@dzhechkov/harness-cli 0.3.231 → 0.3.233

package/.dz-manifest.json

@@ -0,0 +1,137 @@
+{
+  "manifest": {
+    "version": 1,
+    "pack": "harness-cli",
+    "files": [
+      {
+        "path": ".agentic-qe/brain.rvf",
+        "sha256": "8136cd4cc145d3dbe6ed3ae4489946bbc26e3e44172f0e5241ac45dde38bfead"
+      },
+      {
+        "path": ".agentic-qe/brain.rvf.lock",
+        "sha256": "028658845c4fc1e9bd9487b575be0aee727d477fa9ad1b08c26299ce61f622c3"
+      },
+      {
+        "path": ".agentic-qe/memory.db",
+        "sha256": "456372cb9a8c12f98ae6378338b8469d9be6df05cbe03a99b412d83d962b3d11"
+      },
+      {
+        "path": ".agentic-qe/memory.db-shm",
+        "sha256": "23ae1f330a8fad23eabe444e89dc9d4588297cc1abca5929356eb6fec9f5079d"
+      },
+      {
+        "path": ".agentic-qe/memory.db-wal",
+        "sha256": "2eade3dbce1a9fd33a0775269af13fe97c62fdf1dbf44a8569ba0e7341315433"
+      },
+      {
+        "path": ".agentic-qe/patterns.rvf",
+        "sha256": "9090b2e6d339eaa183672ac0cf9f625dbd5f9fc76d64afcdb34a3f5871c31c5a"
+      },
+      {
+        "path": ".agentic-qe/patterns.rvf.idmap.json",
+        "sha256": "c2693f9a7f47a2d2bffe3004188e70ce08411bf8db47d07c60551d18ff7640c4"
+      },
+      {
+        "path": ".agentic-qe/patterns.rvf.lock",
+        "sha256": "b28a956544f4358d57df98fc6c8df0b8f5d5cd8e8b102cee80ed3aabdf0a112b"
+      },
+      {
+        "path": "CHANGELOG.md",
+        "sha256": "9555ead768fef7963e735b0c6af21a64412811531534108be3df61bc65b51021"
+      },
+      {
+        "path": "README.md",
+        "sha256": "406be5cb9294367793daed191b2418bb99669186c8ead8a3a3f994f0db36e1b6"
+      },
+      {
+        "path": "coverage/coverage-final.json",
+        "sha256": "1abb00d07ab57ad413d2747baa6a68cda0876a9e0c6f75db89c205fbf4863530"
+      },
+      {
+        "path": "coverage/coverage-summary.json",
+        "sha256": "42d2a98f54c2ec773b49a0a43c959a78d070c8c427724f4affbd5bafef35621d"
+      },
+      {
+        "path": "dist/bin.d.ts",
+        "sha256": "58be9f04d2fe63cca2efe3957b9933068e443a0e57f9838ff9ef800cc191e03f"
+      },
+      {
+        "path": "dist/bin.d.ts.map",
+        "sha256": "b1e41c8c19fa56ae9dec2267740eb4389bc785431478861a8843867f99c1b25b"
+      },
+      {
+        "path": "dist/bin.js",
+        "sha256": "ad24e06de21b036e2b5a43abc4efd6e7ceb2ae126177b218a3ee13a026641f83"
+      },
+      {
+        "path": "dist/bin.js.map",
+        "sha256": "c2dd399fec3f26e48e23971b29e27c508c1a1f96376a193e72dc8042015c8e65"
+      },
+      {
+        "path": "dist/cli.d.ts",
+        "sha256": "d304769099f8a7f79ba6c295e0348c2aa211527b050dbfff597f7e87c2b80505"
+      },
+      {
+        "path": "dist/cli.d.ts.map",
+        "sha256": "680727bef753625ed99fd9d79ab846c9024608ef0f88d19ee2c8aec25eccf130"
+      },
+      {
+        "path": "dist/cli.js",
+        "sha256": "672bc2fd640d9a92b5af7bfe2880843a770bfedd610f679ae022892fa7c8e66c"
+      },
+      {
+        "path": "dist/cli.js.map",
+        "sha256": "08ec7cf51a49ec818b789cbb6f32b8fc71756e498c99d8756212d16329a8b147"
+      },
+      {
+        "path": "dist/index.d.ts",
+        "sha256": "c1ddc3aa44ca13264d54a72ad8376d8321de06ab48262eb2a6c8d5023c011bb6"
+      },
+      {
+        "path": "dist/index.d.ts.map",
+        "sha256": "a8697ddfabf35947e17a255fce26dfee141f2184f6789c32ba1de75dcd80e36c"
+      },
+      {
+        "path": "dist/index.js",
+        "sha256": "15ff1e6b84537b91b73b6a7e2d1c45f1120b25af9d1139df8da8ad094e99cf0e"
+      },
+      {
+        "path": "dist/index.js.map",
+        "sha256": "2f61a3be1af4ab9f7bbcbacb912ccbd89e3b73414f9fd24766598bfbdc1f8655"
+      },
+      {
+        "path": "keys/README.md",
+        "sha256": "204deec657a7f147bf3016441082c2f868f6f11051776f4edc13ec6b44745192"
+      },
+      {
+        "path": "package.json",
+        "sha256": "b48c494a4d4e2126e033c2d0019e463b9ad6cd3bae7a2aa0da296eba1ab66fcf"
+      },
+      {
+        "path": "src/bin.ts",
+        "sha256": "a0d4e20fafc5cba35816f1f0c6cd03d9ce7c4434d2ca049384491079d2408fd4"
+      },
+      {
+        "path": "src/cli.ts",
+        "sha256": "14ca947c27f366c1377c129b3def86cdd4577536249e44f0009f31884fff9018"
+      },
+      {
+        "path": "src/index.ts",
+        "sha256": "f0aea91d07867603d177da6029f97851ced0b91b62e9db5d0bab5b464f794a91"
+      },
+      {
+        "path": "test/cli.test.ts",
+        "sha256": "d9374e1cc23923c2d5c4cca1e228f31e2c3465f187d1c84cf3f50ad947401537"
+      },
+      {
+        "path": "tsconfig.json",
+        "sha256": "e80ef2911c3347a713dc3dca6a5f6034d91e938e58e71345ea920dd9833bcdbb"
+      },
+      {
+        "path": "vitest.config.ts",
+        "sha256": "a6ffc6172b50a3a59010f8f8c66e2204e7d298b62a7f2bc5de33cbf39c99899d"
+      }
+    ]
+  },
+  "signature": "Vt+64ve0S3VUr7RQQ1sKTxBPCcNyOcMW/F1auDLC8k9ljNGhORaNolB0WZ9xdXN2ZsGz8jQLH0ttajx6eHLxCA=="
+}

package/README.md

@@ -307,7 +307,9 @@ dz sbom --pack packages/@dzhechkov/skills-qe --out sbom.json # write to a file
 ```
 
 A single flipped byte, a deleted file, or an **added** file all fail verification and the offending
-path is named. Every degenerate input (no manifest, empty file list, empty signature, no public key)
+path is named. `node_modules`/`.git` are unsigned territory by design (npm ships neither) — the sign and
+verify walks share those exclusions, while a symlink smuggled anywhere ELSE in the pack still fails loudly.
+Re-sign after ANY pack change (the manifest hashes `package.json` too) — sign is the LAST step before publish. Every degenerate input (no manifest, empty file list, empty signature, no public key)
 fails **closed** — absence never reads as success. `dz doctor` **and** `dz drift-check` run this check
 over the installed packs: a **tampered** pack is fatal (blocks); an **unsigned** pack or a missing trust
 root is reported, not fatal (transitional — the existing packs are not yet signed).
@@ -327,7 +329,7 @@ every run; `--require-signing` turns that into a refusal today.
 verifies what it just installed. A pack that does not match its signed manifest is **fatal**:
 
 ```bash
-dz doctor                      # ... signatures: 3 verified, 0 unsigned, 0 TAMPERED, 0 unverifiable
+dz doctor                      # ... signatures: 23 verified, 0 unsigned, 0 TAMPERED (the gate is ARMED: keys/dz.pub committed)
 dz doctor --require-signing    # an unsigned pack becomes fatal too
 dz upgrade                     # a TAMPERED pack aborts the upgrade
 dz doctor --pubkey ./my.pub    # verify against a key you pinned yourself
@@ -501,6 +503,7 @@ dz discrimination-check --test <f[,f]> [--base <ref>] [--name <filter>] [--runne
 dz sign --init --out <path>  |  --pack <dir> --key <path>   # --init: generate the Ed25519 keypair (private OUTSIDE the repo, prints the public key for keys/dz.pub); else sign a pack's manifest + CycloneDX SBOM
 dz sbom --pack <dir> [--out <file>]   # emit the CycloneDX 1.5 SBOM for a pack standalone (file-level bill of materials); print to stdout or write to a file
 dz guard check --op <publish|teach|consolidate|reindex> [--text <s>] [--json] [--force <reason>]   # declarative constraint layer before self-mutating ops: HARD violation → block (exit 1), SOFT → warn; zero-config defaults, .dz/guard.json to customise; dz guard --init | dz guard log (append-only audit). dz publish runs it automatically (--no-guard "<reason>" = logged escape hatch)
+dz feature-adr-setup --guards [--loc-cap <n>] [--apply]   # P3: scaffold DETERMINISTIC guard tests into the project — guards.config.json + a zero-dependency check.mjs runner (LOC cap, secret scan, frozen-file sha256 pins, waivers-with-reasons); wire `node architecture/guards/check.mjs` into CI
 dz publish           [--filter <name>] [--bump-only] [--claim-check <off|warn|error>]   (dry-run by default; pass --yes/--confirm to go live; claim-check gate defaults to warn — surfaces README claim findings, never blocks)
 dz auto-canonicalize --source <github-url> --pack <skills-pack>
 dz sync-upstream     [--package <dir>] [--list] [--all]
@@ -1619,6 +1622,27 @@ visible, never silent. Calibrated against false gates: in a pnpm workspace, `wor
 *correct* (pnpm rewrites it at publish), so the rule resolves each workspace dep to the version it would
 ship as and blocks only a dep that would ship raw.
 
+### `dz feature-adr-setup --guards` — when a project rule should be a TEST, not a reviewer's memory
+
+A 700-line cap enforced by reviewer judgment catches one file and misses its sibling in the same change;
+`wc -l` catches both, always (the cost-of-detection ladder). `--guards` scaffolds a deterministic guard set
+into the TARGET project — no framework, no dependency, any stack with Node:
+```bash
+dz feature-adr-setup --guards            # preview (existing files are never clobbered)
+dz feature-adr-setup --guards --apply    # writes architecture/guards/{guards.config.json,check.mjs}
+node architecture/guards/check.mjs       # run locally / wire into CI or the test command
+```
+```
+guards: ✗ 1 violation(s)
+  [loc-cap] src/huge.ts — 801 lines > cap 700
+```
+Three deterministic rules, each with a **waiver mechanism that requires a reason** (a waiver without one is
+itself a violation — a conscious exception is recorded, not silently allowed): **loc-cap** (god-object
+guard, `--loc-cap <n>` tunes, default 700), **secret-scan** (the same high-signal credential shapes as
+`dz guard`), **frozen-files** (sha256 pins for files that must not change silently). The config is data —
+edit caps/paths/waivers in `guards.config.json`; the project-critic role should then *not* re-flag these
+rules, only waivers without a reason.
+
 ### Semantic recall (vector tier)
 
 `dz recall` is **hybrid** when the vector tier is available and **exactly the old lexical command** when it is not — enabling it never changes behavior for projects that skip it.

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiPH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AA47JD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA4I5E"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkPH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAg8JD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA4I5E"}

package/dist/cli.js

@@ -9,7 +9,7 @@ import { fileURLToPath } from 'node:url';
 import { execSync } from 'node:child_process';
 import { homedir, tmpdir } from 'node:os';
 import { createRequire } from 'node:module';
-import { createSkill, getSkillInfo, getWorkflow, isTargetName, listSkills, runDoctor, runInit, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, TARGET_NAMES, WORKFLOW_NAMES, importEcc, recordPattern, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, statuslineData, writeFeatureAdrState, computeUsage, deriveUsageCalibration, normalizeClaudeUsageModelKey, readUsageLimits, claimCheck, summarize, queryBookKnowledge, loadStorePatternsSync, patternRecordId, loadStoreRecords, recordToPattern, bundleSkills, brainHome, listBrain, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, decideProvenance, isInsideTree, signManifest, verifyManifest, assertKeyOutsideTree, decidePublishGate, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, } from '@dzhechkov/harness-core';
+import { createSkill, getSkillInfo, getWorkflow, isTargetName, listSkills, runDoctor, runInit, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, TARGET_NAMES, WORKFLOW_NAMES, importEcc, recordPattern, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, statuslineData, writeFeatureAdrState, computeUsage, deriveUsageCalibration, normalizeClaudeUsageModelKey, readUsageLimits, claimCheck, summarize, queryBookKnowledge, loadStorePatternsSync, patternRecordId, loadStoreRecords, recordToPattern, bundleSkills, brainHome, listBrain, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, decideProvenance, isInsideTree, signManifest, verifyManifest, listSignablePackFiles, assertKeyOutsideTree, decidePublishGate, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, } from '@dzhechkov/harness-core';
 import { getPreset, PRESET_NAMES } from '@dzhechkov/harness-presets';
 import { scanGitHub, analyzeRepo, generateReport, deepAnalyze, scanAllSources, ScoutMemory } from '@dzhechkov/scout';
 const USAGE = `dz - DZ cross-platform harness CLI
@@ -2784,25 +2784,9 @@ async function cmdAutoCanonicalize(options, cwd, write) {
 }
 /** The pinned trust root. A key inside the artifact under verification is data, not a key (ADR-001). */
 const TRUST_ROOT_REL = 'keys/dz.pub';
-function packFiles(dir) {
-    const out = [];
-    const walk = (d, rel) => {
-        for (const e of readdirSync(d, { withFileTypes: true })) {
-            if (e.name === 'node_modules' || e.name === '.git')
-                continue;
-            if (e.name === MANIFEST_NAME || e.name === SBOM_NAME)
-                continue;
-            const abs = join(d, e.name);
-            const r = rel ? rel + '/' + e.name : e.name;
-            if (e.isDirectory())
-                walk(abs, r);
-            else if (e.isFile())
-                out.push(r);
-        }
-    };
-    walk(dir, '');
-    return out.sort();
-}
+// One walk to rule both: the SIGN file list is core's listPackFiles — the SAME function verify uses for
+// its added-file sweep, so the two can never drift apart again (the 10-false-TAMPERED lesson, task #36).
+const packFiles = (dir) => listSignablePackFiles(dir);
 /**
  * The consumer-side apply-leg (ADR-001, verify-apply-leg). All security content lives in the two pure
  * functions in harness-core; this only resolves paths, reads bytes, and reports.
@@ -4512,11 +4496,21 @@ async function cmdRetro(options, flags, cwd, write) {
 function cmdFeatureAdrSetup(options, flags, cwd, write) {
     let repoRoot = cwd;
     try {
-        repoRoot = execSync('git rev-parse --show-toplevel', { cwd, encoding: 'utf-8' }).trim() || cwd;
+        repoRoot = execSync('git rev-parse --show-toplevel', { cwd, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim() || cwd;
     }
     catch { /* not git */ }
+    // P3 (fa-improvements): --guards scaffolds the deterministic guard set (guards.config.json + the
+    // zero-dependency check.mjs runner) — usable standalone (`dz feature-adr-setup --guards --apply`) or
+    // together with --from-spec. --loc-cap <n> tunes the LOC cap (default 700).
+    const wantGuards = flags.has('guards');
+    const locCapRaw = options.get('loc-cap');
+    const locCap = locCapRaw !== undefined ? Number(locCapRaw) : undefined;
+    if (locCapRaw !== undefined && (!Number.isFinite(locCap) || locCap <= 0)) {
+        write('dz feature-adr-setup: --loc-cap must be a positive finite number');
+        return 1;
+    }
     const specPath = options.get('from-spec');
-    if (specPath === undefined) {
+    if (specPath === undefined && !wantGuards) {
         // default + --plan: the read-only "which documents, and where?" answer.
         const plan = buildSetupPlan(scanForSetup(repoRoot));
         if (flags.has('json')) {
@@ -4538,15 +4532,22 @@ function cmdFeatureAdrSetup(options, flags, cwd, write) {
             write('  → the `configure-feature-adr` skill walks you through the missing docs; or pass a filled spec with --from-spec.');
         return 0;
     }
-    // --from-spec: scaffold (preview, or --apply to write).
+    // --from-spec and/or --guards: scaffold (preview, or --apply to write).
     let spec;
-    try {
-        spec = JSON.parse(readFileSync(resolve(cwd, specPath), 'utf-8'));
+    if (specPath !== undefined) {
+        try {
+            spec = JSON.parse(readFileSync(resolve(cwd, specPath), 'utf-8'));
+        }
+        catch (e) {
+            write(`dz feature-adr-setup: cannot read spec ${specPath}: ${e instanceof Error ? e.message : String(e)}`);
+            return 1;
+        }
     }
-    catch (e) {
-        write(`dz feature-adr-setup: cannot read spec ${specPath}: ${e instanceof Error ? e.message : String(e)}`);
-        return 1;
+    else {
+        spec = {}; // --guards standalone: scaffold just the guard set
     }
+    if (wantGuards)
+        spec = { ...spec, guards: locCap !== undefined ? { locCap } : true };
     const result = scaffoldFromSpec(spec, readExistingForScaffold(repoRoot));
     if (flags.has('json') && !flags.has('apply')) {
         write(JSON.stringify(result, null, 2));