@catheadowl/dsh-eval 0.1.0

package/src/assertions.mjs

@@ -0,0 +1,389 @@
+/**
+ * Trace matchers for dsh agent eval. Every factory returns a matcher:
+ * `{ describe, check(trace) -> { ok, message } }` — a pure function over an
+ * `EvalTrace` (see trace.mjs), so matchers unit-test without any dsh run.
+ * Intent tests assert tool SELECTION over final text: model wording varies,
+ * tool choice is the contract under test.
+ */
+
+/** Render a name matcher for diagnostics. */
+function describeMatcher(matcher) {
+  return matcher instanceof RegExp ? String(matcher) : `'${matcher}'`
+}
+
+/** Whether a tool name satisfies a matcher (exact string or RegExp). */
+function nameMatches(matcher, name) {
+  return matcher instanceof RegExp ? matcher.test(name) : name === matcher
+}
+
+/**
+ * Whether a message `source` satisfies a source matcher. A string or RegExp
+ * matches `source.plugin` (the producer name — e.g. `'gates'` for steer);
+ * a function receives the full `source` object (for `kind`-based matching).
+ */
+function sourceMatches(matcher, source) {
+  if (typeof matcher === 'function') return matcher(source) === true
+  const plugin = source?.plugin
+  if (matcher instanceof RegExp) return typeof plugin === 'string' && matcher.test(plugin)
+  return plugin === matcher
+}
+
+/** Render a source matcher for diagnostics. */
+function describeSource(matcher) {
+  if (typeof matcher === 'function') return '<source predicate>'
+  return describeMatcher(matcher)
+}
+
+/** Render the trace's call sequence for failure messages. */
+function callList(trace) {
+  const names = trace.toolCalls.map(call => call.name)
+  return names.length === 0 ? '(no tool calls)' : `[${names.join(', ')}]`
+}
+
+/**
+ * Collect the tool results paired with calls matching `matcher`.
+ * @returns {{ callIds: Set<string>, results: object[] }}
+ *   `callIds` is empty when no call satisfies `matcher`;
+ *   `results` is the subset of `trace.toolResults` paired with those calls.
+ */
+function resultsForMatcher(matcher, trace) {
+  const callIds = new Set(
+    trace.toolCalls.filter(call => nameMatches(matcher, call.name)).map(call => call.callId),
+  )
+  const results = callIds.size === 0
+    ? []
+    : trace.toolResults.filter(r => callIds.has(r.callId))
+  return { callIds, results }
+}
+
+/** Truncate a string for diagnostics. */
+function truncate(text, max = 200) {
+  return text.length > max ? `${text.slice(0, max)}…` : text
+}
+
+/** A tool matching `matcher` was called at least once. */
+export function toolCalled(matcher) {
+  return {
+    describe: `tool called: ${describeMatcher(matcher)}`,
+    check(trace) {
+      const hit = trace.toolCalls.some(call => nameMatches(matcher, call.name))
+      return hit
+        ? { ok: true, message: '' }
+        : { ok: false, message: `expected a ${describeMatcher(matcher)} call; saw ${callList(trace)}` }
+    },
+  }
+}
+
+/** No tool matching `matcher` was ever called. */
+export function toolNotCalled(matcher) {
+  return {
+    describe: `tool not called: ${describeMatcher(matcher)}`,
+    check(trace) {
+      const hit = trace.toolCalls.find(call => nameMatches(matcher, call.name))
+      return hit === undefined
+        ? { ok: true, message: '' }
+        : { ok: false, message: `expected no ${describeMatcher(matcher)} call; saw one at seq ${hit.seq}` }
+    },
+  }
+}
+
+/** The FIRST tool call matches `matcher`. */
+export function firstTool(matcher) {
+  return {
+    describe: `first tool is: ${describeMatcher(matcher)}`,
+    check(trace) {
+      const first = trace.toolCalls[0]
+      if (first === undefined) {
+        return { ok: false, message: `expected first tool ${describeMatcher(matcher)}; the run made no tool calls` }
+      }
+      return nameMatches(matcher, first.name)
+        ? { ok: true, message: '' }
+        : { ok: false, message: `expected first tool ${describeMatcher(matcher)}; first was '${first.name}'` }
+    },
+  }
+}
+
+/**
+ * The expected names appear as an ORDERED SUBSEQUENCE of the call sequence
+ * (other calls may interleave). `names` entries are matchers.
+ */
+export function toolSequence(names) {
+  return {
+    describe: `tool sequence: ${names.map(describeMatcher).join(' -> ')}`,
+    check(trace) {
+      let cursor = 0
+      for (const call of trace.toolCalls) {
+        const expected = names[cursor]
+        if (expected !== undefined && nameMatches(expected, call.name)) cursor += 1
+      }
+      return cursor === names.length
+        ? { ok: true, message: '' }
+        : {
+            ok: false,
+            message: `expected subsequence ${names.map(describeMatcher).join(' -> ')}; `
+              + `stalled at ${describeMatcher(names[cursor])}; saw ${callList(trace)}`,
+          }
+    },
+  }
+}
+
+/**
+ * One call of `matcher` satisfies `match` on its arguments: an object checks
+ * a shallow subset of the parsed JSON arguments; a function receives
+ * `(parsedArguments, rawArguments)` and returns a boolean.
+ */
+export function toolCallArgs(matcher, match) {
+  return {
+    describe: `tool ${describeMatcher(matcher)} arguments match`,
+    check(trace) {
+      const calls = trace.toolCalls.filter(call => nameMatches(matcher, call.name))
+      if (calls.length === 0) {
+        return { ok: false, message: `expected a ${describeMatcher(matcher)} call to inspect; saw ${callList(trace)}` }
+      }
+      const satisfied = calls.some(call => {
+        if (typeof match === 'function') return match(call.parsedArguments, call.arguments) === true
+        const parsed = call.parsedArguments
+        if (parsed === null || typeof parsed !== 'object') return false
+        return Object.entries(match).every(
+          ([key, value]) => JSON.stringify(parsed[key]) === JSON.stringify(value),
+        )
+      })
+      return satisfied
+        ? { ok: true, message: '' }
+        : {
+            ok: false,
+            message: `no ${describeMatcher(matcher)} call matched the argument predicate; `
+              + `arguments seen: ${calls.map(call => call.arguments).join(' | ')}`,
+          }
+    },
+  }
+}
+
+/** The call matching `matcher` has a paired `tool/result` in the trace. */
+export function toolResultFor(matcher) {
+  return {
+    describe: `tool result present for: ${describeMatcher(matcher)}`,
+    check(trace) {
+      const { callIds } = resultsForMatcher(matcher, trace)
+      if (callIds.size === 0) {
+        return { ok: false, message: `expected a ${describeMatcher(matcher)} call; saw ${callList(trace)}` }
+      }
+      const hit = trace.toolResults.some(result => callIds.has(result.callId))
+      return hit
+        ? { ok: true, message: '' }
+        : { ok: false, message: `${describeMatcher(matcher)} was called but no tool/result arrived for it` }
+    },
+  }
+}
+
+/**
+ * A call matching `matcher` produced a tool result with `isError === true`.
+ * Fails when the tool was never called, never received a result, or every
+ * result was a success.
+ */
+export function toolResultIsError(matcher) {
+  return {
+    describe: `tool result isError: ${describeMatcher(matcher)}`,
+    check(trace) {
+      const { callIds, results } = resultsForMatcher(matcher, trace)
+      if (callIds.size === 0) {
+        return { ok: false, message: `expected a ${describeMatcher(matcher)} call; saw ${callList(trace)}` }
+      }
+      if (results.length === 0) {
+        return { ok: false, message: `${describeMatcher(matcher)} was called but no tool/result arrived for it` }
+      }
+      const hit = results.some(r => r.isError === true)
+      return hit
+        ? { ok: true, message: '' }
+        : {
+            ok: false,
+            message: `expected ${describeMatcher(matcher)} to produce an error result; `
+              + `saw isError: [${results.map(r => String(r.isError)).join(', ')}]`,
+          }
+    },
+  }
+}
+
+/**
+ * A call matching `matcher` produced a tool result with `isError` NOT true
+ * (i.e. `false` or `undefined` — treated as success).
+ */
+export function toolResultSucceeded(matcher) {
+  return {
+    describe: `tool result succeeded: ${describeMatcher(matcher)}`,
+    check(trace) {
+      const { callIds, results } = resultsForMatcher(matcher, trace)
+      if (callIds.size === 0) {
+        return { ok: false, message: `expected a ${describeMatcher(matcher)} call; saw ${callList(trace)}` }
+      }
+      if (results.length === 0) {
+        return { ok: false, message: `${describeMatcher(matcher)} was called but no tool/result arrived for it` }
+      }
+      const hit = results.some(r => r.isError !== true)
+      return hit
+        ? { ok: true, message: '' }
+        : {
+            ok: false,
+            message: `expected ${describeMatcher(matcher)} to produce a success result; `
+              + `all ${results.length} result(s) had isError: true`,
+          }
+    },
+  }
+}
+
+/**
+ * A call matching `matcher` produced a tool result whose text contains
+ * `substring`. The text is the same projection used by `toolResultFor`
+ * (concatenated inner text blocks of the tool-result wrapper).
+ */
+export function toolResultTextIncludes(matcher, substring) {
+  return {
+    describe: `tool result text includes: ${describeMatcher(matcher)} → '${substring}'`,
+    check(trace) {
+      const { callIds, results } = resultsForMatcher(matcher, trace)
+      if (callIds.size === 0) {
+        return { ok: false, message: `expected a ${describeMatcher(matcher)} call; saw ${callList(trace)}` }
+      }
+      if (results.length === 0) {
+        return { ok: false, message: `${describeMatcher(matcher)} was called but no tool/result arrived for it` }
+      }
+      const hit = results.some(r => r.text.includes(substring))
+      return hit
+        ? { ok: true, message: '' }
+        : {
+            ok: false,
+            message: `no ${describeMatcher(matcher)} result text includes '${substring}'; `
+              + `texts seen: [${results.map(r => JSON.stringify(truncate(r.text))).join(', ')}]`,
+          }
+    },
+  }
+}
+
+/** The final assistant text contains `substring`. */
+export function finalTextIncludes(substring) {
+  return {
+    describe: `final text includes: '${substring}'`,
+    check(trace) {
+      const hit = trace.finalText.includes(substring)
+      return hit
+        ? { ok: true, message: '' }
+        : { ok: false, message: `final text does not include '${substring}'; final text: ${JSON.stringify(trace.finalText.slice(0, 400))}` }
+    },
+  }
+}
+
+/**
+ * Any assembled assistant text contains `substring`. Unlike
+ * `finalTextIncludes`, later turns cannot invalidate the assertion — blocking
+ * gates that splice feedback after the script ends (turn-close hooks) push
+ * their own trailing steps, so a scripted closing line may no longer be the
+ * FINAL text even though the script delivered it.
+ */
+export function assistantTextIncludes(substring) {
+  return {
+    describe: `assistant text includes: '${substring}'`,
+    check(trace) {
+      const hit = trace.assistantTexts.some(text => text.includes(substring))
+      return hit
+        ? { ok: true, message: '' }
+        : { ok: false, message: `no assistant text includes '${substring}'; texts seen: [${trace.assistantTexts.map(t => JSON.stringify(t.slice(0, 120))).join(', ')}]` }
+    },
+  }
+}
+
+/** The final assistant text matches `regex`. */
+export function finalTextMatches(regex) {
+  return {
+    describe: `final text matches: ${String(regex)}`,
+    check(trace) {
+      const hit = regex.test(trace.finalText)
+      return hit
+        ? { ok: true, message: '' }
+        : { ok: false, message: `final text does not match ${String(regex)}; final text: ${JSON.stringify(trace.finalText.slice(0, 400))}` }
+    },
+  }
+}
+
+/** The assembled system prompt of a request contains `substring`. */
+export function systemPromptIncludes(substring) {
+  return {
+    describe: `system prompt includes: '${substring}'`,
+    check(trace) {
+      const headers = trace.requestHeaders
+      if (headers.length === 0) {
+        return { ok: false, message: 'expected a request/header event; the run produced none' }
+      }
+      const hit = headers.some(header => header.system.includes(substring))
+      return hit
+        ? { ok: true, message: '' }
+        : { ok: false, message: `no request/header system prompt contains '${substring}' (${headers.length} header(s) seen)` }
+    },
+  }
+}
+
+/** A tool named `matcher` is mounted in some request header (not merely called). */
+export function toolMounted(matcher) {
+  return {
+    describe: `tool mounted: ${describeMatcher(matcher)}`,
+    check(trace) {
+      const headers = trace.requestHeaders
+      if (headers.length === 0) {
+        return { ok: false, message: 'expected a request/header event; the run produced none' }
+      }
+      const names = [...new Set(headers.flatMap(header => header.toolNames))]
+      const hit = names.some(name => nameMatches(matcher, name))
+      return hit
+        ? { ok: true, message: '' }
+        : { ok: false, message: `expected ${describeMatcher(matcher)} among mounted tools; saw [${names.join(', ')}]` }
+    },
+  }
+}
+
+/**
+ * A user message from a source matching `sourceMatcher` contains `substring`.
+ * Source matcher: string/RegExp against `source.plugin`, or a predicate over
+ * the full `source`. This is how a case asserts plugin steer — a `user/message`
+ * with a plugin source — separately from the task prompt (`kind: 'user'`).
+ */
+export function userMessageTextIncludes(sourceMatcher, substring) {
+  return {
+    describe: `user message from ${describeSource(sourceMatcher)} includes: '${substring}'`,
+    check(trace) {
+      const messages = trace.userMessages.filter(message => sourceMatches(sourceMatcher, message.source))
+      if (messages.length === 0) {
+        return { ok: false, message: `expected a user message from ${describeSource(sourceMatcher)}; the run produced none` }
+      }
+      const hit = messages.some(message => message.text.includes(substring))
+      return hit
+        ? { ok: true, message: '' }
+        : {
+            ok: false,
+            message: `no ${describeSource(sourceMatcher)} user message includes '${substring}'; `
+              + `texts seen: [${messages.map(message => JSON.stringify(truncate(message.text))).join(', ')}]`,
+          }
+    },
+  }
+}
+
+/**
+ * No user message from a source matching `sourceMatcher` contains `substring`.
+ * Passes vacuously when no such message exists — pair it with
+ * `userMessageTextIncludes` to also prove the message arrived. This is the
+ * "not steered on someone else's file" half of an isolation assertion.
+ */
+export function userMessageTextExcludes(sourceMatcher, substring) {
+  return {
+    describe: `user message from ${describeSource(sourceMatcher)} excludes: '${substring}'`,
+    check(trace) {
+      const messages = trace.userMessages.filter(message => sourceMatches(sourceMatcher, message.source))
+      const hit = messages.find(message => message.text.includes(substring))
+      return hit === undefined
+        ? { ok: true, message: '' }
+        : {
+            ok: false,
+            message: `a ${describeSource(sourceMatcher)} user message includes '${substring}': `
+              + `${JSON.stringify(truncate(hit.text))}`,
+          }
+    },
+  }
+}

package/src/cli.mjs

@@ -0,0 +1,104 @@
+/**
+ * Host CLI resolution chain (release-plan C6 / spec host-checkout-resolution).
+ *
+ * Locating the compiled dsh CLI follows the same two-layer model as package
+ * imports: committed files carry no real host-checkout path — the machine's
+ * resolution layer (node_modules, junction-built by the relink anchor tool)
+ * absorbs it. Precedence, first hit wins:
+ *
+ *   1. explicit `--repo <dir>` flag — the documented escape hatch;
+ *   2. resolution layer — `node_modules/@deepseek-ai/dsh/lib/bin.js`
+ *      (the CLI package's own bin target) reachable upward from startDir;
+ *   3. config `repo` key (legacy) — kept working for existing checked-in
+ *      `dsh-eval.config.mjs` files until the repo split retires them.
+ *
+ * Every miss fails loud with a fingerprint and placeholder-only guidance —
+ * no machine-specific example paths, no silent fallback to guessing.
+ */
+
+import { existsSync, realpathSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+
+/** Relative location of the compiled CLI entry inside a dsh checkout. */
+export const CLI_RELATIVE_PATH = join('apps', 'cli', 'lib', 'bin.js')
+
+/** Package-relative location of the CLI entry inside `@deepseek-ai/dsh`. */
+const PACKAGED_CLI_PATH = join('node_modules', '@deepseek-ai', 'dsh', 'lib', 'bin.js')
+
+/** The fail-loud message when no chain segment can produce a CLI. */
+export const NO_CLI_GUIDANCE = [
+  'no dsh CLI found. In order:',
+  "  1) pass --repo <host-checkout> explicitly;",
+  '  2) or make the resolution layer provide it: node_modules/@deepseek-ai/dsh/lib/bin.js',
+  '     (run the repo relink script to (re)build the junction tree from DSH_REPO,',
+  '     then build the host checkout if lib/ is missing);',
+  '  3) or set repo in dsh-eval.config.mjs (legacy, retired at repo split).',
+].join('\n')
+
+/** Validate a repo-style candidate: return the CLI path or undefined. */
+function cliFromRepoDir(repoDir) {
+  const dir = resolve(repoDir)
+  return existsSync(join(dir, CLI_RELATIVE_PATH)) ? join(dir, CLI_RELATIVE_PATH) : undefined
+}
+
+/** Walk up from startDir looking for the packaged CLI on the resolution layer. */
+function cliFromNodeModules(startDir) {
+  let dir = resolve(startDir)
+  for (;;) {
+    const candidate = join(dir, PACKAGED_CLI_PATH)
+    if (existsSync(candidate)) return candidate
+    const parent = dirname(dir)
+    if (parent === dir) return undefined
+    dir = parent
+  }
+}
+
+/**
+ * Derive the host checkout dir from a resolved CLI path (realpath, then up
+ * four levels from `apps/cli/lib/bin.js`). Falls back to undefined when the
+ * layout does not look like a checkout (e.g. an installed CLI tree) — repo
+ * is report metadata only, never a runtime requirement.
+ */
+function repoFromCli(cli) {
+  try {
+    const repo = resolve(realpathSync(cli), '..', '..', '..', '..')
+    return existsSync(join(repo, CLI_RELATIVE_PATH)) ? repo : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Resolve the compiled dsh CLI through the three-segment chain.
+ *
+ * @param {object} options
+ * @param {string} [options.repoFlag] - explicit `--repo <dir>` value (highest).
+ * @param {string} [options.configRepo] - config-file `repo` value (legacy, lowest).
+ * @param {string} [options.startDir] - where resolution-layer lookup starts
+ *   (default: process.cwd()).
+ * @returns {{ cli: string, repo: string | undefined, source: 'flag' | 'node_modules' | 'config' }}
+ * @throws {Error} with placeholder-only guidance when a flag/config repo has
+ *   no compiled CLI, or when the whole chain misses.
+ */
+export function resolveDshCliChain(options = {}) {
+  if (options.repoFlag !== undefined) {
+    const cli = cliFromRepoDir(options.repoFlag)
+    if (cli === undefined) {
+      throw new Error(
+        `repo '${resolve(options.repoFlag)}' has no ${CLI_RELATIVE_PATH.replaceAll('\\', '/')} — pass a built host checkout, or build it first (pnpm build)`
+      )
+    }
+    return { cli, repo: resolve(options.repoFlag), source: 'flag' }
+  }
+  const fromLayer = cliFromNodeModules(options.startDir ?? process.cwd())
+  if (fromLayer !== undefined) {
+    return { cli: fromLayer, repo: repoFromCli(fromLayer), source: 'node_modules' }
+  }
+  if (options.configRepo !== undefined) {
+    const cli = cliFromRepoDir(options.configRepo)
+    if (cli !== undefined) {
+      return { cli, repo: resolve(options.configRepo), source: 'config' }
+    }
+  }
+  throw new Error(NO_CLI_GUIDANCE)
+}

package/src/config.mjs

@@ -0,0 +1,119 @@
+/**
+ * Shared `dsh-eval.config.mjs` discovery and loading (EVAL-008).
+ *
+ * Both CLIs (`dsh-eval`, `dsh-review`) repeat `--profile/--repo` wiring in
+ * every consumer's package scripts. A per-package config file removes that
+ * repetition: discovery walks UP from the working directory (never into
+ * `node_modules`), the first `dsh-eval.config.mjs` wins, and CLI flags
+ * always override config values — flags stay the escape hatch, config is
+ * the default.
+ *
+ * Config shape (default export):
+ *   {
+ *     profile?: string,          // dsh profile to boot
+ *     repo?: string,             // deepseek-harness checkout, RELATIVE paths
+ *                                 // resolve against the config file's dir
+ *     mode?: 'real'|'mock'|'all' // behavior CLI --mode default
+ *     failOnSkip?: boolean,      // behavior CLI default
+ *     report?: string,           // behavior CLI --report default (resolved
+ *                                 // against the config file's dir)
+ *     disableRows?: string[],    // loader rows disabled in EVERY case's run
+ *                                 // unless the case itself declares
+ *                                 // `disableRows` (an explicit case-level
+ *                                 // `[]` re-enables everything)
+ *   }
+ * Unknown keys are rejected: a typo'd `profle` must fail loud, not silently
+ * fall back to CLI-required mode.
+ */
+
+import { existsSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+/** The config file name both CLIs look for. */
+export const CONFIG_FILE_NAME = 'dsh-eval.config.mjs'
+
+const ALLOWED_KEYS = new Set(['profile', 'repo', 'mode', 'failOnSkip', 'report', 'disableRows'])
+
+/**
+ * Walk up from `startDir` looking for the config file. Never crosses into
+ * (or searches within) `node_modules`; the first hit wins.
+ * @param {string} startDir - absolute directory to search from.
+ * @returns {string | undefined} absolute config path, or undefined.
+ */
+export function findEvalConfigFile(startDir) {
+  let dir = resolve(startDir)
+  for (;;) {
+    if (!dir.split(/[\\/]/).includes('node_modules')) {
+      const candidate = join(dir, CONFIG_FILE_NAME)
+      if (existsSync(candidate)) return candidate
+    }
+    const parent = resolve(dir, '..')
+    if (parent === dir) return undefined
+    dir = parent
+  }
+}
+
+/**
+ * Load and validate the config reachable from `startDir`.
+ * @param {string} startDir - absolute directory to search from (usually cwd).
+ * @returns {Promise<{ file: string, config: {
+ *   profile?: string, repo?: string, mode?: 'real'|'mock'|'all',
+ *   failOnSkip?: boolean, report?: string,
+ * } }>} `config` is `{}` when no file exists. `repo`/`report` come back
+ * absolute (resolved against the config file's directory).
+ * @throws {Error} on a malformed config (unknown key, wrong value shape).
+ */
+export async function loadEvalConfig(startDir) {
+  const file = findEvalConfigFile(startDir)
+  if (file === undefined) return { file: undefined, config: {} }
+  const module = await import(pathToFileURL(file).href)
+  const config = module.default ?? {}
+  if (config === null || typeof config !== 'object' || Array.isArray(config)) {
+    throw new Error(`${CONFIG_FILE_NAME}: default export must be a config object`)
+  }
+  for (const key of Object.keys(config)) {
+    if (!ALLOWED_KEYS.has(key)) {
+      throw new Error(`${file}: unknown config key '${key}' (allowed: ${[...ALLOWED_KEYS].join(', ')})`)
+    }
+  }
+  const out = {}
+  if (config.profile !== undefined) {
+    if (typeof config.profile !== 'string' || config.profile === '') {
+      throw new Error(`${file}: profile must be a non-empty string`)
+    }
+    out.profile = config.profile
+  }
+  if (config.repo !== undefined) {
+    if (typeof config.repo !== 'string' || config.repo === '') {
+      throw new Error(`${file}: repo must be a non-empty string (relative to the config file)`)
+    }
+    out.repo = resolve(file, '..', config.repo)
+  }
+  if (config.mode !== undefined) {
+    if (!['real', 'mock', 'all'].includes(config.mode)) {
+      throw new Error(`${file}: mode must be 'real', 'mock', or 'all (got '${config.mode}')`)
+    }
+    out.mode = config.mode
+  }
+  if (config.failOnSkip !== undefined) {
+    if (typeof config.failOnSkip !== 'boolean') {
+      throw new Error(`${file}: failOnSkip must be a boolean`)
+    }
+    out.failOnSkip = config.failOnSkip
+  }
+  if (config.report !== undefined) {
+    if (typeof config.report !== 'string' || config.report === '') {
+      throw new Error(`${file}: report must be a non-empty string (relative to the config file)`)
+    }
+    out.report = resolve(file, '..', config.report)
+  }
+  if (config.disableRows !== undefined) {
+    if (!Array.isArray(config.disableRows) || config.disableRows.length === 0
+      || config.disableRows.some(row => typeof row !== 'string' || row === '')) {
+      throw new Error(`${file}: disableRows must be a non-empty string[] of loader row ids (got '${JSON.stringify(config.disableRows)}')`)
+    }
+    out.disableRows = config.disableRows
+  }
+  return { file, config: out }
+}