@dzhechkov/harness-cli 0.8.5 → 0.8.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-cli",
-  "version": "0.8.5",
+  "version": "0.8.6",
   "description": "The dz CLI — install AI skills for Claude Code, Codex, OpenCode, Hermes, OpenClaude, GitHub Copilot. 83 commands, 14 presets, 10 platform targets.",
   "type": "module",
   "license": "MIT",
@@ -41,23 +41,23 @@
     "sbom.json"
   ],
   "dependencies": {
-    "@dzhechkov/harness-core": "^0.8.5",
-    "@dzhechkov/harness-presets": "^0.5.17",
-    "@dzhechkov/scout": "^0.8.10",
-    "@dzhechkov/skills-devops": "^0.3.16",
-    "@dzhechkov/skills-mcp": "^0.3.9",
-    "@dzhechkov/skills-web3": "^0.2.8",
-    "@dzhechkov/skills-qe": "^0.3.13",
-    "@dzhechkov/skills-meta": "^0.9.54",
-    "@dzhechkov/skills-academic": "^0.3.6",
-    "@dzhechkov/skills-ecc": "^0.1.11",
-    "@dzhechkov/skills-news": "^0.1.15",
-    "@dzhechkov/skills-pm": "^0.1.4",
-    "@dzhechkov/skills-taste": "^0.1.4",
-    "@dzhechkov/skills-idea2prd": "^0.1.14",
-    "@dzhechkov/skills-reverse-engineering": "^0.3.3",
-    "@dzhechkov/skills-presentation-storyteller": "^0.1.13",
-    "@dzhechkov/skills-website-cloner": "^0.1.4"
+    "@dzhechkov/harness-core": "^0.8.6",
+    "@dzhechkov/scout": "^0.8.11",
+    "@dzhechkov/skills-mcp": "^0.3.10",
+    "@dzhechkov/harness-presets": "^0.5.18",
+    "@dzhechkov/skills-devops": "^0.3.17",
+    "@dzhechkov/skills-web3": "^0.2.9",
+    "@dzhechkov/skills-qe": "^0.3.14",
+    "@dzhechkov/skills-meta": "^0.9.55",
+    "@dzhechkov/skills-academic": "^0.3.7",
+    "@dzhechkov/skills-ecc": "^0.1.12",
+    "@dzhechkov/skills-news": "^0.1.16",
+    "@dzhechkov/skills-idea2prd": "^0.1.15",
+    "@dzhechkov/skills-pm": "^0.1.5",
+    "@dzhechkov/skills-reverse-engineering": "^0.3.4",
+    "@dzhechkov/skills-presentation-storyteller": "^0.1.14",
+    "@dzhechkov/skills-taste": "^0.1.5",
+    "@dzhechkov/skills-website-cloner": "^0.1.5"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",
@@ -72,10 +72,13 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/djd1m/dz-harness-hub.git",
+    "url": "git+https://github.com/djd1m/dz-harness.git",
     "directory": "packages/@dzhechkov/harness-cli"
   },
-  "homepage": "https://github.com/djd1m/dz-harness-hub/tree/main/packages/@dzhechkov/harness-cli#readme",
+  "homepage": "https://github.com/djd1m/dz-harness/tree/main/packages/@dzhechkov/harness-cli#readme",
+  "bugs": {
+    "url": "https://github.com/djd1m/dz-harness/issues"
+  },
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "test": "vitest run",

package/sbom.json

@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e74440eef6812dbeaa550bdbbd80483e4cf4f38c22857260c534726f14ebb680"
+          "content": "4a54061280f2c8a3173a07e43492a73a927fdb98dccf6c1acd933735e5b9aca5"
         }
       ]
     },
@@ -125,7 +125,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a5d8d7579320ddbb30016d48c6d74a8ecf5628d90efe3925ed8ecb06cde7477c"
+          "content": "d02abab0b734f19ac7e75d7a28b25ae43cbfc025911128c5848f8e81ba2bf01f"
         }
       ]
     },
@@ -135,7 +135,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "bee6b00ec45da2d49c60ff85a675f989100bf703ce05cbaa5e4f730417161ccc"
+          "content": "3ac75ba951cac7ae985b2b7407ffb2645ef36d98f44897d9094b00f4db20517f"
         }
       ]
     },
@@ -145,7 +145,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e68711d595224a75faf9527aa6ec186b0c37ef551470c9df3690b780efe9cfd5"
+          "content": "c7c308fbc3d596905c25760ba8fa337656f42de06d0565f73ad7c230979a514d"
         }
       ]
     },
@@ -339,7 +339,7 @@
         },
         {
           "name": "dz:canonical-json-sha256-v2",
-          "value": "11df4bc14008b0e123b91bf5dc395589a147c24de3afd1f7beb58093ec753325"
+          "value": "2549a7e988b7a04071319dbbad8917d4231cd648720e70485a594ee9e3bd4aa1"
         }
       ]
     },
@@ -369,7 +369,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6d402ac972df1c859da5996a65dbd94699f5df5080217cf6fce9af354fe92699"
+          "content": "5ff3270b1b82fe28e15d09f37d8099468102abc926512303c7ef76e6c75ecf0d"
         }
       ]
     },

package/src/cli.ts

@@ -15,6 +15,7 @@ import { execFile, execFileSync, execSync, spawn, spawnSync, type ChildProcess }
 import { createHash, randomBytes } from 'node:crypto';
 import { homedir, tmpdir } from 'node:os';
 import { createRequire } from 'node:module';
+import { isDeepStrictEqual } from 'node:util';
 
 import {
   createSkill,
@@ -283,6 +284,7 @@ import {
   harvestStageOutcomes,
   recommendModels,
   planFeed,
+  unfedRuns,
   GRADE_SUCCESS_FLOOR,
   COST_LADDER,
   splitScenarios,
@@ -609,7 +611,7 @@ Usage:
   dz backlog ship <id> [<id>…] [--reason <t>] [--dry-run] [--project <dir>] [--json]   (mark work DONE: new|enriched|in-progress → shipped, removing it from the roulette pool — run it after finishing a task; short id prefixes ok, ambiguous = loud error)
   dz backlog drop <id> [<id>…] [--reason <t>] [--dry-run] [--project <dir>] [--json]   (retire an idea: new|enriched|in-progress → dropped)
   dz backlog edit <id> --text "<new>" | --append "<more>" [--dry-run] [--project <dir>] [--json]   (rewrite ONE idea's text, preserving every other field; re-embeds the dedup vector, and on a failed re-embed MARKS the record embedStale so dedup refuses to trust it — previous text preserved in .dz/backlog/edits.jsonl)
-  dz routing recommend [--tier <t>] [--apply] [--json]   (per-stage args.models suggestion from REAL telemetry — harness records + imported run-meta sidecars — printed WITH its basis: n runs, window, the grade-floor rule, skip reasons; qe is FORCED cross-family of code; --apply feeds .dz/routing-outcomes.json idempotently by runId)
+  dz routing recommend [--tier <t>] [--apply] [--json]   (per-stage args.models suggestion from REAL telemetry — harness records + imported run-meta sidecars — printed WITH its basis + current/STALE/UNFED store receipt; qe is FORCED cross-family of code; --apply feeds .dz/routing-outcomes.json idempotently by runId)
   dz backlog reopen <id> [<id>…] [--reason <t>] [--dry-run] [--project <dir>] [--json]   (back to the pool: shipped|dropped|in-progress → new)
   dz backlog enrich <id> [--project <dir>] [--json]                        (stage the idea2prd input scaffold in features/<slug>/ and hand off to the idea2prd-manual skill — the CLI never fabricates a PRD)
   dz backlog jira <id> [--project <dir>] [--json]                          (draft a Jira issue via the configurable adapter (backlog.jira.adapter: jira-mcp|copilot-mcp|none); none writes an auditable jira-outbox/<id>.json stub)
@@ -7833,6 +7835,90 @@ function gatherReadmeCounts(root: string): { label: string; a: number; b: number
 function gatherGuardFacts(op: string, root: string, text: string | undefined, storeCap: number): Record<string, unknown> {
   const facts: Record<string, unknown> = { op };
   if (op === 'publish') {
+    // Advisory I/O: unreadable telemetry or fed state is absence of evidence, never a fabricated
+    // stale finding and never a publish blocker.
+    try {
+      const routing = readRoutingTelemetry(root);
+      facts['routingFreshness'] = { unfedRunIds: unfedRuns(routing.harvest.samples, routing.alreadyFed) };
+    } catch { /* fail-open: routing-store-stale is SOFT and needs gathered evidence */ }
+    // marketplace-parity: regenerate the two published showcase manifests from the LIVE registry,
+    // but redirect every write to a unique temp root. Version is operator-owned, so pinning the
+    // published value into generatePlugin makes the comparison composition-only by construction.
+    try {
+      const showcaseDir = join(root, '.claude-plugin');
+      if (!existsSync(showcaseDir)) {
+        facts['marketplaceParity'] = { applicable: false };
+      } else {
+        const pluginPath = join(showcaseDir, 'plugin.json');
+        const marketplacePath = join(showcaseDir, 'marketplace.json');
+        const hasPlugin = existsSync(pluginPath);
+        const hasMarketplace = existsSync(marketplacePath);
+        const manifestFailures: { file: 'plugin.json' | 'marketplace.json'; error: string }[] = [];
+        const readManifest = (path: string, file: 'plugin.json' | 'marketplace.json'): unknown => {
+          try {
+            return JSON.parse(readFileSync(path, 'utf8')) as unknown;
+          } catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            manifestFailures.push({ file, error: message.replace(/\s+/g, ' ').slice(0, 240) });
+            return undefined;
+          }
+        };
+        const versionOf = (manifest: unknown): string | undefined => {
+          if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) return undefined;
+          const version = (manifest as Record<string, unknown>)['version'];
+          return typeof version === 'string' && version !== '' ? version : undefined;
+        };
+        const publishedPlugin = hasPlugin ? readManifest(pluginPath, 'plugin.json') : undefined;
+        const publishedMarketplace = hasMarketplace ? readManifest(marketplacePath, 'marketplace.json') : undefined;
+        const marketplaceRecord = publishedMarketplace && typeof publishedMarketplace === 'object' && !Array.isArray(publishedMarketplace)
+          ? publishedMarketplace as Record<string, unknown>
+          : undefined;
+        const marketplacePlugins = marketplaceRecord !== undefined && Array.isArray(marketplaceRecord['plugins'])
+          ? marketplaceRecord['plugins']
+          : [];
+        const publishedVersion = versionOf(publishedPlugin)
+          ?? versionOf(publishedMarketplace)
+          ?? versionOf(marketplacePlugins[0]);
+        if (manifestFailures.length > 0) {
+          facts['marketplaceParity'] = {
+            applicable: true,
+            manifestFailures,
+            ...(publishedVersion !== undefined ? { publishedVersion } : {}),
+          };
+        } else if (hasPlugin !== hasMarketplace) {
+          facts['marketplaceParity'] = {
+            applicable: true,
+            onlyOnePresent: true,
+            ...(publishedVersion !== undefined ? { publishedVersion } : {}),
+          };
+        } else if (!hasPlugin) {
+          facts['marketplaceParity'] = { applicable: false };
+        } else {
+          let scratch: string | undefined;
+          try {
+            const registry = buildRegistry(root);
+            scratch = mkdtempSync(join(tmpdir(), 'dz-guard-marketplace-'));
+            const generated = generatePlugin(scratch, registry, { version: publishedVersion });
+            const freshPlugin = JSON.parse(readFileSync(generated.pluginJsonPath, 'utf8')) as unknown;
+            const freshMarketplace = JSON.parse(readFileSync(generated.marketplaceJsonPath, 'utf8')) as unknown;
+            facts['marketplaceParity'] = {
+              applicable: true,
+              diverged: !isDeepStrictEqual(publishedPlugin, freshPlugin)
+                || !isDeepStrictEqual(publishedMarketplace, freshMarketplace),
+              ...(publishedVersion !== undefined ? { publishedVersion } : {}),
+            };
+          } catch {
+            facts['marketplaceParity'] = {
+              applicable: true,
+              regenerateFailed: true,
+              ...(publishedVersion !== undefined ? { publishedVersion } : {}),
+            };
+          } finally {
+            if (scratch !== undefined) rmSync(scratch, { recursive: true, force: true });
+          }
+        }
+      }
+    } catch { /* fail-open only on unexpected showcase-discovery failure; manifest read/parse errors are structured violations above */ }
     // agents-md-policy-sync: fixed registry, no tree walk. The pure detector
     // recomputes every expected hash from current source text; this gatherer
     // only supplies bytes. Any unexpected gather failure omits the fact, and
@@ -14272,6 +14358,34 @@ async function cmdBacklog(options: Map<string, string>, flags: Set<string>, cwd:
   return sub === undefined ? 0 : 1;
 }
 
+/** Read the recommender's existing telemetry planes plus its idempotency receipt. One adapter is
+ * shared by `recommend` and the publish advisory so their freshness definitions cannot drift. */
+function readRoutingTelemetry(repoRoot: string): { harvest: ReturnType<typeof harvestStageOutcomes>; alreadyFed: string[] } {
+  const records: unknown[] = readHarnessRecords(repoRoot);
+  for (const base of [join(repoRoot, 'features'), join(repoRoot, '.dz', 'loop-trace')]) {
+    if (!existsSync(base)) continue;
+    let names: string[] = [];
+    try { names = readdirSync(base); } catch { continue; }
+    for (const name of names) {
+      const sidecar = join(base, name, 'run-meta.json');
+      if (!existsSync(sidecar)) continue;
+      try {
+        const meta = JSON.parse(readFileSync(sidecar, 'utf-8')) as { runMeta?: { resolved?: boolean; records?: unknown[] } };
+        if (meta.runMeta?.resolved === true && Array.isArray(meta.runMeta.records)) records.push(...meta.runMeta.records);
+      } catch { /* an unreadable sidecar contributes no asserted record */ }
+    }
+  }
+  let alreadyFed: string[] = [];
+  const fedPath = join(repoRoot, '.dz', 'routing-fed.json');
+  if (existsSync(fedPath)) {
+    const parsed = JSON.parse(readFileSync(join(repoRoot, '.dz', 'routing-fed.json'), 'utf-8')) as unknown;
+    if (!Array.isArray(parsed)) throw new Error('.dz/routing-fed.json must be a JSON array of runIds');
+    if (parsed.some((v) => typeof v !== 'string')) throw new Error('.dz/routing-fed.json contains a non-string runId');
+    alreadyFed = parsed as string[];
+  }
+  return { harvest: harvestStageOutcomes(records), alreadyFed };
+}
+
 /**
  * `dz routing` — inspect the learned cost-optimal routing outcome store (feature learned-cost-routing). Shows
  * what `args.models[stage]='auto-cost'` currently believes per (stage, complexity-tier, model): gated
@@ -14286,28 +14400,20 @@ function cmdRouting(options: Map<string, string>, flags: Set<string>, cwd: strin
   // ── recommend — harvest real telemetry, print per-stage picks WITH THE BASIS, optionally feed the
   // store (a9c3dd5c fn 3, ADR-001). Sources: live harness records + imported run-meta.json sidecars.
   if (options.get('_positional_0') === 'recommend') {
-    const records: unknown[] = readHarnessRecords(repoRoot);
-    // imported runs (trace-bundle ADR-001 D4): run-meta sidecars carry runMeta.records of the SAME shape
-    for (const base of [join(repoRoot, 'features'), join(repoRoot, '.dz', 'loop-trace')]) {
-      if (!existsSync(base)) continue;
-      let names: string[] = [];
-      try { names = readdirSync(base); } catch { continue; }
-      for (const name of names) {
-        const sidecar = join(base, name, 'run-meta.json');
-        if (!existsSync(sidecar)) continue;
-        try {
-          const meta = JSON.parse(readFileSync(sidecar, 'utf-8')) as { runMeta?: { resolved?: boolean; records?: unknown[] } };
-          if (meta.runMeta?.resolved === true && Array.isArray(meta.runMeta.records)) records.push(...meta.runMeta.records);
-        } catch { /* an unreadable sidecar contributes nothing — counted below as noResult */ }
-      }
+    let routing: ReturnType<typeof readRoutingTelemetry>;
+    try { routing = readRoutingTelemetry(repoRoot); }
+    catch (e) {
+      write(`dz routing recommend: cannot read routing freshness state — ${(e as Error).message}`);
+      return 1;
     }
-    const harvest = harvestStageOutcomes(records);
-    const rec = recommendModels(harvest, { ...(options.get('tier') !== undefined ? { tier: options.get('tier')! } : {}) });
+    const harvest = routing.harvest;
+    let rec = recommendModels(harvest, {
+      ...(options.get('tier') !== undefined ? { tier: options.get('tier')! } : {}),
+      alreadyFed: routing.alreadyFed,
+    });
     if (flags.has('apply')) {
       const fedPath = join(repoRoot, '.dz', 'routing-fed.json');
-      let alreadyFed: string[] = [];
-      try { alreadyFed = JSON.parse(readFileSync(fedPath, 'utf-8')) as string[]; } catch { /* first apply */ }
-      const plan = planFeed(harvest.samples, alreadyFed);
+      const plan = planFeed(harvest.samples, routing.alreadyFed);
       for (const sample of plan.toFeed) finalizeOutcome(repoRoot, sample.stage, sample.tier, sample.model, sample.success);
       try {
         mkdirSync(join(repoRoot, '.dz'), { recursive: true });
@@ -14316,6 +14422,10 @@ function cmdRouting(options: Map<string, string>, flags: Set<string>, cwd: strin
         write(`dz routing recommend: fed ${plan.toFeed.length} sample(s) but could NOT persist the fed-set — a re-apply WILL double-count: ${(e as Error).message}`);
         return 1;
       }
+      rec = recommendModels(harvest, {
+        ...(options.get('tier') !== undefined ? { tier: options.get('tier')! } : {}),
+        alreadyFed: plan.fedAfter,
+      });
       write(`dz routing recommend --apply: fed ${plan.toFeed.length} sample(s) into .dz/routing-outcomes.json${plan.skippedRuns.length > 0 ? `; skipped ${plan.skippedRuns.length} already-fed run(s) (idempotent by runId)` : ''}`);
     }
     if (flags.has('json')) {
@@ -14327,6 +14437,9 @@ function cmdRouting(options: Map<string, string>, flags: Set<string>, cwd: strin
       write(`  ${s.stage.padEnd(14)} ${s.spec.padEnd(20)} ${s.insufficientData ? '[insufficient data — cold-start pick]' : '[quality bar met]'} ${s.pick.evidence}`);
     }
     write(`  basis: ${rec.basis.rule}`);
+    if (rec.basis.freshness === 'current') write('  store: current (0 unharvested runs)');
+    else if (rec.basis.freshness === 'stale') write(`  store: STALE — ${rec.basis.unfed.count} run(s) harvested but never fed; auto-cost is routing from an older snapshot — run \`dz routing recommend --apply\``);
+    else write('  store: UNFED — auto-cost has no learned rows; picks below are cold-start');
     write(`  basis: skipped records — no result ${rec.basis.skipped.noResult}, no modelsUsed ${rec.basis.skipped.noModels} (predates model routing — history, not an error), no grade ${rec.basis.skipped.noGrade}, unknown model ${rec.basis.skipped.unknownModel}`);
     write(`  basis: ${rec.basis.crossFamilyNote}`);
     return 0;