@dzhechkov/harness-cli 0.3.242 → 0.3.244

package/.dz-manifest.json

@@ -9,7 +9,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "f10f682ab0a6a472d1bb52fb8c861d8b22669d579af8ddbbd392e2fb115cce67"
+        "sha256": "2471dcbdf8588a65410c17557f5ef331c4f8cc77923824728f64ebe7e33d84dc"
       },
       {
         "path": "coverage/coverage-final.json",
@@ -41,15 +41,15 @@
       },
       {
         "path": "dist/cli.d.ts.map",
-        "sha256": "2efde3e98ca7843ac6260881eef51bfd3743e736425ed60fc73bdbebacdb54c6"
+        "sha256": "2bb00d2f42334250ee57b4d0f88d92968cbe3f010ec8d75bb748c0ee6f8de0b8"
       },
       {
         "path": "dist/cli.js",
-        "sha256": "88282ec4122a1e414dfb4c74e8583a49893b7ea0eba18d0cabe9ff50e72b0dec"
+        "sha256": "d959d7623b68286e440e04f90ee3ae7af0166c1fe506f2cf7e6e9e317439409d"
       },
       {
         "path": "dist/cli.js.map",
-        "sha256": "da8e7d578e7929880f0a87e240dac4a3a25afaf5c4da96442fbcb159f1eb0e07"
+        "sha256": "68e0bbf621169f7bae350a5b723f9425969ab12b6f7dd98ce26bb06d32c77c92"
       },
       {
         "path": "dist/index.d.ts",
@@ -73,7 +73,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "7c10b138fb5cbb7c8ccba350863c100aea77a5fd2b2bd30fa08a3ea4260a0e4a"
+        "sha256": "ff01608759bb01a9bb83aa45cc4658182765d9fb4b2512f3a096b8ea55370eac"
       },
       {
         "path": "src/bin.ts",
@@ -81,7 +81,7 @@
       },
       {
         "path": "src/cli.ts",
-        "sha256": "79d8ade45869b7a264d54da7fafda72a39953cab0d48f5ad504dd26657a54a1b"
+        "sha256": "14a3db7155fcc858272439a55bc7a43a09c7f6fd7caa302e5a13c153fe1a6d16"
       },
       {
         "path": "src/index.ts",
@@ -101,5 +101,5 @@
       }
     ]
   },
-  "signature": "FZQ+o3JaRRSlZNY7rza0Neki2zXzDh2wKx2msyLIJhet1811uzEnhpQD5p7RYyfdNt8imOcGlI0eAax5PhxKBQ=="
+  "signature": "WQQaokaBe8iyzdWIE4vAORyCEzPbmF/WLd7uUazUGV6j9mL84mxjqC4NaVyKwWjD1+c+wawazid8gFVOqz07Bg=="
 }

package/README.md

@@ -447,6 +447,9 @@ Two things changed to make it mean something:
   1-hour TTL write, cache-read 0.1x, output 5x).
 - **Subagent transcripts count.** `<session>/subagents/*.jsonl` carry real, non-duplicated usage and
   were silently excluded.
+- **The walk is safe and bounded.** Only regular files are read, symlinked files and directory
+  components are skipped (a FIFO used to block it, a symlink used to be followed), and the file cap
+  keeps the NEWEST transcripts so a long history cannot push current usage out of view.
 
 ```bash
 dz usage                       # session ~13% (resets 10:24) · week ~15% (resets 08:59) · estimated
@@ -517,6 +520,22 @@ binary, a login prompt, a timeout, or a session that read a *different* project
 missing, so its listing is refused rather than believed.) A layout so broken that nothing is
 registrable fails too, instead of passing vacuously on an empty expectation.
 
+**Registration is not usability — `--live-content`.** A skill can be in the session listing and still
+be unusable content. That was the third, manual step of the health-advisor verification: invoke it and
+check the model really loaded its `SKILL.md`. `--live-content` automates it — an extra turn that asks a
+live model to name the expected skills and **quote a heading verbatim** from one:
+
+```
+$ dz skills-verify --expect api-design,debugging,explore --live-content
+dz skills-verify: PASS — all 3 expected skill(s) are registered
+  content probe (ADVISORY, model-mediated — never a gate): coherent — every probed skill was named and one was quoted
+    quoted: "## When to use"
+```
+
+It is **advisory by construction and always will be**: the answer comes from a model, so it never
+changes the exit code and never promotes a verdict. Naming a skill without quoting anything is
+`partial` (naming is not proof the content loaded); an empty answer is `unreadable`, not a pass.
+
 **Use it when:** publishing a package that installs skills, after `dz setup` in a new project, or in
 CI (`--static` needs no Claude session at all).
 

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqRH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;CAC5C;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AA2xL9E,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAoJ5E"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwRH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;CAC5C;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AA20L9E,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAoJ5E"}

package/dist/cli.js

@@ -9,7 +9,7 @@ import { fileURLToPath } from 'node:url';
 import { execSync, spawn } from 'node:child_process';
 import { homedir, tmpdir } from 'node:os';
 import { createRequire } from 'node:module';
-import { createSkill, getSkillInfo, getWorkflow, isTargetName, listSkills, runDoctor, runInit, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, TARGET_NAMES, buildParityMatrix, TARGET_CAPABILITIES, TARGET_SHORT_LABELS, WORKFLOW_NAMES, importEcc, recordPattern, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, mirrorEntriesToVector, patternVectorEntry, readMemoryLearningConfig, promotePatterns, quarantineExpiryCandidates, pruneQuarantinePatterns, clearAgentdbQuarantine, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, statuslineData, writeFeatureAdrState, computeUsage, deriveUsageCalibration, normalizeClaudeUsageModelKey, readUsageLimits, claimCheck, summarize, queryBookKnowledge, loadStorePatternsSync, patternRecordId, loadStoreRecords, recordToPattern, bundleSkills, brainHome, listBrain, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, decideProvenance, isInsideTree, signManifest, verifyManifest, listSignablePackFiles, assertKeyOutsideTree, decidePublishGate, collectPackageFacts, planReleaseGates, selectAffectedPackages, classifyGateExecutions, buildFailureIssue, buildReleaseNotes, releaseTagName, firstOutputLine, formatPublishError, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, collectDeliveryFacts, planDeliveryCheck, renderDeliveryBrief, classifyDelivery, isUsablePlaneResult, renderDeliveryReview, scanSkillsLayout, parseInitFacts, verifyRegistration, findNonRegistrableSkillDirs, registrationExitCode, renderRegistrationReport, } from '@dzhechkov/harness-core';
+import { createSkill, getSkillInfo, getWorkflow, isTargetName, listSkills, runDoctor, runInit, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, TARGET_NAMES, buildParityMatrix, TARGET_CAPABILITIES, TARGET_SHORT_LABELS, WORKFLOW_NAMES, importEcc, recordPattern, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, mirrorEntriesToVector, patternVectorEntry, readMemoryLearningConfig, promotePatterns, quarantineExpiryCandidates, pruneQuarantinePatterns, clearAgentdbQuarantine, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, statuslineData, writeFeatureAdrState, computeUsage, deriveUsageCalibration, normalizeClaudeUsageModelKey, readUsageLimits, claimCheck, summarize, queryBookKnowledge, loadStorePatternsSync, patternRecordId, loadStoreRecords, recordToPattern, bundleSkills, brainHome, listBrain, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, decideProvenance, isInsideTree, signManifest, verifyManifest, listSignablePackFiles, assertKeyOutsideTree, decidePublishGate, collectPackageFacts, planReleaseGates, selectAffectedPackages, classifyGateExecutions, buildFailureIssue, buildReleaseNotes, releaseTagName, firstOutputLine, formatPublishError, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, collectDeliveryFacts, planDeliveryCheck, renderDeliveryBrief, classifyDelivery, isUsablePlaneResult, renderDeliveryReview, scanSkillsLayout, parseInitFacts, verifyRegistration, buildContentProbePrompt, classifyContentProbe, renderContentProbe, findNonRegistrableSkillDirs, registrationExitCode, renderRegistrationReport, } from '@dzhechkov/harness-core';
 import { getPreset, PRESET_NAMES } from '@dzhechkov/harness-presets';
 import { scanGitHub, analyzeRepo, generateReport, deepAnalyze, scanAllSources, ScoutMemory } from '@dzhechkov/scout';
 const USAGE = `dz - DZ cross-platform harness CLI
@@ -5444,6 +5444,44 @@ function probeInitStream(projectDir, timeoutMs) {
         });
     });
 }
+/** Run a full `claude -p` turn and return its text. Unlike the init probe this NEEDS the answer. */
+function probeContent(projectDir, prompt, timeoutMs) {
+    return new Promise((resolveProbe) => {
+        const env = { ...process.env };
+        for (const key of PROBE_SCRUB_ENV)
+            delete env[key];
+        env.CLAUDE_PROJECT_DIR = projectDir;
+        let out = '';
+        let err = '';
+        let settled = false;
+        let child;
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            try {
+                child?.kill('SIGTERM');
+            }
+            catch {
+                /* already gone */
+            }
+            resolveProbe({ text: out, error });
+        };
+        const timer = setTimeout(() => finish(`content probe timed out after ${Math.round(timeoutMs / 1000)}s`), timeoutMs);
+        try {
+            child = spawn('claude', ['-p', prompt, '--output-format', 'text'], { cwd: projectDir, env, stdio: ['ignore', 'pipe', 'pipe'] });
+        }
+        catch (error) {
+            finish(`cannot run \`claude\`: ${error instanceof Error ? error.message : String(error)}`);
+            return;
+        }
+        child.stdout?.on('data', (c) => { out += c.toString(); });
+        child.stderr?.on('data', (c) => { err += c.toString(); });
+        child.on('error', (error) => finish(`cannot run \`claude\`: ${error.message}`));
+        child.on('close', () => finish(out.trim() === '' ? err.trim() || 'the content probe produced no output' : null));
+    });
+}
 /**
  * `dz skills-verify` — does this project's `.claude/skills/` actually REGISTER? (feature
  * skills-verify, ADR-001.) L1 static scan is instant and CI-safe; the live layer reads the
@@ -5455,13 +5493,15 @@ async function cmdSkillsVerify(options, flags, cwd, write) {
         write('dz skills-verify [--dir <project>] [--expect a,b] [--static] [--strict] [--timeout <s>] [--json]');
         write('  Verifies that a project\'s .claude/skills/ actually register in Claude Code.');
         write('  --static  layout scan only (no Claude session, CI-safe): flags dirs that can never register');
+        write('  --live-content  ADVISORY extra turn: ask a live model to name the skills and quote one, proving');
+        write('                  the CONTENT is usable — registration is not usability. Never changes the exit code.');
         write('  default   also starts a real session and reads the authoritative system/init listing');
         write('  exit: 0 pass · 1 fail · 2 inconclusive (--strict makes inconclusive exit 1)');
         return 0;
     }
-    const allowedFlags = new Set(['json', 'help', 'static', 'strict']);
+    const allowedFlags = new Set(['json', 'help', 'static', 'strict', 'live-content']);
     const allowedOptions = new Set(['dir', 'expect', 'timeout']);
-    const usage = '  allowed: --dir <project>, --expect a,b, --timeout <s>, --static, --strict, --json';
+    const usage = '  allowed: --dir <project>, --expect a,b, --timeout <s>, --static, --strict, --live-content, --json';
     if (options.has('_positional_0')) {
         const message = `unexpected argument "${options.get('_positional_0')}"`;
         write(json ? JSON.stringify({ error: message, exitCode: 1 }) : `dz skills-verify: ${message}\n${usage}`);
@@ -5535,10 +5575,20 @@ async function cmdSkillsVerify(options, flags, cwd, write) {
         ...(options.has('expect') ? { expected } : {}),
     }, { resolvePath: canonical });
     const exitCode = registrationExitCode(result.verdict, flags.has('strict'));
+    // ADVISORY layer: registration is not usability. Costs a real model turn, so it is opt-in, and it
+    // can never change the exit code — a model-mediated signal must not gate anything.
+    let content = null;
+    if (flags.has('live-content') && result.verdict === 'pass' && expected.length > 0) {
+        const probe = await probeContent(projectDir, buildContentProbePrompt(expected), timeoutMs);
+        content = classifyContentProbe(probe.error === null ? probe.text : '', expected.slice(0, 6));
+    }
     if (json)
-        write(JSON.stringify({ mode: 'live', ...result, skillsRoot: scan.skillsRoot, exitCode }, null, 2));
-    else
+        write(JSON.stringify({ mode: 'live', ...result, ...(content ? { contentProbe: content } : {}), skillsRoot: scan.skillsRoot, exitCode }, null, 2));
+    else {
         write(renderRegistrationReport(result, scan));
+        if (content)
+            write(renderContentProbe(content));
+    }
     return exitCode;
 }
 function cmdDeliveryCheck(options, flags, cwd, write) {