@dzhechkov/harness-cli 0.3.247 → 0.3.249

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-cli",
-  "version": "0.3.247",
+  "version": "0.3.249",
   "description": "The dz CLI — install AI skills for Claude Code, Codex, OpenCode, Hermes, OpenClaude, GitHub Copilot. 35 commands, 13 presets, 6 platform targets.",
   "type": "module",
   "license": "MIT",
@@ -41,6 +41,7 @@
     "sbom.json"
   ],
   "dependencies": {
+    "@dzhechkov/harness-core": "^0.3.140",
     "@dzhechkov/harness-presets": "^0.5.0",
     "@dzhechkov/scout": "^0.8.0",
     "@dzhechkov/skills-devops": "^0.3.0",
@@ -56,8 +57,7 @@
     "@dzhechkov/skills-idea2prd": "^0.1.0",
     "@dzhechkov/skills-reverse-engineering": "^0.1.0",
     "@dzhechkov/skills-presentation-storyteller": "^0.1.0",
-    "@dzhechkov/skills-website-cloner": "^0.1.0",
-    "@dzhechkov/harness-core": "0.3.138"
+    "@dzhechkov/skills-website-cloner": "^0.1.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",

package/sbom.json

@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "129ee8a3fc96a1edda2258d02cd6dc4b8df2ab766f3b03ddb38f1559f0c0d9b9"
+          "content": "0a4369c88d48323b3b2ceb18b89ec3a0b6f6f7016778de3ac583f8397531b1b3"
         }
       ]
     },
@@ -105,7 +105,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "894d5779615292e57a6b5c204ebd04cef4b065e3fe4d8546c0f3dfbe0fb22529"
+          "content": "e176f74bf8ff0fe938e1bf9b25db392c1adbbd4b7b5b2b63520cb8baa99df82d"
         }
       ]
     },
@@ -115,7 +115,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "aaaf1d89fb27f39c125c3404b37d57f9251fe62d7993f79df5696944ae8bddcf"
+          "content": "8bfdc5551ea8d4897f8bb2ab50e374145965e73b4dca8d01325f5388412d804c"
         }
       ]
     },
@@ -125,7 +125,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "dfdfb4feeb07bf037194a1aa7da4f956e88da30ec8c1848fa2e989d82ed34a0b"
+          "content": "0ae60f97c9b1b9e7afabcc8aa540eae700950539f5adc511c6f02cbe634775bd"
         }
       ]
     },
@@ -185,7 +185,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "16065506fcf54ea10fab7342da217ff2416818c20e05dd998036a75075083330"
+          "content": "207f5a322bb9154eb34478746318abf1f67660f670a92d7bede2fd4a725d4962"
         }
       ]
     },
@@ -205,7 +205,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "967efe0f790775d915f31665e270490794a8ca4bdbecd0844562edda2edf42d9"
+          "content": "1d3e6fb9e19aa8fd589487335a8004cc6f7a6af43472b40e31f9139a482f7e85"
         }
       ]
     },

package/src/cli.ts

@@ -200,6 +200,8 @@ import {
   renderContentProbe,
   findNonRegistrableSkillDirs,
   assembleCompoundingReport,
+  scoreRun,
+  renderScorecard,
   renderCompoundingReport,
   readReinforcementState,
   readQuarantineState,
@@ -237,6 +239,7 @@ Usage:
   dz delivery-check --slug <slug> [--context-only] [--findings <f.json>] [--strict] [--author <model>] [--json]   (portable Step-10 Delivery Gate: prints the 4-plane review brief + artifact probes; --findings classifies a fed-back review into a fail-closed ready|blocked hand-off and writes features/<slug>/10_delivery_review.md; --strict exits 1 on blocked)
   dz skills-verify [--dir <project>] [--expect a,b] [--static] [--strict] [--json]   (does .claude/skills/ actually REGISTER? --static = instant layout scan for CI; default reads the authoritative system/init listing from a real session. exit 0 pass / 1 fail / 2 inconclusive — never a false pass)
   dz compounding [--project <dir>] [--json]   (honest learning-loop payoff report: pool write-only ratio, guard repeat-violation trajectory, cold-vs-warm replay readiness, instrumentation health — a gate without enough data says INSUFFICIENT_DATA, never a fake verdict)
+  dz score --slug <feature> [--project <dir>] [--json]   (process scorecard for ONE feature-adr run, from its artifacts: ADR confirmation, discrimination, cross-model QE grade, live verification, README-first, learning loop, amendments — descriptive-only, a low score exits 0)
   dz setup --target <name> [--preset <name>] [--select id,id,...] [--skills-dir <dir>] [--project <dir>] [--memory agentdb] [--no-memory] [--no-hooks] [--install-driver] [--force] [--enrich]
   dz teach "<pattern>" [--reward <0-1>] [--domain <name>] [--type rule|success-pattern|lesson-learned] [--project <dir>] [--no-mirror]   (--project pins the learned store to <dir>/.dz, not the cwd — pin to a canonical brain)
   dz teach --from-json <file> [--project <dir>] [--no-mirror]   (bulk-import a 'dz recall --all --json' export — share a learned store across machines)
@@ -5625,6 +5628,87 @@ function nameFor(t: { file: string; name?: string }, outcome: 'pass' | 'fail' |
  *   --author <model>         cosmetic: the reviewer to dispatch, printed alongside the brief
  *   --json                   machine contract { planesChecked, planesSkipped, findings, handoff, artifact }
  */
+/**
+ * `dz score --slug <feature>` — score a feature-adr RUN's process discipline from its artifacts
+ * (feature dz-score, Reading C). Descriptive-only: exit 0 on any score; non-zero only on usage errors.
+ */
+function cmdScore(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
+  const json = flags.has('json');
+  if (flags.has('help')) {
+    const usage = 'dz score --slug <feature> [--project <dir>] [--json] — process scorecard for one feature-adr run (descriptive-only, never a gate)';
+    if (json) write(JSON.stringify({ help: usage, exitCode: 0 })); // --json stays ONE document even for help
+    else {
+      write(usage);
+      write('  disciplines: ADR confirmation · discrimination · cross-model QE · live verification · README-first · learning loop · amendments');
+      write('  descriptive-only, never a gate: a low score exits 0');
+    }
+    return 0;
+  }
+  for (const flag of flags) {
+    if (!new Set(['json', 'help']).has(flag)) {
+      write(json ? JSON.stringify({ error: `unknown option --${flag}`, exitCode: 1 }) : `dz score: unknown option --${flag}\n  allowed: --slug <feature>, --project <dir>, --json`);
+      return 1;
+    }
+  }
+  for (const key of options.keys()) {
+    if (key.startsWith('_positional_') || !new Set(['slug', 'project']).has(key)) {
+      const what = key.startsWith('_positional_') ? `unexpected argument "${options.get(key)}"` : `unknown option --${key}`;
+      write(json ? JSON.stringify({ error: what, exitCode: 1 }) : `dz score: ${what}\n  allowed: --slug <feature>, --project <dir>, --json`);
+      return 1;
+    }
+  }
+  const slug = options.get('slug') ?? '';
+  // The delivery-check traversal lesson, upgraded to a WHITELIST: `.` slipped the blacklist and
+  // silently aggregated the entire features/ tree as one "run" (Codex QE #2).
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(slug) || slug === '.' || slug === '..' || slug.includes('..')) {
+    write(json ? JSON.stringify({ error: 'a plain --slug <feature> is required (no path separators)', exitCode: 1 }) : 'dz score: a plain --slug <feature> is required (no path separators)');
+    return 1;
+  }
+  const root = resolve(cwd, options.get('project') ?? '.');
+  const dir = join(root, 'features', slug);
+  if (!existsSync(dir)) {
+    write(json ? JSON.stringify({ error: `no run at features/${slug}/`, exitCode: 1 }) : `dz score: no run at features/${slug}/`);
+    return 1;
+  }
+
+  // Gather the artifact texts (bounded, best-effort — an unreadable file is skipped, not fatal).
+  const artifacts: Record<string, string> = {};
+  let fileBudget = 200; // a run has ~a dozen artifacts; a wide tree must degrade, not exhaust memory
+  const walk = (d: string, prefix: string, depth: number): void => {
+    if (depth > 3 || fileBudget <= 0) return;
+    let entries: string[];
+    try {
+      entries = readdirSync(d);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (fileBudget <= 0) return;
+      const full = join(d, name);
+      const rel = prefix === '' ? name : `${prefix}/${name}`;
+      try {
+        // lstat: a symlinked artifact (or a symlinked features/<slug> subtree) could smuggle
+        // OUTSIDE text into the scorecard's evidence (Codex QE #5).
+        const st = lstatSync(full);
+        if (st.isSymbolicLink()) continue;
+        if (st.isDirectory()) walk(full, rel, depth + 1);
+        else if (st.isFile() && name.endsWith('.md') && st.size < 512 * 1024) {
+          artifacts[rel] = readFileSync(full, 'utf-8');
+          fileBudget -= 1;
+        }
+      } catch {
+        /* skip unreadable */
+      }
+    }
+  };
+  walk(dir, '', 0);
+
+  const card = scoreRun(slug, artifacts);
+  if (json) write(JSON.stringify({ ...card, exitCode: 0 }, null, 2));
+  else write(renderScorecard(card));
+  return 0;
+}
+
 /**
  * `dz compounding` — does the learning loop actually PAY? (feature compounding, scout C2.)
  * Gathers the facts (store rows, apply-leg usage log, guard audit) and hands them to the PURE
@@ -6495,6 +6579,8 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
         return cmdSkillsVerify(options, flags, cwd, write);
       case 'compounding':
         return cmdCompounding(options, flags, cwd, write);
+      case 'score':
+        return cmdScore(options, flags, cwd, write);
       case 'routing':
         return cmdRouting(options, flags, cwd, write);
       case 'bto-optimize':