@dzhechkov/harness-cli 0.7.4 → 0.7.6

package/.dz-manifest.json

@@ -9,7 +9,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "1f117cb9a9e3ebf8e1ddd9fcd9227c64afa93c4dee354851befdfb1c6f1d1e98"
+        "sha256": "ba98f7078023a6202a8bf809b83ae20ef44b3d2e1ca14ce0ae5aac83ffd8d51e"
       },
       {
         "path": "dist/bin.d.ts",
@@ -27,21 +27,37 @@
         "path": "dist/bin.js.map",
         "sha256": "31849f2576f6e57a8a71f49cbb1a6e6c692f98dd8303217ec836933420d08dac"
       },
+      {
+        "path": "dist/boolean-flags.d.ts",
+        "sha256": "014b309c8b7de90b6c0d87e4f4c6a15623fd9c261252282faa3567dd3b9d0d4d"
+      },
+      {
+        "path": "dist/boolean-flags.d.ts.map",
+        "sha256": "a8309c4a78c90a1c9db9518a6d07c5fa800c4d39710941a379635a65012e208d"
+      },
+      {
+        "path": "dist/boolean-flags.js",
+        "sha256": "8cf050f1bc0b69be1088e58cc5f88f034d2e847fba9ffc87f3cc01121d7d9d74"
+      },
+      {
+        "path": "dist/boolean-flags.js.map",
+        "sha256": "442b8bbb2ec9f7701ddc2232fc8662956966097d6f46ee1fce49bd06c20db97f"
+      },
       {
         "path": "dist/cli.d.ts",
         "sha256": "5aeeec8ab84e3922ce0c7b7ea711fd1cdff67b68e1ded0b66e920a907e6ac267"
       },
       {
         "path": "dist/cli.d.ts.map",
-        "sha256": "2adf5f4cd1cdb6f9300c50b67acf6031eb8dfa48eed9e44cceb0e87b705a3335"
+        "sha256": "3c0a60e8d8528e1b7df6bf5678388ce14d3ac3d0362bde42bc8e7e712d914dbd"
       },
       {
         "path": "dist/cli.js",
-        "sha256": "86d6f102999ac1b5183775cd8d721b71050ac55b024113f23cca6be1fe494a6c"
+        "sha256": "f117e676f0a120e1314f3cc6416901931d9b389d97052985e1150fa75322b221"
       },
       {
         "path": "dist/cli.js.map",
-        "sha256": "87e420d5db13a85a12cb185d9da2874c788bfdf26fd44a6400f3799a4b835ccc"
+        "sha256": "718f0380983cb995fad2a30b87af79feb3b0c85656449957bada67956e7e8854"
       },
       {
         "path": "dist/core-compat.d.ts",
@@ -75,21 +91,37 @@
         "path": "dist/index.js.map",
         "sha256": "02b6b6f1b17a53d652a75555d185a20ea5d3e3110aa915ab228bf5521b0ce5fb"
       },
+      {
+        "path": "dist/install-spec.d.ts",
+        "sha256": "f1a4d132eb06068e2c45ce7976f1b01482187c93021bbfaceb7f1dbe76c8c991"
+      },
+      {
+        "path": "dist/install-spec.d.ts.map",
+        "sha256": "59a6d12466909c86aa06c272b237ca39473f106fd544725b1e6c707ca1c06a25"
+      },
+      {
+        "path": "dist/install-spec.js",
+        "sha256": "354aae49a20a404eb9d0405ca6c7f6fa277e23b3e9f4988582f0c610486a2e6b"
+      },
+      {
+        "path": "dist/install-spec.js.map",
+        "sha256": "3f8225df12c17826d5e8642f342a2fae21f4d1c32bb0969915570258a1ce6a76"
+      },
       {
         "path": "dist/known-flags.d.ts",
         "sha256": "40403ed4e24cdf95cb2757653485d7cb4650ef8496af96927ab503c2a189c598"
       },
       {
         "path": "dist/known-flags.d.ts.map",
-        "sha256": "4ac14404f0c1d3c75c215fd7eb7b49c7b0b5d2e3f9fe9a22851117fc8944975b"
+        "sha256": "93d7a002824ed631f1459e922ac2cad08772e06a21777b64eed095933dd0e889"
       },
       {
         "path": "dist/known-flags.js",
-        "sha256": "a3a40afcc63df47a39512dfc243f989fdf5dabe205342d76ee9ca77e33646976"
+        "sha256": "64928f5f20cc647f86323b4d179c614613635eeb6a553fd7733bf5ebad653d70"
       },
       {
         "path": "dist/known-flags.js.map",
-        "sha256": "8e9dadaf3a205827c7b5dec03a73b2ab15a6ea775e4d6fc58314065c2a43851b"
+        "sha256": "3cb9b072c57a3d9562cfb919c11c2b242db215169a4675b9940de46b67e0ccfa"
       },
       {
         "path": "keys/README.md",
@@ -101,15 +133,19 @@
       },
       {
         "path": "package.json",
-        "sha256": "95d92b6f95141dc44061f0d728d7df200d96518ee42f9ff9174cd0539263cc52"
+        "sha256": "4831c7b0121cb2a62464bc4d4844e6037a80f9e2d1e6e0934836bde14a1bffdb"
       },
       {
         "path": "src/bin.ts",
         "sha256": "42a1f67e1f39c4cda2df0887c16fbb6f54eb108ba0cb18612bb83ee153092463"
       },
+      {
+        "path": "src/boolean-flags.ts",
+        "sha256": "c3ef929a729f53ca612ac67b1571d2e8da3681ac5060a1cd16e453e0bb1d4e00"
+      },
       {
         "path": "src/cli.ts",
-        "sha256": "9564c17c05ac595a2db3eef3ea547b39db88837c84e6efe6c1716fb9f7e16018"
+        "sha256": "f30fb7c6b0795758578a90de19b870c4cde42eb2009fa246051023f499374c09"
       },
       {
         "path": "src/core-compat.ts",
@@ -119,11 +155,15 @@
         "path": "src/index.ts",
         "sha256": "d4258f3b183d03047aa07399ae96bdb2b3af83f0005127a24a39f8932982bf78"
       },
+      {
+        "path": "src/install-spec.ts",
+        "sha256": "4196fd89c6d2ab1f3ba107141c32635f2739dc38d978a9f4f41a8b0db0ddc5f9"
+      },
       {
         "path": "src/known-flags.ts",
-        "sha256": "59b255c1ba248365fe5e9432d7ec8933e73bfcb9cd2ce8e19cf8f85f96137163"
+        "sha256": "b08dc5d28795419f642df56fbf5cd036a43a06bb1bec5e864f4e538b0a025b13"
       }
     ]
   },
-  "signature": "Ay/2zRjJGEi+9Xp56MdbVaRnDH2A7zacchPcrzYnMCIZd8VcGVlzHUD8f64s7Zgc6TJbO1XkMDEGZl5j5rfZBg=="
+  "signature": "az3T9G53JK8QzlVMBBMgoXLUN0Awpx4vfe19JJVYkbN67X5FDWUn8nVhe8IRAIKogxxbmp9lgnLkeYOj/b2YCg=="
 }

package/README.md

@@ -266,7 +266,7 @@ you know exactly which file is at fault, and you know whose defect it is.
 
 ## User Journey — from install to mastery
 
-All 75 commands (MEASURED — reproducer: `grep -c "^      case '" src/cli.ts`, the dispatch cases) mapped to a real workflow:
+All 77 commands (MEASURED — reproducer: `grep -c "^      case '" src/cli.ts`, the dispatch cases) mapped to a real workflow:
 
 ```
 DISCOVER → INSTALL → USE → CREATE → MAINTAIN → SHARE
@@ -1768,7 +1768,7 @@ runs a command that MEASURES the declared artifacts itself. It refuses a null re
 never recorded as done), an absent or partially-present artifact set, and a stage that declares nothing
 to witness — so a stage that did not happen can no longer be recorded, which the old mechanism allowed.
 
-## All Commands (75)
+## All Commands (77)
 
 *(73 MEASURED — reproducer: `grep -c "^      case '" src/cli.ts`, the dispatch cases.)*
 
@@ -1837,9 +1837,11 @@ dz epoch-replay --emit  [--project <dir>] [--limit <N>] [--seed <N>] [--margin <
 dz epoch-replay --judge <filled-work-order.json> [--out <file>] [--json]   # blind judge prompts from the filled plans — the file carries {id, prompt} ONLY (no assignment, no arm names); refuses an order whose digest or seed-derived assignment does not check out; half-pairs skipped WITH A REASON, on stdout
 dz epoch-replay --score <judgments.json> --work-order <file> [--slice <name>] [--json]   # un-blind against the VERIFIED pre-registered assignment; ONE paired binomial over DECISIVE pairs (ties excluded, reported) → SUPPORTED only when the lift interval (2p−1) lies entirely above zero; FALSIFIED only on harm or a passed non-superiority test (lift upper bound below the margin PRE-REGISTERED in the work order, default 0.05, at 10+ decisive pairs); else INCONCLUSIVE (min 5 decisive pairs). Refuses a forged work order, a --margin flag, or duplicate judgement ids; the verdict is data, not an exit code
 dz score             --slug <feature> [--project <dir>] [--json]   # process scorecard for ONE feature-adr run, from its artifacts: ADR confirmation, discrimination proof, cross-model QE grade, live verification, README-first, learning loop, amendments — DESCRIPTIVE-ONLY (a low score exits 0); evidence lines are shown so the reader judges the heuristics
-dz recap             [--day|--week|--month] [--at <ISO date>] [--project <dir>] [--json]   # what was done over a window, from records only. Deliveries carry the grade an independent review STATED — a report naming two different grades is reported AMBIGUOUS, never guessed; registry publishes come from a cache (51 packages cost 18.3s over the network, MEASURED — never inside a report); gate verdicts and knowledge reuse come from the local stores. --quarter/--half-year/--year are RECOGNISED and REFUSED with the real span in days: there is exactly ONE complete quarter and the longest record is 174 days, so a quarter-over-quarter comparison is arithmetically impossible and a year would be fabrication. Every section carries its own data-start date, and "the source was not read" never prints as a zero. Contaminated measures are NOT computed and the report says so: commit count (this project mandates a commit per logical change), lines changed (352 of 1318 commits are docs), token spend (self-declared an estimate, once wrong sixfold), learning-event volume (the curve tracks when hooks were installed), inventory counts (monotonic — they can only flatter), lesson count (54% of the pool has never been read). exit 0 reported / 2 refused
+dz recap             [--day|--week|--month] [--at <ISO date>] [--refresh-publishes] [--project <dir>] [--json]   # what was done over a window, from records only. `--refresh-publishes` fills the third-party publish-times cache first (the ONLY place this command touches the network — 51 packages in ~7s, batches of 8); the report itself always reads the cache, prints its AGE, and names any package the registry did not answer for: those are MISSING from the numbers, not zero. Deliveries carry the grade an independent review STATED — a report naming two different grades is reported AMBIGUOUS, never guessed; registry publishes come from a cache (51 packages cost 18.3s over the network, MEASURED — never inside a report); gate verdicts and knowledge reuse come from the local stores. --quarter/--half-year/--year are RECOGNISED and REFUSED with the real span in days: there is exactly ONE complete quarter and the longest record is 174 days, so a quarter-over-quarter comparison is arithmetically impossible and a year would be fabrication. Every section carries its own data-start date, and "the source was not read" never prints as a zero. Contaminated measures are NOT computed and the report says so: commit count (this project mandates a commit per logical change), lines changed (352 of 1318 commits are docs), token spend (self-declared an estimate, once wrong sixfold), learning-event volume (the curve tracks when hooks were installed), inventory counts (monotonic — they can only flatter), lesson count (54% of the pool has never been read). exit 0 reported / 2 refused
+dz cadence           [--window day|week|month|quarter|halfyear|year] [--json]   # the RHYTHM view of what shipped: graded-shipment counts bucketed by ISO week, npm-publish cadence (reads `dz recap`'s publish-times cache — run `dz recap --refresh-publishes` to warm it), guard repeat DECAY on the FIXED rule set (a rule joins only with pre-window history, so a newborn rule's zero is youth, not virtue — the no-stubs false-zero class excluded by construction), and recall reuse per week. A window deeper than 2× the record is REFUSED with the measured depth and the largest honest window named (a cadence from under two full windows is scale forgery). Sibling of `dz recap`: recap is the narrative what-was-done report over one window; cadence is the week-by-week rhythm across the window. exit 0 / 2 refused-window / 1 usage
 dz provenance-check   --manifest <sources.json> [--project <dir>] [--json]   # nothing goes out citing a source that may not leave this machine. Checks PROVENANCE, not words: every claim in a draft names its source, and a source is cleared only when it is a KNOWN kind that resolves safely. Repo paths are classified by `git -C <root> check-ignore` over the RESOLVED path — so a symlink into an ignored directory is refused, not cleared (MEASURED: git classifies the string and never dereferences), and the verdict does not change with your working directory. Store records need naming in the git-TRACKED `provenance-public.json`, so declaring one public is a reviewable commit rather than a field inside an ignored store. Anything else is refused: an undeclared kind is never inferred from the path's shape. exit 0 allowed / 1 blocked / 3 NOT ESTABLISHED — an empty manifest, an unreadable one, or an oracle that did not run is never a pass. **What it cannot do, said on the passing path too:** it proves what was CITED. It cannot see a paraphrase with no citation, nor confidential text pasted by hand into an allowed file. Read the draft.
 dz name-check         [--command <n>] [--module <basename>] [--export <a,b>] [--project <dir>] [--json]   # is this name free, BEFORE a line of code? Twice in one day a collision broke the build outright — `dz retro` was already a command, `decideProvenance` already an export — and both were answerable in advance. Scans workspace SOURCE and never `dist`, because a stale build answers 'free' confidently (MEASURED: half an hour of convincing live runs against a previous build while tsc was red). Checks a command name against the dispatcher AND the help block, a module basename against every package's src/, and exported identifiers against every declaration — naming the DECLARING file, not the barrel. exit 0 all free / 1 at least one taken / 2 nothing asked or the scan read nothing — an empty sweep is never a clean bill. **Honest limit, printed on the passing path:** it reads declarations, so a re-export under a different name stays the build's job.
+dz tg-post            --draft <file.html> [--manifest <sources.json>] [--channel <@name>] [--send --yes] [--night] [--max-per-day <n>] [--json]   # the sender for an APPROVED genai-tweets-channel post, held to the channel's own accepted ADRs: HTML mode only (never MarkdownV2 — 18 escapes against 3, one miss is a 400); link preview OFF by default (x.com previews in Telegram are broken since 2022); the 00:00-06:00 MSK quiet window refuses without an explicit --night. THE DEFAULT RUN IS A DRY-RUN: tag balance and allowed-tag checks, bare &/< detection, the 4096 visible-character limit with the overshoot counted — every issue named in one pass, not just the first. The provenance gate runs IN-PROCESS over --manifest, and a draft with no manifest is refused as unchecked when a send is asked. A real send needs --send AND --yes — ADR-004's standing order that publishing stays manual, stated out loud each time. Three autopublish guards run FAIL-CLOSED, in a fixed order: the **stop-cord** (`.dz/tg-post/HALT` exists ⇒ nothing publishes, checked FIRST so no bug in a later gate can route around it), **dedup** by the sha256 of the post's VISIBLE text (what the reader sees, not the bytes — a whitespace-different draft is the same post), and the **daily limit** (10 by default, `--max-per-day <n>` to change it), counted over the trailing 24h. The journal is two-phase: a `pending` row is written BEFORE the network call and a `sent` row after Telegram accepts, so a crash between the two is caught by dedup on the next run instead of double-publishing; only `sent` rows eat the daily ceiling. An UNREADABLE journal REFUSES — an unreadable counter does not prove the ceiling is unreached. The provenance gate also clears `kind: url`: a well-formed http(s) URL is public by construction so there is nothing local to protect, while a `file://`, a bare path or a non-URL is refused, never inferred. The bot token (TELEGRAM_BOT_TOKEN or telegram.tokenFile) is never printed, and the gates run BEFORE any secret is read. exit 0 sent or clean dry-run / 1 refused / 2 usage
 dz feature-adr-checkpoint (--slug <feature> | --feature-dir <abs>) --stage <s> --input-hash <h> --result <json> [--artifact a,b] [--json]
 dz reqe              [--slug <feature> [--done --report <f>]] [--project <dir>] [--json]   # the re-QE debt ledger: a usage-switched feature-adr run whose Step-8 QE ran on the coder's OWN family (cross-model guard suspended, FR-2.9) records a debt; list debts (also surfaced by dz usage), print the cross-family review brief, settle FAIL-CLOSED against an existing GRADED report (the run's own 08_qe_report.md — even hard-linked — can never settle its own debt); settlement lands in 08_qe_report.md, evidence rotates to reqe-settled.json
 dz qe-bridge         --family claude --slug <feature> [--coder-family codex|claude] [--model <id>] [--files a,b] [--out <f>] [--timeout <s>] [--allow-same-family] [--json]   # the REVERSE QE bridge (Codex-hosted → Claude reviewer): the reviewer runs ISOLATED (an empty temp cwd + --safe-mode --strict-mcp-config --tools '' --no-session-persistence, so no CLAUDE.md/skills/plugins/hooks/MCP load) and its verdict is read from the --output-format json RESULT ENVELOPE, so text a customization printed onto the same stdout can never become a signoff. Probes the model first; sends SCOPED extracts under a loud 200k-char ceiling; the grade must agree across three LAST-anchored channels AND the marker must be the final content — empty/gradeless/mismatched/miscounted output is a named failure with an audit record under features/<slug>/.fa-state/qe-bridge/, never a clean review. exit 0 signoff parsed (ANY grade — it reports, it does not gate) / 1 named failure / 2 usage. DZ_QE_BRIDGE_CLAUDE_BIN is a TEST SEAM (recorded as binOverride:true)
@@ -4094,10 +4096,38 @@ npx @dzhechkov/p-replicator init
 
 ## Status
 
-`v0.7.4` — **a signature-only republish.** `0.7.0` shipped through `pnpm publish` rather than
+`v0.7.6` — **`dz drift-check` and `dz sync-canonical` stop being a `.claude/skills` gate.** Skill-copy
+discovery searched `packages/` plus one hardcoded install root, so the four other per-target install
+trees were ungated — measurably: this repo's own Codex install of `feature-adr` under `.agents/skills`
+drifted for a day while `dz sync-canonical feature-adr --check` reported "all 3 copies match
+canonical" and the HARD `no-skill-drift` rule passed. The copy was missing both the K1 section of its
+`SKILL.md` and the C6 check of its gate script. Discovery is now driven by a target→install-root
+registry, and the HARD rule runs at a new scope covering generated installs while exempting the
+hand-edited dev tree (which legitimately lags — three real skills drift there today, so gating it
+would be red-on-arrival). **The guard legitimately gets STRICTER: a publish that passed before can now
+be BLOCKED by real drift in a non-`.claude` root — that is the gate working.** Target enrichment
+written by `dz init --enrich` is exempt from both the drift verdict and the healer, so `sync-canonical`
+cannot delete it. Also: `dz tg-post` gains `--max-per-day`, previously read by the code but
+unregistered.
+
+`v0.7.6` — **the channel sender stops trusting itself.** `dz tg-post` could format-check, provenance-check
+and time-check a post and still publish it twice, or ten more times, or right through an operator who
+wanted everything stopped: nothing counted what had already gone out. It now runs three guards FAIL-CLOSED
+in a fixed order — a **stop-cord** file that halts even a perfect post before any cheaper check, **dedup**
+keyed on the sha256 of the post's VISIBLE text rather than its bytes, and a **daily limit** (10 by default,
+`--max-per-day <n>`) counted over the trailing 24h. The send journal is two-phase — `pending` written before
+the network call, `sent` after Telegram accepts — so a crash in that window is caught by dedup instead of
+double-publishing, and only accepted sends eat the ceiling. An unreadable journal refuses: an unreadable
+counter does not prove the ceiling is unreached. The provenance gate additionally clears `kind: url` — a
+well-formed http(s) URL is public by construction, while a `file://`, a bare path or a non-URL is refused
+and never inferred from its shape. Also: `dz challenge` is now discoverable from the CLI's own help surface
+(it existed and was reachable only if you already knew the name), and the adversary it assembles is fed all
+five calibration documents rather than a subset.
+
+`v0.7.6` — **a signature-only republish.** `0.7.0` shipped through `pnpm publish` rather than
 `dz publish`, so the re-signing step was skipped and 17 of 497 files in the published core did not
 match their signed hashes — the content was correct, the manifest was ten hours stale. Nothing in
-the shipped behaviour changes between `0.7.0` and `0.7.4`; the integrity check stops reporting these
+the shipped behaviour changes between `0.7.0` and `0.7.6`; the integrity check stops reporting these
 packages as tampered. The one code change is a TEST: the compat case that asserted the workspace
 core sits exactly on `MIN_CORE` is split into an integration half and a boundary half, so a patch
 bump of core no longer reddens it and `MIN_CORE` need not claim a version the CLI does not require.

package/dist/boolean-flags.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Boolean flags DECLARED AS DATA — feature boolean-flags-declared (backlog 247ddcfa).
+ *
+ * Before this file, `parseArgs` had no concept of a boolean flag: ANY `--flag` greedily consumed
+ * the next token unless it began with `--`. MEASURED 2026-08-22 on 0.7.0: `dz sync --dry-run .`
+ * turned the safety flag into the option `dry-run=.` — `flags.has('dry-run')` was FALSE and the
+ * run WROTE, its only trace a missing label. The same class swallowed positionals
+ * (`dz recall --no-semantic "torque"` ate the query) across ~72 commands.
+ *
+ * GENERATED from a census of `cli.ts` reads — `test/boolean-flags.test.ts` re-derives the census
+ * on every run and fails on ANY divergence, in BOTH directions: a name here that gains a valued
+ * read, or a new flags.has-only name missing from here, each forces a conscious decision.
+ *
+ * Two names are declared beyond the mechanical census, both documented:
+ * - `json` — its one valued read (cli.ts, the `--json <path>` recovery in the mcp-scan family) IS
+ *   the hand-patch for this very defect; with the flag declared boolean the recovery goes
+ *   harmlessly dead and `--json <path>` parses as flag + positional, which that code also accepts.
+ * - `force` — valued ONLY under `dz guard` (`--force <reason>`, the audited override); boolean in
+ *   every other command. Encoded via {@link VALUED_FORCE_COMMANDS}.
+ */
+export declare const BOOLEAN_CLI_FLAGS: ReadonlySet<string>;
+/** Commands where `--force` takes a VALUE (`--force <reason>`, logged) and must stay greedy. */
+export declare const VALUED_FORCE_COMMANDS: readonly string[];
+/** Is `--<name>` a boolean flag for this command — i.e. it must never swallow the next token? */
+export declare function isBooleanFlag(name: string, command: string): boolean;
+//# sourceMappingURL=boolean-flags.d.ts.map

package/dist/boolean-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boolean-flags.d.ts","sourceRoot":"","sources":["../src/boolean-flags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAwFhD,CAAC;AAEH,gGAAgG;AAChG,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAAc,CAAC;AAElE,iGAAiG;AACjG,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAGpE"}

package/dist/boolean-flags.js

@@ -0,0 +1,118 @@
+/**
+ * Boolean flags DECLARED AS DATA — feature boolean-flags-declared (backlog 247ddcfa).
+ *
+ * Before this file, `parseArgs` had no concept of a boolean flag: ANY `--flag` greedily consumed
+ * the next token unless it began with `--`. MEASURED 2026-08-22 on 0.7.0: `dz sync --dry-run .`
+ * turned the safety flag into the option `dry-run=.` — `flags.has('dry-run')` was FALSE and the
+ * run WROTE, its only trace a missing label. The same class swallowed positionals
+ * (`dz recall --no-semantic "torque"` ate the query) across ~72 commands.
+ *
+ * GENERATED from a census of `cli.ts` reads — `test/boolean-flags.test.ts` re-derives the census
+ * on every run and fails on ANY divergence, in BOTH directions: a name here that gains a valued
+ * read, or a new flags.has-only name missing from here, each forces a conscious decision.
+ *
+ * Two names are declared beyond the mechanical census, both documented:
+ * - `json` — its one valued read (cli.ts, the `--json <path>` recovery in the mcp-scan family) IS
+ *   the hand-patch for this very defect; with the flag declared boolean the recovery goes
+ *   harmlessly dead and `--json <path>` parses as flag + positional, which that code also accepts.
+ * - `force` — valued ONLY under `dz guard` (`--force <reason>`, the audited override); boolean in
+ *   every other command. Encoded via {@link VALUED_FORCE_COMMANDS}.
+ */
+export const BOOLEAN_CLI_FLAGS = new Set([
+    'affected',
+    'all',
+    'allow-same-family',
+    'allow-same-family-qe',
+    'any',
+    'apply',
+    'audit-dev',
+    'auto',
+    'books',
+    'bto',
+    'bump-only',
+    'by-stage',
+    'calibrate',
+    'check',
+    'confirm',
+    'context-only',
+    'deep',
+    'diff',
+    'done',
+    'dry-run',
+    'emit',
+    'enrich',
+    'fa-record',
+    'fail-on-undergrant',
+    'finalize',
+    'force',
+    'full',
+    'gates',
+    'guard',
+    'guards',
+    'harmonize',
+    'help',
+    'include-pairs',
+    'init',
+    'install',
+    'install-driver',
+    'install-hook',
+    'json',
+    'keep-scratch',
+    'legacy',
+    'lexical',
+    'list',
+    'live-content',
+    'mock',
+    'night',
+    'no-dry-run',
+    'no-evals',
+    'no-hooks',
+    'no-issue',
+    'no-memory',
+    'no-mirror',
+    'no-provenance',
+    'no-result',
+    'no-semantic',
+    'no-teach',
+    'no-verify',
+    'once',
+    'override',
+    'preview',
+    'provenance',
+    'prune-noise',
+    'prune-quarantine',
+    'publish',
+    'reconcile',
+    'record-provisional',
+    'refresh-publishes',
+    'remove',
+    'require-plan',
+    'require-signing',
+    'rerank',
+    'revise',
+    'scope-check',
+    'semantic',
+    'send',
+    'split',
+    'stages-json',
+    'static',
+    'stats',
+    'strict',
+    'tag',
+    'teach',
+    'usage',
+    'validate',
+    'weak',
+    'with-pairs',
+    'with-references',
+    'yes',
+]);
+/** Commands where `--force` takes a VALUE (`--force <reason>`, logged) and must stay greedy. */
+export const VALUED_FORCE_COMMANDS = ['guard'];
+/** Is `--<name>` a boolean flag for this command — i.e. it must never swallow the next token? */
+export function isBooleanFlag(name, command) {
+    if (name === 'force')
+        return !VALUED_FORCE_COMMANDS.includes(command);
+    return BOOLEAN_CLI_FLAGS.has(name);
+}
+//# sourceMappingURL=boolean-flags.js.map

package/dist/boolean-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boolean-flags.js","sourceRoot":"","sources":["../src/boolean-flags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IAC5D,UAAU;IACV,KAAK;IACL,mBAAmB;IACnB,sBAAsB;IACtB,KAAK;IACL,OAAO;IACP,WAAW;IACX,MAAM;IACN,OAAO;IACP,KAAK;IACL,WAAW;IACX,UAAU;IACV,WAAW;IACX,OAAO;IACP,SAAS;IACT,cAAc;IACd,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,MAAM;IACN,QAAQ;IACR,WAAW;IACX,oBAAoB;IACpB,UAAU;IACV,OAAO;IACP,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,WAAW;IACX,MAAM;IACN,eAAe;IACf,MAAM;IACN,SAAS;IACT,gBAAgB;IAChB,cAAc;IACd,MAAM;IACN,cAAc;IACd,QAAQ;IACR,SAAS;IACT,MAAM;IACN,cAAc;IACd,MAAM;IACN,OAAO;IACP,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,WAAW;IACX,WAAW;IACX,eAAe;IACf,WAAW;IACX,aAAa;IACb,UAAU;IACV,WAAW;IACX,MAAM;IACN,UAAU;IACV,SAAS;IACT,YAAY;IACZ,aAAa;IACb,kBAAkB;IAClB,SAAS;IACT,WAAW;IACX,oBAAoB;IACpB,mBAAmB;IACnB,QAAQ;IACR,cAAc;IACd,iBAAiB;IACjB,QAAQ;IACR,QAAQ;IACR,aAAa;IACb,UAAU;IACV,MAAM;IACN,OAAO;IACP,aAAa;IACb,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,KAAK;IACL,OAAO;IACP,OAAO;IACP,UAAU;IACV,MAAM;IACN,YAAY;IACZ,iBAAiB;IACjB,KAAK;CACN,CAAC,CAAC;AAEH,gGAAgG;AAChG,MAAM,CAAC,MAAM,qBAAqB,GAAsB,CAAC,OAAO,CAAC,CAAC;AAElE,iGAAiG;AACjG,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe;IACzD,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtE,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,EAA0B,KAAK,EAAa,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKjG,OAAO,EA4CL,iBAAiB,EAmBjB,KAAK,oBAAoB,EAyUzB,KAAK,YAAY,EAsClB,MAAM,yBAAyB,CAAC;AA4IjC,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACjE;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAk8E9E;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CA0BnF;AA22GD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAQzG;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,SAAkB,GAAG,iBAAiB,CAoB1G;AAwGD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,IAAI,GAAE,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,oBAA+C,EAC3G,KAAK,SAAa,GACjB,iBAAiB,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAK/D;AAsiED,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAElG;AA4BD,gFAAgF;AAChF,wBAAgB,qBAAqB,IAAI;IAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,MAAM,CAAA;CAAE,CAM7I;AA4+CD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAsB,EAC3B,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,eAAe,CAAC,CAI1B;AA8CD,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAEvG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE;IACJ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IAChC,kGAAkG;IAClG,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,GACA,OAAO,CAAC,eAAe,CAAC,CA8D1B;AAutED,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA0N5E"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,OAAO,EAAoC,KAAK,EAAa,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAK3G,OAAO,EA4CL,iBAAiB,EAmBjB,KAAK,oBAAoB,EA8UzB,KAAK,YAAY,EAyClB,MAAM,yBAAyB,CAAC;AAgJjC,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACjE;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAilF9E;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CA0BnF;AA64GD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAQzG;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,SAAkB,GAAG,iBAAiB,CAoB1G;AAwGD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,IAAI,GAAE,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,oBAA+C,EAC3G,KAAK,SAAa,GACjB,iBAAiB,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAK/D;AAsiED,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAElG;AA4BD,gFAAgF;AAChF,wBAAgB,qBAAqB,IAAI;IAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,MAAM,CAAA;CAAE,CAM7I;AAu0DD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAsB,EAC3B,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,eAAe,CAAC,CAI1B;AA8CD,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAEvG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE;IACJ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IAChC,kGAAkG;IAClG,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,GACA,OAAO,CAAC,eAAe,CAAC,CA8D1B;AAutED,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA8N5E"}