@dzhechkov/harness-core 0.8.11 → 0.8.21

package/src/setup.ts

@@ -17,10 +17,17 @@
  */
 
 import { existsSync, mkdirSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { execSync } from 'node:child_process';
+import { basename, dirname, join } from 'node:path';
+import { execSync, spawnSync } from 'node:child_process';
 
 import { mergeManagedHookEntries } from './managed-hooks.js';
+import {
+  CLAUDE_DESTRUCTIVE_HOOK_COMMAND,
+  CLAUDE_DESTRUCTIVE_HOOK_MATCHER,
+  CLAUDE_DESTRUCTIVE_HOOK_RELPATH,
+  generateClaudeDestructiveHook,
+  isDzManagedHookBody,
+} from './claude-hooks-assets.js';
 import { applyIntegrationFragments, IntegrationApplyError } from './integration-apply.js';
 
 /** Memory backend type. */
@@ -251,6 +258,102 @@ export function commandsOf(entry: unknown): string[] {
   return [String(e?.command ?? '')];
 }
 
+export interface GuardInstallReceipt {
+  /** True ONLY when the installed file was RUN and refused a command it must refuse. */
+  readonly ok: boolean;
+  /** What was observed — an exit code and the first line it printed, or why it could not run. */
+  readonly detail: string;
+}
+
+/**
+ * Prove the installed hook WORKS, by running it (feature `destructive-command-guard`, review
+ * round 4, P2).
+ *
+ * Presence is not proof and a successful write is not proof either: the body must load its decider
+ * (which lives in another package directory), and that resolution is exactly what broke in the
+ * global-install layout one round ago. So the receipt is POSITIVE and end-to-end — the file is
+ * spawned with a payload it is obliged to refuse, and only `exit 2` carrying our marker counts.
+ * Anything else — a crash, a silent pass, a missing file, a spawn that could not happen — is `ok:
+ * false` with the observation named, never an assumption about the cause.
+ *
+ * The registry entry is written only when this returns `ok`. A hook that is registered but cannot
+ * run is worse than no hook at all: the breakage lands on EVERY Bash call instead of on none.
+ *
+ * SAFETY PRECONDITION (round 11): this SPAWNS the file, so the caller must only ever call it on a
+ * body dz owns — one carrying the ownership marker, or one dz has just written itself. Calling it
+ * on a preserved foreign body turns `dz setup` into a runner for whatever a cloned repository
+ * committed at that path.
+ */
+export function probeInstalledGuard(
+  hookPath: string,
+  opts: { projectRoot?: string } = {},
+): GuardInstallReceipt {
+  const payload = JSON.stringify({
+    hook_event_name: 'PreToolUse',
+    tool_name: 'Bash',
+    tool_input: { command: 'rm -rf .agentic-qe' },
+  });
+  let run;
+  try {
+    // DZ_GUARD_TRUSTED_ONLY makes the hook resolve its decision module from the INSTALLED
+    // harness-core alone. Without it the probe imports the project's own copy first, so a cloned
+    // repository that commits `packages/@dzhechkov/harness-core/dist/destructive-guard-hook.js`
+    // gets its top-level JavaScript executed by `dz setup` — the round-11 protection ("a foreign
+    // BODY is never spawned") one resolution step further in (cross-family review, gpt-5.6-sol,
+    // round 13). MEASURED before the fix: the planted module's marker reached stderr and its
+    // decider answered `allow`.
+    const env: NodeJS.ProcessEnv = { ...process.env, DZ_GUARD_TRUSTED_ONLY: '1' };
+    if (opts.projectRoot !== undefined) env.CLAUDE_PROJECT_DIR = opts.projectRoot;
+    run = spawnSync(process.execPath, [hookPath], {
+      input: payload,
+      encoding: 'utf-8',
+      timeout: 15_000,
+      env,
+    });
+  } catch (err) {
+    return { ok: false, detail: `не удалось запустить хук: ${String((err as Error).message)}` };
+  }
+  if (run.error !== undefined) return { ok: false, detail: `не удалось запустить хук: ${run.error.message}` };
+  const firstLine = String(run.stderr ?? '').split('\n')[0] ?? '';
+  if (run.status !== 2 || !firstLine.includes('DZ-DESTRUCTIVE:')) {
+    return {
+      ok: false,
+      detail: `установленный хук НЕ отказал на контрольной команде (код выхода ${String(run.status)}; ${firstLine || 'пустой stderr'})`,
+    };
+  }
+  return { ok: true, detail: 'живая проба: отказ на контрольной команде, код выхода 2' };
+}
+
+/**
+ * The destructive-command guard's registry entry (feature `destructive-command-guard`, task T8).
+ *
+ * Emitted for EVERY backend, because the guard has nothing to do with where learning memory is
+ * stored. MEASURED 2026-09-05, before this existed: `dz setup --target claude-code` into a clean
+ * project wrote no `PreToolUse` key at all and created no `.claude/hooks/` — the guard we document
+ * protected only our own checkout.
+ */
+const CLAUDE_DESTRUCTIVE_HOOK_TIMEOUT_MS = 5000;
+const LEGACY_CLAUDE_DESTRUCTIVE_HOOK_COMMANDS: ReadonlySet<string> = new Set([
+  `node "\${CLAUDE_PROJECT_DIR:-.}/${CLAUDE_DESTRUCTIVE_HOOK_RELPATH}"`,
+]);
+
+/** Attribute only commands dz actually emitted, never arbitrary text that mentions the path. */
+function isManagedClaudeDestructiveHookCommand(command: string): boolean {
+  return command === CLAUDE_DESTRUCTIVE_HOOK_COMMAND
+    || LEGACY_CLAUDE_DESTRUCTIVE_HOOK_COMMANDS.has(command);
+}
+
+function destructiveGuardHookEntry(): { matcher: string; hooks: { type: string; command: string; timeout: number }[] } {
+  return {
+    matcher: CLAUDE_DESTRUCTIVE_HOOK_MATCHER,
+    hooks: [{
+      type: 'command',
+      command: CLAUDE_DESTRUCTIVE_HOOK_COMMAND,
+      timeout: CLAUDE_DESTRUCTIVE_HOOK_TIMEOUT_MS,
+    }],
+  };
+}
+
 export function generateHooksConfig(projectRoot: string, backend: MemoryBackend): string {
   const dzDir = join(projectRoot, '.dz');
 
@@ -272,6 +375,7 @@ export function generateHooksConfig(projectRoot: string, backend: MemoryBackend)
         SessionStart: [{ hooks: [{ type: 'command', command: `node ${JSON.stringify(writer)} start` }] }],
         SessionEnd: [{ hooks: [{ type: 'command', command: `node ${JSON.stringify(writer)} end` }] }],
         PreCompact: [{ hooks: [{ type: 'command', command: `node ${JSON.stringify(writer)} precompact`, runInBackground: true }] }],
+        PreToolUse: [destructiveGuardHookEntry()],
       },
     }, null, 2);
   }
@@ -289,6 +393,7 @@ export function generateHooksConfig(projectRoot: string, backend: MemoryBackend)
       SessionStart: [{ hooks: [{ type: 'command', command: jsonlCmd('start') }] }],
       SessionEnd: [{ hooks: [{ type: 'command', command: jsonlCmd('end') }] }],
       PreCompact: [{ hooks: [{ type: 'command', command: jsonlCmd('precompact'), runInBackground: true }] }],
+      PreToolUse: [destructiveGuardHookEntry()],
     },
   }, null, 2);
 }
@@ -614,10 +719,125 @@ export function runSetup(opts: SetupOptions): SetupResult {
   if (!opts.noHooks) {
     const settingsDir = join(opts.projectRoot, '.claude');
     const settingsPath = join(settingsDir, 'settings.json');
+
+    // The BODY goes in first, and the ENTRY goes in only after a LIVE receipt that the body runs
+    // and refuses. Written from the INSTALLED package, never copied out of our repository — a
+    // consumer has no `packages/@dzhechkov/...` above their project.
+    //
+    // Round 4, P2: these two used to be independent. A failed write was recorded as an error and
+    // the entry was merged anyway, so a consumer whose install failed got a `PreToolUse` entry
+    // pointing at something that is not a runnable hook — and that breaks EVERY Bash call, not one.
+    //
+    // Round 5, P1: the write was also UNCONDITIONAL. Setup is additive everywhere else — the
+    // settings merge keeps the user's own hooks, `.gitignore` is appended to, an existing skill is
+    // skipped — and this path overwrote a well-known filename with no ownership check, so a
+    // consumer's hand-authored `.claude/hooks/destructive-guard.cjs` was destroyed by a routine
+    // run. A body we wrote carries a MARKER; a file without it is the consumer's, and only an
+    // explicit `--force` may replace it, after a timestamped backup.
+    const hookPath = join(opts.projectRoot, ...CLAUDE_DESTRUCTIVE_HOOK_RELPATH.split('/'));
+    let installError: string | null = null;
+    let preserved: string | null = null;
+    let backupPath: string | null = null;
+
+    // Unreadable (absent, or something that is not a file at all) is NOT a claim of ownership: it
+    // falls through to the write, whose failure the round-4 receipt below already reports.
+    let current: string | null = null;
+    try {
+      current = readFileSync(hookPath, 'utf-8');
+    } catch {
+      current = null;
+    }
+    const foreign = current !== null && !isDzManagedHookBody(current);
+
+    if (foreign && opts.force !== true) {
+      preserved =
+        'файл на этом пути не наш (нет маркера dz) — ОСТАВЛЕН нетронутым и НЕ ЗАПУСКАЛСЯ; запись в settings.json на этот путь тоже не трогаем (ни своей не добавляем, ни вашу не снимаем); заменить: dz setup --force';
+    } else {
+      try {
+        if (foreign && current !== null) {
+          // Same shape as the codex `hooks.json` backup: the original beside the original, stamped,
+          // so `--force` is recoverable rather than merely loud.
+          backupPath = `${hookPath}.bak-${new Date().toISOString().replace(/[:.]/g, '-')}`;
+          writeFileSync(backupPath, current);
+        }
+        mkdirSync(dirname(hookPath), { recursive: true });
+        writeFileSync(hookPath, generateClaudeDestructiveHook(), { mode: 0o755 });
+      } catch (err) {
+        installError = String((err as Error).message);
+      }
+    }
+    const foreignBodyKept = preserved !== null;
+
+    // The receipt SPAWNS the file, so it may only ever be taken on a body dz owns.
+    //
+    // Round 11, P1 SECURITY — correcting my own round-5 sentence, "the receipt is taken from the
+    // file that IS there". Combined with round 6, which preserves a body dz does not own, that made
+    // `dz setup` EXECUTE whatever a repository had committed at this path: clone a hostile repo,
+    // run the documented setup command, and its `.claude/hooks/destructive-guard.cjs` ran — with
+    // none of the host's hook-trust prompting in between. MEASURED: a foreign body writing a marker
+    // file had written it by the time setup returned.
+    //
+    // So a preserved foreign body is NOT probed, NOT registered, and NOT run. `--force` is consent
+    // to REPLACE it (our body is written above, before this line) — never consent to execute it.
+    // The receipt is still taken whether or not the write threw, because a failed write over an
+    // OLDER BODY OF OURS leaves something we may legitimately run.
+    const receipt: GuardInstallReceipt = foreignBodyKept
+      ? { ok: false, detail: 'проба не проводилась — запускать чужой файл не наше право' }
+      : probeInstalledGuard(hookPath);
+    // Round 8, P2: ownership of the ENTRY follows ownership of the BODY, never the filename.
+    //
+    // Round 6 preserved a consumer's hook file; attribution of its registry entry stayed path-only,
+    // so a routine run deleted the registration of the very file it had just decided not to touch —
+    // their hook left on disk and switched off (MEASURED: their `PreToolUse` entry came back `[]`).
+    // The reverse was just as wrong: a foreign body that happened to refuse made dz ADD an entry
+    // for somebody else's file (MEASURED), taking responsibility for code it may neither read as
+    // its own nor replace.
+    //
+    // So when a foreign body is kept, dz stands down from the whole event: it adds nothing, and
+    // `isManaged` below stops claiming an entry that points at that path. Whether the foreign hook
+    // refuses is not merely the consumer's business — it is a question dz no longer ASKS, because
+    // asking meant running their file (round 11). All of it is said in one line rather than left
+    // for them to find by diffing settings.json.
+    const guardArmed = receipt.ok && !foreignBodyKept;
+    // The receipt is taken from the file that IS at the path — ours, or the one we preserved. A
+    // foreign hook that demonstrably refuses is registered on its own merits; a foreign hook that
+    // does not refuse gets no entry, exactly like a failed install (round 4).
+    const notes = [
+      preserved === null ? '' : `${preserved}; `,
+      backupPath === null ? '' : `прежний файл сохранён: ${basename(backupPath)}; `,
+      installError === null ? '' : `${installError}; `,
+    ].join('');
+    steps.push(
+      guardArmed
+        ? { name: 'Install destructive guard', status: 'done', detail: `${notes}${CLAUDE_DESTRUCTIVE_HOOK_RELPATH} — ${receipt.detail}` }
+        : {
+            name: 'Install destructive guard',
+            status: preserved === null ? 'error' : 'skipped',
+            detail: `${notes}${receipt.detail} — запись в settings.json НЕ добавлена`,
+          },
+    );
     const generated = JSON.parse(generateHooksConfig(opts.projectRoot, backend)) as {
       hooks: Record<string, { hooks: { type: string; command: string; runInBackground?: boolean }[] }[]>;
     };
 
+    // No working body ⇒ no entry, and the EVENT KEY STAYS — as an empty managed list when nothing
+    // else of ours belongs there.
+    //
+    // CORRECTION OF RECORD (round 7, P1). The round-5 version DELETED the key and this comment
+    // claimed the merge would then also drop a guard entry left by an earlier setup. That was
+    // asserted without measuring and it is false: `mergeManagedHookEntries` iterates
+    // `Object.keys(managed)`, so an event absent from the managed input is copied through
+    // UNTOUCHED — a project whose guard used to be armed kept invoking it on every Bash call while
+    // the report said the entry was not added. Handing the event an EMPTY list is what makes the
+    // merge EXAMINE it: our entries are dropped by `isManaged`, the user's are preserved in order,
+    // and nothing is appended. The round-5 test passed for the wrong reason — its project had no
+    // pre-existing settings.json, so there was no stale entry for the claim to be wrong about.
+    if (!guardArmed) {
+      generated.hooks['PreToolUse'] = (generated.hooks['PreToolUse'] ?? []).filter(
+        (entry) => !entry.hooks.some((h) => isManagedClaudeDestructiveHookCommand(h.command)),
+      );
+    }
+
     if (!existsSync(settingsPath)) {
       mkdirSync(settingsDir, { recursive: true });
       writeFileSync(settingsPath, JSON.stringify({ hooks: generated.hooks }, null, 2));
@@ -625,9 +845,18 @@ export function runSetup(opts: SetupOptions): SetupResult {
     } else {
       try {
         const existing = JSON.parse(readFileSync(settingsPath, 'utf-8')) as Record<string, unknown>;
-        // ONE merge implementation, shared with the Codex target (AM-3 / G-E). The Claude path's
-        // historical SUBSTRING attribution is passed IN verbatim rather than reimplemented, so the
-        // emitted bytes, the report tail string and the no-write path all stay identical (AM-37).
+        // ONE merge implementation, shared with the Codex target (AM-3 / G-E). Claude's exact
+        // command attribution is passed in rather than reimplemented, so emitted bytes, report
+        // tail text, and the no-write path stay on the shared merge contract (AM-37).
+        const isManagedCommand = (cmd: string): boolean =>
+          cmd.includes('agentdb add') ||
+          cmd.includes('agentdb-writer.mjs') ||
+          cmd.includes('sessions.jsonl') ||
+          // Ours ONLY while the body at that path is ours (round 8, P2). Without the
+          // path clause a second `dz setup` would append a duplicate guard entry instead of
+          // replacing the first; without the ownership clause it would delete the entry a
+          // consumer wrote for their own preserved hook.
+          (!foreignBodyKept && isManagedClaudeDestructiveHookCommand(cmd));
         const plan = mergeManagedHookEntries(
           (existing['hooks'] ?? {}) as Record<string, unknown[]>,
           generated.hooks as unknown as Record<string, unknown[]>,
@@ -635,13 +864,21 @@ export function runSetup(opts: SetupOptions): SetupResult {
             // Drop dz-generated entries (any vintage, either shape) — keep the user's own hooks
             // untouched. Flat dz entries (≤0.3.43) are dropped too, migrating them to the valid
             // matcher-group shape appended below.
-            isManaged: (entry) =>
-              commandsOf(entry).some(
-                (cmd) => cmd.includes('agentdb add') || cmd.includes('agentdb-writer.mjs') || cmd.includes('sessions.jsonl'),
-              ),
+            isManaged: (entry) => commandsOf(entry).some(isManagedCommand),
             isLegacy: (entry) =>
               !Array.isArray((entry as { hooks?: unknown[] })?.hooks) ||
               commandsOf(entry).some((cmd) => cmd.includes('agentdb add')),
+            // Ownership is per HANDLER, not per matcher group. A user's handler may deliberately
+            // share the Bash group with dz's guard; replacing ours must retain their handler object
+            // and every surrounding group field byte-for-byte through JSON serialization.
+            retainForeign: (entry) => {
+              const grouped = entry as { hooks?: { command?: unknown }[] };
+              if (!Array.isArray(grouped?.hooks)) return null;
+              const kept = grouped.hooks.filter((hook) => !isManagedCommand(String(hook?.command ?? '')));
+              return kept.length === 0
+                ? null
+                : { ...(entry as Record<string, unknown>), hooks: kept };
+            },
             reportLabel: backend,
           },
         );

package/src/sign.ts

@@ -504,7 +504,24 @@ export function verifyManifest(
       continue;
     }
     if (digest !== entry.sha256) {
-      failures.push({ path: entry.path, reason: 'content does not match its signed hash' });
+      // ПРИЧИНА НАЗЫВАЕТСЯ ТОЧНО, А НЕ ОБОБЩЁННО. Для файла, который переписывает упаковщик,
+      // расхождение чаще означает НЕ подделку, а сверку двух РАЗНЫХ объектов: манифест снят с
+      // байтов упакованного пакета, а здесь читается исходный каталог. ИЗМЕРЕНО 2026-09-03: так
+      // расходятся ВСЕ 56 подписанных пакетов, ни один не проверяется — на свежеподписанном
+      // манифест хранит cd7bd97a…, а хэш байтов с диска при любой версии канонизации даёт
+      // 40d926ff…, потому что pnpm вырезает из package.json блок scripts.
+      //
+      // Вердикт НЕ меняется: расхождение остаётся расхождением и выход остаётся ненулевым.
+      // Меняется только прочтение — «подделали» против «сверяете не то». Полное лечение (два
+      // режима проверки: исходный каталог упаковывать, установленный сверять напрямую) —
+      // запись бэклога 58dc4d58, решение владельца получено, работа не сделана.
+      const packerRewritten = CANONICALISED_PACK_FILES.has(entry.path);
+      failures.push({
+        path: entry.path,
+        reason: packerRewritten
+          ? 'content does not match its signed hash — NOTE: this file is rewritten by the packer, so a mismatch here may mean the manifest was built from PACKED bytes while a SOURCE directory is being verified, not tampering (backlog 58dc4d58)'
+          : 'content does not match its signed hash',
+      });
     }
   }
 

package/src/skills-verify.ts

@@ -23,7 +23,9 @@ import { basename, isAbsolute, join, resolve } from 'node:path';
 export type SkillIssueKind =
   | 'no-skill-md'          // a skill dir with no SKILL.md at depth 1 → never registers
   | 'buried-skill-md'      // a SKILL.md at depth >= 2 → the loader does not scan that deep
-  | 'plugin-manifest-trap'; // .claude-plugin/plugin.json under .claude/skills → does NOT auto-register
+  | 'plugin-manifest-trap' // .claude-plugin/plugin.json under .claude/skills → does NOT auto-register
+  | 'wildcard-allowed-tools' // `allowed-tools: *` → every tool granted; a FINDING (see below)
+  | 'empty-allowed-tools';   // `allowed-tools:` with no value → looks restrictive, restricts nothing
 
 export interface SkillLayoutFinding {
   readonly dir: string;
@@ -170,6 +172,98 @@ export function looksLikeSkillDir(dir: string): boolean {
   return walk(dir, 1);
 }
 
+/**
+ * What a SKILL.md's front matter says about the tools it may use.
+ *
+ * Three states, and they are NOT the same thing:
+ *   `absent`   — no `allowed-tools` key. The skill honestly inherits; this is the ordinary case
+ *                (7 170 SKILL.md files in this tree, MEASURED 2026-09-03).
+ *   `empty`    — the key is present with no value. It LOOKS like a restriction and restricts
+ *                nothing. Reported, never failed: 70 files are in this state today, and a gate
+ *                that goes red on the day it is introduced gets switched off — taking the
+ *                wildcard check down with it.
+ *   `listed`   — actual values, which may include a wildcard.
+ */
+export type AllowedToolsState =
+  | { readonly state: 'absent' }
+  | { readonly state: 'empty' }
+  | { readonly state: 'listed'; readonly values: readonly string[]; readonly wildcard: boolean };
+
+/**
+ * Read `allowed-tools` from the FRONT MATTER only.
+ *
+ * Scanning the whole file would turn `allowed-tools: *` written inside a skill's own documentation
+ * into a violation — and a gate that INVENTS violations is worse than no gate: it teaches people to
+ * ignore it. So the parse stops at the closing `---`.
+ *
+ * Both YAML spellings are accepted, because both appear in this tree: an inline list
+ * (`allowed-tools: Read, Write`) and a flow sequence (`allowed-tools: [Read, Write]`). Quotes are
+ * stripped before the wildcard test — `allowed-tools: "*"` grants exactly as much as a bare one.
+ */
+export function parseAllowedTools(markdown: string): AllowedToolsState {
+  const lines = markdown.split(/\r?\n/);
+  if (lines[0]?.trim() !== '---') return { state: 'absent' };
+  let raw: string | null = null;
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i] ?? '';
+    if (line.trim() === '---') break;                       // конец заголовка
+    const m = /^allowed-tools:(.*)$/.exec(line);
+    if (m) { raw = m[1] ?? ''; break; }
+  }
+  if (raw === null) return { state: 'absent' };
+
+  // ЯВНО ПУСТОЙ МАССИВ — НЕ ТО ЖЕ, ЧТО ПУСТОЕ ПОЛЕ. `allowed-tools: []` — это утверждение
+  // («никаких инструментов»), а `allowed-tools:` — незаполненное поле, которое ВЫГЛЯДИТ
+  // ограничением и ничего не ограничивает. Свалить их в одно состояние значило бы сказать про
+  // первый случай неправду в тексте предупреждения.
+  const trimmed = raw.trim();
+  if (trimmed === '') return { state: 'empty' };
+  const bracketed = /^\[(.*)\]$/s.exec(trimmed);
+  const body = (bracketed ? bracketed[1] ?? '' : trimmed).trim();
+  if (body === '') return { state: 'listed', values: [], wildcard: false };
+
+  const values = body.split(',')
+    .map((v) => v.trim().replace(/^["']|["']$/g, '').trim())
+    .filter((v) => v !== '');
+  return { state: 'listed', values, wildcard: values.includes('*') };
+}
+
+/**
+ * Privilege findings for one skill directory.
+ *
+ * WHY THIS FAILS RATHER THAN WARNS. The advisory carve-out in this module exists for layout classes
+ * whose support this gate CANNOT observe (workspace trust). A wildcard grant is not that: the text
+ * is right there in the file, the reading is unambiguous, and nothing about the environment can make
+ * it narrow. It is also a pure regression guard — MEASURED 2026-09-03: zero wildcards exist in this
+ * tree, so introducing it breaks no one.
+ */
+function scanSkillPrivileges(
+  dir: string, label: string, findings: SkillLayoutFinding[], advisories: SkillLayoutFinding[],
+): void {
+  let text: string;
+  try {
+    text = readFileSync(join(dir, 'SKILL.md'), 'utf8');
+  } catch {
+    return;   // нечитаемый файл — забота других проверок этого же слоя, не этой
+  }
+  const tools = parseAllowedTools(text);
+  if (tools.state === 'empty') {
+    advisories.push({
+      dir: label,
+      kind: 'empty-allowed-tools',
+      detail: 'allowed-tools is present but empty — it looks like a restriction and grants everything; either list the tools or drop the key',
+    });
+    return;
+  }
+  if (tools.state === 'listed' && tools.wildcard) {
+    findings.push({
+      dir: label,
+      kind: 'wildcard-allowed-tools',
+      detail: `allowed-tools grants every tool via "*" (${tools.values.join(', ')}) — name the tools this skill actually needs`,
+    });
+  }
+}
+
 /**
  * A directory registers only if `SKILL.md` is a regular FILE. `existsSync` also answers true for a
  * DIRECTORY named SKILL.md, which registers nothing yet suppressed every other check (QE2 #4).
@@ -332,6 +426,10 @@ export function scanSkillsLayout(projectDir: string): StaticScan {
     const isPluginContainer = hasPluginManifest(dir);
     const bucket = isPluginContainer ? advisories : findings;
 
+    // Права проверяются у КАЖДОГО навыка с читаемым SKILL.md, включая одно-навыковый плагин: щедрая
+    // выдача не становится безопаснее оттого, что навык лежит в контейнере.
+    if (registers) scanSkillPrivileges(dir, name, findings, advisories);
+
     if (registers && !isPluginContainer) {
       registrable.push(name);
     } else if (registers && isPluginContainer) {

package/src/stage-line.ts

@@ -0,0 +1,151 @@
+/**
+ * stage-line-before-dispatch — the two-phase stage announcement renderer used by feature-adr
+ * dispatch points (historical feature name `stage-line-before-dispatch`, ADR-001). The workflow's
+ * sole dispatch seam prints an intent line before the runtime call and a distinct final outcome
+ * line after the same attempt settles.
+ *
+ * WHY this file is standalone and import-free: the workflow script runs in a sandbox with no
+ * imports, so this module is projected into `.claude/workflows/feature-adr.js` VERBATIM by
+ * `scripts/gen-loop-blobs.mjs` (blob `stage-line`) and byte-checked there by
+ * `loop-blobs-regen.test.ts`. The generator FAILS CLOSED on any cross-file import, so the decision
+ * shape below is declared STRUCTURALLY here rather than imported from `feature-adr-routing.ts`.
+ *
+ * The line is PURE TEXT ASSEMBLY: every field comes from the decision the resolver returned or from
+ * the constant label table below. No model ever writes a word of it (AC-6), it reads nothing, and it
+ * prints nothing — the caller does the printing (AC-3).
+ *
+ * DESIGN CONSTRAINT (shared with feature-adr-routing.ts): the Workflow parser is stricter than
+ * `node --check` — string `+` concatenation only, explicit `if`/`return`, object-literal tables.
+ *
+ * @packageDocumentation
+ */
+
+/** Blob version stamp read by scripts/gen-loop-blobs.mjs; bump on any semantic change here. */
+export const STAGE_LINE_BLOB_VERSION = '2.0.0';
+
+/**
+ * The decision shape `renderStageLine` consumes — structurally identical to
+ * `StageDecision` from `feature-adr-routing.ts`, declared locally because a cross-file import
+ * would make this file unprojectable into the sandboxed workflow (see the file header).
+ */
+export interface StageLineDecision {
+  readonly opts: { readonly agentType?: string; readonly model?: string };
+  readonly spec: string | null;
+  readonly reason: string;
+}
+
+export type StageLineOutcomeState = 'dispatched' | 'probe-failed' | 'refused-before-dispatch';
+
+/** Final state of this exact rung. Selection reasons never travel through this shape. */
+export interface StageLineOutcome {
+  readonly state: StageLineOutcomeState;
+  readonly reason: string | null;
+}
+
+/**
+ * Human signature per resolver branch — a CLOSED table over `StageDecisionReason`. A reason with no
+ * entry is a hole, and `stage-line.test.ts` proves the table has none: a newcomer reading `· ` and
+ * then a raw enum token learns nothing, which is the whole failure this feature exists to prevent.
+ */
+export const STAGE_LINE_REASON_LABELS: Record<string, string> = {
+  'usage-override': 'usage override (Claude limit pressure)',
+  'explicit-models': 'explicit args.models',
+  'routing-not-requested': 'routing not requested',
+  'coder-knob-codex': 'coder knob = codex',
+  'planner-knob-codex': 'planner knob = codex',
+  'qe-cross-family': 'cross-family QE (the coder never self-reviews)',
+  'budget-table-cell': 'budget table cell',
+  'default-models': 'default models table',
+  'codex-id-substituted': 'unknown codex id — substituted',
+  'spec-unrecognised': 'unrecognised spec — session-inherited',
+  // dispatch-level (11-20): what the runtime or current fallback selection did.
+  'coder-fallback': 'coder fallback ladder',
+  'codex-unsupported-at-dispatch': 'codex unsupported at this dispatch — Claude',
+  'fallback-after-no-deliverable': 'fallback — the previous rung delivered nothing',
+  'precision-second-pass': 'independent precision second pass',
+  'auto-cost': 'learned-cost routing',
+  'qe-same-family-degraded': 'same-family QE — cross-family review NOT obtained',
+  'challenge-panel': 'adversarial plan-gate panel',
+  'codex-probe-failed': 'codex probe found no usable id — Claude',
+  'codex-refused-before-dispatch': 'codex refused before dispatching — nothing ran',
+  'fallback-rung': 'fallback rung (prior outcome reported separately)',
+};
+
+/** Stages that write an artifact FILE out of band when they resolve to Codex, and therefore wait on
+ *  the Codex-landed barrier before their consumer runs. Naming it in the line tells the reader why
+ *  the run is about to sit still.
+ *
+ *  The four DESIGN stages belong here too (R4-F5, cross-family review round 3): `designStage` runs an
+ *  out-of-band artifact probe for any codex-resolved design stage, exactly as code and plan do, so a
+ *  roster of only {code, plan} left the line silent about a barrier that was actually engaged. QE is
+ *  deliberately absent — its codex path is a synchronous `codex exec`, not the wrapper — and so is
+ *  delivery, whose planes never run on codex at all. */
+export const STAGE_LINE_BARRIER_STAGES: Record<string, number> = {
+  code: 1,
+  plan: 1,
+  requirements: 1,
+  adr: 1,
+  ideation: 1,
+  architecture: 1,
+};
+
+/**
+ * One deterministic line: `▸ <stage> · <model or "session"> · <branch signature>`, plus
+ * ` · landed barrier` when this stage resolved to Codex AND uses the barrier.
+ *
+ * PURE: reads nothing, prints nothing, and depends on no state beyond its two arguments (AC-3).
+ */
+function renderStagePrefix(stage: string, decision: StageLineDecision): string {
+  let model = 'session';
+  if (decision && decision.spec) model = decision.spec;
+  return '▸ ' + stage + ' · ' + model;
+}
+
+/** Timely statement of what the workflow is about to try. It is explicitly not proof of dispatch. */
+export function renderStageIntentLine(stage: string, decision: StageLineDecision): string {
+  let signature = '';
+  if (decision) {
+    const labelled = STAGE_LINE_REASON_LABELS[decision.reason];
+    if (labelled) signature = labelled;
+  }
+  // An unlabelled reason must be VISIBLE, never silently blank: print the raw token so the hole is
+  // reportable from a real run instead of reading as "no reason at all".
+  if (!signature) {
+    signature = 'unlabelled branch';
+    if (decision && decision.reason) signature = 'unlabelled branch: ' + decision.reason;
+  }
+  let line = renderStagePrefix(stage, decision) + ' · ' + signature;
+  if (STAGE_LINE_BARRIER_STAGES[stage] && decision && decision.opts && decision.opts.agentType === 'codex:codex-rescue') {
+    line = line + ' · landed barrier';
+  }
+  return line + ' · intent';
+}
+
+/**
+ * Final fact for one rung. It deliberately ignores the selection reason: the outcome owns only
+ * this rung's state and refusal detail, so another rung's reason cannot leak into it.
+ */
+export function renderStageOutcomeLine(
+  stage: string,
+  decision: StageLineDecision,
+  outcome: StageLineOutcome,
+): string {
+  let model = 'session';
+  if (decision && decision.spec) model = decision.spec;
+  let label = 'dispatched';
+  if (outcome && outcome.state === 'probe-failed') label = 'probe found no usable model';
+  else if (outcome && outcome.state === 'refused-before-dispatch') label = 'refused before dispatch';
+  let line = '◆ ' + stage + ' · ' + model + ' · outcome: ' + label;
+  if (outcome && outcome.state === 'refused-before-dispatch' && outcome.reason === 'codex-unsupported-at-dispatch') {
+    line = line + ' · codex agent type unsupported';
+  } else if (outcome && outcome.state === 'refused-before-dispatch' && outcome.reason) {
+    line = line + ' · reason: ' + outcome.reason;
+  }
+  return line;
+}
+
+/** One-release compatibility alias: the historical renderer is now explicitly the intent half. */
+export function renderStageLine(stage: string, decision: StageLineDecision): string {
+  const intent = renderStageIntentLine(stage, decision);
+  return intent.slice(0, intent.length - ' · intent'.length);
+}