@slicedearth/whoisleuth-cli 1.39.1 → 1.43.0

package/README.md

@@ -68,6 +68,11 @@ node bin/whoisleuth.mts reconcile office.json mobile.json external.json --json
 node bin/whoisleuth.mts timeline first-observation.json second-observation.json latest-observation.json --json
 node bin/whoisleuth.mts registry-support example.test --json
 node bin/whoisleuth.mts registry-doctor lookup.json --json
+node bin/whoisleuth.mts registry-cohort saved-lookups.jsonl --json
+node bin/whoisleuth.mts brief lookup.json
+node bin/whoisleuth.mts case-pack cases.json --audience trusted --reviewed --json
+node bin/whoisleuth.mts monitor-once control-manifest.json --json
+node bin/whoisleuth.mts workflow-run domain-triage example.test --approve-network --json --output run.json
 node bin/whoisleuth.mts lookalike-calibrate reviewed-candidates.json --json
 node bin/whoisleuth.mts doctor
 node bin/whoisleuth.mts commands --json
@@ -100,6 +105,10 @@ checkpoint. A checkpoint write failure preserves completed output and returns
 the partial-result exit code. Ctrl-C suppresses partial final output and
 returns exit code 130; a second interrupt performs best-effort temporary-file
 cleanup before exiting immediately.
+Strict local profiles can supply only safe presentation, Fast-mode,
+concurrency, and observer defaults; command-line options override them.
+Supported automation commands can emit JUnit or SARIF and apply explicit
+failure policies without changing their collection result.
 
 The offline `timeline` command orders 2 to 20 saved Lookup documents for one
 domain and compares each adjacent observation. It retains observation times and
@@ -114,6 +123,12 @@ non-comparable evidence separate; the labels are context, not proof of
 independence. `registry-doctor`, `assurance`, `sharing-review`, and
 `lookalike-calibrate` add offline compatibility, change/recovery, sharing, and
 review-yield workflows without contacting the hosted application.
+`registry-cohort` aggregates target-free publication-quality counts from saved
+Lookups, while `registry-scaffold` produces a sanitised synthetic contributor
+fixture. `brief` and `case-pack` create bounded local handoffs, `monitor-once`
+runs one explicit control review rather than a daemon, and `workflow-run`
+executes only installed fixed-recipe steps with per-run network approval and
+analyst-selection pauses.
 
 Bulk also supports fixed-column CSV, domain-only or exact-query output,
 registered, inconclusive, and hard-failure output filters, and bounded A, AAAA,

package/bin/whoisleuth.mjs

@@ -20,11 +20,21 @@ if (argv.length === 1 && (argv[0] === '--version' || argv[0] === '-V')) {
     }
 }
 else {
-    const [errorsModule, outputModule, runnerModule] = await Promise.all([
+    const [configModule, errorsModule, outputModule, runnerModule] = await Promise.all([
+        import("../cli/config-profile.mjs"),
         import("../cli/errors.mjs"),
         import("../cli/output-file.mjs"),
         import("../cli/runner.mjs"),
     ]);
+    let resolvedArgv;
+    try {
+        resolvedArgv = await configModule.resolveCliProfileArguments(argv);
+    }
+    catch (error) {
+        process.stderr.write(`Usage error: ${errorsModule.boundedCliErrorMessage(error, 'Invalid CLI profile')}\n`);
+        process.exitCode = 64;
+        resolvedArgv = [];
+    }
     const cancellation = new AbortController();
     let interruptionCount = 0;
     const interrupt = () => {
@@ -37,7 +47,8 @@ else {
         }
     };
     process.on('SIGINT', interrupt);
-    runnerModule.runCli(argv, { signal: cancellation.signal }).then((code) => {
+    const execution = resolvedArgv.length ? runnerModule.runCli(resolvedArgv, { signal: cancellation.signal }) : Promise.resolve(process.exitCode || 64);
+    execution.then((code) => {
         if (code === 130) {
             process.removeListener('SIGINT', interrupt);
             process.exit(130);

package/cli/archive-inspect.mjs

@@ -3,9 +3,10 @@ import { createHash } from 'node:crypto';
 import { domainToASCII } from 'node:url';
 import { decryptWorkspaceArchive, isEncryptedWorkspaceArchive, } from "../frontend/src/lib/analysis/workspace-archive-crypto.js";
 import { WORKSPACE_ARCHIVE_SCHEMA, readWorkspaceArchive, } from "../frontend/src/lib/analysis/workspace-archive.js";
+import { canonicalArtifactJson } from "../frontend/src/lib/analysis/artifact-integrity.js";
 import { MAX_OFFLINE_ARTIFACT_BYTES, verifyOfflineArtifact, } from "./artifact-verify.mjs";
 export const ARCHIVE_INSPECTION_SCHEMA = 'whoisleuth.workspace-archive-inspection';
-export const ARCHIVE_INSPECTION_VERSION = 1;
+export const ARCHIVE_INSPECTION_VERSION = 2;
 export const MAX_ARCHIVE_SEARCH_LENGTH = 253;
 export const MAX_ARCHIVE_SEARCH_MATCHES = 100;
 export const MAX_ARCHIVE_SEARCH_NODES = 100_000;
@@ -19,6 +20,7 @@ const SEARCHABLE_FIELDS = new Set([
     'target',
 ]);
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+const SHA256_DIGEST_RE = /^sha256:[a-f0-9]{64}$/u;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -66,6 +68,30 @@ function canonicalSearchValue(value) {
 function valueDigest(value) {
     return createHash('sha256').update(value, 'utf8').digest('hex');
 }
+function archiveContentDigest(sections) {
+    const identity = sections.map((section) => ({
+        id: section.id,
+        schema: section.schema,
+        version: section.version,
+        recordCount: section.recordCount,
+        content: (() => {
+            if (!section.data || typeof section.data !== 'object' || Array.isArray(section.data)) {
+                return section.data;
+            }
+            const { exportedAt: _exportedAt, generatedAt: _generatedAt, ...content } = section.data;
+            return content;
+        })(),
+    }));
+    return `sha256:${createHash('sha256').update(canonicalArtifactJson(identity), 'utf8').digest('hex')}`;
+}
+function expectedContentDigest(value) {
+    if (value === null || value === undefined || value === '')
+        return null;
+    if (typeof value !== 'string' || !SHA256_DIGEST_RE.test(value)) {
+        throw new TypeError('Expected archive content digest must use the form sha256 followed by 64 lowercase hexadecimal characters.');
+    }
+    return value;
+}
 function searchSection(section, value, search, reveal, results, state) {
     const stack = [{ value, depth: 0 }];
     while (stack.length && results.length < MAX_ARCHIVE_SEARCH_MATCHES) {
@@ -120,6 +146,11 @@ export async function inspectWorkspaceArchive(raw, options = {}) {
         ? await decryptWorkspaceArchive(parsed, options.passphrase)
         : parsed;
     const archive = await readWorkspaceArchive(archiveValue);
+    const contentDigestSha256 = archiveContentDigest(archive.sections);
+    const expectedDigest = expectedContentDigest(options.expectedContentDigest);
+    if (expectedDigest && expectedDigest !== contentDigestSha256) {
+        throw new TypeError('Workspace archive content digest did not match the expected value.');
+    }
     const search = normalizeSearch(options.search);
     const reveal = options.reveal === true;
     if (reveal && !search)
@@ -143,12 +174,14 @@ export async function inspectWorkspaceArchive(raw, options = {}) {
         archive: Object.freeze({
             encrypted,
             schema: WORKSPACE_ARCHIVE_SCHEMA,
-            version: archive.version,
+            version: archive.sourceVersion,
+            readerVersion: archive.version,
         }),
         summary: Object.freeze({
             inputBytes: Buffer.byteLength(raw, 'utf8'),
             sectionCount: archive.sections.length,
             recordCount: archive.sections.reduce((sum, section) => sum + section.recordCount, 0),
+            contentDigestSha256,
         }),
         sections: Object.freeze(archive.sections.map((section) => Object.freeze({
             id: section.id,
@@ -169,6 +202,7 @@ export async function inspectWorkspaceArchive(raw, options = {}) {
         }),
         limitations: Object.freeze([
             'Inspection validates the archive and reports bounded section metadata without printing retained evidence by default.',
+            'The content digest covers ordered section identities and normalised content after excluding each section export timestamp. Equality detects matching retained archive content but does not authenticate its source or accuracy.',
             'Search checks exact values in a small allowlist of target fields and never searches analyst notes, contacts, or raw evidence.',
             ...(reveal
                 ? ['Search values were revealed only because the operator supplied --reveal; handle the output as sensitive evidence.']
@@ -182,6 +216,7 @@ export function formatArchiveInspection(report) {
         `Archive: ${report.archive.encrypted ? 'encrypted' : 'plain'} · v${report.archive.version}`,
         `Sections: ${report.summary.sectionCount}`,
         `Records: ${report.summary.recordCount}`,
+        `Content digest: ${report.summary.contentDigestSha256}`,
     ];
     for (const section of report.sections) {
         lines.push(`${section.label}: ${section.recordCount} records · ${section.status} · ${section.bytes} bytes`);