vigiles 9.1.0 → 11.0.0

package/dist/cli.js

@@ -34,6 +34,7 @@ const optimize_js_1 = require("./optimize.js");
 const audit_score_js_1 = require("./audit-score.js");
 const audit_prompts_js_1 = require("./audit-prompts.js");
 const audit_html_js_1 = require("./audit-html.js");
+const audit_serve_js_1 = require("./audit-serve.js");
 const audit_report_js_1 = require("./audit-report.js");
 const adoptability_js_1 = require("./adoptability.js");
 const compile_js_1 = require("./core/compile.js");
@@ -140,6 +141,14 @@ function printErrors(specFile, errors) {
         console.log(`::error file=${specFile}::${err.message}`);
     }
 }
+/** Non-blocking advisories — printed, but never fail the compile. */
+function printWarnings(specFile, warnings) {
+    for (const w of warnings) {
+        const pathInfo = w.path ? ` (${w.path})` : "";
+        console.log(`  ⚠ [${w.type}] ${w.message}${pathInfo}`);
+        console.log(`::warning file=${specFile}::${w.message}`);
+    }
+}
 // ---------------------------------------------------------------------------
 // Commands
 // ---------------------------------------------------------------------------
@@ -238,7 +247,7 @@ function writeInstructionMirrors(primaryOutput, harnesses) {
 /** Compile a declarative SkillSpec → SKILL.md. */
 function compileSkillToFile(spec, specPath, dialect) {
     const outputPath = specPath.replace(/\.spec\.ts$/, "");
-    const { markdown, errors } = (0, compile_js_1.compileSkill)(spec, {
+    const { markdown, errors, warnings } = (0, compile_js_1.compileSkill)(spec, {
         basePath: process.cwd(),
         specFile: specPath,
         // The SKILL.md frontmatter profile comes from the resolved harness — a Codex
@@ -248,16 +257,18 @@ function compileSkillToFile(spec, specPath, dialect) {
     (0, node_fs_1.writeFileSync)((0, node_path_1.resolve)(process.cwd(), outputPath), markdown);
     if (errors.length === 0) {
         console.log(`\n✓ ${specPath} → ${outputPath}`);
+        printWarnings(specPath, warnings);
         return true;
     }
     console.log(`\n✗ ${specPath} — ${String(errors.length)} error(s)`);
     printErrors(specPath, errors);
+    printWarnings(specPath, warnings);
     return false;
 }
 /** Compile a subagent spec → agents/<name>.md (with its result-contract section). */
 function compileAgentToFile(spec, specPath, dialect) {
     const outputPath = specPath.replace(/\.spec\.ts$/, "");
-    const { markdown, errors } = (0, compile_js_1.compileAgent)(spec, {
+    const { markdown, errors, warnings } = (0, compile_js_1.compileAgent)(spec, {
         basePath: process.cwd(),
         specFile: specPath,
         dialect,
@@ -265,10 +276,12 @@ function compileAgentToFile(spec, specPath, dialect) {
     (0, node_fs_1.writeFileSync)((0, node_path_1.resolve)(process.cwd(), outputPath), markdown);
     if (errors.length === 0) {
         console.log(`\n✓ ${specPath} → ${outputPath}`);
+        printWarnings(specPath, warnings);
         return true;
     }
     console.log(`\n✗ ${specPath} — ${String(errors.length)} error(s)`);
     printErrors(specPath, errors);
+    printWarnings(specPath, warnings);
     return false;
 }
 /**
@@ -665,6 +678,13 @@ function lintExitCode(report) {
         report.frontmatterValidErrors > 0 ||
         report.mcpHookErrors > 0 ||
         report.preferCompiledHookErrors > 0 ||
+        report.lethalTrifectaErrors > 0 ||
+        report.skillResourceErrors > 0 ||
+        report.skillFenceErrors > 0 ||
+        report.pluginLayoutErrors > 0 ||
+        report.delegationTrifectaErrors > 0 ||
+        report.hookBlockErrors > 0 ||
+        report.hookMatcherErrors > 0 ||
         report.symbolRefErrors > 0 ||
         report.mcpRefErrors > 0)
         return 2;
@@ -819,8 +839,26 @@ function verifyFrontmatterRules(filePath, silent, exclude, linterOptions) {
     };
 }
 /**
- * Verify inline `<!-- vigiles:enforce -->` comments and `vigiles:` YAML
- * frontmatter in instruction files that aren't managed by a spec.
+ * Frontmatter mode (Level 1 — a `vigiles:` YAML block) is DISABLED in lint:
+ * KEPT IN CODE (`src/core/frontmatter.ts`, `verifyFrontmatterRules`,
+ * `vigiles generate schema`), but INERT — lint no longer reads or verifies a
+ * `vigiles:` block, so it never fires and never fails a build.
+ *
+ * WHY disabled-not-removed: the three-rung adoption ladder (inline / frontmatter
+ * / typed spec) collapsed to TWO on-ramps — inline comments (the zero-TS floor)
+ * and the typed `.spec.ts` (the source of truth). Frontmatter mode was the
+ * weakest middle rung and an undocumented-but-live surface that muddied the
+ * spec-first story (it literally confused a review). With ~no users to break,
+ * gating it off makes lint coherent (verify compiled output + inline marks +
+ * specs, nothing else) while preserving the code so the decision is reversible:
+ * flip this to `true` to re-enable. See `research/pre-release-focus.md` and the
+ * parked note in `docs/markdown-mode.md`.
+ */
+const FRONTMATTER_MODE_ENABLED = false;
+/**
+ * Verify inline `<!-- vigiles:enforce -->` comments (and, when
+ * {@link FRONTMATTER_MODE_ENABLED}, `vigiles:` YAML frontmatter) in instruction
+ * files that aren't managed by a spec.
  *
  * Spec mode is the source of truth when it exists, so a literal
  * `<!-- vigiles:enforce ... -->` snippet that survived into compiled
@@ -861,9 +899,13 @@ function verifyMarkdownModeRules(files, silent, config) {
         const inline = verifyInlineRules(filePath, silent, linterOptions);
         totals.inlineErrors += inline.errorCount;
         totals.inlineRules += inline.ruleCount;
-        const fm = verifyFrontmatterRules(filePath, silent, new Set(inline.ruleNames), linterOptions);
-        totals.frontmatterErrors += fm.errorCount;
-        totals.frontmatterRules += fm.ruleCount;
+        // Frontmatter mode is DISABLED (kept in code, inert in lint) — a `vigiles:`
+        // block is ignored, never verified. See FRONTMATTER_MODE_ENABLED.
+        if (FRONTMATTER_MODE_ENABLED) {
+            const fm = verifyFrontmatterRules(filePath, silent, new Set(inline.ruleNames), linterOptions);
+            totals.frontmatterErrors += fm.errorCount;
+            totals.frontmatterRules += fm.ruleCount;
+        }
     }
     if (!silent &&
         files.length > 0 &&
@@ -993,6 +1035,29 @@ async function runLint(restArgs, flags, config) {
     // 7n. Prefer-compiled-hooks — ONE discovery nudge (not per-hook) toward
     // compiled `vigiles/hook` artifacts when hand-written hooks ship. Recommendation.
     const preferCompiledHooks = checkPreferCompiledHooks(config, silent, adapter);
+    // 7o. Lethal-trifecta — a unit (subagent / model-invocable skill) whose tools
+    // hold all three legs (read-private + ingest-untrusted + exfiltrate) is a
+    // prompt-injection exfil path (Rule of Two). Capability SET-intersection.
+    const lethalTrifecta = checkLethalTrifecta(config, silent, adapter);
+    // 7p. Skill-resource — a SKILL.md body referencing a bundled file that doesn't
+    // exist on disk under the skill dir (the agent gets nothing). FP-safe.
+    const skillResources = checkSkillResourceResolves(config, silent, adapter);
+    // 7q. Skill-missing-fence — a SKILL.md opening with `name:`/`description:` but no
+    // `---` fence loads as plain body (invisible — no name/description/trigger).
+    const skillFence = checkSkillMissingFence(config, silent, adapter);
+    // 7r. Plugin-dir-layout — functional surface dirs (skills/agents/commands) nested
+    // inside the `.claude-plugin/` manifest dir where the harness can't see them.
+    const pluginLayout = checkPluginDirLayout(config, silent, adapter);
+    // 7s. Delegation-trifecta — a lethal trifecta that emerges across a delegation
+    // edge (a subagent's own ∪ delegated-to capability) though no single unit trips it.
+    const delegationTrifecta = checkDelegationTrifecta(config, silent, adapter);
+    // 7t. Hook-block-ineffective — a hook that looks like it blocks but silently
+    // doesn't (block decision on a non-blocking event, or the legacy `decision`
+    // field on a permission-gated event). The #1 verified hook pain (#19009).
+    const hookBlock = checkHookBlockIneffective(config, silent, adapter);
+    // 7u. Hook-matcher — a hook `matcher` that never fires (tool-name typo, or a
+    // malformed/undeclared MCP form).
+    const hookMatcher = checkHookMatcher(config, silent, adapter);
     // 8. Validate vigiles builder calls inside markdown code blocks. Default
     // is to validate every ref; illustrative blocks opt out via
     // `<!-- vigiles:ignore -->` (single block) or
@@ -1060,6 +1125,20 @@ async function runLint(restArgs, flags, config) {
         mcpHookErrors: mcpHookTargets.errors,
         preferCompiledHookIssues: preferCompiledHooks.issues,
         preferCompiledHookErrors: preferCompiledHooks.errors,
+        lethalTrifectaIssues: lethalTrifecta.issues,
+        lethalTrifectaErrors: lethalTrifecta.errors,
+        skillResourceIssues: skillResources.issues,
+        skillResourceErrors: skillResources.errors,
+        skillFenceIssues: skillFence.issues,
+        skillFenceErrors: skillFence.errors,
+        pluginLayoutIssues: pluginLayout.issues,
+        pluginLayoutErrors: pluginLayout.errors,
+        delegationTrifectaIssues: delegationTrifecta.issues,
+        delegationTrifectaErrors: delegationTrifecta.errors,
+        hookBlockIssues: hookBlock.issues,
+        hookBlockErrors: hookBlock.errors,
+        hookMatcherIssues: hookMatcher.issues,
+        hookMatcherErrors: hookMatcher.errors,
         docRefErrors: docRefReport.errors.length,
         symbolRefErrors,
         mcpRefErrors,
@@ -2638,6 +2717,211 @@ function checkDescriptionOverlap(config, silent, adapter) {
     }
     return { issues: found.length, errors: sev === "error" ? found.length : 0 };
 }
+/**
+ * Apply the `lethal-trifecta` rule: a unit (subagent / model-invocable skill)
+ * whose declared tools hold all three legs (read-private + ingest-untrusted +
+ * exfiltrate) is a prompt-injection exfil path (Meta's Rule of Two). Reuses
+ * `scanPlugin`'s `trifectaFindings` (a capability SET-intersection, one detector,
+ * no drift). Warning by default; "error" gates CI. Surfaces across BOTH subagents
+ * and skills, so it is NOT gated on the `subagents` capability — a skill-only
+ * harness still has the surface.
+ */
+function checkLethalTrifecta(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["lethal-trifecta"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).trifectaFindings;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nLethal-trifecta check:\n");
+        for (const t of found) {
+            const msg = `${t.kind} ${t.name}: ${t.finding.message}`;
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${t.path}: ${msg}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", msg, t.path);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `skill-resource-resolves` rule: a SKILL.md body referencing a bundled
+ * file (`scripts/`/`references/`/`assets/` or a relative markdown link with an
+ * extension) that doesn't exist on disk — the agent reads the instruction and gets
+ * nothing. Reuses `scanPlugin`'s `skillResourceIssues` (high-precision / FP-safe,
+ * one detector, no drift). Warning by default; "error" gates CI.
+ */
+function checkSkillResourceResolves(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["skill-resource-resolves"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).skillResourceIssues;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nSkill-resource check:\n");
+        for (const s of found) {
+            const msg = `${s.name}: bundled resource "${s.finding.ref}" (line ${String(s.finding.line)}) is referenced but missing — the agent reads the instruction and gets nothing.`;
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${s.path}: ${msg}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", msg, s.path);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `skill-missing-fence` rule: a SKILL.md that opens with
+ * frontmatter-looking keys (`name:`/`description:`) but no `---` fence loads as
+ * pure body — no name, no description, no trigger (the skill is invisible).
+ * Reuses `scanPlugin`'s `skillFenceIssues` (one detector, no drift). Warning by
+ * default; "error" gates CI.
+ */
+function checkSkillMissingFence(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["skill-missing-fence"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).skillFenceIssues;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nSkill-missing-fence check:\n");
+        for (const s of found) {
+            const msg = `${s.name}: ${s.finding.message}`;
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${s.path}: ${msg}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", msg, s.path);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `plugin-dir-layout` rule: functional surface dirs (skills/agents/
+ * commands) nested inside the `.claude-plugin/` manifest dir where the harness
+ * can't see them (the #1 plugin-author mistake). Reuses `scanPlugin`'s
+ * `pluginLayoutIssues` (one detector, no drift). Warning by default; "error"
+ * gates CI.
+ */
+function checkPluginDirLayout(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["plugin-dir-layout"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).pluginLayoutIssues;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nPlugin-dir-layout check:\n");
+        for (const p of found) {
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${p.message}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", p.message);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `delegation-trifecta` rule: a lethal trifecta that EMERGES across a
+ * delegation edge — a subagent whose effective (own ∪ delegated-to) capability
+ * holds all three legs though no single unit does. Reuses `scanPlugin`'s
+ * `delegationTrifecta` (one detector, no drift). Warning by default; "error"
+ * gates CI. Surfaces across the subagent graph, so it is NOT gated on a
+ * capability the way a surface-specific rule is.
+ */
+function checkDelegationTrifecta(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["delegation-trifecta"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).delegationTrifecta;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nDelegation-trifecta check:\n");
+        for (const d of found) {
+            const msg = `${d.finding.name}: ${d.finding.message}`;
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${d.path}: ${msg}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", msg, d.path);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `hook-block-ineffective` rule: a hook that LOOKS like it blocks but
+ * silently doesn't — a block decision (`exit 2` / `decision` / `permissionDecision`)
+ * on a non-blocking event, or the legacy top-level `decision` field on a
+ * permission-gated event (#19009, the #1 verified hook pain). Reuses `scanPlugin`'s
+ * `hookBlockFindings` (one detector, no drift). Warning by default; "error" gates CI.
+ */
+function checkHookBlockIneffective(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["hook-block-ineffective"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    if (!adapter.capabilities.shellHooks) {
+        reportNotApplicable("Hook-block check", "shell hooks", adapter, silent);
+        return { issues: 0, errors: 0 };
+    }
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).hookBlockFindings;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nHook-block check:\n");
+        for (const h of found) {
+            const where = h.scriptPath ?? "(inline)";
+            const msg = `[${h.event}] ${where}: ${h.message}`;
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${msg}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", msg, h.scriptPath ?? undefined);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
+/**
+ * Apply the `hook-matcher` rule: a hook `matcher` string that silently never
+ * fires — a tool-name typo (`bash`→`Bash`) or a malformed/undeclared MCP form.
+ * Reuses `scanPlugin`'s `hookMatcherFindings` (one detector, no drift). Warning
+ * by default; "error" gates CI.
+ */
+function checkHookMatcher(config, silent, adapter) {
+    const sev = (0, types_js_1.ruleSeverity)(config?.rules?.["hook-matcher"]);
+    if (!sev)
+        return { issues: 0, errors: 0 };
+    if (!adapter.capabilities.shellHooks) {
+        reportNotApplicable("Hook-matcher check", "shell hooks", adapter, silent);
+        return { issues: 0, errors: 0 };
+    }
+    let found;
+    try {
+        found = (0, scan_js_1.scanPlugin)(process.cwd(), adapter.layout, adapter.dialect).hookMatcherFindings;
+    }
+    catch {
+        return { issues: 0, errors: 0 };
+    }
+    if (found.length > 0 && !silent) {
+        console.log("\nHook-matcher check:\n");
+        for (const m of found) {
+            console.log(`  ${sev === "error" ? "✗" : "⚠"} ${m.message}`);
+            ghAnnotate(sev === "error" ? "error" : "warning", m.message);
+        }
+    }
+    return { issues: found.length, errors: sev === "error" ? found.length : 0 };
+}
 /**
  * Apply the `mcp-hook-target-resolves` rule: a `type: "mcp_tool"` hook action
  * that's incomplete (no `server`/`tool`) or targets a server the plugin doesn't
@@ -3330,6 +3614,7 @@ function printUsage(command) {
     console.log("  vigiles audit [dir...]          Lighthouse for your harness — a LOCAL report: rings + what's broken + fixes (a deterministic read; 2+ dirs → leaderboard)");
     console.log("                                 writes vigiles-report.html + vigiles-report.json (--no-html/--no-json) · --json for machine output. NOT a CI step — use `vigiles lint` in CI.");
     console.log("                                 the executing checks (run your hooks · live MCP · do skills fire?) run only interactively — `audit` asks once (remembered); automation uses the vigiles/testing API");
+    console.log("                                 --serve opens a LIVE local report whose buttons create specs in one click (own repo only; loopback + token-guarded) · --no-serve to skip the prompt");
     console.log("  vigiles test [files...]        Run *.harness.mjs deterministic harness tests");
     console.log("  vigiles eval [files...]        Run *.eval.mjs real-model harness evals (--trials=N, --min=N, --no-skip)");
     console.log("  vigiles scaffold-test [dir]    Generate a starter test for each untested skill/agent/hook (--write, --json)");
@@ -4186,6 +4471,63 @@ function writeAuditHtml(report) {
         console.log(`\n⚠ skipped vigiles-report.html: ${e instanceof Error ? e.message : String(e)}`);
     }
 }
+/**
+ * Start the live (`--serve`) adoption server: render the report with a per-run
+ * token, serve it on loopback, and run `init` in-process when a button POSTs. The
+ * security model lives in src/audit-serve.ts (token + Origin + allowlist). Blocks
+ * until the user stops it (Ctrl-C or the page's Done). Own-repo only — the caller
+ * gates this via decideServeGate, so adopt always writes into the current repo.
+ */
+async function runAuditServe(report, adoptable, cliErr) {
+    const token = (0, audit_serve_js_1.newToken)();
+    const surfaces = new Set((adoptable?.surfaces ?? []).map((s) => s.path));
+    let html;
+    try {
+        html = (0, audit_html_js_1.renderAuditHtml)(report, { token });
+    }
+    catch (e) {
+        console.log(`\n⚠ can't serve the live report: ${cliErr(e)}`);
+        return;
+    }
+    const adoptOne = (target) => {
+        try {
+            scaffoldSpec(["--target=" + target]); // in-process; writes into cwd (own repo)
+            return Promise.resolve({
+                ok: true,
+                message: `created spec for ${target}`,
+            });
+        }
+        catch (e) {
+            return Promise.resolve({ ok: false, message: cliErr(e) });
+        }
+    };
+    console.log("\n  Live report — create specs with one click. Ctrl-C to stop.\n");
+    await (0, audit_serve_js_1.serveAudit)({
+        token,
+        surfaces,
+        html,
+        runAdopt: adoptOne,
+        runAdoptAll: () => {
+            try {
+                for (const p of surfaces)
+                    scaffoldSpec(["--target=" + p]);
+                return Promise.resolve({
+                    ok: true,
+                    message: `created ${String(surfaces.size)} spec(s)`,
+                });
+            }
+            catch (e) {
+                return Promise.resolve({ ok: false, message: cliErr(e) });
+            }
+        },
+        onListening: (url) => {
+            console.log(`  ${url}`);
+            if (process.stdout.isTTY)
+                openBestEffort(url);
+        },
+    });
+    console.log("\n✓ live report closed");
+}
 /**
  * Run the model trigger tier with no `--prompts`: auto-generate diverse probe
  * prompts from each skill's description and measure trigger-rate (recall +
@@ -4210,19 +4552,54 @@ async function runAutoTrigger(dir, report, adapter, args) {
     if (!json) {
         console.log("\nℹ auto-generated probe prompts from skill descriptions (pass --prompts=<file> for a curated set).");
     }
+    const model = flagValue(args, "--model");
     const trigger = await (0, scan_behavioral_js_1.probePluginTriggers)(dir, promptSet, {
         minPrompts: audit_prompts_js_1.AUTO_RECALL_COUNT,
         minDistance: audit_prompts_js_1.AUTO_MIN_DISTANCE,
-        model: flagValue(args, "--model"),
+        model,
         harness,
         // Discover candidates with the resolved adapter's layout/dialect — a Codex
         // repo's skills live under the Codex layout, not the default CC one.
         layout: adapter.layout,
         dialect: adapter.dialect,
     });
-    console.log(json
-        ? JSON.stringify({ trigger }, null, 2)
-        : "\n" + (0, scan_behavioral_js_1.formatBehavioralReport)(trigger));
+    // Second behavioral eval (same consent): the selection-collision matrix — does
+    // one skill HIJACK a sibling's prompt? This is the MEASURED confirmation of the
+    // deterministic description-overlap proxy (the Triggering ring flags look-alikes;
+    // this proves the wrong one actually fires). Only meaningful with ≥2 model-
+    // invocable skills (a lone skill can't collide); reuses the same auto prompts.
+    const collisions = skills.length >= 2
+        ? await (0, scan_behavioral_js_1.measurePluginSelection)(dir, promptSet, { model, harness })
+        : null;
+    // Third behavioral eval (same consent): adversarial-gate — do enforcement-gate
+    // skills HOLD when the agent is told to violate them? Auto-derives its own
+    // attacks; a no-op (no model calls) when the plugin declares no gate skills.
+    const gates = await (0, scan_behavioral_js_1.measureGateAdversarial)(dir, {
+        model,
+        harness,
+        layout: adapter.layout,
+        dialect: adapter.dialect,
+    });
+    // Show the gate section when gate skills were DETECTED — even if the eval
+    // couldn't RUN (a Codex audit, or no `claude` CLI) it returns available:false
+    // with empty results, and `formatGateReport` renders the "unavailable" note.
+    // The consent prompt already advertised these gate skills, so a skipped check
+    // must be reported LOUDLY, never silently omitted as if there were none.
+    const hasGates = gates.results.length > 0 || (0, scan_behavioral_js_1.detectGateSkills)(report.skills).length > 0;
+    if (json) {
+        console.log(JSON.stringify({
+            trigger,
+            ...(collisions ? { collisions } : {}),
+            ...(hasGates ? { gates } : {}),
+        }, null, 2));
+    }
+    else {
+        console.log("\n" + (0, scan_behavioral_js_1.formatBehavioralReport)(trigger));
+        if (collisions)
+            console.log("\n" + (0, scan_behavioral_js_1.formatSelectionReport)(collisions));
+        if (hasGates)
+            console.log("\n" + (0, scan_behavioral_js_1.formatGateReport)(gates));
+    }
 }
 /**
  * The ONE read-vs-run decision for a single-plugin `audit`. A plain `audit` is a
@@ -4272,7 +4649,17 @@ function buildExecuteDisclosure(s, harness) {
     if (s.hasMcp)
         lines.push("  · start your MCP servers — connects to their backends");
     if (s.triggerableSkills > 0) {
-        lines.push(`  · measure whether skills fire (${triggerCostWording(harness)})`);
+        // ≥2 model-invocable skills also get the selection-collision matrix (does one
+        // skill hijack a sibling's prompt) — disclose it so the consent stays honest.
+        const what = s.triggerableSkills >= 2
+            ? "measure whether skills fire and collide"
+            : "measure whether skills fire";
+        lines.push(`  · ${what} (${triggerCostWording(harness)})`);
+    }
+    if (s.gateSkills > 0) {
+        // The adversarial-gate eval runs the FULL (unstubbed) skill — the most
+        // expensive check — so disclose it separately when gate skills are present.
+        lines.push(`  · test whether ${String(s.gateSkills)} enforcement-gate skill${s.gateSkills === 1 ? "" : "s"} hold under pressure — runs the full skill (${triggerCostWording(harness)})`);
     }
     if (s.adoptableRefs) {
         lines.push(`  · draft + verify your instruction file's references (${triggerCostWording(harness)})`);
@@ -4452,7 +4839,10 @@ async function main() {
                 // through to a misleading "empty machine / no structural issues" report
                 // (obra/superpowers-marketplace, anthropics/claude-plugins-community).
                 if (json) {
-                    console.log(JSON.stringify(market, null, 2));
+                    console.log(JSON.stringify((0, audit_report_js_1.buildMarketplaceReport)(market, {
+                        vigilesVersion: getVersion(),
+                        dir: (0, node_path_1.resolve)(dirs[0]),
+                    }), null, 2));
                 }
                 else {
                     console.log(`Marketplace "${market.name}": ${String(market.total)} plugin(s), all external ` +
@@ -4468,7 +4858,12 @@ async function main() {
                 const text = args.includes("--md")
                     ? (0, leaderboard_js_1.formatLeaderboardMarkdown)(scores)
                     : (0, leaderboard_js_1.formatLeaderboard)(scores);
-                console.log(json ? JSON.stringify(scores, null, 2) : text);
+                console.log(json
+                    ? JSON.stringify((0, audit_report_js_1.buildLeaderboardReport)(scores, {
+                        vigilesVersion: getVersion(),
+                        dir: (0, node_path_1.resolve)(dirs[0]),
+                    }), null, 2)
+                    : text);
             }
             else {
                 const root = (0, node_path_1.resolve)(targets[0]);
@@ -4546,6 +4941,7 @@ async function main() {
                 const surfaces = {
                     hasMcp: report.mcp && !isForeign,
                     triggerableSkills: report.skills.filter((s) => s.hasDescription && !s.userInvoked).length,
+                    gateSkills: (0, scan_behavioral_js_1.detectGateSkills)(report.skills).length,
                     adoptableRefs: adapter.name === "claude-code" &&
                         (0, node_fs_1.existsSync)((0, node_path_1.resolve)(root, adapter.layout.instructionFile)),
                 };
@@ -4632,17 +5028,36 @@ async function main() {
                 const finalReport = adoptabilityResult
                     ? { ...auditReport, adoptability: adoptabilityResult }
                     : auditReport;
-                // The shareable HTML report — written by default (--no-html to skip), and
-                // opened best-effort only for a human at a TTY (never spawn a browser for
-                // an agent / CI run).
-                if (!json && !args.includes("--no-html")) {
-                    writeAuditHtml(finalReport);
-                }
                 // The versioned JSON artifact — the upload/CI boundary (a hosted dashboard
                 // ingests this). Written by default in the human path; --no-json to skip.
                 if (!json && !args.includes("--no-json")) {
                     writeAuditJson(finalReport);
                 }
+                // The HTML report has two deliveries. STATIC (default): write the
+                // shareable file whose buttons copy the `init` command. LIVE (`--serve`,
+                // or a TTY "yes"): start a loopback server whose buttons run `init` for
+                // you. The gate keeps the default a terminating, headless-safe read and
+                // restricts the write-server to your own repo (decideServeGate).
+                const serveGate = (0, audit_serve_js_1.decideServeGate)({
+                    serveFlag: args.includes("--serve"),
+                    noServeFlag: args.includes("--no-serve"),
+                    json,
+                    isTTY: process.stdout.isTTY && process.stdin.isTTY,
+                    ownRepo: !isForeign,
+                    adoptableCount: finalReport.adoptable?.surfaces.length ?? 0,
+                });
+                let serveLive = serveGate === "serve";
+                if (serveGate === "ask") {
+                    const ans = (await askOnce("\nOpen the live report to create specs with one click? [y/N] ")).toLowerCase();
+                    serveLive = ans === "y" || ans === "yes";
+                }
+                const errMsg = (e) => e instanceof Error ? e.message : String(e);
+                if (serveLive) {
+                    await runAuditServe(finalReport, finalReport.adoptable, errMsg);
+                }
+                else if (!json && !args.includes("--no-html")) {
+                    writeAuditHtml(finalReport);
+                }
             }
             break;
         }

package/dist/core/CLAUDE.md.spec.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("./spec.js").ClaudeSpec;
+export default _default;
+//# sourceMappingURL=CLAUDE.md.spec.d.ts.map

package/dist/core/CLAUDE.md.spec.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Directory-scoped guidance for working in `src/core/` (the harness-agnostic
+ * detectors + domain).
+ *
+ * The full project rule set is the ROOT `CLAUDE.md` (compiled from
+ * `CLAUDE.md.spec.ts`). This nested spec adds only the discipline that belongs
+ * next to the detectors themselves — Claude Code loads it as directory memory
+ * whenever you work in `src/core/`. Source of truth; `src/core/CLAUDE.md` is a
+ * compiled build artifact (`vigiles compile`).
+ */
+const spec_js_1 = require("./spec.js");
+exports.default = (0, spec_js_1.claude)({
+    sections: {
+        scope: `Working in \`src/core/\`? This is the harness-AGNOSTIC domain (spec, compile, linters, the lint/audit detectors). The root \`CLAUDE.md\` holds the full positioning + rule set — read it first. Two invariants live closest to this code: the core must not import an adapter (\`core ⊄ adapter\`, eslint-enforced) and must not hard-code a Claude Code literal (read it from the injected layout/dialect). This file adds the rule for ADDING or CHANGING a detector.`,
+    },
+    keyFiles: {
+        "src/core/rule-meta.ts": "The RuleMeta registry — every rule's decidability bucket + severity + detector, the single source the detector-meta rule enforces.",
+        "src/core/types.ts": "RulesConfig — the rule-name keys the registry is keyed on.",
+    },
+    rules: {
+        "detector-meta": (0, spec_js_1.guidance)("A deterministic DETECTOR here is one half of a RULE — and a rule is not done until it is DECLARED. Three things move together (sibling of one-detector-no-drift + rules-docs-in-sync): (1) the pure detector function (shared by `lint` AND `audit`, never reimplemented per surface; read the layout/dialect, never a CC literal); (2) its entry in `src/core/rule-meta.ts` — the `Record<RuleName, RuleMeta>` won't typecheck without it — declaring its DECIDABILITY BUCKET (structural-closed = a type could prevent it / external-decidable = needs the world, error-capable / heuristic-behavioral = warn-or-measure-only), surface, defaultSeverity, the detector name, and any upstreamPrevention; (3) its `docs/rules/<name>.md` (the coverage test binds the registry to the docs by an EXACT set match, so a missing meta or doc fails CI). The bucket is the CEILING, not a preference — a heuristic proxy may NEVER default to `error` (it cries wolf); a structural/external fact MAY, once proven FP-safe. Before writing a new detector, CLASSIFY the defect into a bucket — that decides whether it can ever gate. The full model + the prose behind the buckets is the root `lint-rule-calibration` rule and `research/enforcement-model.md`."),
+    },
+});
+//# sourceMappingURL=CLAUDE.md.spec.js.map