@dzhechkov/harness-cli 0.3.231 → 0.3.233

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-cli",
-  "version": "0.3.231",
+  "version": "0.3.233",
   "description": "The dz CLI — install AI skills for Claude Code, Codex, OpenCode, Hermes, OpenClaude, GitHub Copilot. 35 commands, 13 presets, 6 platform targets.",
   "type": "module",
   "license": "MIT",
@@ -36,7 +36,9 @@
     "dist",
     "src",
     "README.md",
-    "keys"
+    "keys",
+    ".dz-manifest.json",
+    "sbom.json"
   ],
   "dependencies": {
     "@dzhechkov/harness-presets": "^0.5.0",
@@ -55,7 +57,7 @@
     "@dzhechkov/skills-reverse-engineering": "^0.1.0",
     "@dzhechkov/skills-presentation-storyteller": "^0.1.0",
     "@dzhechkov/skills-website-cloner": "^0.1.0",
-    "@dzhechkov/harness-core": "0.3.123"
+    "@dzhechkov/harness-core": "0.3.125"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",

package/sbom.json

@@ -0,0 +1,333 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "version": 1,
+  "metadata": {
+    "component": {
+      "type": "library",
+      "name": "harness-cli"
+    }
+  },
+  "components": [
+    {
+      "type": "file",
+      "name": ".agentic-qe/brain.rvf",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "8136cd4cc145d3dbe6ed3ae4489946bbc26e3e44172f0e5241ac45dde38bfead"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": ".agentic-qe/brain.rvf.lock",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "028658845c4fc1e9bd9487b575be0aee727d477fa9ad1b08c26299ce61f622c3"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": ".agentic-qe/memory.db",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "456372cb9a8c12f98ae6378338b8469d9be6df05cbe03a99b412d83d962b3d11"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": ".agentic-qe/memory.db-shm",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "23ae1f330a8fad23eabe444e89dc9d4588297cc1abca5929356eb6fec9f5079d"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": ".agentic-qe/memory.db-wal",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2eade3dbce1a9fd33a0775269af13fe97c62fdf1dbf44a8569ba0e7341315433"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": ".agentic-qe/patterns.rvf",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "9090b2e6d339eaa183672ac0cf9f625dbd5f9fc76d64afcdb34a3f5871c31c5a"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": ".agentic-qe/patterns.rvf.idmap.json",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "c2693f9a7f47a2d2bffe3004188e70ce08411bf8db47d07c60551d18ff7640c4"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": ".agentic-qe/patterns.rvf.lock",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "b28a956544f4358d57df98fc6c8df0b8f5d5cd8e8b102cee80ed3aabdf0a112b"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "CHANGELOG.md",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "9555ead768fef7963e735b0c6af21a64412811531534108be3df61bc65b51021"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "README.md",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "406be5cb9294367793daed191b2418bb99669186c8ead8a3a3f994f0db36e1b6"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "coverage/coverage-final.json",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "1abb00d07ab57ad413d2747baa6a68cda0876a9e0c6f75db89c205fbf4863530"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "coverage/coverage-summary.json",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "42d2a98f54c2ec773b49a0a43c959a78d070c8c427724f4affbd5bafef35621d"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/bin.d.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "58be9f04d2fe63cca2efe3957b9933068e443a0e57f9838ff9ef800cc191e03f"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/bin.d.ts.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "b1e41c8c19fa56ae9dec2267740eb4389bc785431478861a8843867f99c1b25b"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/bin.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "ad24e06de21b036e2b5a43abc4efd6e7ceb2ae126177b218a3ee13a026641f83"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/bin.js.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "c2dd399fec3f26e48e23971b29e27c508c1a1f96376a193e72dc8042015c8e65"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/cli.d.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "d304769099f8a7f79ba6c295e0348c2aa211527b050dbfff597f7e87c2b80505"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/cli.d.ts.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "680727bef753625ed99fd9d79ab846c9024608ef0f88d19ee2c8aec25eccf130"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/cli.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "672bc2fd640d9a92b5af7bfe2880843a770bfedd610f679ae022892fa7c8e66c"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/cli.js.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "08ec7cf51a49ec818b789cbb6f32b8fc71756e498c99d8756212d16329a8b147"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/index.d.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "c1ddc3aa44ca13264d54a72ad8376d8321de06ab48262eb2a6c8d5023c011bb6"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/index.d.ts.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "a8697ddfabf35947e17a255fce26dfee141f2184f6789c32ba1de75dcd80e36c"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/index.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "15ff1e6b84537b91b73b6a7e2d1c45f1120b25af9d1139df8da8ad094e99cf0e"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/index.js.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2f61a3be1af4ab9f7bbcbacb912ccbd89e3b73414f9fd24766598bfbdc1f8655"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "keys/README.md",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "204deec657a7f147bf3016441082c2f868f6f11051776f4edc13ec6b44745192"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "package.json",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "b48c494a4d4e2126e033c2d0019e463b9ad6cd3bae7a2aa0da296eba1ab66fcf"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "src/bin.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "a0d4e20fafc5cba35816f1f0c6cd03d9ce7c4434d2ca049384491079d2408fd4"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "src/cli.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "14ca947c27f366c1377c129b3def86cdd4577536249e44f0009f31884fff9018"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "src/index.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "f0aea91d07867603d177da6029f97851ced0b91b62e9db5d0bab5b464f794a91"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "test/cli.test.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "d9374e1cc23923c2d5c4cca1e228f31e2c3465f187d1c84cf3f50ad947401537"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "tsconfig.json",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "e80ef2911c3347a713dc3dca6a5f6034d91e938e58e71345ea920dd9833bcdbb"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "vitest.config.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "a6ffc6172b50a3a59010f8f8c66e2204e7d298b62a7f2bc5de33cbf39c99899d"
+        }
+      ]
+    }
+  ]
+}

package/src/cli.ts

@@ -111,6 +111,7 @@ import {
   isInsideTree,
   signManifest,
   verifyManifest,
+  listSignablePackFiles,
   assertKeyOutsideTree,
   decidePublishGate,
   MANIFEST_NAME,
@@ -3092,21 +3093,9 @@ async function cmdAutoCanonicalize(options: Map<string, string>, cwd: string, wr
 /** The pinned trust root. A key inside the artifact under verification is data, not a key (ADR-001). */
 const TRUST_ROOT_REL = 'keys/dz.pub';
 
-function packFiles(dir: string): string[] {
-  const out: string[] = [];
-  const walk = (d: string, rel: string): void => {
-    for (const e of readdirSync(d, { withFileTypes: true })) {
-      if (e.name === 'node_modules' || e.name === '.git') continue;
-      if (e.name === MANIFEST_NAME || e.name === SBOM_NAME) continue;
-      const abs = join(d, e.name);
-      const r = rel ? rel + '/' + e.name : e.name;
-      if (e.isDirectory()) walk(abs, r);
-      else if (e.isFile()) out.push(r);
-    }
-  };
-  walk(dir, '');
-  return out.sort();
-}
+// One walk to rule both: the SIGN file list is core's listPackFiles — the SAME function verify uses for
+// its added-file sweep, so the two can never drift apart again (the 10-false-TAMPERED lesson, task #36).
+const packFiles = (dir: string): string[] => listSignablePackFiles(dir);
 
 
 /**
@@ -4782,10 +4771,21 @@ async function cmdRetro(options: Map<string, string>, flags: Set<string>, cwd: s
  */
 function cmdFeatureAdrSetup(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
   let repoRoot = cwd;
-  try { repoRoot = execSync('git rev-parse --show-toplevel', { cwd, encoding: 'utf-8' }).trim() || cwd; } catch { /* not git */ }
+  try { repoRoot = execSync('git rev-parse --show-toplevel', { cwd, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim() || cwd; } catch { /* not git */ }
+
+  // P3 (fa-improvements): --guards scaffolds the deterministic guard set (guards.config.json + the
+  // zero-dependency check.mjs runner) — usable standalone (`dz feature-adr-setup --guards --apply`) or
+  // together with --from-spec. --loc-cap <n> tunes the LOC cap (default 700).
+  const wantGuards = flags.has('guards');
+  const locCapRaw = options.get('loc-cap');
+  const locCap = locCapRaw !== undefined ? Number(locCapRaw) : undefined;
+  if (locCapRaw !== undefined && (!Number.isFinite(locCap) || (locCap as number) <= 0)) {
+    write('dz feature-adr-setup: --loc-cap must be a positive finite number');
+    return 1;
+  }
 
   const specPath = options.get('from-spec');
-  if (specPath === undefined) {
+  if (specPath === undefined && !wantGuards) {
     // default + --plan: the read-only "which documents, and where?" answer.
     const plan = buildSetupPlan(scanForSetup(repoRoot));
     if (flags.has('json')) { write(JSON.stringify(plan, null, 2)); return 0; }
@@ -4798,10 +4798,15 @@ function cmdFeatureAdrSetup(options: Map<string, string>, flags: Set<string>, cw
     return 0;
   }
 
-  // --from-spec: scaffold (preview, or --apply to write).
+  // --from-spec and/or --guards: scaffold (preview, or --apply to write).
   let spec: SetupSpec;
-  try { spec = JSON.parse(readFileSync(resolve(cwd, specPath), 'utf-8')) as SetupSpec; }
-  catch (e) { write(`dz feature-adr-setup: cannot read spec ${specPath}: ${e instanceof Error ? e.message : String(e)}`); return 1; }
+  if (specPath !== undefined) {
+    try { spec = JSON.parse(readFileSync(resolve(cwd, specPath), 'utf-8')) as SetupSpec; }
+    catch (e) { write(`dz feature-adr-setup: cannot read spec ${specPath}: ${e instanceof Error ? e.message : String(e)}`); return 1; }
+  } else {
+    spec = {}; // --guards standalone: scaffold just the guard set
+  }
+  if (wantGuards) spec = { ...spec, guards: locCap !== undefined ? { locCap } : true };
 
   const result = scaffoldFromSpec(spec, readExistingForScaffold(repoRoot));
   if (flags.has('json') && !flags.has('apply')) { write(JSON.stringify(result, null, 2)); return 0; }