@dzhechkov/harness-cli 0.3.261 → 0.3.262

package/.dz-manifest.json

@@ -9,7 +9,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "61c71e355d633a88401a19c247e517d69f7a8d1483ea7549b3505eccb2a8740b"
+        "sha256": "af18869081f5141177b6427e812d724e15995d49b10cf67f24803eb5e1d79cb5"
       },
       {
         "path": "coverage/coverage-final.json",
@@ -41,15 +41,15 @@
       },
       {
         "path": "dist/cli.d.ts.map",
-        "sha256": "942d09c054994014e50139b807e1984586e172809b21e309114a5bf2ea92667c"
+        "sha256": "02a2ba1def8a57e1d4dcde048d5a62af19ab4cd825c98bcfbe8ac0df7de2062c"
       },
       {
         "path": "dist/cli.js",
-        "sha256": "43b1280af2070d30296162cc33a045a23452201b2da2ce7aec12eea1900451f3"
+        "sha256": "8d3674dc681dc2493886534c8a30e124664a158fd4f7f2da476f5ff2ec615edd"
       },
       {
         "path": "dist/cli.js.map",
-        "sha256": "d0847603ca911ccca9e0838d54dadd1924ac0d9008e103c4edaef16dc4be0678"
+        "sha256": "3975feb3b9102aad34cdcc070315a7756ef9241aa2bb618759a1bbac25ec7951"
       },
       {
         "path": "dist/index.d.ts",
@@ -73,7 +73,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "582e9b8e1b919650b444b6be90cc3a1ae54e2fd190524fdb3ffa46c8f2058990"
+        "sha256": "3e9deb36cf53245aaae26a72de359a7f57e9691d52454266ffe32f61dc963a27"
       },
       {
         "path": "src/bin.ts",
@@ -81,7 +81,7 @@
       },
       {
         "path": "src/cli.ts",
-        "sha256": "e6b54081432afb9d3f1ee8a851c0e6b5ec8012dad4b9ae02a0d9036772226044"
+        "sha256": "9549a9864fddc36eb99a172f3f0e7c7e72ae32d36aebadaf826b58af0bed16b4"
       },
       {
         "path": "src/index.ts",
@@ -109,5 +109,5 @@
       }
     ]
   },
-  "signature": "y8gV9ZSni/bgEg5MSCmyhQ+Nr9Q22yNs4Ac2MNR5JFmL6hsn8VsOzxFdWlog2Fw2oyZN4ZuprbK4lUVU4GLSDw=="
+  "signature": "3ghvnJARKOZq3JBJswFiPPiar56oO/qN6KDRN1kU2yunpTVyhNAqXdr49P/a5w/OHWPKD7hX5Vk72VLYNkTWDA=="
 }

package/README.md

@@ -2367,6 +2367,12 @@ dz recall "signature" --limit 3 --domain health-research
 #     domain "health-research": no lesson in this result carries it — order unchanged, nothing was hidden
 ```
 
+**One line out per hit.** Every value that reaches a `dz recall` output line — the lesson, its
+domain, your query, the requested domain — is rendered on a single line, with embedded line breaks
+shown as `⏎`. That is not cosmetic: any tool parsing this output line-wise (the `health-advisor`
+research skill reads it to detect whether this `dz` supports `--domain`) would otherwise see lines
+forged by stored content or by a crafted query.
+
 **Why a boost and not a filter.** Cross-domain transfer is the reason one shared store beats two
 separate ones: *"a reviewer's evidence needs the same execute-don't-describe discipline as your own
 claims"* was learned reviewing code and applies verbatim to medical sources. A filter would cut

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA8XH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;CAC5C;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAu3O9E,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA8J5E"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA8XH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;CAC5C;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AA83O9E,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA8J5E"}

package/dist/cli.js

@@ -1848,6 +1848,14 @@ async function cmdRecall(options, flags, cwd, write) {
     // never receive its promised lift — the feature was weakest in exactly the case it
     // exists for (foreign-domain dilution pushing a relevant lesson just past the cut).
     // Fetch a bounded surplus, re-rank, then trim to the limit the caller asked for.
+    // EVERY value that reaches an output line goes through this, not just stored fields.
+    // Round 5: `pattern` and `domain` were sanitised but the QUERY and the requested
+    // domain were not, so a caller-supplied newline could still forge a line that looks
+    // like the tool's own — including the boost note a peer reads as a capability probe.
+    // The rule is "one line out per line of output", and it has to hold for every field.
+    const oneLine = (v) => String(v).replace(/[\r\n\u2028\u2029\u0085\v\f]+/g, ' ⏎ ');
+    const shownQuery = oneLine(query);
+    const shownDomain = wantedDomain === undefined ? undefined : oneLine(wantedDomain);
     const fetchLimit = wantedDomain !== undefined ? Math.min(limit * 3, limit + 20) : limit;
     const result = await recallHybrid(projectRoot, query, { limit: fetchLimit, mode });
     if (mode === 'semantic' && result.vectorEngine === 'none') {
@@ -1873,19 +1881,19 @@ async function cmdRecall(options, flags, cwd, write) {
         return 0;
     }
     if (hits.length === 0) {
-        write(`dz recall "${query}"`);
+        write(`dz recall "${shownQuery}"`);
         write(`  No matching patterns (teach some with \`dz teach\`, or consolidate sessions).`);
         // The domain note must print here too (Codex QE #10): a --domain run with zero hits
         // silently said nothing about the domain, so the reader could not tell whether the
         // boost had been applied and found nothing, or had not run at all.
-        if (boost !== null && wantedDomain !== undefined)
-            write(renderDomainBoostNote(boost, wantedDomain));
+        if (boost !== null && shownDomain !== undefined)
+            write(renderDomainBoostNote(boost, shownDomain));
         return 0;
     }
     const vectorOn = result.vectorEngine !== 'none' && result.vectorError === undefined && mode !== 'lexical';
     const lexLabel = result.lexicalBackend === 'sqlite' ? 'SQLite FTS5' : 'keyword (JSON)';
     const ranking = vectorOn ? `${lexLabel} + vector (${result.vectorEngine}) ranking` : `${lexLabel} ranking (lexical)`;
-    write(`dz recall "${query}"  —  ${hits.length} hit(s), ${ranking}`);
+    write(`dz recall "${shownQuery}"  —  ${hits.length} hit(s), ${ranking}`);
     let sawQuarantined = false;
     for (const h of hits) {
         const backendTag = vectorOn ? ` ⟨${h.backend}⟩` : '';
@@ -1901,7 +1909,6 @@ async function cmdRecall(options, flags, cwd, write) {
         // might treat as a break — not just CR/LF. Round 4 forged the domain-boost note
         // twice over: once through `domain`, which was rendered raw, and once through a
         // U+2028 that Python's splitlines() honours and this replace did not.
-        const oneLine = (v) => v.replace(/[\r\n\u2028\u2029\u0085\v\f]+/g, ' ⏎ ');
         const shown = oneLine(h.pattern.pattern).slice(0, 80);
         write(`  [${h.pattern.reward.toFixed(2)}] (${oneLine(h.pattern.domain)})${backendTag}${qTag} ${shown}`);
     }
@@ -1909,10 +1916,10 @@ async function cmdRecall(options, flags, cwd, write) {
         // The loop stays VISIBLE (ADR D2): a quarantined hit is shown, marked, and explained.
         write('  ⚠q = quarantined (unproven hypothesis, rank damped) — confirm with dz teach --reinforce, or dz recall --promote <dzId> --apply');
     }
-    if (boost !== null && wantedDomain !== undefined) {
+    if (boost !== null && shownDomain !== undefined) {
         // Say what the boost did — INCLUDING when it did nothing. A silent reorder would
         // let the reader believe the ranking was domain-aware when it had no match to work with.
-        write(renderDomainBoostNote(boost, wantedDomain));
+        write(renderDomainBoostNote(boost, shownDomain));
         const cutNote = renderDomainCutNote(displaced, limit);
         if (cutNote !== '')
             write(cutNote);