@slicedearth/whoisleuth-cli 1.36.1 → 1.43.0

package/README.md

@@ -50,6 +50,7 @@ node bin/whoisleuth.mts --help
 node bin/whoisleuth.mts lookup example.test
 node bin/whoisleuth.mts lookup example.test --deep --summary
 node bin/whoisleuth.mts lookup example.test --deep --plan --json
+node bin/whoisleuth.mts lookup example.test --deep --observer workstation-a --vantage office-egress --json
 node bin/whoisleuth.mts lookup example.test --deep --markdown --output lookup.md
 node bin/whoisleuth.mts bulk domains.txt --deep --checkpoint bulk-checkpoint.json
 node bin/whoisleuth.mts bulk domains.txt --csv --registered-only
@@ -59,10 +60,20 @@ node bin/whoisleuth.mts discover-scan example.test --scan-limit 50 --checkpoint
 node bin/whoisleuth.mts page-compare official.json candidate.json --json
 node bin/whoisleuth.mts mail-review bulk.json --json
 node bin/whoisleuth.mts domain-control domain-control-input.json --json
+node bin/whoisleuth.mts assurance domain-assurance-input.json --json
+node bin/whoisleuth.mts sharing-review response-packet.json --marking amber --recipient-scope organization --purpose 'Reviewed handoff' --human-reviewed --personal-data-reviewed --redactions-confirmed --json
 node bin/whoisleuth.mts workflow-plan domain-triage example.test --json
 node bin/whoisleuth.mts diff first-lookup.json second-lookup.json --json
+node bin/whoisleuth.mts reconcile office.json mobile.json external.json --json
 node bin/whoisleuth.mts timeline first-observation.json second-observation.json latest-observation.json --json
 node bin/whoisleuth.mts registry-support example.test --json
+node bin/whoisleuth.mts registry-doctor lookup.json --json
+node bin/whoisleuth.mts registry-cohort saved-lookups.jsonl --json
+node bin/whoisleuth.mts brief lookup.json
+node bin/whoisleuth.mts case-pack cases.json --audience trusted --reviewed --json
+node bin/whoisleuth.mts monitor-once control-manifest.json --json
+node bin/whoisleuth.mts workflow-run domain-triage example.test --approve-network --json --output run.json
+node bin/whoisleuth.mts lookalike-calibrate reviewed-candidates.json --json
 node bin/whoisleuth.mts doctor
 node bin/whoisleuth.mts commands --json
 node bin/whoisleuth.mts completion zsh
@@ -94,13 +105,31 @@ checkpoint. A checkpoint write failure preserves completed output and returns
 the partial-result exit code. Ctrl-C suppresses partial final output and
 returns exit code 130; a second interrupt performs best-effort temporary-file
 cleanup before exiting immediately.
+Strict local profiles can supply only safe presentation, Fast-mode,
+concurrency, and observer defaults; command-line options override them.
+Supported automation commands can emit JUnit or SARIF and apply explicit
+failure policies without changing their collection result.
 
 The offline `timeline` command orders 2 to 20 saved Lookup documents for one
 domain and compares each adjacent observation. It retains observation times and
-normalized field states but no input filenames or raw registry payloads.
+normalised field states but no input filenames or raw registry payloads.
 Observed differences remain separate from missing, unavailable, and changed
 collection conditions.
 
+Optional bounded observer and vantage labels let analysts distinguish saved
+collection contexts without changing collection. `reconcile` compares 2 to 5
+same-domain observations while keeping agreement, disagreement, and
+non-comparable evidence separate; the labels are context, not proof of
+independence. `registry-doctor`, `assurance`, `sharing-review`, and
+`lookalike-calibrate` add offline compatibility, change/recovery, sharing, and
+review-yield workflows without contacting the hosted application.
+`registry-cohort` aggregates target-free publication-quality counts from saved
+Lookups, while `registry-scaffold` produces a sanitised synthetic contributor
+fixture. `brief` and `case-pack` create bounded local handoffs, `monitor-once`
+runs one explicit control review rather than a daemon, and `workflow-run`
+executes only installed fixed-recipe steps with per-run network approval and
+analyst-selection pauses.
+
 Bulk also supports fixed-column CSV, domain-only or exact-query output,
 registered, inconclusive, and hard-failure output filters, and bounded A, AAAA,
 NS, and MX summaries. Discover
@@ -115,7 +144,8 @@ lookups can be compared across static page, parse5-tokenized DOM structure,
 favicon, technology, and TLS evidence, while saved Bulk output can be reviewed
 for passive MX, null MX, SPF, DMARC, and shared-provider context.
 
-See `docs/cli.md` in the package for the complete command, privacy, output, and
+See `docs/cli.md` in the package for installation and first use, and
+`docs/cli-reference.md` for the complete command, privacy, output, and
 evidence-contract reference. Report suspected vulnerabilities through the
 private channel described in `SECURITY.md`.
 

package/bin/whoisleuth.mjs

@@ -1,7 +1,5 @@
 #!/usr/bin/env node
-import { boundedCliErrorMessage } from "../cli/errors.mjs";
-import { cleanupPendingOutputFilesSync } from "../cli/output-file.mjs";
-import { runCli } from "../cli/runner.mjs";
+import { createRequire } from 'node:module';
 for (const stream of [process.stdout, process.stderr]) {
     stream.on('error', (error) => {
         if (error.code === 'EPIPE')
@@ -9,27 +7,57 @@ for (const stream of [process.stdout, process.stderr]) {
         throw error;
     });
 }
-const cancellation = new AbortController();
-let interruptionCount = 0;
-const interrupt = () => {
-    interruptionCount += 1;
-    if (interruptionCount === 1)
-        cancellation.abort(new DOMException('Aborted', 'AbortError'));
+const argv = process.argv.slice(2);
+if (argv.length === 1 && (argv[0] === '--version' || argv[0] === '-V')) {
+    const require = createRequire(import.meta.url);
+    const metadata = require('../package.json');
+    if (typeof metadata.version !== 'string' || !metadata.version) {
+        process.stderr.write('Internal CLI error: Package version is unavailable.\n');
+        process.exitCode = 70;
+    }
     else {
-        cleanupPendingOutputFilesSync();
-        process.exit(130);
+        process.stdout.write(`${metadata.version}\n`);
     }
-};
-process.on('SIGINT', interrupt);
-runCli(process.argv.slice(2), { signal: cancellation.signal }).then((code) => {
-    if (code === 130) {
-        process.removeListener('SIGINT', interrupt);
-        process.exit(130);
+}
+else {
+    const [configModule, errorsModule, outputModule, runnerModule] = await Promise.all([
+        import("../cli/config-profile.mjs"),
+        import("../cli/errors.mjs"),
+        import("../cli/output-file.mjs"),
+        import("../cli/runner.mjs"),
+    ]);
+    let resolvedArgv;
+    try {
+        resolvedArgv = await configModule.resolveCliProfileArguments(argv);
+    }
+    catch (error) {
+        process.stderr.write(`Usage error: ${errorsModule.boundedCliErrorMessage(error, 'Invalid CLI profile')}\n`);
+        process.exitCode = 64;
+        resolvedArgv = [];
     }
-    process.exitCode = code;
-}).catch((error) => {
-    process.stderr.write(`Internal CLI error: ${boundedCliErrorMessage(error)}\n`);
-    process.exitCode = 70;
-}).finally(() => {
-    process.removeListener('SIGINT', interrupt);
-});
+    const cancellation = new AbortController();
+    let interruptionCount = 0;
+    const interrupt = () => {
+        interruptionCount += 1;
+        if (interruptionCount === 1)
+            cancellation.abort(new DOMException('Aborted', 'AbortError'));
+        else {
+            outputModule.cleanupPendingOutputFilesSync();
+            process.exit(130);
+        }
+    };
+    process.on('SIGINT', interrupt);
+    const execution = resolvedArgv.length ? runnerModule.runCli(resolvedArgv, { signal: cancellation.signal }) : Promise.resolve(process.exitCode || 64);
+    execution.then((code) => {
+        if (code === 130) {
+            process.removeListener('SIGINT', interrupt);
+            process.exit(130);
+        }
+        process.exitCode = code;
+    }).catch((error) => {
+        process.stderr.write(`Internal CLI error: ${errorsModule.boundedCliErrorMessage(error)}\n`);
+        process.exitCode = 70;
+    }).finally(() => {
+        process.removeListener('SIGINT', interrupt);
+    });
+}

package/cli/archive-inspect.mjs

@@ -3,9 +3,10 @@ import { createHash } from 'node:crypto';
 import { domainToASCII } from 'node:url';
 import { decryptWorkspaceArchive, isEncryptedWorkspaceArchive, } from "../frontend/src/lib/analysis/workspace-archive-crypto.js";
 import { WORKSPACE_ARCHIVE_SCHEMA, readWorkspaceArchive, } from "../frontend/src/lib/analysis/workspace-archive.js";
+import { canonicalArtifactJson } from "../frontend/src/lib/analysis/artifact-integrity.js";
 import { MAX_OFFLINE_ARTIFACT_BYTES, verifyOfflineArtifact, } from "./artifact-verify.mjs";
 export const ARCHIVE_INSPECTION_SCHEMA = 'whoisleuth.workspace-archive-inspection';
-export const ARCHIVE_INSPECTION_VERSION = 1;
+export const ARCHIVE_INSPECTION_VERSION = 2;
 export const MAX_ARCHIVE_SEARCH_LENGTH = 253;
 export const MAX_ARCHIVE_SEARCH_MATCHES = 100;
 export const MAX_ARCHIVE_SEARCH_NODES = 100_000;
@@ -19,6 +20,7 @@ const SEARCHABLE_FIELDS = new Set([
     'target',
 ]);
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+const SHA256_DIGEST_RE = /^sha256:[a-f0-9]{64}$/u;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -66,6 +68,30 @@ function canonicalSearchValue(value) {
 function valueDigest(value) {
     return createHash('sha256').update(value, 'utf8').digest('hex');
 }
+function archiveContentDigest(sections) {
+    const identity = sections.map((section) => ({
+        id: section.id,
+        schema: section.schema,
+        version: section.version,
+        recordCount: section.recordCount,
+        content: (() => {
+            if (!section.data || typeof section.data !== 'object' || Array.isArray(section.data)) {
+                return section.data;
+            }
+            const { exportedAt: _exportedAt, generatedAt: _generatedAt, ...content } = section.data;
+            return content;
+        })(),
+    }));
+    return `sha256:${createHash('sha256').update(canonicalArtifactJson(identity), 'utf8').digest('hex')}`;
+}
+function expectedContentDigest(value) {
+    if (value === null || value === undefined || value === '')
+        return null;
+    if (typeof value !== 'string' || !SHA256_DIGEST_RE.test(value)) {
+        throw new TypeError('Expected archive content digest must use the form sha256 followed by 64 lowercase hexadecimal characters.');
+    }
+    return value;
+}
 function searchSection(section, value, search, reveal, results, state) {
     const stack = [{ value, depth: 0 }];
     while (stack.length && results.length < MAX_ARCHIVE_SEARCH_MATCHES) {
@@ -120,6 +146,11 @@ export async function inspectWorkspaceArchive(raw, options = {}) {
         ? await decryptWorkspaceArchive(parsed, options.passphrase)
         : parsed;
     const archive = await readWorkspaceArchive(archiveValue);
+    const contentDigestSha256 = archiveContentDigest(archive.sections);
+    const expectedDigest = expectedContentDigest(options.expectedContentDigest);
+    if (expectedDigest && expectedDigest !== contentDigestSha256) {
+        throw new TypeError('Workspace archive content digest did not match the expected value.');
+    }
     const search = normalizeSearch(options.search);
     const reveal = options.reveal === true;
     if (reveal && !search)
@@ -143,12 +174,14 @@ export async function inspectWorkspaceArchive(raw, options = {}) {
         archive: Object.freeze({
             encrypted,
             schema: WORKSPACE_ARCHIVE_SCHEMA,
-            version: archive.version,
+            version: archive.sourceVersion,
+            readerVersion: archive.version,
         }),
         summary: Object.freeze({
             inputBytes: Buffer.byteLength(raw, 'utf8'),
             sectionCount: archive.sections.length,
             recordCount: archive.sections.reduce((sum, section) => sum + section.recordCount, 0),
+            contentDigestSha256,
         }),
         sections: Object.freeze(archive.sections.map((section) => Object.freeze({
             id: section.id,
@@ -169,6 +202,7 @@ export async function inspectWorkspaceArchive(raw, options = {}) {
         }),
         limitations: Object.freeze([
             'Inspection validates the archive and reports bounded section metadata without printing retained evidence by default.',
+            'The content digest covers ordered section identities and normalised content after excluding each section export timestamp. Equality detects matching retained archive content but does not authenticate its source or accuracy.',
             'Search checks exact values in a small allowlist of target fields and never searches analyst notes, contacts, or raw evidence.',
             ...(reveal
                 ? ['Search values were revealed only because the operator supplied --reveal; handle the output as sensitive evidence.']
@@ -182,6 +216,7 @@ export function formatArchiveInspection(report) {
         `Archive: ${report.archive.encrypted ? 'encrypted' : 'plain'} · v${report.archive.version}`,
         `Sections: ${report.summary.sectionCount}`,
         `Records: ${report.summary.recordCount}`,
+        `Content digest: ${report.summary.contentDigestSha256}`,
     ];
     for (const section of report.sections) {
         lines.push(`${section.label}: ${section.recordCount} records · ${section.status} · ${section.bytes} bytes`);