hardness 1.0.0

package/node_modules/zod/v4-mini/index.cjs

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("../v4/mini/index.cjs"), exports);

package/node_modules/zod/v4-mini/index.d.cts

@@ -0,0 +1 @@
+export * from "../v4/mini/index.cjs";

package/node_modules/zod/v4-mini/index.d.ts

@@ -0,0 +1 @@
+export * from "../v4/mini/index.js";

package/node_modules/zod/v4-mini/index.js

@@ -0,0 +1 @@
+export * from "../v4/mini/index.js";

package/package.json

@@ -0,0 +1,80 @@
+{
+  "name": "hardness",
+  "version": "1.0.0",
+  "description": "Universal Agentic Development Harness — governance, security, validation and audit for AI-assisted development, model/tool/IDE agnostic.",
+  "author": "cmt-t",
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cmt-t/HardNess.git"
+  },
+  "bugs": {
+    "url": "https://github.com/cmt-t/HardNess/issues"
+  },
+  "homepage": "https://github.com/cmt-t/HardNess#readme",
+  "keywords": [
+    "ai",
+    "agent",
+    "agentic",
+    "harness",
+    "orchestrator",
+    "governance",
+    "validation",
+    "audit",
+    "llm",
+    "cli",
+    "typescript",
+    "sprint"
+  ],
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "bin": {
+    "hardness": "packages/cli/dist/index.js"
+  },
+  "files": [
+    "packages/cli/dist/",
+    "packages/core/dist/",
+    "packages/analyzers/dist/",
+    "packages/prompts/dist/",
+    "packages/cli/package.json",
+    "packages/core/package.json",
+    "packages/analyzers/package.json",
+    "packages/prompts/package.json",
+    "templates/",
+    "schemas/",
+    "README.md",
+    "AGENTS.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "build": "tsc --build",
+    "test": "vitest run --workspace=vitest.workspace.ts",
+    "test:watch": "vitest --workspace=vitest.workspace.ts",
+    "clean": "tsc --build --clean",
+    "prepublishOnly": "npm run clean && npm run build && npm test"
+  },
+  "workspaces": [
+    "packages/*"
+  ],
+  "dependencies": {
+    "@hardness/core": "*",
+    "@hardness/analyzers": "*",
+    "@hardness/prompts": "*",
+    "commander": "^12.1.0",
+    "picocolors": "^1.0.0",
+    "zod": "^3.22.4"
+  },
+  "bundleDependencies": [
+    "@hardness/core",
+    "@hardness/analyzers",
+    "@hardness/prompts"
+  ],
+  "devDependencies": {
+    "@types/node": "^20.12.7",
+    "typescript": "^5.4.5",
+    "vitest": "^1.6.0"
+  }
+}

package/packages/analyzers/README.md

@@ -0,0 +1,31 @@
+# @hardness/analyzers
+
+Static-analysis registry for [Hardness](https://github.com/cmt-t/HardNess), organized per stack profile.
+
+## Built-in analyzers
+
+- `typescript-node` — detects undeclared dependencies and discourages `console.log`
+- `generic` — fallback analyzer (todos, generic secret patterns, duplication)
+
+## Add a custom analyzer
+
+```typescript
+import { globalAnalyzerRegistry, Analyzer } from '@hardness/analyzers';
+
+const myAnalyzer: Analyzer = {
+  name: 'my-stack',
+  supportedProfiles: ['my-stack'],
+  async analyze(projectRoot) {
+    // ... return Diagnostic[]
+    return [];
+  },
+};
+
+globalAnalyzerRegistry.register(myAnalyzer);
+```
+
+See the [main repo](https://github.com/cmt-t/HardNess#readme) for full documentation.
+
+## License
+
+MIT © 2026 cmt-t

package/packages/analyzers/dist/generic.d.ts

@@ -0,0 +1,6 @@
+import { Analyzer } from './index.js';
+/**
+ * Generic analyzer for any project type.
+ * Runs on all stacks.
+ */
+export declare const GenericAnalyzer: Analyzer;

package/packages/analyzers/dist/generic.js

@@ -0,0 +1,13 @@
+/**
+ * Generic analyzer for any project type.
+ * Runs on all stacks.
+ */
+export const GenericAnalyzer = {
+    name: 'generic',
+    supportedProfiles: ['*'],
+    async analyze() {
+        // Returns empty by default, serving as a stub/base for other generic stacks
+        return [];
+    }
+};
+//# sourceMappingURL=generic.js.map

package/packages/analyzers/dist/generic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic.js","sourceRoot":"","sources":["../src/generic.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,IAAI,EAAE,SAAS;IACf,iBAAiB,EAAE,CAAC,GAAG,CAAC;IACxB,KAAK,CAAC,OAAO;QACX,4EAA4E;QAC5E,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC"}

package/packages/analyzers/dist/index.d.ts

@@ -0,0 +1,26 @@
+export interface Diagnostic {
+    file: string;
+    line?: number;
+    ruleId: string;
+    message: string;
+    severity: 'error' | 'warning';
+}
+export interface Analyzer {
+    name: string;
+    supportedProfiles: string[];
+    analyze(projectRoot: string): Promise<Diagnostic[]>;
+}
+/**
+ * Registry of available static code analyzers in the system.
+ */
+export declare class AnalyzerRegistry {
+    private analyzers;
+    register(analyzer: Analyzer): void;
+    getForProfile(profile: string): Analyzer[];
+    runAll(profile: string, projectRoot: string): Promise<Diagnostic[]>;
+}
+export declare const globalAnalyzerRegistry: AnalyzerRegistry;
+export declare const name = "@hardness/analyzers";
+import { TypeScriptNodeAnalyzer } from './typescript-node.js';
+import { GenericAnalyzer } from './generic.js';
+export { TypeScriptNodeAnalyzer, GenericAnalyzer };

package/packages/analyzers/dist/index.js

@@ -0,0 +1,40 @@
+/**
+ * Registry of available static code analyzers in the system.
+ */
+export class AnalyzerRegistry {
+    analyzers = [];
+    register(analyzer) {
+        this.analyzers.push(analyzer);
+    }
+    getForProfile(profile) {
+        return this.analyzers.filter(a => a.supportedProfiles.includes(profile) || a.supportedProfiles.includes('*'));
+    }
+    async runAll(profile, projectRoot) {
+        const matched = this.getForProfile(profile);
+        const diagnostics = [];
+        for (const analyzer of matched) {
+            try {
+                const res = await analyzer.analyze(projectRoot);
+                diagnostics.push(...res);
+            }
+            catch (err) {
+                diagnostics.push({
+                    file: 'project',
+                    ruleId: 'analyzer-failure',
+                    message: `Analyzer "${analyzer.name}" failed: ${err.message}`,
+                    severity: 'error'
+                });
+            }
+        }
+        return diagnostics;
+    }
+}
+export const globalAnalyzerRegistry = new AnalyzerRegistry();
+export const name = '@hardness/analyzers';
+// Import and register default analyzers
+import { TypeScriptNodeAnalyzer } from './typescript-node.js';
+import { GenericAnalyzer } from './generic.js';
+globalAnalyzerRegistry.register(TypeScriptNodeAnalyzer);
+globalAnalyzerRegistry.register(GenericAnalyzer);
+export { TypeScriptNodeAnalyzer, GenericAnalyzer };
+//# sourceMappingURL=index.js.map

package/packages/analyzers/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA;;GAEG;AACH,MAAM,OAAO,gBAAgB;IACnB,SAAS,GAAe,EAAE,CAAC;IAEnC,QAAQ,CAAC,QAAkB;QACzB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,aAAa,CAAC,OAAe;QAC3B,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAChH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,WAAmB;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBAChD,WAAW,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,WAAW,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,kBAAkB;oBAC1B,OAAO,EAAE,aAAa,QAAQ,CAAC,IAAI,aAAc,GAAa,CAAC,OAAO,EAAE;oBACxE,QAAQ,EAAE,OAAO;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAC7D,MAAM,CAAC,MAAM,IAAI,GAAG,qBAAqB,CAAC;AAE1C,wCAAwC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,sBAAsB,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;AACxD,sBAAsB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAEjD,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,CAAC"}

package/packages/analyzers/dist/typescript-node.d.ts

@@ -0,0 +1,6 @@
+import { Analyzer } from './index.js';
+/**
+ * Static analyzer for TypeScript and Node.js projects.
+ * Checks for undeclared dependencies in package.json and discourages console.log without a logger.
+ */
+export declare const TypeScriptNodeAnalyzer: Analyzer;

package/packages/analyzers/dist/typescript-node.js

@@ -0,0 +1,110 @@
+import fs from 'fs';
+import path from 'path';
+/**
+ * Static analyzer for TypeScript and Node.js projects.
+ * Checks for undeclared dependencies in package.json and discourages console.log without a logger.
+ */
+export const TypeScriptNodeAnalyzer = {
+    name: 'typescript-node',
+    supportedProfiles: ['typescript-node'],
+    async analyze(projectRoot) {
+        const diagnostics = [];
+        // 1. Try to read and map dependencies from package.json
+        const pkgPath = path.join(projectRoot, 'package.json');
+        let declaredDeps = [];
+        let declaredDevDeps = [];
+        if (fs.existsSync(pkgPath)) {
+            try {
+                const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+                declaredDeps = Object.keys(pkg.dependencies || {});
+                declaredDevDeps = Object.keys(pkg.devDependencies || {});
+            }
+            catch {
+                // Ignore package.json parse errors
+            }
+        }
+        // Node.js built-in modules
+        const nodeBuiltins = [
+            'path', 'fs', 'os', 'child_process', 'crypto', 'url', 'readline',
+            'events', 'util', 'http', 'https', 'stream', 'zlib', 'assert'
+        ];
+        const allDeclared = [...declaredDeps, ...declaredDevDeps, ...nodeBuiltins];
+        // 2. Find files recursively
+        function findFiles(dir) {
+            let results = [];
+            const list = fs.readdirSync(dir);
+            for (const file of list) {
+                // Skip common build, dependency or temp folders
+                if (['node_modules', 'dist', '.git', '.hardness', 'temp-cli-test', 'temp-orchestrator-test', 'temp-preflight-test'].includes(file)) {
+                    continue;
+                }
+                const filePath = path.join(dir, file);
+                const stat = fs.statSync(filePath);
+                if (stat && stat.isDirectory()) {
+                    results = results.concat(findFiles(filePath));
+                }
+                else if (file.endsWith('.ts') || file.endsWith('.js') || file.endsWith('.tsx') || file.endsWith('.jsx')) {
+                    results.push(filePath);
+                }
+            }
+            return results;
+        }
+        let files = [];
+        try {
+            files = findFiles(projectRoot);
+        }
+        catch {
+            return [];
+        }
+        // 3. Scan files for inconsistencies
+        for (const file of files) {
+            const relativeFile = path.relative(projectRoot, file).split('\\').join('/');
+            const content = fs.readFileSync(file, 'utf-8');
+            const lines = content.split('\n');
+            for (let i = 0; i < lines.length; i++) {
+                const lineContent = lines[i];
+                const lineNum = i + 1;
+                // A. Detect console.log
+                if (lineContent.includes('console.log') && !lineContent.includes('//') && !lineContent.includes('/*')) {
+                    diagnostics.push({
+                        file: relativeFile,
+                        line: lineNum,
+                        ruleId: 'no-console-log',
+                        message: 'console.log call detected. Consider using a formal system logger instead.',
+                        severity: 'warning'
+                    });
+                }
+                // B. Detect imports of packages not declared in the manifest
+                const importMatch = lineContent.match(/(?:import\s+.*\s+from\s+|require\()['"]([^'"]+)['"]/);
+                if (importMatch) {
+                    const importPath = importMatch[1];
+                    // Skip relative imports
+                    if (!importPath.startsWith('.') && !importPath.startsWith('/') && !importPath.startsWith('file:')) {
+                        let pkgName = importPath;
+                        // Handle scoped packages (e.g. @hardness/core)
+                        if (importPath.startsWith('@')) {
+                            const parts = importPath.split('/');
+                            if (parts.length >= 2) {
+                                pkgName = `${parts[0]}/${parts[1]}`;
+                            }
+                        }
+                        else {
+                            pkgName = importPath.split('/')[0];
+                        }
+                        if (!allDeclared.includes(pkgName)) {
+                            diagnostics.push({
+                                file: relativeFile,
+                                line: lineNum,
+                                ruleId: 'undeclared-dependency',
+                                message: `Dependency "${pkgName}" imported in code but not declared in package.json.`,
+                                severity: 'error'
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    }
+};
+//# sourceMappingURL=typescript-node.js.map

package/packages/analyzers/dist/typescript-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typescript-node.js","sourceRoot":"","sources":["../src/typescript-node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAGxB;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAa;IAC9C,IAAI,EAAE,iBAAiB;IACvB,iBAAiB,EAAE,CAAC,iBAAiB,CAAC;IACtC,KAAK,CAAC,OAAO,CAAC,WAAmB;QAC/B,MAAM,WAAW,GAAiB,EAAE,CAAC;QAErC,wDAAwD;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QACvD,IAAI,YAAY,GAAa,EAAE,CAAC;QAChC,IAAI,eAAe,GAAa,EAAE,CAAC;QAEnC,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC1D,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;gBACnD,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,MAAM,YAAY,GAAG;YACnB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU;YAChE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ;SAC9D,CAAC;QAEF,MAAM,WAAW,GAAG,CAAC,GAAG,YAAY,EAAE,GAAG,eAAe,EAAE,GAAG,YAAY,CAAC,CAAC;QAE3E,4BAA4B;QAC5B,SAAS,SAAS,CAAC,GAAW;YAC5B,IAAI,OAAO,GAAa,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACjC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;gBACxB,gDAAgD;gBAChD,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,wBAAwB,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnI,SAAS;gBACX,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACtC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC/B,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAChD,CAAC;qBAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1G,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,oCAAoC;QACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;gBAEtB,wBAAwB;gBACxB,IAAI,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtG,WAAW,CAAC,IAAI,CAAC;wBACf,IAAI,EAAE,YAAY;wBAClB,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,gBAAgB;wBACxB,OAAO,EAAE,2EAA2E;wBACpF,QAAQ,EAAE,SAAS;qBACpB,CAAC,CAAC;gBACL,CAAC;gBAED,6DAA6D;gBAC7D,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;gBAC7F,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;oBAElC,wBAAwB;oBACxB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;wBAClG,IAAI,OAAO,GAAG,UAAU,CAAC;wBAEzB,+CAA+C;wBAC/C,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;4BACpC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gCACtB,OAAO,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;4BACtC,CAAC;wBACH,CAAC;6BAAM,CAAC;4BACN,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;wBACrC,CAAC;wBAED,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;4BACnC,WAAW,CAAC,IAAI,CAAC;gCACf,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,OAAO;gCACb,MAAM,EAAE,uBAAuB;gCAC/B,OAAO,EAAE,eAAe,OAAO,sDAAsD;gCACrF,QAAQ,EAAE,OAAO;6BAClB,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC"}

package/packages/analyzers/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@hardness/analyzers",
+  "version": "1.0.0",
+  "description": "Hardness Stack Analyzers — static analysis registry per stack profile",
+  "author": "cmt-t",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc --build",
+    "clean": "tsc --build --clean"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@types/node": "^20.12.7"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cmt-t/HardNess.git",
+    "directory": "packages/analyzers"
+  },
+  "bugs": {
+    "url": "https://github.com/cmt-t/HardNess/issues"
+  },
+  "homepage": "https://github.com/cmt-t/HardNess#readme",
+  "keywords": [
+    "static-analysis",
+    "analyzer",
+    "audit",
+    "typescript",
+    "lint"
+  ]
+}

package/packages/cli/README.md

@@ -0,0 +1,27 @@
+# @hardness/cli
+
+CLI entry point for [Hardness](https://github.com/cmt-t/HardNess) — the Universal Agentic Development Harness.
+
+## Usage
+
+```bash
+npx hardness@latest --help
+
+# Initialize a project
+npx hardness init --preset manual
+
+# Validate sprints
+npx hardness validate
+
+# Run the orchestrator
+npx hardness run
+
+# Audit
+npx hardness audit
+```
+
+See the [main repo](https://github.com/cmt-t/HardNess#readme) for full documentation.
+
+## License
+
+MIT © 2026 cmt-t

package/packages/cli/dist/commands/audit.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function auditCommand(program: Command): void;

package/packages/cli/dist/commands/audit.js

@@ -0,0 +1,36 @@
+import { logger, loadConfig, getProjectRoot } from '@hardness/core';
+import { globalAnalyzerRegistry } from '@hardness/analyzers';
+export function auditCommand(program) {
+    program
+        .command('audit')
+        .description('Runs the static analyzers for the configured stackProfile')
+        .option('--json', 'Emits the report as JSON', false)
+        .action(async (opts) => {
+        const root = getProjectRoot();
+        const config = loadConfig(root);
+        const profile = config.stack.stackProfile;
+        logger.info(`Running audit with profile "${profile}" at "${root}"...`);
+        const diagnostics = await globalAnalyzerRegistry.runAll(profile, root);
+        if (opts.json) {
+            process.stdout.write(JSON.stringify({ profile, diagnostics }, null, 2) + '\n');
+        }
+        else {
+            if (diagnostics.length === 0) {
+                logger.success('✓ No issues found. Audit approved.');
+            }
+            else {
+                const errors = diagnostics.filter(d => d.severity === 'error');
+                const warnings = diagnostics.filter(d => d.severity === 'warning');
+                for (const d of diagnostics) {
+                    const loc = d.line ? `${d.file}:${d.line}` : d.file;
+                    const tag = d.severity === 'error' ? 'ERROR' : 'WARN';
+                    logger.warn(`[${tag}] ${loc} (${d.ruleId}) ${d.message}`);
+                }
+                logger.info(`Summary: ${errors.length} error(s), ${warnings.length} warning(s).`);
+            }
+        }
+        const errors = diagnostics.filter(d => d.severity === 'error');
+        process.exit(errors.length > 0 ? 1 : 0);
+    });
+}
+//# sourceMappingURL=audit.js.map

package/packages/cli/dist/commands/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/commands/audit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,2DAA2D,CAAC;SACxE,MAAM,CAAC,QAAQ,EAAE,0BAA0B,EAAE,KAAK,CAAC;SACnD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;QAE1C,MAAM,CAAC,IAAI,CAAC,+BAA+B,OAAO,SAAS,IAAI,MAAM,CAAC,CAAC;QAEvE,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAEvE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;gBAC/D,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;gBACnE,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;oBAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBACpD,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;oBACtD,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,MAAM,cAAc,QAAQ,CAAC,MAAM,cAAc,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/cli/dist/commands/discover.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function discoverCommand(program: Command): void;

package/packages/cli/dist/commands/discover.js

@@ -0,0 +1,12 @@
+import { logger } from '@hardness/core';
+export function discoverCommand(program) {
+    program
+        .command('discover')
+        .description('Interactive interview to generate PRD.md (planned for M4)')
+        .action(() => {
+        logger.warn('`hardness discover` is not yet implemented (planned for Milestone 4).');
+        logger.info('Use this flow instead: write PRD.md manually and run `hardness spec`.');
+        process.exit(2);
+    });
+}
+//# sourceMappingURL=discover.js.map

package/packages/cli/dist/commands/discover.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover.js","sourceRoot":"","sources":["../../src/commands/discover.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,2DAA2D,CAAC;SACxE,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/cli/dist/commands/dry-run.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function dryRunCommand(program: Command): void;

package/packages/cli/dist/commands/dry-run.js

@@ -0,0 +1,47 @@
+import fs from 'fs';
+import path from 'path';
+import { logger, loadConfig, getProjectRoot, getNextFeature, getSprintStatus } from '@hardness/core';
+export function dryRunCommand(program) {
+    program
+        .command('dry-run')
+        .description('Shows what would happen when running the orchestrator, without executing anything')
+        .action(() => {
+        const root = getProjectRoot();
+        const config = loadConfig(root);
+        const currentPath = path.join(root, '.hardness', 'current.txt');
+        if (!fs.existsSync(currentPath)) {
+            logger.fatal(`current.txt not found. Run \`hardness init\` first.`);
+            process.exit(1);
+        }
+        const active = fs.readFileSync(currentPath, 'utf-8').trim();
+        if (!active) {
+            logger.warn('No active sprint.');
+            return;
+        }
+        if (active === 'DONE') {
+            logger.success('Queue empty (DONE).');
+            return;
+        }
+        const sprintPath = path.join(root, '.hardness', 'sprints', active);
+        if (!fs.existsSync(sprintPath)) {
+            logger.fatal(`Active sprint not found: "${sprintPath}"`);
+            process.exit(1);
+        }
+        const sprint = JSON.parse(fs.readFileSync(sprintPath, 'utf-8'));
+        const next = getNextFeature(sprint);
+        logger.info(`[DRY-RUN] Active sprint: ${active}`);
+        logger.info(`[DRY-RUN]   Name: ${sprint.name}`);
+        logger.info(`[DRY-RUN]   Status: ${getSprintStatus(sprint)}`);
+        logger.info(`[DRY-RUN]   agentCommand: ${config.agent.agentCommand}`);
+        if (!next) {
+            logger.success(`[DRY-RUN] No pending features — sprint would be closed.`);
+            return;
+        }
+        logger.info(`[DRY-RUN] Next feature: ${next.id} — "${next.title}"`);
+        logger.info(`[DRY-RUN]   Files: ${(next.files || []).map((f) => typeof f === 'object' ? f.file : f).join(', ')}`);
+        logger.info(`[DRY-RUN]   specLines: ${next.specLines}`);
+        logger.info(`[DRY-RUN]   Gates: typecheck, smoke, grep, anti-empty, unicode, paths, dependency`);
+        logger.success(`[DRY-RUN] Nothing executed. Use \`hardness run\` to execute.`);
+    });
+}
+//# sourceMappingURL=dry-run.js.map

package/packages/cli/dist/commands/dry-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dry-run.js","sourceRoot":"","sources":["../../src/commands/dry-run.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAErG,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,mFAAmF,CAAC;SAChG,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QAEhE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,KAAK,CAAC,6BAA6B,UAAU,GAAG,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QAEpC,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,uBAAuB,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QAEtE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,2BAA2B,IAAI,CAAC,EAAE,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvH,MAAM,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;QACjG,MAAM,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/cli/dist/commands/init.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function initCommand(program: Command): void;