@dzhechkov/harness-cli 0.3.226 → 0.3.228

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-cli",
-  "version": "0.3.226",
+  "version": "0.3.228",
   "description": "The dz CLI — install AI skills for Claude Code, Codex, OpenCode, Hermes, OpenClaude, GitHub Copilot. 35 commands, 13 presets, 6 platform targets.",
   "type": "module",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "@dzhechkov/skills-reverse-engineering": "^0.1.0",
     "@dzhechkov/skills-presentation-storyteller": "^0.1.0",
     "@dzhechkov/skills-website-cloner": "^0.1.0",
-    "@dzhechkov/harness-core": "0.3.119"
+    "@dzhechkov/harness-core": "0.3.121"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",

package/src/cli.ts

@@ -4,11 +4,11 @@
  * @packageDocumentation
  */
 
-import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmdirSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execSync } from 'node:child_process';
-import { homedir } from 'node:os';
+import { homedir, tmpdir } from 'node:os';
 import { createRequire } from 'node:module';
 
 import {
@@ -101,6 +101,7 @@ import {
   buildSbom,
   resolveTrustRoot,
   decideVerifyPolicy,
+  generateSigningKeypair,
   decideProvenance,
   isInsideTree,
   signManifest,
@@ -142,6 +143,8 @@ import {
   readExistingForScaffold,
   assembleChallengeContext,
   buildChallengeBrief,
+  planDiscriminationCheck,
+  classifyDiscrimination,
   pickAdversaryModel,
   CHALLENGE_QUESTIONS,
   loadOutcomes,
@@ -3228,10 +3231,73 @@ function reportPackVerification(
 }
 
 function cmdSign(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
+  // `dz sign --init` — one-time keygen. Writes the PRIVATE key OUTSIDE the repo (default ~/.dz/keys/dz.key,
+  // mode 0600) and prints the PUBLIC key for the operator to commit as keys/dz.pub. The private key never
+  // touches the repo or a tarball (the hard invariant — enforced by assertKeyOutsideTree).
+  if (flags.has('init')) {
+    const outPath = resolve(cwd, options.get('out') ?? join(homedir(), '.dz', 'keys', 'dz.key'));
+    // Resolve symlinks BEFORE the containment check: an --out (or a parent dir) that is a symlink pointing
+    // INTO the repo would otherwise slip the private key inside the tree past a string-only guard — including a
+    // DANGLING symlink whose target does not exist yet (existsSync follows the link and reports false, so the
+    // symlink itself must be resolved via lstat/readlink, not existsSync).
+    const realTarget = ((): string => {
+      // walk up to the deepest path that exists as ANY entry (file, dir, or even a dangling symlink).
+      let anc = outPath;
+      const tail: string[] = [];
+      for (;;) {
+        try { lstatSync(anc); break; } catch { /* not present */ }
+        const parent = dirname(anc);
+        if (parent === anc) return outPath; // reached root without an existing entry
+        tail.unshift(basename(anc));
+        anc = parent;
+      }
+      let base: string;
+      try {
+        base = realpathSync(anc); // resolves dirs/files and any RESOLVABLE symlink chain
+      } catch {
+        // `anc` exists but realpath threw → a dangling symlink: resolve its immediate target by hand.
+        try { base = resolve(dirname(anc), readlinkSync(anc)); } catch { return outPath; }
+      }
+      return tail.length ? join(base, ...tail) : base;
+    })();
+    try {
+      assertKeyOutsideTree(realTarget, cwd);
+    } catch (err) {
+      write(`dz sign --init: ${(err as Error).message}`);
+      write('  choose an --out path (and parent) OUTSIDE the repository (e.g. ~/.dz/keys/dz.key)');
+      return 1;
+    }
+    if (existsSync(outPath) && !flags.has('force')) {
+      write(`dz sign --init: ${outPath} already exists — refusing to overwrite (pass --force to replace)`);
+      write('  overwriting a signing key orphans every pack signed with the old one.');
+      return 1;
+    }
+    const { privateKey, publicKey } = generateSigningKeypair();
+    try {
+      mkdirSync(dirname(outPath), { recursive: true });
+      // Unlink an existing file first: writeFileSync's `mode` is ignored when the file already exists, so a
+      // pre-existing 0644 key would stay world-readable after --force. Removing it forces a fresh 0600 create.
+      if (existsSync(outPath)) rmSync(outPath, { force: true });
+      writeFileSync(outPath, privateKey, { mode: 0o600 });
+      chmodSync(outPath, 0o600); // belt-and-suspenders: guarantee 0600 regardless of umask/prior state
+    } catch (err) {
+      write(`dz sign --init: could not write the private key to ${outPath}: ${(err as Error).message}`);
+      return 1;
+    }
+    write(`dz sign --init: Ed25519 keypair generated.`);
+    write(`  private key → ${outPath} (mode 0600, OUTSIDE the repo — never commit it)`);
+    write(`  public key  → commit the block below as ${TRUST_ROOT_REL}:`);
+    write('');
+    write(publicKey.trimEnd());
+    write('');
+    write(`  then: dz sign --pack <dir> --key ${outPath}   (sign a pack)`);
+    return 0;
+  }
+
   const pack = options.get('pack');
   const key = options.get('key');
   if (!pack || !key) {
-    write('dz sign: --pack <dir> and --key <path> are both required');
+    write('dz sign: --pack <dir> and --key <path> are both required (or: dz sign --init to generate a keypair)');
     write('  the key path MUST be outside the repository working tree (a leaked signing key is not revertible)');
     return 1;
   }
@@ -3283,6 +3349,37 @@ function cmdVerifyPack(options: Map<string, string>, flags: Set<string>, cwd: st
   return 1;
 }
 
+/**
+ * `dz sbom` — emit a CycloneDX 1.5 SBOM (Software Bill of Materials) for a pack, standalone (no signing).
+ * The same inventory `dz sign` writes as `sbom.json`, available on its own for audit/procurement. Components
+ * are the pack's shipped files with their SHA-256 — a file-level bill of materials for the pack.
+ *   --pack <dir>   the pack to inventory (required)
+ *   --out <file>   write here (default: print to stdout)
+ *   --json         (implied) SPDX/CycloneDX is already JSON
+ */
+function cmdSbom(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
+  const pack = options.get('pack');
+  if (!pack) { write('dz sbom: --pack <dir> is required'); return 1; }
+  const packDir = resolve(cwd, pack);
+  if (!existsSync(packDir)) { write(`dz sbom: no such pack: ${packDir}`); return 1; }
+
+  const files = packFiles(packDir);
+  if (files.length === 0) { write('dz sbom: the pack contains no files'); return 1; }
+  const manifest = buildManifest(packDir, basename(packDir), files);
+  const sbom = buildSbom(manifest);
+  const out = JSON.stringify(sbom, null, 2);
+
+  const outOpt = options.get('out');
+  if (outOpt !== undefined) {
+    const outPath = resolve(cwd, outOpt);
+    try { writeFileSync(outPath, out + '\n'); } catch (err) { write(`dz sbom: could not write ${outPath}: ${(err as Error).message}`); return 1; }
+    write(`dz sbom: ${sbom.components.length} component(s) → ${outPath} (CycloneDX ${sbom.specVersion})`);
+    return 0;
+  }
+  write(out);
+  return 0;
+}
+
 function cmdPublish(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
   // Reject unknown flags/options so a typo (e.g. `--dry-rum`) can NEVER be
   // silently swallowed and flip the command into live-publish mode.
@@ -4060,33 +4157,40 @@ function cmdDriftCheck(options: Map<string, string>, flags: Set<string>, cwd: st
     write(`allowlisted (accepted drift): ${r.allowlisted.map((d) => d.name).join(', ')}`);
   }
   write(`DRIFTED (unexpected, byte-differences between copies): ${r.drifted.length}`);
+  let driftExit = 0;
   if (r.drifted.length === 0) {
     write('✓ no unexpected intra-monorepo skill drift');
-    return 0;
-  }
-  write('');
-  write('skill'.padEnd(34) + 'copies  drift/total');
-  for (const d of r.drifted) {
-    write(
-      d.name.padEnd(34) +
-        String(d.copies).padStart(4) +
-        '    ' +
-        `${d.driftFiles}/${d.totalFiles}` +
-        (d.missingFiles ? ` (+${d.missingFiles} missing)` : ''),
-    );
+  } else {
+    write('');
+    write('skill'.padEnd(34) + 'copies  drift/total');
+    for (const d of r.drifted) {
+      write(
+        d.name.padEnd(34) +
+          String(d.copies).padStart(4) +
+          '    ' +
+          `${d.driftFiles}/${d.totalFiles}` +
+          (d.missingFiles ? ` (+${d.missingFiles} missing)` : ''),
+      );
+    }
+    write('');
+    write('→ fix each: heal drift, then commit. Remediation per skill:');
+    for (const d of r.drifted) {
+      const hasMeta = existsSync(join(root, 'packages', '@dzhechkov', 'skills-meta', d.name));
+      write(
+        hasMeta
+          ? `    dz sync-canonical ${d.name}`
+          : `    dz sync-canonical ${d.name} --from <a-known-good-copy>   (no skills-meta canonical)`,
+      );
+    }
+    write('  (accept a drift intentionally: add its name to .dz/drift-allowlist.json with a reason)');
+    driftExit = 1; // EXIT CODE 1 = the CI gate trips
   }
+  // Supplementary CI check: installed-pack signatures. A TAMPERED pack trips the gate (fatal); an unsigned
+  // pack or a missing trust root is reported, not fatal — the same warn/block posture as `dz doctor` (the
+  // primary signature gate). drift-check surfaces it so the CI drift view also flags a tampered pack.
   write('');
-  write('→ fix each: heal drift, then commit. Remediation per skill:');
-  for (const d of r.drifted) {
-    const hasMeta = existsSync(join(root, 'packages', '@dzhechkov', 'skills-meta', d.name));
-    write(
-      hasMeta
-        ? `    dz sync-canonical ${d.name}`
-        : `    dz sync-canonical ${d.name} --from <a-known-good-copy>   (no skills-meta canonical)`,
-    );
-  }
-  write('  (accept a drift intentionally: add its name to .dz/drift-allowlist.json with a reason)');
-  return 1; // EXIT CODE 1 = the CI gate trips
+  const sigFatal = reportPackVerification(root, options.get('pubkey'), flags.has('require-signing'), write);
+  return driftExit || sigFatal;
 }
 
 /**
@@ -4573,6 +4677,130 @@ function cmdChallenge(options: Map<string, string>, flags: Set<string>, cwd: str
   return 0;
 }
 
+/**
+ * `dz discrimination-check` — the §42 test-discrimination gate (feature learned from cve-bench/evaluate.mjs).
+ * feature-adr Step-8 already asserts the ADR safety property HAS a test; this asserts that test DISCRIMINATES:
+ * run the property test(s) in an isolated git worktree at the pre-feature base (default HEAD, since the feature
+ * diff is uncommitted mid-pipeline). They MUST go red without the feature diff — a green is a false green.
+ *
+ *   --test <a.test.ts[,b.test.ts]>  the property test file(s) mapped from the ADR Confirmation (comma list)
+ *   --base <ref>                    the base ref to fail against (default HEAD)
+ *   --name '<filter>'               optional -t test-name filter applied to every target
+ *   --runner '<cmd>'                test runner (default `npx vitest run`)
+ *   --json                          machine-readable {plan, results, verdict, finding}
+ *
+ * NEVER auto-aborts: a non-discriminating (false-green) test is reported as a HIGH finding for the owner to
+ * decide (dz's rule — a false gate kills trust). Exit code is 0 on a clean run regardless of verdict; 2 only on
+ * a usage/setup error, so a caller distinguishes "gate ran" from "gate could not run".
+ */
+function cmdDiscriminationCheck(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
+  let repoRoot = cwd;
+  try { repoRoot = execSync('git rev-parse --show-toplevel', { cwd, encoding: 'utf-8' }).trim() || cwd; } catch { /* not git */ }
+
+  const testArg = options.get('test');
+  if (testArg === undefined || testArg.trim() === '') {
+    write('dz discrimination-check: pass --test <property-test.ts[,...]> (the test(s) the ADR Confirmation names).');
+    return 2;
+  }
+  const nameFilter = options.get('name');
+  const propertyTests = testArg.split(',').map((s) => s.trim()).filter(Boolean).map((file) =>
+    nameFilter !== undefined && nameFilter.trim() !== '' ? { file, name: nameFilter.trim() } : { file });
+  const baseRef = options.get('base') ?? 'HEAD';
+  const runnerOpt = options.get('runner');
+
+  const plan = planDiscriminationCheck(runnerOpt !== undefined ? { baseRef, propertyTests, runner: runnerOpt } : { baseRef, propertyTests });
+
+  if (!plan.runnable) {
+    // No safe target to run → this is the existing "property untested" finding (empty propertyTests classify).
+    const result = classifyDiscrimination({ propertyTests: [], results: [] });
+    if (flags.has('json')) { write(JSON.stringify({ plan, results: [], ...result }, null, 2)); return 0; }
+    write(`discrimination-check: NOT RUN (${plan.reason ?? 'unknown'})`);
+    if (plan.rejected.length) write('  rejected: ' + plan.rejected.map((r) => `${r.file} (${r.reason})`).join(', '));
+    write(`  → ${result.finding?.detail ?? 'no property test to check'}`);
+    return 0;
+  }
+
+  // Execute the plan in a temp worktree WE own; substitute {{WORKTREE}} and always clean up.
+  // `git worktree add` must CREATE the path, so compute a fresh non-existent one (do NOT mkdtemp it).
+  const worktree = join(mkdtempSync(join(tmpdir(), 'dz-disc-')), 'wt');
+  const results: { file: string; name?: string; outcome: 'pass' | 'fail' | 'error' }[] = [];
+  try {
+    // 1) add the detached worktree at base (git creates `worktree`; its parent already exists).
+    const addCmd = plan.commands[0]!.replace(/\{\{WORKTREE\}\}/g, worktree);
+    execSync(addCmd, { cwd: repoRoot, stdio: 'pipe', encoding: 'utf-8' });
+
+    // 1b) a fresh worktree has NO node_modules — without this, every test fails to load (runner + deps
+    // unresolvable) and the gate collapses to always-VIA_ERROR, blind to false greens. Absolute-path
+    // symlinks point back at the main checkout's already-installed trees, robust across pnpm's layout.
+    const linkNodeModules = (relDir: string): void => {
+      const srcNm = join(repoRoot, relDir, 'node_modules');
+      if (!existsSync(srcNm)) return;
+      const dstNm = join(worktree, relDir, 'node_modules');
+      if (existsSync(dstNm)) return;
+      try { mkdirSync(dirname(dstNm), { recursive: true }); symlinkSync(srcNm, dstNm, 'dir'); } catch { /* best effort */ }
+    };
+    linkNodeModules('.'); // root (hoisted deps + .bin)
+    const pkgDirs = new Set<string>();
+    for (const t of plan.targets) {
+      let d = dirname(t.file);
+      while (d && d !== '.' && d !== sep) {
+        if (existsSync(join(repoRoot, d, 'package.json'))) { pkgDirs.add(d); break; }
+        d = dirname(d);
+      }
+    }
+    for (const d of pkgDirs) linkNodeModules(d);
+
+    // 2) copy each property test into the base worktree, then 3) run it and record pass/fail/error per target.
+    for (const t of plan.targets) {
+      try {
+        const src = resolve(repoRoot, t.file);
+        // containment guard (defense in depth beyond planDiscriminationCheck's path sanitation).
+        if (!resolve(src).startsWith(resolve(repoRoot) + sep)) { results.push(nameFor(t, 'error')); continue; }
+        const dst = join(worktree, t.file);
+        mkdirSync(dirname(dst), { recursive: true });
+        writeFileSync(dst, readFileSync(src));
+      } catch { results.push(nameFor(t, 'error')); continue; }
+
+      const runner = (runnerOpt !== undefined && plan.commands.some((c) => c.includes(runnerOpt))) ? runnerOpt : 'npx vitest run';
+      // t.file + t.name already passed the engine's strict sanitation (no quotes/metacharacters/leading-dash);
+      // still quote + `--` so a path can never be read as a runner option or split a word.
+      const nameArg = t.name ? ` -t '${t.name}'` : '';
+      try {
+        execSync(`${runner}${nameArg} -- '${t.file}'`, { cwd: worktree, stdio: 'pipe', encoding: 'utf-8' });
+        results.push(nameFor(t, 'pass')); // exit 0 → test PASSED at base → false green
+      } catch (e) {
+        // vitest exits non-zero on failure AND on load/compile error. Distinguish: a load error usually names
+        // "Cannot find module"/"Failed to load"/"No test files"; otherwise treat as an assertion failure (red).
+        const out = String((e as { stdout?: string; stderr?: string }).stdout ?? '') + String((e as { stderr?: string }).stderr ?? '');
+        const isLoadError = /cannot find module|failed to load|no test (files )?found|error: cannot|transform failed|esbuild/i.test(out);
+        results.push(nameFor(t, isLoadError ? 'error' : 'fail'));
+      }
+    }
+  } catch (e) {
+    if (flags.has('json')) { write(JSON.stringify({ plan, error: 'worktree-setup-failed', detail: String((e as Error).message).slice(0, 300) }, null, 2)); }
+    else write(`discrimination-check: could not create worktree at ${baseRef}: ${String((e as Error).message).slice(0, 200)}`);
+    return 2;
+  } finally {
+    try { execSync(`git worktree remove --force ${worktree}`, { cwd: repoRoot, stdio: 'pipe' }); } catch { /* fall through to rm */ }
+    // remove the whole mkdtemp parent (worktree is `<mkdtemp>/wt`), so nothing leaks under tmp even on error.
+    try { rmSync(dirname(worktree), { recursive: true, force: true }); } catch { /* best effort */ }
+    try { execSync('git worktree prune', { cwd: repoRoot, stdio: 'pipe' }); } catch { /* best effort */ }
+  }
+
+  const result = classifyDiscrimination({ propertyTests, results });
+  if (flags.has('json')) { write(JSON.stringify({ plan, results, ...result }, null, 2)); return 0; }
+
+  write(`discrimination-check @ ${baseRef} — verdict: ${result.aggregate}`);
+  for (const p of result.perTest) write(`  ${p.verdict === 'NON_DISCRIMINATING' ? '✗' : '✓'} ${p.file}${p.name ? ` (${p.name})` : ''}: ${p.verdict}`);
+  if (result.finding) write(`\n  [${result.finding.severity}] ${result.finding.title}\n  ${result.finding.detail}`);
+  return 0;
+}
+
+/** small helper: build a result row, omitting `name` when absent (exactOptionalPropertyTypes). */
+function nameFor(t: { file: string; name?: string }, outcome: 'pass' | 'fail' | 'error'): { file: string; name?: string; outcome: 'pass' | 'fail' | 'error' } {
+  return t.name !== undefined ? { file: t.file, name: t.name, outcome } : { file: t.file, outcome };
+}
+
 /**
  * `dz routing` — inspect the learned cost-optimal routing outcome store (feature learned-cost-routing). Shows
  * what `args.models[stage]='auto-cost'` currently believes per (stage, complexity-tier, model): gated
@@ -4939,6 +5167,8 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
         return cmdClaimCheck(options, optionLists, flags, cwd, write);
       case 'sign':
         return cmdSign(options, flags, cwd, write);
+      case 'sbom':
+        return cmdSbom(options, flags, cwd, write);
       case 'verify-pack':
         return cmdVerifyPack(options, flags, cwd, write);
       case 'setup':
@@ -4987,6 +5217,8 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
         return cmdFeatureAdrSetup(options, flags, cwd, write);
       case 'challenge':
         return cmdChallenge(options, flags, cwd, write);
+      case 'discrimination-check':
+        return cmdDiscriminationCheck(options, flags, cwd, write);
       case 'routing':
         return cmdRouting(options, flags, cwd, write);
       case 'bto-optimize':