bootproof 0.1.0 → 0.3.0

package/README.md

@@ -1,12 +1,34 @@
 # BootProof
 
+[![CI](https://github.com/bootproof/bootproof/actions/workflows/ci.yml/badge.svg)](https://github.com/bootproof/bootproof/actions/workflows/ci.yml)
+
 > **The honest Run Button for repos — with proof, not vibes.**
 
 **Human diagnosis. Machine proof. One engine.**
 
-<p align="center">
-  <img src="https://raw.githubusercontent.com/rossbuckley1990-hash/bootproof/main/assets/bootproof_viral_demo.gif" alt="BootProof demo" width="900">
-</p>
+```text
+ bootproof up https://github.com/dubinc/dub
+
+Remote source: https://github.com/dubinc/dub.git
+Clone retained at: .bootproof/remotes/github.com/dubinc/dub-*/repo
+
+Inference (evidence-based)
+  application: yes
+  package manager: pnpm.15.9
+  selected command: pnpm dev
+
+✗ NOT VERIFIED — remote_code_execution_blocked
+Why BootProof refused: remote repositories are untrusted code and require explicit consent.
+
+ bootproof up . --provider local --unsafe-local --install
+
+✓ install: dependencies installed
+✓ start-app: app process started and was supervised
+✓ health: observed HTTP 200 at http://localhost:3333
+
+✓ BOOTED — HTTP 200 at http://localhost:3333
+Evidence: .bootproof/attestation.json
+```
 
 BootProof inspects a local repository, builds an evidence-based run plan, executes only what it can justify, observes HTTP health, and writes a signed attestation for success or failure.
 
@@ -36,6 +58,42 @@ They get a signed verdict and a deterministic exit code.
 
 The same engine powers both.
 
+## Verified Repairs
+
+For the small deterministic repair registry:
+
+```bash
+bootproof fix .
+```
+
+BootProof reuses a signature-valid failure only at the exact clean Git commit; otherwise it reproduces the failure in a temporary copy. It applies one known remediation there and reruns full verification. It emits a signed `bootproof/repair-receipt/v1` only when the before run failed and the after run observed successful HTTP health.
+
+The original working tree is not edited. File changes are written as a reviewable patch under `.bootproof/`; the human decides whether to apply it.
+
+Machine mode is:
+
+```bash
+bootproof fix . --json
+```
+
+It emits one `bootproof/repair-result/v1` object and exits `0` only when a verified receipt exists.
+
+Public GitHub, GitLab, Bitbucket, and Codeberg repositories use the same retained managed workspace and execution gate as `up`:
+
+```bash
+bootproof fix https://github.com/user/repo --provider local --unsafe-local
+```
+
+`fix` never applies its patch. To explicitly apply a signature-valid file repair to a local working tree:
+
+```bash
+bootproof apply-repair .
+```
+
+Application checks the receipt signature, allowed file scope, signed content hashes, and exact current preimages before writing. Environment-only and plan-only receipts have no file change to apply.
+
+See [docs/REPAIR_RECEIPT.md](docs/REPAIR_RECEIPT.md).
+
 ## What It Tells Humans
 
 A failed run is still useful:
@@ -48,7 +106,7 @@ Safe next step: Run corepack enable && corepack prepare pnpm@10.24.0 --activate,
 Evidence: .bootproof/attestation.json
 ```
 
-BootProof distinguishes diagnosis from proof. Detecting Python, Flask, React, Celery, Go, or a monorepo does not mean BootProof claims full orchestration support for that stack.
+BootProof distinguishes diagnosis from proof. It can execute a narrow explicit Go main package, Rails `bin/rails` entrypoint, or Make run target, but detection alone never implies general support for every Go, Ruby, Make, Python, or monorepo architecture.
 
 ## What It Gives Machines
 
@@ -100,13 +158,13 @@ npx bootproof explain .bootproof/attestation.json
 npx bootproof verify .bootproof/attestation.json
 ```
 
-Run against a public GitHub repository:
+Run against a public HTTPS Git repository on GitHub, GitLab, Bitbucket, or Codeberg:
 
 ```bash
 npx bootproof up https://github.com/user/repo
 ```
 
-BootProof clones credential-free HTTPS GitHub URLs into `.bootproof/remotes/` and retains the clone so its evidence and any generated files continue to exist. It inspects the clone but refuses to execute remote code until host execution is explicitly acknowledged:
+BootProof clones credential-free HTTPS URLs from those named providers into `.bootproof/remotes/` and retains the clone so its evidence and any generated files continue to exist. It inspects the clone but refuses to execute remote code until host execution is explicitly acknowledged:
 
 ```bash
 npx bootproof up https://github.com/user/repo --provider local --unsafe-local
@@ -121,6 +179,7 @@ Contributors working from this source repository can use `npm ci`, `npm run buil
 BootProof is constrained on purpose:
 
 - no verified boot without an observed health signal
+- no Docker-to-host execution fallback; host commands require `--provider local --unsafe-local`
 - no success rendering for skipped steps
 - no invented secrets
 - no writes to `.env`, `.env.local`, `.env.development`, or `.env.production`
@@ -138,20 +197,35 @@ See [docs/HONESTY_CONTRACT.md](docs/HONESTY_CONTRACT.md).
 BootProof currently provides:
 
 - Node package-manager and start-command inference
+- conservative Go main-package, Rails `bin/rails`, and explicit Make run-target execution
 - Python/Flask and Go/Node hybrid detection
 - monorepo candidate ranking
 - Docker service dependency detection and scaffolding
+- repository Compose execution when a web service builds the checked-out source and publishes an HTTP port
 - localhost health-candidate discovery from repository evidence and app logs
 - classified failures
 - signed Ed25519 attestations
 - strict JSON and fail-closed CI output
 - redacted registry-entry export
+- deterministic sandboxed repairs with signed before/after receipts for the registered v0.3 classes
+- explicit repair application with signature, scope, and stale-preimage checks
+- marker-and-evidence-backed migration repair for Prisma, Django, Rails, Knex, and Drizzle
 
 Detection is broader than orchestration. For example:
 
 - Superset-like Python/Flask/React/Celery repos are detected, then honestly refused with `python_flask_setup_required`.
 - Grafana-like Go/Node hybrids are detected without pretending a frontend watcher is the whole application.
 - Parallel monorepo root commands are refused until a specific workspace is selected.
+- Image-only or infrastructure-only Compose services are not accepted as proof of the checked-out source.
+
+The supported repository entrypoints are deliberately narrow:
+
+- Go: exactly one `main.go` or `cmd/*/main.go`
+- Ruby: `Gemfile` plus `bin/rails`
+- Make: an explicit `run`, `serve`, `server`, `start`, or `dev` target
+- Compose: a service with a repository-local build context and a published HTTP port
+
+Each path still requires an observed HTTP response. A successful Compose `up -d`, process spawn, or command exit is not a green result by itself.
 
 ## Files Written
 
@@ -160,6 +234,7 @@ Depending on the observed plan, BootProof may write:
 ```text
 .bootproof/attestation.json
 .bootproof/registry-entry.json
+.bootproof/runtime/
 docker-compose.bootproof.yml
 .env.bootproof.example
 ```
@@ -252,9 +327,10 @@ BootProof is early alpha.
 
 Near-term work includes:
 
-- additional remote source providers beyond public HTTPS GitHub repositories
+- additional remote source providers beyond GitHub, GitLab, Bitbucket, and Codeberg
+- broader deterministic remediation coverage
 - stronger multi-service orchestration
-- broader Python and Go execution support
+- broader Python, Go, Ruby, and Make execution support
 - CI/OIDC-backed signing
 - proof-linked badges and a verified public index
 

package/dist/cli.js

@@ -9,14 +9,16 @@ import { pollHealth } from "./exec.js";
 import { buildRegistryEntry, verifyRegistryEntry, writeRegistryEntry, registryEntryPath } from "./registry.js";
 import { normalizeDockerBindPath, detectHostPlatform } from "./platform.js";
 import { diagnoseFailure } from "./diagnosis.js";
-import { cloneGithubRemote, isRemoteTarget, managedRemoteSource } from "./remote.js";
+import { cloneRemoteTarget, isRemoteTarget, managedRemoteSource } from "./remote.js";
+import { applyVerifiedRepair, repairRepo, verifyRepairReceipt, } from "./repair.js";
 let GREEN = "\x1b[32m", YELLOW = "\x1b[33m", RED = "\x1b[31m", DIM = "\x1b[2m", BOLD = "\x1b[1m", RESET = "\x1b[0m";
 const ok = (s) => console.log(`${GREEN}\u2713 ${s}${RESET}`);
 const would = (s) => console.log(`${DIM}\u25cb would: ${s}${RESET}`);
 const warn = (s) => console.log(`${YELLOW}! ${s}${RESET}`);
 const bad = (s) => console.log(`${RED}\u2717 ${s}${RESET}`);
 const disableColor = () => { GREEN = ""; YELLOW = ""; RED = ""; DIM = ""; BOLD = ""; RESET = ""; };
-const COMMANDS = ["up", "analyze", "plan", "verify", "explain", "attest", "help", "version", "--help", "-h", "--version"];
+const portableRelative = (from, to) => path.relative(from, to).replace(/\\/g, "/");
+const COMMANDS = ["up", "fix", "apply-repair", "analyze", "plan", "verify", "explain", "attest", "help", "version", "--help", "-h", "--version"];
 void normalizeDockerBindPath;
 void detectHostPlatform; // exported surface, used by docker provider work in progress
 if (process.env.NO_COLOR !== undefined)
@@ -45,12 +47,14 @@ function help() {
     console.log(`${BOLD}bootproof${RESET} — Human diagnosis. Machine proof. One engine.
 
 Usage:
-  bootproof analyze <path|github-url> [--workspace dir] [--json]
+  bootproof analyze <path|git-url> [--workspace dir] [--json]
                                                             inspect a repo, show evidence-based inference
-  bootproof plan <path|github-url> [--workspace dir]        show the run plan and files that WOULD be generated
-  bootproof up <path|github-url> [options]                  execute the plan, verify localhost, write signed proof
-  bootproof verify <path|attestation.json>              validate an attestation signature and inspect its claim
-  bootproof explain <attestation.json>                  human explanation of an attestation
+  bootproof plan <path|git-url> [--workspace dir]           show the run plan and files that WOULD be generated
+  bootproof up <path|git-url> [options]                     execute the plan, verify localhost, write signed proof
+  bootproof fix <path|git-url> [options]                    test a deterministic repair in a sandbox
+  bootproof apply-repair <path> [--receipt proof.json]      explicitly apply a signature-valid verified file change
+  bootproof verify <path|proof.json>                        validate an attestation or repair-receipt signature
+  bootproof explain <proof.json>                            explain an attestation or repair receipt
   bootproof attest export <path>                        redacted, re-signed shareable registry entry (never uploads)
   bootproof attest check <path>                         verify a registry entry signature
   bootproof version
@@ -66,6 +70,14 @@ Options for up:
   --json                    one bootproof/result/v1 JSON object on stdout
   --ci                      no prompts, colours, or interactive UI; fail closed
 
+Options for fix:
+  --provider docker|local   execution provider (default docker)
+  --unsafe-local            required acknowledgement for local sandbox execution
+  --port <n>                override inferred application port
+  --timeout <ms>            before/after health timeout (default 60000)
+  --dry-run                 execute nothing, write nothing, produce no repair proof
+  --json                    one bootproof/repair-result/v1 object on stdout
+
 Honesty contract: no green check without an observed event; dry runs say "would";
 .env/.env.local are never written; secrets are never invented.
 Remote execution requires --provider local --unsafe-local. docs/HONESTY_CONTRACT.md`);
@@ -81,6 +93,11 @@ function printInference(inf) {
         console.log(`  frontend markers: ${inf.frontendMarkers.join(", ")}`);
     if (inf.serviceMarkers.length)
         console.log(`  service markers: ${inf.serviceMarkers.join(", ")}`);
+    if (inf.repoComposeFile)
+        console.log(`  repo compose: ${inf.repoComposeFile} (bootproof defers to it)`);
+    if (inf.composeApplicationServices.length) {
+        console.log(`  compose HTTP services: ${inf.composeApplicationServices.map(service => `${service.name} (${service.source === "build" ? "builds checked-out source" : "image only"})`).join("; ")}`);
+    }
     console.log(`  package manager: ${inf.packageManager} ${DIM}(${inf.packageManagerEvidence})${RESET}`);
     if (inf.setupSteps.length)
         console.log(`  setup steps: ${inf.setupSteps.join("; ")}`);
@@ -92,6 +109,8 @@ function printInference(inf) {
         console.log(`  worker command: ${inf.workerCommand}`);
     if (inf.appCommand)
         console.log(`  selected command: ${inf.appCommand} ${DIM}(${inf.appCommandSource})${RESET}`);
+    if (inf.preparationCommands.length)
+        console.log(`  preparation: ${inf.preparationCommands.map(command => command.command).join("; ")}`);
     console.log(`  command scope: ${inf.commandScope}`);
     console.log(`  port: ${inf.port} ${DIM}(${inf.portEvidence})${RESET}`);
     if (inf.healthCandidates.length)
@@ -145,6 +164,43 @@ function printFailure(failureClass, diagnosis, evidencePath) {
     console.log(`Safe next step: ${diagnosis.safeNextStep}`);
     console.log(`Evidence: ${evidencePath}`);
 }
+function isRepairReceipt(value) {
+    return Boolean(value && typeof value === "object" && value.schema === "bootproof/repair-receipt/v1");
+}
+function printRepairResult(result) {
+    if (result.repaired) {
+        ok(`${BOLD}VERIFIED REPAIR${RESET}${GREEN} — ${result.repairId}`);
+        console.log(result.explanation);
+        if (result.patchPath)
+            console.log(`Patch: ${result.patchPath}`);
+        console.log(`Receipt: ${result.receiptPath}`);
+        console.log(`After attestation: ${result.afterAttestationPath}`);
+        return;
+    }
+    bad(`${BOLD}NO VERIFIED REPAIR${RESET}${RED}${result.failureClass ? ` — ${result.failureClass}` : ""}`);
+    console.log(result.explanation);
+}
+function printRepairApplyResult(result) {
+    if (result.applied) {
+        ok(`${BOLD}APPLIED VERIFIED REPAIR${RESET}`);
+        console.log(result.explanation);
+        console.log(`Receipt: ${result.receiptPath}`);
+        return;
+    }
+    bad(`${BOLD}REPAIR NOT APPLIED${RESET}`);
+    console.log(result.explanation);
+}
+function rebaseRemoteRepairPaths(result, repo) {
+    const rebase = (value) => value
+        ? portableRelative(process.cwd(), path.join(repo, value))
+        : null;
+    return {
+        ...result,
+        receiptPath: rebase(result.receiptPath),
+        patchPath: rebase(result.patchPath),
+        afterAttestationPath: rebase(result.afterAttestationPath),
+    };
+}
 async function main() {
     const [cmd, ...rest] = process.argv.slice(2);
     if (!cmd || cmd === "help" || cmd === "--help" || cmd === "-h")
@@ -164,7 +220,7 @@ async function main() {
     let target = path.resolve(targetInput);
     let remote = null;
     let remoteSource = null;
-    if (["analyze", "plan", "up"].includes(cmd) && isRemoteTarget(targetInput)) {
+    if (["analyze", "plan", "up", "fix"].includes(cmd) && isRemoteTarget(targetInput)) {
         if (flags["dry-run"]) {
             const explanation = "Remote dry runs are refused because cloning would write files, while BootProof dry runs promise to write nothing.";
             if (flags.json)
@@ -175,12 +231,12 @@ async function main() {
             return;
         }
         try {
-            remote = cloneGithubRemote(targetInput, process.cwd());
+            remote = cloneRemoteTarget(targetInput, process.cwd());
             target = remote.repoPath;
             remoteSource = remote.canonicalUrl;
             if (!flags.json) {
                 console.log(`${DIM}Remote source: ${remote.canonicalUrl}${RESET}`);
-                console.log(`${DIM}Clone retained at: ${path.relative(process.cwd(), remote.repoPath)}${RESET}`);
+                console.log(`${DIM}Clone retained at: ${portableRelative(process.cwd(), remote.repoPath)}${RESET}`);
             }
         }
         catch (error) {
@@ -193,14 +249,14 @@ async function main() {
             return;
         }
     }
-    if (!remote && ["analyze", "plan", "up"].includes(cmd)) {
+    if (!remote && ["analyze", "plan", "up", "fix"].includes(cmd)) {
         remoteSource = managedRemoteSource(target);
         if (remoteSource && !flags.json) {
             console.log(`${DIM}Managed remote source: ${remoteSource}${RESET}`);
         }
     }
     const evidencePath = remote
-        ? path.relative(process.cwd(), attestationPath(target))
+        ? portableRelative(process.cwd(), attestationPath(target))
         : ".bootproof/attestation.json";
     if (cmd === "analyze") {
         const inf = inferRepo(target, { workspace: flags.workspace });
@@ -223,6 +279,110 @@ async function main() {
             console.log(`${DIM}--- .env.bootproof.example (preview) ---\n${envExampleFor(inf)}${RESET}`);
         return;
     }
+    if (cmd === "apply-repair") {
+        if (isRemoteTarget(targetInput)) {
+            const result = {
+                schema: "bootproof/repair-apply-result/v1",
+                applied: false,
+                receiptPath: String(flags.receipt ?? ".bootproof/repair-receipt.json"),
+                filesChanged: [],
+                explanation: "apply-repair requires a local working tree; use the retained managed clone path for a remote repair",
+            };
+            if (flags.json)
+                console.log(JSON.stringify(result));
+            else
+                printRepairApplyResult(result);
+            process.exitCode = 1;
+            return;
+        }
+        if (flags["dry-run"]) {
+            const result = {
+                schema: "bootproof/repair-apply-result/v1",
+                applied: false,
+                receiptPath: String(flags.receipt ?? ".bootproof/repair-receipt.json"),
+                filesChanged: [],
+                explanation: "Dry run — no repair files were applied.",
+            };
+            if (flags.json)
+                console.log(JSON.stringify(result));
+            else
+                printRepairApplyResult(result);
+            process.exitCode = 1;
+            return;
+        }
+        const receipt = flags.receipt
+            ? path.resolve(String(flags.receipt))
+            : path.join(target, ".bootproof", "repair-receipt.json");
+        const result = applyVerifiedRepair(target, receipt);
+        if (flags.json)
+            console.log(JSON.stringify(result));
+        else
+            printRepairApplyResult(result);
+        process.exitCode = result.applied ? 0 : 1;
+        return;
+    }
+    if (cmd === "fix") {
+        if (flags["dry-run"]) {
+            const result = {
+                schema: "bootproof/repair-result/v1",
+                repaired: false,
+                failureClass: null,
+                repairId: null,
+                receiptPath: null,
+                patchPath: null,
+                afterAttestationPath: null,
+                explanation: "Dry run — nothing was executed, nothing was written, and no repair proof exists.",
+            };
+            if (flags.json)
+                console.log(JSON.stringify(result));
+            else
+                printRepairResult(result);
+            process.exitCode = 1;
+            return;
+        }
+        const provider = flags.provider;
+        const timeoutMs = Number(flags.timeout ?? 60_000);
+        const port = flags.port === undefined ? undefined : Number(flags.port);
+        const optionError = provider !== undefined && provider !== "docker" && provider !== "local"
+            ? `invalid --provider value: ${String(provider)} (expected docker or local)`
+            : !Number.isFinite(timeoutMs) || timeoutMs <= 0
+                ? `invalid --timeout value: ${String(flags.timeout)} (expected a positive number)`
+                : port !== undefined && (!Number.isInteger(port) || port < 1 || port > 65_535)
+                    ? `invalid --port value: ${String(flags.port)} (expected an integer from 1 to 65535)`
+                    : null;
+        if (optionError) {
+            const result = {
+                schema: "bootproof/repair-result/v1",
+                repaired: false,
+                failureClass: null,
+                repairId: null,
+                receiptPath: null,
+                patchPath: null,
+                afterAttestationPath: null,
+                explanation: optionError,
+            };
+            if (flags.json)
+                console.log(JSON.stringify(result));
+            else
+                printRepairResult(result);
+            process.exitCode = 1;
+            return;
+        }
+        const repairResult = await repairRepo(target, {
+            provider: provider,
+            unsafeLocal: Boolean(flags["unsafe-local"]),
+            timeoutMs,
+            port,
+            remoteSource: remoteSource ?? undefined,
+        });
+        const result = remote ? rebaseRemoteRepairPaths(repairResult, target) : repairResult;
+        if (flags.json)
+            console.log(JSON.stringify(result));
+        else
+            printRepairResult(result);
+        process.exitCode = result.repaired ? 0 : 1;
+        return;
+    }
     if (cmd === "up") {
         const provider = flags.provider ?? "docker";
         const timeoutMs = Number(flags.timeout ?? 60_000);
@@ -298,11 +458,20 @@ async function main() {
     if (cmd === "verify") {
         const p = path.extname(target) === ".json" ? target : attestationPath(target);
         if (!fs.existsSync(p)) {
-            bad(`no attestation at ${p} — run bootproof up first, or this repo has no committed proof yet`);
+            bad(`no proof at ${p} — run bootproof up or bootproof fix first`);
             process.exitCode = 1;
             return;
         }
-        const att = JSON.parse(fs.readFileSync(p, "utf8"));
+        const proof = JSON.parse(fs.readFileSync(p, "utf8"));
+        if (isRepairReceipt(proof)) {
+            const valid = verifyRepairReceipt(proof);
+            (valid ? ok : bad)(`repair receipt signature ${valid ? "valid" : "INVALID"} (ed25519, trust-on-first-use)`);
+            console.log(`${DIM}failure=${proof.verification.before.failureClass} repair=${proof.repair.id} after=${proof.verification.after.healthObservation}${RESET}`);
+            if (!valid)
+                process.exitCode = 1;
+            return;
+        }
+        const att = proof;
         const sig = verifySignature(att);
         (sig ? ok : bad)(`signature ${sig ? "valid" : "INVALID"} (ed25519, trust-on-first-use)`);
         console.log(`Trust level: ${att.trust?.level ?? "legacy_unspecified"}`);
@@ -367,7 +536,29 @@ async function main() {
     }
     if (cmd === "explain") {
         const p = positional[0] ? path.resolve(positional[0]) : attestationPath(target);
-        const att = JSON.parse(fs.readFileSync(p, "utf8"));
+        const proof = JSON.parse(fs.readFileSync(p, "utf8"));
+        if (isRepairReceipt(proof)) {
+            const valid = verifyRepairReceipt(proof);
+            console.log(`${BOLD}Repair receipt explained${RESET}`);
+            console.log(`Signature: ${valid ? "valid" : "INVALID"}`);
+            if (!valid) {
+                console.log("The receipt has been tampered with or is malformed. Its repair claims are not trusted.");
+                process.exitCode = 1;
+                return;
+            }
+            console.log(`Before: NOT VERIFIED — ${proof.verification.before.failureClass}.`);
+            console.log(`Repair: ${proof.repair.id} (${proof.repair.kind}).`);
+            console.log(`After: BOOTED — ${proof.verification.after.healthObservation}.`);
+            console.log(`Description: ${proof.repair.description}`);
+            if (proof.repair.filesChanged.length)
+                console.log(`Files changed in sandbox: ${proof.repair.filesChanged.join(", ")}`);
+            if (proof.repair.planDelta)
+                console.log(`Plan delta: ${proof.repair.planDelta}`);
+            if (proof.repair.envDelta)
+                console.log(`Environment delta: ${proof.repair.envDelta}`);
+            return;
+        }
+        const att = proof;
         console.log(`${BOLD}Attestation explained${RESET}`);
         console.log(att.result.booted ? `This run BOOTED: ${att.result.healthObservation}.` : `This run did NOT verify. Failure class: ${att.result.failureClass}.`);
         console.log(`Trust level: ${att.trust?.level ?? "legacy_unspecified"}`);
@@ -392,9 +583,32 @@ async function main() {
 }
 main().catch(err => {
     const argv = process.argv.slice(2);
-    if (argv[0] === "up" && argv.includes("--json")) {
+    if (argv.includes("--json") && argv[0] === "up") {
         console.log(JSON.stringify(machineFailure(String(err?.message ?? err))));
     }
+    else if (argv.includes("--json") && argv[0] === "fix") {
+        const result = {
+            schema: "bootproof/repair-result/v1",
+            repaired: false,
+            failureClass: null,
+            repairId: null,
+            receiptPath: null,
+            patchPath: null,
+            afterAttestationPath: null,
+            explanation: String(err?.message ?? err),
+        };
+        console.log(JSON.stringify(result));
+    }
+    else if (argv.includes("--json") && argv[0] === "apply-repair") {
+        const result = {
+            schema: "bootproof/repair-apply-result/v1",
+            applied: false,
+            receiptPath: ".bootproof/repair-receipt.json",
+            filesChanged: [],
+            explanation: String(err?.message ?? err),
+        };
+        console.log(JSON.stringify(result));
+    }
     else {
         bad(String(err?.message ?? err));
     }

package/dist/diagnosis.js

@@ -30,6 +30,12 @@ export function diagnoseFailure(failureClass, evidence, explanation, inference)
                 whyRefused: "BootProof cannot yet orchestrate that multi-step application safely enough to claim a verified boot.",
                 safeNextStep: "Review the detected setup and service commands, complete the repository's documented initialization, then rerun when orchestration support is available.",
             };
+        case "orchestration_not_supported":
+            return {
+                whatHappened: explanation,
+                whyRefused: "The detected application requires backend/frontend or repository-specific orchestration that BootProof cannot yet execute safely.",
+                safeNextStep: "Use the repository's documented runbook. Treat this attestation as diagnosis only, not proof of a localhost boot.",
+            };
         case "workspace_ambiguous":
             if (/multiple workspaces in parallel|starts multiple workspaces in parallel/i.test(explanation)) {
                 return {
@@ -79,6 +85,12 @@ export function diagnoseFailure(failureClass, evidence, explanation, inference)
                 whyRefused: "BootProof cannot run the declared install or start command without that executable.",
                 safeNextStep: "Enable Corepack or install the repository's declared package manager, then rerun BootProof.",
             };
+        case "missing_runtime_tool":
+            return {
+                whatHappened: explanation,
+                whyRefused: "BootProof cannot execute the repository's explicit run path without its declared runtime or build tool.",
+                safeNextStep: "Install the required tool at a version supported by the repository, then rerun BootProof.",
+            };
         case "runtime_engine_mismatch":
             return {
                 whatHappened: "The available Node.js runtime does not satisfy the repository's declared engine requirement.",
@@ -87,7 +99,7 @@ export function diagnoseFailure(failureClass, evidence, explanation, inference)
             };
         case "missing_env_var":
             return {
-                whatHappened: "The application reported required environment configuration that is missing.",
+                whatHappened: explanation,
                 whyRefused: "BootProof will not invent secrets or write protected .env files to force startup.",
                 safeNextStep: "Provide the real required values using the repository's documented configuration path, then rerun BootProof.",
             };

package/dist/exec.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import http from "node:http";
 const TAIL = 4000;
 const tail = (s) => (s.length > TAIL ? s.slice(-TAIL) : s);
@@ -39,8 +39,9 @@ function killTree(pid, signal = "SIGTERM") {
     if (!pid)
         return;
     try {
-        if (process.platform === "win32")
-            process.kill(pid, signal);
+        if (process.platform === "win32") {
+            spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
+        }
         else
             process.kill(-pid, signal); // negative pid = whole process group
     }
@@ -116,7 +117,23 @@ function probe(url) {
     });
 }
 export function minimalEnv(extra = {}) {
-    const keep = ["PATH", "HOME", "USER", "SHELL", "TMPDIR", "TEMP", "LANG", "TERM", "NODE_OPTIONS", "COREPACK_HOME", "npm_config_cache"];
+    const keep = [
+        "PATH",
+        "HOME",
+        "USER",
+        "SHELL",
+        "TMPDIR",
+        "TEMP",
+        "LANG",
+        "TERM",
+        "NODE_OPTIONS",
+        "COREPACK_HOME",
+        "npm_config_cache",
+        "SystemRoot",
+        "SYSTEMROOT",
+        "ComSpec",
+        "PATHEXT",
+    ];
     const env = {};
     for (const k of keep)
         if (process.env[k])