@dzhechkov/harness-cli 0.3.232 → 0.3.233

package/.dz-manifest.json

@@ -0,0 +1,137 @@
+{
+  "manifest": {
+    "version": 1,
+    "pack": "harness-cli",
+    "files": [
+      {
+        "path": ".agentic-qe/brain.rvf",
+        "sha256": "8136cd4cc145d3dbe6ed3ae4489946bbc26e3e44172f0e5241ac45dde38bfead"
+      },
+      {
+        "path": ".agentic-qe/brain.rvf.lock",
+        "sha256": "028658845c4fc1e9bd9487b575be0aee727d477fa9ad1b08c26299ce61f622c3"
+      },
+      {
+        "path": ".agentic-qe/memory.db",
+        "sha256": "456372cb9a8c12f98ae6378338b8469d9be6df05cbe03a99b412d83d962b3d11"
+      },
+      {
+        "path": ".agentic-qe/memory.db-shm",
+        "sha256": "23ae1f330a8fad23eabe444e89dc9d4588297cc1abca5929356eb6fec9f5079d"
+      },
+      {
+        "path": ".agentic-qe/memory.db-wal",
+        "sha256": "2eade3dbce1a9fd33a0775269af13fe97c62fdf1dbf44a8569ba0e7341315433"
+      },
+      {
+        "path": ".agentic-qe/patterns.rvf",
+        "sha256": "9090b2e6d339eaa183672ac0cf9f625dbd5f9fc76d64afcdb34a3f5871c31c5a"
+      },
+      {
+        "path": ".agentic-qe/patterns.rvf.idmap.json",
+        "sha256": "c2693f9a7f47a2d2bffe3004188e70ce08411bf8db47d07c60551d18ff7640c4"
+      },
+      {
+        "path": ".agentic-qe/patterns.rvf.lock",
+        "sha256": "b28a956544f4358d57df98fc6c8df0b8f5d5cd8e8b102cee80ed3aabdf0a112b"
+      },
+      {
+        "path": "CHANGELOG.md",
+        "sha256": "9555ead768fef7963e735b0c6af21a64412811531534108be3df61bc65b51021"
+      },
+      {
+        "path": "README.md",
+        "sha256": "406be5cb9294367793daed191b2418bb99669186c8ead8a3a3f994f0db36e1b6"
+      },
+      {
+        "path": "coverage/coverage-final.json",
+        "sha256": "1abb00d07ab57ad413d2747baa6a68cda0876a9e0c6f75db89c205fbf4863530"
+      },
+      {
+        "path": "coverage/coverage-summary.json",
+        "sha256": "42d2a98f54c2ec773b49a0a43c959a78d070c8c427724f4affbd5bafef35621d"
+      },
+      {
+        "path": "dist/bin.d.ts",
+        "sha256": "58be9f04d2fe63cca2efe3957b9933068e443a0e57f9838ff9ef800cc191e03f"
+      },
+      {
+        "path": "dist/bin.d.ts.map",
+        "sha256": "b1e41c8c19fa56ae9dec2267740eb4389bc785431478861a8843867f99c1b25b"
+      },
+      {
+        "path": "dist/bin.js",
+        "sha256": "ad24e06de21b036e2b5a43abc4efd6e7ceb2ae126177b218a3ee13a026641f83"
+      },
+      {
+        "path": "dist/bin.js.map",
+        "sha256": "c2dd399fec3f26e48e23971b29e27c508c1a1f96376a193e72dc8042015c8e65"
+      },
+      {
+        "path": "dist/cli.d.ts",
+        "sha256": "d304769099f8a7f79ba6c295e0348c2aa211527b050dbfff597f7e87c2b80505"
+      },
+      {
+        "path": "dist/cli.d.ts.map",
+        "sha256": "680727bef753625ed99fd9d79ab846c9024608ef0f88d19ee2c8aec25eccf130"
+      },
+      {
+        "path": "dist/cli.js",
+        "sha256": "672bc2fd640d9a92b5af7bfe2880843a770bfedd610f679ae022892fa7c8e66c"
+      },
+      {
+        "path": "dist/cli.js.map",
+        "sha256": "08ec7cf51a49ec818b789cbb6f32b8fc71756e498c99d8756212d16329a8b147"
+      },
+      {
+        "path": "dist/index.d.ts",
+        "sha256": "c1ddc3aa44ca13264d54a72ad8376d8321de06ab48262eb2a6c8d5023c011bb6"
+      },
+      {
+        "path": "dist/index.d.ts.map",
+        "sha256": "a8697ddfabf35947e17a255fce26dfee141f2184f6789c32ba1de75dcd80e36c"
+      },
+      {
+        "path": "dist/index.js",
+        "sha256": "15ff1e6b84537b91b73b6a7e2d1c45f1120b25af9d1139df8da8ad094e99cf0e"
+      },
+      {
+        "path": "dist/index.js.map",
+        "sha256": "2f61a3be1af4ab9f7bbcbacb912ccbd89e3b73414f9fd24766598bfbdc1f8655"
+      },
+      {
+        "path": "keys/README.md",
+        "sha256": "204deec657a7f147bf3016441082c2f868f6f11051776f4edc13ec6b44745192"
+      },
+      {
+        "path": "package.json",
+        "sha256": "b48c494a4d4e2126e033c2d0019e463b9ad6cd3bae7a2aa0da296eba1ab66fcf"
+      },
+      {
+        "path": "src/bin.ts",
+        "sha256": "a0d4e20fafc5cba35816f1f0c6cd03d9ce7c4434d2ca049384491079d2408fd4"
+      },
+      {
+        "path": "src/cli.ts",
+        "sha256": "14ca947c27f366c1377c129b3def86cdd4577536249e44f0009f31884fff9018"
+      },
+      {
+        "path": "src/index.ts",
+        "sha256": "f0aea91d07867603d177da6029f97851ced0b91b62e9db5d0bab5b464f794a91"
+      },
+      {
+        "path": "test/cli.test.ts",
+        "sha256": "d9374e1cc23923c2d5c4cca1e228f31e2c3465f187d1c84cf3f50ad947401537"
+      },
+      {
+        "path": "tsconfig.json",
+        "sha256": "e80ef2911c3347a713dc3dca6a5f6034d91e938e58e71345ea920dd9833bcdbb"
+      },
+      {
+        "path": "vitest.config.ts",
+        "sha256": "a6ffc6172b50a3a59010f8f8c66e2204e7d298b62a7f2bc5de33cbf39c99899d"
+      }
+    ]
+  },
+  "signature": "Vt+64ve0S3VUr7RQQ1sKTxBPCcNyOcMW/F1auDLC8k9ljNGhORaNolB0WZ9xdXN2ZsGz8jQLH0ttajx6eHLxCA=="
+}

package/README.md

@@ -307,7 +307,9 @@ dz sbom --pack packages/@dzhechkov/skills-qe --out sbom.json # write to a file
 ```
 
 A single flipped byte, a deleted file, or an **added** file all fail verification and the offending
-path is named. Every degenerate input (no manifest, empty file list, empty signature, no public key)
+path is named. `node_modules`/`.git` are unsigned territory by design (npm ships neither) — the sign and
+verify walks share those exclusions, while a symlink smuggled anywhere ELSE in the pack still fails loudly.
+Re-sign after ANY pack change (the manifest hashes `package.json` too) — sign is the LAST step before publish. Every degenerate input (no manifest, empty file list, empty signature, no public key)
 fails **closed** — absence never reads as success. `dz doctor` **and** `dz drift-check` run this check
 over the installed packs: a **tampered** pack is fatal (blocks); an **unsigned** pack or a missing trust
 root is reported, not fatal (transitional — the existing packs are not yet signed).
@@ -327,7 +329,7 @@ every run; `--require-signing` turns that into a refusal today.
 verifies what it just installed. A pack that does not match its signed manifest is **fatal**:
 
 ```bash
-dz doctor                      # ... signatures: 3 verified, 0 unsigned, 0 TAMPERED, 0 unverifiable
+dz doctor                      # ... signatures: 23 verified, 0 unsigned, 0 TAMPERED (the gate is ARMED: keys/dz.pub committed)
 dz doctor --require-signing    # an unsigned pack becomes fatal too
 dz upgrade                     # a TAMPERED pack aborts the upgrade
 dz doctor --pubkey ./my.pub    # verify against a key you pinned yourself

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiPH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AA48JD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA4I5E"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkPH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAg8JD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA4I5E"}

package/dist/cli.js

@@ -9,7 +9,7 @@ import { fileURLToPath } from 'node:url';
 import { execSync } from 'node:child_process';
 import { homedir, tmpdir } from 'node:os';
 import { createRequire } from 'node:module';
-import { createSkill, getSkillInfo, getWorkflow, isTargetName, listSkills, runDoctor, runInit, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, TARGET_NAMES, WORKFLOW_NAMES, importEcc, recordPattern, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, statuslineData, writeFeatureAdrState, computeUsage, deriveUsageCalibration, normalizeClaudeUsageModelKey, readUsageLimits, claimCheck, summarize, queryBookKnowledge, loadStorePatternsSync, patternRecordId, loadStoreRecords, recordToPattern, bundleSkills, brainHome, listBrain, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, decideProvenance, isInsideTree, signManifest, verifyManifest, assertKeyOutsideTree, decidePublishGate, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, } from '@dzhechkov/harness-core';
+import { createSkill, getSkillInfo, getWorkflow, isTargetName, listSkills, runDoctor, runInit, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, TARGET_NAMES, WORKFLOW_NAMES, importEcc, recordPattern, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, statuslineData, writeFeatureAdrState, computeUsage, deriveUsageCalibration, normalizeClaudeUsageModelKey, readUsageLimits, claimCheck, summarize, queryBookKnowledge, loadStorePatternsSync, patternRecordId, loadStoreRecords, recordToPattern, bundleSkills, brainHome, listBrain, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, decideProvenance, isInsideTree, signManifest, verifyManifest, listSignablePackFiles, assertKeyOutsideTree, decidePublishGate, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, } from '@dzhechkov/harness-core';
 import { getPreset, PRESET_NAMES } from '@dzhechkov/harness-presets';
 import { scanGitHub, analyzeRepo, generateReport, deepAnalyze, scanAllSources, ScoutMemory } from '@dzhechkov/scout';
 const USAGE = `dz - DZ cross-platform harness CLI
@@ -2784,25 +2784,9 @@ async function cmdAutoCanonicalize(options, cwd, write) {
 }
 /** The pinned trust root. A key inside the artifact under verification is data, not a key (ADR-001). */
 const TRUST_ROOT_REL = 'keys/dz.pub';
-function packFiles(dir) {
-    const out = [];
-    const walk = (d, rel) => {
-        for (const e of readdirSync(d, { withFileTypes: true })) {
-            if (e.name === 'node_modules' || e.name === '.git')
-                continue;
-            if (e.name === MANIFEST_NAME || e.name === SBOM_NAME)
-                continue;
-            const abs = join(d, e.name);
-            const r = rel ? rel + '/' + e.name : e.name;
-            if (e.isDirectory())
-                walk(abs, r);
-            else if (e.isFile())
-                out.push(r);
-        }
-    };
-    walk(dir, '');
-    return out.sort();
-}
+// One walk to rule both: the SIGN file list is core's listPackFiles — the SAME function verify uses for
+// its added-file sweep, so the two can never drift apart again (the 10-false-TAMPERED lesson, task #36).
+const packFiles = (dir) => listSignablePackFiles(dir);
 /**
  * The consumer-side apply-leg (ADR-001, verify-apply-leg). All security content lives in the two pure
  * functions in harness-core; this only resolves paths, reads bytes, and reports.