@dzhechkov/harness-cli 0.3.226 → 0.3.227

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-cli",
-  "version": "0.3.226",
+  "version": "0.3.227",
   "description": "The dz CLI — install AI skills for Claude Code, Codex, OpenCode, Hermes, OpenClaude, GitHub Copilot. 35 commands, 13 presets, 6 platform targets.",
   "type": "module",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "@dzhechkov/skills-reverse-engineering": "^0.1.0",
     "@dzhechkov/skills-presentation-storyteller": "^0.1.0",
     "@dzhechkov/skills-website-cloner": "^0.1.0",
-    "@dzhechkov/harness-core": "0.3.119"
+    "@dzhechkov/harness-core": "0.3.120"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",

package/src/cli.ts

@@ -4,11 +4,11 @@
  * @packageDocumentation
  */
 
-import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmdirSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, renameSync, rmdirSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execSync } from 'node:child_process';
-import { homedir } from 'node:os';
+import { homedir, tmpdir } from 'node:os';
 import { createRequire } from 'node:module';
 
 import {
@@ -142,6 +142,8 @@ import {
   readExistingForScaffold,
   assembleChallengeContext,
   buildChallengeBrief,
+  planDiscriminationCheck,
+  classifyDiscrimination,
   pickAdversaryModel,
   CHALLENGE_QUESTIONS,
   loadOutcomes,
@@ -4573,6 +4575,130 @@ function cmdChallenge(options: Map<string, string>, flags: Set<string>, cwd: str
   return 0;
 }
 
+/**
+ * `dz discrimination-check` — the §42 test-discrimination gate (feature learned from cve-bench/evaluate.mjs).
+ * feature-adr Step-8 already asserts the ADR safety property HAS a test; this asserts that test DISCRIMINATES:
+ * run the property test(s) in an isolated git worktree at the pre-feature base (default HEAD, since the feature
+ * diff is uncommitted mid-pipeline). They MUST go red without the feature diff — a green is a false green.
+ *
+ *   --test <a.test.ts[,b.test.ts]>  the property test file(s) mapped from the ADR Confirmation (comma list)
+ *   --base <ref>                    the base ref to fail against (default HEAD)
+ *   --name '<filter>'               optional -t test-name filter applied to every target
+ *   --runner '<cmd>'                test runner (default `npx vitest run`)
+ *   --json                          machine-readable {plan, results, verdict, finding}
+ *
+ * NEVER auto-aborts: a non-discriminating (false-green) test is reported as a HIGH finding for the owner to
+ * decide (dz's rule — a false gate kills trust). Exit code is 0 on a clean run regardless of verdict; 2 only on
+ * a usage/setup error, so a caller distinguishes "gate ran" from "gate could not run".
+ */
+function cmdDiscriminationCheck(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
+  let repoRoot = cwd;
+  try { repoRoot = execSync('git rev-parse --show-toplevel', { cwd, encoding: 'utf-8' }).trim() || cwd; } catch { /* not git */ }
+
+  const testArg = options.get('test');
+  if (testArg === undefined || testArg.trim() === '') {
+    write('dz discrimination-check: pass --test <property-test.ts[,...]> (the test(s) the ADR Confirmation names).');
+    return 2;
+  }
+  const nameFilter = options.get('name');
+  const propertyTests = testArg.split(',').map((s) => s.trim()).filter(Boolean).map((file) =>
+    nameFilter !== undefined && nameFilter.trim() !== '' ? { file, name: nameFilter.trim() } : { file });
+  const baseRef = options.get('base') ?? 'HEAD';
+  const runnerOpt = options.get('runner');
+
+  const plan = planDiscriminationCheck(runnerOpt !== undefined ? { baseRef, propertyTests, runner: runnerOpt } : { baseRef, propertyTests });
+
+  if (!plan.runnable) {
+    // No safe target to run → this is the existing "property untested" finding (empty propertyTests classify).
+    const result = classifyDiscrimination({ propertyTests: [], results: [] });
+    if (flags.has('json')) { write(JSON.stringify({ plan, results: [], ...result }, null, 2)); return 0; }
+    write(`discrimination-check: NOT RUN (${plan.reason ?? 'unknown'})`);
+    if (plan.rejected.length) write('  rejected: ' + plan.rejected.map((r) => `${r.file} (${r.reason})`).join(', '));
+    write(`  → ${result.finding?.detail ?? 'no property test to check'}`);
+    return 0;
+  }
+
+  // Execute the plan in a temp worktree WE own; substitute {{WORKTREE}} and always clean up.
+  // `git worktree add` must CREATE the path, so compute a fresh non-existent one (do NOT mkdtemp it).
+  const worktree = join(mkdtempSync(join(tmpdir(), 'dz-disc-')), 'wt');
+  const results: { file: string; name?: string; outcome: 'pass' | 'fail' | 'error' }[] = [];
+  try {
+    // 1) add the detached worktree at base (git creates `worktree`; its parent already exists).
+    const addCmd = plan.commands[0]!.replace(/\{\{WORKTREE\}\}/g, worktree);
+    execSync(addCmd, { cwd: repoRoot, stdio: 'pipe', encoding: 'utf-8' });
+
+    // 1b) a fresh worktree has NO node_modules — without this, every test fails to load (runner + deps
+    // unresolvable) and the gate collapses to always-VIA_ERROR, blind to false greens. Absolute-path
+    // symlinks point back at the main checkout's already-installed trees, robust across pnpm's layout.
+    const linkNodeModules = (relDir: string): void => {
+      const srcNm = join(repoRoot, relDir, 'node_modules');
+      if (!existsSync(srcNm)) return;
+      const dstNm = join(worktree, relDir, 'node_modules');
+      if (existsSync(dstNm)) return;
+      try { mkdirSync(dirname(dstNm), { recursive: true }); symlinkSync(srcNm, dstNm, 'dir'); } catch { /* best effort */ }
+    };
+    linkNodeModules('.'); // root (hoisted deps + .bin)
+    const pkgDirs = new Set<string>();
+    for (const t of plan.targets) {
+      let d = dirname(t.file);
+      while (d && d !== '.' && d !== sep) {
+        if (existsSync(join(repoRoot, d, 'package.json'))) { pkgDirs.add(d); break; }
+        d = dirname(d);
+      }
+    }
+    for (const d of pkgDirs) linkNodeModules(d);
+
+    // 2) copy each property test into the base worktree, then 3) run it and record pass/fail/error per target.
+    for (const t of plan.targets) {
+      try {
+        const src = resolve(repoRoot, t.file);
+        // containment guard (defense in depth beyond planDiscriminationCheck's path sanitation).
+        if (!resolve(src).startsWith(resolve(repoRoot) + sep)) { results.push(nameFor(t, 'error')); continue; }
+        const dst = join(worktree, t.file);
+        mkdirSync(dirname(dst), { recursive: true });
+        writeFileSync(dst, readFileSync(src));
+      } catch { results.push(nameFor(t, 'error')); continue; }
+
+      const runner = (runnerOpt !== undefined && plan.commands.some((c) => c.includes(runnerOpt))) ? runnerOpt : 'npx vitest run';
+      // t.file + t.name already passed the engine's strict sanitation (no quotes/metacharacters/leading-dash);
+      // still quote + `--` so a path can never be read as a runner option or split a word.
+      const nameArg = t.name ? ` -t '${t.name}'` : '';
+      try {
+        execSync(`${runner}${nameArg} -- '${t.file}'`, { cwd: worktree, stdio: 'pipe', encoding: 'utf-8' });
+        results.push(nameFor(t, 'pass')); // exit 0 → test PASSED at base → false green
+      } catch (e) {
+        // vitest exits non-zero on failure AND on load/compile error. Distinguish: a load error usually names
+        // "Cannot find module"/"Failed to load"/"No test files"; otherwise treat as an assertion failure (red).
+        const out = String((e as { stdout?: string; stderr?: string }).stdout ?? '') + String((e as { stderr?: string }).stderr ?? '');
+        const isLoadError = /cannot find module|failed to load|no test (files )?found|error: cannot|transform failed|esbuild/i.test(out);
+        results.push(nameFor(t, isLoadError ? 'error' : 'fail'));
+      }
+    }
+  } catch (e) {
+    if (flags.has('json')) { write(JSON.stringify({ plan, error: 'worktree-setup-failed', detail: String((e as Error).message).slice(0, 300) }, null, 2)); }
+    else write(`discrimination-check: could not create worktree at ${baseRef}: ${String((e as Error).message).slice(0, 200)}`);
+    return 2;
+  } finally {
+    try { execSync(`git worktree remove --force ${worktree}`, { cwd: repoRoot, stdio: 'pipe' }); } catch { /* fall through to rm */ }
+    // remove the whole mkdtemp parent (worktree is `<mkdtemp>/wt`), so nothing leaks under tmp even on error.
+    try { rmSync(dirname(worktree), { recursive: true, force: true }); } catch { /* best effort */ }
+    try { execSync('git worktree prune', { cwd: repoRoot, stdio: 'pipe' }); } catch { /* best effort */ }
+  }
+
+  const result = classifyDiscrimination({ propertyTests, results });
+  if (flags.has('json')) { write(JSON.stringify({ plan, results, ...result }, null, 2)); return 0; }
+
+  write(`discrimination-check @ ${baseRef} — verdict: ${result.aggregate}`);
+  for (const p of result.perTest) write(`  ${p.verdict === 'NON_DISCRIMINATING' ? '✗' : '✓'} ${p.file}${p.name ? ` (${p.name})` : ''}: ${p.verdict}`);
+  if (result.finding) write(`\n  [${result.finding.severity}] ${result.finding.title}\n  ${result.finding.detail}`);
+  return 0;
+}
+
+/** small helper: build a result row, omitting `name` when absent (exactOptionalPropertyTypes). */
+function nameFor(t: { file: string; name?: string }, outcome: 'pass' | 'fail' | 'error'): { file: string; name?: string; outcome: 'pass' | 'fail' | 'error' } {
+  return t.name !== undefined ? { file: t.file, name: t.name, outcome } : { file: t.file, outcome };
+}
+
 /**
  * `dz routing` — inspect the learned cost-optimal routing outcome store (feature learned-cost-routing). Shows
  * what `args.models[stage]='auto-cost'` currently believes per (stage, complexity-tier, model): gated
@@ -4987,6 +5113,8 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
         return cmdFeatureAdrSetup(options, flags, cwd, write);
       case 'challenge':
         return cmdChallenge(options, flags, cwd, write);
+      case 'discrimination-check':
+        return cmdDiscriminationCheck(options, flags, cwd, write);
       case 'routing':
         return cmdRouting(options, flags, cwd, write);
       case 'bto-optimize':