registry / vigiles / 12.8.0

vigiles@12.8.0

⚠ Under review

Lint & test the harness your AI agent runs on — verify the references in your CLAUDE.md / AGENTS.md and test that your hooks and skills actually work.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 155 file(s), 1.42 MB of source, external domains: 127.0.0.1, code.claude.com, example.com, github.com, json-schema.org, vigiles.dev

Source & flagged code

6 flagged

dist/dialect-drift.jsView file

Lines 27-67javascript

27 * proprietary package into an MIT dep tree, (b) couple the harness-agnostic core to

28 * a Claude-Code-only package, and (c) not even give us `builtinAgentTools` (the SDK

29 * union is input-SCHEMA names like `FileReadInput`/`CronCreateInput` — a superset in

30 * a different vocabulary than the subagent `tools:` catalog). Reading the local file

31 * + a hand-authored list of bare identifiers (facts) is the deliberate ToS-clean

32 * design; this drift alarm is what keeps the hand-list honest.

33 *

34 * NOTE (CC ≥ ~2.1.18x): CC switched to a NATIVE-BINARY distribution — the npm

35 * package ships `bin/claude.exe` (from a platform `optionalDependencies` package),

36 * NOT a readable `cli.js` JS bundle. So the old "grep hook-event string literals out

37 * of cli.js" check has no bundle to read and degrades to a LOUD SKIP (see

38 * `findClaudeCodeBundle`); `sdk-tools.d.ts` is still shipped, so the tool-type drift

39 * alarm keeps working.

40 *

41 * Pure parsers (testable with fixtures) + a local-install locator. TWO consumers:

42 * the gated CI test in `dialect-drift.test.ts` (fails loud on tool/event drift), and

43 * `vigiles audit` at runtime via `checkDialectDrift`/`formatDialectDrift` (a best-effort,

44 * read-local freshness WARN when the installed CC's tool surface drifts from ours).

45 */

46const node_fs_1 = require("node:fs");

47const node_path_1 = require("node:path");

48const node_child_process_1 = require("node:child_process");

49/**

High

Child Process

Package source references child process execution.

dist/dialect-drift.jsView on unpkg · L47

50 * The Claude Code version `ACKNOWLEDGED_TOOL_INPUT_TYPES` + the dialect were last

51 * validated against. SINGLE SOURCE OF TRUTH for the pin: CI installs

52 * `@anthropic-ai/claude-code@<this>` (grepped from this line) in every job that

53 * drives the real binary, so the dialect-drift alarm fires only on a DELIBERATE

54 * bump — not on every unpinned CC release landing on an unrelated PR — and the

55 * real-`claude` harness/eval tests stay reproducible. Bump this together with

56 * `ACKNOWLEDGED_TOOL_INPUT_TYPES` (the gated test cross-checks them).

57 */

58exports.VALIDATED_CC_VERSION = "2.1.187";

59/**

60 * The `<X>Input` interface names we've ACKNOWLEDGED from `sdk-tools.d.ts` (Claude

61 * Code 2.1.187). The drift test fails when the installed set differs — a loud nudge

62 * to re-check `claudeCodeDialect` (and update this set) when CC adds/removes a tool.

63 * NOT a redistribution of their file: a list of bare identifiers (facts), authored here.

64 *

65 * 2.1.187 added the agent-PLATFORM surface (cron/scheduling/worktrees/web-app):

66 * Artifact, Cron{Create,Delete,List}, Enter/ExitWorktree, EnterPlanMode, Monitor,

67 * Projects, PushNotification, REPL, ReadMcpResourceDir, RemoteTrigger,

dist/cli.jsView file

Lines 103-143javascript

103 for (const distPath of candidates) {

104 if ((0, node_fs_1.existsSync)(distPath)) {

105 try {

106 const mod = (await import(distPath));

107 // CJS double-default: `{ default: { default: spec } }`.

dist/eval-baseline.jsView file

Lines 6-46javascript

6exports.diffReports = diffReports;

7exports.formatBaselineDiff = formatBaselineDiff;

8exports.diffToJUnit = diffToJUnit;

9exports.readBaseline = readBaseline;

10exports.writeBaseline = writeBaseline;

11/**

12 * vigiles — eval regression gating (Phase C).

13 *

hooks/post-edit.shView file

•path = hooks/post-edit.sh kind = build_helper sizeBytes = 887 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/post-edit.shView on unpkg

Source & flagged code

6 flagged · loading source

dist/dialect-drift.jsView file

47const node_path_1 = require("node:path"); L48: const node_child_process_1 = require("node:child_process"); L49: /**

High

Child Process

Package source references child process execution.

dist/dialect-drift.jsView on unpkg · L47

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = vigiles@12.3.0 matchedIdentity = npm:dmlnaWxlcw:12.3.0 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

123const script = `import(${JSON.stringify(fullPath)}).then(m => { const d = m.default?.default ?? m.default; console.log(JSON.stringify(d)); })`; L124: const output = execSync(`npx tsx -e '${script.replace(/'/g, "'\\''")}'`, { L125: encoding: "utf-8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L123

3762"runs the real model on your subscription. Refusing to fire them all non-interactively.\n" + L3763: " → name the eval(s): vigiles eval path/to/x.eval.mjs\n" + L3764: " → or opt in to all: vigiles eval --all");

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L3762

dist/eval-baseline.jsView file

26*/ L27: const node_fs_1 = require("node:fs"); L28: const node_path_1 = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/eval-baseline.jsView on unpkg · L26

hooks/post-edit.shView file

•path = hooks/post-edit.sh kind = build_helper sizeBytes = 887 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/post-edit.shView on unpkg

Findings

1 Critical2 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/dialect-drift.js

HighRuntime Package Installdist/cli.js

MediumDynamic Requiredist/eval-baseline.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperhooks/post-edit.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/cli.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/dialect-drift.jsView file

Lines 27-67javascript

27 * proprietary package into an MIT dep tree, (b) couple the harness-agnostic core to

28 * a Claude-Code-only package, and (c) not even give us `builtinAgentTools` (the SDK

29 * union is input-SCHEMA names like `FileReadInput`/`CronCreateInput` — a superset in

30 * a different vocabulary than the subagent `tools:` catalog). Reading the local file

31 * + a hand-authored list of bare identifiers (facts) is the deliberate ToS-clean

32 * design; this drift alarm is what keeps the hand-list honest.

33 *

34 * NOTE (CC ≥ ~2.1.18x): CC switched to a NATIVE-BINARY distribution — the npm

35 * package ships `bin/claude.exe` (from a platform `optionalDependencies` package),

36 * NOT a readable `cli.js` JS bundle. So the old "grep hook-event string literals out

37 * of cli.js" check has no bundle to read and degrades to a LOUD SKIP (see

38 * `findClaudeCodeBundle`); `sdk-tools.d.ts` is still shipped, so the tool-type drift

39 * alarm keeps working.

40 *

41 * Pure parsers (testable with fixtures) + a local-install locator. TWO consumers:

42 * the gated CI test in `dialect-drift.test.ts` (fails loud on tool/event drift), and

43 * `vigiles audit` at runtime via `checkDialectDrift`/`formatDialectDrift` (a best-effort,

44 * read-local freshness WARN when the installed CC's tool surface drifts from ours).

45 */

46const node_fs_1 = require("node:fs");

47const node_path_1 = require("node:path");

48const node_child_process_1 = require("node:child_process");

49/**

High

Child Process

Package source references child process execution.

dist/dialect-drift.jsView on unpkg · L47

50 * The Claude Code version `ACKNOWLEDGED_TOOL_INPUT_TYPES` + the dialect were last

51 * validated against. SINGLE SOURCE OF TRUTH for the pin: CI installs

52 * `@anthropic-ai/claude-code@<this>` (grepped from this line) in every job that

53 * drives the real binary, so the dialect-drift alarm fires only on a DELIBERATE

54 * bump — not on every unpinned CC release landing on an unrelated PR — and the

55 * real-`claude` harness/eval tests stay reproducible. Bump this together with

56 * `ACKNOWLEDGED_TOOL_INPUT_TYPES` (the gated test cross-checks them).

57 */

58exports.VALIDATED_CC_VERSION = "2.1.187";

59/**

60 * The `<X>Input` interface names we've ACKNOWLEDGED from `sdk-tools.d.ts` (Claude

61 * Code 2.1.187). The drift test fails when the installed set differs — a loud nudge

62 * to re-check `claudeCodeDialect` (and update this set) when CC adds/removes a tool.

63 * NOT a redistribution of their file: a list of bare identifiers (facts), authored here.

64 *

65 * 2.1.187 added the agent-PLATFORM surface (cron/scheduling/worktrees/web-app):

66 * Artifact, Cron{Create,Delete,List}, Enter/ExitWorktree, EnterPlanMode, Monitor,

67 * Projects, PushNotification, REPL, ReadMcpResourceDir, RemoteTrigger,

dist/cli.jsView file

Lines 103-143javascript

103 for (const distPath of candidates) {

104 if ((0, node_fs_1.existsSync)(distPath)) {

105 try {

106 const mod = (await import(distPath));

107 // CJS double-default: `{ default: { default: spec } }`.

dist/eval-baseline.jsView file

Lines 6-46javascript

6exports.diffReports = diffReports;

7exports.formatBaselineDiff = formatBaselineDiff;

8exports.diffToJUnit = diffToJUnit;

9exports.readBaseline = readBaseline;

10exports.writeBaseline = writeBaseline;

11/**

12 * vigiles — eval regression gating (Phase C).

13 *

hooks/post-edit.shView file

•path = hooks/post-edit.sh kind = build_helper sizeBytes = 887 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/post-edit.shView on unpkg

Lines 3742-3782javascript

3742 process.exit(1);

3743 }

3744 if (files.length === 0) {

3745 console.log(`No ${defaultGlob} files found.`);

3746 return;

3747 }

3748 // Consent gate for a bare `vigiles eval`: it runs the REAL model on your

3749 // subscription, and a no-target run discovered the whole tree — so never fan out

3750 // over an unbounded glob without explicit intent. Mirrors audit's read-vs-run

3751 // consent. `test` is free → always runs (decideRunScripts returns "run").

3752 const runDecision = (0, run_scripts_js_1.decideRunScripts)({

3753 kind,

3754 explicitTargets: restArgs.length > 0,

3755 matchedCount: files.length,

3756 isTTY: (process.stdin.isTTY ?? false) && (process.stdout.isTTY ?? false),

3757 all: args.includes("--all"),

3758 yes: args.includes("--yes") || args.includes("--no-interactive"),

3759 });

3760 if (runDecision.kind === "refuse") {

3761 console.error(`✗ vigiles eval: ${String(runDecision.count)} eval file(s) matched the whole tree, and each ` +

3762 "runs the real model on your subscription. Refusing to fire them all non-interactively.\n" +

3763 " → name the eval(s): vigiles eval path/to/x.eval.mjs\n" +

3764 " → or opt in to all: vigiles eval --all");

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L3762

3765 process.exit(2);

3766 }

3767 if (runDecision.kind === "confirm") {

3768 const ok = await promptYesNo(`About to run ${String(runDecision.count)} eval file(s) against the real model on your ` +

3769 "subscription (uses your Claude quota). Continue? [y/N] ");

3770 if (!ok) {

3771 console.log("Aborted. Name specific eval(s), or pass --all to run them all.");

3772 return;

3773 }

3774 }

3775 // No blanket skip: unit-tier (runHook) tests need no `claude`, so always run.

3776 // A script whose tier DOES need `claude` self-reports `⊘ SKIPPED` (exit 77) —

3777 // loud, never a silent green. Just flag up front that some may skip.

3778 if (kind === "test" && !(0, harness_test_js_1.claudeAvailable)()) {

3779 console.log("ℹ `claude` CLI not found — unit-tier tests run; tests that need it report SKIPPED.\n");

3780 }

3781 // `--trials=N` (a run knob: cost/precision, doesn't change WHAT is measured) is

3782 // forwarded to scripts via env. The MODEL is deliberately NOT a CLI/env knob —