metaharness 0.1.0

package/dist/audit-cmd.js

@@ -0,0 +1,139 @@
+// SPDX-License-Identifier: MIT
+//
+// `harness audit [path] [--level=high|critical|moderate]` CLI subcommand.
+//
+// Wraps `npm audit --omit=dev --audit-level=<level>` against a harness's
+// package-lock.json + reports the per-severity advisory count. Like
+// scripts/audit-deps.mjs but per-harness.
+import { execFile as execFileCb } from 'node:child_process';
+import { promisify } from 'node:util';
+import { existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+const execFile = promisify(execFileCb);
+const LEVELS = ['info', 'low', 'moderate', 'high', 'critical'];
+export async function auditCmd(args) {
+    const positional = args.filter(a => !a.startsWith('--'));
+    const dir = resolve(positional[0] ?? process.cwd());
+    const level = args.find(a => a.startsWith('--level='))?.slice('--level='.length) ?? 'high';
+    const includeDev = args.includes('--include-dev');
+    // iter 102: --bundle emits the full audit JSON (npm audit raw output +
+    // harness metadata) so users can paste it into a security review or
+    // attach to a GitHub issue. Same pattern as iter-90 diag --bundle.
+    const bundle = args.includes('--bundle');
+    const lines = [`harness audit — ${dir} (level=${level})`];
+    if (!LEVELS.includes(level)) {
+        if (bundle) {
+            return {
+                code: 2,
+                lines: [JSON.stringify({ schema: 1, error: 'unknown-level', level, validLevels: LEVELS }, null, 2)],
+            };
+        }
+        lines.push(`  unknown --level=${level} (use one of ${LEVELS.join(', ')})`);
+        return { code: 2, lines };
+    }
+    const pkgPath = join(dir, 'package.json');
+    if (!existsSync(pkgPath)) {
+        if (bundle) {
+            return {
+                code: 1,
+                lines: [JSON.stringify({ schema: 1, error: 'no-package-json', dir }, null, 2)],
+            };
+        }
+        lines.push(`  no package.json at ${dir}`);
+        return { code: 1, lines };
+    }
+    const lockPath = join(dir, 'package-lock.json');
+    if (!existsSync(lockPath)) {
+        if (bundle) {
+            return {
+                code: 1,
+                lines: [JSON.stringify({ schema: 1, error: 'no-lockfile', dir }, null, 2)],
+            };
+        }
+        lines.push(`  no package-lock.json at ${dir} — run \`npm install --package-lock-only\` first`);
+        return { code: 1, lines };
+    }
+    const npmArgs = ['audit', '--json', `--audit-level=${level}`];
+    if (!includeDev)
+        npmArgs.push('--omit=dev');
+    const npmCmd = process.platform === 'win32' ? 'cmd.exe' : 'npm';
+    const finalArgs = process.platform === 'win32'
+        ? ['/d', '/s', '/c', 'npm', ...npmArgs]
+        : npmArgs;
+    let stdout = '', stderr = '', exitCode = 0;
+    try {
+        const r = await execFile(npmCmd, finalArgs, {
+            cwd: dir, maxBuffer: 1024 * 1024 * 16, windowsHide: true,
+        });
+        stdout = r.stdout;
+        stderr = r.stderr;
+    }
+    catch (e) {
+        stdout = e.stdout ?? '';
+        stderr = e.stderr ?? '';
+        exitCode = e.code ?? 1;
+    }
+    let parsed = null;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch { /* */ }
+    if (!parsed) {
+        if (exitCode === 0) {
+            if (bundle) {
+                return {
+                    code: 0,
+                    lines: [JSON.stringify({
+                            schema: 1, generatedAt: new Date().toISOString(),
+                            harnessDir: dir, level, total: 0, counts: {},
+                            offenders: [], failCount: 0, exitCode: 0,
+                        }, null, 2)],
+                };
+            }
+            lines.push('  no advisories at the configured level');
+            return { code: 0, lines };
+        }
+        if (bundle) {
+            return {
+                code: 1,
+                lines: [JSON.stringify({ schema: 1, error: 'non-json-audit-output', exitCode, stderr }, null, 2)],
+            };
+        }
+        lines.push(`  npm audit produced non-JSON output (exit ${exitCode})`);
+        return { code: 1, lines };
+    }
+    const counts = parsed.metadata?.vulnerabilities ?? {};
+    const levelIdx = LEVELS.indexOf(level);
+    const failCount = LEVELS.slice(levelIdx).reduce((s, l) => s + (counts[l] ?? 0), 0);
+    const total = Object.values(counts).reduce((s, n) => s + (n ?? 0), 0);
+    const offenders = Object.entries(parsed.vulnerabilities ?? {})
+        .filter(([, v]) => LEVELS.indexOf(v.severity) >= levelIdx)
+        .map(([name, v]) => ({ name, severity: v.severity, advisory: v.via?.[0]?.title ?? null }));
+    const code = failCount === 0 ? 0 : 1;
+    if (bundle) {
+        return {
+            code,
+            lines: [JSON.stringify({
+                    schema: 1,
+                    generatedAt: new Date().toISOString(),
+                    harnessDir: dir,
+                    level,
+                    total,
+                    counts,
+                    offenders,
+                    failCount,
+                    exitCode: code,
+                }, null, 2)],
+        };
+    }
+    lines.push(`  total advisories: ${total}`);
+    lines.push(`  per severity: ${LEVELS.map(l => `${l}=${counts[l] ?? 0}`).join(', ')}`);
+    if (failCount === 0) {
+        lines.push(`  PASS: 0 advisories at ${level}+`);
+        return { code: 0, lines };
+    }
+    const offenderText = offenders.slice(0, 5).map(o => `${o.name}(${o.severity})`);
+    lines.push(`  FAIL: ${failCount} advisories at ${level}+: ${offenderText.join(', ')}`);
+    return { code: 1, lines };
+}
+//# sourceMappingURL=audit-cmd.js.map

package/dist/audit-cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-cmd.js","sourceRoot":"","sources":["../src/audit-cmd.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,0EAA0E;AAC1E,EAAE;AACF,yEAAyE;AACzE,oEAAoE;AACpE,0CAA0C;AAE1C,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;AAIvC,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAExE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAc;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;IAC3F,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAClD,uEAAuE;IACvE,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEzC,MAAM,KAAK,GAAa,CAAC,mBAAmB,GAAG,WAAW,KAAK,GAAG,CAAC,CAAC;IAEpE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAY,CAAC,EAAE,CAAC;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;aACpG,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,gBAAgB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3E,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;aAC/E,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;aAC3E,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,6BAA6B,GAAG,kDAAkD,CAAC,CAAC;QAC/F,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,KAAK,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5C,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QACvC,CAAC,CAAC,OAAO,CAAC;IAEZ,IAAI,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE;YAC1C,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI;SACzD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAAC,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,GAAQ,IAAI,CAAC;IACvB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;4BACrB,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;4BAChD,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE;4BAC5C,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;yBACzC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;iBACb,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;aAClG,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,8CAA8C,QAAQ,GAAG,CAAC,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAY,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAS,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAM,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;SAChE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAE,CAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC;SAClE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAG,CAAS,CAAC,QAAQ,EAAE,QAAQ,EAAG,CAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/G,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;oBACrB,MAAM,EAAE,CAAC;oBACT,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACrC,UAAU,EAAE,GAAG;oBACf,KAAK;oBACL,KAAK;oBACL,MAAM;oBACN,SAAS;oBACT,SAAS;oBACT,QAAQ,EAAE,IAAI;iBACf,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;SACb,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtF,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,2BAA2B,KAAK,GAAG,CAAC,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;IAChF,KAAK,CAAC,IAAI,CAAC,WAAW,SAAS,kBAAkB,KAAK,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC"}

package/dist/bin.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=bin.d.ts.map

package/dist/bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":""}

package/dist/bin.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: MIT
+import { main } from './index.js';
+main(process.argv.slice(2)).catch((err) => {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+});
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,+BAA+B;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACjD,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/compare-cmd.d.ts

@@ -0,0 +1,56 @@
+export type SubcommandResult = {
+    code: number;
+    lines: string[];
+};
+interface Manifest {
+    schema?: number;
+    generator?: string;
+    template?: string;
+    template_version?: string;
+    hosts?: string[];
+    files?: Record<string, string>;
+    meta?: {
+        surface?: string;
+        kernel_version?: string;
+    };
+}
+interface CompareReport {
+    schema: 1;
+    generatedAt: string;
+    a: {
+        dir: string;
+        manifest: Manifest | undefined;
+    };
+    b: {
+        dir: string;
+        manifest: Manifest | undefined;
+    };
+    meta: {
+        sameSurface: boolean;
+        sameKernel: boolean;
+        sameGenerator: boolean;
+        surfaceA: string | undefined;
+        surfaceB: string | undefined;
+        kernelA: string | undefined;
+        kernelB: string | undefined;
+        generatorA: string | undefined;
+        generatorB: string | undefined;
+    };
+    hosts: {
+        sameHosts: boolean;
+        addedInB: string[];
+        removedInB: string[];
+    };
+    files: {
+        sameFiles: boolean;
+        addedInB: string[];
+        removedInB: string[];
+        changed: string[];
+    };
+    identical: boolean;
+    exitCode: number;
+}
+export declare function buildCompareReport(dirA: string, dirB: string): Promise<CompareReport>;
+export declare function compareCmd(args: string[]): Promise<SubcommandResult>;
+export {};
+//# sourceMappingURL=compare-cmd.d.ts.map

package/dist/compare-cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare-cmd.d.ts","sourceRoot":"","sources":["../src/compare-cmd.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE,UAAU,QAAQ;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED,UAAU,aAAa;IACrB,MAAM,EAAE,CAAC,CAAC;IACV,WAAW,EAAE,MAAM,CAAC;IACpB,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAA;KAAE,CAAC;IACnD,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAA;KAAE,CAAC;IACnD,IAAI,EAAE;QACJ,WAAW,EAAE,OAAO,CAAC;QACrB,UAAU,EAAE,OAAO,CAAC;QACpB,aAAa,EAAE,OAAO,CAAC;QACvB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;QAC/B,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;KAChC,CAAC;IACF,KAAK,EAAE;QACL,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,UAAU,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;IACF,KAAK,EAAE;QACL,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAqBD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAuD3F;AA0CD,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsC1E"}

package/dist/compare-cmd.js

@@ -0,0 +1,173 @@
+// SPDX-License-Identifier: MIT
+//
+// `harness compare <a> <b>` — diff two harness manifests + per-file
+// fingerprints + meta blocks.
+//
+// Use case: "is my fork drifting from upstream?" or "does my prod copy
+// match my staging copy?". The manifest already records per-file
+// sha256 (iter 56 + earlier), so a comparison reduces to:
+//
+//   1. meta block diff      (surface? kernel_version? generator?)
+//   2. host list diff        (does the fork target the same hosts?)
+//   3. per-file fingerprint diff   (added/removed/changed)
+//
+// Bundle-shaped output (--bundle) per ADR-031.
+import { readFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+async function readManifest(dir) {
+    const path = join(dir, '.harness', 'manifest.json');
+    if (!existsSync(path))
+        return undefined;
+    try {
+        return JSON.parse(await readFile(path, 'utf-8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+function diffSets(a, b) {
+    const aSet = new Set(a);
+    const bSet = new Set(b);
+    return {
+        addedInB: b.filter(x => !aSet.has(x)).sort(),
+        removedInB: a.filter(x => !bSet.has(x)).sort(),
+    };
+}
+export async function buildCompareReport(dirA, dirB) {
+    const mA = await readManifest(dirA);
+    const mB = await readManifest(dirB);
+    const surfaceA = mA?.meta?.surface;
+    const surfaceB = mB?.meta?.surface;
+    const kernelA = mA?.meta?.kernel_version;
+    const kernelB = mB?.meta?.kernel_version;
+    const generatorA = mA?.generator;
+    const generatorB = mB?.generator;
+    const hostsDiff = diffSets(mA?.hosts ?? [], mB?.hosts ?? []);
+    const filesA = mA?.files ?? {};
+    const filesB = mB?.files ?? {};
+    const filesDiff = diffSets(Object.keys(filesA), Object.keys(filesB));
+    const changed = Object.keys(filesA)
+        .filter(p => p in filesB && filesA[p] !== filesB[p])
+        .sort();
+    const identical = surfaceA === surfaceB &&
+        kernelA === kernelB &&
+        generatorA === generatorB &&
+        hostsDiff.addedInB.length === 0 &&
+        hostsDiff.removedInB.length === 0 &&
+        filesDiff.addedInB.length === 0 &&
+        filesDiff.removedInB.length === 0 &&
+        changed.length === 0;
+    return {
+        schema: 1,
+        generatedAt: new Date().toISOString(),
+        a: { dir: dirA, manifest: mA },
+        b: { dir: dirB, manifest: mB },
+        meta: {
+            sameSurface: surfaceA === surfaceB,
+            sameKernel: kernelA === kernelB,
+            sameGenerator: generatorA === generatorB,
+            surfaceA, surfaceB, kernelA, kernelB, generatorA, generatorB,
+        },
+        hosts: {
+            sameHosts: hostsDiff.addedInB.length === 0 && hostsDiff.removedInB.length === 0,
+            addedInB: hostsDiff.addedInB,
+            removedInB: hostsDiff.removedInB,
+        },
+        files: {
+            sameFiles: filesDiff.addedInB.length === 0 && filesDiff.removedInB.length === 0 && changed.length === 0,
+            addedInB: filesDiff.addedInB,
+            removedInB: filesDiff.removedInB,
+            changed,
+        },
+        identical,
+        exitCode: identical ? 0 : 1,
+    };
+}
+function formatReport(r) {
+    const lines = [];
+    lines.push(`harness compare`);
+    lines.push(`  A: ${r.a.dir}`);
+    lines.push(`  B: ${r.b.dir}`);
+    lines.push('');
+    if (!r.a.manifest || !r.b.manifest) {
+        if (!r.a.manifest)
+            lines.push(`  FAIL no .harness/manifest.json at A (${r.a.dir})`);
+        if (!r.b.manifest)
+            lines.push(`  FAIL no .harness/manifest.json at B (${r.b.dir})`);
+        return lines;
+    }
+    lines.push('  meta:');
+    lines.push(`    surface:           A=${r.meta.surfaceA ?? '(unset)'} B=${r.meta.surfaceB ?? '(unset)'} ${r.meta.sameSurface ? 'PASS' : 'FAIL'}`);
+    lines.push(`    kernel_version:    A=${r.meta.kernelA ?? '(unset)'} B=${r.meta.kernelB ?? '(unset)'} ${r.meta.sameKernel ? 'PASS' : 'FAIL'}`);
+    lines.push(`    generator:         A=${r.meta.generatorA ?? '(unset)'} B=${r.meta.generatorB ?? '(unset)'} ${r.meta.sameGenerator ? 'PASS' : 'FAIL'}`);
+    lines.push('  hosts:');
+    if (r.hosts.sameHosts) {
+        lines.push('    PASS host lists match');
+    }
+    else {
+        if (r.hosts.addedInB.length)
+            lines.push(`    + added in B:   ${r.hosts.addedInB.join(', ')}`);
+        if (r.hosts.removedInB.length)
+            lines.push(`    - removed in B: ${r.hosts.removedInB.join(', ')}`);
+    }
+    lines.push('  files:');
+    if (r.files.sameFiles) {
+        lines.push(`    PASS ${Object.keys(r.a.manifest.files ?? {}).length} files match`);
+    }
+    else {
+        if (r.files.addedInB.length)
+            lines.push(`    + added in B:   ${r.files.addedInB.length} file(s)`);
+        if (r.files.removedInB.length)
+            lines.push(`    - removed in B: ${r.files.removedInB.length} file(s)`);
+        if (r.files.changed.length)
+            lines.push(`    ~ changed:      ${r.files.changed.length} file(s)`);
+        // Show the first 5 of each so the user can spot the obvious differences
+        const sample = (arr) => arr.slice(0, 5).map(p => `        ${p}`);
+        if (r.files.addedInB.length)
+            sample(r.files.addedInB).forEach(l => lines.push(l));
+        if (r.files.removedInB.length)
+            sample(r.files.removedInB).forEach(l => lines.push(l));
+        if (r.files.changed.length)
+            sample(r.files.changed).forEach(l => lines.push(l));
+    }
+    lines.push('');
+    lines.push(`  Result: ${r.identical ? 'IDENTICAL' : 'DRIFT'}`);
+    return lines;
+}
+export async function compareCmd(args) {
+    const bundle = args.includes('--bundle');
+    const positional = args.filter(a => !a.startsWith('--'));
+    if (positional.length < 2) {
+        const lines = [
+            'Usage: harness compare <a> <b> [--bundle]',
+            '',
+            'Compare two scaffolded harnesses by manifest + per-file fingerprint.',
+            'Exits 0 if identical, 1 if drift, 2 if either path lacks a manifest.',
+        ];
+        return { code: 2, lines };
+    }
+    const dirA = resolve(positional[0]);
+    const dirB = resolve(positional[1]);
+    const report = await buildCompareReport(dirA, dirB);
+    // ADR-031: missing manifest is an error path that's still bundle-formed.
+    if (!report.a.manifest || !report.b.manifest) {
+        if (bundle) {
+            return {
+                code: 2,
+                lines: [JSON.stringify({
+                        schema: 1, generatedAt: report.generatedAt,
+                        error: !report.a.manifest && !report.b.manifest ? 'no-manifest-in-either'
+                            : !report.a.manifest ? 'no-manifest-in-a' : 'no-manifest-in-b',
+                        dirA, dirB, exitCode: 2,
+                    }, null, 2)],
+            };
+        }
+        return { code: 2, lines: formatReport(report) };
+    }
+    if (bundle) {
+        return { code: report.exitCode, lines: [JSON.stringify(report, null, 2)] };
+    }
+    return { code: report.exitCode, lines: formatReport(report) };
+}
+//# sourceMappingURL=compare-cmd.js.map

package/dist/compare-cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare-cmd.js","sourceRoot":"","sources":["../src/compare-cmd.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,oEAAoE;AACpE,8BAA8B;AAC9B,EAAE;AACF,uEAAuE;AACvE,iEAAiE;AACjE,0DAA0D;AAC1D,EAAE;AACF,kEAAkE;AAClE,oEAAoE;AACpE,2DAA2D;AAC3D,EAAE;AACF,+CAA+C;AAE/C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgD1C,KAAK,UAAU,YAAY,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAI,CAAM,EAAE,CAAM;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;KAC/C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,IAAY;IACjE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC;IACnC,MAAM,QAAQ,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC;IACnC,MAAM,OAAO,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC;IACzC,MAAM,OAAO,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC;IACzC,MAAM,UAAU,GAAG,EAAE,EAAE,SAAS,CAAC;IACjC,MAAM,UAAU,GAAG,EAAE,EAAE,SAAS,CAAC;IAEjC,MAAM,SAAS,GAAG,QAAQ,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;SACnD,IAAI,EAAE,CAAC;IAEV,MAAM,SAAS,GACb,QAAQ,KAAK,QAAQ;QACrB,OAAO,KAAK,OAAO;QACnB,UAAU,KAAK,UAAU;QACzB,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC/B,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QACjC,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC/B,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QACjC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IAEvB,OAAO;QACL,MAAM,EAAE,CAAC;QACT,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC9B,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC9B,IAAI,EAAE;YACJ,WAAW,EAAE,QAAQ,KAAK,QAAQ;YAClC,UAAU,EAAE,OAAO,KAAK,OAAO;YAC/B,aAAa,EAAE,UAAU,KAAK,UAAU;YACxC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU;SAC7D;QACD,KAAK,EAAE;YACL,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAC/E,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,UAAU,EAAE,SAAS,CAAC,UAAU;SACjC;QACD,KAAK,EAAE;YACL,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YACvG,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,OAAO;SACR;QACD,SAAS;QACT,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,CAAgB;IACpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC9B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QACpF,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,SAAS,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACjJ,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9I,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,SAAS,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACvJ,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,cAAc,CAAC,CAAC;IACrF,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,UAAU,CAAC,CAAC;QAClG,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,UAAU,CAAC,CAAC;QACtG,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;QAChG,wEAAwE;QACxE,MAAM,MAAM,GAAG,CAAC,GAAa,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM;YAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM;YAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAEzD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG;YACZ,2CAA2C;YAC3C,EAAE;YACF,sEAAsE;YACtE,sEAAsE;SACvE,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEpD,yEAAyE;IACzE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC1C,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,uBAAuB;4BACpE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB;wBACnE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;qBACxB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;aACb,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;AAChE,CAAC"}

package/dist/completions-cmd.d.ts

@@ -0,0 +1,6 @@
+export type SubcommandResult = {
+    code: number;
+    lines: string[];
+};
+export declare function completionsCmd(args: string[]): SubcommandResult;
+//# sourceMappingURL=completions-cmd.d.ts.map

package/dist/completions-cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completions-cmd.d.ts","sourceRoot":"","sources":["../src/completions-cmd.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAyIjE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CA8B/D"}

package/dist/completions-cmd.js

@@ -0,0 +1,171 @@
+// SPDX-License-Identifier: MIT
+//
+// `harness completions <bash|zsh|fish>` — emit shell completion
+// scripts. Mirrors the standard CLI convention (gh, npm, etc.).
+// Users source the output:
+//
+//   harness completions bash >> ~/.bash_completion
+//   harness completions zsh  >  ~/.zsh/_harness
+//   harness completions fish >  ~/.config/fish/completions/harness.fish
+const SUBCOMMANDS = [
+    'sign', 'verify', 'doctor',
+    'federate', 'secrets', 'validate',
+    'mcp', 'publish', 'upgrade',
+    'completions', 'sbom', 'audit',
+    // iter 55 PR-#1 additions
+    'mcp-scan', 'analyze-repo',
+    // iter 66 — kernel-version skew diagnostic
+    'diag',
+    // iter 97 — export MCP + claims as single JSON
+    'export-config',
+    // iter 105 — diff two harness manifests + per-file fingerprints
+    'compare',
+    // iter 110 — 7-section readiness scorecard for a local repo
+    'genome',
+    // iter 111 — 5-dimension harness scorecard with badges
+    'score',
+    // iter 112 — MCP threat-model artifact for enterprise review
+    'threat-model',
+    // iter 121 — OIA v0.1 cross-cutting manifest (ADR-034)
+    'oia-manifest',
+    'help',
+];
+const SECRETS_SUBSUBS = ['check', 'fetch', 'validate-token', 'help'];
+const MCP_SUBSUBS = ['ls', 'invoke', 'help'];
+const FEDERATE_SUBSUBS = ['init', 'add', 'remove', 'list', 'status', 'help'];
+function bashCompletion() {
+    return `# bash completion for harness
+_harness_completion() {
+  local cur prev cmd
+  COMPREPLY=()
+  cur="\${COMP_WORDS[COMP_CWORD]}"
+  prev="\${COMP_WORDS[COMP_CWORD-1]}"
+  cmd="\${COMP_WORDS[1]:-}"
+
+  # Top-level subcommands
+  if [ $COMP_CWORD -eq 1 ]; then
+    COMPREPLY=( $(compgen -W "${SUBCOMMANDS.join(' ')}" -- "$cur") )
+    return 0
+  fi
+
+  case "$cmd" in
+    secrets)
+      [ $COMP_CWORD -eq 2 ] && COMPREPLY=( $(compgen -W "${SECRETS_SUBSUBS.join(' ')}" -- "$cur") )
+      ;;
+    mcp)
+      [ $COMP_CWORD -eq 2 ] && COMPREPLY=( $(compgen -W "${MCP_SUBSUBS.join(' ')}" -- "$cur") )
+      ;;
+    federate)
+      [ $COMP_CWORD -eq 2 ] && COMPREPLY=( $(compgen -W "${FEDERATE_SUBSUBS.join(' ')}" -- "$cur") )
+      ;;
+    completions)
+      [ $COMP_CWORD -eq 2 ] && COMPREPLY=( $(compgen -W "bash zsh fish" -- "$cur") )
+      ;;
+  esac
+  return 0
+}
+complete -F _harness_completion harness
+`;
+}
+function zshCompletion() {
+    return `#compdef harness
+# zsh completion for harness
+
+_harness() {
+  local -a subcommands
+  subcommands=(
+    'sign:produce or update the witness manifest'
+    'verify:verify the witness manifest signature'
+    'doctor:smoke-check a scaffolded harness'
+    'federate:manage federation peers (init/add/remove/list/status)'
+    'secrets:GCP Secret Manager: check / fetch / validate-token'
+    'validate:umbrella: doctor + verify + path-guard + mcp + secrets'
+    'mcp:list MCP servers / dispatch a tool through the claim check'
+    'publish:pin the harness manifest to IPFS via Pinata (dry-run default)'
+    'upgrade:re-render template + drift plan (--apply to apply)'
+    'completions:emit shell completion scripts (bash/zsh/fish)'
+    'sbom:emit SPDX-2.3 SBOM for the harness'
+    'audit:npm audit per-harness with structured output'
+    'mcp-scan:security-scan the harness MCP surface (policy + perms + deps)'
+    'analyze-repo:recommend a harness from a local repo'
+    'diag:kernel-version skew check (ADR-027 diagnostic)'
+    'export-config:emit MCP servers + claims + permissions as a single JSON'
+    'compare:diff two harnesses (manifest + per-file fingerprints, ADR-031 --bundle)'
+    'genome:7-section readiness scorecard for a local repo (--json/--bundle, iter 110)'
+    'score:5-dimension harness scorecard 0–100 with badges (--json/--bundle, iter 111)'
+    'threat-model:MCP threat-model artifact for PR/compliance review (--json/--bundle, iter 112)'
+    'oia-manifest:emit .harness/oia-manifest.json — OIA v0.1 layer alignment (ADR-034, iter 121)'
+    'help:show help'
+  )
+
+  if (( CURRENT == 2 )); then
+    _describe -t commands 'harness command' subcommands
+    return
+  fi
+
+  case "$words[2]" in
+    secrets)
+      (( CURRENT == 3 )) && compadd ${SECRETS_SUBSUBS.join(' ')}
+      ;;
+    mcp)
+      (( CURRENT == 3 )) && compadd ${MCP_SUBSUBS.join(' ')}
+      ;;
+    federate)
+      (( CURRENT == 3 )) && compadd ${FEDERATE_SUBSUBS.join(' ')}
+      ;;
+    completions)
+      (( CURRENT == 3 )) && compadd bash zsh fish
+      ;;
+  esac
+}
+
+_harness "$@"
+`;
+}
+function fishCompletion() {
+    const subs = SUBCOMMANDS.map(s => `complete -c harness -f -n '__fish_use_subcommand' -a ${s}`).join('\n');
+    return `# fish completion for harness
+${subs}
+
+# secrets sub-subs
+complete -c harness -f -n '__fish_seen_subcommand_from secrets' -a '${SECRETS_SUBSUBS.join(' ')}'
+# mcp sub-subs
+complete -c harness -f -n '__fish_seen_subcommand_from mcp' -a '${MCP_SUBSUBS.join(' ')}'
+# federate sub-subs
+complete -c harness -f -n '__fish_seen_subcommand_from federate' -a '${FEDERATE_SUBSUBS.join(' ')}'
+# completions sub-subs
+complete -c harness -f -n '__fish_seen_subcommand_from completions' -a 'bash zsh fish'
+`;
+}
+export function completionsCmd(args) {
+    const shell = args[0];
+    switch (shell) {
+        case 'bash':
+            return { code: 0, lines: [bashCompletion()] };
+        case 'zsh':
+            return { code: 0, lines: [zshCompletion()] };
+        case 'fish':
+            return { code: 0, lines: [fishCompletion()] };
+        case undefined:
+        case 'help':
+            return {
+                code: 0,
+                lines: [
+                    'Usage: harness completions <bash|zsh|fish>',
+                    '',
+                    'Emit a shell completion script for the given shell.',
+                    '',
+                    'Examples:',
+                    '  harness completions bash >> ~/.bash_completion',
+                    '  harness completions zsh  >  ~/.zsh/_harness',
+                    '  harness completions fish >  ~/.config/fish/completions/harness.fish',
+                ],
+            };
+        default:
+            return {
+                code: 2,
+                lines: [`Unknown shell: ${shell} (expected bash, zsh, or fish)`],
+            };
+    }
+}
+//# sourceMappingURL=completions-cmd.js.map

package/dist/completions-cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"completions-cmd.js","sourceRoot":"","sources":["../src/completions-cmd.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,gEAAgE;AAChE,gEAAgE;AAChE,2BAA2B;AAC3B,EAAE;AACF,mDAAmD;AACnD,gDAAgD;AAChD,wEAAwE;AAIxE,MAAM,WAAW,GAAG;IAClB,MAAM,EAAE,QAAQ,EAAE,QAAQ;IAC1B,UAAU,EAAE,SAAS,EAAE,UAAU;IACjC,KAAK,EAAE,SAAS,EAAE,SAAS;IAC3B,aAAa,EAAE,MAAM,EAAE,OAAO;IAC9B,0BAA0B;IAC1B,UAAU,EAAE,cAAc;IAC1B,2CAA2C;IAC3C,MAAM;IACN,+CAA+C;IAC/C,eAAe;IACf,gEAAgE;IAChE,SAAS;IACT,4DAA4D;IAC5D,QAAQ;IACR,uDAAuD;IACvD,OAAO;IACP,6DAA6D;IAC7D,cAAc;IACd,uDAAuD;IACvD,cAAc;IACd,MAAM;CACE,CAAC;AAEX,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAU,CAAC;AAC9E,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AACtD,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAEtF,SAAS,cAAc;IACrB,OAAO;;;;;;;;;;gCAUuB,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;;;;;;2DAMM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;;;2DAGzB,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;;;2DAGrB,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;;;;;;;;;CASpF,CAAC;AACF,CAAC;AAED,SAAS,aAAa;IACpB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sCAqC6B,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;;;sCAGzB,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;;;sCAGrB,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;;;;;;;;;CAS/D,CAAC;AACF,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,wDAAwD,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1G,OAAO;EACP,IAAI;;;sEAGgE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;;kEAE7B,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;;uEAEhB,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;;;CAGhG,CAAC;AACF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAc;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC;QAChD,KAAK,KAAK;YACR,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC;QAC/C,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC;QAChD,KAAK,SAAS,CAAC;QACf,KAAK,MAAM;YACT,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE;oBACL,4CAA4C;oBAC5C,EAAE;oBACF,qDAAqD;oBACrD,EAAE;oBACF,WAAW;oBACX,kDAAkD;oBAClD,+CAA+C;oBAC/C,uEAAuE;iBACxE;aACF,CAAC;QACJ;YACE,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC,kBAAkB,KAAK,gCAAgC,CAAC;aACjE,CAAC;IACN,CAAC;AACH,CAAC"}