@dzhechkov/harness-cli 0.3.227 → 0.3.228

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-cli",
-  "version": "0.3.227",
+  "version": "0.3.228",
   "description": "The dz CLI — install AI skills for Claude Code, Codex, OpenCode, Hermes, OpenClaude, GitHub Copilot. 35 commands, 13 presets, 6 platform targets.",
   "type": "module",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "@dzhechkov/skills-reverse-engineering": "^0.1.0",
     "@dzhechkov/skills-presentation-storyteller": "^0.1.0",
     "@dzhechkov/skills-website-cloner": "^0.1.0",
-    "@dzhechkov/harness-core": "0.3.120"
+    "@dzhechkov/harness-core": "0.3.121"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",

package/src/cli.ts

@@ -4,7 +4,7 @@
  * @packageDocumentation
  */
 
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, renameSync, rmdirSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execSync } from 'node:child_process';
@@ -101,6 +101,7 @@ import {
   buildSbom,
   resolveTrustRoot,
   decideVerifyPolicy,
+  generateSigningKeypair,
   decideProvenance,
   isInsideTree,
   signManifest,
@@ -3230,10 +3231,73 @@ function reportPackVerification(
 }
 
 function cmdSign(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
+  // `dz sign --init` — one-time keygen. Writes the PRIVATE key OUTSIDE the repo (default ~/.dz/keys/dz.key,
+  // mode 0600) and prints the PUBLIC key for the operator to commit as keys/dz.pub. The private key never
+  // touches the repo or a tarball (the hard invariant — enforced by assertKeyOutsideTree).
+  if (flags.has('init')) {
+    const outPath = resolve(cwd, options.get('out') ?? join(homedir(), '.dz', 'keys', 'dz.key'));
+    // Resolve symlinks BEFORE the containment check: an --out (or a parent dir) that is a symlink pointing
+    // INTO the repo would otherwise slip the private key inside the tree past a string-only guard — including a
+    // DANGLING symlink whose target does not exist yet (existsSync follows the link and reports false, so the
+    // symlink itself must be resolved via lstat/readlink, not existsSync).
+    const realTarget = ((): string => {
+      // walk up to the deepest path that exists as ANY entry (file, dir, or even a dangling symlink).
+      let anc = outPath;
+      const tail: string[] = [];
+      for (;;) {
+        try { lstatSync(anc); break; } catch { /* not present */ }
+        const parent = dirname(anc);
+        if (parent === anc) return outPath; // reached root without an existing entry
+        tail.unshift(basename(anc));
+        anc = parent;
+      }
+      let base: string;
+      try {
+        base = realpathSync(anc); // resolves dirs/files and any RESOLVABLE symlink chain
+      } catch {
+        // `anc` exists but realpath threw → a dangling symlink: resolve its immediate target by hand.
+        try { base = resolve(dirname(anc), readlinkSync(anc)); } catch { return outPath; }
+      }
+      return tail.length ? join(base, ...tail) : base;
+    })();
+    try {
+      assertKeyOutsideTree(realTarget, cwd);
+    } catch (err) {
+      write(`dz sign --init: ${(err as Error).message}`);
+      write('  choose an --out path (and parent) OUTSIDE the repository (e.g. ~/.dz/keys/dz.key)');
+      return 1;
+    }
+    if (existsSync(outPath) && !flags.has('force')) {
+      write(`dz sign --init: ${outPath} already exists — refusing to overwrite (pass --force to replace)`);
+      write('  overwriting a signing key orphans every pack signed with the old one.');
+      return 1;
+    }
+    const { privateKey, publicKey } = generateSigningKeypair();
+    try {
+      mkdirSync(dirname(outPath), { recursive: true });
+      // Unlink an existing file first: writeFileSync's `mode` is ignored when the file already exists, so a
+      // pre-existing 0644 key would stay world-readable after --force. Removing it forces a fresh 0600 create.
+      if (existsSync(outPath)) rmSync(outPath, { force: true });
+      writeFileSync(outPath, privateKey, { mode: 0o600 });
+      chmodSync(outPath, 0o600); // belt-and-suspenders: guarantee 0600 regardless of umask/prior state
+    } catch (err) {
+      write(`dz sign --init: could not write the private key to ${outPath}: ${(err as Error).message}`);
+      return 1;
+    }
+    write(`dz sign --init: Ed25519 keypair generated.`);
+    write(`  private key → ${outPath} (mode 0600, OUTSIDE the repo — never commit it)`);
+    write(`  public key  → commit the block below as ${TRUST_ROOT_REL}:`);
+    write('');
+    write(publicKey.trimEnd());
+    write('');
+    write(`  then: dz sign --pack <dir> --key ${outPath}   (sign a pack)`);
+    return 0;
+  }
+
   const pack = options.get('pack');
   const key = options.get('key');
   if (!pack || !key) {
-    write('dz sign: --pack <dir> and --key <path> are both required');
+    write('dz sign: --pack <dir> and --key <path> are both required (or: dz sign --init to generate a keypair)');
     write('  the key path MUST be outside the repository working tree (a leaked signing key is not revertible)');
     return 1;
   }
@@ -3285,6 +3349,37 @@ function cmdVerifyPack(options: Map<string, string>, flags: Set<string>, cwd: st
   return 1;
 }
 
+/**
+ * `dz sbom` — emit a CycloneDX 1.5 SBOM (Software Bill of Materials) for a pack, standalone (no signing).
+ * The same inventory `dz sign` writes as `sbom.json`, available on its own for audit/procurement. Components
+ * are the pack's shipped files with their SHA-256 — a file-level bill of materials for the pack.
+ *   --pack <dir>   the pack to inventory (required)
+ *   --out <file>   write here (default: print to stdout)
+ *   --json         (implied) SPDX/CycloneDX is already JSON
+ */
+function cmdSbom(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
+  const pack = options.get('pack');
+  if (!pack) { write('dz sbom: --pack <dir> is required'); return 1; }
+  const packDir = resolve(cwd, pack);
+  if (!existsSync(packDir)) { write(`dz sbom: no such pack: ${packDir}`); return 1; }
+
+  const files = packFiles(packDir);
+  if (files.length === 0) { write('dz sbom: the pack contains no files'); return 1; }
+  const manifest = buildManifest(packDir, basename(packDir), files);
+  const sbom = buildSbom(manifest);
+  const out = JSON.stringify(sbom, null, 2);
+
+  const outOpt = options.get('out');
+  if (outOpt !== undefined) {
+    const outPath = resolve(cwd, outOpt);
+    try { writeFileSync(outPath, out + '\n'); } catch (err) { write(`dz sbom: could not write ${outPath}: ${(err as Error).message}`); return 1; }
+    write(`dz sbom: ${sbom.components.length} component(s) → ${outPath} (CycloneDX ${sbom.specVersion})`);
+    return 0;
+  }
+  write(out);
+  return 0;
+}
+
 function cmdPublish(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
   // Reject unknown flags/options so a typo (e.g. `--dry-rum`) can NEVER be
   // silently swallowed and flip the command into live-publish mode.
@@ -4062,33 +4157,40 @@ function cmdDriftCheck(options: Map<string, string>, flags: Set<string>, cwd: st
     write(`allowlisted (accepted drift): ${r.allowlisted.map((d) => d.name).join(', ')}`);
   }
   write(`DRIFTED (unexpected, byte-differences between copies): ${r.drifted.length}`);
+  let driftExit = 0;
   if (r.drifted.length === 0) {
     write('✓ no unexpected intra-monorepo skill drift');
-    return 0;
-  }
-  write('');
-  write('skill'.padEnd(34) + 'copies  drift/total');
-  for (const d of r.drifted) {
-    write(
-      d.name.padEnd(34) +
-        String(d.copies).padStart(4) +
-        '    ' +
-        `${d.driftFiles}/${d.totalFiles}` +
-        (d.missingFiles ? ` (+${d.missingFiles} missing)` : ''),
-    );
+  } else {
+    write('');
+    write('skill'.padEnd(34) + 'copies  drift/total');
+    for (const d of r.drifted) {
+      write(
+        d.name.padEnd(34) +
+          String(d.copies).padStart(4) +
+          '    ' +
+          `${d.driftFiles}/${d.totalFiles}` +
+          (d.missingFiles ? ` (+${d.missingFiles} missing)` : ''),
+      );
+    }
+    write('');
+    write('→ fix each: heal drift, then commit. Remediation per skill:');
+    for (const d of r.drifted) {
+      const hasMeta = existsSync(join(root, 'packages', '@dzhechkov', 'skills-meta', d.name));
+      write(
+        hasMeta
+          ? `    dz sync-canonical ${d.name}`
+          : `    dz sync-canonical ${d.name} --from <a-known-good-copy>   (no skills-meta canonical)`,
+      );
+    }
+    write('  (accept a drift intentionally: add its name to .dz/drift-allowlist.json with a reason)');
+    driftExit = 1; // EXIT CODE 1 = the CI gate trips
   }
+  // Supplementary CI check: installed-pack signatures. A TAMPERED pack trips the gate (fatal); an unsigned
+  // pack or a missing trust root is reported, not fatal — the same warn/block posture as `dz doctor` (the
+  // primary signature gate). drift-check surfaces it so the CI drift view also flags a tampered pack.
   write('');
-  write('→ fix each: heal drift, then commit. Remediation per skill:');
-  for (const d of r.drifted) {
-    const hasMeta = existsSync(join(root, 'packages', '@dzhechkov', 'skills-meta', d.name));
-    write(
-      hasMeta
-        ? `    dz sync-canonical ${d.name}`
-        : `    dz sync-canonical ${d.name} --from <a-known-good-copy>   (no skills-meta canonical)`,
-    );
-  }
-  write('  (accept a drift intentionally: add its name to .dz/drift-allowlist.json with a reason)');
-  return 1; // EXIT CODE 1 = the CI gate trips
+  const sigFatal = reportPackVerification(root, options.get('pubkey'), flags.has('require-signing'), write);
+  return driftExit || sigFatal;
 }
 
 /**
@@ -5065,6 +5167,8 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
         return cmdClaimCheck(options, optionLists, flags, cwd, write);
       case 'sign':
         return cmdSign(options, flags, cwd, write);
+      case 'sbom':
+        return cmdSbom(options, flags, cwd, write);
       case 'verify-pack':
         return cmdVerifyPack(options, flags, cwd, write);
       case 'setup':