@dzhechkov/harness-cli 0.7.3 → 0.7.4

package/dist/known-flags.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Every `--name` this CLI knows: the union of every name its code READS and every name its help
+ * DOCUMENTS. GENERATED — `test/known-flags-drift.test.ts` re-derives it from `cli.ts` and fails if
+ * this list has gone stale, so a new flag cannot silently start warning at its own users.
+ *
+ * It is deliberately a FLAT set, not a per-command map. Both ways of building a per-command list
+ * were measured and both are unsafe: 53 of the names the CLI reads appear nowhere in help, and
+ * static extraction over the dispatch table lost `--week` from `dz recap` while picking up a
+ * neighbour's flags for `dz usage`. A refusal built on either would reject working commands.
+ * See harness-core/src/cli-flag-notice.ts for the full reasoning and the honest limit.
+ */
+export declare const KNOWN_CLI_FLAGS: readonly string[];
+//# sourceMappingURL=known-flags.d.ts.map

package/dist/known-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-flags.d.ts","sourceRoot":"","sources":["../src/known-flags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EA+Q5C,CAAC"}

package/dist/known-flags.js

@@ -0,0 +1,284 @@
+/**
+ * Every `--name` this CLI knows: the union of every name its code READS and every name its help
+ * DOCUMENTS. GENERATED — `test/known-flags-drift.test.ts` re-derives it from `cli.ts` and fails if
+ * this list has gone stale, so a new flag cannot silently start warning at its own users.
+ *
+ * It is deliberately a FLAT set, not a per-command map. Both ways of building a per-command list
+ * were measured and both are unsafe: 53 of the names the CLI reads appear nowhere in help, and
+ * static extraction over the dispatch table lost `--week` from `dz recap` while picking up a
+ * neighbour's flags for `dz usage`. A refusal built on either would reject working commands.
+ * See harness-core/src/cli-flag-notice.ts for the full reasoning and the honest limit.
+ */
+export const KNOWN_CLI_FLAGS = [
+    'affected',
+    'all',
+    'allow-same-family',
+    'allow-same-family-qe',
+    'any',
+    'append',
+    'apply',
+    'arg',
+    'artifact',
+    'at',
+    'audit-dev',
+    'author',
+    'auto',
+    'base',
+    'baseline',
+    'body',
+    'book',
+    'books',
+    'bto',
+    'budget',
+    'budget-extra',
+    'bump-only',
+    'by-stage',
+    'calibrate',
+    'candidate',
+    'candidates',
+    'canonical',
+    'category',
+    'check',
+    'claim-check',
+    'claude-bin',
+    'cmd',
+    'coder-family',
+    'codex-home',
+    'command',
+    'commands',
+    'commit',
+    'compare',
+    'confirm',
+    'confirmed',
+    'context-only',
+    'corroborate',
+    'day',
+    'deep',
+    'default-family',
+    'desc',
+    'description',
+    'diff',
+    'diff-filter',
+    'dir',
+    'domain',
+    'done',
+    'dry-run',
+    'effect',
+    'effort',
+    'emit',
+    'emit-policy',
+    'enrich',
+    'epsilon',
+    'expect',
+    'expect-commands',
+    'export',
+    'fa-record',
+    'fail-on',
+    'fail-on-undergrant',
+    'family',
+    'feature-dir',
+    'files',
+    'filter',
+    'finalize',
+    'findings',
+    'flag',
+    'force',
+    'forget',
+    'format',
+    'from',
+    'from-',
+    'from-json',
+    'from-kus',
+    'from-pack',
+    'from-slice',
+    'from-spec',
+    'full',
+    'gates',
+    'gen-critic',
+    'goal',
+    'guard',
+    'guards',
+    'half-year',
+    'harmonize',
+    'help',
+    'holdout',
+    'html',
+    'id',
+    'include-domain',
+    'include-pairs',
+    'init',
+    'input-hash',
+    'install',
+    'install-driver',
+    'install-hook',
+    'into',
+    'invariants',
+    'json',
+    'judge',
+    'k',
+    'keep-scratch',
+    'key',
+    'kind',
+    'ladder',
+    'legacy',
+    'lexical',
+    'license',
+    'limit',
+    'list',
+    'live-content',
+    'loc-cap',
+    'local-path',
+    'manifest',
+    'margin',
+    'mark',
+    'max',
+    'max-wall-clock',
+    'memory',
+    'mock',
+    'mode',
+    'model',
+    'module',
+    'month',
+    'n',
+    'name',
+    'name-only',
+    'no-audit',
+    'no-decorate',
+    'no-dry-run',
+    'no-evals',
+    'no-filters',
+    'no-fund',
+    'no-guard',
+    'no-hooks',
+    'no-index',
+    'no-issue',
+    'no-memory',
+    'no-merges',
+    'no-mirror',
+    'no-provenance',
+    'no-result',
+    'no-semantic',
+    'no-session-persistence',
+    'no-teach',
+    'no-verify',
+    'o',
+    'once',
+    'oneline',
+    'only',
+    'op',
+    'original',
+    'out',
+    'output',
+    'output-format',
+    'override',
+    'pack',
+    'pack-destination',
+    'package',
+    'pair',
+    'pattern',
+    'periods',
+    'pick',
+    'plan',
+    'plugin-dir',
+    'porcelain',
+    'preset',
+    'pretty',
+    'project',
+    'promote',
+    'proposal',
+    'provenance',
+    'prune-noise',
+    'prune-quarantine',
+    'pubkey',
+    'publish',
+    'quarter',
+    'reason',
+    'rebaseline',
+    'recalled',
+    'reconcile',
+    'record-provisional',
+    'registry',
+    'reinforce',
+    'remove',
+    'report',
+    'require-plan',
+    'require-signing',
+    'rerank',
+    'result',
+    'resume',
+    'revise',
+    'reward',
+    'row',
+    'run',
+    'run-dir',
+    'run-id',
+    'runner',
+    'safe-mode',
+    'sandbox',
+    'save-dev',
+    'scenarios',
+    'scope-check',
+    'score',
+    'seed',
+    'select',
+    'semantic',
+    'session',
+    'sessions-dir',
+    'short',
+    'show-toplevel',
+    'sign-key',
+    'since',
+    'skill',
+    'skills-dir',
+    'slice',
+    'slug',
+    'source',
+    'split',
+    'stage',
+    'stage-timeout',
+    'stages-json',
+    'static',
+    'stats',
+    'status',
+    'stdin',
+    'step',
+    'stored',
+    'strict',
+    'strict-mcp-config',
+    'subsystem',
+    'success',
+    'tag',
+    'target',
+    'task',
+    'teach',
+    'test',
+    'test-cmd',
+    'text',
+    'threshold',
+    'tie-rate',
+    'tier',
+    'timeout',
+    'title',
+    'tolerance',
+    'tools',
+    'topics',
+    'type',
+    'usage',
+    'validate',
+    'verbose',
+    'verified',
+    'verify',
+    'version',
+    'wall-clock-extra',
+    'weak',
+    'week',
+    'weekly',
+    'window-days',
+    'with-pairs',
+    'with-references',
+    'work-order',
+    'write',
+    'year',
+    'yes',
+];
+//# sourceMappingURL=known-flags.js.map

package/dist/known-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-flags.js","sourceRoot":"","sources":["../src/known-flags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,UAAU;IACV,KAAK;IACL,mBAAmB;IACnB,sBAAsB;IACtB,KAAK;IACL,QAAQ;IACR,OAAO;IACP,KAAK;IACL,UAAU;IACV,IAAI;IACJ,WAAW;IACX,QAAQ;IACR,MAAM;IACN,MAAM;IACN,UAAU;IACV,MAAM;IACN,MAAM;IACN,OAAO;IACP,KAAK;IACL,QAAQ;IACR,cAAc;IACd,WAAW;IACX,UAAU;IACV,WAAW;IACX,WAAW;IACX,YAAY;IACZ,WAAW;IACX,UAAU;IACV,OAAO;IACP,aAAa;IACb,YAAY;IACZ,KAAK;IACL,cAAc;IACd,YAAY;IACZ,SAAS;IACT,UAAU;IACV,QAAQ;IACR,SAAS;IACT,SAAS;IACT,WAAW;IACX,cAAc;IACd,aAAa;IACb,KAAK;IACL,MAAM;IACN,gBAAgB;IAChB,MAAM;IACN,aAAa;IACb,MAAM;IACN,aAAa;IACb,KAAK;IACL,QAAQ;IACR,MAAM;IACN,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,aAAa;IACb,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,iBAAiB;IACjB,QAAQ;IACR,WAAW;IACX,SAAS;IACT,oBAAoB;IACpB,QAAQ;IACR,aAAa;IACb,OAAO;IACP,QAAQ;IACR,UAAU;IACV,UAAU;IACV,MAAM;IACN,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,OAAO;IACP,WAAW;IACX,UAAU;IACV,WAAW;IACX,YAAY;IACZ,WAAW;IACX,MAAM;IACN,OAAO;IACP,YAAY;IACZ,MAAM;IACN,OAAO;IACP,QAAQ;IACR,WAAW;IACX,WAAW;IACX,MAAM;IACN,SAAS;IACT,MAAM;IACN,IAAI;IACJ,gBAAgB;IAChB,eAAe;IACf,MAAM;IACN,YAAY;IACZ,SAAS;IACT,gBAAgB;IAChB,cAAc;IACd,MAAM;IACN,YAAY;IACZ,MAAM;IACN,OAAO;IACP,GAAG;IACH,cAAc;IACd,KAAK;IACL,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,SAAS;IACT,OAAO;IACP,MAAM;IACN,cAAc;IACd,SAAS;IACT,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,MAAM;IACN,KAAK;IACL,gBAAgB;IAChB,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,GAAG;IACH,MAAM;IACN,WAAW;IACX,UAAU;IACV,aAAa;IACb,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,SAAS;IACT,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,WAAW;IACX,WAAW;IACX,WAAW;IACX,eAAe;IACf,WAAW;IACX,aAAa;IACb,wBAAwB;IACxB,UAAU;IACV,WAAW;IACX,GAAG;IACH,MAAM;IACN,SAAS;IACT,MAAM;IACN,IAAI;IACJ,UAAU;IACV,KAAK;IACL,QAAQ;IACR,eAAe;IACf,UAAU;IACV,MAAM;IACN,kBAAkB;IAClB,SAAS;IACT,MAAM;IACN,SAAS;IACT,SAAS;IACT,MAAM;IACN,MAAM;IACN,YAAY;IACZ,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,SAAS;IACT,UAAU;IACV,YAAY;IACZ,aAAa;IACb,kBAAkB;IAClB,QAAQ;IACR,SAAS;IACT,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,WAAW;IACX,oBAAoB;IACpB,UAAU;IACV,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,cAAc;IACd,iBAAiB;IACjB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,KAAK;IACL,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,SAAS;IACT,UAAU;IACV,WAAW;IACX,aAAa;IACb,OAAO;IACP,MAAM;IACN,QAAQ;IACR,UAAU;IACV,SAAS;IACT,cAAc;IACd,OAAO;IACP,eAAe;IACf,UAAU;IACV,OAAO;IACP,OAAO;IACP,YAAY;IACZ,OAAO;IACP,MAAM;IACN,QAAQ;IACR,OAAO;IACP,OAAO;IACP,eAAe;IACf,aAAa;IACb,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,mBAAmB;IACnB,WAAW;IACX,SAAS;IACT,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;IACN,UAAU;IACV,MAAM;IACN,WAAW;IACX,UAAU;IACV,MAAM;IACN,SAAS;IACT,OAAO;IACP,WAAW;IACX,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,UAAU;IACV,SAAS;IACT,UAAU;IACV,QAAQ;IACR,SAAS;IACT,kBAAkB;IAClB,MAAM;IACN,MAAM;IACN,QAAQ;IACR,aAAa;IACb,YAAY;IACZ,iBAAiB;IACjB,YAAY;IACZ,OAAO;IACP,MAAM;IACN,KAAK;CACN,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-cli",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "The dz CLI — install AI skills for Claude Code, Codex, OpenCode, Hermes, OpenClaude, GitHub Copilot. 67 commands, 14 presets, 10 platform targets.",
   "type": "module",
   "license": "MIT",

package/sbom.json

@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c58f8ba9168698b8b85767b8989c707a2f9cec3ebe28cc47061160f2f143e997"
+          "content": "1f117cb9a9e3ebf8e1ddd9fcd9227c64afa93c4dee354851befdfb1c6f1d1e98"
         }
       ]
     },
@@ -85,7 +85,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "833c76f1fca3af7f1085862cb1239bb81a70e1261839fc34f8d2dc0d00752cc7"
+          "content": "2adf5f4cd1cdb6f9300c50b67acf6031eb8dfa48eed9e44cceb0e87b705a3335"
         }
       ]
     },
@@ -95,7 +95,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "130604723d58640d89186e5535201346eabba190a2f9542504235d28d323a761"
+          "content": "86d6f102999ac1b5183775cd8d721b71050ac55b024113f23cca6be1fe494a6c"
         }
       ]
     },
@@ -105,7 +105,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a46fc71ca11f520e532956258cbce30e80736ce8315edbd2d2abab67c5affe6f"
+          "content": "87e420d5db13a85a12cb185d9da2874c788bfdf26fd44a6400f3799a4b835ccc"
         }
       ]
     },
@@ -189,6 +189,46 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "dist/known-flags.d.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "40403ed4e24cdf95cb2757653485d7cb4650ef8496af96927ab503c2a189c598"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/known-flags.d.ts.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "4ac14404f0c1d3c75c215fd7eb7b49c7b0b5d2e3f9fe9a22851117fc8944975b"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/known-flags.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "a3a40afcc63df47a39512dfc243f989fdf5dabe205342d76ee9ca77e33646976"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/known-flags.js.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "8e9dadaf3a205827c7b5dec03a73b2ab15a6ea775e4d6fc58314065c2a43851b"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "keys/README.md",
@@ -215,7 +255,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2aa110c79aca3b5874a166eed1d9bdecb2450cb389fbd28f689ede4e1e629532"
+          "content": "95d92b6f95141dc44061f0d728d7df200d96518ee42f9ff9174cd0539263cc52"
         }
       ]
     },
@@ -235,7 +275,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "43cc0a4fb533c65076b9e0e5da37b836cdbae1fc2d285131bd27b9bde9c38899"
+          "content": "9564c17c05ac595a2db3eef3ea547b39db88837c84e6efe6c1716fb9f7e16018"
         }
       ]
     },
@@ -258,6 +298,16 @@
           "content": "d4258f3b183d03047aa07399ae96bdb2b3af83f0005127a24a39f8932982bf78"
         }
       ]
+    },
+    {
+      "type": "file",
+      "name": "src/known-flags.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "59b255c1ba248365fe5e9432d7ec8933e73bfcb9cd2ce8e19cf8f85f96137163"
+        }
+      ]
     }
   ]
 }

package/src/cli.ts

@@ -7,6 +7,7 @@
 import { appendFileSync, chmodSync, closeSync, cpSync, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { KNOWN_CLI_FLAGS } from './known-flags.js';
 import { execFileSync, execSync, spawn, spawnSync, type ChildProcess } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
 import { homedir, tmpdir } from 'node:os';
@@ -318,6 +319,7 @@ import {
   buildRecap,
   renderRecap,
   parseSourceManifest,
+  unknownFlagNotice,
   mirrorWriterExplanation,
   appendRecallUsage,
   closenessLine,
@@ -12865,6 +12867,16 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
   };
   const { command, options, optionLists, flags } = parseArgs(argv);
 
+  // An unrecognised `--flag` must not pass in silence. MEASURED 2026-08-24: `dz recall "x" --breif
+  // --limit 2` printed the full ordinary output and exited 0, so a typo read as "the mode worked".
+  // It WARNS rather than refuses, and the reason is measured, not cautious: 53 of the names this CLI
+  // reads appear nowhere in help, and static extraction over the dispatch table lost `--week` from
+  // `dz recap` — a refusal built on either list would reject working commands, which is a worse
+  // failure than the one being fixed. Goes to STDERR so a `--json` consumer's stdout stays clean.
+  for (const notice of unknownFlagNotice([...flags, ...options.keys()].filter((k) => !k.startsWith('_positional_')), KNOWN_CLI_FLAGS)) {
+    writeErr(notice.line);
+  }
+
   // ── `dz --version` / `dz -v` / `dz version` — PRE-DISPATCH, before the help branch ──
   //
   // Until now `dz --version` printed the whole USAGE manual and exited 0 (MEASURED 2026-08-17,