReport {
      * uses the field. Additive/optional — schema version unchanged.
      */
     readonly deprecatedKeyFiles?: readonly DeprecatedKeyFilesFinding[];
+    /**
+     * The UNGRADED rule groups — checks vigiles ships but has not measured as
+     * reliable enough to grade you on. One block per group with a rule this run
+     * turned on (a preset, `--preset=`, or the rule in `rules`), headed by the
+     * group's own label, each rule listed even when it found nothing; absent
+     * when none is on. NEVER scored: `score`, `verdict` and `recommendations`
+     * are computed from the graded view, without these. Additive/optional —
+     * schema version unchanged.
+     */
+    readonly ungraded?: readonly UngradedGroup[];
     /**
      * The adoption preview — "what would vigiles catch in your repo?" Present only
      * when the model-gated tier ran (behind consent); a deterministic read omits it.
@@ -208,7 +219,9 @@ export interface BuildAuditReportOptions extends AuditScoreOptions {
  * The CLI attaches `meta.generatedAt` when it writes the JSON artifact; the
  * HTML-embedded form omits it so the rendered file stays deterministic.
  */
-export declare function buildAuditReport(report: ScanReport, opts: BuildAuditReportOptions): AuditReport;
+export declare function buildAuditReport(
+/** Minted by `applyRules`: an off rule's findings are already gone. */
+report: FilteredScan<ScanReport>, opts: BuildAuditReportOptions): AuditReport;
 /**
  * The versioned envelope for a `audit --json` run over MULTIPLE plugins (a
  * marketplace expanded into its members, or several dirs) — the leaderboard.

package/dist/audit-report.js

@@ -20,6 +20,7 @@ exports.buildMarketplaceReport = buildMarketplaceReport;
 const audit_score_js_1 = require("./audit-score.js");
 const optimize_js_1 = require("./optimize.js");
 const audit_verdict_js_1 = require("./audit-verdict.js");
+const apply_rules_js_1 = require("./core/apply-rules.js");
 /**
  * The current schema version. Bump only on a BREAKING change to the shape.
  * v2 (2026-07-15): the rule-map `mechanism` enum value for an unrouted rule
@@ -74,9 +75,13 @@ function inventoryOf(report) {
 function outputStylesField(n) {
     return n === undefined || n === 0 ? {} : { outputStyles: n };
 }
-/** The scan's concrete finding lists, each present only when non-empty. */
+/**
+ * The scan's concrete finding lists, each present only when non-empty — and the
+ * ungraded groups' blocks, present only when some rule of one is on.
+ */
 function scanFindingLists(report) {
     return {
+        ...(report.ungraded.length > 0 ? { ungraded: report.ungraded } : {}),
         ...(report.danglingRefs.length
             ? { brokenReferences: report.danglingRefs }
             : {}),
@@ -85,16 +90,27 @@ function scanFindingLists(report) {
             : {}),
     };
 }
+/**
+ * The graded half of the report — score, verdict, fixes — read off the GRADED
+ * view (`gradedView`), so an ungraded group's findings can never move it.
+ */
+function gradedPart(report, opts) {
+    const graded = (0, apply_rules_js_1.gradedView)(report);
+    const score = (0, audit_score_js_1.auditScore)(graded, { firingMeasured: opts.firingMeasured });
+    const recommendations = (0, optimize_js_1.optimize)(graded).recommendations;
+    const verdict = (0, audit_verdict_js_1.computeVerdict)({ report: graded, score, recommendations });
+    return { score, verdict, recommendations };
+}
 /**
  * Assemble the versioned {@link AuditReport} from a scan report — pure, no clock.
  * The CLI attaches `meta.generatedAt` when it writes the JSON artifact; the
  * HTML-embedded form omits it so the rendered file stays deterministic.
  */
-function buildAuditReport(report, opts) {
+function buildAuditReport(
+/** Minted by `applyRules`: an off rule's findings are already gone. */
+report, opts) {
     const adoptable = buildAdoptable(opts.adoptableSurfaces);
-    const score = (0, audit_score_js_1.auditScore)(report, { firingMeasured: opts.firingMeasured });
-    const recommendations = (0, optimize_js_1.optimize)(report).recommendations;
-    const verdict = (0, audit_verdict_js_1.computeVerdict)({ report, score, recommendations });
+    const { score, verdict, recommendations } = gradedPart(report, opts);
     return {
         meta: {
             schemaVersion: exports.AUDIT_SCHEMA_VERSION,