@bruc3van/dsh-doctor 0.1.5 → 0.5.0

package/migrations/dsh-v0.1.1-rc.2__dsh-v0.1.2-alpha.2/packages.json

@@ -0,0 +1,62 @@
+{
+  "removed": [
+    "@deepseek-ai/dsh-acp-demo",
+    "@deepseek-ai/dsh-acp-snapshot",
+    "@deepseek-ai/dsh-client-runtime",
+    "@deepseek-ai/dsh-host-apiproxy",
+    "@deepseek-ai/dsh-sdk-jsonrpc-demo"
+  ],
+  "added": [
+    "@deepseek-ai/dsh-acp-app",
+    "@deepseek-ai/dsh-api-session-controller",
+    "@deepseek-ai/dsh-api-settings-controller",
+    "@deepseek-ai/dsh-api-workspace-controller",
+    "@deepseek-ai/dsh-client-store",
+    "@deepseek-ai/dsh-client-ui-approval",
+    "@deepseek-ai/dsh-client-ui-chat",
+    "@deepseek-ai/dsh-client-ui-schedule",
+    "@deepseek-ai/dsh-client-ui-session",
+    "@deepseek-ai/dsh-deepseek-llm-api-extensions",
+    "@deepseek-ai/dsh-deque",
+    "@deepseek-ai/dsh-experimental-agent-team-profile",
+    "@deepseek-ai/dsh-experimental-agent-team-web-profile",
+    "@deepseek-ai/dsh-experimental-client-ui-agent-team",
+    "@deepseek-ai/dsh-experimental-inspector",
+    "@deepseek-ai/dsh-experimental-webworker-packer",
+    "@deepseek-ai/dsh-experimental-webworker-runtime",
+    "@deepseek-ai/dsh-plugin-package-inventory-deepseek",
+    "@deepseek-ai/dsh-sdk-app",
+    "@deepseek-ai/dsh-sdk-minimal",
+    "@deepseek-ai/dsh-session-log-deepseek",
+    "@deepseek-ai/dsh-session-snapshot",
+    "@deepseek-ai/dsh-util-crypto",
+    "@deepseek-ai/dsh-util-time",
+    "@deepseek-ai/dsh-util-values",
+    "@deepseek-ai/dsh-util-workspace-path",
+    "@deepseek-ai/dsh-webhook",
+    "@deepseek-ai/dsh-webhook-github",
+    "@deepseek-ai/dsh-win32-process"
+  ],
+  "targetVersions": {
+    "@deepseek-ai/cordis": "4.0.2",
+    "@deepseek-ai/dsh-client-store": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-session": "0.1.2-alpha.2"
+  },
+  "semanticReplacements": {
+    "@deepseek-ai/dsh-client-runtime": [
+      "@deepseek-ai/dsh-api-session-controller",
+      "@deepseek-ai/dsh-api-workspace-controller",
+      "@deepseek-ai/dsh-client-store",
+      "@deepseek-ai/dsh-client-ui-session",
+      "@deepseek-ai/dsh-client-ui-conversation",
+      "@deepseek-ai/dsh-client-ui-chat",
+      "@deepseek-ai/dsh-client-ui-trajectory",
+      "@deepseek-ai/dsh-client-ui-approval",
+      "@deepseek-ai/dsh-client-ui-user-questions"
+    ],
+    "@deepseek-ai/dsh-host-apiproxy": [
+      "@deepseek-ai/dsh-api-gateway",
+      "@deepseek-ai/dsh-api-remotes"
+    ]
+  }
+}

package/migrations/dsh-v0.1.1-rc.2__dsh-v0.1.2-alpha.2/services.json

@@ -0,0 +1,28 @@
+{
+  "services": {
+    "sessions": {
+      "owner": "@deepseek-ai/dsh-api-session-controller/client",
+      "confidence": "semantic",
+      "note": "The service name survives, but Session snapshots no longer contain Conversation views or pending interactions."
+    },
+    "workspaces": {
+      "owner": "@deepseek-ai/dsh-api-workspace-controller/client",
+      "confidence": "semantic",
+      "note": "The service name survives, while cross-domain navigation belongs to ui-workspace."
+    },
+    "conversation": {
+      "owner": "@deepseek-ai/dsh-client-ui-conversation/client",
+      "confidence": "semantic",
+      "note": "Conversation assembly and input are independent of Session lifecycle snapshots."
+    },
+    "slots": {
+      "owner": "@deepseek-ai/dsh-client-ui-renderer/client",
+      "confidence": "semantic",
+      "note": "Slot declarations stay in ui-slots; runtime registration and binding belong to ui-renderer."
+    }
+  },
+  "removedHostFacade": {
+    "package": "@deepseek-ai/dsh-host-apiproxy",
+    "replacementPolicy": "Use the natural business Remote owner through generated api-remotes contributions; there is no replacement facade."
+  }
+}

package/migrations/dsh-v0.1.1-rc.2__dsh-v0.1.2-alpha.2/symbols.json

@@ -0,0 +1,126 @@
+{
+  "modules": {
+    "@deepseek-ai/dsh-client-runtime/client": {
+      "ClientContext": {
+        "toModule": "@deepseek-ai/cordis",
+        "toSymbol": "Context",
+        "confidence": "exact",
+        "reason": "ClientContext was a type alias of Cordis Context."
+      },
+      "createSnapshotStore": {
+        "toModule": "@deepseek-ai/dsh-client-store",
+        "toSymbol": "createSnapshotStore",
+        "confidence": "exact",
+        "reason": "The React-free store engine moved to client-store."
+      },
+      "defineStore": {
+        "toModule": "@deepseek-ai/dsh-client-store",
+        "toSymbol": "defineStore",
+        "confidence": "exact",
+        "reason": "The declarative store factory moved to client-store."
+      },
+      "ObservableSnapshot": {
+        "toModule": "@deepseek-ai/dsh-client-store",
+        "toSymbol": "ObservableSnapshot",
+        "confidence": "exact",
+        "reason": "The observable store contract moved to client-store."
+      },
+      "SnapshotStore": {
+        "toModule": "@deepseek-ai/dsh-client-store",
+        "toSymbol": "SnapshotStore",
+        "confidence": "exact",
+        "reason": "The writable store contract moved to client-store."
+      },
+      "shallowEqual": {
+        "toModule": "@deepseek-ai/dsh-client-store",
+        "toSymbol": "shallowEqual",
+        "confidence": "exact",
+        "reason": "The store equality helper moved to client-store."
+      },
+      "SessionId": {
+        "toModule": "@deepseek-ai/dsh-session/types",
+        "toSymbol": "SessionId",
+        "confidence": "exact",
+        "reason": "Session identity is owned by the Session domain."
+      },
+      "ISessions": {
+        "toModule": "@deepseek-ai/dsh-api-session-controller/client",
+        "toSymbol": "ISessions",
+        "confidence": "semantic",
+        "reason": "Session ownership moved to the Session Controller and its snapshots changed."
+      },
+      "Session": {
+        "toModule": "@deepseek-ai/dsh-api-session-controller/client",
+        "toSymbol": "Session",
+        "confidence": "semantic",
+        "reason": "The Client Session object and lifecycle moved to the Session Controller."
+      },
+      "SessionBinding": {
+        "toModule": "@deepseek-ai/dsh-api-session-controller/client",
+        "toSymbol": "SessionBinding",
+        "confidence": "semantic",
+        "reason": "Session bindings are now Controller-owned lifetimes."
+      },
+      "SessionListState": {
+        "toModule": "@deepseek-ai/dsh-api-session-controller/client",
+        "toSymbol": "SessionListState",
+        "confidence": "semantic",
+        "reason": "The list state moved and no longer owns Conversation or pending-interaction facts."
+      },
+      "SessionSummary": {
+        "toModule": "@deepseek-ai/dsh-api-session-controller/client",
+        "toSymbol": "SessionSummary",
+        "confidence": "semantic",
+        "reason": "The Session summary is now a Controller-owned control snapshot."
+      },
+      "UseProjection": {
+        "toModule": "@deepseek-ai/dsh-api-session-controller/client",
+        "toSymbol": "UseProjection",
+        "confidence": "semantic",
+        "reason": "Projection sources are now exposed by Session Controller bindings and adapted by ui-session."
+      },
+      "IWorkspaces": {
+        "toModule": "@deepseek-ai/dsh-api-workspace-controller/client",
+        "toSymbol": "IWorkspaces",
+        "confidence": "semantic",
+        "reason": "Workspace ownership moved to the Workspace Controller and navigation policy moved to ui-workspace."
+      },
+      "WorkspaceId": {
+        "toModule": "@deepseek-ai/dsh-api-workspace-controller/client",
+        "toSymbol": "WorkspaceId",
+        "confidence": "semantic",
+        "reason": "Workspace identity is re-exported by the Workspace Controller."
+      },
+      "WorkspaceView": {
+        "toModule": "@deepseek-ai/dsh-api-workspace-controller/client",
+        "toSymbol": "WorkspaceView",
+        "confidence": "semantic",
+        "reason": "Workspace snapshots are Controller-owned and their shape changed."
+      },
+      "ConversationNode": {
+        "toModule": "@deepseek-ai/dsh-client-ui-conversation/client",
+        "toSymbol": "ConversationNode",
+        "confidence": "semantic",
+        "reason": "Conversation assembly moved out of Session snapshots into ui-conversation."
+      },
+      "ConversationSnapshot": {
+        "toModule": "@deepseek-ai/dsh-client-ui-conversation/client",
+        "toSymbol": "ConversationSnapshot",
+        "confidence": "semantic",
+        "reason": "Conversation is now an independent target-neutral source."
+      },
+      "PendingInteraction": {
+        "toModule": "@deepseek-ai/dsh-client-ui-session/client",
+        "toSymbol": "SessionPendingInteraction",
+        "confidence": "semantic",
+        "reason": "Approval and Question now publish domain-owned pending interactions through ui-session."
+      },
+      "PendingWait": {
+        "toModule": "@deepseek-ai/dsh-client-ui-session/client",
+        "toSymbol": "SessionPendingInteraction",
+        "confidence": "semantic",
+        "reason": "The Runtime PendingWait aggregate was removed; pending domains own their payloads."
+      }
+    }
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bruc3van/dsh-doctor",
-  "version": "0.1.5",
-  "description": "Diagnose DSH plugins broken by upgrades, startup blockers, and profile issues with explicit, confirmed repairs",
+  "version": "0.5.0",
+  "description": "Diagnose DSH upgrades, migrate plugins with safe codemods, and verify recovery decisions",
   "license": "MIT",
   "type": "module",
   "repository": {
@@ -17,19 +17,22 @@
   },
   "files": [
     "src",
+    "migrations",
+    "skills",
     "README.md",
     "README.en.md",
     "LICENSE"
   ],
   "scripts": {
     "test": "node --test",
-    "check": "node --check src/cli.mjs && node --check src/doctor.mjs && node --check src/i18n.mjs && node --check src/repair.mjs && npm test",
+    "check": "node --check src/cli.mjs && node --check src/doctor.mjs && node --check src/i18n.mjs && node --check src/repair.mjs && node --check src/migration-catalog.mjs && node --check src/migrate.mjs && node --check src/migrate-verify.mjs && npm test",
     "prepublishOnly": "npm run check"
   },
   "dependencies": {
     "cross-spawn": "^7.0.6",
     "js-yaml": "^4.2.0",
     "semver": "^7.7.2",
+    "typescript": "^6.0.3",
     "yaml": "^2.8.1"
   },
   "engines": {

package/skills/dsh-plugin-upgrade/SKILL.md

@@ -0,0 +1,98 @@
+---
+name: dsh-plugin-upgrade
+description: Upgrade a DeepSeek Harness plugin from dsh-v0.1.1-rc.2 to dsh-v0.1.2-alpha.2 with dsh-doctor. Use when a plugin developer asks to migrate, assess compatibility, replace removed dsh-client-runtime or dsh-host-apiproxy APIs, update DSH peer dependencies, rebuild artifacts, or verify a plugin against DSH 0.1.2. Produces an evidence-backed staged report and applies only catalog-confirmed exact rewrites automatically.
+---
+
+# DSH plugin upgrade
+
+Upgrade one plugin at a time. Treat source migration, artifact verification, runtime activation, and business behavior as separate gates.
+This skill is intentionally bound to the `dsh-v0.1.1-rc.2` to `dsh-v0.1.2-alpha.2` catalog; do not reuse its mappings for another version pair.
+
+## Inputs
+
+Determine:
+
+- the plugin repository root;
+- the DSH Harness checkout when available;
+- whether the developer authorizes writes and project command execution;
+- the plugin's package manager and build scripts.
+
+Use these fixed refs unless the user explicitly requests a supported alternative:
+
+- source: `dsh-v0.1.1-rc.2`
+- target: `dsh-v0.1.2-alpha.2`
+
+Read [migration-map.md](references/migration-map.md) before making semantic changes. Read [verification.md](references/verification.md) before build or runtime verification.
+
+Before touching the plugin, run `dsh-doctor migrations list` and confirm this exact version pair is present. If `dsh-doctor` is not on `PATH`, use `npx --package=@bruc3van/dsh-doctor dsh-doctor migrations list` and confirm the same catalog before continuing; never silently use an older CLI that lacks the migration.
+
+## Phase 1: analyze
+
+Run from any directory:
+
+```sh
+dsh-doctor migrate analyze <plugin-root> \
+  --from dsh-v0.1.1-rc.2 \
+  --to dsh-v0.1.2-alpha.2 \
+  --json
+```
+
+Append `--harness-root <deepseek-harness-root>` when the checkout is available. Prefer an exact Harness checkout so the CLI verifies both tag commits. Both tags must exist and resolve to the commits recorded by the catalog; fetch the repository tags first when a shallow checkout lacks them. Without `--harness-root`, analysis is catalog-only and must be reported as such.
+
+Group the result by:
+
+1. errors blocking compatibility;
+2. exact import moves eligible for safe codemods;
+3. semantic tasks requiring developer judgment;
+4. stale build artifacts;
+5. required verification gates.
+
+Do not infer compatibility from a clean bundled artifact alone. The analyzer intentionally scans TypeScript type imports, source files, package metadata, client graph declarations, and built output.
+
+## Phase 2: apply exact changes
+
+Preview first:
+
+```sh
+dsh-doctor migrate apply <plugin-root> --safe --harness-root <deepseek-harness-root> --json
+```
+
+Review affected files and hashes. Apply only with explicit authorization:
+
+```sh
+dsh-doctor migrate apply <plugin-root> --safe --yes --harness-root <deepseek-harness-root> --json
+```
+
+The CLI creates timestamped backups and refuses writes when a file changed after preview. It may split a mixed import: exact symbols move to their new owners while semantic symbols remain unresolved. It may pin non-removed DSH development dependencies and add dependencies required by exact symbol moves. It does not change the ranges of existing published peers automatically. Never mechanically replace the removed Client Runtime with one aggregate package; no such replacement exists.
+
+After apply, inspect every `MIG_SEMANTIC_API_CHANGE`. Rewrite behavior using the new domain owner and its current snapshot/lifecycle contract. Keep these edits separate enough to review and test.
+
+## Phase 3: verify
+
+Run the gates in order:
+
+```sh
+dsh-doctor migrate verify <plugin-root> --level static --harness-root <deepseek-harness-root> --json
+dsh-doctor migrate verify <plugin-root> --level build --yes --harness-root <deepseek-harness-root> --json
+dsh-doctor migrate verify <plugin-root> --level runtime --yes --harness-root <deepseek-harness-root> --json
+```
+
+Build and runtime levels execute plugin scripts and therefore require `--yes`. Runtime verification packs the real plugin, creates a temporary `DSH_HOME`, installs into a new web profile, dumps effective config, and performs an activation smoke. It does not modify the developer's normal `~/.dsh`.
+
+Resolve every semantic task and rebuild stale artifacts before expecting static verification to pass. An `apply` exit code of 1 after successful writes means migration blockers remain in the follow-up analysis; inspect `mode`, `writes`, and `report` instead of treating it as a write failure.
+
+On failure, preserve and report the temporary directory. On success, the CLI removes it unless `--keep-temp` is used.
+
+Runtime activation is not business-behavior proof. Finish with targeted manual or automated checks for visible UI, service lifecycle, event subscriptions, cleanup, configuration, and plugin-specific workflows.
+
+## Report the outcome
+
+State the highest achieved gate exactly:
+
+- `analyzed`
+- `source-migrated`
+- `artifact-verified`
+- `runtime-verified`
+- behavior verified separately with named evidence
+
+Do not call the plugin compatible while errors, semantic tasks, stale artifacts, or required behavior checks remain. Include backups and retained temporary directories in the handoff.

package/skills/dsh-plugin-upgrade/evals/evals.json

@@ -0,0 +1,36 @@
+{
+  "skill_name": "dsh-plugin-upgrade",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "检查这个只有后端 bundle 的 DSH 插件能否从 0.1.1-rc.2 升级到 0.1.2-alpha.2。它的 peerDependencies 仍是 ^0.1.1，不要改文件。",
+      "expected_output": "Runs read-only migrate analysis, identifies target range mismatch, and does not claim runtime compatibility.",
+      "expectations": [
+        "Uses migrate analyze before proposing edits",
+        "Reports the exact verification status as analyzed",
+        "Does not write files or execute build scripts"
+      ]
+    },
+    {
+      "id": 2,
+      "prompt": "把这个前端插件升级到 DSH 0.1.2。源码里有 import type { ClientContext, ISessions } from '@deepseek-ai/dsh-client-runtime/client'，可以安全改的帮我改，其他的列出来。",
+      "expected_output": "Safely moves ClientContext to Cordis while leaving ISessions as an explicit semantic migration task, with backup evidence.",
+      "expectations": [
+        "Detects type-only imports from source rather than relying on the bundle",
+        "Uses migrate apply --safe and requires explicit confirmation for writes",
+        "Does not mechanically rewrite the semantic ISessions contract"
+      ]
+    },
+    {
+      "id": 3,
+      "prompt": "完整升级这个混合前后端插件并验证，Harness 在 /workspace/deepseek-harness。构建失败也要把现场路径告诉我。",
+      "expected_output": "Performs analyze, safe apply, semantic work, build and isolated runtime gates; reports the highest proven status and retained failure workspace.",
+      "expectations": [
+        "Uses the exact Harness refs and verifies the catalog commits",
+        "Runs static, build, then runtime verification in order",
+        "Uses a temporary DSH_HOME and reports retained failure state",
+        "Keeps business behavior verification separate from activation smoke"
+      ]
+    }
+  ]
+}

package/skills/dsh-plugin-upgrade/references/migration-map.md

@@ -0,0 +1,32 @@
+# Migration map
+
+## Ownership split
+
+`@deepseek-ai/dsh-client-runtime` was removed without an aggregate replacement.
+
+| Old concern | 0.1.2 owner | Migration policy |
+| --- | --- | --- |
+| store engine and equality helpers | `@deepseek-ai/dsh-client-store` | exact for catalog-listed symbols |
+| Cordis client context type | `@deepseek-ai/cordis` `Context` | exact; preserve local aliases |
+| session control/list/commands | `@deepseek-ai/dsh-api-session-controller/client` | semantic |
+| workspace state/commands | `@deepseek-ai/dsh-api-workspace-controller/client` | semantic |
+| conversation assembly | `@deepseek-ai/dsh-client-ui-conversation/client` | semantic |
+| approval/questions pending state | domain UI packages aggregated by `ui-session` | semantic |
+
+Session snapshots no longer own Conversation views or all pending-interaction facts. Workspace navigation policy is distinct from workspace state. Check callers and lifecycle rather than changing import paths alone.
+
+## Host facade removal
+
+`@deepseek-ai/dsh-host-apiproxy` was removed. Browser operations use their natural generated Remote owners through API Remotes/API Gateway contributions. There is no facade-compatible package substitution.
+
+## Client graph
+
+- `dsh.client.inject` declares package dependency edges; Cordis service injection still controls activation.
+- React, Cordis, client-store, ui-slots, and ui-primitives baseline modules are implicit and should not be repeated in `dsh.client.external`.
+- A declared web client requires a published `exports["./client"]` artifact.
+
+## Patch targets
+
+For `MIG_PATCH_TARGET_CHANGED`, first confirm the Harness checkout is exact and its tag scan succeeded. Then compare the old and target web profile bundle patches: remove an obsolete override only when the old row disappeared without a replacement, or update the id when upstream deliberately renamed/moved the row. Do not guess a replacement id from a similar name.
+
+The machine-readable source of truth is the [versioned catalog](../../../migrations/dsh-v0.1.1-rc.2__dsh-v0.1.2-alpha.2/manifest.json).

package/skills/dsh-plugin-upgrade/references/verification.md

@@ -0,0 +1,27 @@
+# Verification gates
+
+## Static
+
+Static analysis covers source/type imports, dependency ranges, client graph declarations, and generated artifacts. A pass means no known blocking finding; it does not execute project code.
+
+## Build
+
+The CLI selects the package manager from lockfiles and runs declared scripts in this order: `typecheck`, `build`, `test`, `pack:check`, stopping at the first failure. Artifact verification requires a successful `build` or `pack:check`; `typecheck`/`test` alone do not pass this gate.
+
+## Runtime
+
+Runtime verification:
+
+1. packs the plugin from its repository;
+2. creates a fresh temporary `DSH_HOME`;
+3. initializes a web profile by adding the tarball through the target DSH CLI;
+4. composes effective config with `--dump-config`;
+5. performs a CLI activation smoke with `--help`.
+
+The gate also checks the DSH CLI's exact target version, the created profile manifest, the installed package manifest, bundle activation, and the plugin's presence in the effective config. Successful exit codes alone are insufficient.
+
+Use a built target Harness CLI through `--harness-root`, or pass `--dsh-command` explicitly. The temporary home is deleted only after a successful run unless `--keep-temp` is set.
+
+## Behavior
+
+Choose focused checks from the plugin contract: render the real UI, invoke each command, exercise settings, verify service availability, repeat activation/deactivation, check listener cleanup, and cover failure recovery. Record exact commands, screenshots, logs, or tests. This gate is deliberately not inferred by dsh-doctor.

package/src/baseline.mjs

@@ -0,0 +1,69 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { atomicWrite, snapshotFile } from './safe-write.mjs'
+import { redactSecrets } from './redact.mjs'
+
+export function baselinePath(report, explicit) {
+  return explicit === undefined
+    ? join(report.context.profileDir, '.dsh-doctor', 'baseline.json')
+    : resolve(explicit)
+}
+
+export function baselineFromReport(report) {
+  const safeReport = redactSecrets(report)
+  return {
+    schemaVersion: 2,
+    createdAt: new Date().toISOString(),
+    profile: report.context.profile,
+    home: report.context.home,
+    harness: safeReport.context.harness,
+    packages: safeReport.context.packages.map(item => ({ name: item.name, version: item.version, compatibility: item.compatibility })),
+    configuration: {
+      layers: safeReport.context.configuration?.layers ?? [],
+      currentDefaultTree: safeReport.context.configuration?.currentDefaultTree ?? [],
+      currentEffectiveTree: safeReport.context.configuration?.currentEffectiveTree ?? [],
+    },
+    findingCodes: report.findings.map(item => item.code),
+  }
+}
+
+export function createBaseline(report, explicit) {
+  const file = baselinePath(report, explicit)
+  const snapshot = snapshotFile(file)
+  const baseline = baselineFromReport(report)
+  const written = atomicWrite(snapshot, `${JSON.stringify(baseline, null, 2)}\n`, { backup: snapshot.exists })
+  return { ...written, baseline }
+}
+
+function byName(values) {
+  return new Map(values.map(item => [item.name, item]))
+}
+
+export function compareBaseline(report, explicit) {
+  const file = baselinePath(report, explicit)
+  if (!existsSync(file)) throw new Error(`baseline does not exist: ${file}`)
+  const baseline = JSON.parse(readFileSync(file, 'utf8'))
+  if (![1, 2].includes(baseline?.schemaVersion) || !Array.isArray(baseline.packages)) throw new Error(`unsupported baseline document: ${file}`)
+  const before = byName(baseline.packages)
+  const after = byName(report.context.packages)
+  const added = [...after.keys()].filter(name => !before.has(name)).sort()
+  const removed = [...before.keys()].filter(name => !after.has(name)).sort()
+  const changed = [...after.keys()].filter(name => before.has(name)).flatMap(name => {
+    const left = before.get(name)
+    const right = after.get(name)
+    const fields = ['version', 'compatibility'].filter(field => left[field] !== right[field])
+    return fields.length === 0 ? [] : [{ name, fields, before: left, after: right }]
+  })
+  const oldFindings = new Set(baseline.findingCodes ?? [])
+  const currentFindings = new Set(report.findings.map(item => item.code))
+  return {
+    file,
+    baselineCreatedAt: baseline.createdAt,
+    harness: { before: baseline.harness, after: report.context.harness },
+    packages: { added, removed, changed },
+    findings: {
+      introduced: [...currentFindings].filter(code => !oldFindings.has(code)).sort(),
+      resolved: [...oldFindings].filter(code => !currentFindings.has(code)).sort(),
+    },
+  }
+}