@dzhechkov/harness-cli 0.3.241 → 0.3.243

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-cli",
-  "version": "0.3.241",
+  "version": "0.3.243",
   "description": "The dz CLI — install AI skills for Claude Code, Codex, OpenCode, Hermes, OpenClaude, GitHub Copilot. 35 commands, 13 presets, 6 platform targets.",
   "type": "module",
   "license": "MIT",
@@ -57,7 +57,7 @@
     "@dzhechkov/skills-reverse-engineering": "^0.1.0",
     "@dzhechkov/skills-presentation-storyteller": "^0.1.0",
     "@dzhechkov/skills-website-cloner": "^0.1.0",
-    "@dzhechkov/harness-core": "0.3.132"
+    "@dzhechkov/harness-core": "0.3.134"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",

package/sbom.json

@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5b07e06ab04301ad1edfa9207b705266b57f3288f474f19ef7f22747237b6e67"
+          "content": "5f4e31653970ef6970b6d87c862a1c6ac1f2da92c3f4f913b4be4155284db1f4"
         }
       ]
     },
@@ -105,7 +105,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "eb431a9aaed2c853b19a797cd49668bed9fe1e700880a8d18d9a1a4cfe243f55"
+          "content": "2bb00d2f42334250ee57b4d0f88d92968cbe3f010ec8d75bb748c0ee6f8de0b8"
         }
       ]
     },
@@ -115,7 +115,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9a46ece09ee1ac72ca3d7715ae86c1b5dc3747b18287c6f558a3c5d6569de7da"
+          "content": "d959d7623b68286e440e04f90ee3ae7af0166c1fe506f2cf7e6e9e317439409d"
         }
       ]
     },
@@ -125,7 +125,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "02dcf19b1e616487f3840482e9af6f9028749b5a8c9d8da143126be5d7ee5779"
+          "content": "68e0bbf621169f7bae350a5b723f9425969ab12b6f7dd98ce26bb06d32c77c92"
         }
       ]
     },
@@ -185,7 +185,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "dc78329bbed8510db61dc597124a455a1ce367f4ce1f0258a171ee6207ebb1e6"
+          "content": "e26250419d70ec922def52f25f63000b658eec8203b29a2135edad1be98f8d5d"
         }
       ]
     },
@@ -205,7 +205,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8477517b028f8258d5f11a2197167210de2db0acefa901f0f393579dc14bd409"
+          "content": "14a3db7155fcc858272439a55bc7a43a09c7f6fd7caa302e5a13c153fe1a6d16"
         }
       ]
     },
@@ -225,7 +225,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3deb99917f3d8b4a5c9a3b0315bd65a3099ce2b508121cfa2bdeed19b7554d48"
+          "content": "a82b15dd9d166764479528e9f9ede45fc39d1b4068a96f19f158aa5a4c03369b"
         }
       ]
     },

package/src/cli.ts

@@ -195,6 +195,9 @@ import {
   scanSkillsLayout,
   parseInitFacts,
   verifyRegistration,
+  buildContentProbePrompt,
+  classifyContentProbe,
+  renderContentProbe,
   findNonRegistrableSkillDirs,
   registrationExitCode,
   renderRegistrationReport,
@@ -4367,7 +4370,43 @@ function cmdClaimCheck(
     paths.push(p);
   }
 
-  const scanSet = paths.length > 0 ? paths.map((p) => resolve(root, p)) : defaultClaimScanSet(root);
+  // A DIRECTORY argument used to hit EISDIR, be counted as "skipped", and still exit 0 — the gate
+  // reported PASS having scanned nothing (MEASURED: `dz claim-check docs` said "1 skipped" and exited
+  // 0 while `dz claim-check docs/*.md` found 7). Expand a directory into its markdown instead.
+  const expandDir = (dir: string, depth = 0): string[] => {
+    if (depth > 6) return [];
+    let entries: string[];
+    try {
+      entries = readdirSync(dir);
+    } catch {
+      return [];
+    }
+    const out: string[] = [];
+    for (const name of entries) {
+      if (name.startsWith('.') || name === 'node_modules' || name === 'dist') continue;
+      const full = join(dir, name);
+      try {
+        const st = statSync(full);
+        if (st.isDirectory()) out.push(...expandDir(full, depth + 1));
+        else if (st.isFile() && name.toLowerCase().endsWith('.md')) out.push(full);
+      } catch {
+        /* unreadable entry — nothing to scan */
+      }
+    }
+    return out;
+  };
+  const requested = paths.length > 0 ? paths.map((p) => resolve(root, p)) : defaultClaimScanSet(root);
+  const scanSet: string[] = [];
+  for (const p of requested) {
+    let isDir = false;
+    try {
+      isDir = statSync(p).isDirectory();
+    } catch {
+      /* missing path stays in the set so it is reported as skipped, never silently dropped */
+    }
+    if (isDir) scanSet.push(...expandDir(p));
+    else scanSet.push(p);
+  }
 
   const findings: (ClaimFinding & { file: string })[] = [];
   const scanned: { path: string; status: 'scanned' | 'skipped'; findings?: number; reason?: string }[] = [];
@@ -4410,6 +4449,13 @@ function cmdClaimCheck(
   const skipped = scanned.filter((s) => s.status === 'skipped');
   write(`\n  ${scanned.length} file(s) in scan set, ${skipped.length} skipped.`);
   for (const s of skipped) write(`    skipped ${s.path} (${s.reason})`);
+  // A gate that examined NOTHING must never report a pass. Previously an unreadable argument was
+  // counted as "skipped" and the command still exited 0 — a clean bill of health over zero evidence.
+  const readCount = scanned.filter((s) => s.status === 'scanned').length;
+  if (readCount === 0 && scanned.length > 0) {
+    write('  NOTHING was read — this is not a pass. Check the paths above.');
+    return 1;
+  }
   // Additive per-group rollup (ADR-001 C4): the widened default set can produce thousands of
   // findings; this summarizes WHERE they land (root README, packages/…, features/<slug>,
   // docs/<subdir>) WITHOUT hiding any — display-only, so `--json` shape and exit codes are
@@ -5650,6 +5696,41 @@ function probeInitStream(projectDir: string, timeoutMs: number): Promise<{ strea
   });
 }
 
+/** Run a full `claude -p` turn and return its text. Unlike the init probe this NEEDS the answer. */
+function probeContent(projectDir: string, prompt: string, timeoutMs: number): Promise<{ text: string; error: string | null }> {
+  return new Promise((resolveProbe) => {
+    const env: NodeJS.ProcessEnv = { ...process.env };
+    for (const key of PROBE_SCRUB_ENV) delete env[key];
+    env.CLAUDE_PROJECT_DIR = projectDir;
+    let out = '';
+    let err = '';
+    let settled = false;
+    let child: ReturnType<typeof spawn>;
+    const finish = (error: string | null): void => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        child?.kill('SIGTERM');
+      } catch {
+        /* already gone */
+      }
+      resolveProbe({ text: out, error });
+    };
+    const timer = setTimeout(() => finish(`content probe timed out after ${Math.round(timeoutMs / 1000)}s`), timeoutMs);
+    try {
+      child = spawn('claude', ['-p', prompt, '--output-format', 'text'], { cwd: projectDir, env, stdio: ['ignore', 'pipe', 'pipe'] });
+    } catch (error) {
+      finish(`cannot run \`claude\`: ${error instanceof Error ? error.message : String(error)}`);
+      return;
+    }
+    child.stdout?.on('data', (c: Buffer) => { out += c.toString(); });
+    child.stderr?.on('data', (c: Buffer) => { err += c.toString(); });
+    child.on('error', (error: Error) => finish(`cannot run \`claude\`: ${error.message}`));
+    child.on('close', () => finish(out.trim() === '' ? err.trim() || 'the content probe produced no output' : null));
+  });
+}
+
 /**
  * `dz skills-verify` — does this project's `.claude/skills/` actually REGISTER? (feature
  * skills-verify, ADR-001.) L1 static scan is instant and CI-safe; the live layer reads the
@@ -5666,14 +5747,16 @@ async function cmdSkillsVerify(
     write('dz skills-verify [--dir <project>] [--expect a,b] [--static] [--strict] [--timeout <s>] [--json]');
     write('  Verifies that a project\'s .claude/skills/ actually register in Claude Code.');
     write('  --static  layout scan only (no Claude session, CI-safe): flags dirs that can never register');
+    write('  --live-content  ADVISORY extra turn: ask a live model to name the skills and quote one, proving');
+    write('                  the CONTENT is usable — registration is not usability. Never changes the exit code.');
     write('  default   also starts a real session and reads the authoritative system/init listing');
     write('  exit: 0 pass · 1 fail · 2 inconclusive (--strict makes inconclusive exit 1)');
     return 0;
   }
 
-  const allowedFlags = new Set(['json', 'help', 'static', 'strict']);
+  const allowedFlags = new Set(['json', 'help', 'static', 'strict', 'live-content']);
   const allowedOptions = new Set(['dir', 'expect', 'timeout']);
-  const usage = '  allowed: --dir <project>, --expect a,b, --timeout <s>, --static, --strict, --json';
+  const usage = '  allowed: --dir <project>, --expect a,b, --timeout <s>, --static, --strict, --live-content, --json';
   if (options.has('_positional_0')) {
     const message = `unexpected argument "${options.get('_positional_0')}"`;
     write(json ? JSON.stringify({ error: message, exitCode: 1 }) : `dz skills-verify: ${message}\n${usage}`);
@@ -5753,8 +5836,19 @@ async function cmdSkillsVerify(
   );
   const exitCode = registrationExitCode(result.verdict, flags.has('strict'));
 
-  if (json) write(JSON.stringify({ mode: 'live', ...result, skillsRoot: scan.skillsRoot, exitCode }, null, 2));
-  else write(renderRegistrationReport(result, scan));
+  // ADVISORY layer: registration is not usability. Costs a real model turn, so it is opt-in, and it
+  // can never change the exit code — a model-mediated signal must not gate anything.
+  let content: ReturnType<typeof classifyContentProbe> | null = null;
+  if (flags.has('live-content') && result.verdict === 'pass' && expected.length > 0) {
+    const probe = await probeContent(projectDir, buildContentProbePrompt(expected), timeoutMs);
+    content = classifyContentProbe(probe.error === null ? probe.text : '', expected.slice(0, 6));
+  }
+
+  if (json) write(JSON.stringify({ mode: 'live', ...result, ...(content ? { contentProbe: content } : {}), skillsRoot: scan.skillsRoot, exitCode }, null, 2));
+  else {
+    write(renderRegistrationReport(result, scan));
+    if (content) write(renderContentProbe(content));
+  }
   return exitCode;
 }