ruby-pwsh 2.0.0 → 2.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 696f0411f70a59f1e487088dd2e90c6f16c66949f7872c05d29ac53a5e86cc65
-  data.tar.gz: 7c2e373fe612fedc43a84b85afd267239de4fff91e5e5a12dc89de3fa8896231
+  metadata.gz: d87a118d1771f309420051ae1204ceef19fd07b749bfe6ae00f09cd5f4cb0dea
+  data.tar.gz: defedaf6b72f61b033cdf576b83925f2796f22ef16e1f32269d8f20b0ab35f9a
 SHA512:
-  metadata.gz: 1fffcd2e377099b3a2d4b58787ce5d899f21c613f6a81c66ca0c555a7bcc3c02ec22514850aa60bcb56681cdf156ac86727a3c795e8f527a5c08c56a84d5dd1b
-  data.tar.gz: e32671cf64bd4cd3fecb838ce913c345a5169500a5c5698dc1acbec738e611fbe36e40e84d39ccd6a93aa703b80abaf343ced4da7bb5d655f2a68fe3e9868219
+  metadata.gz: c90e9942e0bdd31c33e1cb965795625726adb919d98b599b5008840ddf91291129b3f2a740dc26baff6495b3fecc7cc5330c7136e868b25c572662c50823d3db
+  data.tar.gz: 2f130b671873a490c2e811994fb635a47a37882190e1cd4a98e934fde5c08a1577d31f5b21eee7f0866285f6f85e0fdc5599bce18b9502c9dd9d3b04f3f36031

data/lib/puppet/provider/dsc_base_provider/dsc_base_provider.rb

@@ -12,8 +12,11 @@ class Puppet::Provider::DscBaseProvider # rubocop:disable Metrics/ClassLength
   # - logon failures
   def initialize
     @cached_canonicalized_resource = []
-    @cached_query_results = []
+    @cached_canonicalize_results = [] # Cache for invoke_get_method calls from canonicalize only
+    @cached_query_results = []        # Cache for invoke_get_method calls from get only
     @cached_test_results = []
+    @cached_fresh_get_results = {}
+    @insync_property_cache = {}
     @logon_failures = []
     @timeout = nil # default timeout, ps_manager.execute is expecting nil by default..
     super
@@ -61,7 +64,11 @@ class Puppet::Provider::DscBaseProvider # rubocop:disable Metrics/ClassLength
           canonicalized = r.dup
           @cached_canonicalized_resource << r.dup
         else
-          canonicalized = invoke_get_method(context, r)
+          # Use a separate cache for canonicalize's Get calls so we don't pollute
+          # @cached_query_results, which get() uses for the "is" state comparison.
+          # Sharing a cache between canonicalize and get caused the Resource API to
+          # see identical "should" and "is" values, killing per-property report detail.
+          canonicalized = invoke_get_method_for_canonicalize(context, r)
           # If the resource could not be found or was returned as absent, skip case munging and
           # treat the manifest values as canonical since the resource is being created.
           # rubocop:disable Metrics/BlockNesting
@@ -136,6 +143,21 @@ class Puppet::Provider::DscBaseProvider # rubocop:disable Metrics/ClassLength
     cached_results = fetch_cached_hashes(@cached_query_results, names)
     return cached_results unless cached_results.empty?
 
+    # Use the raw system state from canonicalize's Get call if available.
+    # @cached_canonicalize_results has the unmodified DSC Get response (before
+    # canonicalize normalized casing). This gives the Resource API real "is" data
+    # with all property values, enabling per-property "Changed from" reporting.
+    unless @cached_canonicalize_results.empty?
+      canon_results = fetch_cached_hashes(@cached_canonicalize_results, names)
+      unless canon_results.empty?
+        # Cache these as query results too so subsequent get() calls find them
+        canon_results.each do |r|
+          @cached_query_results << r.dup if fetch_cached_hashes(@cached_query_results, [r]).empty?
+        end
+        return canon_results
+      end
+    end
+
     if @cached_canonicalized_resource.empty?
       mandatory_properties = {}
     else
@@ -166,6 +188,12 @@ class Puppet::Provider::DscBaseProvider # rubocop:disable Metrics/ClassLength
       # If should is an array instead of a hash and only has one entry, use that.
       should = should.first if should.is_a?(Array) && should.length == 1
 
+      # DSC_WORKAROUND logging disabled — the insync? tuple returns now provide
+      # accurate per-property change detail in PE Events, making this redundant.
+      # Retained commented out for future debugging if needed.
+      # fresh_is = get_fresh_state_for_logging(context, name, should)
+      # log_change_detail(context, name, fresh_is || is, should)
+
       # for compatibility sake, we use dsc_ensure instead of ensure, so context.type.ensurable? does not work
       if context.type.attributes.key?(:dsc_ensure)
         # HACK: If the DSC Resource is ensurable but doesn't report a default value
@@ -201,6 +229,120 @@ class Puppet::Provider::DscBaseProvider # rubocop:disable Metrics/ClassLength
     end
   end
 
+  # Compares the is and should hashes and logs per-property change detail.
+  # The Resource API does not generate per-property change events when custom_insync
+  # is declared as a feature, so we emit them ourselves to populate report detail.
+  #
+  # @param context [Object] the Puppet runtime context to operate in and send feedback to
+  # @param name [String] the name of the resource being changed
+  # @param is [Hash] the current state of the resource
+  # @param should [Hash] the desired state of the resource
+  def log_change_detail(context, name, is_value, should)
+    return if is_value.nil? || should.nil?
+
+    # Build context info for the log line
+    type_name = begin
+      context.type.definition[:name]
+    rescue StandardError
+      nil
+    end
+    dsc_module = begin
+      context.type.definition[:dscmeta_module_name]
+    rescue StandardError
+      nil
+    end
+    resource_title = name.is_a?(Hash) ? name[:name] : name
+    # Try to extract the declaring Puppet class from tags if available
+    tags = should[:tag] || should[:tags]
+    declaring_class = if tags.is_a?(Array)
+                        # Tags include type name, title, and all containing classes.
+                        # Class tags contain '::' — pick the most specific one.
+                        tags.reverse.find { |t| t.include?('::') }
+                      end
+
+    should.each do |property, desired_value|
+      next unless property.to_s.start_with?('dsc_')
+      next if property == :dsc_psdscrunascredential
+      # Skip namevars — they're identifiers, not managed properties
+      next if namevar_attributes(context).include?(property)
+
+      current_value = is_value[property]
+      # Skip if values are the same (case-insensitive for strings)
+      next if same?(recursively_downcase(current_value), recursively_downcase(desired_value))
+
+      mof_type = begin
+        context.type.definition[:attributes][property][:mof_type]
+      rescue StandardError
+        nil
+      end
+
+      detail = "DSC_WORKAROUND: #{property} '#{current_value}' -> '#{desired_value}'"
+      detail += " (#{mof_type})" if mof_type
+      detail += " | resource: #{type_name}[#{resource_title}]" if type_name
+      detail += " | dsc_module: #{dsc_module}" if dsc_module
+      detail += " | class: #{declaring_class}" if declaring_class
+      context.notice(detail)
+    end
+  end
+
+  # Performs a fresh DSC Get call completely bypassing all caches to retrieve the actual
+  # current system state. Used by both insync? (for accurate property comparison and
+  # change_message tuples) and set() (for DSC_WORKAROUND log entries).
+  #
+  # @param context [Object] the Puppet runtime context to operate in and send feedback to
+  # @param name [Hash] the name hash for the resource
+  # @param should [Hash] the desired state hash (used to extract query properties)
+  # @return [Hash] returns a hash with dsc_ prefixed keys and current system values, or nil on failure
+  def perform_fresh_get(context, name, should)
+    query_props = should.select { |k, v| mandatory_get_attributes(context).include?(k) || (k == :dsc_psdscrunascredential && !v.nil?) }
+    data = invoke_dsc_resource(context, name, query_props, 'get')
+    return nil if data.nil?
+
+    # Minimal key processing to match the dsc_ prefix format used by Puppet types
+    valid_attributes = context.type.attributes.keys.collect(&:to_s)
+    result = {}
+    data.each do |key, value|
+      type_key = :"dsc_#{key.downcase}"
+      next unless valid_attributes.include?(type_key.to_s)
+
+      # Sanitize .NET serialization artifacts (e.g., "System.Object[]")
+      if value.is_a?(String) && value =~ /^System\.\w+\[\]$/
+        result[type_key] = nil
+      else
+        # Normalize CIM instances the same way invoke_get_method does,
+        # so fresh values are comparable to canonicalized should values.
+        if value.is_a?(Enumerable)
+          downcase_hash_keys!(value)
+          munge_cim_instances!(value)
+        end
+        result[type_key] = value
+      end
+    end
+    result[:name] = name.is_a?(Hash) ? name[:name] : name
+    result
+  rescue StandardError => e
+    context.debug("perform_fresh_get failed: #{e.message}")
+    nil
+  end
+
+  # Caching wrapper around perform_fresh_get — one fresh DSC Get per resource,
+  # reused across all properties during that resource's insync? calls.
+  #
+  # @param context [Object] the Puppet runtime context to operate in and send feedback to
+  # @param name [Hash] the name hash for the resource
+  # @param should [Hash] the desired state hash (used to extract query properties)
+  # @return [Hash] returns a hash with dsc_ prefixed keys and current system values, or nil on failure
+  def get_cached_fresh_state(context, name, should)
+    cache_key = name.is_a?(Hash) ? name[:name] : name
+    context.debug("INSYNC_DIAG: get_cached_fresh_state called, cache_key=#{cache_key.inspect}, name class=#{name.class}, cached=#{@cached_fresh_get_results.key?(cache_key)}")
+    unless @cached_fresh_get_results.key?(cache_key)
+      result = perform_fresh_get(context, name, should)
+      context.debug("INSYNC_DIAG: perform_fresh_get returned #{result.nil? ? 'nil' : result.keys.inspect}")
+      @cached_fresh_get_results[cache_key] = result
+    end
+    @cached_fresh_get_results[cache_key]
+  end
+
   # Attempts to set an instance of the DSC resource, invoking the `Set` method and thinly wrapping
   # the `invoke_set_method` method; whether this method, `update`, or `delete` is called is entirely
   # up to the Resource API based on the results
@@ -341,24 +483,115 @@ class Puppet::Provider::DscBaseProvider # rubocop:disable Metrics/ClassLength
     data
   end
 
-  # Determine if the DSC Resource is in the desired state, invoking the `Test` method unless it's
-  #   already been run for the resource, in which case reuse the result instead of checking for each
-  #   property. This behavior is only triggered if the validation_mode is set to resource; by default
-  #   it is set to property and uses the default property comparison logic in Puppet::Property.
+  # Compare two values with type coercion. Handles the mismatches common in DSC:
+  # integers vs strings, case differences, array ordering, and nested CIM instances.
+  # Uses the same recursively_sort/recursively_downcase helpers the provider already
+  # relies on for canonicalize and log_change_detail comparisons.
+  #
+  # @param is_value [Object] the current value from a fresh DSC Get
+  # @param should_value [Object] the desired value from the Puppet manifest
+  # @return [Boolean] true if the values are equivalent
+  def values_equal?(is_value, should_value)
+    return true if is_value == should_value
+
+    # Handle nil/empty equivalence
+    is_empty = is_value.nil? || (is_value.respond_to?(:empty?) && is_value.empty?)
+    should_empty = should_value.nil? || (should_value.respond_to?(:empty?) && should_value.empty?)
+    return true if is_empty && should_empty
+
+    # Normalize and compare: sort for order-insensitive array/hash comparison,
+    # downcase for case-insensitive string comparison, handles nested structures.
+    same?(recursively_downcase(is_value), recursively_downcase(should_value))
+  end
+
+  # Determine if the DSC Resource is in the desired state, using fresh DSC Get
+  # results to provide accurate property comparison and real change messages.
+  #
+  # For validation_mode: resource, delegates entirely to DSC Test (unchanged).
+  #
+  # For validation_mode: property (default), performs a fresh DSC Get (one per
+  # resource, cached) that bypasses the get()/canonicalize pipeline, then compares
+  # each dsc_ property against the desired value. Returns:
+  # - true if the property matches (suppresses false positive events)
+  # - [false, "'current' -> 'desired'"] if the property genuinely differs
+  #   (the RSAPI uses the change_message as the Event text in PE)
+  # - nil to fall through to default RSAPI comparison (non-dsc_ properties,
+  #   or if the fresh Get failed)
   #
   # @param context [Object] the Puppet runtime context to operate in and send feedback to
   # @param name [String] the name of the resource being tested
-  # @param is_hash [Hash] the current state of the resource on the system
+  # @param property_name [Symbol] the name of the property being compared
+  # @param _is_hash [Hash] the current state of the resource on the system (unused, required by RSAPI signature)
   # @param should_hash [Hash] the desired state of the resource per the manifest
-  # @return [Boolean, Void] returns true/false if the resource is/isn't in the desired state and
-  #   the validation mode is set to resource, otherwise nil.
-  def insync?(context, name, _property_name, _is_hash, should_hash)
-    return nil if should_hash[:validation_mode] != 'resource'
+  # @return [Boolean, Array, Void] returns true/false/[false, message] if the resource
+  #   is/isn't in the desired state, or nil to fall through to default property comparison.
+  def insync?(context, name, property_name, _is_hash, should_hash)
+    # Detect corrective change check: after insync? returns [false, msg], Puppet calls
+    # insync? again for the same property. Return nil so default comparison handles it.
+    cache_key = name.is_a?(Hash) ? name[:name] : name
+    property_key = "#{cache_key}_#{property_name}"
+    return nil if @insync_property_cache.delete(property_key)
+
+    if should_hash[:validation_mode] == 'resource'
+      insync_resource_mode(context, name, property_name, should_hash)
+    else
+      insync_property_mode(context, name, property_name, should_hash)
+    end
+  end
 
+  private
+
+  # Resource validation mode: DSC Test is the authority on overall sync state.
+  def insync_resource_mode(context, name, property_name, should_hash)
+    should_value = should_hash.is_a?(Hash) ? should_hash[property_name] : nil
     prior_result = fetch_cached_hashes(@cached_test_results, [name])
-    prior_result.empty? ? invoke_test_method(context, name, should_hash) : prior_result.first[:in_desired_state]
+    test_result = prior_result.empty? ? invoke_test_method(context, name, should_hash) : prior_result.first[:in_desired_state]
+    in_sync = test_result.is_a?(Array) ? test_result.first : test_result
+
+    return true if in_sync
+
+    # DSC Test says out of sync. Suppress non-dsc_ and nil/empty properties.
+    return true unless property_name.to_s.start_with?('dsc_')
+    return true if should_value.nil? || (should_value.respond_to?(:empty?) && should_value.empty?)
+
+    # Fresh Get comparison for dsc_ properties with values
+    compare_fresh_value(context, name, property_name, should_hash, report_on_failure: true)
+  end
+
+  # Property validation mode: only intervene for dsc_ properties with a desired value.
+  def insync_property_mode(context, name, property_name, should_hash)
+    return nil unless property_name.to_s.start_with?('dsc_')
+
+    should_value = should_hash.is_a?(Hash) ? should_hash[property_name] : nil
+    return nil if should_value.nil? || (should_value.respond_to?(:empty?) && should_value.empty?)
+
+    compare_fresh_value(context, name, property_name, should_hash, report_on_failure: false)
   end
 
+  # Shared fresh Get comparison for both validation modes.
+  def compare_fresh_value(context, name, property_name, should_hash, report_on_failure:)
+    should_value = should_hash.is_a?(Hash) ? should_hash[property_name] : nil
+    property_key = "#{name.is_a?(Hash) ? name[:name] : name}_#{property_name}"
+    fresh_state = get_cached_fresh_state(context, name, should_hash)
+
+    if fresh_state.nil?
+      if report_on_failure
+        @insync_property_cache[property_key] = true
+        return [false, "#{property_name} changed '' to '#{should_value}'"]
+      end
+
+      return nil
+    end
+
+    fresh_value = fresh_state[property_name]
+    return true if values_equal?(fresh_value, should_value)
+
+    @insync_property_cache[property_key] = true
+    [false, "#{property_name} changed '#{fresh_value}' to '#{should_value}'"]
+  end
+
+  public
+
   # Invokes the `Get` method, passing the name_hash as the properties to use with `Invoke-DscResource`
   # The PowerShell script returns a JSON representation of the DSC Resource's CIM Instance munged as
   # best it can be for Ruby. Once that JSON is parsed into a hash this method further munges it to
@@ -368,7 +601,7 @@ class Puppet::Provider::DscBaseProvider # rubocop:disable Metrics/ClassLength
   # @param context [Object] the Puppet runtime context to operate in and send feedback to
   # @param name_hash [Hash] the hash of namevars to be passed as properties to `Invoke-DscResource`
   # @return [Hash] returns a hash representing the DSC resource munged to the representation the Puppet Type expects
-  def invoke_get_method(context, name_hash) # rubocop:disable Metrics/AbcSize
+  def invoke_get_method(context, name_hash)
     context.debug("retrieving #{name_hash.inspect}")
 
     query_props = name_hash.select { |k, v| mandatory_get_attributes(context).include?(k) || (k == :dsc_psdscrunascredential && !v.nil?) }
@@ -387,29 +620,10 @@ class Puppet::Provider::DscBaseProvider # rubocop:disable Metrics/ClassLength
     data.keys.each do |key|
       type_key = :"dsc_#{key.downcase}"
       data[type_key] = data.delete(key)
-
-      # Special handling for CIM Instances
-      if data[type_key].is_a?(Enumerable)
-        downcase_hash_keys!(data[type_key])
-        munge_cim_instances!(data[type_key])
-      end
-
-      # Convert DateTime back to appropriate type
-      if context.type.attributes[type_key][:mof_type] =~ /DateTime/i && !data[type_key].nil?
-        data[type_key] = begin
-          Puppet::Pops::Time::Timestamp.parse(data[type_key]) if context.type.attributes[type_key][:mof_type] =~ /DateTime/i && !data[type_key].nil?
-        rescue ArgumentError, TypeError => e
-          # Catch any failures in the parse, output them to the context and then return nil
-          context.err("Value returned for DateTime (#{data[type_key].inspect}) failed to parse: #{e}")
-          nil
-        end
-      end
-      # PowerShell does not distinguish between a return of empty array/string
-      #  and null but Puppet does; revert to those values if specified.
-      data[type_key] = [] if data[type_key].nil? && query_props.key?(type_key) && query_props[type_key].is_a?(Array)
+      canonicalize_get_value!(context, data, type_key, query_props)
     end
-    # If a resource is found, it's present, so refill this Puppet-only key
-    data[:name] = name_hash[:name]
+    sanitize_dotnet_artifacts!(context, data)
+    preserve_namevar_values!(context, data, name_hash)
 
     data = stringify_nil_attributes(context, data)
 
@@ -431,6 +645,78 @@ class Puppet::Provider::DscBaseProvider # rubocop:disable Metrics/ClassLength
     data
   end
 
+  # Invokes the `Get` method for canonicalize only, using a separate cache from get().
+  # This prevents canonicalize from polluting @cached_query_results, which get() relies on
+  # to return the "is" state for the Resource API's property-by-property comparison.
+  #
+  # @param context [Object] the Puppet runtime context to operate in and send feedback to
+  # @param name_hash [Hash] the hash of namevars to be passed as properties to `Invoke-DscResource`
+  # @return [Hash] returns a hash representing the DSC resource munged to the representation the Puppet Type expects
+  def invoke_get_method_for_canonicalize(context, name_hash)
+    # Check the canonicalize-specific cache first
+    cached = fetch_cached_hashes(@cached_canonicalize_results, [name_hash.select { |k, _v| namevar_attributes(context).include?(k) }])
+    return cached.first unless cached.empty?
+
+    # Call invoke_get_method which will do the actual DSC Get call.
+    # It will also cache to @cached_query_results as a side effect — remove that entry
+    # so get() is forced to do its own fresh lookup later.
+    result = invoke_get_method(context, name_hash)
+
+    # Remove the entry that invoke_get_method just added to @cached_query_results
+    # so that get() will do its own fresh DSC Get call and produce independent "is" data.
+    @cached_query_results.select! do |item|
+      matching = fetch_cached_hashes([item], [name_hash.select { |k, _v| namevar_attributes(context).include?(k) }])
+      matching.empty?
+    end
+
+    # Cache in our own separate cache
+    @cached_canonicalize_results << result.dup if result && fetch_cached_hashes(@cached_canonicalize_results, [result]).empty?
+
+    result
+  end
+
+  # Canonicalize a single value returned by DSC Get: handle CIM instances, DateTime, and empty arrays.
+  def canonicalize_get_value!(context, data, type_key, query_props)
+    # Special handling for CIM Instances
+    if data[type_key].is_a?(Enumerable)
+      downcase_hash_keys!(data[type_key])
+      munge_cim_instances!(data[type_key])
+    end
+
+    # Convert DateTime back to appropriate type
+    if context.type.attributes[type_key][:mof_type] =~ /DateTime/i && !data[type_key].nil?
+      data[type_key] = begin
+        Puppet::Pops::Time::Timestamp.parse(data[type_key])
+      rescue ArgumentError, TypeError => e
+        context.err("Value returned for DateTime (#{data[type_key].inspect}) failed to parse: #{e}")
+        nil
+      end
+    end
+    # PowerShell does not distinguish between a return of empty array/string
+    #  and null but Puppet does; revert to those values if specified.
+    data[type_key] = [] if data[type_key].nil? && query_props.key?(type_key) && query_props[type_key].is_a?(Array)
+  end
+
+  # Sanitize .NET serialization artifacts (e.g., "System.Object[]") to nil.
+  def sanitize_dotnet_artifacts!(context, data)
+    data.each do |key, value|
+      next unless value.is_a?(String) && value =~ /^System\.\w+\[\]$/
+
+      context.debug("Sanitizing .NET serialization artifact for #{key}: #{value} -> nil")
+      data[key] = nil
+    end
+  end
+
+  # Preserve namevar values from the input hash when DSC returns nil/empty.
+  def preserve_namevar_values!(context, data, name_hash)
+    data[:name] = name_hash[:name]
+    namevar_attributes(context).each do |namevar|
+      next unless name_hash.key?(namevar)
+
+      data[namevar] = name_hash[namevar] if data[namevar].nil? || (data[namevar].respond_to?(:empty?) && data[namevar].empty?)
+    end
+  end
+
   # Invokes the `Set` method, passing the should hash as the properties to use with `Invoke-DscResource`
   # The PowerShell script returns a JSON hash with key-value pairs indicating whether or not the resource
   # is in the desired state, whether or not it requires a reboot, and any error messages captured.

data/lib/pwsh/version.rb

@@ -2,5 +2,5 @@
 
 module Pwsh
   # The version of the ruby-pwsh gem
-  VERSION = '2.0.0'
+  VERSION = '2.0.1'
 end

data/spec/acceptance/dsc/class.rb

@@ -47,7 +47,7 @@ RSpec.describe 'DSC Acceptance: Class-Based Resource' do
       first_run_result = powershell.execute(command)
       expect(first_run_result[:exitcode]).to be(2)
       expect(first_run_result[:native_stdout]).to match(//)
-      expect(first_run_result[:native_stdout]).to match(/dsc_description changed  to 'Example role capability file'/)
+      expect(first_run_result[:native_stdout]).to match(/dsc_description changed.*to 'Example role capability file'/)
       expect(first_run_result[:native_stdout]).to match(/Creating: Finished/)
       expect(first_run_result[:native_stdout]).to match(/Applied catalog/)
       second_run_result = powershell.execute(command)

data/spec/acceptance/dsc/complex.rb

@@ -123,11 +123,11 @@ RSpec.describe 'DSC Acceptance: Complex' do
       # Web content index created
       expect(first_run_result[:native_stdout]).to match(%r{File\[WebContentIndex\]/ensure: defined content as '.+'})
       # Web site created
-      expect(first_run_result[:native_stdout]).to match(%r{Dsc_xwebsite\[NewWebsite\]/dsc_siteid: dsc_siteid changed  to 7})
+      expect(first_run_result[:native_stdout]).to match(%r{Dsc_xwebsite\[NewWebsite\]/dsc_siteid: dsc_siteid changed.*to 7})
       expect(first_run_result[:native_stdout]).to match(%r{Dsc_xwebsite\[NewWebsite\]/dsc_ensure: dsc_ensure changed 'Absent' to 'Present'})
-      expect(first_run_result[:native_stdout]).to match(%r{Dsc_xwebsite\[NewWebsite\]/dsc_physicalpath: dsc_physicalpath changed  to '.+fixtures/website'})
-      expect(first_run_result[:native_stdout]).to match(%r{Dsc_xwebsite\[NewWebsite\]/dsc_state: dsc_state changed  to 'Started'})
-      expect(first_run_result[:native_stdout]).to match(%r{Dsc_xwebsite\[NewWebsite\]/dsc_serverautostart: dsc_serverautostart changed  to 'true'})
+      expect(first_run_result[:native_stdout]).to match(%r{Dsc_xwebsite\[NewWebsite\]/dsc_physicalpath: dsc_physicalpath changed.*to '.+fixtures/website'})
+      expect(first_run_result[:native_stdout]).to match(%r{Dsc_xwebsite\[NewWebsite\]/dsc_state: dsc_state changed.*to 'Started'})
+      expect(first_run_result[:native_stdout]).to match(%r{Dsc_xwebsite\[NewWebsite\]/dsc_serverautostart: dsc_serverautostart changed.*to 'true'})
       expect(first_run_result[:native_stdout]).to match(/dsc_xwebsite\[{:name=>"NewWebsite", :dsc_name=>"Puppet DSC Site"}\]: Creating: Finished/)
       # Run finished
       expect(first_run_result[:native_stdout]).to match(/Applied catalog/)

data/spec/unit/puppet/provider/dsc_base_provider/dsc_base_provider_spec.rb

@@ -20,6 +20,9 @@ RSpec.describe Puppet::Provider::DscBaseProvider do
     provider.instance_variable_set(:@cached_query_results, [])
     provider.instance_variable_set(:@cached_test_results, [])
     provider.instance_variable_set(:@logon_failures, [])
+    provider.instance_variable_set(:@cached_canonicalize_results, [])
+    provider.instance_variable_set(:@cached_fresh_get_results, {})
+    provider.instance_variable_set(:@insync_property_cache, {})
   end
 
   describe '.initialize' do
@@ -43,6 +46,18 @@ RSpec.describe Puppet::Provider::DscBaseProvider do
     it 'initializes the logon_failures instance variable' do
       expect(provider.instance_variable_get(:@logon_failures)).to eq([])
     end
+
+    it 'initializes the cached_canonicalize_results instance variable' do
+      expect(provider.instance_variable_get(:@cached_canonicalize_results)).to eq([])
+    end
+
+    it 'initializes the cached_fresh_get_results instance variable' do
+      expect(provider.instance_variable_get(:@cached_fresh_get_results)).to eq({})
+    end
+
+    it 'initializes the insync_property_cache instance variable' do
+      expect(provider.instance_variable_get(:@insync_property_cache)).to eq({})
+    end
   end
 
   describe '.cached_test_results' do
@@ -391,36 +406,259 @@ RSpec.describe Puppet::Provider::DscBaseProvider do
   end
 
   describe '.insync?' do
-    let(:name)               { { name: 'foo' } }
-    let(:attribute_name)     { :foo }
-    let(:is_hash)            { { name: 'foo', foo: 1 } }
-    let(:cached_test_result) { [{ name: 'foo', in_desired_state: true }] }
-    let(:should_hash_validate_by_property) { { name: 'foo', foo: 1, validation_mode: 'property' } }
-    let(:should_hash_validate_by_resource) { { name: 'foo', foo: 1, validation_mode: 'resource' } }
+    let(:name)           { { name: 'foo' } }
+    let(:property_name)  { :dsc_setting }
+    let(:is_hash)        { { name: 'foo', dsc_setting: 'Bar' } }
+    let(:should_hash)    { { name: 'foo', dsc_setting: 'Foo', validation_mode: 'property' } }
+    let(:fresh_state)    { { name: 'foo', dsc_setting: 'Bar' } }
+
+    before do
+      allow(context).to receive(:debug)
+    end
+
+    context 'when the corrective check is detected' do
+      it 'returns nil and deletes the cache entry on second call for the same property' do
+        provider.instance_variable_set(:@insync_property_cache, { 'foo_dsc_setting' => true })
+        result = provider.send(:insync?, context, name, property_name, is_hash, should_hash)
+        expect(result).to be_nil
+        expect(provider.instance_variable_get(:@insync_property_cache)).not_to have_key('foo_dsc_setting')
+      end
+    end
 
     context 'when the validation_mode is "resource"' do
-      it 'calls invoke_test_method if the result of a test is not already cached' do
-        expect(provider).to receive(:fetch_cached_hashes).and_return([])
-        expect(provider).to receive(:invoke_test_method).and_return(true)
-        expect(provider.send(:insync?, context, name, attribute_name, is_hash, should_hash_validate_by_resource)).to be true
+      let(:should_hash) { { name: 'foo', dsc_setting: 'Foo', validation_mode: 'resource' } }
+
+      context 'when DSC Test says in sync' do
+        it 'returns true for any property' do
+          allow(provider).to receive(:fetch_cached_hashes).and_return([])
+          allow(provider).to receive(:invoke_test_method).and_return(true)
+          expect(provider.send(:insync?, context, name, property_name, is_hash, should_hash)).to be true
+        end
+
+        it 'caches the Test result and reuses on subsequent calls' do
+          cached_test_result = [{ name: 'foo', in_desired_state: true }]
+          allow(provider).to receive(:fetch_cached_hashes).and_return(cached_test_result)
+          expect(provider).not_to receive(:invoke_test_method)
+          expect(provider.send(:insync?, context, name, property_name, is_hash, should_hash)).to be true
+        end
       end
 
-      it 'does not call invoke_test_method if the result of a test is already cached' do
-        expect(provider).to receive(:fetch_cached_hashes).and_return(cached_test_result)
-        expect(provider).not_to receive(:invoke_test_method)
-        expect(provider.send(:insync?, context, name, attribute_name, is_hash, should_hash_validate_by_resource)).to be true
+      context 'when DSC Test says out of sync' do
+        before do
+          allow(provider).to receive(:fetch_cached_hashes).and_return([])
+          allow(provider).to receive(:invoke_test_method).and_return([false, 'not in desired state'])
+        end
+
+        it 'returns fresh Get comparison result for dsc_ properties' do
+          allow(provider).to receive(:get_cached_fresh_state).and_return(fresh_state)
+          result = provider.send(:insync?, context, name, property_name, is_hash, should_hash)
+          # fresh_state has 'Bar', should_hash has 'Foo' — values differ
+          expect(result).to be_an(Array)
+          expect(result.first).to be false
+          expect(result.last).to match(/dsc_setting changed/)
+        end
+
+        it 'returns true for non-dsc_ properties (suppressed)' do
+          result = provider.send(:insync?, context, name, :name, is_hash, should_hash)
+          expect(result).to be true
+        end
+
+        it 'returns true when should_value is nil (suppressed)' do
+          should_hash_nil = should_hash.merge(dsc_setting: nil)
+          result = provider.send(:insync?, context, name, :dsc_setting, is_hash, should_hash_nil)
+          expect(result).to be true
+        end
       end
     end
 
     context 'when the validation_mode is "property"' do
-      it 'does not call invoke_test_method and returns nil' do
-        expect(provider).not_to receive(:fetch_cached_hashes)
-        expect(provider).not_to receive(:invoke_test_method)
-        expect(provider.send(:insync?, context, name, attribute_name, is_hash, should_hash_validate_by_property)).to be_nil
+      context 'when property_name does not start with dsc_' do
+        it 'returns nil for :name' do
+          result = provider.send(:insync?, context, name, :name, is_hash, should_hash)
+          expect(result).to be_nil
+        end
+
+        it 'returns nil for :ensure' do
+          result = provider.send(:insync?, context, name, :ensure, is_hash, should_hash)
+          expect(result).to be_nil
+        end
+      end
+
+      context 'when should_value is nil' do
+        it 'returns nil' do
+          should_hash_nil = should_hash.merge(dsc_setting: nil)
+          result = provider.send(:insync?, context, name, :dsc_setting, is_hash, should_hash_nil)
+          expect(result).to be_nil
+        end
+      end
+
+      context 'when should_value is empty string' do
+        it 'returns nil' do
+          should_hash_empty = should_hash.merge(dsc_setting: '')
+          result = provider.send(:insync?, context, name, :dsc_setting, is_hash, should_hash_empty)
+          expect(result).to be_nil
+        end
+      end
+
+      context 'when fresh Get returns nil' do
+        it 'returns nil' do
+          allow(provider).to receive(:get_cached_fresh_state).and_return(nil)
+          result = provider.send(:insync?, context, name, :dsc_setting, is_hash, should_hash)
+          expect(result).to be_nil
+        end
+      end
+
+      context 'when fresh Get returns nil in resource mode' do
+        let(:should_hash_resource) { { name: 'foo', dsc_setting: 'Foo', validation_mode: 'resource' } }
+
+        it 'returns [false, msg] and sets insync_property_cache' do
+          allow(provider).to receive(:fetch_cached_hashes).and_return([])
+          allow(provider).to receive(:invoke_test_method).and_return([false, 'not in desired state'])
+          allow(provider).to receive(:get_cached_fresh_state).and_return(nil)
+          result = provider.send(:insync?, context, name, :dsc_setting, is_hash, should_hash_resource)
+          expect(result).to be_an(Array)
+          expect(result.first).to be false
+          expect(provider.instance_variable_get(:@insync_property_cache)).to have_key('foo_dsc_setting')
+        end
+      end
+
+      context 'when values match' do
+        it 'returns true' do
+          matching_fresh = { name: 'foo', dsc_setting: 'Foo' }
+          allow(provider).to receive(:get_cached_fresh_state).and_return(matching_fresh)
+          result = provider.send(:insync?, context, name, :dsc_setting, is_hash, should_hash)
+          expect(result).to be true
+        end
+      end
+
+      context 'when values differ' do
+        it 'returns [false, change_message] and sets insync_property_cache' do
+          differing_fresh = { name: 'foo', dsc_setting: 'Bar' }
+          allow(provider).to receive(:get_cached_fresh_state).and_return(differing_fresh)
+          result = provider.send(:insync?, context, name, :dsc_setting, is_hash, should_hash)
+          expect(result).to be_an(Array)
+          expect(result.first).to be false
+          expect(result.last).to eq("dsc_setting changed 'Bar' to 'Foo'")
+          expect(provider.instance_variable_get(:@insync_property_cache)).to have_key('foo_dsc_setting')
+        end
       end
     end
   end
 
+  describe '.values_equal?' do
+    it 'returns true for identical values' do
+      expect(provider.values_equal?('foo', 'foo')).to be true
+    end
+
+    it 'returns true for nil/nil' do
+      expect(provider.values_equal?(nil, nil)).to be true
+    end
+
+    it 'returns true for nil and empty string' do
+      expect(provider.values_equal?(nil, '')).to be true
+      expect(provider.values_equal?('', nil)).to be true
+    end
+
+    it 'returns true for case-insensitive string match' do
+      expect(provider.values_equal?('Foo', 'foo')).to be true
+    end
+
+    it 'returns false for integer vs string mismatch' do
+      expect(provider.values_equal?(30, '30')).to be false
+    end
+
+    it 'returns true for arrays in different order' do
+      expect(provider.values_equal?(%w[a b c], %w[c b a])).to be true
+    end
+
+    it 'returns true for hashes with case-different keys/values' do
+      expect(provider.values_equal?({ 'Foo' => 'Bar' }, { 'foo' => 'bar' })).to be true
+    end
+
+    it 'returns false for genuinely different values' do
+      expect(provider.values_equal?('foo', 'bar')).to be false
+    end
+
+    it 'returns false for different numbers' do
+      expect(provider.values_equal?(30, 42)).to be false
+    end
+  end
+
+  describe '.perform_fresh_get' do
+    let(:name) { { name: 'foo', dsc_name: 'foo' } }
+    let(:should_hash) { { name: 'foo', dsc_name: 'foo', dsc_setting: 'desired' } }
+    let(:attributes) { { name: { type: 'String' }, dsc_name: { type: 'String', mandatory_for_get: true }, dsc_setting: { type: 'String' } } }
+
+    before do
+      allow(context).to receive(:debug)
+      allow(context).to receive(:type).and_return(type)
+      allow(type).to receive(:attributes).and_return(attributes)
+      allow(provider).to receive(:mandatory_get_attributes).and_return([:dsc_name])
+    end
+
+    context 'when invoke_dsc_resource returns data' do
+      it 'returns a hash with dsc_ prefixed keys and :name' do
+        allow(provider).to receive(:invoke_dsc_resource).and_return({ 'Name' => 'foo', 'Setting' => 'current' })
+        result = provider.perform_fresh_get(context, name, should_hash)
+        expect(result[:dsc_setting]).to eq('current')
+        expect(result[:name]).to eq('foo')
+      end
+
+      it 'sanitizes System.Object[] artifacts to nil' do
+        allow(provider).to receive(:invoke_dsc_resource).and_return({ 'Name' => 'foo', 'Setting' => 'System.Object[]' })
+        result = provider.perform_fresh_get(context, name, should_hash)
+        expect(result[:dsc_setting]).to be_nil
+      end
+
+      it 'normalizes CIM instance hash keys and munges cim_instance_type' do
+        allow(provider).to receive(:invoke_dsc_resource).and_return({ 'Name' => 'foo', 'Setting' => { 'SomeKey' => 'val' } })
+        result = provider.perform_fresh_get(context, name, should_hash)
+        expect(result[:dsc_setting].keys.first).to eq('somekey')
+      end
+    end
+
+    context 'when invoke_dsc_resource returns nil' do
+      it 'returns nil' do
+        allow(provider).to receive(:invoke_dsc_resource).and_return(nil)
+        expect(provider.perform_fresh_get(context, name, should_hash)).to be_nil
+      end
+    end
+
+    context 'when invoke_dsc_resource raises an error' do
+      it 'returns nil and logs a debug message' do
+        allow(provider).to receive(:invoke_dsc_resource).and_raise(StandardError, 'boom')
+        expect(context).to receive(:debug).with(/perform_fresh_get failed/)
+        expect(provider.perform_fresh_get(context, name, should_hash)).to be_nil
+      end
+    end
+  end
+
+  describe '.get_cached_fresh_state' do
+    let(:name) { { name: 'foo' } }
+    let(:should_hash) { { name: 'foo', dsc_setting: 'desired' } }
+    let(:fresh_result) { { name: 'foo', dsc_setting: 'current' } }
+
+    before do
+      allow(context).to receive(:debug)
+    end
+
+    it 'calls perform_fresh_get on first call and caches the result' do
+      expect(provider).to receive(:perform_fresh_get).once.and_return(fresh_result)
+      result1 = provider.get_cached_fresh_state(context, name, should_hash)
+      result2 = provider.get_cached_fresh_state(context, name, should_hash)
+      expect(result1).to eq(fresh_result)
+      expect(result2).to eq(fresh_result)
+    end
+
+    it 'caches nil results to avoid repeated failed calls' do
+      expect(provider).to receive(:perform_fresh_get).once.and_return(nil)
+      result1 = provider.get_cached_fresh_state(context, name, should_hash)
+      result2 = provider.get_cached_fresh_state(context, name, should_hash)
+      expect(result1).to be_nil
+      expect(result2).to be_nil
+    end
+  end
+
   describe '.invoke_get_method' do
     subject(:result) { provider.invoke_get_method(context, name_hash) }
 
@@ -656,6 +894,47 @@ RSpec.describe Puppet::Provider::DscBaseProvider do
       end
     end
 
+    context 'when DSC returns System.Object[] string values' do
+      let(:parsed_invocation_data) do
+        {
+          'Name' => 'foo',
+          'Ensure' => 'System.Object[]',
+          'Time' => nil
+        }
+      end
+
+      before do
+        allow(ps_manager).to receive(:execute).with(script, nil).and_return({ stdout: 'DSC Data' })
+        allow(JSON).to receive(:parse).with('DSC Data').and_return(parsed_invocation_data)
+        allow(provider).to receive(:fetch_cached_hashes).and_return([])
+      end
+
+      it 'sanitizes System.Object[] to nil' do
+        expect(result[:dsc_ensure]).to be_nil
+      end
+    end
+
+    context 'when DSC returns nil for a namevar' do
+      let(:parsed_invocation_data) do
+        {
+          'Name' => nil,
+          'Ensure' => 'Present'
+        }
+      end
+
+      before do
+        allow(ps_manager).to receive(:execute).with(script, nil).and_return({ stdout: 'DSC Data' })
+        allow(JSON).to receive(:parse).with('DSC Data').and_return(parsed_invocation_data)
+        allow(provider).to receive(:fetch_cached_hashes).and_return([])
+        allow(provider).to receive(:namevar_attributes).and_return(%i[name dsc_name])
+      end
+
+      it 'preserves the namevar value from the input name_hash' do
+        expect(result[:dsc_name]).to eq('foo')
+        expect(result[:name]).to eq('foo')
+      end
+    end
+
     context 'when the DSC invocation errors' do
       it 'writes an error and returns nil' do
         expect(provider).not_to receive(:logon_failed_already?)
@@ -864,6 +1143,44 @@ RSpec.describe Puppet::Provider::DscBaseProvider do
     end
   end
 
+  describe '.invoke_get_method_for_canonicalize' do
+    before do
+      allow(context).to receive(:debug)
+      allow(provider).to receive(:namevar_attributes).and_return(%i[name dsc_name])
+    end
+
+    it 'calls invoke_get_method and caches to @cached_canonicalize_results' do
+      result = { name: 'foo', dsc_name: 'foo', dsc_setting: 'bar' }
+      allow(provider).to receive(:invoke_get_method).and_return(result)
+      allow(provider).to receive(:fetch_cached_hashes).and_return([])
+
+      provider.invoke_get_method_for_canonicalize(context, { name: 'foo', dsc_name: 'foo' })
+      expect(provider.instance_variable_get(:@cached_canonicalize_results)).to include(result)
+    end
+
+    it 'removes entries from @cached_query_results so get() does its own lookup' do
+      result = { name: 'foo', dsc_name: 'foo', dsc_setting: 'bar' }
+      cached_entry = result.dup
+      allow(provider).to receive(:invoke_get_method).and_return(result)
+      # First call checks @cached_canonicalize_results — return [] (cache miss)
+      # Subsequent calls within reject! should return a match so the entry gets removed
+      allow(provider).to receive(:fetch_cached_hashes).and_return([], [cached_entry], [])
+      provider.instance_variable_set(:@cached_query_results, [cached_entry])
+
+      provider.invoke_get_method_for_canonicalize(context, { name: 'foo', dsc_name: 'foo' })
+      expect(provider.instance_variable_get(:@cached_query_results)).to be_empty
+    end
+
+    it 'returns cached result on subsequent calls' do
+      result = { name: 'foo', dsc_name: 'foo', dsc_setting: 'bar' }
+      provider.instance_variable_set(:@cached_canonicalize_results, [result])
+      allow(provider).to receive(:fetch_cached_hashes).with([result], anything).and_return([result])
+
+      expect(provider).not_to receive(:invoke_get_method)
+      expect(provider.invoke_get_method_for_canonicalize(context, { name: 'foo', dsc_name: 'foo' })).to eq(result)
+    end
+  end
+
   describe '.puppetize_name' do
     it 'downcases the input string' do
       expect(provider.puppetize_name('FooBar')).to eq('foobar')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ruby-pwsh
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.0.1
 platform: ruby
 authors:
 - Puppet, Inc.
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-05-06 00:00:00.000000000 Z
+date: 2026-02-16 00:00:00.000000000 Z
 dependencies: []
 description: PowerShell code manager for ruby.
 email:
@@ -67,7 +67,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.27
+rubygems_version: 3.4.19
 signing_key:
 specification_version: 4
 summary: PowerShell code manager for ruby.