@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/cli/support-command-runner.mjs

@@ -1,6 +1,6 @@
 import { REGISTRY_CAPABILITIES_VERSION, registryCapabilityFor } from "../lib/registry-capabilities.mjs";
-import { buildRiskCalibrationSummaryReport } from "../lib/risk-calibration-summary.mjs";
-import { explainRiskScore, explainRiskScoreV7, RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD } from "../lib/risk-scoring.mjs";
+import { buildRiskCalibrationSummaryReport } from "../packages/analysis/risk-calibration-summary.mjs";
+import { explainRiskScore, explainRiskScoreV8, RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD } from "../packages/analysis/risk-scoring.mjs";
 import { buildCliCommandCatalogue, formatCliCommandCatalogue, selectCliCommands } from "./command-catalogue.mjs";
 import { CLI_COMMAND_REGISTRY, CLI_COMMANDS, COMMAND_COLLECTION, COMMAND_DETAILS, COMMAND_USAGE, } from "./command-reference.mjs";
 import { buildShellCompletion } from "./completion.mjs";
@@ -169,8 +169,8 @@ async function runRiskCalibrationCommand(args, dependencies, context) {
         modelVersion: dependencies.riskModelVersion || RISK_MODEL_VERSION,
         reviewThreshold: dependencies.riskReviewThreshold || RISK_REVIEW_THRESHOLD,
         ...(!dependencies.explainRiskScore ? {
-            previousModelVersion: 7,
-            explainPreviousRiskScore: explainRiskScoreV7,
+            previousModelVersion: 8,
+            explainPreviousRiskScore: explainRiskScoreV8,
         } : {}),
     });
     if (!args.quiet) {

package/cli/watchlist-review.mjs

@@ -0,0 +1,43 @@
+import { parseBoundedJson } from "../packages/analysis/bounded-json.mjs";
+import { applyCandidateWatchHandoff, planCandidateWatchHandoff, } from "../packages/workspace/candidate-watch-handoff.mjs";
+import { buildWatchlistExport, mergeWatchlistStores, } from "../packages/workspace/watchlist-store.mjs";
+import { MAX_WATCHLIST_IMPORT_BYTES } from "../packages/contracts/workspace-portability.mjs";
+import { ordinaryWorkspaceRecord } from "../packages/workspace/hostile-input.mjs";
+import { CANDIDATE_WATCH_INPUT_SCHEMA, CANDIDATE_WATCH_INPUT_VERSION, } from "../packages/contracts/candidate-watch-review.mjs";
+export function parseCandidateWatchInput(input) {
+    const value = typeof input === 'string'
+        ? parseBoundedJson(input, {
+            maximumBytes: MAX_WATCHLIST_IMPORT_BYTES,
+            label: 'Candidate watch selection',
+        })
+        : input;
+    const raw = ordinaryWorkspaceRecord(value, 'Candidate watch selection');
+    if (!raw ||
+        raw.schema !== CANDIDATE_WATCH_INPUT_SCHEMA ||
+        raw.version !== CANDIDATE_WATCH_INPUT_VERSION ||
+        Object.keys(raw).some((key) => !['schema', 'version', 'watchlists', 'selection'].includes(key)))
+        throw new TypeError('Use candidate-watch-input schema 1 with watchlists and an explicit selection.');
+    const selection = ordinaryWorkspaceRecord(raw.selection, 'Candidate watch selection');
+    if (!selection ||
+        Object.keys(selection).some((key) => ![
+            'name',
+            'candidates',
+            'brandProfileId',
+            'priority',
+            'reason',
+            'reviewDueAt',
+            'replaceExistingContext',
+        ].includes(key)))
+        throw new TypeError('The candidate selection contains undeclared fields.');
+    const local = raw.watchlists === null ? {} : mergeWatchlistStores({}, raw.watchlists).watchlists;
+    planCandidateWatchHandoff(local, selection);
+    return raw;
+}
+export function reviewCandidateWatchInput(input, operation, now) {
+    const raw = parseCandidateWatchInput(input), selection = raw.selection;
+    const local = raw.watchlists === null ? {} : mergeWatchlistStores({}, raw.watchlists).watchlists;
+    if (operation === 'plan')
+        return planCandidateWatchHandoff(local, selection);
+    const result = applyCandidateWatchHandoff(local, selection, now);
+    return buildWatchlistExport(result.watchlists, now);
+}

package/cli/workflow-arguments.mjs

@@ -0,0 +1,100 @@
+import {} from "./command-argument-grammar.mjs";
+import { CliUsageError } from "./errors.mjs";
+import {} from "./fail-policy.mjs";
+import { commandDefaultNumber } from "./command-reference.mjs";
+import { WORKFLOW_COMMAND_DEFINITIONS } from "./workflow-command-definitions.mjs";
+import { parseDomainFeedSelectors } from "./domain-feed.mjs";
+import { terminalOptions, jsonOutput, failPolicies, parseOutput, } from "./argument-values.mjs";
+function parseDomainFeedArguments(parsed) {
+    const operation = parsed.positionalValue('operation');
+    const contextSource = parsed.positionalValue('context');
+    if ((operation === 'watch-input') !== Boolean(contextSource))
+        throw new CliUsageError('watch-input requires one existing candidate-watch-input context file; review does not accept a context file.');
+    return { action: 'domain-feed', operation, feedId: parsed.positionalValue('feed'), source: parsed.positionalValue('source'), contextSource,
+        selection: parseDomainFeedSelectors(parsed.optionValues('--select')), output: jsonOutput(parsed), ...terminalOptions(parsed) };
+}
+function parseWatchlistReviewArguments(parsed) {
+    return { action: 'watchlist-review', operation: parsed.positionalValue('operation'), source: parsed.positionalValue('source'), output: jsonOutput(parsed), ...terminalOptions(parsed) };
+}
+function parseMonitorOnceArguments(parsed) {
+    const selectedFailPolicies = failPolicies(parsed, 'monitor-once');
+    return {
+        action: 'monitor-once',
+        source: parsed.positionalValue('source'),
+        previousSource: parsed.optionValue('--previous'),
+        output: parseOutput(parsed, WORKFLOW_COMMAND_DEFINITIONS['monitor-once']),
+        limit: parsed.integerOption('--limit') ?? commandDefaultNumber('monitor-once', '--limit'),
+        concurrency: parsed.integerOption('--concurrency') ??
+            commandDefaultNumber('monitor-once', '--concurrency'),
+        ...terminalOptions(parsed),
+        ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
+    };
+}
+function parseWorkflowPlanArguments(parsed) {
+    const options = { output: jsonOutput(parsed), ...terminalOptions(parsed) };
+    if (parsed.hasOption('--list')) {
+        if (parsed.allPositionals.length > 0)
+            throw new CliUsageError('workflow-plan discovery options do not accept a subject.');
+        return { action: 'workflow-plan', discovery: 'list', ...options };
+    }
+    if (parsed.hasOption('--explain')) {
+        if (parsed.allPositionals.length > 0)
+            throw new CliUsageError('workflow-plan discovery options do not accept a subject.');
+        return {
+            action: 'workflow-plan',
+            discovery: 'explain',
+            recipe: parsed.optionValue('--explain'),
+            ...options,
+        };
+    }
+    if (parsed.allPositionals.length !== 2) {
+        throw new CliUsageError('workflow-plan requires one fixed recipe and one subject, --list, or --explain <recipe>.');
+    }
+    return {
+        action: 'workflow-plan',
+        recipe: parsed.positionalValue('recipe'),
+        subject: parsed.positionalValue('subject'),
+        ...options,
+    };
+}
+function parseWorkflowRunArguments(parsed) {
+    const artifactBindings = parsed.optionValues('--use-artifact').map((value) => {
+        const match = /^([a-z0-9]+(?:-[a-z0-9]+)*):([1-9][0-9]?)=([a-z0-9]+(?:-[a-z0-9]+)*)$/u.exec(value);
+        if (!match)
+            throw new CliUsageError('--use-artifact requires <step-id>:<input-number>=<earlier-step-id>.');
+        return Object.freeze({ stepId: match[1], input: Number(match[2]), sourceStepId: match[3] });
+    });
+    const selections = parsed.optionValues('--select').map((value) => {
+        const separator = value.indexOf('=');
+        const stepId = separator === -1 ? '' : value.slice(0, separator);
+        const selection = separator === -1 ? '' : value.slice(separator + 1);
+        if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(stepId) || !selection.trim()) {
+            throw new CliUsageError('--select requires <step-id>=<path-or-value>.');
+        }
+        if (selection.startsWith('-')) {
+            throw new CliUsageError('--select values cannot start with a hyphen; prefix a file path with ./ when needed.');
+        }
+        return Object.freeze({ stepId, value: selection });
+    });
+    return {
+        action: 'workflow-run',
+        recipe: parsed.positionalValue('recipe'),
+        subject: parsed.positionalValue('subject'),
+        resumeSource: parsed.optionValue('--resume'),
+        selections: Object.freeze(selections),
+        artifactBindings: Object.freeze(artifactBindings),
+        confirmedReviews: Object.freeze(parsed.optionValues('--confirm-review')),
+        approveNetwork: parsed.hasOption('--approve-network'),
+        interactive: parsed.hasOption('--interactive'),
+        ...(parsed.hasOption('--preview') ? { preview: true } : {}),
+        output: jsonOutput(parsed),
+        ...terminalOptions(parsed),
+    };
+}
+export const WORKFLOW_ARGUMENT_PARSERS = Object.freeze({
+    'domain-feed': parseDomainFeedArguments,
+    'watchlist-review': parseWatchlistReviewArguments,
+    'monitor-once': parseMonitorOnceArguments,
+    'workflow-plan': parseWorkflowPlanArguments,
+    'workflow-run': parseWorkflowRunArguments,
+});

package/cli/workflow-command-definitions.mjs

@@ -0,0 +1,103 @@
+import { INVESTIGATION_PLAN_RECIPES, RUNNABLE_INVESTIGATION_PLAN_RECIPES } from "./investigation-recipes.mjs";
+import { positional, OPTIONAL_FILE_POSITIONAL, constraint, commandSeed, integer, BASE_INTEGER_RANGE, file, optionDefinition } from "./command-definition.mjs";
+import { DOMAIN_FEED_CATALOGUE } from "../packages/monitoring/domain-feed.mjs";
+export const WORKFLOW_COMMAND_DEFINITIONS = Object.freeze({
+    'domain-feed': commandSeed({
+        reference: { description: 'Review exact hosts or literal terms in a selected local plain-domain feed.',
+            example: 'whoisleuth domain-feed review tif-mini feed.txt --select host:candidate.example --json',
+            boundary: 'Always available offline. Reads one explicit local regular file; never downloads a feed, performs a Lookup, changes scores, retains candidates or enables a schedule. Streams at most 256 MiB and 10 million physical rows with 1,024-byte lines and a ten-minute deadline; retains at most 200 matched hosts. Repeat --select host:<hostname>, term:<literal> or exclude:<literal> for at most 200 exact hosts, 20 positive and 20 negative literal terms of 3–80 characters. A negative match vetoes even an exact host before the match bound; at least one positive term or exact host is required. Matching uses canonical ASCII/punycode substrings, never token boundaries, parent equivalence, typo/confusable expansion or regular expressions. Review emits the full raw-byte digest, separate declared file/local clocks, unknown per-host clocks and omissions. watch-input also requires a candidate-watch-input v1 context file with an empty candidates array, and emits that existing format for a separate watchlist-review plan/export. Inclusion is not a maliciousness, activity, ownership or availability verdict.' },
+        collection: { scope: 'Local raw file: 256 MiB, 10 million physical rows, 1,024 bytes per line, ten minutes; 200 retained hosts, 20 positive and 20 negative literal terms, no requests.' },
+        summary: 'Review a selected local plain-domain feed', options: ['--select', '--json', '--quiet', '--no-color'],
+        optionOverrides: { '--select': optionDefinition('text', 'Select host:<exact-hostname>, term:<literal-text> or exclude:<literal-text>; repeat for separate explicit selectors.', { occurrence: 'repeatable', acceptsOptionLikeValue: true }) },
+        positionals: Object.freeze([positional('operation', 'enum', 1, 1, ['review', 'watch-input']),
+            positional('feed', 'enum', 1, 1, DOMAIN_FEED_CATALOGUE.map(feed => feed.id)), positional('source', 'file', 1, 1), positional('context', 'file', 0, 1)]),
+        constraints: Object.freeze([constraint({ kind: 'required', options: ['--select'] })]),
+        handlerOwner: 'workflow', networkEffect: 'offline', common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.candidate-watch-input']), primaryArtefacts: Object.freeze(['Bounded feed inclusion review', 'Explicit candidate watch selection']),
+        planSupport: true, additionalOutputFormats: Object.freeze([]), bootstrapProfile: 'allowed',
+    }),
+    'watchlist-review': commandSeed({
+        reference: { description: 'Preview or export an explicit candidate selection to a local watchlist.', example: 'whoisleuth watchlist-review plan selection.json --json',
+            boundary: 'Reads bounded local JSON only. Plan shows exact domains, duplicates, per-domain outcomes, destination and review priority with zero additional requests. Export emits Watchlist schema 5 without creating a scan or baseline. Neither mode enables collection or scheduling.' },
+        collection: { scope: 'At most 2,000 selected candidate domains; no target requests.' },
+        summary: 'Review a local candidate watchlist handoff', options: ['--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('operation', 'enum', 1, 1, ['plan', 'export']), positional('source', 'file', 0, 1, [], 'argv_or_stdin')]),
+        constraints: Object.freeze([]), handlerOwner: 'workflow', networkEffect: 'offline', common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.candidate-watch-input', 'whoisleuth.watchlists']), primaryArtefacts: Object.freeze(['Exact candidate handoff plan', 'Local watchlist export']),
+        planSupport: true, additionalOutputFormats: Object.freeze([]), bootstrapProfile: 'allowed',
+    }),
+    "monitor-once": commandSeed({
+        reference: {
+            description: 'Collect one bounded owned-domain review and compare it with an optional prior checkpoint.',
+            example: 'whoisleuth monitor-once manifest.json --previous previous.json --json --output next.json',
+            boundary: 'This is an operator-scheduled one-shot collection, not a daemon. It caps targets and concurrency, retains normalised observations, and never changes domain configuration.',
+        },
+        collection: { scope: 'Runs deep collection for at most 20 manifest domains with concurrency capped at 3.' },
+        summary: 'Run one bounded domain control review',
+        options: ['--previous', '--limit', '--concurrency', '--fail-on', '--json', '--junit', '--quiet', '--no-color'],
+        optionOverrides: {
+            '--concurrency': integer('Set the maximum number of concurrent collection tasks.', () => Object.freeze([BASE_INTEGER_RANGE(1, 3)]), () => 2),
+        },
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: Object.freeze([
+            constraint({ kind: 'mutually_exclusive', options: ['--json', '--junit'] }),
+        ]),
+        handlerOwner: 'workflow',
+        networkEffect: 'always_network',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.domain-control-monitor', 'whoisleuth.domain-control-flight-recorder.input']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "workflow-plan": commandSeed({
+        reference: {
+            description: 'Build a fixed domain-investigation plan from existing bounded CLI commands.',
+            example: 'whoisleuth workflow-plan domain-triage example.test --json',
+            boundary: 'Planning is offline and plan-only. It does not execute commands, expand placeholders, read files, make requests, or submit evidence.',
+        },
+        collection: { scope: 'Builds a fixed typed recipe and executes none of its network or file steps.' },
+        summary: 'Plan a fixed investigation recipe',
+        options: ['--list', '--explain', '--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([
+            positional('recipe', 'enum', 0, 1, INVESTIGATION_PLAN_RECIPES),
+            positional('subject', 'text', 0, 1),
+        ]),
+        constraints: Object.freeze([
+            constraint({ kind: 'mutually_exclusive', options: ['--list', '--explain'] }),
+        ]),
+        handlerOwner: 'workflow',
+        networkEffect: 'offline',
+        common: true,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.investigation-plan', 'whoisleuth.cli.workflow-recipe-catalogue']),
+        primaryArtefacts: Object.freeze(['Plan-only workflow document']),
+        planSupport: true,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "workflow-run": commandSeed({
+        reference: {
+            description: 'Execute approved steps from a fixed investigation recipe and emit a resumable checkpoint.',
+            example: 'whoisleuth workflow-run domain-triage example.test --approve-network --json --output run.json',
+            boundary: '--preview validates the checkpoint and shows retained outputs, unresolved inputs and remaining approvals without executing or writing. It cannot be combined with approval, interactive, quiet or output-file flags. Only installed recipe commands can run. Network steps require explicit approval for each invocation. New runs connect compatible earlier outputs using the recipe defaults. Use --use-artifact <step-id>:<input-number>=<earlier-step-id> to override a connection; input numbers start at 1. Repeat --select for remaining placeholders in order, or supply every input for a step to replace its connections with files. Values stay literal and cannot start with a hyphen or invoke a shell. Optional --interactive prompts on terminal stderr for missing inputs; a blank answer pauses. It grants neither network approval nor human-review confirmation. A step declaring human review still requires --confirm-review <step-id> for that invocation. Checkpoints do not grant later approvals. Resumes preserve recorded connections. Content digests identify retained output, not authenticity or freshness. Partial collections pause for review and are not recollected on resume; failed validation or export steps remain retryable. Diagnostics go to stderr. File output holds exclusive adjacent locks and refuses concurrently changed state files.',
+        },
+        collection: { scope: 'Runs only fixed-recipe steps; network collection requires --approve-network and unresolved analyst selections pause.' },
+        summary: 'Execute approved fixed-recipe steps',
+        options: ['--select', '--use-artifact', '--confirm-review', '--approve-network', '--resume', '--interactive', '--preview', '--json', '--quiet', '--no-color'],
+        optionOverrides: { '--resume': file('Resume the selected workflow checkpoint; approvals must be supplied again.') },
+        positionals: Object.freeze([
+            positional('recipe', 'enum', 1, 1, RUNNABLE_INVESTIGATION_PLAN_RECIPES),
+            positional('subject', 'text', 1, 1),
+        ]),
+        constraints: Object.freeze([constraint({ kind: 'excludes_all', option: '--preview', excludedOptions: ['--approve-network', '--confirm-review', '--interactive', '--output', '--force', '--quiet'] })]),
+        handlerOwner: 'workflow',
+        networkEffect: 'conditional_network',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.investigation-run', 'whoisleuth.cli.investigation-preview']),
+        primaryArtefacts: Object.freeze(['Resumable workflow state', 'Offline resume preview']),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+});

package/cli/workflow-command-runner.mjs

@@ -5,7 +5,7 @@ import EXIT_CODES from "./exit-codes.mjs";
 import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
 import { formatJsonDocument } from "./formatters/json.mjs";
 import { buildInvestigationPlan, buildWorkflowRecipeCatalogue, formatInvestigationPlan, formatWorkflowRecipeCatalogue, } from "./investigation-plan.mjs";
-import { MAX_INVESTIGATION_RUN_BYTES, formatInvestigationRun, investigationRunExitCode, runInvestigationRecipe, } from "./investigation-run.mjs";
+import { MAX_INVESTIGATION_RUN_BYTES, formatInvestigationRun, investigationRunExitCode, runInvestigationRecipe, previewInvestigationRecipe, formatInvestigationPreview, } from "./investigation-run.mjs";
 import { MAX_OFFLINE_EVIDENCE_INPUT_BYTES } from "./offline-evidence-review.mjs";
 import { MAX_OFFLINE_ARTIFACT_BYTES } from "./artifact-verify.mjs";
 import { MAX_RETAINED_ARTIFACT_DIFF_BYTES } from "./retained-artifact-diff.mjs";
@@ -16,7 +16,37 @@ import { MAX_SHARING_REVIEW_BYTES } from "./sharing-review.mjs";
 import { createBufferedOutput } from "./output-file.mjs";
 import { boundedInteractiveAnswer, canReadInteractiveLine, readBoundedInteractiveLine } from "./terminal-input.mjs";
 import { WORKFLOW_INLINE_COMMANDS } from "./inline-command-families.mjs";
+import { reviewCandidateWatchInput, parseCandidateWatchInput } from "./watchlist-review.mjs";
+import { readDomainFeedFile } from "./domain-feed.mjs";
+import { scanDomainFeed, buildDomainFeedWatchInput, normalizeDomainFeedSelection } from "../packages/monitoring/domain-feed.mjs";
+import { MAX_WATCHLIST_IMPORT_BYTES } from "../packages/contracts/workspace-portability.mjs";
 import { runDiscriminatedCommandHandler } from "./discriminated-command-handlers.mjs";
+async function runWatchlistReviewCommand(args, dependencies, context) {
+    const raw = dependencies.readArtifactInput ? await dependencies.readArtifactInput(args.source) : await context.readInput(args.source, MAX_WATCHLIST_IMPORT_BYTES, 'Candidate watch selection');
+    const document = reviewCandidateWatchInput(raw, args.operation, context.now());
+    if (!args.quiet)
+        context.writeStdout(formatJsonDocument(document));
+    return EXIT_CODES.SUCCESS;
+}
+async function runDomainFeedCommand(args, dependencies, context) {
+    context.setFailureLabel('Offline domain-feed review');
+    const handoff = args.contextSource ? parseCandidateWatchInput(dependencies.readArtifactInput
+        ? await dependencies.readArtifactInput(args.contextSource)
+        : await context.readInput(args.contextSource, MAX_WATCHLIST_IMPORT_BYTES, 'Candidate watch context')) : null;
+    const watchSelection = handoff?.selection;
+    if (watchSelection && watchSelection.candidates.length)
+        throw new CliUsageError('The watch-input context must have an empty candidates array; only reviewed feed matches may be nominated.');
+    const selection = normalizeDomainFeedSelection({ ...args.selection, brandProfileId: watchSelection?.brandProfileId ?? null });
+    const review = await scanDomainFeed((dependencies.readDomainFeedInput ?? readDomainFeedFile)(args.source, dependencies.signal), {
+        feedId: args.feedId, selection, importedAt: context.now(), ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+    });
+    const document = watchSelection && handoff
+        ? buildDomainFeedWatchInput(review, review.matches.map(match => match.domain), watchSelection, handoff.watchlists)
+        : review;
+    if (!args.quiet)
+        context.writeStdout(formatJsonDocument(document));
+    return EXIT_CODES.SUCCESS;
+}
 function boundWorkflowInputs(command, inputs, dependencies, context) {
     if (!inputs.size)
         return {};
@@ -125,6 +155,13 @@ async function runWorkflowRecipeCommand(args, dependencies, context) {
             throw new CliUsageError(`Could not read investigation resume state: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
         }
     }
+    if (args.preview) {
+        const preview = previewInvestigationRecipe(args.recipe, args.subject, {
+            resumeInput, selections: args.selections, artifactBindings: args.artifactBindings, generatedAt: context.now(),
+        });
+        context.writeStdout(args.output === 'json' ? formatJsonDocument(preview) : context.terminal(formatInvestigationPreview(preview), args.color));
+        return EXIT_CODES.SUCCESS;
+    }
     const document = await runInvestigationRecipe(args.recipe, args.subject, {
         approveNetwork: args.approveNetwork,
         selections: args.selections,
@@ -174,6 +211,8 @@ async function runWorkflowRecipeCommand(args, dependencies, context) {
     return investigationRunExitCode(document);
 }
 const WORKFLOW_COMMAND_HANDLERS = Object.freeze({
+    'domain-feed': runDomainFeedCommand,
+    'watchlist-review': runWatchlistReviewCommand,
     'monitor-once': runMonitorOnceCommand,
     'workflow-plan': runWorkflowPlanCommand,
     'workflow-run': runWorkflowRecipeCommand,

package/docs/cli-reference.md

@@ -10,6 +10,11 @@ This page records the common interfaces and the boundaries that matter across
 commands. The generated [privacy/data-flow catalogue](https://github.com/slicedearth/whoisleuth/blob/main/docs/privacy-data-flow-catalogue.md)
 contains the exhaustive recipient, retention and export metadata.
 
+For an explicitly selected local IP-location database, see the
+[MMDB query and compatibility guide](cli.md#local-ip-location-database-review).
+Current reviews retain exact-byte identity and intrinsic metadata, and require
+an analyst-justified freshness policy. No database is downloaded or updated.
+
 ## Installation
 
 Use the [installation guide](cli.md#installation) for runtime requirements,
@@ -61,6 +66,26 @@ Optional browser providers are not implicit CLI actions.
 The [message-header review](cli.md#message-header-review) is offline and reports
 publisher claims, not independent DNS or cryptographic validation.
 
+For copied-content or credential-abuse review, keep the supplied reference,
+candidate, form destination and deliberately observed navigation separately
+attributed. A similar page without a logo or brand name can still merit manual
+evidence review; correspondence does not establish authorship, rights authority
+or maliciousness. Missing optional capture or comparison evidence does not
+prevent ordinary Case pins and conclusions. Installed command help remains the
+authority for offline file inputs and explicit collection plans.
+
+The [reporting guide](https://www.whoisleuth.com/resources/reporting-and-takedown-guidance)
+uses the same reviewed official-route catalogue as the Console for social
+content, storefronts, app listings, hosted files/forms and advertising. Verify
+the exact object, current route, reporter authority and disclosure before any
+manual submission. Fraud, order complaints and rights notices are different
+processes; search or app delisting is not source-content removal. Formal domain
+disputes and copyright procedures have their own criteria, remedies and
+jurisdiction-specific rules, not a universal waiting period. CLI preparation
+does not submit a report or make a legal declaration. Preserve original delivery
+references when preparing additional evidence, and recheck each response scope
+independently rather than treating a closed ticket as remediation.
+
 `dnssec-validate` and `mail-transport` are isolated authorised actions. Both
 require a selected literal public resolver, a local trust-anchor document and
 `--owned-or-authorized`; mail transport also requires `--active-probe`. Mail
@@ -194,6 +219,8 @@ own retention policy. No automatic key discovery, key storage or trust refresh o
   evidence. They do not tune the running model, change infrastructure or turn an
   analyst label into observed truth.
 - `workflow-plan` lists fixed installed recipes without executing them.
+  `workflow-run --preview` validates a selected checkpoint and explains remaining
+  inputs and approvals offline, without running steps or rewriting the checkpoint.
   `workflow-run` executes only installed steps, requires approval for network
   work and pauses at unresolved analyst selections. Repeat
   `--select <step-id>=<path-or-value>` for remaining placeholders in order, or bind