registry / vigiles / 12.3.0

vigiles@12.3.0

Lint & test the harness your AI agent runs on — verify the references in your CLAUDE.md / AGENTS.md and test that your hooks and skills actually work.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious attack surface was found. The package does expose first-party AI-agent hook/plugin setup that can modify Claude/Codex hook configs when explicitly invoked.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs vigiles init/setup/compile/plugin or installs the Claude plugin explicitly

Impact

Agent hooks may run local vigiles commands during agent sessions; no unconsented install-time mutation or exfiltration found

Mechanism

first-party agent hook and harness configuration setup

Rationale

vigiles@12.3.0 is an AI harness testing/linting package whose suspicious primitives are aligned with its stated purpose and are user-invoked. Because it ships and can wire first-party agent hooks, downgrade to warn rather than block.

Evidence

package.jsondist/cli.jsdist/setup-plan.jsdist/hook-install.js.claude-plugin/plugin.jsonhooks/post-edit.shhooks/pre-edit.shhooks/session-start.shdist/eval.jsdist/dialect-drift.js.codex/config.toml.claude/settings.json.vigiles/hooks/*.jsonvigiles-report.jsonvigiles-report.html

Network endpoints3

github.com/zernie/vigilesgithub.com/zernie/vigiles/issues127.0.0.1

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

.claude-plugin/plugin.json registers first-party Claude hooks that run package scripts from hooks/*.sh
dist/cli.js wireCodexHooks writes .codex/config.toml with npx vigiles hook-runtime commands during explicit plugin init
dist/cli.js installHookFile can merge compiled user-authored hooks into .claude/settings.json or .codex/config.toml
dist/eval.js and harness code spawn local claude/codex processes for explicit eval/test features

Evidence against

package.json has no preinstall/install/postinstall lifecycle scripts
package main dist/core/spec.js is builder/helper exports, not import-time attack code
Hook and config mutation paths are CLI/user-invoked, not automatic npm install behavior
Network references are package-aligned testing/sandbox/model endpoints; no credential exfiltration endpoint found
Shell hooks run local npx vigiles lint/compile/generate tasks and do not harvest secrets

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 148 file(s), 1.33 MB of source, external domains: 127.0.0.1, code.claude.com, example.com, github.com, json-schema.org, vigiles.dev

Source & flagged code

6 flagged

dist/dialect-drift.jsView file

Lines 27-67javascript

27 * proprietary package into an MIT dep tree, (b) couple the harness-agnostic core to

28 * a Claude-Code-only package, and (c) not even give us `builtinAgentTools` (the SDK

29 * union is input-SCHEMA names like `FileReadInput`/`CronCreateInput` — a superset in

30 * a different vocabulary than the subagent `tools:` catalog). Reading the local file

31 * + a hand-authored list of bare identifiers (facts) is the deliberate ToS-clean

32 * design; this drift alarm is what keeps the hand-list honest.

33 *

34 * NOTE (CC ≥ ~2.1.18x): CC switched to a NATIVE-BINARY distribution — the npm

35 * package ships `bin/claude.exe` (from a platform `optionalDependencies` package),

36 * NOT a readable `cli.js` JS bundle. So the old "grep hook-event string literals out

37 * of cli.js" check has no bundle to read and degrades to a LOUD SKIP (see

38 * `findClaudeCodeBundle`); `sdk-tools.d.ts` is still shipped, so the tool-type drift

39 * alarm keeps working.

40 *

41 * Pure parsers (testable with fixtures) + a local-install locator. TWO consumers:

42 * the gated CI test in `dialect-drift.test.ts` (fails loud on tool/event drift), and

43 * `vigiles audit` at runtime via `checkDialectDrift`/`formatDialectDrift` (a best-effort,

44 * read-local freshness WARN when the installed CC's tool surface drifts from ours).

45 */

46const node_fs_1 = require("node:fs");

47const node_path_1 = require("node:path");

48const node_child_process_1 = require("node:child_process");

49/**

High

Child Process

Package source references child process execution.

dist/dialect-drift.jsView on unpkg · L47

50 * The Claude Code version `ACKNOWLEDGED_TOOL_INPUT_TYPES` + the dialect were last

51 * validated against. SINGLE SOURCE OF TRUTH for the pin: CI installs

52 * `@anthropic-ai/claude-code@<this>` (grepped from this line) in every job that

53 * drives the real binary, so the dialect-drift alarm fires only on a DELIBERATE

54 * bump — not on every unpinned CC release landing on an unrelated PR — and the

55 * real-`claude` harness/eval tests stay reproducible. Bump this together with

56 * `ACKNOWLEDGED_TOOL_INPUT_TYPES` (the gated test cross-checks them).

57 */

58exports.VALIDATED_CC_VERSION = "2.1.187";

59/**

60 * The `<X>Input` interface names we've ACKNOWLEDGED from `sdk-tools.d.ts` (Claude

61 * Code 2.1.187). The drift test fails when the installed set differs — a loud nudge

62 * to re-check `claudeCodeDialect` (and update this set) when CC adds/removes a tool.

63 * NOT a redistribution of their file: a list of bare identifiers (facts), authored here.

64 *

65 * 2.1.187 added the agent-PLATFORM surface (cron/scheduling/worktrees/web-app):

66 * Artifact, Cron{Create,Delete,List}, Enter/ExitWorktree, EnterPlanMode, Monitor,

67 * Projects, PushNotification, REPL, ReadMcpResourceDir, RemoteTrigger,

dist/cli.jsView file

Lines 101-141javascript

101 for (const distPath of candidates) {

102 if ((0, node_fs_1.existsSync)(distPath)) {

103 try {

104 const mod = (await import(distPath));

105 // CJS double-default: `{ default: { default: spec } }`.

dist/eval-baseline.jsView file

Lines 6-46javascript

6exports.diffReports = diffReports;

7exports.formatBaselineDiff = formatBaselineDiff;

8exports.diffToJUnit = diffToJUnit;

9exports.readBaseline = readBaseline;

10exports.writeBaseline = writeBaseline;

11/**

12 * vigiles — eval regression gating (Phase C).

13 *

hooks/post-edit.shView file

•path = hooks/post-edit.sh kind = build_helper sizeBytes = 887 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/post-edit.shView on unpkg

dist/eval.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = vigiles@12.2.0 matchedIdentity = npm:dmlnaWxlcw:12.2.0 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/eval.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/dialect-drift.jsView file

47const node_path_1 = require("node:path"); L48: const node_child_process_1 = require("node:child_process"); L49: /**

High

Child Process

Package source references child process execution.

dist/dialect-drift.jsView on unpkg · L47

dist/cli.jsView file

121const script = `import(${JSON.stringify(fullPath)}).then(m => { const d = m.default?.default ?? m.default; console.log(JSON.stringify(d)); })`; L122: const output = execSync(`npx tsx -e '${script.replace(/'/g, "'\\''")}'`, { L123: encoding: "utf-8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L121

3598"runs the real model on your subscription. Refusing to fire them all non-interactively.\n" + L3599: " → name the eval(s): vigiles eval path/to/x.eval.mjs\n" + L3600: " → or opt in to all: vigiles eval --all");

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L3598

dist/eval-baseline.jsView file

26*/ L27: const node_fs_1 = require("node:fs"); L28: const node_path_1 = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/eval-baseline.jsView on unpkg · L26

hooks/post-edit.shView file

•path = hooks/post-edit.sh kind = build_helper sizeBytes = 887 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/post-edit.shView on unpkg

dist/eval.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/eval.jsView on unpkg

Findings

1 Critical2 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/eval.js

HighChild Processdist/dialect-drift.js

HighRuntime Package Installdist/cli.js

MediumDynamic Requiredist/eval-baseline.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperhooks/post-edit.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/cli.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

86%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

Maintainerszernie

Version12.8.0

PublishedJul 7, 2026

LicenseMIT

Dependencies16

Integrityverified

Package size716 KB

Files320

Keywordsclaude-codecodexagentsagenticaillmharnesshooks

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/core/spec.jstypes → ./dist/core/spec.d.tsexports mapbin → vigiles

RuntimeNo engine / OS / CPU constraints

Artifact2.30 MB · 320 files1 signature(s)

Install lifecycleNo install hooks · other: api:check, api:report, build, build:core +8

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

6 flagged

dist/dialect-drift.jsView file

Lines 27-67javascript

27 * proprietary package into an MIT dep tree, (b) couple the harness-agnostic core to

28 * a Claude-Code-only package, and (c) not even give us `builtinAgentTools` (the SDK

29 * union is input-SCHEMA names like `FileReadInput`/`CronCreateInput` — a superset in

30 * a different vocabulary than the subagent `tools:` catalog). Reading the local file

31 * + a hand-authored list of bare identifiers (facts) is the deliberate ToS-clean

32 * design; this drift alarm is what keeps the hand-list honest.

33 *

34 * NOTE (CC ≥ ~2.1.18x): CC switched to a NATIVE-BINARY distribution — the npm

35 * package ships `bin/claude.exe` (from a platform `optionalDependencies` package),

36 * NOT a readable `cli.js` JS bundle. So the old "grep hook-event string literals out

37 * of cli.js" check has no bundle to read and degrades to a LOUD SKIP (see

38 * `findClaudeCodeBundle`); `sdk-tools.d.ts` is still shipped, so the tool-type drift

39 * alarm keeps working.

40 *

41 * Pure parsers (testable with fixtures) + a local-install locator. TWO consumers:

42 * the gated CI test in `dialect-drift.test.ts` (fails loud on tool/event drift), and

43 * `vigiles audit` at runtime via `checkDialectDrift`/`formatDialectDrift` (a best-effort,

44 * read-local freshness WARN when the installed CC's tool surface drifts from ours).

45 */

46const node_fs_1 = require("node:fs");

47const node_path_1 = require("node:path");

48const node_child_process_1 = require("node:child_process");

49/**

High

Child Process

Package source references child process execution.

dist/dialect-drift.jsView on unpkg · L47

50 * The Claude Code version `ACKNOWLEDGED_TOOL_INPUT_TYPES` + the dialect were last

51 * validated against. SINGLE SOURCE OF TRUTH for the pin: CI installs

52 * `@anthropic-ai/claude-code@<this>` (grepped from this line) in every job that

53 * drives the real binary, so the dialect-drift alarm fires only on a DELIBERATE

54 * bump — not on every unpinned CC release landing on an unrelated PR — and the

55 * real-`claude` harness/eval tests stay reproducible. Bump this together with

56 * `ACKNOWLEDGED_TOOL_INPUT_TYPES` (the gated test cross-checks them).

57 */

58exports.VALIDATED_CC_VERSION = "2.1.187";

59/**

60 * The `<X>Input` interface names we've ACKNOWLEDGED from `sdk-tools.d.ts` (Claude

61 * Code 2.1.187). The drift test fails when the installed set differs — a loud nudge

62 * to re-check `claudeCodeDialect` (and update this set) when CC adds/removes a tool.

63 * NOT a redistribution of their file: a list of bare identifiers (facts), authored here.

64 *

65 * 2.1.187 added the agent-PLATFORM surface (cron/scheduling/worktrees/web-app):

66 * Artifact, Cron{Create,Delete,List}, Enter/ExitWorktree, EnterPlanMode, Monitor,

67 * Projects, PushNotification, REPL, ReadMcpResourceDir, RemoteTrigger,

dist/cli.jsView file

Lines 101-141javascript

101 for (const distPath of candidates) {

102 if ((0, node_fs_1.existsSync)(distPath)) {

103 try {

104 const mod = (await import(distPath));

105 // CJS double-default: `{ default: { default: spec } }`.

dist/eval-baseline.jsView file

Lines 6-46javascript

6exports.diffReports = diffReports;

7exports.formatBaselineDiff = formatBaselineDiff;

8exports.diffToJUnit = diffToJUnit;

9exports.readBaseline = readBaseline;

10exports.writeBaseline = writeBaseline;

11/**

12 * vigiles — eval regression gating (Phase C).

13 *

hooks/post-edit.shView file

•path = hooks/post-edit.sh kind = build_helper sizeBytes = 887 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/post-edit.shView on unpkg

dist/eval.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/eval.jsView on unpkg

Lines 3578-3618javascript

3578 process.exit(1);

3579 }

3580 if (files.length === 0) {

3581 console.log(`No ${defaultGlob} files found.`);

3582 return;

3583 }

3584 // Consent gate for a bare `vigiles eval`: it runs the REAL model on your

3585 // subscription, and a no-target run discovered the whole tree — so never fan out

3586 // over an unbounded glob without explicit intent. Mirrors audit's read-vs-run

3587 // consent. `test` is free → always runs (decideRunScripts returns "run").

3588 const runDecision = (0, run_scripts_js_1.decideRunScripts)({

3589 kind,

3590 explicitTargets: restArgs.length > 0,

3591 matchedCount: files.length,

3592 isTTY: (process.stdin.isTTY ?? false) && (process.stdout.isTTY ?? false),

3593 all: args.includes("--all"),

3594 yes: args.includes("--yes") || args.includes("--no-interactive"),

3595 });

3596 if (runDecision.kind === "refuse") {

3597 console.error(`✗ vigiles eval: ${String(runDecision.count)} eval file(s) matched the whole tree, and each ` +

3598 "runs the real model on your subscription. Refusing to fire them all non-interactively.\n" +

3599 " → name the eval(s): vigiles eval path/to/x.eval.mjs\n" +

3600 " → or opt in to all: vigiles eval --all");

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L3598

3601 process.exit(2);

3602 }

3603 if (runDecision.kind === "confirm") {

3604 const ok = await promptYesNo(`About to run ${String(runDecision.count)} eval file(s) against the real model on your ` +

3605 "subscription (uses your Claude quota). Continue? [y/N] ");

3606 if (!ok) {

3607 console.log("Aborted. Name specific eval(s), or pass --all to run them all.");

3608 return;

3609 }

3610 }

3611 // No blanket skip: unit-tier (runHook) tests need no `claude`, so always run.

3612 // A script whose tier DOES need `claude` self-reports `⊘ SKIPPED` (exit 77) —

3613 // loud, never a silent green. Just flag up front that some may skip.

3614 if (kind === "test" && !(0, harness_test_js_1.claudeAvailable)()) {

3615 console.log("ℹ `claude` CLI not found — unit-tier tests run; tests that need it report SKIPPED.\n");

3616 }

3617 // `--trials=N` (a run knob: cost/precision, doesn't change WHAT is measured) is

3618 // forwarded to scripts via env. The MODEL is deliberately NOT a CLI/env knob —