vigiles 4.0.2 → 5.0.0

package/dist/integration.d.ts

@@ -1,13 +1,19 @@
 /**
  * `vigiles/integration` — the **deterministic, assembled-machine** tier.
  *
- * Re-exports everything in [`vigiles/unit`](./unit.ts) and adds the runners that
- * drive the real `claude` CLI against a **scripted mock model** plus structural
- * assembly: `runHarnessTest` / `withHarness` (real hooks fire, outcome
- * reproducible), `scriptModel` (the mock), and `loadPlugin` / `resolveHarness`
- * (the plugin loader). Capability contract: needs the **`claude` binary and
- * bubblewrap**, but **no API key and no network**. A `*.integration.test.ts`
- * imports from here.
+ * Re-exports everything in [`vigiles/unit`](./unit.ts) and adds the
+ * harness-agnostic runners for the assembled machine: `runHarnessTest` /
+ * `runHarness` (real hooks fire, outcome reproducible) plus the generic trace
+ * parsers and the sandbox policy. Capability contract: needs the **`claude`
+ * binary and bubblewrap**, but **no API key and no network**. A
+ * `*.integration.test.ts` imports from here.
+ *
+ * The Claude-Code **transport** — the scripted mock (`scriptModel`) and the
+ * plugin loader (`loadPlugin` / `resolveHarness`) — is harness-specific, so it is
+ * NOT re-exported here (this surface stays agnostic, enforced by the
+ * `agnostic-surface ⊄ adapter` boundary lint). Import it from
+ * [`vigiles/claude-code`](./claude-code.ts):
+ * `import { scriptModel, loadPlugin } from "vigiles/claude-code"`.
  *
  * Real **egress** is a CAPABILITY of this scope (the former `e2e` tier), not a
  * separate tier: `egressRoutes()` probes whether allowlisted egress can route,
@@ -17,8 +23,7 @@
  * `research/testing-api-design.md` Part 4.
  */
 export * from "./unit.js";
-export * from "./harness-test.js";
-export * from "./mock-model.js";
-export type { LoadedPlugin } from "./plugin-loader.js";
+export { runHarnessTest, runHarness, parseToolCalls, parseSubagents, parseResultEvent, parseOutput, parseHooks, decideSandbox, specTrusted, sandboxAvailable, } from "./harness-test.js";
+export type { HarnessTestSpec, Trace, SubagentTrace, HarnessTestResult, RunHarnessTestOptions, ModelTurn, ModelRequest, ToolCall, HookFire, HarnessTestDriver, SandboxMode, } from "./harness-test.js";
 export { egressRoutes } from "./run-hook.js";
 //# sourceMappingURL=integration.d.ts.map

package/dist/integration.js

@@ -14,17 +14,23 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.egressRoutes = void 0;
+exports.egressRoutes = exports.sandboxAvailable = exports.specTrusted = exports.decideSandbox = exports.parseHooks = exports.parseOutput = exports.parseResultEvent = exports.parseSubagents = exports.parseToolCalls = exports.runHarness = exports.runHarnessTest = void 0;
 /**
  * `vigiles/integration` — the **deterministic, assembled-machine** tier.
  *
- * Re-exports everything in [`vigiles/unit`](./unit.ts) and adds the runners that
- * drive the real `claude` CLI against a **scripted mock model** plus structural
- * assembly: `runHarnessTest` / `withHarness` (real hooks fire, outcome
- * reproducible), `scriptModel` (the mock), and `loadPlugin` / `resolveHarness`
- * (the plugin loader). Capability contract: needs the **`claude` binary and
- * bubblewrap**, but **no API key and no network**. A `*.integration.test.ts`
- * imports from here.
+ * Re-exports everything in [`vigiles/unit`](./unit.ts) and adds the
+ * harness-agnostic runners for the assembled machine: `runHarnessTest` /
+ * `runHarness` (real hooks fire, outcome reproducible) plus the generic trace
+ * parsers and the sandbox policy. Capability contract: needs the **`claude`
+ * binary and bubblewrap**, but **no API key and no network**. A
+ * `*.integration.test.ts` imports from here.
+ *
+ * The Claude-Code **transport** — the scripted mock (`scriptModel`) and the
+ * plugin loader (`loadPlugin` / `resolveHarness`) — is harness-specific, so it is
+ * NOT re-exported here (this surface stays agnostic, enforced by the
+ * `agnostic-surface ⊄ adapter` boundary lint). Import it from
+ * [`vigiles/claude-code`](./claude-code.ts):
+ * `import { scriptModel, loadPlugin } from "vigiles/claude-code"`.
  *
  * Real **egress** is a CAPABILITY of this scope (the former `e2e` tier), not a
  * separate tier: `egressRoutes()` probes whether allowlisted egress can route,
@@ -34,8 +40,19 @@ exports.egressRoutes = void 0;
  * `research/testing-api-design.md` Part 4.
  */
 __exportStar(require("./unit.js"), exports);
-__exportStar(require("./harness-test.js"), exports);
-__exportStar(require("./mock-model.js"), exports);
+// The harness-test tier — AGNOSTIC SURFACE ONLY (CC transport lives in
+// vigiles/claude-code; see the module doc above).
+var harness_test_js_1 = require("./harness-test.js");
+Object.defineProperty(exports, "runHarnessTest", { enumerable: true, get: function () { return harness_test_js_1.runHarnessTest; } });
+Object.defineProperty(exports, "runHarness", { enumerable: true, get: function () { return harness_test_js_1.runHarness; } });
+Object.defineProperty(exports, "parseToolCalls", { enumerable: true, get: function () { return harness_test_js_1.parseToolCalls; } });
+Object.defineProperty(exports, "parseSubagents", { enumerable: true, get: function () { return harness_test_js_1.parseSubagents; } });
+Object.defineProperty(exports, "parseResultEvent", { enumerable: true, get: function () { return harness_test_js_1.parseResultEvent; } });
+Object.defineProperty(exports, "parseOutput", { enumerable: true, get: function () { return harness_test_js_1.parseOutput; } });
+Object.defineProperty(exports, "parseHooks", { enumerable: true, get: function () { return harness_test_js_1.parseHooks; } });
+Object.defineProperty(exports, "decideSandbox", { enumerable: true, get: function () { return harness_test_js_1.decideSandbox; } });
+Object.defineProperty(exports, "specTrusted", { enumerable: true, get: function () { return harness_test_js_1.specTrusted; } });
+Object.defineProperty(exports, "sandboxAvailable", { enumerable: true, get: function () { return harness_test_js_1.sandboxAvailable; } });
 var run_hook_js_1 = require("./run-hook.js");
 Object.defineProperty(exports, "egressRoutes", { enumerable: true, get: function () { return run_hook_js_1.egressRoutes; } });
 //# sourceMappingURL=integration.js.map

package/dist/linting.d.ts

@@ -1,9 +1,10 @@
 /**
  * `vigiles/linting` — Pillar 1 entry point: the **linting layer** for instruction
- * files. Re-exports the spec builders/types and the compiler under one
- * concern-named import. The granular paths (`vigiles/spec`, `vigiles/compile`)
- * keep working; this just groups them so the import name matches the pillar.
+ * files. Re-exports the spec builders/types, the compiler, and the linter
+ * cross-referencing engine under one concern-named import. This is the canonical
+ * pillar-1 surface; the spec builders are also at the package root (`vigiles`).
  */
 export * from "./core/spec.js";
 export * from "./core/compile.js";
+export * from "./core/linters.js";
 //# sourceMappingURL=linting.d.ts.map

package/dist/linting.js

@@ -16,10 +16,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 /**
  * `vigiles/linting` — Pillar 1 entry point: the **linting layer** for instruction
- * files. Re-exports the spec builders/types and the compiler under one
- * concern-named import. The granular paths (`vigiles/spec`, `vigiles/compile`)
- * keep working; this just groups them so the import name matches the pillar.
+ * files. Re-exports the spec builders/types, the compiler, and the linter
+ * cross-referencing engine under one concern-named import. This is the canonical
+ * pillar-1 surface; the spec builders are also at the package root (`vigiles`).
  */
 __exportStar(require("./core/spec.js"), exports);
 __exportStar(require("./core/compile.js"), exports);
+__exportStar(require("./core/linters.js"), exports);
 //# sourceMappingURL=linting.js.map

package/dist/setup-plan.d.ts

@@ -44,6 +44,17 @@ export interface ParsedSetupArgs {
 export declare function parseSetupArgs(args: readonly string[]): ParsedSetupArgs;
 /** The non-interactive defaults: both pillars, CI, and the plugin. */
 export declare function defaultPlan(strict?: boolean): SetupPlan;
+/**
+ * Pure config-merge for what `vigiles init` writes to `.vigilesrc.json`: record
+ * the `harness` if absent, add strict rule severities if `--strict`, NEVER
+ * clobber an existing key. Returns the merged config, or `null` when nothing
+ * changed (so the IO layer skips the write). The IO (read/parse/write + the
+ * malformed-file guard) stays in cli.ts.
+ */
+export declare function mergeProjectConfig(existing: Record<string, unknown>, opts: {
+    harness: string | string[];
+    strict: boolean;
+}): Record<string, unknown> | null;
 /**
  * Whether to drop into interactive prompts: a human at a TTY who passed neither
  * `--yes` nor an explicit `--target`, and who hasn't already pinned every choice

package/dist/setup-plan.js

@@ -12,6 +12,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseSetupArgs = parseSetupArgs;
 exports.defaultPlan = defaultPlan;
+exports.mergeProjectConfig = mergeProjectConfig;
 exports.shouldPrompt = shouldPrompt;
 exports.planPluginInstall = planPluginInstall;
 exports.resolvePlan = resolvePlan;
@@ -52,6 +53,34 @@ function defaultPlan(strict = false) {
         force: false,
     };
 }
+/**
+ * Pure config-merge for what `vigiles init` writes to `.vigilesrc.json`: record
+ * the `harness` if absent, add strict rule severities if `--strict`, NEVER
+ * clobber an existing key. Returns the merged config, or `null` when nothing
+ * changed (so the IO layer skips the write). The IO (read/parse/write + the
+ * malformed-file guard) stays in cli.ts.
+ */
+function mergeProjectConfig(existing, opts) {
+    const config = { ...existing };
+    let changed = false;
+    if (config.harness === undefined) {
+        config.harness = opts.harness;
+        changed = true;
+    }
+    if (opts.strict) {
+        const rules = { ...config.rules };
+        // `require-skill-spec` is deprecated (skills can be hand-written), so --strict
+        // no longer promotes it; it tightens only `require-spec` (instruction files).
+        for (const r of ["require-spec"]) {
+            if (rules[r] === undefined) {
+                rules[r] = "error";
+                changed = true;
+            }
+        }
+        config.rules = rules;
+    }
+    return changed ? config : null;
+}
 /**
  * Whether to drop into interactive prompts: a human at a TTY who passed neither
  * `--yes` nor an explicit `--target`, and who hasn't already pinned every choice

package/dist/skill-harness.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Cross-harness skill-frontmatter verification (slice 3 of
+ * research/multi-harness-compile.md, the *verify* half).
+ *
+ * A skill's `SKILL.md` references are harness-agnostic; the one harness-specific
+ * surface is the frontmatter PROFILE. The `claude-code` profile emits CC-only
+ * keys (`disable-model-invocation`, `argument-hint`); the `minimal` profile
+ * (Codex, OpenCode) omits them. So a skill that sets those keys, in a repo that
+ * also targets a minimal-profile harness, has a silent semantic gap: the
+ * constraint the author expressed won't take effect there.
+ *
+ * This reports that gap. It is ASSUMPTION-FREE — the minimal profile *drops* the
+ * keys, so the warning states a fact about vigiles's own output, not a guess
+ * about another tool's parser tolerance.
+ */
+import type { SkillSpec } from "./core/spec.js";
+/** The Claude-Code-only frontmatter keys a skill spec would emit. */
+export declare function claudeOnlyFrontmatterKeys(spec: SkillSpec): string[];
+/**
+ * Warn for each declared harness whose `minimal` SKILL.md profile would DROP a
+ * skill's Claude-Code-only frontmatter. Empty when the skill uses no such keys or
+ * no declared harness is minimal-profile.
+ */
+export declare function skillFrontmatterDropWarnings(spec: SkillSpec, harnessNames: readonly string[]): string[];
+//# sourceMappingURL=skill-harness.d.ts.map

package/dist/skill-harness.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claudeOnlyFrontmatterKeys = claudeOnlyFrontmatterKeys;
+exports.skillFrontmatterDropWarnings = skillFrontmatterDropWarnings;
+const adapter_registry_js_1 = require("./adapter-registry.js");
+/** The Claude-Code-only frontmatter keys a skill spec would emit. */
+function claudeOnlyFrontmatterKeys(spec) {
+    const keys = [];
+    if (spec.disableModelInvocation !== undefined) {
+        keys.push("disable-model-invocation");
+    }
+    if (spec.argumentHint || (spec.inputs && spec.inputs.length > 0)) {
+        keys.push("argument-hint");
+    }
+    return keys;
+}
+/**
+ * Warn for each declared harness whose `minimal` SKILL.md profile would DROP a
+ * skill's Claude-Code-only frontmatter. Empty when the skill uses no such keys or
+ * no declared harness is minimal-profile.
+ */
+function skillFrontmatterDropWarnings(spec, harnessNames) {
+    const ccKeys = claudeOnlyFrontmatterKeys(spec);
+    if (ccKeys.length === 0)
+        return [];
+    const warnings = [];
+    const seen = new Set();
+    for (const name of harnessNames) {
+        const adapter = (0, adapter_registry_js_1.getAdapter)(name);
+        if (!adapter || seen.has(adapter.name))
+            continue;
+        seen.add(adapter.name);
+        if (adapter.dialect.skillFrontmatter === "minimal") {
+            const one = ccKeys.length === 1;
+            warnings.push(`skill "${spec.name}": ${ccKeys.join(", ")} ${one ? "is" : "are"} Claude-Code-only — declared harness "${adapter.name}" drops ${one ? "it" : "them"}.`);
+        }
+    }
+    return warnings;
+}
+//# sourceMappingURL=skill-harness.js.map

package/dist/test-coverage.d.ts

@@ -15,10 +15,11 @@
  *      surface by PATH (`skills/foo`, `hooks/pre-edit.sh`) or NAMESPACE
  *      (`vigiles:foo`). Not bare-name — too fuzzy.
  *
- * Warning-by-default (a nudge, not a gate). User-invoked skills
- * (`disable-model-invocation: true`) can't auto-trigger, so they're exempt by
- * default; flip `includeUserInvokedSkills` to demand an outcome test for them.
- * Per-surface opt-out: a `vigiles:ignore-test` marker in the surface file.
+ * Warning-by-default (a nudge, not a gate). EVERY skill, agent, and hook is held
+ * to the requirement — invocation mode does NOT exempt anything (a command-only
+ * skill still DOES something when invoked, and that behaviour is worth a test).
+ * The only opt-out is explicit: a `vigiles:ignore-test` marker in the surface
+ * file, which is reported as `exempt` so the skip is visible, never silent.
  */
 export type SurfaceKind = "skill" | "agent" | "hook";
 export interface Surface {
@@ -29,15 +30,15 @@ export interface Surface {
     readonly name: string;
     /** Substrings a test may reference to "cover" this surface (path / namespace). */
     readonly tokens: readonly string[];
-    /** True for skills with `disable-model-invocation: true`. */
-    readonly userInvoked: boolean;
+    /** Explicitly opted out of the test requirement via `vigiles:ignore-test`. */
+    readonly ignored: boolean;
 }
 export interface UntestedReport {
     /** Total surfaces considered (after exemptions). */
     readonly total: number;
     readonly covered: readonly Surface[];
     readonly untested: readonly Surface[];
-    /** Surfaces skipped (user-invoked skills, `vigiles:ignore-test`). */
+    /** Surfaces explicitly opted out via `vigiles:ignore-test`. */
     readonly exempt: number;
 }
 export interface TestCoverageOptions {
@@ -49,8 +50,6 @@ export interface TestCoverageOptions {
     readonly agents?: boolean;
     /** Scan hook scripts referenced from plugin.json / settings.json. Default true. */
     readonly hooks?: boolean;
-    /** Require a test for user-invoked (disable-model-invocation) skills. Default false. */
-    readonly includeUserInvokedSkills?: boolean;
     /** Globs of test files that count as coverage. */
     readonly testGlobs?: readonly string[];
     /** Extra ignore globs (added to node_modules/dist/.git/.vigiles). */
@@ -59,9 +58,9 @@ export interface TestCoverageOptions {
 /**
  * Find harness surfaces (skills / agents / hooks) that no test or eval covers.
  * A surface is covered by a colocated `*.{harness,eval}.mjs` OR any discovered
- * test that references its path/namespace. User-invoked skills are exempt unless
- * `includeUserInvokedSkills` is set; any surface with a `vigiles:ignore-test`
- * marker is exempt.
+ * test that references its path/namespace. EVERY skill, agent, and hook is held
+ * to this — the only exemption is an explicit `vigiles:ignore-test` marker in the
+ * surface file (counted as `exempt`).
  */
 export declare function findUntestedSurfaces(options?: TestCoverageOptions): UntestedReport;
 /** Suggested colocated test path for an untested surface (shown in the warning). */

package/dist/test-coverage.js

@@ -16,10 +16,11 @@
  *      surface by PATH (`skills/foo`, `hooks/pre-edit.sh`) or NAMESPACE
  *      (`vigiles:foo`). Not bare-name — too fuzzy.
  *
- * Warning-by-default (a nudge, not a gate). User-invoked skills
- * (`disable-model-invocation: true`) can't auto-trigger, so they're exempt by
- * default; flip `includeUserInvokedSkills` to demand an outcome test for them.
- * Per-surface opt-out: a `vigiles:ignore-test` marker in the surface file.
+ * Warning-by-default (a nudge, not a gate). EVERY skill, agent, and hook is held
+ * to the requirement — invocation mode does NOT exempt anything (a command-only
+ * skill still DOES something when invoked, and that behaviour is worth a test).
+ * The only opt-out is explicit: a `vigiles:ignore-test` marker in the surface
+ * file, which is reported as `exempt` so the skip is visible, never silent.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.findUntestedSurfaces = findUntestedSurfaces;
@@ -57,10 +58,6 @@ function read(path) {
         return "";
     }
 }
-/** A SKILL.md is user-invoked when its frontmatter sets disable-model-invocation. */
-function isUserInvoked(content) {
-    return /^\s*disable-model-invocation:\s*true\s*$/m.test(content);
-}
 function discoverSkills(basePath, ignore) {
     const out = [];
     const found = (0, glob_1.globSync)(["skills/*/SKILL.md", ".claude/skills/*/SKILL.md"], {
@@ -70,14 +67,12 @@ function discoverSkills(basePath, ignore) {
     for (const path of found.sort()) {
         const name = (0, node_path_1.basename)((0, node_path_1.dirname)(path));
         const content = read((0, node_path_1.join)(basePath, path));
-        if (content.includes(IGNORE_MARKER))
-            continue;
         out.push({
             kind: "skill",
             path,
             name,
             tokens: [`skills/${name}`, `:${name}`],
-            userInvoked: isUserInvoked(content),
+            ignored: content.includes(IGNORE_MARKER),
         });
     }
     return out;
@@ -92,8 +87,6 @@ function discoverAgents(basePath, ignore) {
         if (path.endsWith(".spec.ts"))
             continue;
         const content = read((0, node_path_1.join)(basePath, path));
-        if (content.includes(IGNORE_MARKER))
-            continue;
         const name = (0, node_path_1.basename)(path, ".md");
         const dir = (0, node_path_1.dirname)(path);
         out.push({
@@ -101,7 +94,7 @@ function discoverAgents(basePath, ignore) {
             path,
             name,
             tokens: [`${dir}/${name}`],
-            userInvoked: false,
+            ignored: content.includes(IGNORE_MARKER),
         });
     }
     return out;
@@ -147,7 +140,7 @@ function discoverHooks(basePath) {
         path,
         name: (0, node_path_1.basename)(path).replace(/\.[^.]+$/, ""),
         tokens: [path],
-        userInvoked: false,
+        ignored: false,
     }));
 }
 function discoverTests(basePath, globs, ignore) {
@@ -186,9 +179,9 @@ function isCovered(surface, tests) {
 /**
  * Find harness surfaces (skills / agents / hooks) that no test or eval covers.
  * A surface is covered by a colocated `*.{harness,eval}.mjs` OR any discovered
- * test that references its path/namespace. User-invoked skills are exempt unless
- * `includeUserInvokedSkills` is set; any surface with a `vigiles:ignore-test`
- * marker is exempt.
+ * test that references its path/namespace. EVERY skill, agent, and hook is held
+ * to this — the only exemption is an explicit `vigiles:ignore-test` marker in the
+ * surface file (counted as `exempt`).
  */
 function findUntestedSurfaces(options = {}) {
     const basePath = options.basePath ?? process.cwd();
@@ -201,7 +194,9 @@ function findUntestedSurfaces(options = {}) {
         surfaces.push(...discoverAgents(basePath, ignore));
     if (options.hooks !== false)
         surfaces.push(...discoverHooks(basePath));
-    const considered = surfaces.filter((s) => !s.userInvoked || s.kind !== "skill" || options.includeUserInvokedSkills);
+    // Every skill/agent/hook is held to the requirement — only an explicit
+    // `vigiles:ignore-test` marker exempts a surface (a visible, deliberate skip).
+    const considered = surfaces.filter((s) => !s.ignored);
     const exempt = surfaces.length - considered.length;
     const tests = discoverTests(basePath, globs, ignore);
     const covered = [];

package/dist/testing.d.ts

@@ -11,9 +11,12 @@
  * `research/adapter-api-design.md`.
  */
 export * from "./run-hook.js";
-export * from "./harness-test.js";
 export * from "./eval.js";
 export * from "./harness-assert.js";
 export * from "./check.js";
 export { hookFired } from "./check.js";
+export { judge } from "./judge.js";
+export * from "./tool-stub.js";
+export { runHarnessTest, runHarness, parseToolCalls, parseSubagents, parseResultEvent, parseOutput, parseHooks, decideSandbox, specTrusted, sandboxAvailable, } from "./harness-test.js";
+export type { HarnessTestSpec, Trace, SubagentTrace, HarnessTestResult, RunHarnessTestOptions, ModelTurn, ModelRequest, ToolCall, HookFire, HarnessTestDriver, SandboxMode, } from "./harness-test.js";
 //# sourceMappingURL=testing.d.ts.map

package/dist/testing.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hookFired = void 0;
+exports.sandboxAvailable = exports.specTrusted = exports.decideSandbox = exports.parseHooks = exports.parseOutput = exports.parseResultEvent = exports.parseSubagents = exports.parseToolCalls = exports.runHarness = exports.runHarnessTest = exports.judge = exports.hookFired = void 0;
 /**
  * `vigiles/testing` — Pillar 2 entry point: the **harness-testing** API. Re-exports
  * the three tiers — `runHook` (unit), `runHarnessTest` (deterministic), `runEval`
@@ -28,7 +28,6 @@ exports.hookFired = void 0;
  * `research/adapter-api-design.md`.
  */
 __exportStar(require("./run-hook.js"), exports);
-__exportStar(require("./harness-test.js"), exports);
 __exportStar(require("./eval.js"), exports);
 __exportStar(require("./harness-assert.js"), exports);
 // The declarative check vocabulary is now first-class at the front door. Its
@@ -37,4 +36,27 @@ __exportStar(require("./harness-assert.js"), exports);
 __exportStar(require("./check.js"), exports);
 var check_js_1 = require("./check.js");
 Object.defineProperty(exports, "hookFired", { enumerable: true, get: function () { return check_js_1.hookFired; } });
+// The model-graded judge (agnostic — grades text against a rubric). Public here
+// now that `vigiles/judge` is no longer a standalone subpath.
+var judge_js_1 = require("./judge.js");
+Object.defineProperty(exports, "judge", { enumerable: true, get: function () { return judge_js_1.judge; } });
+// Tool stubs on PATH (rung R2): shadow a CLI tool with a recorded canned result.
+__exportStar(require("./tool-stub.js"), exports);
+// The harness-test tier — AGNOSTIC SURFACE ONLY. The Claude-Code transport
+// (`scriptModel`, `claudeCodeDriver`, `buildClaudeArgs`, `parseClaudeRun`,
+// `claudeAvailable`, `loadPlugin`, `resolveHarness`) is deliberately NOT
+// re-exported here, so `vigiles/testing` stays harness-agnostic — import those
+// from `vigiles/claude-code` (or your harness's package). See
+// `research/code-adapter-architecture.md`.
+var harness_test_js_1 = require("./harness-test.js");
+Object.defineProperty(exports, "runHarnessTest", { enumerable: true, get: function () { return harness_test_js_1.runHarnessTest; } });
+Object.defineProperty(exports, "runHarness", { enumerable: true, get: function () { return harness_test_js_1.runHarness; } });
+Object.defineProperty(exports, "parseToolCalls", { enumerable: true, get: function () { return harness_test_js_1.parseToolCalls; } });
+Object.defineProperty(exports, "parseSubagents", { enumerable: true, get: function () { return harness_test_js_1.parseSubagents; } });
+Object.defineProperty(exports, "parseResultEvent", { enumerable: true, get: function () { return harness_test_js_1.parseResultEvent; } });
+Object.defineProperty(exports, "parseOutput", { enumerable: true, get: function () { return harness_test_js_1.parseOutput; } });
+Object.defineProperty(exports, "parseHooks", { enumerable: true, get: function () { return harness_test_js_1.parseHooks; } });
+Object.defineProperty(exports, "decideSandbox", { enumerable: true, get: function () { return harness_test_js_1.decideSandbox; } });
+Object.defineProperty(exports, "specTrusted", { enumerable: true, get: function () { return harness_test_js_1.specTrusted; } });
+Object.defineProperty(exports, "sandboxAvailable", { enumerable: true, get: function () { return harness_test_js_1.sandboxAvailable; } });
 //# sourceMappingURL=testing.js.map

package/dist/tool-intercept.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Tool interception — the eval-tier half of the tool-call spy.
+ *
+ * The eval tier drives the REAL model, so the agent's tool decisions are genuine.
+ * But letting a side-effecting tool actually run — a paid image API, `git push`,
+ * spawning a paid subagent — makes the eval expensive and dangerous. An
+ * **intercept** lets the model emit the `tool_use` (so its arguments are captured
+ * in the `Trace`, where `toolWith` / `notTool` assert on them) while a PreToolUse
+ * hook **denies the real execution** with a block message. The run stays cheap and
+ * side-effect-free, but the agent's *decision* — the thing a completion grader
+ * can't see — is fully observable.
+ *
+ * This module is the PURE decision + wiring core, mirroring the agent-contract
+ * rail (`src/adapters/claude-code/agent-runtime.ts`):
+ *
+ * - `decideIntercept` — does this call get intercepted, and with what deny reason;
+ * - `buildInterceptSettings` — the PreToolUse hook fragment routing matched tools
+ *   through `vigiles intercept-tool-hook`;
+ * - `serializeIntercepts` / `parseIntercepts` — the env round-trip (incl. RegExp
+ *   matchers) the hook subprocess reads back.
+ *
+ * The hook denies via exit 2 + a stderr message (the same block mechanism the
+ * agent rail uses). IMPORTANT — Claude Code surfaces that to the model as a
+ * *blocked* call: the tool is intercepted (prevented), NOT executed, and the model
+ * is NOT handed a faked successful return. So this is **intercept-and-prevent +
+ * observe the attempt**, not a faithful tool mock: it's sound for "did the agent
+ * ATTEMPT X / call it with these args / push to the wrong branch" (first-attempt
+ * questions, where what happens after doesn't matter), and unsound for "stub the
+ * tool and let the trajectory continue as if it succeeded" (the model is told it
+ * was blocked, so a multi-step flow that needs the real result will derail). CC
+ * exposes no "skip execution but return this as success" primitive for arbitrary
+ * tools, so deny+reason is the closest available — with that ceiling.
+ */
+import { type ArgMatcher } from "./arg-match.js";
+/** Env var the spawned `vigiles intercept-tool-hook` reads its intercept list from. */
+export declare const INTERCEPT_TOOLS_ENV = "VIGILES_INTERCEPT_TOOLS";
+/** Declare a tool to intercept: deny its real execution with a block message. */
+export interface ToolIntercept {
+    /** The tool to intercept (e.g. `"Bash"`, `"WebFetch"`, `"Task"`, `"mcp__img__gen"`). */
+    readonly tool: string;
+    /**
+     * Only intercept calls whose `input` matches (so you can intercept `git push`
+     * while letting other `Bash` through). Omit to intercept every call to `tool`.
+     */
+    readonly when?: ArgMatcher;
+    /**
+     * The denial reason shown to the model when the call is intercepted. This is a
+     * *block* message: the call is intercepted (prevented), NOT executed — so phrase
+     * it as "this was prevented; don't retry", not "here's your result".
+     * Defaults to {@link DEFAULT_INTERCEPT_REASON}.
+     */
+    readonly denyReason?: string;
+}
+/** The default denial reason — honest that the call was intercepted (prevented), NOT executed. */
+export declare const DEFAULT_INTERCEPT_REASON: string;
+/** The decision for one tool call: intercept it (deny + reason), or let it run. */
+export type InterceptDecision = {
+    readonly intercept: true;
+    readonly denyReason: string;
+} | {
+    readonly intercept: false;
+};
+/**
+ * Decide whether a tool call should be intercepted. Returns the first matching
+ * intercept's denial reason (preventing real execution), or `{ intercept: false }`
+ * to let the call run for real. Pure — the same logic `vigiles intercept-tool-hook`
+ * runs.
+ */
+export declare function decideIntercept(toolName: string, input: unknown, intercepts: readonly ToolIntercept[]): InterceptDecision;
+/**
+ * Decide from a raw PreToolUse event JSON (the hook's stdin). Parses `tool_name`
+ * + `tool_input`, then defers to {@link decideIntercept}. Malformed input or a
+ * missing tool name is a no-op (let it run) — never fail closed on a parse error.
+ */
+export declare function interceptHookDecision(rawEvent: string, intercepts: readonly ToolIntercept[]): InterceptDecision;
+/** A `.claude/settings.json` fragment registering the intercept PreToolUse hook. */
+export interface InterceptSettings {
+    readonly hooks: {
+        readonly PreToolUse: readonly unknown[];
+    };
+}
+/**
+ * Build the PreToolUse hook fragment that routes every intercepted tool through
+ * `vigiles intercept-tool-hook`. The `matcher` is a CC tool-name regex over the
+ * union of intercepted tool names (each escaped), so unrelated tools are never
+ * intercepted. Merge the result into an arm's `settings`; the intercept list
+ * itself travels in the {@link INTERCEPT_TOOLS_ENV} env var (see
+ * {@link serializeIntercepts}).
+ */
+export declare function buildInterceptSettings(intercepts: readonly ToolIntercept[], opts?: {
+    command?: string;
+}): InterceptSettings;
+/**
+ * Serialize an intercept list to a JSON string for {@link INTERCEPT_TOOLS_ENV}.
+ * RegExp matchers are encoded as `{ re, flags }` so they round-trip exactly (a
+ * plain `JSON.stringify` would drop them to `{}`).
+ */
+export declare function serializeIntercepts(intercepts: readonly ToolIntercept[]): string;
+/** Parse an intercept list from the env JSON (tolerant — a bad entry is skipped). */
+export declare function parseIntercepts(json: string): ToolIntercept[];
+//# sourceMappingURL=tool-intercept.d.ts.map