@bruc3van/dsh-doctor 0.1.6 → 0.5.0

package/src/cli.mjs

@@ -1,47 +1,95 @@
 #!/usr/bin/env node
 
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { createInterface } from 'node:readline/promises'
 import { formatReport, diagnose, resolveDshHome } from './doctor.mjs'
 import { applyRepairs, formatRepairOutcome, formatRepairPlan, repairsFromReport } from './repair.mjs'
 import { resolveLanguage } from './i18n.mjs'
-import { readFileSync } from 'node:fs'
-import { dirname, resolve } from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { createInterface } from 'node:readline/promises'
+import { checkCompatibleVersion } from './registry.mjs'
+import { applyPersistentQuarantine, attachUpdateResult, persistentQuarantinePlan, prepareRemovalArtifacts, quarantineDocument, removalPlan, restoreBackup, verifyQuarantine, verifyUpdate, writeQuarantineOverlay } from './recovery.mjs'
+import { compareBaseline, createBaseline } from './baseline.mjs'
+import { redactSecrets } from './redact.mjs'
 
-const HELP_EN = `Usage: dsh-doctor [options]
+const HELP_EN = `Usage:
+  dsh-doctor diagnose [options]
+  dsh-doctor recover <package> [--action <action>] [options]
+  dsh-doctor baseline <create|compare> [options]
+  dsh-doctor migrations list
+  dsh-doctor migrate <analyze|apply|verify> [plugin-root] [options]
 
-Diagnostics and confirmed recovery for a DeepSeek Harness profile.
+Commands:
+  diagnose                 inspect the selected profile (default command)
+  recover <package>        build and optionally execute one explicit recovery decision
+  baseline create|compare  save or compare a pre-upgrade diagnostic snapshot
+  migrations list          list built-in versioned migration catalogs
+  migrate analyze          find source, manifest, artifact, and semantic migration work
+  migrate apply            preview or apply only exact catalog codemods with backups
+  migrate verify           run static, build, or isolated runtime verification
 
 Options:
   --profile <name>       profile to inspect (default: web)
   --home <path>          Harness home (default: $DSH_HOME or ~/.dsh)
   --harness-root <path>  active DeepSeek Harness source checkout
-  --dsh-command <path>   DSH executable or lib/bin.js used for command repairs
-  --lang <auto|zh|en>    output language (default: DSH setting, then system)
+  --patch <path>         include one CLI overlay in the effective tree (repeatable)
+  --dsh-command <path>   DSH executable or lib/bin.js used for commands
+  --check-updates        query registry for manifest-declared compatible versions
+  --action <action>      check-update, update, quarantine, persist-quarantine, rollback-quarantine, or remove
+  --output <path>        quarantine overlay or baseline path
+  --backup <path>        backup used by rollback-quarantine
+  --verified             assert that a temporary quarantine overlay was tested
+  --lang <auto|zh|en>    output language
   --json                 print machine-readable JSON
-  --fix, --repair        preview and apply available repairs after confirmation
-  --yes                  confirm the displayed repair plan non-interactively
+  --fix, --repair        legacy confirmed repairs (never removes a plugin)
+  --yes                  confirm an explicit write or command
+  --from <ref>            source DSH ref (default: dsh-v0.1.1-rc.2)
+  --to <ref>              target DSH ref (default: dsh-v0.1.2-alpha.2)
+  --safe                  restrict migrate apply to catalog-confirmed exact rewrites
+  --level <level>         static, build, or runtime verification
+  --keep-temp             retain a successful runtime verification directory
   -h, --help             show help
   -v, --version          show version
 `
 
-const HELP_ZH = `用法：dsh-doctor [选项]
+const HELP_ZH = `用法：
+  dsh-doctor diagnose [选项]
+  dsh-doctor recover <包名> [--action <动作>] [选项]
+  dsh-doctor baseline <create|compare> [选项]
+  dsh-doctor migrations list
+  dsh-doctor migrate <analyze|apply|verify> [插件目录] [选项]
 
-诊断 DeepSeek Harness profile，并在用户确认后实施修复。
+命令：
+  diagnose                 检查选定的 profile（默认命令）
+  recover <包名>           生成并按确认执行一个明确的恢复动作
+  baseline create|compare  保存或比较升级前诊断快照
+  migrations list          列出内置的版本化迁移目录
+  migrate analyze          识别源码、manifest、产物和语义迁移任务
+  migrate apply            预览或应用 catalog 确认的精确改写并创建备份
+  migrate verify           执行静态、构建或隔离运行时验证
 
 选项：
   --profile <名称>       要检查的 profile（默认：web）
-  --home <路径>          Harness 主目录（默认：$DSH_HOME 或 ~/.dsh）
+  --home <路径>          Harness home（默认：$DSH_HOME 或 ~/.dsh）
   --harness-root <路径>  当前 DeepSeek Harness 源码工作区
-  --dsh-command <路径>   命令修复使用的 DSH 可执行文件或 lib/bin.js
-  --lang <auto|zh|en>    输出语言（默认：DSH 设置，其次系统语言）
-  --json                 输出稳定的机器可读 JSON
-  --fix, --repair        展示修复计划，确认后实施
-  --yes                  在非交互环境中确认当前修复计划
+  --patch <路径>         在生效配置树中加入一个 CLI overlay（可重复）
+  --dsh-command <路径>   执行动作使用的 DSH 可执行文件或 lib/bin.js
+  --check-updates        查询 registry 中由 manifest 声明兼容的版本
+  --action <动作>        check-update、update、quarantine、persist-quarantine、rollback-quarantine 或 remove
+  --output <路径>        quarantine overlay 或 baseline 路径
+  --backup <路径>        rollback-quarantine 使用的备份
+  --verified             确认临时 quarantine overlay 已经过测试
+  --lang <auto|zh|en>    输出语言
+  --json                 输出机器可读 JSON
+  --fix, --repair        旧式确认修复（绝不移除插件）
+  --yes                  确认一个明确的写入或命令动作
+  --from <ref>           源 DSH ref（默认：dsh-v0.1.1-rc.2）
+  --to <ref>             目标 DSH ref（默认：dsh-v0.1.2-alpha.2）
+  --safe                 migrate apply 仅执行 catalog 确认的精确改写
+  --level <级别>        static、build 或 runtime
+  --keep-temp            成功后仍保留运行时验证目录
   -h, --help             显示帮助
   -v, --version          显示版本
 `
-
 const help = language => language === 'zh' ? HELP_ZH : HELP_EN
 
 function valueAfter(args, index, name) {
@@ -51,16 +99,21 @@ function valueAfter(args, index, name) {
 }
 
 function optionValue(arg, name) {
-  const prefix = `${name}=`
-  if (!arg.startsWith(prefix)) return undefined
-  const value = arg.slice(prefix.length)
+  const value = arg.slice(`${name}=`.length)
   if (value === '') throw new Error(`${name} needs a value`)
   return value
 }
 
 function parse(args) {
-  const options = {}
-  for (let index = 0; index < args.length; index += 1) {
+  const options = { command: 'diagnose' }
+  let index = 0
+  if (['diagnose', 'recover', 'baseline', 'migrations', 'migrate'].includes(args[0])) options.command = args[index++]
+  if (options.command === 'recover' && args[index] !== undefined && !args[index].startsWith('-')) options.package = args[index++]
+  if (options.command === 'baseline' && args[index] !== undefined && !args[index].startsWith('-')) options.baselineAction = args[index++]
+  if (options.command === 'migrations' && args[index] !== undefined && !args[index].startsWith('-')) options.migrationsAction = args[index++]
+  if (options.command === 'migrate' && args[index] !== undefined && !args[index].startsWith('-')) options.migrateAction = args[index++]
+  if (options.command === 'migrate' && args[index] !== undefined && !args[index].startsWith('-')) options.pluginRoot = args[index++]
+  for (; index < args.length; index += 1) {
     const arg = args[index]
     if (arg === '--profile') options.profile = valueAfter(args, index++, arg)
     else if (arg.startsWith('--profile=')) options.profile = optionValue(arg, '--profile')
@@ -68,13 +121,31 @@ function parse(args) {
     else if (arg.startsWith('--home=')) options.home = optionValue(arg, '--home')
     else if (arg === '--harness-root') options.harnessRoot = valueAfter(args, index++, arg)
     else if (arg.startsWith('--harness-root=')) options.harnessRoot = optionValue(arg, '--harness-root')
+    else if (arg === '--patch') (options.patchFiles ??= []).push(valueAfter(args, index++, arg))
+    else if (arg.startsWith('--patch=')) (options.patchFiles ??= []).push(optionValue(arg, '--patch'))
     else if (arg === '--dsh-command') options.dshCommand = valueAfter(args, index++, arg)
     else if (arg.startsWith('--dsh-command=')) options.dshCommand = optionValue(arg, '--dsh-command')
     else if (arg === '--lang') options.lang = valueAfter(args, index++, arg)
     else if (arg.startsWith('--lang=')) options.lang = optionValue(arg, '--lang')
+    else if (arg === '--action') options.action = valueAfter(args, index++, arg)
+    else if (arg.startsWith('--action=')) options.action = optionValue(arg, '--action')
+    else if (arg === '--output') options.output = valueAfter(args, index++, arg)
+    else if (arg.startsWith('--output=')) options.output = optionValue(arg, '--output')
+    else if (arg === '--backup') options.backup = valueAfter(args, index++, arg)
+    else if (arg.startsWith('--backup=')) options.backup = optionValue(arg, '--backup')
+    else if (arg === '--check-updates') options.checkUpdates = true
+    else if (arg === '--verified') options.verified = true
     else if (arg === '--json') options.json = true
     else if (arg === '--fix' || arg === '--repair') options.fix = true
     else if (arg === '--yes') options.yes = true
+    else if (arg === '--from') options.from = valueAfter(args, index++, arg)
+    else if (arg.startsWith('--from=')) options.from = optionValue(arg, '--from')
+    else if (arg === '--to') options.to = valueAfter(args, index++, arg)
+    else if (arg.startsWith('--to=')) options.to = optionValue(arg, '--to')
+    else if (arg === '--safe') options.safe = true
+    else if (arg === '--level') options.level = valueAfter(args, index++, arg)
+    else if (arg.startsWith('--level=')) options.level = optionValue(arg, '--level')
+    else if (arg === '--keep-temp') options.keepTemp = true
     else if (arg === '--help' || arg === '-h') options.help = true
     else if (arg === '--version' || arg === '-v') options.version = true
     else throw new Error(`unknown option ${arg}`)
@@ -82,84 +153,187 @@ function parse(args) {
   return options
 }
 
+function diagnosisOptions(options) {
+  return { profile: options.profile, home: options.home, harnessRoot: options.harnessRoot, dshCommand: options.dshCommand, patchFiles: options.patchFiles }
+}
+
+async function checkUpdates(report, selected) {
+  const names = selected === undefined ? report.context.pluginDiagnoses.map(item => item.name) : [selected]
+  for (const name of names) {
+    const diagnosis = report.context.pluginDiagnoses.find(item => item.name === name)
+    if (diagnosis === undefined) throw new Error(`package is not a direct profile plugin: ${name}`)
+    const result = await checkCompatibleVersion(name, report.context.harness.packages ?? {})
+    attachUpdateResult(diagnosis, result, { ...report.context.dshCli, profile: report.context.profile })
+  }
+}
+
+function print(value, options) {
+  const safeValue = typeof value === 'string' ? value : redactSecrets(value)
+  process.stdout.write(options.json ? `${JSON.stringify(safeValue, null, 2)}\n` : `${typeof safeValue === 'string' ? safeValue : JSON.stringify(safeValue, null, 2)}\n`)
+}
+
+async function legacyFix(options, language) {
+  let report = diagnose(diagnosisOptions(options))
+  const actions = repairsFromReport(report)
+  let repairs = []
+  let declined = false
+  if (actions.length === 0 && report.context.dshCli?.commandRepairNeeded && !report.context.dshCli.available) {
+    throw new Error(language === 'zh' ? '未找到可用的 DSH CLI，无法执行命令型修复；请使用 --dsh-command 指定当前安装的 dsh 或 lib/bin.js' : 'no working DSH CLI was found; pass the active dsh executable or lib/bin.js with --dsh-command')
+  }
+  if (actions.length > 0) {
+    let confirmed = options.yes === true
+    const plan = formatRepairPlan(actions, { language, prompt: !confirmed })
+    if (confirmed) process.stderr.write(`${plan}\n`)
+    else {
+      if (!process.stdin.isTTY) throw new Error('--fix needs an interactive terminal or explicit --yes')
+      const reader = createInterface({ input: process.stdin, output: process.stderr })
+      const answer = await reader.question(plan)
+      reader.close()
+      confirmed = /^(?:y(?:es)?|是|确认)$/i.test(answer.trim())
+    }
+    if (confirmed) {
+      repairs = applyRepairs(actions, { captureOutput: options.json })
+      if (repairs.every(item => item.status === 'applied')) report = diagnose(diagnosisOptions(options))
+    } else declined = true
+  }
+  const output = { ...report, repairs }
+  if (options.json) print(output, options)
+  else process.stdout.write(`${formatReport(report, { color: process.stdout.isTTY, language })}${repairs.length > 0 ? `${language === 'zh' ? '修复结果' : 'Repairs'}: ${JSON.stringify(repairs, null, 2)}\n` : formatRepairOutcome(actions, repairs, { declined, findingCount: report.findings.length, language })}`)
+  process.exitCode = repairs.some(item => item.status === 'failed') ? 2 : report.summary.errors > 0 ? 1 : 0
+}
+
+async function runRecover(options) {
+  if (options.package === undefined) throw new Error('recover needs a package name')
+  const allowed = ['check-update', 'update', 'quarantine', 'persist-quarantine', 'rollback-quarantine', 'remove']
+  if (options.action !== undefined && !allowed.includes(options.action)) throw new Error(`unsupported recovery action ${options.action}`)
+  let report = diagnose(diagnosisOptions(options))
+  const diagnosis = report.context.pluginDiagnoses?.find(item => item.name === options.package)
+  if (diagnosis === undefined) throw new Error(`package is not a direct profile plugin: ${options.package}`)
+  await checkUpdates(report, options.package)
+  const action = options.action
+  if (action === undefined || action === 'check-update') return print({ diagnosis }, options)
+  if (action === 'quarantine') {
+    const patches = quarantineDocument(diagnosis)
+    if (options.output === undefined) return print({ action, mode: 'preview', patches, command: ['dsh', '--profile', report.context.profile, '--patch', '<output.yml>'] }, options)
+    const result = writeQuarantineOverlay(diagnosis, options.output)
+    const verificationReport = diagnose({ ...diagnosisOptions(options), patchFiles: [...(options.patchFiles ?? []), result.file] })
+    const verification = verifyQuarantine(verificationReport, patches)
+    process.exitCode = verification.allTargetEntriesDisabled ? 0 : 1
+    return print({ diagnosis, result, verification: { ...verification, report: verificationReport }, command: ['dsh', '--profile', report.context.profile, '--patch', result.file] }, options)
+  }
+  if (action === 'persist-quarantine') {
+    if (!options.verified) throw new Error('persist-quarantine requires --verified after testing a temporary overlay')
+    const plan = persistentQuarantinePlan(diagnosis, report.context.profileDir)
+    if (!options.yes) return print({ action, mode: 'preview', file: plan.file, diff: plan.diff }, options)
+    const result = applyPersistentQuarantine(plan)
+    report = diagnose(diagnosisOptions(options))
+    const verification = verifyQuarantine(report, plan.patches)
+    process.exitCode = verification.allTargetEntriesDisabled && report.summary.errors === 0 ? 0 : 1
+    return print({ action, result, verification: { ...verification, report } }, options)
+  }
+  if (action === 'rollback-quarantine') {
+    if (options.backup === undefined) throw new Error('rollback-quarantine requires --backup')
+    const target = join(report.context.profileDir, 'cordis.patch.yml')
+    if (!options.yes) return print({ action, mode: 'preview', backup: options.backup, target }, options)
+    const result = restoreBackup(options.backup, target)
+    report = diagnose(diagnosisOptions(options))
+    process.exitCode = report.summary.errors > 0 ? 1 : 0
+    return print({ action, result, verification: report }, options)
+  }
+  if (action === 'remove') {
+    const plan = removalPlan(diagnosis, report.context.dshCli, report.context.home, report.context.profile)
+    if (!options.yes) return print({ action, mode: 'preview', plan }, options)
+    const artifacts = prepareRemovalArtifacts(diagnosis, report)
+    const [result] = applyRepairs([plan], { captureOutput: options.json })
+    report = diagnose(diagnosisOptions(options))
+    const absent = !report.context.packages.some(item => item.name === options.package)
+    const entryAbsent = !report.context.configuration?.entries?.some(entry => entry.name === options.package || entry.origin?.package === options.package)
+    const bundleAbsent = !report.context.configuration?.layers?.some(layer => layer.package === options.package)
+    const targetIds = new Set(plan.impact.hostEntries)
+    const referencesAbsent = !report.context.configuration?.patchReferences?.some(reference => targetIds.has(reference.id))
+    process.exitCode = result.status === 'failed' ? 2 : absent && entryAbsent && bundleAbsent && referencesAbsent ? (report.summary.errors > 0 ? 1 : 0) : 1
+    return print({ action, result, artifacts, verification: { packageAbsent: absent, bundleAbsent, entryAbsent, patchReferencesAbsent: referencesAbsent, report }, rollback: plan.impact.rollback }, options)
+  }
+  const update = diagnosis.recovery.options.find(item => item.kind === 'update')
+  if (update?.availability !== 'available' || update.command.length === 0) throw new Error('no manifest-declared compatible update is available through the active DSH CLI')
+  const plan = { id: `update-package:${diagnosis.name}`, kind: 'command', risk: 'medium', description: update.reason, command: update.command, env: { DSH_HOME: report.context.home } }
+  if (!options.yes) return print({ action, mode: 'preview', plan }, options)
+  const [result] = applyRepairs([plan], { captureOutput: options.json })
+  report = diagnose(diagnosisOptions(options))
+  const verification = verifyUpdate(report, diagnosis.name, update.impact.candidateVersion)
+  process.exitCode = result.status === 'failed' ? 2 : verification.verified ? 0 : 1
+  return print({ action, result, verification: { ...verification, report } }, options)
+}
+
 async function main() {
   const options = parse(process.argv.slice(2))
   if (options.version) {
-    const here = dirname(fileURLToPath(import.meta.url))
-    const manifest = JSON.parse(readFileSync(resolve(here, '..', 'package.json'), 'utf8'))
-    process.stdout.write(`${manifest.version}\n`)
+    process.stdout.write(`${JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version}\n`)
     return
   }
-  if (options.help) {
-    const requested = ['auto', 'zh', 'en'].includes(options.lang) ? options.lang : undefined
-    const language = resolveLanguage({
-      requested,
-      home: resolveDshHome(options.home),
-      systemLocale: Intl.DateTimeFormat().resolvedOptions().locale,
-    })
-    process.stdout.write(help(language))
+  const requestedLanguage = options.help
+    ? (['auto', 'zh', 'en'].includes(options.lang) ? options.lang : undefined)
+    : options.lang
+  const language = resolveLanguage({ requested: requestedLanguage, home: resolveDshHome(options.home), systemLocale: Intl.DateTimeFormat().resolvedOptions().locale })
+  if (options.help) return process.stdout.write(help(language))
+  if (options.fix && options.command !== 'diagnose') throw new Error('--fix/--repair can only be used with diagnose')
+  if (options.yes && !options.fix && options.command === 'diagnose') throw new Error('--yes requires --fix or an explicit recover/migrate action')
+  if (options.json && options.fix && !options.yes) throw new Error('--json --fix requires --yes because a prompt would corrupt JSON output')
+  if (options.fix) return legacyFix(options, language)
+  if (options.command === 'recover') return runRecover(options)
+  if (options.command === 'migrations') {
+    if (options.migrationsAction !== 'list') throw new Error('migrations needs list')
+    const { listMigrations } = await import('./migration-catalog.mjs')
+    const migrations = listMigrations()
+    if (options.json) print({ schemaVersion: 1, migrations }, options)
+    else process.stdout.write(`${migrations.map(item => `${item.from.ref} -> ${item.to.ref} (${item.id})`).join('\n')}\n`)
     return
   }
-  const language = resolveLanguage({
-    requested: options.lang,
-    home: resolveDshHome(options.home),
-    systemLocale: Intl.DateTimeFormat().resolvedOptions().locale,
-  })
-  if (options.yes && !options.fix) throw new Error('--yes requires --fix')
-  if (options.json && options.fix && !options.yes) throw new Error('--json --fix requires --yes because a prompt would corrupt JSON output')
-  {
-    let report = diagnose(options)
-    let repairs = []
-    let actions = []
-    let repairDeclined = false
-    if (options.fix) {
-      actions = repairsFromReport(report)
-      if (actions.length === 0 && report.context.dshCli?.commandRepairNeeded && !report.context.dshCli.available) {
-        throw new Error(language === 'zh'
-          ? '未找到可用的 DSH CLI，无法执行命令型修复；请使用 --dsh-command 指定当前安装的 dsh 或 lib/bin.js'
-          : 'no working DSH CLI was found; pass the active dsh executable or lib/bin.js with --dsh-command')
-      }
-      if (actions.length > 0) {
-        let confirmed = options.yes === true
-        const plan = formatRepairPlan(actions, { language, prompt: !confirmed })
-        if (confirmed) {
-          process.stderr.write(`${plan}\n`)
-        } else {
-          if (!process.stdin.isTTY) throw new Error('--fix needs an interactive terminal or explicit --yes')
-          const reader = createInterface({ input: process.stdin, output: process.stderr })
-          const answer = await reader.question(plan)
-          reader.close()
-          confirmed = /^(?:y(?:es)?|是|确认)$/i.test(answer.trim())
-        }
-        if (confirmed) {
-          repairs = applyRepairs(actions, { captureOutput: options.json })
-          if (repairs.every(item => item.status === 'applied')) report = diagnose(options)
-        } else repairDeclined = true
-      }
+  if (options.command === 'migrate') {
+    if (!['analyze', 'apply', 'verify'].includes(options.migrateAction)) throw new Error('migrate needs analyze, apply, or verify')
+    if (options.migrateAction === 'apply' && options.safe !== true) throw new Error('migrate apply requires --safe')
+    if (options.migrateAction === 'apply' && options.pluginRoot === undefined) throw new Error('migrate apply requires an explicit plugin root')
+    const migrationOptions = { from: options.from, to: options.to, harnessRoot: options.harnessRoot, dshCommand: options.dshCommand, level: options.level, yes: options.yes, safe: options.safe, keepTemp: options.keepTemp }
+    if (options.migrateAction === 'verify') {
+      const { formatVerification, verifyMigration } = await import('./migrate-verify.mjs')
+      const result = verifyMigration(options.pluginRoot, migrationOptions)
+      print(options.json ? result : formatVerification(result, language), options)
+      process.exitCode = result.passed ? 0 : 1
+      return
     }
-    const output = options.fix ? { ...report, repairs } : report
-    const noRepairMessage = options.fix && repairs.length === 0 && !options.json
-      ? formatRepairOutcome(actions, repairs, {
-          declined: repairDeclined,
-          findingCount: report.findings.length,
-          language,
-        })
-      : ''
-    process.stdout.write(options.json
-      ? `${JSON.stringify(output, null, 2)}\n`
-      : `${formatReport(report, { color: process.stdout.isTTY, language })}${repairs.length > 0 ? `${language === 'zh' ? '修复结果' : 'Repairs'}: ${JSON.stringify(repairs, null, 2)}\n` : noRepairMessage}`)
-    process.exitCode = repairs.some(item => item.status === 'failed') ? 2 : report.summary.errors > 0 ? 1 : 0
+    const { analyzeMigration, applyMigration, formatMigrationReport, publicMigrationReport } = await import('./migrate.mjs')
+    const report = analyzeMigration(options.pluginRoot, migrationOptions)
+    if (options.migrateAction === 'apply') {
+      const result = applyMigration(report, migrationOptions)
+      if (options.json) print(result, options)
+      else if (result.mode === 'preview') process.stdout.write(`${formatMigrationReport(result, language)}${language === 'zh' ? '这是预览；加入 --yes 后才会写入。' : 'This is a preview; add --yes to write.'}\n`)
+      else process.stdout.write(`${language === 'zh' ? '已应用安全改写并创建备份。' : 'Safe edits applied with backups.'}\n${formatMigrationReport(result.report, language)}`)
+      const remaining = result.mode === 'applied' ? result.report : result
+      process.exitCode = remaining.summary.errors > 0 ? 1 : 0
+      return
+    }
+    print(options.json ? publicMigrationReport(report) : formatMigrationReport(report, language), options)
+    process.exitCode = report.summary.errors > 0 ? 1 : 0
+    return
   }
+  const report = diagnose(diagnosisOptions(options))
+  if (options.command === 'baseline') {
+    if (!['create', 'compare'].includes(options.baselineAction)) throw new Error('baseline needs create or compare')
+    const result = options.baselineAction === 'create' ? createBaseline(report, options.output) : compareBaseline(report, options.output)
+    print(result, options)
+    process.exitCode = report.summary.errors > 0 ? 1 : 0
+    return
+  }
+  if (options.checkUpdates) await checkUpdates(report)
+  print(options.json ? report : formatReport(report, { color: process.stdout.isTTY, language }), options)
+  process.exitCode = report.summary.errors > 0 ? 1 : 0
 }
 
 try {
   await main()
 } catch (error) {
   const message = error instanceof Error ? error.message : String(error)
-  if (process.argv.includes('--json')) {
-    process.stdout.write(`${JSON.stringify({ version: 1, operationalError: message }, null, 2)}\n`)
-  } else {
-    process.stderr.write(`dsh-doctor: ${message}\n\n${help('en')}`)
-  }
+  if (process.argv.includes('--json')) process.stdout.write(`${JSON.stringify({ version: 2, operationalError: message }, null, 2)}\n`)
+  else process.stderr.write(`dsh-doctor: ${message}\n\n${help('en')}`)
   process.exitCode = 2
 }

package/src/config-model.mjs

@@ -0,0 +1,167 @@
+import { readFileSync } from 'node:fs'
+
+function record(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined
+}
+
+function source(layer, patchIndex) {
+  return {
+    kind: layer.kind,
+    file: layer.file,
+    patchIndex,
+    ...(layer.package === undefined ? {} : { package: layer.package }),
+  }
+}
+
+function leafPaths(value, prefix = '') {
+  const object = record(value)
+  if (object === undefined) return prefix === '' ? [] : [prefix]
+  const paths = Object.entries(object).flatMap(([key, child]) => leafPaths(child, prefix === '' ? key : `${prefix}.${key}`))
+  return paths.length === 0 && prefix !== '' ? [prefix] : paths
+}
+
+function makeEntry(value, origin) {
+  const entry = structuredClone(value)
+  const fields = {}
+  for (const [key, fieldValue] of Object.entries(entry)) {
+    fields[key] = { value: structuredClone(fieldValue), source: origin }
+  }
+  return { value: entry, origin, fields }
+}
+
+function flatten(nodes, result = []) {
+  for (const node of nodes) {
+    result.push({
+      ...structuredClone(node.value),
+      origin: node.origin,
+      fields: node.fields,
+    })
+    if (node.value.group && Array.isArray(node.children)) flatten(node.children, result)
+  }
+  return result
+}
+
+function publicTree(nodes) {
+  return nodes.map(node => ({
+    ...structuredClone(node.value),
+    ...(node.children === undefined ? {} : { config: publicTree(node.children) }),
+    origin: node.origin,
+    fields: node.fields,
+  }))
+}
+
+function compose(layers, onIssue) {
+  const roots = []
+  const idMap = new Map()
+  const register = (node, layer, patchIndex) => {
+    const id = node.value.id
+    if (typeof id === 'string' && id.length > 0) {
+      if (idMap.has(id)) onIssue('DUPLICATE_ENTRY_ID', layer, patchIndex, node.value, { id })
+      idMap.set(id, node)
+    }
+    if (node.value.group && Array.isArray(node.value.config)) {
+      node.children = node.value.config.map(value => makeEntry(value, node.origin))
+      delete node.value.config
+      for (const child of node.children) register(child, layer, patchIndex)
+    } else if (node.value.group && Object.hasOwn(node.value, 'config')) {
+      onIssue('INVALID_GROUP_CONFIG', layer, patchIndex, node.value, { actualType: node.value.config === null ? 'null' : typeof node.value.config })
+    }
+  }
+  for (const layer of layers) {
+    layer.patches.forEach((patch, patchIndex) => {
+      const at = source(layer, patchIndex)
+      if (Array.isArray(patch.insert)) {
+        let destination = roots
+        if (typeof patch.id === 'string' && patch.id.length > 0) {
+          const target = idMap.get(patch.id)
+          if (target === undefined || !target.value.group) return
+          if (target.children === undefined) target.children = []
+          destination = target.children
+        }
+        for (const value of patch.insert) {
+          const node = makeEntry(value, at)
+          destination.push(node)
+          register(node, layer, patchIndex)
+        }
+        return
+      }
+      if (typeof patch.id !== 'string' || patch.id.length === 0) return
+      const target = idMap.get(patch.id)
+      if (target === undefined || (patch.name !== undefined && patch.name !== target.value.name)) return
+      for (const [key, value] of Object.entries(patch)) {
+        if (key === 'id' || key === 'insert' || key === 'name') continue
+        const previous = target.fields[key]
+        const removedPaths = key === 'config' && previous !== undefined
+          ? leafPaths(previous.value).filter(path => !leafPaths(value).includes(path))
+          : []
+        target.value[key] = structuredClone(value)
+        target.fields[key] = {
+          value: structuredClone(value),
+          source: at,
+          ...(previous === undefined ? {} : { replacedSource: previous.source }),
+          ...(removedPaths.length === 0 ? {} : { removedPaths }),
+        }
+        if (key === 'config' && target.value.group) {
+          // A complete override always discards the old public children. Keep
+          // the application index unchanged (applyEntryPatches does not index
+          // config overrides), but only rebuild children for a valid array.
+          delete target.children
+          if (Array.isArray(value)) {
+            target.children = value.map(child => makeEntry(child, at))
+            delete target.value.config
+          } else {
+            onIssue('INVALID_GROUP_CONFIG', layer, patchIndex, target.value, { actualType: value === null ? 'null' : typeof value })
+          }
+        }
+        if (key === 'disabled' && value === true && layer.kind !== 'bundle') {
+          onIssue('CORE_ENTRY_DISABLED_BY_HIGHER_LAYER', layer, patchIndex, target.value, { origin: target.origin })
+        }
+        if (key === 'config' && previous !== undefined && layer.kind !== 'bundle' && previous.source.file !== at.file) {
+          onIssue(target.value.group ? 'GROUP_CONTENT_REPLACED' : 'CONFIG_REPLACED_BY_HIGHER_LAYER', layer, patchIndex, target.value, { removedPaths })
+        }
+        if (key === 'group' && layer.kind !== 'bundle') onIssue('ENTRY_STRUCTURE_OVERRIDDEN', layer, patchIndex, target.value, {})
+      }
+    })
+  }
+  const entries = flatten(roots)
+  const names = new Map()
+  for (const entry of entries) {
+    if (entry.disabled === true || typeof entry.name !== 'string' || entry.name.length === 0) continue
+    const mounted = names.get(entry.name) ?? []
+    mounted.push(entry.id)
+    names.set(entry.name, mounted)
+  }
+  for (const [name, ids] of names) {
+    if (ids.length > 1) onIssue('DUPLICATE_PLUGIN_MOUNT', undefined, undefined, { name }, { ids })
+  }
+  return { tree: publicTree(roots), entries }
+}
+
+export function buildConfigurationModel(layers, addFinding) {
+  const issues = []
+  const onIssue = (code, layer, patchIndex, entry, details) => {
+    const issue = {
+      code,
+      layer,
+      patchIndex,
+      entry,
+      details,
+    }
+    issues.push(issue)
+    if (addFinding !== undefined) addFinding(issue)
+  }
+  const bundleLayers = layers.filter(layer => layer.kind === 'bundle')
+  const currentDefault = compose(bundleLayers, () => {})
+  const currentEffective = compose(layers, onIssue)
+  return {
+    layers: layers.map(layer => ({ kind: layer.kind, file: layer.file, label: layer.label, package: layer.package })),
+    currentDefaultTree: currentDefault.tree,
+    currentEffectiveTree: currentEffective.tree,
+    entries: currentEffective.entries,
+    issues,
+  }
+}
+
+export function readPatchText(file) {
+  return readFileSync(file, 'utf8')
+}