@dzhechkov/harness-cli 0.3.242 → 0.3.243

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-cli",
-  "version": "0.3.242",
+  "version": "0.3.243",
   "description": "The dz CLI — install AI skills for Claude Code, Codex, OpenCode, Hermes, OpenClaude, GitHub Copilot. 35 commands, 13 presets, 6 platform targets.",
   "type": "module",
   "license": "MIT",
@@ -57,7 +57,7 @@
     "@dzhechkov/skills-reverse-engineering": "^0.1.0",
     "@dzhechkov/skills-presentation-storyteller": "^0.1.0",
     "@dzhechkov/skills-website-cloner": "^0.1.0",
-    "@dzhechkov/harness-core": "0.3.133"
+    "@dzhechkov/harness-core": "0.3.134"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",

package/sbom.json

@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f10f682ab0a6a472d1bb52fb8c861d8b22669d579af8ddbbd392e2fb115cce67"
+          "content": "5f4e31653970ef6970b6d87c862a1c6ac1f2da92c3f4f913b4be4155284db1f4"
         }
       ]
     },
@@ -105,7 +105,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2efde3e98ca7843ac6260881eef51bfd3743e736425ed60fc73bdbebacdb54c6"
+          "content": "2bb00d2f42334250ee57b4d0f88d92968cbe3f010ec8d75bb748c0ee6f8de0b8"
         }
       ]
     },
@@ -115,7 +115,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "88282ec4122a1e414dfb4c74e8583a49893b7ea0eba18d0cabe9ff50e72b0dec"
+          "content": "d959d7623b68286e440e04f90ee3ae7af0166c1fe506f2cf7e6e9e317439409d"
         }
       ]
     },
@@ -125,7 +125,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "da8e7d578e7929880f0a87e240dac4a3a25afaf5c4da96442fbcb159f1eb0e07"
+          "content": "68e0bbf621169f7bae350a5b723f9425969ab12b6f7dd98ce26bb06d32c77c92"
         }
       ]
     },
@@ -185,7 +185,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7c10b138fb5cbb7c8ccba350863c100aea77a5fd2b2bd30fa08a3ea4260a0e4a"
+          "content": "e26250419d70ec922def52f25f63000b658eec8203b29a2135edad1be98f8d5d"
         }
       ]
     },
@@ -205,7 +205,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "79d8ade45869b7a264d54da7fafda72a39953cab0d48f5ad504dd26657a54a1b"
+          "content": "14a3db7155fcc858272439a55bc7a43a09c7f6fd7caa302e5a13c153fe1a6d16"
         }
       ]
     },

package/src/cli.ts

@@ -195,6 +195,9 @@ import {
   scanSkillsLayout,
   parseInitFacts,
   verifyRegistration,
+  buildContentProbePrompt,
+  classifyContentProbe,
+  renderContentProbe,
   findNonRegistrableSkillDirs,
   registrationExitCode,
   renderRegistrationReport,
@@ -5693,6 +5696,41 @@ function probeInitStream(projectDir: string, timeoutMs: number): Promise<{ strea
   });
 }
 
+/** Run a full `claude -p` turn and return its text. Unlike the init probe this NEEDS the answer. */
+function probeContent(projectDir: string, prompt: string, timeoutMs: number): Promise<{ text: string; error: string | null }> {
+  return new Promise((resolveProbe) => {
+    const env: NodeJS.ProcessEnv = { ...process.env };
+    for (const key of PROBE_SCRUB_ENV) delete env[key];
+    env.CLAUDE_PROJECT_DIR = projectDir;
+    let out = '';
+    let err = '';
+    let settled = false;
+    let child: ReturnType<typeof spawn>;
+    const finish = (error: string | null): void => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        child?.kill('SIGTERM');
+      } catch {
+        /* already gone */
+      }
+      resolveProbe({ text: out, error });
+    };
+    const timer = setTimeout(() => finish(`content probe timed out after ${Math.round(timeoutMs / 1000)}s`), timeoutMs);
+    try {
+      child = spawn('claude', ['-p', prompt, '--output-format', 'text'], { cwd: projectDir, env, stdio: ['ignore', 'pipe', 'pipe'] });
+    } catch (error) {
+      finish(`cannot run \`claude\`: ${error instanceof Error ? error.message : String(error)}`);
+      return;
+    }
+    child.stdout?.on('data', (c: Buffer) => { out += c.toString(); });
+    child.stderr?.on('data', (c: Buffer) => { err += c.toString(); });
+    child.on('error', (error: Error) => finish(`cannot run \`claude\`: ${error.message}`));
+    child.on('close', () => finish(out.trim() === '' ? err.trim() || 'the content probe produced no output' : null));
+  });
+}
+
 /**
  * `dz skills-verify` — does this project's `.claude/skills/` actually REGISTER? (feature
  * skills-verify, ADR-001.) L1 static scan is instant and CI-safe; the live layer reads the
@@ -5709,14 +5747,16 @@ async function cmdSkillsVerify(
     write('dz skills-verify [--dir <project>] [--expect a,b] [--static] [--strict] [--timeout <s>] [--json]');
     write('  Verifies that a project\'s .claude/skills/ actually register in Claude Code.');
     write('  --static  layout scan only (no Claude session, CI-safe): flags dirs that can never register');
+    write('  --live-content  ADVISORY extra turn: ask a live model to name the skills and quote one, proving');
+    write('                  the CONTENT is usable — registration is not usability. Never changes the exit code.');
     write('  default   also starts a real session and reads the authoritative system/init listing');
     write('  exit: 0 pass · 1 fail · 2 inconclusive (--strict makes inconclusive exit 1)');
     return 0;
   }
 
-  const allowedFlags = new Set(['json', 'help', 'static', 'strict']);
+  const allowedFlags = new Set(['json', 'help', 'static', 'strict', 'live-content']);
   const allowedOptions = new Set(['dir', 'expect', 'timeout']);
-  const usage = '  allowed: --dir <project>, --expect a,b, --timeout <s>, --static, --strict, --json';
+  const usage = '  allowed: --dir <project>, --expect a,b, --timeout <s>, --static, --strict, --live-content, --json';
   if (options.has('_positional_0')) {
     const message = `unexpected argument "${options.get('_positional_0')}"`;
     write(json ? JSON.stringify({ error: message, exitCode: 1 }) : `dz skills-verify: ${message}\n${usage}`);
@@ -5796,8 +5836,19 @@ async function cmdSkillsVerify(
   );
   const exitCode = registrationExitCode(result.verdict, flags.has('strict'));
 
-  if (json) write(JSON.stringify({ mode: 'live', ...result, skillsRoot: scan.skillsRoot, exitCode }, null, 2));
-  else write(renderRegistrationReport(result, scan));
+  // ADVISORY layer: registration is not usability. Costs a real model turn, so it is opt-in, and it
+  // can never change the exit code — a model-mediated signal must not gate anything.
+  let content: ReturnType<typeof classifyContentProbe> | null = null;
+  if (flags.has('live-content') && result.verdict === 'pass' && expected.length > 0) {
+    const probe = await probeContent(projectDir, buildContentProbePrompt(expected), timeoutMs);
+    content = classifyContentProbe(probe.error === null ? probe.text : '', expected.slice(0, 6));
+  }
+
+  if (json) write(JSON.stringify({ mode: 'live', ...result, ...(content ? { contentProbe: content } : {}), skillsRoot: scan.skillsRoot, exitCode }, null, 2));
+  else {
+    write(renderRegistrationReport(result, scan));
+    if (content) write(renderContentProbe(content));
+  }
   return exitCode;
 }