@slicedearth/whoisleuth-cli 1.39.1 → 1.45.0

package/README.md

@@ -68,6 +68,11 @@ node bin/whoisleuth.mts reconcile office.json mobile.json external.json --json
 node bin/whoisleuth.mts timeline first-observation.json second-observation.json latest-observation.json --json
 node bin/whoisleuth.mts registry-support example.test --json
 node bin/whoisleuth.mts registry-doctor lookup.json --json
+node bin/whoisleuth.mts registry-cohort saved-lookups.jsonl --json
+node bin/whoisleuth.mts brief lookup.json
+node bin/whoisleuth.mts case-pack cases.json --audience trusted --reviewed --json
+node bin/whoisleuth.mts monitor-once control-manifest.json --json
+node bin/whoisleuth.mts workflow-run domain-triage example.test --approve-network --json --output run.json
 node bin/whoisleuth.mts lookalike-calibrate reviewed-candidates.json --json
 node bin/whoisleuth.mts doctor
 node bin/whoisleuth.mts commands --json
@@ -85,8 +90,8 @@ and disclosures without making a network request. `commands --json` exposes the
 installed command contracts for local wrappers without running collection.
 Focused command help and the generated manual label every operation as offline
 or networked and state its target, input, and concurrency boundaries. The
-packaged [dual-use disclosure](DISCLOSURE) defines the supported defensive use
-of those capabilities.
+packaged [dual-use disclosure](https://github.com/slicedearth/whoisleuth/blob/main/DISCLOSURE)
+defines the supported defensive use of those capabilities.
 
 Interactive output uses restrained semantic colour, width-aware wrapping, and
 stderr-only progress for slower collection. Redirected and machine-readable
@@ -96,10 +101,18 @@ offline unless `--network` is explicitly supplied, and completion scripts are
 printed without modifying shell configuration. Commands can use atomic private
 `--output` files, Lookup can emit strict automation exits and target-free
 versioned progress events, and Bulk can resume an exact validated compact
-checkpoint. A checkpoint write failure preserves completed output and returns
+checkpoint. Checkpoint schema 2 preserves each current row's observation time;
+legacy schema-1 rows remain readable with unknown observation time rather than
+being restamped on resume. Bulk machine output schema 3 distinguishes current
+and resumed rows. A checkpoint write failure preserves completed output and returns
 the partial-result exit code. Ctrl-C suppresses partial final output and
-returns exit code 130; a second interrupt performs best-effort temporary-file
+returns exit code 130. SIGTERM uses the same graceful cleanup path and returns
+143; a second interrupt performs best-effort temporary-file
 cleanup before exiting immediately.
+Strict local profiles can supply only safe presentation, Fast-mode,
+concurrency, and observer defaults; command-line options override them.
+Supported automation commands can emit JUnit or SARIF and apply explicit
+failure policies without changing their collection result.
 
 The offline `timeline` command orders 2 to 20 saved Lookup documents for one
 domain and compares each adjacent observation. It retains observation times and
@@ -114,6 +127,12 @@ non-comparable evidence separate; the labels are context, not proof of
 independence. `registry-doctor`, `assurance`, `sharing-review`, and
 `lookalike-calibrate` add offline compatibility, change/recovery, sharing, and
 review-yield workflows without contacting the hosted application.
+`registry-cohort` aggregates target-free publication-quality counts from saved
+Lookups, while `registry-scaffold` produces a sanitised synthetic contributor
+fixture. `brief` and `case-pack` create bounded local handoffs, `monitor-once`
+runs one explicit control review rather than a daemon, and `workflow-run`
+executes only installed fixed-recipe steps with per-run network approval and
+analyst-selection pauses.
 
 Bulk also supports fixed-column CSV, domain-only or exact-query output,
 registered, inconclusive, and hard-failure output filters, and bounded A, AAAA,

package/bin/whoisleuth.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import EXIT_CODES from "../cli/exit-codes.mjs";
 for (const stream of [process.stdout, process.stderr]) {
     stream.on('error', (error) => {
         if (error.code === 'EPIPE')
@@ -20,33 +21,54 @@ if (argv.length === 1 && (argv[0] === '--version' || argv[0] === '-V')) {
     }
 }
 else {
-    const [errorsModule, outputModule, runnerModule] = await Promise.all([
+    const [configModule, errorsModule, outputModule, runnerModule] = await Promise.all([
+        import("../cli/config-profile.mjs"),
         import("../cli/errors.mjs"),
         import("../cli/output-file.mjs"),
         import("../cli/runner.mjs"),
     ]);
+    let resolvedArgv;
+    try {
+        resolvedArgv = await configModule.resolveCliProfileArguments(argv);
+    }
+    catch (error) {
+        process.stderr.write(`Usage error: ${errorsModule.boundedCliErrorMessage(error, 'Invalid CLI profile')}\n`);
+        process.exitCode = EXIT_CODES.USAGE;
+        resolvedArgv = [];
+    }
     const cancellation = new AbortController();
     let interruptionCount = 0;
-    const interrupt = () => {
+    let requestedExitCode = 130;
+    const interrupt = (signal) => {
         interruptionCount += 1;
-        if (interruptionCount === 1)
+        if (interruptionCount === 1) {
+            requestedExitCode = signal === 'SIGTERM' ? 143 : 130;
             cancellation.abort(new DOMException('Aborted', 'AbortError'));
+        }
         else {
             outputModule.cleanupPendingOutputFilesSync();
-            process.exit(130);
+            process.exit(requestedExitCode);
         }
     };
-    process.on('SIGINT', interrupt);
-    runnerModule.runCli(argv, { signal: cancellation.signal }).then((code) => {
+    const onSigint = () => interrupt('SIGINT');
+    const onSigterm = () => interrupt('SIGTERM');
+    process.on('SIGINT', onSigint);
+    process.on('SIGTERM', onSigterm);
+    const execution = resolvedArgv.length
+        ? runnerModule.runCli(resolvedArgv, { signal: cancellation.signal })
+        : Promise.resolve(process.exitCode || EXIT_CODES.USAGE);
+    execution.then((code) => {
         if (code === 130) {
-            process.removeListener('SIGINT', interrupt);
-            process.exit(130);
+            process.removeListener('SIGINT', onSigint);
+            process.removeListener('SIGTERM', onSigterm);
+            process.exit(requestedExitCode);
         }
         process.exitCode = code;
     }).catch((error) => {
         process.stderr.write(`Internal CLI error: ${errorsModule.boundedCliErrorMessage(error)}\n`);
         process.exitCode = 70;
     }).finally(() => {
-        process.removeListener('SIGINT', interrupt);
+        process.removeListener('SIGINT', onSigint);
+        process.removeListener('SIGTERM', onSigterm);
     });
 }

package/cli/archive-inspect.mjs

@@ -3,9 +3,10 @@ import { createHash } from 'node:crypto';
 import { domainToASCII } from 'node:url';
 import { decryptWorkspaceArchive, isEncryptedWorkspaceArchive, } from "../frontend/src/lib/analysis/workspace-archive-crypto.js";
 import { WORKSPACE_ARCHIVE_SCHEMA, readWorkspaceArchive, } from "../frontend/src/lib/analysis/workspace-archive.js";
+import { canonicalArtifactJson } from "../frontend/src/lib/analysis/artifact-integrity.js";
 import { MAX_OFFLINE_ARTIFACT_BYTES, verifyOfflineArtifact, } from "./artifact-verify.mjs";
 export const ARCHIVE_INSPECTION_SCHEMA = 'whoisleuth.workspace-archive-inspection';
-export const ARCHIVE_INSPECTION_VERSION = 1;
+export const ARCHIVE_INSPECTION_VERSION = 2;
 export const MAX_ARCHIVE_SEARCH_LENGTH = 253;
 export const MAX_ARCHIVE_SEARCH_MATCHES = 100;
 export const MAX_ARCHIVE_SEARCH_NODES = 100_000;
@@ -19,6 +20,7 @@ const SEARCHABLE_FIELDS = new Set([
     'target',
 ]);
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+const SHA256_DIGEST_RE = /^sha256:[a-f0-9]{64}$/u;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -66,6 +68,30 @@ function canonicalSearchValue(value) {
 function valueDigest(value) {
     return createHash('sha256').update(value, 'utf8').digest('hex');
 }
+function archiveContentDigest(sections) {
+    const identity = sections.map((section) => ({
+        id: section.id,
+        schema: section.schema,
+        version: section.version,
+        recordCount: section.recordCount,
+        content: (() => {
+            if (!section.data || typeof section.data !== 'object' || Array.isArray(section.data)) {
+                return section.data;
+            }
+            const { exportedAt: _exportedAt, generatedAt: _generatedAt, ...content } = section.data;
+            return content;
+        })(),
+    }));
+    return `sha256:${createHash('sha256').update(canonicalArtifactJson(identity), 'utf8').digest('hex')}`;
+}
+function expectedContentDigest(value) {
+    if (value === null || value === undefined || value === '')
+        return null;
+    if (typeof value !== 'string' || !SHA256_DIGEST_RE.test(value)) {
+        throw new TypeError('Expected archive content digest must use the form sha256 followed by 64 lowercase hexadecimal characters.');
+    }
+    return value;
+}
 function searchSection(section, value, search, reveal, results, state) {
     const stack = [{ value, depth: 0 }];
     while (stack.length && results.length < MAX_ARCHIVE_SEARCH_MATCHES) {
@@ -120,6 +146,11 @@ export async function inspectWorkspaceArchive(raw, options = {}) {
         ? await decryptWorkspaceArchive(parsed, options.passphrase)
         : parsed;
     const archive = await readWorkspaceArchive(archiveValue);
+    const contentDigestSha256 = archiveContentDigest(archive.sections);
+    const expectedDigest = expectedContentDigest(options.expectedContentDigest);
+    if (expectedDigest && expectedDigest !== contentDigestSha256) {
+        throw new TypeError('Workspace archive content digest did not match the expected value.');
+    }
     const search = normalizeSearch(options.search);
     const reveal = options.reveal === true;
     if (reveal && !search)
@@ -143,12 +174,14 @@ export async function inspectWorkspaceArchive(raw, options = {}) {
         archive: Object.freeze({
             encrypted,
             schema: WORKSPACE_ARCHIVE_SCHEMA,
-            version: archive.version,
+            version: archive.sourceVersion,
+            readerVersion: archive.version,
         }),
         summary: Object.freeze({
             inputBytes: Buffer.byteLength(raw, 'utf8'),
             sectionCount: archive.sections.length,
             recordCount: archive.sections.reduce((sum, section) => sum + section.recordCount, 0),
+            contentDigestSha256,
         }),
         sections: Object.freeze(archive.sections.map((section) => Object.freeze({
             id: section.id,
@@ -169,6 +202,7 @@ export async function inspectWorkspaceArchive(raw, options = {}) {
         }),
         limitations: Object.freeze([
             'Inspection validates the archive and reports bounded section metadata without printing retained evidence by default.',
+            'The content digest covers ordered section identities and normalised content after excluding each section export timestamp. Equality detects matching retained archive content but does not authenticate its source or accuracy.',
             'Search checks exact values in a small allowlist of target fields and never searches analyst notes, contacts, or raw evidence.',
             ...(reveal
                 ? ['Search values were revealed only because the operator supplied --reveal; handle the output as sensitive evidence.']
@@ -182,6 +216,7 @@ export function formatArchiveInspection(report) {
         `Archive: ${report.archive.encrypted ? 'encrypted' : 'plain'} · v${report.archive.version}`,
         `Sections: ${report.summary.sectionCount}`,
         `Records: ${report.summary.recordCount}`,
+        `Content digest: ${report.summary.contentDigestSha256}`,
     ];
     for (const section of report.sections) {
         lines.push(`${section.label}: ${section.recordCount} records · ${section.status} · ${section.bytes} bytes`);