vigiles 9.1.0 → 11.0.0

package/dist/scan.js

@@ -31,12 +31,20 @@ const plugin_loader_js_2 = require("./plugin-loader.js");
 const tool_contract_js_1 = require("./core/tool-contract.js");
 const hook_events_js_1 = require("./core/hook-events.js");
 const mcp_config_js_1 = require("./core/mcp-config.js");
+const hook_normalize_js_1 = require("./core/hook-normalize.js");
 const linters_js_1 = require("./core/linters.js");
 const frontmatter_read_js_1 = require("./core/frontmatter-read.js");
 const description_overlap_js_1 = require("./core/description-overlap.js");
 const mcp_tool_js_1 = require("./core/mcp-tool.js");
 const mcp_js_1 = require("./core/mcp.js");
 const mcp_hook_js_1 = require("./core/mcp-hook.js");
+const lethal_trifecta_js_1 = require("./core/lethal-trifecta.js");
+const skill_resources_js_1 = require("./core/skill-resources.js");
+const skill_missing_fence_js_1 = require("./core/skill-missing-fence.js");
+const plugin_dir_layout_js_1 = require("./core/plugin-dir-layout.js");
+const delegation_trifecta_js_1 = require("./core/delegation-trifecta.js");
+const hook_block_ineffective_js_1 = require("./core/hook-block-ineffective.js");
+const hook_matcher_js_1 = require("./core/hook-matcher.js");
 const agent_runtime_js_1 = require("./adapters/claude-code/agent-runtime.js");
 const test_coverage_js_1 = require("./test-coverage.js");
 const effects_js_1 = require("./core/effects.js");
@@ -69,14 +77,24 @@ function makeClassifier(layout) {
     const skillRe = skill ? new RegExp(`${skill}[^/]+/SKILL\\.md$`) : null;
     const agentRe = agent ? new RegExp(`${agent}[^/]+\\.md$`) : null;
     const commandRe = command ? new RegExp(`${command}.+\\.md$`) : null;
-    // A subagent lives at the plugin's TOP-LEVEL `agents/` dir, never recursively
-    // under a skill (`skills/<x>/agents/`). Those nested files are skill-internal
-    // worker docs (e.g. Anthropic's own skill-creator), NOT dispatchable Claude
-    // Code subagents — flagging them is a false positive. The agent dir nested
-    // under the skill dir is excluded; a genuine top-level `agents/foo.md` still
-    // matches. See scan.test.ts for the regression.
-    const nestedAgentRe = layout.skillDir && layout.agentDir
-        ? new RegExp(`(?:^|/)${escapeRe(layout.skillDir)}/.+/${escapeRe(layout.agentDir)}/`)
+    // A subagent lives at the plugin's TOP-LEVEL `agents/` dir (e.g. `agents/foo.md`
+    // or `.claude/agents/foo.md`), never recursively under ANOTHER surface dir. Two
+    // real-world nesting traps are excluded as false positives:
+    //   - `skills/<x>/agents/…` — skill-internal worker docs (Anthropic's skill-creator)
+    //   - `commands/agents/…`   — a COMMAND namespaced `/agents:…` (ruvnet/claude-flow),
+    //     incl. a `README.md`; these are commands, not dispatchable subagents.
+    // Flagging either as a subagent missing frontmatter is a false positive (it
+    // mis-graded a real plugin F). A genuine top-level `agents/foo.md` still
+    // matches. Both excluded dirs are read from the layout (adapter-agnostic). See
+    // scan.test.ts for the regressions.
+    const nestedUnder = [
+        layout.skillDir &&
+            `${escapeRe(layout.skillDir)}/.+/${escapeRe(layout.agentDir)}/`,
+        layout.commandDir &&
+            `${escapeRe(layout.commandDir)}/(?:.+/)?${escapeRe(layout.agentDir)}/`,
+    ].filter((x) => Boolean(x));
+    const nestedAgentRe = layout.agentDir && nestedUnder.length
+        ? new RegExp(`(?:^|/)(?:${nestedUnder.join("|")})`)
         : null;
     const isAgent = (f) => (agentRe?.test(f) ?? false) &&
         !f.endsWith(".spec.ts") &&
@@ -165,7 +183,27 @@ function firstBodyParagraph(md) {
     }
     return para.join(" ").trim() || undefined;
 }
-function scanSkills(files, cls) {
+/** The body of a SKILL.md with the leading `---` frontmatter block stripped. */
+function skillBody(md) {
+    return md.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, "");
+}
+/**
+ * The on-disk path for a materialized file key. `loadPlugin` prefixes each
+ * surface file with the layout's `materializeRoot` (e.g. `.claude/`), but the file
+ * lives on disk WITHOUT that prefix (under the real surface dir), so a
+ * bundled-resource existence check must strip it back off. Mirrors how
+ * `resolveScript` resolves a hook path against the real plugin root.
+ */
+function onDiskPath(materializedKey, materializeRoot) {
+    if (!materializeRoot)
+        return materializedKey;
+    const prefix = `${materializeRoot}/`;
+    return materializedKey.startsWith(prefix)
+        ? materializedKey.slice(prefix.length)
+        : materializedKey;
+}
+function scanSkills(files, cls, ctx) {
+    const { root, materializeRoot, dialect } = ctx;
     const out = [];
     for (const [path, md] of Object.entries(files)) {
         if (!cls.isSkill(path))
@@ -176,13 +214,35 @@ function scanSkills(files, cls) {
         // NEITHER exists is the skill genuinely undescribed (can't be selected). The
         // explicit-frontmatter best-practice is the separate `skill-frontmatter` rule.
         const effectiveDesc = fm.description ?? firstBodyParagraph(md);
+        const userInvoked = /^\s*disable-model-invocation:\s*true\s*$/m.test(md);
+        // Bundled-resource refs resolve against the skill's OWN dir (resources ship
+        // beside the SKILL.md), built from the plugin root + the file's ON-DISK dir
+        // (the materialize-root prefix the loader added is stripped back off).
+        const skillDir = (0, node_path_1.resolve)(root, (0, node_path_1.dirname)(onDiskPath(path, materializeRoot)));
+        const resourceIssues = (0, skill_resources_js_1.skillResourceIssues)(skillBody(md), skillDir);
+        // The lethal trifecta is a property of what a unit CAN do, which for a skill is
+        // its declared `allowed-tools` (the CC skill tool contract). Only a model-
+        // invocable skill can be hijacked by attacker content, so a user-invoked one is
+        // excluded. A skill with no `allowed-tools` line inherits all → advisory.
+        const skillTools = (0, agent_runtime_js_1.parseAgentToolList)(md, "allowed-tools");
+        // No `allowed-tools:` line (null) → inherits all → wildcard sentinel; an
+        // EXPLICIT empty `[]` means zero tools → no trifecta (don't collapse them).
+        const trifecta = userInvoked
+            ? null
+            : (0, lethal_trifecta_js_1.lethalTrifectaIssues)(skillTools ?? ["*"], dialect);
         out.push({
             name: fm.name ?? skillName(path),
             path,
             hasDescription: Boolean(effectiveDesc && effectiveDesc.length >= 20),
             description: effectiveDesc?.trim(),
-            userInvoked: /^\s*disable-model-invocation:\s*true\s*$/m.test(md),
+            userInvoked,
             descriptionScript: effectiveDesc ? unexpectedScript(effectiveDesc) : null,
+            resourceIssues,
+            trifecta,
+            // A SKILL.md opening with `name:`/`description:` but no `---` fence loads
+            // as plain body → the skill is invisible. Inspect the RAW md (not the
+            // frontmatter-stripped body) so the unfenced keys are visible.
+            fenceIssue: (0, skill_missing_fence_js_1.skillMissingFence)(md),
         });
     }
     return out.sort((a, b) => a.name.localeCompare(b.name));
@@ -245,6 +305,11 @@ function scanAgents(files, dialect, declaredServers, cls) {
                 sideEffecting: surface.sideEffecting,
                 unknown: surface.unknown,
             },
+            // The lethal trifecta: a subagent whose contract grants all three legs. An
+            // inherits-all agent (no `tools:` line → tools === null) is the advisory
+            // case — pass the wildcard sentinel so it's distinguished from an EXPLICIT
+            // empty `tools: []` (zero tools → no trifecta). One detector, no drift.
+            trifecta: (0, lethal_trifecta_js_1.lethalTrifectaIssues)(tools ?? ["*"], dialect),
         });
     }
     return out.sort((a, b) => a.name.localeCompare(b.name));
@@ -314,57 +379,41 @@ function preferCompiledHooksMessage(count) {
  * `SessionStart`/`PostToolUse`/`Stop` hook isn't tested against the disaster
  * catalog. Returns an empty map for a non-object/array config (event → unknown).
  */
-function eventsByScript(hooks) {
+function eventsByScript(regs) {
     const map = new Map();
-    if (!hooks || typeof hooks !== "object" || Array.isArray(hooks))
-        return map;
-    for (const [event, arr] of Object.entries(hooks)) {
-        if (!Array.isArray(arr))
-            continue;
-        for (const entry of arr) {
-            const hookList = entry.hooks;
-            if (!Array.isArray(hookList))
-                continue;
-            for (const h of hookList) {
-                const cmd = h.command;
-                if (typeof cmd !== "string")
-                    continue;
-                for (const tok of cmd.match(SCRIPT_RE) ?? []) {
-                    if (!map.has(tok))
-                        map.set(tok, event);
-                }
-            }
+    for (const reg of regs) {
+        for (const tok of reg.command.match(SCRIPT_RE) ?? []) {
+            if (!map.has(tok))
+                map.set(tok, reg.event);
         }
     }
     return map;
 }
-function scanHooks(settings, root, pluginRootToken) {
-    const text = JSON.stringify(settings.hooks ?? {});
-    const commands = [...text.matchAll(/"command":\s*"((?:[^"\\]|\\.)*)"/g)].map((m) => m[1]);
-    const evMap = eventsByScript(settings.hooks);
+function scanHooks(regs, root, pluginRootToken) {
+    const commands = regs.map((r) => r.command);
+    const evMap = eventsByScript(regs);
     // A hand-written hook is any non-empty command that isn't a vigiles-managed
     // (compiled) hook-runtime invocation — the basis for the prefer-compiled-hooks nudge.
     const manual = commands.filter((c) => {
-        const u = c.replace(/\\(.)/g, "$1").trim();
+        const u = c.trim();
         return u !== "" && !isManagedHookCommand(u);
     }).length;
     const byScript = new Map();
     let inline = 0;
     for (const cmd of commands) {
-        const unescaped = cmd.replace(/\\(.)/g, "$1");
-        const found = unescaped.match(SCRIPT_RE);
+        const found = cmd.match(SCRIPT_RE);
         if (!found || found.length === 0) {
             inline++;
             continue;
         }
         // A guarded command runs its script only if it exists — an optional hook, not
         // a broken one. Treat it as a conditional one-liner (inline), don't path-check.
-        if (EXISTENCE_GUARD.test(unescaped)) {
+        if (EXISTENCE_GUARD.test(cmd)) {
             inline++;
             continue;
         }
         for (const tok of found) {
-            const hook = resolveScript(tok, root, pluginRootToken, unescaped);
+            const hook = resolveScript(tok, root, pluginRootToken, cmd);
             const event = evMap.get(tok);
             byScript.set(hook.script, event ? { ...hook, event } : hook);
         }
@@ -562,24 +611,157 @@ function collectMcpServers(root, layout) {
     collect(layout.manifestPath);
     return servers;
 }
+/**
+ * Flatten the per-surface lethal-trifecta + skill-resource findings into the
+ * path-tagged report lists the `audit` report AND the `lethal-trifecta` /
+ * `skill-resource-resolves` lint rules both consume (one detector, no drift).
+ */
+function collectSurfaceFindings(agents, skills) {
+    const trifectaFindings = [];
+    for (const a of agents) {
+        if (a.trifecta) {
+            trifectaFindings.push({
+                path: a.path,
+                kind: "subagent",
+                name: a.name,
+                finding: a.trifecta,
+            });
+        }
+    }
+    for (const s of skills) {
+        if (s.trifecta) {
+            trifectaFindings.push({
+                path: s.path,
+                kind: "skill",
+                name: s.name,
+                finding: s.trifecta,
+            });
+        }
+    }
+    const skillResourceFindings = skills.flatMap((s) => s.resourceIssues.map((finding) => ({
+        path: s.path,
+        name: s.name,
+        finding,
+    })));
+    const skillFenceFindings = skills.flatMap((s) => s.fenceIssue ? [{ path: s.path, name: s.name, finding: s.fenceIssue }] : []);
+    return { trifectaFindings, skillResourceFindings, skillFenceFindings };
+}
+/**
+ * Build the subagent delegation graph and flag a lethal trifecta that EMERGES
+ * across an edge (own ∪ delegated-to capability) though no single unit trips it.
+ *
+ * Edge source (deterministic, audit-available): a subagent that lists the `Task`
+ * tool can dispatch any sibling subagent, so it `delegatesTo` every OTHER agent.
+ * An inherits-all agent (`tools === null`) carries the wildcard, which the
+ * detector's FP-safe guard skips (that maximal-blast case is the per-unit
+ * advisory's job). One detector, no drift. (Richer edge sources — a typed
+ * railway's `delegate()` chain, a Flue subagent inheritance tree — plug in here.)
+ */
+function collectDelegationTrifecta(agents, dialect) {
+    const allNames = agents.map((a) => a.name);
+    const nodes = agents.map((a) => {
+        const canDispatch = a.tools === null ||
+            a.tools.some((t) => t === "Task" || t.startsWith("Task("));
+        return {
+            name: a.name,
+            kind: "agent",
+            tools: a.tools ?? ["*"],
+            delegatesTo: canDispatch ? allNames.filter((n) => n !== a.name) : [],
+        };
+    });
+    const pathByName = new Map(agents.map((a) => [a.name, a.path]));
+    return (0, delegation_trifecta_js_1.delegationTrifectaIssues)(nodes, dialect).map((finding) => ({
+        path: pathByName.get(finding.name) ?? "",
+        finding,
+    }));
+}
+/**
+ * Build `hookBlockIssues` entries by walking the canonical object-keyed-by-event
+ * settings shape PER REGISTRATION — so a script registered under several events
+ * is inspected under EACH (no de-dup by script path), inline one-liners are
+ * included (script token → null, inspect the command), and a script token is
+ * resolved to its ABSOLUTE on-disk path against the plugin root (not the caller's
+ * cwd). Addresses the gaps a de-duplicated `ScanHook[]` would miss.
+ */
+function collectHookBlockEntries(regs, root, pluginRootToken) {
+    const out = [];
+    for (const { event, command: cmd } of regs) {
+        // A wrapper command runs MORE than one script (`node run.cjs guard.mjs`),
+        // so resolve EVERY candidate and inspect each — reading only the first
+        // (the wrapper) would miss the guard's block logic. Candidates: extensioned
+        // script tokens (SCRIPT_RE) PLUS path-like words with NO extension
+        // (`bash hooks/guard`, `${ROOT}/hooks/session-start`) that resolve to a file.
+        const candidates = new Set(cmd.match(SCRIPT_RE) ?? []);
+        for (const word of cmd.split(/\s+/)) {
+            const w = word.replace(/^["']+|["']+$/g, "");
+            if (w.startsWith("-"))
+                continue; // a flag, not a path
+            if (w.includes("/") || w.includes(pluginRootToken))
+                candidates.add(w);
+        }
+        const resolvedPaths = [];
+        for (const tok of candidates) {
+            const r = resolveScript(tok, root, pluginRootToken, cmd);
+            if (r.status === "ok") {
+                const abs = (0, node_path_1.isAbsolute)(r.script) ? r.script : (0, node_path_1.resolve)(root, r.script);
+                if (!resolvedPaths.includes(abs))
+                    resolvedPaths.push(abs);
+            }
+        }
+        if (resolvedPaths.length > 0) {
+            // One entry per resolvable script (each is inspected on its own).
+            for (const sp of resolvedPaths) {
+                out.push({ event, command: cmd, scriptPath: sp });
+            }
+        }
+        else {
+            // No script file resolved → inline one-liner; inspect the command text.
+            out.push({ event, command: cmd, scriptPath: null });
+        }
+    }
+    return out;
+}
+/** Extract (event, matcher) pairs from the normalized hook registrations. */
+function collectHookMatchers(regs) {
+    const seen = new Set();
+    const out = [];
+    for (const { event, matcher } of regs) {
+        if (matcher === null)
+            continue;
+        const key = `${event}${matcher}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push({ event, matcher });
+    }
+    return out;
+}
+/** Tally how many scanned agents fall into each purity rung (effectSurface). */
+function summarizePurity(agents) {
+    return agents.reduce((acc, a) => {
+        acc[a.purity]++;
+        return acc;
+    }, { pure: 0, bounded: 0, unrestricted: 0 });
+}
 /** Scan a plugin/repo directory and report its surfaces + structural issues. */
 function scanPlugin(dir, layout, dialect = dialect_js_1.claudeCodeDialect) {
     const lay = layout ?? layout_js_1.claudeCodeLayout;
     const cls = makeClassifier(lay);
     const loaded = (0, plugin_loader_js_1.loadPlugin)(dir, lay);
-    const { hooks, inline, manual } = scanHooks(loaded.settings, (0, node_path_1.resolve)(dir), lay.pluginRootToken);
+    // Parse the raw `settings.hooks` ONCE at the boundary (parse-don't-validate):
+    // tolerant of the Claude Code nested shape AND the Codex flat shape, so every
+    // hook detector below consumes typed `HookRegistration[]` instead of re-walking
+    // `unknown`. The single seam where the per-harness hook shape is absorbed.
+    const hookRegs = (0, hook_normalize_js_1.normalizeHooks)(loaded.settings.hooks);
+    const { hooks, inline, manual } = scanHooks(hookRegs, (0, node_path_1.resolve)(dir), lay.pluginRootToken);
     // Hook-event keys are a CLOSED platform set — an unrecognized one is a dead
     // registration (the hook never fires), so flag every unknown (not just typos).
     // ONLY for the canonical object-keyed-by-event shape: a plugin shipping a
     // hooks ARRAY uses a non-CC/custom format whose events live INSIDE each entry
-    // (e.g. ananddtyagi/sugar's `[{event:"tool-use",…}]`) — Object.keys would read
-    // array INDICES, a false positive. We don't interpret a format we don't own.
-    const hooksObj = loaded.settings.hooks;
-    const eventNames = hooksObj !== null &&
-        typeof hooksObj === "object" &&
-        !Array.isArray(hooksObj)
-        ? Object.keys(hooksObj)
-        : [];
+    // (e.g. ananddtyagi/sugar's `[{event:"tool-use",…}]`) — `hookEventNames` reads
+    // object keys only and returns [] for an array. We don't interpret a format we
+    // don't own.
+    const eventNames = (0, hook_normalize_js_1.hookEventNames)(loaded.settings.hooks);
     const hookEventIssues = (0, hook_events_js_1.confidentHookEventIssues)((0, hook_events_js_1.verifyHookEvents)(eventNames, dialect));
     const instructions = loaded.files[lay.instructionFile] !== undefined
         ? {
@@ -590,14 +772,17 @@ function scanPlugin(dir, layout, dialect = dialect_js_1.claudeCodeDialect) {
     const mcpServers = collectMcpServers((0, node_path_1.resolve)(dir), lay);
     const declaredServers = Object.keys(mcpServers);
     const agents = scanAgents(loaded.files, dialect, declaredServers, cls);
-    const puritySummary = agents.reduce((acc, a) => {
-        acc[a.purity]++;
-        return acc;
-    }, { pure: 0, bounded: 0, unrestricted: 0 });
+    const skills = scanSkills(loaded.files, cls, {
+        root: (0, node_path_1.resolve)(dir),
+        materializeRoot: lay.materializeRoot,
+        dialect,
+    });
+    const puritySummary = summarizePurity(agents);
+    const { trifectaFindings, skillResourceFindings, skillFenceFindings } = collectSurfaceFindings(agents, skills);
     return {
         dir,
         instructions,
-        skills: scanSkills(loaded.files, cls),
+        skills,
         agents,
         hooks,
         inlineHooks: inline,
@@ -612,6 +797,22 @@ function scanPlugin(dir, layout, dialect = dialect_js_1.claudeCodeDialect) {
         mcpIssues: (0, mcp_config_js_1.verifyMcpServers)(mcpServers),
         mcpHookIssues: (0, mcp_hook_js_1.verifyMcpHookTargets)(loaded.settings.hooks, declaredServers, dialect),
         descriptionOverlaps: descriptionOverlapsFor(loaded.files, cls),
+        trifectaFindings,
+        skillResourceIssues: skillResourceFindings,
+        skillFenceIssues: skillFenceFindings,
+        pluginLayoutIssues: (0, plugin_dir_layout_js_1.pluginDirLayoutIssues)((0, node_path_1.resolve)(dir, (0, node_path_1.dirname)(lay.manifestPath)), 
+        // The hooks dir is a misplaceable functional surface too, but it lives in
+        // the layout as a convention PATH (`hooks/hooks.json`), not in surfaceDirs
+        // — derive its first segment and dedupe so the detector watches it as well.
+        [...new Set([...lay.surfaceDirs, lay.hooksConventionPath.split("/")[0]])]),
+        delegationTrifecta: collectDelegationTrifecta(agents, dialect),
+        hookBlockFindings: dialect.noEffectHookEvents
+            ? (0, hook_block_ineffective_js_1.hookBlockIssues)(collectHookBlockEntries(hookRegs, (0, node_path_1.resolve)(dir), lay.pluginRootToken), {
+                noEffectEvents: new Set(dialect.noEffectHookEvents),
+                permissionDecisionEvents: new Set(dialect.permissionDecisionHookEvents ?? []),
+            })
+            : [],
+        hookMatcherFindings: (0, hook_matcher_js_1.hookMatcherIssues)(collectHookMatchers(hookRegs), declaredServers, dialect),
         malformedFrontmatter: malformedFrontmatterFor(loaded.files, cls),
         warnings: loaded.warnings,
         untested: (0, test_coverage_js_1.findUntestedSurfaces)({ basePath: dir, layout: lay }).untested
@@ -801,6 +1002,13 @@ function formatScanReport(r) {
     out.push(...section("MCP config", r.mcpIssues.map((i) => `  ✗ ${i.message}`)));
     out.push(...section("MCP hook targets", r.mcpHookIssues.map((i) => `  ✗ ${i.message}`)));
     out.push(...section("Description overlap (precision risk)", r.descriptionOverlaps.map((o) => `  ⚠ ${o.message}`)));
+    out.push(...section("Lethal trifecta (prompt-injection exfil risk)", r.trifectaFindings.map((t) => `  ${t.finding.severity === "hard" ? "✗" : "⚠"} ${t.kind} ${t.name} (${t.path}): ${t.finding.message}`)));
+    out.push(...section("Skill bundled resources", r.skillResourceIssues.map((s) => `  ✗ ${s.name}: ${s.finding.ref} (line ${String(s.finding.line)}) — bundled resource not found`)));
+    out.push(...section("Invisible skills (missing frontmatter fence)", r.skillFenceIssues.map((s) => `  ✗ ${s.name} (${s.path}): opens with \`${s.finding.key}:\` but no \`---\` fence — loads as body, never fires`)));
+    out.push(...section("Misplaced plugin directories", r.pluginLayoutIssues.map((p) => `  ✗ ${p.message}`)));
+    out.push(...section("Lethal trifecta across delegation (blast radius)", r.delegationTrifecta.map((d) => `  ⚠ ${d.finding.name} (${d.path}): ${d.finding.message}`)));
+    out.push(...section("Ineffective hook guards (false confidence)", r.hookBlockFindings.map((h) => `  ✗ [${h.event}] ${h.scriptPath ?? "(inline)"}: ${h.message}`)));
+    out.push(...section("Hook matchers that never fire", r.hookMatcherFindings.map((m) => `  ✗ ${m.message}`)));
     const facts = [];
     if (r.commands > 0)
         facts.push(`Commands: ${String(r.commands)}`);
@@ -855,7 +1063,15 @@ function formatScanReport(r) {
         r.frontmatterIssues.length +
         r.frontmatterValueIssues.length +
         r.mcpIssues.length +
-        r.mcpHookIssues.length;
+        r.mcpHookIssues.length +
+        r.skillResourceIssues.length +
+        r.skillFenceIssues.length +
+        r.pluginLayoutIssues.length +
+        r.hookBlockFindings.length +
+        r.hookMatcherFindings.length +
+        // HARD trifectas render ✗ and are graded into the score, so they count; the
+        // ADVISORY (inherits-all) ones and the delegation-trifecta ⚠ risk do NOT.
+        r.trifectaFindings.filter((t) => t.finding.severity === "hard").length;
     out.push(broken === 0
         ? "✓ no structural issues found"
         : `⚠ ${String(broken)} structural issue(s) — see ✗/⚠ above`);

package/dist/setup-plan.d.ts

@@ -89,10 +89,13 @@ export declare const WORKFLOW_RULES: readonly ["require-instructions-spec", "unt
  * CC's loader), `skill-frontmatter` (skills load without it) and `unmarked-refs`
  * (the undecidable-plaintext nudge) sit at `warn`; `prefer-compiled-hooks` defaults
  * OFF (a recommendation that shouldn't fire unasked — the shell lane stays
- * first-class). `init` does not write these — they keep their own default
- * severities. Named for the group taxonomy (research/install-enforcement-dx.md).
+ * first-class). `lethal-trifecta` + `skill-resource-resolves` are here for now on a
+ * don't-cry-wolf rollout (default `warn`; a team raises either to `error` by hand
+ * once it's confirmed quiet on their corpus). `init` does not write these — they
+ * keep their own default severities. Named for the group taxonomy
+ * (research/install-enforcement-dx.md).
  */
-export declare const NUDGE_RULES: readonly ["frontmatter-valid", "skill-frontmatter", "prefer-compiled-hooks", "unmarked-refs"];
+export declare const NUDGE_RULES: readonly ["frontmatter-valid", "skill-frontmatter", "prefer-compiled-hooks", "unmarked-refs", "lethal-trifecta", "skill-resource-resolves", "skill-missing-fence", "plugin-dir-layout", "delegation-trifecta", "hook-block-ineffective", "hook-matcher"];
 export declare function mergeProjectConfig(existing: Record<string, unknown>, opts: {
     harness: string | string[];
     strict: boolean;

package/dist/setup-plan.js

@@ -112,14 +112,24 @@ exports.WORKFLOW_RULES = [
  * CC's loader), `skill-frontmatter` (skills load without it) and `unmarked-refs`
  * (the undecidable-plaintext nudge) sit at `warn`; `prefer-compiled-hooks` defaults
  * OFF (a recommendation that shouldn't fire unasked — the shell lane stays
- * first-class). `init` does not write these — they keep their own default
- * severities. Named for the group taxonomy (research/install-enforcement-dx.md).
+ * first-class). `lethal-trifecta` + `skill-resource-resolves` are here for now on a
+ * don't-cry-wolf rollout (default `warn`; a team raises either to `error` by hand
+ * once it's confirmed quiet on their corpus). `init` does not write these — they
+ * keep their own default severities. Named for the group taxonomy
+ * (research/install-enforcement-dx.md).
  */
 exports.NUDGE_RULES = [
     "frontmatter-valid",
     "skill-frontmatter",
     "prefer-compiled-hooks",
     "unmarked-refs",
+    "lethal-trifecta",
+    "skill-resource-resolves",
+    "skill-missing-fence",
+    "plugin-dir-layout",
+    "delegation-trifecta",
+    "hook-block-ineffective",
+    "hook-matcher",
 ];
 function mergeProjectConfig(existing, opts) {
     const config = { ...existing };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigiles",
-  "version": "9.1.0",
+  "version": "11.0.0",
   "description": "Lint & test the harness your AI agent runs on — verify the references in your CLAUDE.md / AGENTS.md and test that your hooks and skills actually work.",
   "keywords": [
     "claude-code",