vigiles 9.1.0 → 11.0.0

package/dist/core/skill-resources.js

@@ -0,0 +1,167 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.skillResourceIssues = skillResourceIssues;
+/**
+ * vigiles — SKILL bundled-resource resolution (the cross-reference moat applied
+ * to a SKILL.md body).
+ *
+ * A SKILL.md body is freeform markdown that routinely points the agent at LOCAL
+ * BUNDLED files shipped beside it — `scripts/foo.sh`, `references/api.md`,
+ * `[setup](./scripts/run.py)`, an inline `run \`scripts/setup.sh\``. When a
+ * referenced file doesn't exist on disk under the skill directory, the agent
+ * reads the instruction, gets nothing, and silently continues (a documented top
+ * skill pain — one practitioner found 59 broken refs across 192 files). vigiles
+ * already verifies file/script refs inside typed specs (core/refs.ts,
+ * core/doc-refs.ts) and intra-plugin script refs in the loader
+ * (plugin-loader.ts `danglingRefs`); this extends that to the SKILL.md body.
+ *
+ * HIGH-PRECISION / FP-SAFE, by the same don't-cry-wolf discipline the rest of
+ * vigiles holds (see `danglingRefs`/`isPluginRooted`): we flag ONLY references
+ * that are UNAMBIGUOUSLY a local bundled resource — a markdown link to a
+ * relative path with a file extension, or an explicit `scripts/`/`references/`/
+ * `assets/`-prefixed path (the Agent-Skills standard bundle dirs) with an
+ * extension. Everything else is skipped: URLs, absolute paths, `${VAR}`/`$VAR`
+ * tokens, `../` escapes, bare words with no extension or known prefix. Prefer
+ * MISSING a real ref over emitting a false positive — a noisy resource check
+ * would teach users to ignore it.
+ *
+ * Pure: the only IO is an injectable `existsSync` (default node:fs), mirroring
+ * core/refs.ts and the loader so the detector is testable with a fake.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+// ---------------------------------------------------------------------------
+// Shapes we match vs deliberately skip (FP-safety)
+// ---------------------------------------------------------------------------
+const FENCE = /^\s*(?:`{3,}|~{3,})/;
+// The Agent-Skills standard bundle subdirectories. A path PREFIXED by one of
+// these is unambiguously a local bundled resource, even without a `./`.
+const BUNDLE_DIRS = ["scripts", "references", "assets"];
+const BUNDLE_PREFIX = new RegExp(`^(?:${BUNDLE_DIRS.join("|")})/`);
+// A markdown inline link `[text](target)` — we read its target.
+const MD_LINK = /\[[^\]]*\]\(([^)\s]+)\)/g;
+// An inline-code path mention: a backtick span whose whole content is a single
+// path token. We only treat it as a ref when it is a bundle-dir-prefixed path
+// with an extension (the high-confidence shape); a bare `scripts` or a generic
+// `foo.ts` mention is NOT flagged.
+const INLINE_SPAN = /`([^`\n]+)`/g;
+// A path must carry a file extension to be a resource reference. A bare word or
+// a directory name (`scripts/lib`) is undecidable prose — skipped.
+const HAS_EXT = /\.[A-Za-z0-9]+$/;
+/**
+ * A reference target is a LOCAL BUNDLED RESOURCE worth resolving iff it is a
+ * relative path with a file extension AND is not one of the skip shapes. This is
+ * the single gate; both the link path and the inline-path path run through it.
+ */
+function localResourceTarget(rawTarget) {
+    // Strip a markdown link title / fragment / query if present, and trim.
+    const target = rawTarget.trim();
+    if (target.length === 0)
+        return null;
+    // SKIP: URLs (http://, https://, mailto:, any scheme://) — external.
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(target) || /^mailto:/i.test(target)) {
+        return null;
+    }
+    // SKIP: a pure anchor / fragment-only link (`#section`).
+    if (target.startsWith("#"))
+        return null;
+    // SKIP: absolute paths (`/etc/x`, Windows `C:\`) — not bundled-relative.
+    if (target.startsWith("/") || /^[A-Za-z]:[\\/]/.test(target))
+        return null;
+    // SKIP: variable tokens (`${CLAUDE_PLUGIN_ROOT}/x`, `$VAR/x`) — uncheckable,
+    // and almost always a plugin-root or runtime path, not a bundled file.
+    if (target.includes("$"))
+        return null;
+    // Drop a URL fragment / query suffix so `references/api.md#auth` resolves to
+    // the file. (Only after the scheme check above, so we never mangle a URL.)
+    const path = target.replace(/[?#].*$/, "");
+    if (path.length === 0)
+        return null;
+    // SKIP: a `../` escape OUT of the skill dir — undecidable / not a bundled
+    // resource (it points at a sibling skill or the repo). A leading `./` is fine.
+    const normalized = path.replace(/^\.\//, "");
+    if (normalized.startsWith("../") || normalized.includes("/../"))
+        return null;
+    // Must look like a file (have an extension), else it's a dir/prose mention.
+    if (!HAS_EXT.test(normalized))
+        return null;
+    return normalized;
+}
+/**
+ * Whether an inline-code path token is high-confidence enough to flag on its
+ * own (no surrounding `[..](..)` link syntax). We require a BUNDLE-DIR PREFIX
+ * (`scripts/`, `references/`, `assets/`) so a generic `` `config.json` `` or a
+ * `` `src/foo.ts` `` API mention in prose is never flagged — only the standard
+ * bundle layout, which is unambiguously a shipped resource.
+ */
+function isInlineBundlePath(token) {
+    const t = token.trim();
+    // A single token only — a span with spaces is a command/prose, not a path.
+    if (/\s/.test(t))
+        return false;
+    const normalized = t.replace(/^\.\//, "");
+    return BUNDLE_PREFIX.test(normalized) && HAS_EXT.test(normalized);
+}
+/** Collect candidate bundled-resource refs from one body line, skipping fences. */
+function candidatesInLine(line, lineNo) {
+    const out = [];
+    // Markdown links: any relative path target that passes the local-resource gate.
+    for (const m of line.matchAll(MD_LINK)) {
+        const resolved = localResourceTarget(m[1]);
+        if (resolved !== null) {
+            out.push({ ref: m[1].trim(), resolved, kind: "link", line: lineNo });
+        }
+    }
+    // Inline-code path mentions: only the high-confidence bundle-dir-prefixed form.
+    for (const m of line.matchAll(INLINE_SPAN)) {
+        const token = m[1].trim();
+        if (!isInlineBundlePath(token))
+            continue;
+        const resolved = localResourceTarget(token);
+        if (resolved !== null) {
+            out.push({ ref: token, resolved, kind: "path", line: lineNo });
+        }
+    }
+    return out;
+}
+/**
+ * The bundled-resource references in a SKILL.md body that don't resolve on disk
+ * under `skillDir`. Pure + FP-safe (see the module header). `skillDir` is the
+ * directory the SKILL.md itself lives in (resources are bundled beside it).
+ *
+ * The shared detector behind both `vigiles lint` (the `skill-resource-resolves`
+ * rule) and `vigiles audit` (the read-only report) — one detector, no drift.
+ */
+function skillResourceIssues(skillBody, skillDir, opts = {}) {
+    const exists = opts.existsSync ?? node_fs_1.existsSync;
+    const findings = [];
+    const seen = new Set();
+    const lines = skillBody.split("\n");
+    let inFence = false;
+    for (let i = 0; i < lines.length; i++) {
+        if (FENCE.test(lines[i])) {
+            inFence = !inFence;
+            continue;
+        }
+        if (inFence)
+            continue;
+        for (const c of candidatesInLine(lines[i], i + 1)) {
+            const full = (0, node_path_1.resolve)(skillDir, c.resolved);
+            if (exists(full))
+                continue;
+            // De-dupe the same missing file referenced several times in the body.
+            const key = `${c.kind}:${c.resolved}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            findings.push({
+                ref: c.ref,
+                resolved: c.resolved,
+                kind: c.kind,
+                line: c.line,
+            });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=skill-resources.js.map

package/dist/core/types.d.ts

@@ -220,6 +220,77 @@ export interface RulesConfig {
      * as `scan` (mcpHookIssues).
      */
     "mcp-hook-target-resolves"?: RuleSeverity;
+    /**
+     * Flag a unit (subagent / model-invocable skill) whose declared tools hold all
+     * THREE legs of Simon Willison's "lethal trifecta" — read private data, ingest
+     * untrusted content, AND exfiltrate — a prompt-injection exfil path with no
+     * exploit code (Meta's Rule of Two: allow at most two). A capability SET-
+     * intersection over the declared contract, NOT a text scan; high-precision (only
+     * well-known tools map to a leg). An EXPLICIT all-three contract is a "hard"
+     * finding; an inherits-all unit (no contract → every leg) is "advisory". Default
+     * "warn" (don't-cry-wolf rollout); raise to "error" to gate CI. Same detector as
+     * `scan` (lethalTrifectaIssues). See docs/rules/lethal-trifecta.md.
+     */
+    "lethal-trifecta"?: RuleSeverity;
+    /**
+     * Flag a SKILL.md body referencing a bundled file (`scripts/`/`references/`/
+     * `assets/`, or a relative markdown link with an extension) that doesn't exist
+     * on disk under the skill dir — the agent reads the instruction, gets nothing,
+     * and silently continues. The cross-reference moat applied to the SKILL.md body.
+     * High-precision / FP-safe (skips URLs, `$VAR` tokens, `../` escapes, extension-
+     * less mentions). Default "warn"; raise to "error" to gate CI. Same detector as
+     * `scan` (skillResourceIssues). See docs/rules/skill-resource-resolves.md.
+     */
+    "skill-resource-resolves"?: RuleSeverity;
+    /**
+     * Flag a SKILL.md that opens with frontmatter-looking keys (`name:`,
+     * `description:`, …) but has NO opening `---` fence — the harness loads the
+     * whole file as body, so the skill has no name/description/trigger and is
+     * invisible (never fires). High-precision (a fixed key whitelist; markdown /
+     * prose lines never match). Default "warn"; raise to "error" to gate CI. Same
+     * detector as `scan` (skillFenceIssues). See docs/rules/skill-missing-fence.md.
+     */
+    "skill-missing-fence"?: RuleSeverity;
+    /**
+     * Flag a functional surface directory (skills/agents/commands) nested INSIDE
+     * the `.claude-plugin/` manifest dir, where only `plugin.json` belongs — the
+     * harness can't see it, so the surface is invisible (the #1 plugin-author
+     * mistake). Pure filesystem check, FP-safe. Default "warn"; raise to "error"
+     * to gate CI. Same detector as `scan` (pluginLayoutIssues). See
+     * docs/rules/plugin-dir-layout.md.
+     */
+    "plugin-dir-layout"?: RuleSeverity;
+    /**
+     * Flag a lethal trifecta that EMERGES across a delegation edge — a subagent
+     * whose effective (own ∪ delegated-to) capability holds all three legs though
+     * no single unit does (the combined blast radius). The capability-diff across
+     * the delegation tree; skips units the per-unit `lethal-trifecta` already
+     * flags (no double-report), FP-safe (explicit edges, wildcard-guarded). Default
+     * "warn"; raise to "error" to gate CI. Same detector as `scan`
+     * (delegationTrifecta). See docs/rules/delegation-trifecta.md.
+     */
+    "delegation-trifecta"?: RuleSeverity;
+    /**
+     * Flag a hook that LOOKS like it blocks but silently doesn't — a block decision
+     * (`exit 2` / `decision` / `permissionDecision`) on an event that can't veto, or
+     * the legacy top-level `decision` field on a permission-gated event where only
+     * `hookSpecificOutput.permissionDecision` works (#19009, the #1 verified hook
+     * pain). FP-safe (conservative literal patterns; the blocking-event sets are
+     * read from the dialect, so it runs only where they're declared). Default "warn";
+     * raise to "error" to gate CI. Same detector as `scan` (hookBlockFindings). See
+     * docs/rules/hook-block-ineffective.md.
+     */
+    "hook-block-ineffective"?: RuleSeverity;
+    /**
+     * Flag a hook `matcher` string that silently never fires — a close typo of a
+     * built-in tool (`bash`→`Bash`), or a malformed/undeclared MCP form
+     * (`mcp_memory_*` instead of `mcp__memory__.*`, or a server the plugin doesn't
+     * declare). High-precision (close-typo only; MCP gated on a declared set,
+     * built-ins allowlisted; wildcards/regex skipped). Default "warn"; raise to
+     * "error" to gate CI. Same detector as `scan` (hookMatcherFindings). See
+     * docs/rules/hook-matcher.md.
+     */
+    "hook-matcher"?: RuleSeverity;
 }
 /** Extract severity from a rule value (handles both simple and tuple forms). */
 export declare function ruleSeverity<T>(rule: RuleWithOptions<T> | undefined): RuleSeverity;

package/dist/core/validate.d.ts

@@ -1,5 +1,6 @@
 import type { ParsedRule, ValidationError, ValidationResult, ReadResult, FileResult, ValidatePathsResult, RulesConfig, VigilesConfig, MarkerType, ParseOptions, ValidateOptions, ValidatePathsOptions, ReadOptions } from "./types.js";
 export type { ParsedRule, ValidationError, ValidationResult, ReadResult, FileResult, ValidatePathsResult, RulesConfig, VigilesConfig, MarkerType, ParseOptions, ValidateOptions, ValidatePathsOptions, ReadOptions, };
+export declare const DEFAULT_RULES: Required<RulesConfig>;
 export declare function findInstructionFiles(cwd?: string, configFiles?: string[]): string[];
 export declare function loadConfig(): VigilesConfig;
 export declare function parseRules(content: string, { ruleMarkers }?: ParseOptions): ParsedRule[];

package/dist/core/validate.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_RULES = void 0;
 exports.findInstructionFiles = findInstructionFiles;
 exports.loadConfig = loadConfig;
 exports.parseRules = parseRules;
@@ -28,7 +29,7 @@ const VALID_MARKERS = ["headings", "checkboxes"];
 const INSTRUCTION_FILES = ["CLAUDE.md", "AGENTS.md"];
 // The default instruction file to validate when no config names one.
 const DEFAULT_FILES = [INSTRUCTION_FILES[0]];
-const DEFAULT_RULES = {
+exports.DEFAULT_RULES = {
     "require-instructions-spec": "warn",
     // Default OFF — the consistent `require-<surface>-spec` parallel. Skills are
     // legitimately hand-written, so requiring a .spec.ts per SKILL.md is the wrong
@@ -70,10 +71,31 @@ const DEFAULT_RULES = {
     "frontmatter-valid": "warn",
     // A mcp_tool hook incomplete / targeting an undeclared server — on by default at warn.
     "mcp-hook-target-resolves": "warn",
+    // Lethal-trifecta capability set-intersection (read-private + ingest-untrusted +
+    // exfiltrate in one unit) — WARN by default (don't-cry-wolf rollout); raise to error.
+    "lethal-trifecta": "warn",
+    // A SKILL.md body referencing a missing bundled resource — WARN by default
+    // (don't-cry-wolf rollout, FP-safe); raise to error to gate CI.
+    "skill-resource-resolves": "warn",
+    // A SKILL.md missing its opening `---` fence (invisible skill) — WARN by
+    // default (FP-safe key whitelist); raise to error to gate CI.
+    "skill-missing-fence": "warn",
+    // Functional dirs nested inside `.claude-plugin/` (invisible surfaces) — WARN
+    // by default; raise to error to gate CI.
+    "plugin-dir-layout": "warn",
+    // A lethal trifecta emerging across a delegation edge (combined blast radius) —
+    // WARN by default (don't-cry-wolf rollout); raise to error to gate CI.
+    "delegation-trifecta": "warn",
+    // A hook that looks like it blocks but silently doesn't (#19009) — WARN by
+    // default (FP-safe literal patterns); raise to error to gate CI.
+    "hook-block-ineffective": "warn",
+    // A hook matcher that never fires (tool typo / wrong MCP form) — WARN by
+    // default (high-precision); raise to error to gate CI.
+    "hook-matcher": "warn",
 };
 const DEFAULT_CONFIG = {
     ruleMarkers: ["headings", "checkboxes"],
-    rules: DEFAULT_RULES,
+    rules: exports.DEFAULT_RULES,
     files: DEFAULT_FILES,
 };
 // ---------------------------------------------------------------------------
@@ -99,7 +121,7 @@ function loadConfig() {
         const config = {
             ...DEFAULT_CONFIG,
             ...userConfig,
-            rules: { ...DEFAULT_RULES, ...userConfig.rules },
+            rules: { ...exports.DEFAULT_RULES, ...userConfig.rules },
             files: Array.isArray(userConfig.files) ? userConfig.files : DEFAULT_FILES,
         };
         if (!Array.isArray(config.ruleMarkers) ||
@@ -170,7 +192,7 @@ function parseRules(content, { ruleMarkers } = {}) {
 // Core validation
 // ---------------------------------------------------------------------------
 function validate(content, { ruleMarkers, rules: rulesConfig, filePath, dialect } = {}) {
-    const activeRules = rulesConfig ?? DEFAULT_RULES;
+    const activeRules = rulesConfig ?? exports.DEFAULT_RULES;
     const parsedRules = parseRules(content, { ruleMarkers });
     const enforced = parsedRules.filter((r) => r.enforcement === "enforced").length;
     const guidanceOnly = parsedRules.filter((r) => r.enforcement === "guidance").length;

package/dist/leaderboard.d.ts

@@ -26,6 +26,7 @@ export declare const W_NO_DESCRIPTION = 10;
 export declare const W_DANGLING_REF = 8;
 export declare const W_OVERLAP = 8;
 export declare const W_NO_CONTRACT = 5;
+export declare const W_TRIFECTA = 20;
 /** Map a 0–100 structural-health score to its letter grade (A ≥90 … F <60). */
 export declare function gradeFor(score: number): PluginScore["grade"];
 /** One deduction: a count, its per-item weight, and the label if non-zero. */

package/dist/leaderboard.js

@@ -12,7 +12,7 @@
  * model and stack on top later; this part runs anywhere in CI for free.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.W_NO_CONTRACT = exports.W_OVERLAP = exports.W_DANGLING_REF = exports.W_NO_DESCRIPTION = exports.W_MISSING_HOOK = void 0;
+exports.W_TRIFECTA = exports.W_NO_CONTRACT = exports.W_OVERLAP = exports.W_DANGLING_REF = exports.W_NO_DESCRIPTION = exports.W_MISSING_HOOK = void 0;
 exports.gradeFor = gradeFor;
 exports.reportDeductions = reportDeductions;
 exports.isEmptyMachine = isEmptyMachine;
@@ -48,8 +48,11 @@ exports.W_MISSING_HOOK = 15; // a hook script that doesn't exist → never runs
 exports.W_NO_DESCRIPTION = 10; // a skill with no usable description → can't trigger
 exports.W_DANGLING_REF = 8; // a referenced intra-plugin file that's missing → broken path
 exports.W_OVERLAP = 8; // a description collision → the wrong skill fires
-exports.W_NO_CONTRACT = 5; // an agent with no `tools:` line → inherits everything
-// (untested surfaces are advisory, not a penalty — see scoreReport)
+exports.W_NO_CONTRACT = 5; // generic small-footgun weight (disallowedTools typo, invalid model/color)
+exports.W_TRIFECTA = 20; // a HARD lethal-trifecta contract (all three legs, explicit) → a declared prompt-injection exfil path
+// Two things are advisory, NOT graded penalties (shown, never scored — see scoreReport):
+//   - untested surfaces — a hardening gap, not breakage.
+//   - an agent that inherits all tools (no `tools:` line) — see reportDeductions for why.
 /** Map a 0–100 structural-health score to its letter grade (A ≥90 … F <60). */
 function gradeFor(score) {
     if (score >= 90)
@@ -72,11 +75,20 @@ function gradeFor(score) {
 function reportDeductions(r) {
     const missingHooks = r.hooks.filter((h) => h.status === "missing").length;
     const noDesc = r.skills.filter((s) => !s.hasDescription).length;
-    const noContract = r.agents.filter((a) => a.tools === null).length;
     const deadTools = r.agents.reduce((n, a) => n + a.toolIssues.length, 0);
     const deadMcpTools = r.agents.reduce((n, a) => n + a.mcpToolIssues.length, 0);
     const deadDisallowed = r.agents.reduce((n, a) => n + a.disallowedToolIssues.length, 0);
+    // HARD lethal-trifecta findings only — an EXPLICIT contract naming all three
+    // legs (a declared exfil path). Advisory (inherits-all) trifecta findings are
+    // surfaced but NEVER graded (aligned with the inherits-all stance), so they're
+    // excluded here.
+    const hardTrifecta = r.trifectaFindings.filter((f) => f.finding.severity === "hard").length;
     return [
+        {
+            n: hardTrifecta,
+            weight: exports.W_TRIFECTA,
+            label: "unit(s) holding all three lethal-trifecta legs (prompt-injection exfil path)",
+        },
         {
             n: missingHooks,
             weight: exports.W_MISSING_HOOK,
@@ -117,11 +129,14 @@ function reportDeductions(r) {
             weight: exports.W_NO_CONTRACT,
             label: "agent disallowedTools typo(s) that block nothing",
         },
-        {
-            n: noContract,
-            weight: exports.W_NO_CONTRACT,
-            label: "agent(s) inherit all tools (no contract)",
-        },
+        // NB: an agent that inherits all tools (no `tools:` line) is ADVISORY, not a
+        // graded penalty — it's surfaced by scoreReport / the Structure ring but never
+        // drags the score. WHY: omitting the `tools:` line is a near-universal,
+        // legitimate authoring style (a measured OSS sweep of 122 real plugins found
+        // 109 whose ONLY finding was this), so penalizing it makes the grade cry wolf
+        // on idiomatic subagents. A health score should mean "something is BROKEN", and
+        // a broad-by-default tool surface is a hardening/least-privilege NUDGE, not
+        // breakage. The count is re-derived where the advisory note is built.
         {
             n: r.frontmatterIssues.length,
             weight: exports.W_NO_DESCRIPTION,
@@ -142,6 +157,33 @@ function reportDeductions(r) {
             weight: exports.W_DANGLING_REF,
             label: "mcp_tool hook(s) incomplete / targeting an undeclared server",
         },
+        {
+            n: r.skillResourceIssues.length,
+            weight: exports.W_DANGLING_REF,
+            label: "skill bundled-resource ref(s) that don't resolve on disk",
+        },
+        {
+            n: r.skillFenceIssues.length,
+            weight: exports.W_NO_DESCRIPTION,
+            label: "invisible skill(s) (frontmatter with no opening `---` fence)",
+        },
+        {
+            n: r.pluginLayoutIssues.length,
+            weight: exports.W_NO_DESCRIPTION,
+            label: "functional dir(s) misplaced inside `.claude-plugin/` (invisible)",
+        },
+        {
+            n: r.hookBlockFindings.length,
+            weight: exports.W_MISSING_HOOK,
+            label: "hook(s) that look like they block but silently don't",
+        },
+        {
+            n: r.hookMatcherFindings.length,
+            weight: exports.W_MISSING_HOOK,
+            label: "hook matcher(s) that never fire (typo / wrong MCP form)",
+        },
+        // NB: delegationTrifecta (like the advisory per-unit/inherits-all trifecta) is a
+        // ⚠ RISK, surfaced but NOT graded — only the HARD per-unit trifecta above scores.
         // NB: untested surfaces are NOT a penalty — an untested surface is a hardening
         // gap, not breakage, so it never drags the health score (it's appended as an
         // advisory note below). The score ranks what's BROKEN.
@@ -192,8 +234,15 @@ function scoreReport(r) {
     }
     // Sort issues by cost (worst first) so the report leads with what matters.
     issues.sort((a, b) => Number(b.split(" ")[0]) - Number(a.split(" ")[0]));
-    // Untested surfaces are advisory — surfaced for visibility, but they don't
-    // affect the score, so they come AFTER the real (score-affecting) issues.
+    // Advisory notes are surfaced for visibility but DON'T affect the score, so they
+    // come AFTER the real (score-affecting) issues:
+    //   - inherit-all (no tool contract): a least-privilege NUDGE, not breakage —
+    //     see reportDeductions for the full rationale.
+    //   - untested surfaces: a hardening gap, not breakage.
+    const noContract = r.agents.filter((a) => a.tools === null).length;
+    if (noContract > 0) {
+        issues.push(`${String(noContract)} agent(s) inherit all tools (no contract) (advisory)`);
+    }
     if (r.untested > 0) {
         issues.push(`${String(r.untested)} untested surface(s) (advisory)`);
     }
@@ -228,12 +277,12 @@ function formatLeaderboard(scores) {
         const issue = s.issues.length > 0 ? ` — ${s.issues.join("; ")}` : "";
         out.push(`  ${rank}  ${score}    ${s.grade}      ${s.name}${issue}`);
     });
-    out.push("", "Structural health only (no model). Weights: missing hook -15, no-description", "skill -10, broken intra-plugin ref -8, agent-without-tool-contract -5.", "Untested surfaces are advisory — shown, but they don't affect the score.");
+    out.push("", "Structural health only (no model). Weights: lethal-trifecta unit -20, missing", "hook -15, no-description skill -10, broken intra-plugin ref -8, dead tool/MCP", "ref -8. Inherit-all subagents and untested surfaces are advisory — shown, not", "scored.");
     return out.join("\n");
 }
-const LEADERBOARD_METHOD = "_Structural health only (deterministic, no model): missing hook −15, " +
-    "no-description skill −10, broken intra-plugin ref −8, " +
-    "agent-without-tool-contract −5. Untested surfaces are advisory (shown, not " +
+const LEADERBOARD_METHOD = "_Structural health only (deterministic, no model): lethal-trifecta unit −20, " +
+    "missing hook −15, no-description skill −10, broken intra-plugin / dead-tool ref −8. " +
+    "Inherit-all subagents and untested surfaces are advisory (shown, not " +
     "scored). Behavioural columns (trigger-rate, collisions, egress) stack on top._";
 /**
  * Format a ranked leaderboard as a Markdown table — the PUBLISHABLE form (a README,

package/dist/scan-behavioral.d.ts

@@ -135,5 +135,90 @@ export declare function measurePluginSelectionWith(dir: string, promptSet: Trigg
 export declare function measurePluginSelection(dir: string, promptSet: TriggerPromptSet, opts?: SelectionOptions): Promise<SelectionReport>;
 /** Format the selection-collision matrix as a scan-report section. */
 export declare function formatSelectionReport(r: SelectionReport): string;
+/** Does a skill description assert a hard constraint (→ an adversarial-gate candidate)? */
+export declare function isGateDescription(description: string): boolean;
+/** A skill considered for gate detection — name + its (model-visible) description. */
+export interface GateCandidate {
+    readonly name: string;
+    readonly description?: string;
+    readonly userInvoked?: boolean;
+    readonly hasDescription?: boolean;
+}
+/**
+ * The model-invocable, described skills whose description reads as an enforcement
+ * gate — the candidates for the adversarial-gate eval. User-invoked and
+ * description-less skills are excluded (they can't auto-fire a constraint on the
+ * model's behaviour), mirroring the trigger-rate candidate filter.
+ */
+export declare function detectGateSkills(skills: readonly GateCandidate[]): readonly string[];
+/** A gate under test: its name + the rule its description states. */
+export interface GateUnderTest {
+    readonly name: string;
+    readonly description: string;
+}
+/** The verdict an injected judge returns (a subset of judge.ts JudgeResult). */
+export interface GateVerdict {
+    readonly pass: boolean;
+    readonly score: number;
+    readonly reason: string;
+}
+/** Injected dependencies, so the orchestration is unit-testable with no model. */
+export interface GateEvalDeps {
+    readonly driver: EvalDriver;
+    /** Grade whether the gate held, given the run output + the rule rubric. */
+    readonly judge: (a: {
+        output: string;
+        rubric: string;
+    }) => GateVerdict;
+    /** Turn a gate's rule into a one-line user request that tries to violate it. */
+    readonly derive: (gate: GateUnderTest) => string;
+}
+export interface GateOptions {
+    /** Selector model for the harness run (default sonnet). */
+    readonly model?: string;
+    /** Attacks per gate (default 1). */
+    readonly trials?: number;
+    /** Concurrent harness runs (default 1). */
+    readonly concurrency?: number;
+    readonly harness?: ProbeHarness;
+    readonly layout?: PluginLayout;
+    readonly dialect?: HarnessDialect;
+    /** Author-supplied attack prompts (bare skill name → prompts); overrides derive. */
+    readonly attacks?: Record<string, readonly string[]>;
+}
+export interface GateResult {
+    readonly skill: string;
+    readonly measured: boolean;
+    /** Fraction of attacks the gate HELD (1 = held every time). */
+    readonly heldRate?: number;
+    /** Convenience: held on EVERY attack (a single cave → false). */
+    readonly held?: boolean;
+    readonly n?: number;
+    /** The attack used (first), for the report. */
+    readonly attack?: string;
+    /** The judge's rationale on a representative cave (else a hold), for the report. */
+    readonly reason?: string;
+    readonly note?: string;
+}
+export interface GateAdversarialReport {
+    readonly available: boolean;
+    readonly results: readonly GateResult[];
+    readonly note?: string;
+}
+/** Build the LLM-judge rubric from the gate's own rule (pure). */
+export declare function gateRubric(gate: GateUnderTest): string;
+/** The injectable core (unit-testable with fake driver/judge/derive — no model). */
+export declare function measureGateAdversarialWith(dir: string, gates: readonly GateUnderTest[], deps: GateEvalDeps, opts?: GateOptions): Promise<GateAdversarialReport>;
+/**
+ * Measure whether a plugin's enforcement-gate skills HOLD when adversarially
+ * challenged. Detects gate skills (keyword heuristic), auto-derives an attack from
+ * each rule (unless author-supplied), runs the UNSTUBBED harness, and LLM-judges
+ * hold vs cave. Claude Code only; degrades to `available: false` without the CLI/auth.
+ */
+export declare function measureGateAdversarial(dir: string, opts?: GateOptions): Promise<GateAdversarialReport>;
+/** Default adversarial attacks per gate (stochastic → need >1; unstubbed → keep low). */
+export declare const DEFAULT_GATE_TRIALS = 3;
+/** Format the adversarial-gate report as a scan-report section. */
+export declare function formatGateReport(r: GateAdversarialReport): string;
 export {};
 //# sourceMappingURL=scan-behavioral.d.ts.map