Function experimental_verifyPluginGuards

Run the disaster battery against every hook a plugin or repo declares, using each hook's OWN event, matcher and condition, and report per hook.

import { experimental_verifyPluginGuards } from "vigiles";

const report = experimental_verifyPluginGuards(".");
for (const h of report.hooks) {
  if (h.status === "measured")
    console.log(`${h.blocked.length}/${h.results.length}  ${h.hook.command}`);
  else console.log(`⊘ ${h.status}  ${h.hook.command} — ${h.reason}`);
}
for (const note of report.notes) console.log(note);
Copy

Nothing here needs a model or a key. The hooks it finds are the ones the harness would load, so a hook that is present on disk but not registered is absent from the report by construction — which is the correct answer, and the one you would not get by globbing hooks/*.sh.

⚠️ It RUNS each reachable hook. A hook is a program you did not necessarily write, so point this at a repo whose hooks you are willing to execute, or pass trusted: false / sandbox: "auto" (inherited from RunHookOptions) to confine them. verifyGuardrail has always had the same property; sweeping a whole plugin makes it worth saying out loud.

Days old, with no consumer outside this repository. The REPORT SHAPE is the part most likely to move — specifically whether not-applicable stays one status or splits by cause, and whether the per-hook counts stay id arrays. The prefix comes off when that shape survives sweeping several real third-party repos unchanged; see docs/experimental.md.