@dzhechkov/harness-cli 0.3.240 → 0.3.242

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-cli",
-  "version": "0.3.240",
+  "version": "0.3.242",
   "description": "The dz CLI — install AI skills for Claude Code, Codex, OpenCode, Hermes, OpenClaude, GitHub Copilot. 35 commands, 13 presets, 6 platform targets.",
   "type": "module",
   "license": "MIT",
@@ -57,7 +57,7 @@
     "@dzhechkov/skills-reverse-engineering": "^0.1.0",
     "@dzhechkov/skills-presentation-storyteller": "^0.1.0",
     "@dzhechkov/skills-website-cloner": "^0.1.0",
-    "@dzhechkov/harness-core": "0.3.131"
+    "@dzhechkov/harness-core": "0.3.133"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",

package/sbom.json

@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1356d1ebf22352d0ab57ebe17fb91bb8c4df17da8b6968863a92b92402921bb7"
+          "content": "f10f682ab0a6a472d1bb52fb8c861d8b22669d579af8ddbbd392e2fb115cce67"
         }
       ]
     },
@@ -105,7 +105,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "eb431a9aaed2c853b19a797cd49668bed9fe1e700880a8d18d9a1a4cfe243f55"
+          "content": "2efde3e98ca7843ac6260881eef51bfd3743e736425ed60fc73bdbebacdb54c6"
         }
       ]
     },
@@ -115,7 +115,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9a46ece09ee1ac72ca3d7715ae86c1b5dc3747b18287c6f558a3c5d6569de7da"
+          "content": "88282ec4122a1e414dfb4c74e8583a49893b7ea0eba18d0cabe9ff50e72b0dec"
         }
       ]
     },
@@ -125,7 +125,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "02dcf19b1e616487f3840482e9af6f9028749b5a8c9d8da143126be5d7ee5779"
+          "content": "da8e7d578e7929880f0a87e240dac4a3a25afaf5c4da96442fbcb159f1eb0e07"
         }
       ]
     },
@@ -185,7 +185,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b729864fd3fb9fc4cf2fcab96c6aa36f13ed181f3aa2bb37c6b3ca0c893afd76"
+          "content": "7c10b138fb5cbb7c8ccba350863c100aea77a5fd2b2bd30fa08a3ea4260a0e4a"
         }
       ]
     },
@@ -205,7 +205,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8477517b028f8258d5f11a2197167210de2db0acefa901f0f393579dc14bd409"
+          "content": "79d8ade45869b7a264d54da7fafda72a39953cab0d48f5ad504dd26657a54a1b"
         }
       ]
     },
@@ -225,7 +225,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3deb99917f3d8b4a5c9a3b0315bd65a3099ce2b508121cfa2bdeed19b7554d48"
+          "content": "a82b15dd9d166764479528e9f9ede45fc39d1b4068a96f19f158aa5a4c03369b"
         }
       ]
     },

package/src/cli.ts

@@ -4367,7 +4367,43 @@ function cmdClaimCheck(
     paths.push(p);
   }
 
-  const scanSet = paths.length > 0 ? paths.map((p) => resolve(root, p)) : defaultClaimScanSet(root);
+  // A DIRECTORY argument used to hit EISDIR, be counted as "skipped", and still exit 0 — the gate
+  // reported PASS having scanned nothing (MEASURED: `dz claim-check docs` said "1 skipped" and exited
+  // 0 while `dz claim-check docs/*.md` found 7). Expand a directory into its markdown instead.
+  const expandDir = (dir: string, depth = 0): string[] => {
+    if (depth > 6) return [];
+    let entries: string[];
+    try {
+      entries = readdirSync(dir);
+    } catch {
+      return [];
+    }
+    const out: string[] = [];
+    for (const name of entries) {
+      if (name.startsWith('.') || name === 'node_modules' || name === 'dist') continue;
+      const full = join(dir, name);
+      try {
+        const st = statSync(full);
+        if (st.isDirectory()) out.push(...expandDir(full, depth + 1));
+        else if (st.isFile() && name.toLowerCase().endsWith('.md')) out.push(full);
+      } catch {
+        /* unreadable entry — nothing to scan */
+      }
+    }
+    return out;
+  };
+  const requested = paths.length > 0 ? paths.map((p) => resolve(root, p)) : defaultClaimScanSet(root);
+  const scanSet: string[] = [];
+  for (const p of requested) {
+    let isDir = false;
+    try {
+      isDir = statSync(p).isDirectory();
+    } catch {
+      /* missing path stays in the set so it is reported as skipped, never silently dropped */
+    }
+    if (isDir) scanSet.push(...expandDir(p));
+    else scanSet.push(p);
+  }
 
   const findings: (ClaimFinding & { file: string })[] = [];
   const scanned: { path: string; status: 'scanned' | 'skipped'; findings?: number; reason?: string }[] = [];
@@ -4410,6 +4446,13 @@ function cmdClaimCheck(
   const skipped = scanned.filter((s) => s.status === 'skipped');
   write(`\n  ${scanned.length} file(s) in scan set, ${skipped.length} skipped.`);
   for (const s of skipped) write(`    skipped ${s.path} (${s.reason})`);
+  // A gate that examined NOTHING must never report a pass. Previously an unreadable argument was
+  // counted as "skipped" and the command still exited 0 — a clean bill of health over zero evidence.
+  const readCount = scanned.filter((s) => s.status === 'scanned').length;
+  if (readCount === 0 && scanned.length > 0) {
+    write('  NOTHING was read — this is not a pass. Check the paths above.');
+    return 1;
+  }
   // Additive per-group rollup (ADR-001 C4): the widened default set can produce thousands of
   // findings; this summarizes WHERE they land (root README, packages/…, features/<slug>,
   // docs/<subdir>) WITHOUT hiding any — display-only, so `--json` shape and exit codes are