@unbrained/pm-cli 2026.7.7 → 2026.7.8

package/dist/cli-bundle/chunks/{chunk-CJQM7O7R.js → chunk-FOJEBRDD.js}

@@ -18,7 +18,7 @@ import {
   serializeStatusDefsFile,
   upsertField,
   upsertStatusDef
-} from "./chunk-XPMXPR7K.js";
+} from "./chunk-YSRXFGNV.js";
 import {
   assertAliasesAvailable,
   assertTypeFolderAvailable,
@@ -29,7 +29,7 @@ import {
   removeItemType,
   serializeItemTypesFile,
   upsertItemType
-} from "./chunk-VLEA2UTQ.js";
+} from "./chunk-7QKSLAHB.js";
 import {
   PmCliError,
   acquireLock,
@@ -39,7 +39,7 @@ import {
   readSettings,
   resolveGovernanceKnobs,
   runActiveOnWriteHooks
-} from "./chunk-GH73UOSJ.js";
+} from "./chunk-NTOOEVJ4.js";
 import {
   DEFAULT_RUNTIME_SCHEMA_FILE_PATHS,
   EXIT_CODE,
@@ -54,7 +54,7 @@ import {
   resolveRuntimeStatusRegistry,
   toDefaultFolder,
   writeFileAtomic
-} from "./chunk-UO7XAZK6.js";
+} from "./chunk-MFLLULHU.js";
 
 // dist/cli/commands/schema.js
 import path from "node:path";
@@ -1230,6 +1230,6 @@ export {
   formatSchemaInferTypesHuman,
   _testOnlySchemaCommand
 };
-//# sourceMappingURL=chunk-CJQM7O7R.js.map
+//# sourceMappingURL=chunk-FOJEBRDD.js.map
 
 //# debugId=1b34f963-b810-5986-b87a-f27bba0ea7d6

package/dist/cli-bundle/chunks/{chunk-XZWL7VNE.js → chunk-G4FKP4ID.js}

@@ -13,11 +13,11 @@ import {
   readFirstStringFromCommanderOptions,
   readFirstValueFromCommanderOptions,
   readStringArrayFromCommanderOptions
-} from "./chunk-2APXX4TZ.js";
+} from "./chunk-ML27MHNM.js";
 import {
   printError,
   writeStdout
-} from "./chunk-EOUVR7JN.js";
+} from "./chunk-U72GF3I2.js";
 import {
   PmCliError,
   getActiveExtensionRegistrations,
@@ -26,7 +26,7 @@ import {
   readLocatedItem,
   readSettings,
   setActiveCommandResult
-} from "./chunk-GH73UOSJ.js";
+} from "./chunk-NTOOEVJ4.js";
 import {
   EXIT_CODE,
   coercePositiveInteger,
@@ -42,7 +42,7 @@ import {
   toNonEmptyString,
   trimTrailingSlashes,
   writeFileAtomic
-} from "./chunk-UO7XAZK6.js";
+} from "./chunk-MFLLULHU.js";
 
 // dist/cli/registration-helpers.js
 import { Option } from "commander";
@@ -2863,6 +2863,6 @@ export {
   normalizeNextOptions,
   invalidateSearchCachesForMutation
 };
-//# sourceMappingURL=chunk-XZWL7VNE.js.map
+//# sourceMappingURL=chunk-G4FKP4ID.js.map
 
 //# debugId=143ba130-1e4a-555a-ad5a-281c82c7f363

package/dist/cli-bundle/chunks/{chunk-Y5IKRUEM.js → chunk-GE44TQMC.js}

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c604d98f-a58a-571c-8593-a90bc7b6bbf9")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="dd6181c4-91c1-58ac-92c2-ce5ae31a5816")}catch(e){}}();
 import {
   EXECUTABLE_COMMAND_ALIASES,
   normalizeExtensionNameForMatch,
@@ -7,27 +7,27 @@ import {
   normalizeStringList,
   parseExtensionManifest,
   validateExtensionDirectory
-} from "./chunk-EVEPHNXJ.js";
+} from "./chunk-ZMOPZFVT.js";
 import {
   describeExtensionActivation,
   renderExtensionSurfaceMarkdown
-} from "./chunk-TEKZOS7M.js";
+} from "./chunk-Z2JQH2MG.js";
 import {
   ensureTypeFolderScaffold
-} from "./chunk-CJQM7O7R.js";
+} from "./chunk-FOJEBRDD.js";
 import {
   TYPE_PRESET_NAMES,
   normalizeTypePresetName,
   resolveTypePresetDefinitions
-} from "./chunk-XPMXPR7K.js";
+} from "./chunk-YSRXFGNV.js";
 import {
   PM_CORE_COMMAND_NAMES
-} from "./chunk-2APXX4TZ.js";
+} from "./chunk-ML27MHNM.js";
 import {
   parseItemTypesFile,
   serializeItemTypesFile,
   upsertItemType
-} from "./chunk-VLEA2UTQ.js";
+} from "./chunk-7QKSLAHB.js";
 import {
   splitCommaList
 } from "./chunk-P4SESZGT.js";
@@ -39,7 +39,7 @@ import {
   readSettings,
   runActiveOnWriteHooks,
   writeSettings
-} from "./chunk-GH73UOSJ.js";
+} from "./chunk-NTOOEVJ4.js";
 import {
   DEFAULT_RUNTIME_SCHEMA_FILE_PATHS,
   EXIT_CODE,
@@ -67,7 +67,7 @@ import {
   resolvePmPackageRootFromModule,
   resolvePmRoot,
   writeFileAtomic
-} from "./chunk-UO7XAZK6.js";
+} from "./chunk-MFLLULHU.js";
 
 // dist/core/packages/manifest.js
 import fs from "node:fs/promises";
@@ -4037,59 +4037,116 @@ var LIFECYCLE_ACTION_FLAGS = {
   init: "--init"
 };
 var NATIVE_OUTPUT_MARKER = "__pm_native_output";
+var EXTENSION_POLICY_ROOT_LIST_FIELDS = [
+  "trusted_extensions",
+  "allowed_extensions",
+  "blocked_extensions",
+  "allowed_capabilities",
+  "blocked_capabilities",
+  "allowed_surfaces",
+  "blocked_surfaces",
+  "allowed_commands",
+  "blocked_commands",
+  "allowed_actions",
+  "blocked_actions",
+  "allowed_services",
+  "blocked_services"
+];
+var EXTENSION_POLICY_OVERRIDE_LIST_FIELDS = [
+  "allowed_capabilities",
+  "blocked_capabilities",
+  "allowed_surfaces",
+  "blocked_surfaces",
+  "allowed_commands",
+  "blocked_commands",
+  "allowed_actions",
+  "blocked_actions",
+  "allowed_services",
+  "blocked_services"
+];
+var DEFAULT_EXTENSION_POLICY_DETAILS = {
+  mode: "off",
+  trust_mode: "off",
+  require_provenance: false,
+  trusted_extensions: [],
+  default_sandbox_profile: "none",
+  allowed_extensions: [],
+  blocked_extensions: [],
+  allowed_capabilities: [],
+  blocked_capabilities: [],
+  allowed_surfaces: [],
+  blocked_surfaces: [],
+  allowed_commands: [],
+  blocked_commands: [],
+  allowed_actions: [],
+  blocked_actions: [],
+  allowed_services: [],
+  blocked_services: [],
+  extension_overrides: []
+};
+function normalizePolicyRootLists(policy) {
+  const safePolicy = policy ?? DEFAULT_EXTENSION_POLICY_DETAILS;
+  const lists = {};
+  for (const field of EXTENSION_POLICY_ROOT_LIST_FIELDS) {
+    lists[field] = normalizeStringList(safePolicy[field] ?? []);
+  }
+  return lists;
+}
+function appendNonEmptyPolicyLists(target, lists) {
+  for (const field of EXTENSION_POLICY_OVERRIDE_LIST_FIELDS) {
+    if (lists[field].length > 0) {
+      target[field] = lists[field];
+    }
+  }
+  return target;
+}
+function buildExtensionPolicyOverrideDetails(override) {
+  const name = typeof override.name === "string" ? override.name.trim() : "";
+  if (name.length === 0) {
+    return null;
+  }
+  const details = { name };
+  if (override.disabled === true) {
+    details.disabled = true;
+  }
+  if (override.require_trusted === true) {
+    details.require_trusted = true;
+  }
+  if (override.require_provenance === true) {
+    details.require_provenance = true;
+  }
+  if (override.sandbox_profile) {
+    details.sandbox_profile = override.sandbox_profile;
+  }
+  const lists = {};
+  for (const field of EXTENSION_POLICY_OVERRIDE_LIST_FIELDS) {
+    lists[field] = normalizeStringList(override[field] ?? []);
+  }
+  return appendNonEmptyPolicyLists(details, lists);
+}
 function buildExtensionPolicyDetails(policy) {
-  const overrides = (policy.extension_overrides ?? []).map((override) => ({
-    name: override.name.trim(),
-    disabled: override.disabled === true ? true : void 0,
-    require_trusted: override.require_trusted === true ? true : void 0,
-    require_provenance: override.require_provenance === true ? true : void 0,
-    sandbox_profile: override.sandbox_profile,
-    allowed_capabilities: normalizeStringList(override.allowed_capabilities ?? []),
-    blocked_capabilities: normalizeStringList(override.blocked_capabilities ?? []),
-    allowed_surfaces: normalizeStringList(override.allowed_surfaces ?? []),
-    blocked_surfaces: normalizeStringList(override.blocked_surfaces ?? []),
-    allowed_commands: normalizeStringList(override.allowed_commands ?? []),
-    blocked_commands: normalizeStringList(override.blocked_commands ?? []),
-    allowed_actions: normalizeStringList(override.allowed_actions ?? []),
-    blocked_actions: normalizeStringList(override.blocked_actions ?? []),
-    allowed_services: normalizeStringList(override.allowed_services ?? []),
-    blocked_services: normalizeStringList(override.blocked_services ?? [])
-  })).filter((override) => override.name.length > 0).sort((left, right) => left.name.localeCompare(right.name));
+  const safePolicy = policy ?? DEFAULT_EXTENSION_POLICY_DETAILS;
+  const rootLists = normalizePolicyRootLists(policy);
+  const overrides = (safePolicy.extension_overrides ?? []).map((override) => buildExtensionPolicyOverrideDetails(override)).filter((override) => override !== null).sort((left, right) => left.name.localeCompare(right.name));
   return {
-    mode: policy.mode,
-    trust_mode: policy.trust_mode,
-    require_provenance: policy.require_provenance === true,
-    trusted_extensions: normalizeStringList(policy.trusted_extensions ?? []),
-    default_sandbox_profile: policy.default_sandbox_profile ?? "none",
-    allowed_extensions: normalizeStringList(policy.allowed_extensions ?? []),
-    blocked_extensions: normalizeStringList(policy.blocked_extensions ?? []),
-    allowed_capabilities: normalizeStringList(policy.allowed_capabilities ?? []),
-    blocked_capabilities: normalizeStringList(policy.blocked_capabilities ?? []),
-    allowed_surfaces: normalizeStringList(policy.allowed_surfaces ?? []),
-    blocked_surfaces: normalizeStringList(policy.blocked_surfaces ?? []),
-    allowed_commands: normalizeStringList(policy.allowed_commands ?? []),
-    blocked_commands: normalizeStringList(policy.blocked_commands ?? []),
-    allowed_actions: normalizeStringList(policy.allowed_actions ?? []),
-    blocked_actions: normalizeStringList(policy.blocked_actions ?? []),
-    allowed_services: normalizeStringList(policy.allowed_services ?? []),
-    blocked_services: normalizeStringList(policy.blocked_services ?? []),
-    extension_overrides: overrides.map((override) => ({
-      name: override.name,
-      ...override.disabled === true ? { disabled: true } : {},
-      ...override.require_trusted === true ? { require_trusted: true } : {},
-      ...override.require_provenance === true ? { require_provenance: true } : {},
-      ...override.sandbox_profile ? { sandbox_profile: override.sandbox_profile } : {},
-      ...override.allowed_capabilities.length > 0 ? { allowed_capabilities: override.allowed_capabilities } : {},
-      ...override.blocked_capabilities.length > 0 ? { blocked_capabilities: override.blocked_capabilities } : {},
-      ...override.allowed_surfaces.length > 0 ? { allowed_surfaces: override.allowed_surfaces } : {},
-      ...override.blocked_surfaces.length > 0 ? { blocked_surfaces: override.blocked_surfaces } : {},
-      ...override.allowed_commands.length > 0 ? { allowed_commands: override.allowed_commands } : {},
-      ...override.blocked_commands.length > 0 ? { blocked_commands: override.blocked_commands } : {},
-      ...override.allowed_actions.length > 0 ? { allowed_actions: override.allowed_actions } : {},
-      ...override.blocked_actions.length > 0 ? { blocked_actions: override.blocked_actions } : {},
-      ...override.allowed_services.length > 0 ? { allowed_services: override.allowed_services } : {},
-      ...override.blocked_services.length > 0 ? { blocked_services: override.blocked_services } : {}
-    }))
+    mode: safePolicy.mode ?? DEFAULT_EXTENSION_POLICY_DETAILS.mode,
+    trust_mode: safePolicy.trust_mode ?? DEFAULT_EXTENSION_POLICY_DETAILS.trust_mode,
+    require_provenance: safePolicy.require_provenance === true,
+    trusted_extensions: rootLists.trusted_extensions,
+    default_sandbox_profile: safePolicy.default_sandbox_profile ?? "none",
+    allowed_extensions: rootLists.allowed_extensions,
+    blocked_extensions: rootLists.blocked_extensions,
+    allowed_capabilities: rootLists.allowed_capabilities,
+    blocked_capabilities: rootLists.blocked_capabilities,
+    allowed_surfaces: rootLists.allowed_surfaces,
+    blocked_surfaces: rootLists.blocked_surfaces,
+    allowed_commands: rootLists.allowed_commands,
+    blocked_commands: rootLists.blocked_commands,
+    allowed_actions: rootLists.allowed_actions,
+    blocked_actions: rootLists.blocked_actions,
+    allowed_services: rootLists.allowed_services,
+    blocked_services: rootLists.blocked_services,
+    extension_overrides: overrides
   };
 }
 function isRetriableExtensionInstallCopyError(error) {
@@ -4787,6 +4844,11 @@ function assertExtensionActionOptionScope(action, options) {
       allowed: action === "manage" || action === "doctor",
       message: "--fix-managed-state is only valid with --manage or --doctor."
     },
+    {
+      triggered: options.isolated === true || options.ignoreGlobal === true,
+      allowed: action === "doctor",
+      message: "--isolated and --ignore-global are only valid with --doctor."
+    },
     {
       triggered: options.capability !== void 0,
       allowed: action === "init",
@@ -5312,10 +5374,11 @@ async function runExtensionActivateDeactivateAction(ctx) {
     }
   });
 }
-function buildDoctorRemediation(baseRemediation, loadFailureCount, activationFailureCount, vocabulary, managedStateFix) {
+function buildDoctorRemediation(baseRemediation, loadFailureCount, activationFailureCount, vocabulary, managedStateFix, isolationHint) {
   return [
     ...new Set([
       ...baseRemediation,
+      ...isolationHint === null ? [] : [isolationHint],
       /* c8 ignore start -- vocabulary-specific remediation branches are copy-only variants */
       ...loadFailureCount > 0 ? [
         vocabulary === "package" ? "Run pm package explore --project and pm package explore --global to inspect load failures." : "Run pm extension --explore --project and pm extension --explore --global to inspect load failures."
@@ -5328,11 +5391,45 @@ function buildDoctorRemediation(baseRemediation, loadFailureCount, activationFai
     ].map((entry) => entry.trim()).filter((entry) => entry.length > 0))
   ];
 }
+function hasGlobalLayerDiagnostics(loadResult) {
+  return loadResult.loaded.some((entry) => entry.layer === "global") || loadResult.failed.some((entry) => entry.layer === "global") || loadResult.warnings.some((warning) => warning.includes(":global:"));
+}
+function buildDoctorIsolationHint(scope, isolated, vocabulary, loadResult) {
+  if (scope !== "project" || isolated || !hasGlobalLayerDiagnostics(loadResult)) {
+    return null;
+  }
+  const noun = vocabulary === "package" ? "package" : "extension";
+  return `Global ${noun} registrations are included in project diagnostics. For hermetic ${noun} smoke tests, rerun pm ${noun} doctor --project --isolated --detail deep --trace, or set PM_GLOBAL_PATH to a temporary directory for the whole test process.`;
+}
+function buildDoctorIsolationMetadata(scope, isolated, vocabulary, loadResult) {
+  const noun = vocabulary === "package" ? "package" : "extension";
+  if (scope !== "project") {
+    return {
+      isolated,
+      global_extensions_included: false,
+      global_diagnostics_present: hasGlobalLayerDiagnostics(loadResult),
+      rerun_command: null,
+      pm_global_path_recipe: null
+    };
+  }
+  const isolatedCommand = `pm ${noun} doctor --project --isolated --detail deep --trace`;
+  return {
+    isolated,
+    global_extensions_included: !isolated,
+    global_diagnostics_present: hasGlobalLayerDiagnostics(loadResult),
+    rerun_command: isolated ? null : isolatedCommand,
+    pm_global_path_recipe: `PM_GLOBAL_PATH=$(mktemp -d) pm ${noun} doctor --project --detail deep --trace`
+  };
+}
 async function runExtensionDoctorAction(ctx) {
   const { normalizedTarget, scope, resolvedRoots, warnings, options, global, withResult } = ctx;
   if (normalizedTarget && normalizedTarget.trim().length > 0) {
     throw new PmCliError('Action "doctor" does not accept a target argument.', EXIT_CODE.USAGE);
   }
+  const isolated = options.isolated === true || options.ignoreGlobal === true;
+  if (isolated && scope === "global") {
+    throw new PmCliError("--isolated and --ignore-global are only valid with project-scope doctor diagnostics.", EXIT_CODE.USAGE);
+  }
   const detailMode = parseDoctorDetailMode(options.detail);
   const includeTrace = options.trace === true;
   if (includeTrace && detailMode !== "deep") {
@@ -5354,7 +5451,8 @@ async function runExtensionDoctorAction(ctx) {
     pmRoot: resolvedRoots.pm_root,
     settings,
     cwd: process.cwd(),
-    noExtensions: global.noExtensions === true
+    noExtensions: global.noExtensions === true,
+    ignoreGlobalExtensions: isolated
   });
   const activationResult = await activateExtensions({
     ...loadResult,
@@ -5400,7 +5498,9 @@ async function runExtensionDoctorAction(ctx) {
   const capabilityGuidance = collectUnknownCapabilityGuidance(normalizedWarnings);
   const capabilityContract = buildCapabilityContractMetadata();
   const warningCodes = triage.warning_codes;
-  const remediation = buildDoctorRemediation(triage.remediation, loadResult.failed.length, activationResult.failed.length, options.vocabulary, managedStateFix);
+  const isolationHint = buildDoctorIsolationHint(scope, isolated, options.vocabulary, loadResult);
+  const remediation = buildDoctorRemediation(triage.remediation, loadResult.failed.length, activationResult.failed.length, options.vocabulary, managedStateFix, isolationHint);
+  const isolation = buildDoctorIsolationMetadata(scope, isolated, options.vocabulary, loadResult);
   const summary = {
     status: triage.status,
     scope,
@@ -5432,6 +5532,7 @@ async function runExtensionDoctorAction(ctx) {
     has_blocking_failures: loadResult.failed.length + activationResult.failed.length > 0,
     consistency_warning_count: doctorConsistency.warnings.length,
     trace_enabled: includeTrace,
+    isolation,
     policy: policySummary,
     remediation
   };
@@ -5456,6 +5557,7 @@ async function runExtensionDoctorAction(ctx) {
     capability_contract: capabilityContract,
     capability_guidance: capabilityGuidance,
     managed_state_fix: managedStateFixSummary,
+    isolation,
     policy: loadResult.policy
   };
   if (detailMode === "deep") {
@@ -6619,6 +6721,6 @@ export {
   summarizeInitResult,
   runInit
 };
-//# sourceMappingURL=chunk-Y5IKRUEM.js.map
+//# sourceMappingURL=chunk-GE44TQMC.js.map
 
-//# debugId=c604d98f-a58a-571c-8593-a90bc7b6bbf9
+//# debugId=dd6181c4-91c1-58ac-92c2-ce5ae31a5816