@dzhechkov/harness-cli 0.3.199 → 0.3.201

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dzhechko
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -132,7 +132,7 @@ point any tool at (a skill is just Markdown). Dedicated targets are on the [road
 
 ## User Journey — from install to mastery
 
-All 39 commands mapped to a real workflow:
+All 41 commands mapped to a real workflow:
 
 ```
 DISCOVER → INSTALL → USE → CREATE → MAINTAIN → SHARE
@@ -356,7 +356,7 @@ Get the whole set with `dz init --target claude-code --preset meta`, or pick one
 
 > **A skill and its npx toolkit are not duplicates — they're a graduation.** Several skills (e.g. `feature-adr`, `design-thinking`) exist BOTH as a skill inside a `dz` preset AND as a standalone `npx` package. The preset's SKILL.md is **fully functional on its own** (the whole methodology — modules + references — travels with it, and it auto-activates by description), and it's the only way to compile that capability to the **non-Claude platforms** (Codex/OpenCode/Hermes/OpenClaude) via `dz`. The npx package adds **project-level runtime governance** around the same skill: a slash command, governance rules, a context shard, and (for feature-adr) reward-learning + `/harvest`. So: pick the **skill/preset** for a working capability across platforms; pick the **npx toolkit** when you want it as a governed, command-driven fixture of one project.
 
-## All Commands (40)
+## All Commands (41)
 
 ```
 dz setup             --target <name> [--preset <name>] [--select id,id,...] [--skills-dir <dir>] [--memory agentdb] [--no-memory] [--no-hooks] [--install-driver] [--force]
@@ -376,7 +376,8 @@ dz vector import     <file.rvf> [--project <dir>] [--json]         # RVF import
 dz vector harmonize  [--apply] [--threshold <0..1>] [--json]       # SEMANTIC merge of near-dups (dry-run default; --apply after a restorable backup)
 dz teach --harmonize [--apply] [--threshold <0..1>]                # alias of `dz vector harmonize`
 dz statusline        [--json] [--install]   # compact Claude Code statusline: live self-learning pattern count + brain sources
-dz usage             [--json] [--project <dir>]   # ESTIMATE Claude session (5h-block) + weekly (7d) token usage from local transcripts; exit 0 ALWAYS; pct=null when limits unconfigured
+dz usage             [--json] [--project <dir>] | --calibrate --session <pct> --weekly <pct> [--model fable=<pct>]   # ESTIMATE Claude usage from fixed reset windows; optional per-model weekly binding; exit 0 ALWAYS
+dz claim-check       [paths...] [--json] [--fail-on high|medium|none] [--project <dir>]   # enforce the Integrity Rule: flag untagged/overstated accuracy claims; default scan = READMEs + features' 08_qe_report.md; exit 1 only at/above --fail-on (default high)
 dz brain list        [--json]                                        # the durable cross-project knowledge brain
 dz brain query       "<q>" [--source <slug>] [--limit <N>] [--any] [--rerank] [--json]  # cross-source recall (--any = OR match; --rerank reorders on-point first). Auto-broadens: if strict all-terms match yields 0 hits, it retries once as OR and labels the result "broadened" (text note + broadened:true in --json) instead of returning empty. Explicit --any is OR from the start (never labeled broadened).
 dz brain add         [--source <slug>] [--project <dir>] [--from-slice <f>|--from-pack <p>|--from-kus <f> --slug <s> --kind <k> --license <spdx> [--override]] [--json]  # grow the brain
@@ -400,7 +401,7 @@ dz create-skill      --name <id> [--description <text>] [--tier 1|2|3] [--with-r
 dz registry          [search <query>] [--category <cat>]
 dz benchmark         <skill-dir> [--compare <dir>] [--all]
 dz mcp-scan          [path] [--json]   (static agent-permission audit; exit 0/1/2 = clean/medium/high)
-dz publish           [--filter <name>] [--bump-only]   (dry-run by default; pass --yes/--confirm to go live)
+dz publish           [--filter <name>] [--bump-only] [--claim-check <off|warn|error>]   (dry-run by default; pass --yes/--confirm to go live; claim-check gate defaults to warn — surfaces README claim findings, never blocks)
 dz auto-canonicalize --source <github-url> --pack <skills-pack>
 dz sync-upstream     [--package <dir>] [--list] [--all]
 dz drift-check       [--all] [--json] [--project <dir>]   # CI gate: exit 1 on NEW shared-skill drift (baseline: .dz/drift-allowlist.json; --all incl .claude dogfood)
@@ -467,29 +468,103 @@ Modeled on the Agentic QE statusline pattern (e.g. AQE's `🎓 12 patterns`).
 
 ### Usage estimate (`dz usage`)
 
-`dz usage` prints a READONLY, never-throw ESTIMATE of Claude SESSION (active 5h-block) and WEEKLY
-(rolling 7d) token usage, aggregated from your local `~/.claude/projects/**/*.jsonl` transcripts:
+`dz usage` prints a READONLY, never-throw ESTIMATE of Claude SESSION and WEEKLY token usage,
+aggregated from your local `~/.claude/projects/**/*.jsonl` transcripts. Weekly counts start at the
+configured fixed local anchor (`memory.usage.weeklyResetAnchor`, for example `Wed 08:59`). Session
+counts use the active fixed-length transcript block (`memory.usage.sessionBlockHours`, normally `5`).
 
 ```bash
-dz usage           # session ~74% (resets 19:00) · week ~52% (resets Sat) · estimated
-dz usage --json    # {"sessionPct":74,"weeklyPct":52,"sessionTokens":…,"resetsAt":{…},"limits":{…},"estimated":true}
+dz usage           # session ~74% (resets 19:00) · week ~76% fable-bound (resets 08:59) · estimated
+dz usage --json    # {"sessionPct":74,"weeklyPct":76,"sessionTokens":...,"weeklyTokens":...,"resetsAt":{...},"limits":{...},"estimated":true}
 ```
 
 **Exit code is 0 ALWAYS** (even unconfigured/error → all-null JSON) — a probe must never distinguish
-"usage unknown" from "command failed" via a non-zero exit. Percentages are **ESTIMATES** (there is no
-official usage API); they are `null` until you configure the plan-dependent limits in `.dz/config.json`:
+"usage unknown" from "command failed" via a non-zero exit. Percentages are **ESTIMATES** from local
+transcripts; claude.ai/settings/usage is authoritative. They are `null` until you configure the
+plan-dependent limits in `.dz/config.json`:
 
 ```json
-{ "memory": { "usage": { "sessionTokenLimit": 200000000, "weeklyTokenLimit": 1000000000 } } }
+{
+  "memory": {
+    "usage": {
+      "sessionTokenLimit": 200000000,
+      "weeklyTokenLimit": 1000000000,
+      "weeklyResetAnchor": "Wed 08:59",
+      "sessionBlockHours": 5,
+      "weeklyTokenLimitByModel": { "fable": 500000000 }
+    }
+  }
+}
+```
+
+`sessionTokenLimit` and `weeklyTokenLimit` are optional; absent means that pct is `null` (unknown,
+never `0`). `weeklyTokenLimit` is the all-model weekly limit. `weeklyTokenLimitByModel` is optional;
+when it has at least one valid model limit (`fable`, `opus`, `sonnet`, or `haiku`), `weeklyPct` is the
+binding per-model percentage and `--json` adds:
+
+```json
+{
+  "weeklyByModel": { "fable": { "tokens": 380, "pct": 76 } },
+  "limits": { "session": 200000000, "weekly": 1000000000, "weeklyByModel": { "fable": 500 } }
+}
+```
+
+When no per-model limits are configured, the JSON shape stays at the legacy fields:
+`sessionPct`, `weeklyPct`, `sessionTokens`, `weeklyTokens`, `resetsAt`, `limits`, `estimated`.
+
+Calibrate from human-transcribed claude.ai percentages with one command:
+
+```bash
+dz usage --calibrate --session 20 --weekly 50 --model fable=76 --project .
 ```
 
-Both keys are OPTIONAL — absent ⇒ that `pct` is `null` (unknown, never `0`). **Calibrate** by scaling a
-limit by `X/100` when a real limit-hit lands at an estimated `X%` (observed-exhaustion calibration).
+It computes each limit as `currentTokens / (pct / 100)`, writes only `memory.usage` in
+`.dz/config.json`, and records `calibratedAt` plus `source: "claude.ai/settings/usage"`. Invalid
+percentages, unknown models, missing transcripts, and zero-token calibration requests are skipped with
+exit code `0`.
+
 This feeds `/feature-adr`'s **usage-adaptive routing** — the pipeline probes `dz usage --json` at each
-phase boundary and pre-emptively routes the remaining stages to Codex when usage crosses the threshold
-(default 70%). **Honest caveat:** at TRUE exhaustion even the Codex dispatch dies (`codex:codex-rescue`
-is a Claude wrapper), so the switch must happen BEFORE — the pre-emptive probe, not reactive detection,
-is the real defense.
+phase boundary and pre-emptively routes the remaining stages to Codex when `sessionPct` or the binding
+`weeklyPct` crosses the threshold (default 70%). **Honest caveat:** at TRUE exhaustion even the Codex
+dispatch dies (`codex:codex-rescue` is a Claude wrapper), so the switch must happen BEFORE — the
+pre-emptive probe, not reactive detection, is the real defense.
+
+### Claim check (`dz claim-check`)
+
+Makes the Integrity Rule — *"no fake claims; verify before claiming success"* — a runnable check
+instead of prose. Every quantitative claim (coverage, test/skill/command counts, benchmarks) must be
+tagged `MEASURED` / `CLAIMED` / `SYNTHETIC` / `ESTIMATED` / `UNVALIDATED` / `BASELINE`, and a
+`MEASURED` claim must name its reproducer (`npm test`, a coverage report, `npm view`, a git ref).
+"100% / perfect" framing is always high severity.
+
+```bash
+dz claim-check                       # scans root README, every package README, features/*/08_qe_report.md
+dz claim-check docs/perf.md --json   # {"ok":false,"findings":[…],"scanned":[…]}
+dz claim-check --fail-on medium      # stricter gate for CI
+```
+
+**Exit-code contract:** `0` when ok; `1` only when a finding at or above `--fail-on` (default `high`)
+exists. `--json` always emits valid JSON, even on the failure path, and never throws on an
+unreadable, binary, or missing file — those are skipped and reported in `scanned`.
+
+`dz publish` runs the same check over each package's README. The gate defaults to `warn`: findings
+are surfaced but publish status is **never** changed. Pass `--claim-check error` to fail a package
+that carries a high-severity claim, or `--claim-check off` to disable it.
+
+```bash
+dz publish --filter harness-cli                      # warn (default): prints "⚠ claim-check: N finding(s) (M high)"
+dz publish --filter harness-cli --claim-check error  # a high finding fails THIS package only
+dz publish --filter harness-cli --claim-check off    # disable the gate entirely
+```
+
+Ported from rUv's [`ruview`](https://www.npmjs.com/package/@ruvnet/ruview) `src/guardrails.js` (MIT),
+which was itself written after a documented AI-slop incident. The detection semantics are kept
+verbatim — including a deliberately `\b`-free `100%` regex that looks like a bug and is not.
+
+**Honest note:** run on this repo it reports hundreds of medium findings and a handful of high ones
+(reproducer: `dz claim-check --json`, which prints the exact current counts — deliberately not frozen
+into this README, since any doc edit moves them). That is the point of the tool, not a defect in it:
+the high findings are real untagged perfect-score claims in our own documentation.
 
 ### Targets (10 platforms — 5 lossless + Copilot + AGENTS.md + Cursor + Gemini + Windsurf)
 

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAyJH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAitGD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAgH5E"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA8JH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAyiHD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAkH5E"}