@dzhechkov/harness-core 0.3.23 → 0.3.25

package/dist/reconcile.d.ts

@@ -0,0 +1,79 @@
+/**
+ * `dz mcp-scan --reconcile` — static capability reconciliation (Phase 3).
+ *
+ * Joins two things `dz` can read deterministically:
+ *  - the project's GRANT surface (`scanMcp` of `.claude/settings*.json` + `.mcp.json`), and
+ *  - the aggregate DECLARED capabilities of the installed skills (`.claude/skills/<id>/SKILL.md`),
+ * then REPORTS the gaps (under-grant / over-grant) and, optionally, EMITS a
+ * least-privilege advisory policy artifact for a host to consume.
+ *
+ * HONESTY: `dz` is build-time / static. It does NOT run agents and CANNOT block,
+ * time out, or rate-limit a tool call. The HOST (Claude Code enforcing
+ * settings.json allow/deny; or an MCP server consuming a policy.json) is the only
+ * thing that enforces at call time. Verbs here are REPORT / RECONCILE / EMIT /
+ * CANDIDATE — never BLOCK / DENIED / ENFORCED.
+ *
+ * @packageDocumentation
+ */
+import type { McpScanReport } from './mcp-scan.js';
+/** The honesty banner — repeated in --help, the report header, and the artifact $comment. */
+export declare const RECONCILE_BANNER: string;
+/** A reconcilable capability axis (the axes BOTH the grant surface and the manifest expose). */
+export type ReconcileAxis = 'shell' | 'network' | 'file-write';
+/** Per-axis reconciliation state. */
+export interface AxisState {
+    readonly axis: ReconcileAxis;
+    /** Project permits this capability (from scanMcp). */
+    readonly grant: boolean;
+    /** At least one installed skill declares it needs this (declared === true). */
+    readonly need: boolean;
+    /** Skills that declared need (true) — for attribution. */
+    readonly needSkills: readonly string[];
+    /** Installed skills that are SILENT on this axis (declared === undefined). */
+    readonly silentCount: number;
+}
+/** A single reconciliation finding. */
+export interface ReconcileFinding {
+    readonly id: string;
+    readonly kind: 'under-grant' | 'over-grant';
+    readonly severity: 'medium' | 'low' | 'info';
+    readonly axis: ReconcileAxis;
+    readonly detail: string;
+    readonly skills: readonly string[];
+}
+/** Aggregated declared limits across installed skills (tightest values; inert). */
+export interface LimitsRollup {
+    readonly declaredBy: number;
+    readonly toolTimeoutMs?: number;
+    readonly maxToolCallsPerTurn?: number;
+    readonly requireApprovalForDangerous?: boolean;
+}
+/** The least-privilege advisory policy artifact (only written with --emit-policy). */
+export interface PolicyArtifact {
+    readonly $comment: string;
+    readonly version: 1;
+    readonly defaultDeny: true;
+    /** axis → true ONLY where an installed skill declared need; absent otherwise. */
+    readonly allow: Partial<Record<ReconcileAxis, true>>;
+    readonly limits?: LimitsRollup;
+    readonly derivedFrom: {
+        readonly grants: Record<ReconcileAxis, boolean>;
+        readonly declaredNeed: Record<ReconcileAxis, boolean>;
+        readonly skillsByAxis: Partial<Record<ReconcileAxis, readonly string[]>>;
+    };
+}
+/** Result of {@link reconcileCapabilities}. */
+export interface ReconcileReport {
+    readonly skillsDir: string;
+    readonly installedCount: number;
+    readonly axes: readonly AxisState[];
+    readonly findings: readonly ReconcileFinding[];
+    readonly limits: LimitsRollup | null;
+    readonly policy: PolicyArtifact;
+}
+/**
+ * Statically reconcile a project's GRANT surface against the DECLARED needs of
+ * its installed skills. Pure: same inputs → same report. No execution, no writes.
+ */
+export declare function reconcileCapabilities(report: McpScanReport, skillsDir: string): ReconcileReport;
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,6FAA6F;AAC7F,eAAO,MAAM,gBAAgB,QAGkD,CAAC;AAEhF,gGAAgG;AAChG,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,CAAC;AAG/D,qCAAqC;AACrC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,uCAAuC;AACvC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC;CAChD;AAED,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAChD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACtD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;KAC1E,CAAC;CACH;AAED,+CAA+C;AAC/C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC/C,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAqCD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,CA6E/F"}

package/dist/reconcile.js

@@ -0,0 +1,134 @@
+/**
+ * `dz mcp-scan --reconcile` — static capability reconciliation (Phase 3).
+ *
+ * Joins two things `dz` can read deterministically:
+ *  - the project's GRANT surface (`scanMcp` of `.claude/settings*.json` + `.mcp.json`), and
+ *  - the aggregate DECLARED capabilities of the installed skills (`.claude/skills/<id>/SKILL.md`),
+ * then REPORTS the gaps (under-grant / over-grant) and, optionally, EMITS a
+ * least-privilege advisory policy artifact for a host to consume.
+ *
+ * HONESTY: `dz` is build-time / static. It does NOT run agents and CANNOT block,
+ * time out, or rate-limit a tool call. The HOST (Claude Code enforcing
+ * settings.json allow/deny; or an MCP server consuming a policy.json) is the only
+ * thing that enforces at call time. Verbs here are REPORT / RECONCILE / EMIT /
+ * CANDIDATE — never BLOCK / DENIED / ENFORCED.
+ *
+ * @packageDocumentation
+ */
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parseDeclaredCapabilities, parseDeclaredLimits } from './capability-vocab.js';
+/** The honesty banner — repeated in --help, the report header, and the artifact $comment. */
+export const RECONCILE_BANNER = 'dz is build-time/static: it REPORTS the grant-vs-declaration gap and may EMIT an advisory policy, ' +
+    'but does NOT block, time out, or rate-limit anything. The HOST (Claude Code settings.json; or an MCP ' +
+    'server consuming policy.json) is the only thing that enforces at call time.';
+const AXES = ['shell', 'network', 'file-write'];
+function readInstalled(skillsDir) {
+    if (!existsSync(skillsDir))
+        return [];
+    let entries;
+    try {
+        entries = readdirSync(skillsDir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const e of entries) {
+        if (!e.isDirectory())
+            continue;
+        const md = join(skillsDir, e.name, 'SKILL.md');
+        if (!existsSync(md))
+            continue;
+        let content;
+        try {
+            content = readFileSync(md, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        out.push({ id: e.name, caps: parseDeclaredCapabilities(content), limits: parseDeclaredLimits(content) });
+    }
+    return out.sort((a, b) => a.id.localeCompare(b.id));
+}
+function grantFor(report, axis) {
+    const c = report.capabilities;
+    return axis === 'shell' ? c.shell : axis === 'network' ? c.network : c.fileWrite;
+}
+/**
+ * Statically reconcile a project's GRANT surface against the DECLARED needs of
+ * its installed skills. Pure: same inputs → same report. No execution, no writes.
+ */
+export function reconcileCapabilities(report, skillsDir) {
+    const installed = readInstalled(skillsDir);
+    const axes = [];
+    const findings = [];
+    const allow = {};
+    const grants = {};
+    const declaredNeed = {};
+    const skillsByAxis = {};
+    for (const axis of AXES) {
+        const grant = grantFor(report, axis);
+        const needSkills = installed.filter((s) => s.caps[axis] === true).map((s) => s.id);
+        const need = needSkills.length > 0;
+        const silentCount = installed.filter((s) => s.caps[axis] === undefined).length;
+        axes.push({ axis, grant, need, needSkills, silentCount });
+        grants[axis] = grant;
+        declaredNeed[axis] = need;
+        if (need) {
+            skillsByAxis[axis] = needSkills;
+            allow[axis] = true;
+        }
+        if (need && !grant) {
+            findings.push({
+                id: `MS-UNDERGRANT-${axis.toUpperCase()}`,
+                kind: 'under-grant',
+                severity: 'medium',
+                axis,
+                detail: `${needSkills.length} installed skill(s) declare needing ${axis}, but the grant surface does not permit it — the host will starve them at runtime. Add the grant or remove the skill(s).`,
+                skills: needSkills,
+            });
+        }
+        else if (grant && !need) {
+            // over-grant is ALWAYS advisory; downgrade to info when any skill is silent
+            // (it may genuinely need the grant but didn't declare), or when there are
+            // no installed skills at all.
+            const downgrade = silentCount > 0 || installed.length === 0;
+            findings.push({
+                id: `MS-OVERGRANT-${axis.toUpperCase()}`,
+                kind: 'over-grant',
+                severity: downgrade ? 'info' : 'low',
+                axis,
+                detail: `The project permits ${axis} but no installed skill declares needing it${silentCount > 0 ? ` (${silentCount} skill(s) silent on ${axis})` : ''} — least-privilege CANDIDATE to revoke; may be for the operator or a non-skill MCP server.`,
+                skills: [],
+            });
+        }
+    }
+    // limits roll-up (tightest values) — INERT, never a gate
+    const withLimits = installed.filter((s) => Object.keys(s.limits).length > 0);
+    let limits = null;
+    if (withLimits.length > 0) {
+        const tts = withLimits.map((s) => s.limits.toolTimeoutMs).filter((n) => typeof n === 'number');
+        const mcs = withLimits.map((s) => s.limits.maxToolCallsPerTurn).filter((n) => typeof n === 'number');
+        const ras = withLimits.some((s) => s.limits.requireApprovalForDangerous === true);
+        limits = {
+            declaredBy: withLimits.length,
+            ...(tts.length > 0 ? { toolTimeoutMs: Math.min(...tts) } : {}),
+            ...(mcs.length > 0 ? { maxToolCallsPerTurn: Math.min(...mcs) } : {}),
+            ...(ras ? { requireApprovalForDangerous: true } : {}),
+        };
+    }
+    const policy = {
+        $comment: `ADVISORY. ${RECONCILE_BANNER} A host MUST consume this; dz does not.`,
+        version: 1,
+        defaultDeny: true,
+        allow,
+        ...(limits ? { limits } : {}),
+        derivedFrom: { grants, declaredNeed, skillsByAxis },
+    };
+    // stable ordering: under-grant (medium) first, then over-grant
+    const order = { medium: 0, low: 1, info: 2 };
+    findings.sort((a, b) => order[a.severity] - order[b.severity] || a.axis.localeCompare(b.axis));
+    return { skillsDir, installedCount: installed.length, axes, findings, limits, policy };
+}
+//# sourceMappingURL=reconcile.js.map

package/dist/reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.js","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAuB,MAAM,uBAAuB,CAAC;AAG5G,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gBAAgB,GAC3B,oGAAoG;IACpG,uGAAuG;IACvG,6EAA6E,CAAC;AAIhF,MAAM,IAAI,GAA6B,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAgE1E,SAAS,aAAa,CAAC,SAAiB;IACtC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,IAAI,OAAmC,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,SAAS;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAAE,SAAS;QAC9B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,MAAqB,EAAE,IAAmB;IAC1D,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;IAC9B,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAqB,EAAE,SAAiB;IAC5E,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAE3C,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,KAAK,GAAyC,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,EAAoC,CAAC;IACpD,MAAM,YAAY,GAAG,EAAoC,CAAC;IAC1D,MAAM,YAAY,GAAsD,EAAE,CAAC;IAE3E,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QACnC,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACrB,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAC1B,IAAI,IAAI,EAAE,CAAC;YACT,YAAY,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,iBAAiB,IAAI,CAAC,WAAW,EAAE,EAAE;gBACzC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,IAAI;gBACJ,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,uCAAuC,IAAI,0HAA0H;gBACjM,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,4EAA4E;YAC5E,0EAA0E;YAC1E,8BAA8B;YAC9B,MAAM,SAAS,GAAG,WAAW,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,gBAAgB,IAAI,CAAC,WAAW,EAAE,EAAE;gBACxC,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;gBACpC,IAAI;gBACJ,MAAM,EAAE,uBAAuB,IAAI,8CAA8C,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,uBAAuB,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,4FAA4F;gBAClP,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAI,MAAM,GAAwB,IAAI,CAAC;IACvC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC5G,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAClH,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,2BAA2B,KAAK,IAAI,CAAC,CAAC;QAClF,MAAM,GAAG;YACP,UAAU,EAAE,UAAU,CAAC,MAAM;YAC7B,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAmB;QAC7B,QAAQ,EAAE,aAAa,gBAAgB,yCAAyC;QAChF,OAAO,EAAE,CAAC;QACV,WAAW,EAAE,IAAI;QACjB,KAAK;QACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE;KACpD,CAAC;IAEF,+DAA+D;IAC/D,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAW,CAAC;IACtD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/F,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACzF,CAAC"}

package/dist/targets.d.ts

@@ -8,15 +8,9 @@ import type { Adapter } from '@dzhechkov/core';
  * The targets the harness can initialise. The key is the CLI `--target` name
  * (`claude-code`, not `claude`); the value is the adapter that emits for it.
  */
-export declare const TARGETS: {
-    readonly 'claude-code': Adapter;
-    readonly codex: Adapter;
-    readonly opencode: Adapter;
-    readonly hermes: Adapter;
-    readonly openclaude: Adapter;
-};
 /** A valid `--target` name. */
-export type TargetName = keyof typeof TARGETS;
+export type TargetName = 'claude-code' | 'codex' | 'opencode' | 'hermes' | 'openclaude' | 'copilot';
+export declare const TARGETS: Record<TargetName, Adapter>;
 /** Every supported `--target` name. */
 export declare const TARGET_NAMES: TargetName[];
 /** Type guard: is `value` a supported `--target` name? */

package/dist/targets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"targets.d.ts","sourceRoot":"","sources":["../src/targets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,OAAO;;;;;;CAMwB,CAAC;AAE7C,+BAA+B;AAC/B,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,OAAO,CAAC;AAE9C,uCAAuC;AACvC,eAAO,MAAM,YAAY,EAA2B,UAAU,EAAE,CAAC;AAEjE,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,UAAU,CAE/D"}
+{"version":3,"file":"targets.d.ts","sourceRoot":"","sources":["../src/targets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE/C;;;GAGG;AACH,+BAA+B;AAC/B,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAC;AAKpG,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,CAO/C,CAAC;AAEF,uCAAuC;AACvC,eAAO,MAAM,YAAY,EAA2B,UAAU,EAAE,CAAC;AAEjE,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,UAAU,CAE/D"}

package/dist/targets.js

@@ -5,19 +5,20 @@
  */
 import { claudeAdapter } from '@dzhechkov/adapter-claude';
 import { codexAdapter } from '@dzhechkov/adapter-codex';
+import { copilotAdapter } from '@dzhechkov/adapter-copilot';
 import { hermesAdapter } from '@dzhechkov/adapter-hermes';
 import { opencodeAdapter } from '@dzhechkov/adapter-opencode';
 import { openclaudeAdapter } from '@dzhechkov/adapter-openclaude';
-/**
- * The targets the harness can initialise. The key is the CLI `--target` name
- * (`claude-code`, not `claude`); the value is the adapter that emits for it.
- */
+// Explicitly annotated (not `as const satisfies`) so the type is portable across
+// the workspace — adapters compiled against slightly different `@dzhechkov/core`
+// versions would otherwise make the inferred type un-nameable (TS2742).
 export const TARGETS = {
     'claude-code': claudeAdapter,
     codex: codexAdapter,
     opencode: opencodeAdapter,
     hermes: hermesAdapter,
     openclaude: openclaudeAdapter,
+    copilot: copilotAdapter,
 };
 /** Every supported `--target` name. */
 export const TARGET_NAMES = Object.keys(TARGETS);

package/dist/targets.js.map

@@ -1 +1 @@
-{"version":3,"file":"targets.js","sourceRoot":"","sources":["../src/targets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGlE;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,aAAa,EAAE,aAAa;IAC5B,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,eAAe;IACzB,MAAM,EAAE,aAAa;IACrB,UAAU,EAAE,iBAAiB;CACa,CAAC;AAK7C,uCAAuC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAiB,CAAC;AAEjE,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"targets.js","sourceRoot":"","sources":["../src/targets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAUlE,iFAAiF;AACjF,iFAAiF;AACjF,wEAAwE;AACxE,MAAM,CAAC,MAAM,OAAO,GAAgC;IAClD,aAAa,EAAE,aAAa;IAC5B,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,eAAe;IACzB,MAAM,EAAE,aAAa;IACrB,UAAU,EAAE,iBAAiB;IAC7B,OAAO,EAAE,cAAc;CACxB,CAAC;AAEF,uCAAuC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAiB,CAAC;AAEjE,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-core",
-  "version": "0.3.23",
+  "version": "0.3.25",
   "description": "Shared harness logic - skill loading, additive apply, and the init/sync/verify/doctor operations.",
   "type": "module",
   "license": "MIT",
@@ -29,8 +29,9 @@
     "@dzhechkov/adapter-hermes": "^0.2.0",
     "@dzhechkov/adapter-openclaude": "^0.1.0",
     "@dzhechkov/adapter-opencode": "^0.2.0",
-    "@dzhechkov/core": "^0.2.0",
-    "yaml": "^2.0.0"
+    "yaml": "^2.0.0",
+    "@dzhechkov/adapter-copilot": "0.1.0",
+    "@dzhechkov/core": "0.2.3"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",

package/src/benchmark.ts

@@ -11,6 +11,7 @@
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 
+import { detectScriptCapabilities, parseDeclaredCapabilities } from './capability-vocab.js';
 import { estimateSkillCost, type CostEstimate } from './cost-scoring.js';
 
 /** A single benchmark check result. */
@@ -19,6 +20,12 @@ export interface BenchmarkCheck {
   readonly name: string;
   readonly passed: boolean;
   readonly detail?: string | undefined;
+  /**
+   * When true this check is informational ONLY — it is excluded from the
+   * pass-rate / grade math (so it can ship without regressing existing grades).
+   * Surfaced as a warning in output. Used by S16 (capability-declaration nudge).
+   */
+  readonly advisory?: boolean;
 }
 
 /** Score for a single skill benchmark. */
@@ -160,11 +167,52 @@ export function benchmarkSkill(skillDir: string, skillId: string): BenchmarkScor
     || /\*\*\s*PROHIBITED/i.test(content);
   checks.push({ id: 'S14', name: 'anti-patterns or self-check', passed: hasAntiPatterns });
 
-  const passed = checks.filter((c) => c.passed).length;
-  const passRate = Math.round((passed / checks.length) * 100);
+  // S15: capability declaration matches usage (advisory, contradiction-only).
+  // Phase 1 auto-detects network + shell from scripts/ only (never SKILL.md prose).
+  // PASS unless a declared `capabilities.<cap>: false` is contradicted by detected
+  // usage. Absent block, or under-declaration (uses it, declares nothing), PASS —
+  // so the ~all skills that declare nothing today stay green.
+  const declaredCaps = parseDeclaredCapabilities(content);
+  const detectedCaps = detectScriptCapabilities(skillDir);
+  const contradictions: string[] = [];
+  if (detectedCaps.network && declaredCaps.network === false) contradictions.push('network');
+  if (detectedCaps.shell && declaredCaps.shell === false) contradictions.push('shell');
+  checks.push({
+    id: 'S15',
+    name: 'capability declaration matches usage',
+    passed: contradictions.length === 0,
+    detail:
+      contradictions.length > 0
+        ? `scripts use ${contradictions.join(' + ')} but capabilities declare it false`
+        : undefined,
+  });
+
+  // S16: side-effecting skills should declare their capabilities (ADVISORY — not
+  // graded). Warns when scripts use network/shell but the capability is not
+  // declared at all (neither true nor false). The adoption nudge for the manifest;
+  // excluded from the grade so it never regresses an existing skill.
+  const undeclaredUsed: string[] = [];
+  if (detectedCaps.network && declaredCaps.network === undefined) undeclaredUsed.push('network');
+  if (detectedCaps.shell && declaredCaps.shell === undefined) undeclaredUsed.push('shell');
+  checks.push({
+    id: 'S16',
+    name: 'side-effects declared (advisory)',
+    passed: undeclaredUsed.length === 0,
+    advisory: true,
+    detail:
+      undeclaredUsed.length > 0
+        ? `scripts use ${undeclaredUsed.join(' + ')} — add a capabilities: block declaring it`
+        : undefined,
+  });
+
+  // grade math is over GRADED checks only — advisory checks (S16) are excluded
+  // so they ship without changing any existing grade.
+  const graded = checks.filter((c) => !c.advisory);
+  const passed = graded.filter((c) => c.passed).length;
+  const passRate = graded.length > 0 ? Math.round((passed / graded.length) * 100) : 0;
 
   return {
-    skillId, skillDir, checks, passed, total: checks.length,
+    skillId, skillDir, checks, passed, total: graded.length,
     passRate, grade: gradeFromRate(passRate), cost: estimateSkillCost(content),
   };
 }
@@ -190,8 +238,12 @@ export function compareSkills(
   const skillA = benchmarkSkill(skillADir, skillAId);
   const skillB = benchmarkSkill(skillBDir, skillBId);
 
+  // deltaChecks is GRADED-ONLY — advisory checks (e.g. S16) never touch the grade,
+  // so surfacing them in the A/B diff would misrepresent an adoption nudge as a
+  // quality difference. Mirrors the graded filter in the grade math above.
   const deltaChecks: { id: string; aPass: boolean; bPass: boolean }[] = [];
   for (const checkA of skillA.checks) {
+    if (checkA.advisory) continue;
     const checkB = skillB.checks.find((c) => c.id === checkA.id);
     if (checkB && checkA.passed !== checkB.passed) {
       deltaChecks.push({ id: checkA.id, aPass: checkA.passed, bPass: checkB.passed });