dsh-composition-doctor 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DSH Composition Doctor contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,70 @@
+# dsh-composition-doctor
+
+DeepSeek Harness (DSH) 的本地组合与升级预检插件。它只读取用户明确指定的 profile 元数据，输出有证据的 Cordis/插件组合诊断，并在独立临时目录中演练升级；不会修改真实 profile、安装或卸载插件，也不会扩大权限。
+
+## 中文
+
+### 功能
+
+- `scan`：分析显式 profile 的 composition，输出 JSON/Markdown。
+- `snapshot`：生成脱敏、可比较的 profile 快照和 lockfile 哈希。
+- `diff`：比较两个快照，识别插件升降级、rows、hooks、UI、peer/platform 变化。
+- `preflight`：在 OS 临时目录中进行离线解析和最小 smoke test；没有 `--allow-build` 时只输出构建计划。
+- DSH Settings 页面：只读显示最近报告、冲突关系和本地导出按钮。
+
+### 安装与卸载
+
+```powershell
+pnpm install
+pnpm build
+dsh plugin --profile <profile> add C:\path\to\dsh-composition-doctor
+dsh plugin --profile <profile> remove dsh-composition-doctor
+```
+
+命令行也可直接运行 `node dist/cli/main.js`（或 `pnpm dsh-doctor`）。
+
+### 使用
+
+```powershell
+dsh-doctor scan --profile .\test\fixtures\healthy --format both --output .\reports\healthy
+dsh-doctor snapshot --profile .\test\fixtures\healthy --output .\reports\before.json
+dsh-doctor diff --before .\reports\before.json --after .\reports\after.json --format both
+dsh-doctor preflight --profile .\test\fixtures\preflight-real-profile --target-dsh 0.1.0-rc.6 --candidate example-plugin@2.0.0
+```
+
+`--online` 只记录用户明确选择在线适配器的意图；当前实现仍不调用网络。`--allow-build` 是显式闸门，当前版本没有第三方构建 runner，因此不会执行生命周期脚本。
+
+### 输出示例
+
+```text
+warning  runtime-composition-unavailable
+  evidence: cordis.yml (static)
+  explanation: 未注入公开的 resolved-composition provider，静态 YAML 不能证明运行时加载结果。
+  remediation: 在隔离 fixture 中提供公开 provider 后重跑。
+```
+
+完整示例见 [`docs/examples/scan-report.md`](docs/examples/scan-report.md)。
+
+### 权限与隐私边界
+
+默认只读，只读取显式 profile 根目录的 `cordis.yml`、`cordis.patch.yml`、`package.json` 和 lockfile 元数据，并拒绝符号链接。不会读取 `.env`、密钥、token、环境变量值、会话正文或工作区文件内容，不联网，不安装/卸载/迁移，不切换权限模式。快照递归脱敏敏感字段并只保留结构摘要与 SHA-256。工具不提供“安全评分”，也不声称插件本身安全。
+
+### 支持范围与限制
+
+当前验证过的开发预览范围：DSH `>=0.1.0-rc.5 <0.2.0`、Cordis `>=4 <5`、Node `>=20`，Windows 优先且可在 macOS/Linux 使用。DSH 尚未公开稳定的 resolved composition introspection API；未注入 provider 时结果明确标记为 static，不能证明启动成功或失败。Settings 页面依赖公开 `settings.plugins.tab` slot，不使用私有图标或 loader API。
+
+## English
+
+`dsh-composition-doctor` is a local, read-only composition and upgrade preflight plugin for DeepSeek Harness. It analyses an explicitly selected profile, reports evidence-backed Cordis and plugin risks, snapshots redacted metadata, diffs snapshots, and rehearses upgrades in an isolated temporary directory. It never edits a real profile, installs or removes plugins, changes permissions, reads `.env`/keys/tokens/session/workspace contents, or performs network I/O by default. Findings are `info`, `warning`, or `error`; incomplete evidence is a warning, not a confirmed failure.
+
+Commands are `dsh-doctor scan`, `snapshot`, `diff`, and `preflight`; invocation examples are above. The Web Settings section is display/export only. Verified preview range: DSH `>=0.1.0-rc.5 <0.2.0`, Cordis `>=4 <5`, Node `>=20`. Runtime composition introspection is an injected public-provider boundary; static findings are labelled accordingly. See [`docs/compatibility.md`](docs/compatibility.md) and [`docs/examples/scan-report.md`](docs/examples/scan-report.md).
+
+## Development
+
+```powershell
+pnpm test
+pnpm typecheck
+pnpm build
+```
+
+Fixtures under `test/fixtures` cover healthy, duplicate row id, hook order, UI conflict, peer mismatch, redaction, and preflight isolation cases.

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: dsh-composition-doctor
+      name: dsh-composition-doctor

package/dist/cli/main.js

@@ -0,0 +1,133 @@
+import { fileURLToPath } from 'node:url';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { resolveComposition } from '../core/composition-adapter.js';
+import { diffSnapshots, renderSnapshotDiffMarkdown } from '../core/diff.js';
+import { readProfile } from '../core/profile-reader.js';
+import { createSnapshot } from '../core/snapshot.js';
+import { analyseComposition } from '../core/rules.js';
+import { renderJson } from '../reports/json.js';
+import { renderMarkdown } from '../reports/markdown.js';
+import { runPreflight } from '../core/preflight.js';
+const usage = 'Usage: dsh-doctor <scan | snapshot | diff | preflight>';
+const commands = new Set(['scan', 'snapshot', 'diff', 'preflight']);
+function option(argv, name) {
+    const index = argv.indexOf(name);
+    return index >= 0 && typeof argv[index + 1] === 'string' ? argv[index + 1] : undefined;
+}
+function options(argv, name) {
+    const values = [];
+    for (let index = 0; index < argv.length; index += 1) {
+        if (argv[index] === name && typeof argv[index + 1] === 'string')
+            values.push(argv[index + 1]);
+    }
+    return values;
+}
+function invalid(io, message) {
+    io.write(`Invalid command: ${message}`);
+    return 2;
+}
+async function scan(argv, io) {
+    const profile = option(argv, '--profile');
+    const output = option(argv, '--output');
+    const format = option(argv, '--format') ?? 'json';
+    if (profile === undefined || output === undefined)
+        return invalid(io, 'scan requires --profile and --output');
+    if (format !== 'json' && format !== 'markdown' && format !== 'both')
+        return invalid(io, '--format must be json, markdown, or both');
+    const report = analyseComposition(await resolveComposition(await readProfile({ profileDir: resolve(profile) })));
+    const destination = resolve(output);
+    await mkdir(destination, { recursive: true });
+    if (format === 'json' || format === 'both')
+        await writeFile(resolve(destination, 'report.json'), renderJson(report), 'utf8');
+    if (format === 'markdown' || format === 'both')
+        await writeFile(resolve(destination, 'report.md'), renderMarkdown(report), 'utf8');
+    io.write(`Wrote reports to ${destination}`);
+    return 0;
+}
+async function snapshot(argv, io) {
+    const profile = option(argv, '--profile');
+    const output = option(argv, '--output');
+    if (profile === undefined || output === undefined)
+        return invalid(io, 'snapshot requires --profile and --output');
+    const destination = resolve(output);
+    await writeFile(destination, `${JSON.stringify(await createSnapshot(await readProfile({ profileDir: resolve(profile) })), null, 2)}\n`, 'utf8');
+    io.write(`Wrote snapshot to ${destination}`);
+    return 0;
+}
+function isSnapshot(value) {
+    return value !== null && typeof value === 'object' && value.schemaVersion === 1;
+}
+async function diff(argv, io) {
+    const beforePath = option(argv, '--before');
+    const afterPath = option(argv, '--after');
+    const format = option(argv, '--format') ?? 'json';
+    if (beforePath === undefined || afterPath === undefined)
+        return invalid(io, 'diff requires --before and --after');
+    if (format !== 'json' && format !== 'markdown' && format !== 'both')
+        return invalid(io, '--format must be json, markdown, or both');
+    const before = JSON.parse(await readFile(resolve(beforePath), 'utf8'));
+    const after = JSON.parse(await readFile(resolve(afterPath), 'utf8'));
+    if (!isSnapshot(before) || !isSnapshot(after))
+        return invalid(io, 'diff inputs must be schema version 1 snapshots');
+    const result = diffSnapshots(before, after);
+    if (format === 'json' || format === 'both')
+        io.write(`${JSON.stringify(result, null, 2)}\n`);
+    if (format === 'markdown' || format === 'both')
+        io.write(renderSnapshotDiffMarkdown(result));
+    return 0;
+}
+async function preflight(argv, io) {
+    const profile = option(argv, '--profile');
+    const targetDsh = option(argv, '--target-dsh');
+    const output = option(argv, '--output');
+    if (profile === undefined || targetDsh === undefined)
+        return invalid(io, 'preflight requires --profile and --target-dsh');
+    const result = await runPreflight({
+        profileDir: resolve(profile),
+        targetDsh,
+        candidates: options(argv, '--candidate'),
+        allowBuild: argv.includes('--allow-build'),
+        online: argv.includes('--online'),
+        keepTemp: argv.includes('--keep-temp')
+    });
+    const rendered = `${JSON.stringify(result, null, 2)}\n`;
+    if (output === undefined)
+        io.write(rendered);
+    else {
+        const destination = resolve(output);
+        await mkdir(resolve(destination, '..'), { recursive: true });
+        await writeFile(destination, rendered, 'utf8');
+        io.write(`Wrote preflight report to ${destination}`);
+    }
+    return result.outcome === 'fail' ? 1 : 0;
+}
+export async function runCli(argv, io = { write: (line) => console.log(line) }) {
+    const command = argv[0];
+    if (argv.length === 0 || command === '--help') {
+        io.write(usage);
+        return 0;
+    }
+    if (!commands.has(command)) {
+        io.write(`Unknown command: ${command}`);
+        return 2;
+    }
+    try {
+        if (command === 'scan')
+            return await scan(argv.slice(1), io);
+        if (command === 'snapshot')
+            return await snapshot(argv.slice(1), io);
+        if (command === 'diff')
+            return await diff(argv.slice(1), io);
+        return await preflight(argv.slice(1), io);
+    }
+    catch (error) {
+        io.write(error instanceof Error ? error.message : String(error));
+        return 1;
+    }
+}
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+    runCli(process.argv.slice(2)).then((exitCode) => {
+        process.exitCode = exitCode;
+    });
+}

package/dist/client/index.js

@@ -0,0 +1,30 @@
+import { createReportView } from './report-view.js';
+export const name = 'dsh-composition-doctor';
+export const registration = Object.freeze({
+    id: name,
+    actions: ['export-json', 'export-markdown'],
+    component: () => createReportView()
+});
+export const apply = Object.assign((ctx) => {
+    const messages = {
+        zh: { title: 'DSH 组合医生', exportJson: '导出 JSON', exportMarkdown: '导出 Markdown' },
+        en: { title: 'DSH Composition Doctor', exportJson: 'Export JSON', exportMarkdown: 'Export Markdown' }
+    };
+    const disposeLocale = ctx.locale?.register('dshCompositionDoctor', messages);
+    const t = ctx.locale?.bind('dshCompositionDoctor') ?? ((key) => messages.en[key] ?? key);
+    const disposeSlot = ctx.slots.inject('settings.plugins.tab', () => ctx.slots.register({
+        name: 'settings.plugins.tab', id: registration.id, order: 70,
+        locale: 'dshCompositionDoctor', label: () => t('title')
+    }, () => createReportView(undefined, t)));
+    return () => {
+        if (typeof disposeSlot === 'function')
+            disposeSlot();
+        if (typeof disposeLocale === 'function')
+            disposeLocale();
+    };
+}, { inject: ['slots', 'locale'] });
+/** Stable, test-friendly metadata for the Web Settings contract. */
+export function clientRegistration() {
+    return registration;
+}
+export default apply;

package/dist/client/report-view.js

@@ -0,0 +1,92 @@
+import { renderMarkdown } from '../reports/markdown.js';
+export const clientReportPath = '/dsh-composition-doctor/reports/latest';
+export function buildConflictGraph(report) {
+    const nodes = new Map();
+    const edges = [];
+    for (const diagnostic of report.diagnostics) {
+        const evidence = diagnostic.evidence;
+        const evidenceNodes = evidence.map((item, index) => {
+            const id = `${diagnostic.id}:${index}`;
+            nodes.set(id, { id, label: item.subject ?? item.packageName ?? item.detail, source: item.source });
+            return id;
+        });
+        for (let index = 1; index < evidenceNodes.length; index += 1) {
+            edges.push({ from: evidenceNodes[0], to: evidenceNodes[index], diagnosticId: diagnostic.id });
+        }
+    }
+    return { nodes: [...nodes.values()], edges };
+}
+export function toReportViewModel(report) {
+    const counts = { info: 0, warning: 0, error: 0 };
+    for (const diagnostic of report.diagnostics)
+        counts[diagnostic.severity] += 1;
+    return { report, counts, graph: buildConflictGraph(report) };
+}
+function isReport(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    return candidate.schemaVersion === 1 && Array.isArray(candidate.diagnostics);
+}
+function text(document, value) {
+    return document.createTextNode(value);
+}
+function button(document, label, onClick) {
+    const element = document.createElement('button');
+    element.type = 'button';
+    element.textContent = label;
+    element.addEventListener('click', onClick);
+    return element;
+}
+async function fetchReport(fetcher = globalThis.fetch) {
+    const response = await fetcher(clientReportPath, { method: 'GET', cache: 'no-store' });
+    if (!response.ok)
+        throw new Error(`Report request failed (${response.status})`);
+    const value = await response.json();
+    if (!isReport(value))
+        throw new Error('The latest report has an unsupported schema.');
+    return value;
+}
+function download(document, content, filename, mime) {
+    const link = document.createElement('a');
+    link.href = URL.createObjectURL(new Blob([content], { type: mime }));
+    link.download = filename;
+    link.click();
+    URL.revokeObjectURL(link.href);
+}
+/**
+ * Browser-native settings section. It only performs a GET and offers local
+ * downloads; it contains no profile, package, configuration, or repair writes.
+ */
+export function createReportView(document = globalThis.document, translate = (key) => ({
+    title: 'DSH Composition Doctor', exportJson: 'Export JSON', exportMarkdown: 'Export Markdown', loading: 'Loading the latest local report…', unavailable: 'The latest report is unavailable.'
+}[key] ?? key)) {
+    const root = document.createElement('section');
+    root.dataset.plugin = nameForDom;
+    root.setAttribute('aria-labelledby', 'dsh-composition-doctor-title');
+    const heading = document.createElement('h2');
+    heading.id = 'dsh-composition-doctor-title';
+    heading.append(text(document, translate('title')));
+    root.append(heading);
+    const status = document.createElement('p');
+    status.textContent = translate('loading');
+    root.append(status);
+    const actions = document.createElement('p');
+    actions.append(button(document, translate('exportJson'), () => { void fetchReport().then((report) => download(document, `${JSON.stringify(report, null, 2)}\n`, 'dsh-composition-doctor-report.json', 'application/json')).catch(() => undefined); }), text(document, ' '), button(document, translate('exportMarkdown'), () => { void fetchReport().then((report) => download(document, renderMarkdown(report), 'dsh-composition-doctor-report.md', 'text/markdown')).catch(() => undefined); }));
+    root.append(actions);
+    void fetchReport().then((report) => {
+        const model = toReportViewModel(report);
+        status.textContent = `Diagnostics: ${model.counts.error} error, ${model.counts.warning} warning, ${model.counts.info} info. Conflict graph: ${model.graph.nodes.length} evidence nodes.`;
+        const list = document.createElement('ul');
+        for (const diagnostic of report.diagnostics) {
+            const item = document.createElement('li');
+            item.textContent = `[${diagnostic.severity}] ${diagnostic.title}`;
+            list.append(item);
+        }
+        root.append(list);
+    }).catch((error) => {
+        status.textContent = error instanceof Error ? error.message : translate('unavailable');
+    });
+    return root;
+}
+const nameForDom = 'dsh-composition-doctor';

package/dist/client.js

@@ -0,0 +1,204 @@
+window.__ModuleLoader__.load({
+	id: "dsh-composition-doctor",
+	factory: (require) => {
+		var module = { exports: {} };
+		var exports = module.exports;
+		"use strict";
+		var __defProp = Object.defineProperty;
+		var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+		var __getOwnPropNames = Object.getOwnPropertyNames;
+		var __hasOwnProp = Object.prototype.hasOwnProperty;
+		var __export = (target, all) => {
+		  for (var name2 in all)
+		    __defProp(target, name2, { get: all[name2], enumerable: true });
+		};
+		var __copyProps = (to, from, except, desc) => {
+		  if (from && typeof from === "object" || typeof from === "function") {
+		    for (let key of __getOwnPropNames(from))
+		      if (!__hasOwnProp.call(to, key) && key !== except)
+		        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+		  }
+		  return to;
+		};
+		var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+		
+		// src/client/index.ts
+		var index_exports = {};
+		__export(index_exports, {
+		  apply: () => apply,
+		  clientRegistration: () => clientRegistration,
+		  default: () => index_default,
+		  name: () => name,
+		  registration: () => registration
+		});
+		module.exports = __toCommonJS(index_exports);
+		
+		// src/reports/markdown.ts
+		function formatEvidence(item) {
+		  const subject = item.subject === void 0 ? "" : ` \u2014 ${item.subject}`;
+		  const packageLabel = item.packageName === void 0 ? "" : ` (${item.packageName}${item.version === void 0 ? "" : `@${item.version}`})`;
+		  return `- \`${item.source}\`${subject}${packageLabel}: ${item.detail}`;
+		}
+		function formatDiagnostic(item) {
+		  const evidence = item.evidence.length === 0 ? "- No concrete source evidence was supplied." : item.evidence.map(formatEvidence).join("\n");
+		  return `## [${item.severity.toUpperCase()}] ${item.title}
+		
+		${item.explanation}
+		
+		Evidence:
+		${evidence}
+		
+		Remediation: ${item.remediation}`;
+		}
+		function renderMarkdown(report) {
+		  const summary = ["error", "warning", "info"].map((severity) => `${severity}: ${report.diagnostics.filter((item) => item.severity === severity).length}`).join(", ");
+		  const body = report.diagnostics.length === 0 ? "No diagnostics were produced." : report.diagnostics.map(formatDiagnostic).join("\n\n");
+		  return `# DSH Composition Doctor Report
+		
+		Schema: ${report.schemaVersion}
+		
+		Profile: \`${report.profileDir}\`
+		
+		Generated: ${report.generatedAt}
+		
+		Summary: ${summary}
+		
+		${body}
+		`;
+		}
+		
+		// src/client/report-view.ts
+		var clientReportPath = "/dsh-composition-doctor/reports/latest";
+		function buildConflictGraph(report) {
+		  const nodes = /* @__PURE__ */ new Map();
+		  const edges = [];
+		  for (const diagnostic of report.diagnostics) {
+		    const evidence = diagnostic.evidence;
+		    const evidenceNodes = evidence.map((item, index) => {
+		      const id = `${diagnostic.id}:${index}`;
+		      nodes.set(id, { id, label: item.subject ?? item.packageName ?? item.detail, source: item.source });
+		      return id;
+		    });
+		    for (let index = 1; index < evidenceNodes.length; index += 1) {
+		      edges.push({ from: evidenceNodes[0], to: evidenceNodes[index], diagnosticId: diagnostic.id });
+		    }
+		  }
+		  return { nodes: [...nodes.values()], edges };
+		}
+		function toReportViewModel(report) {
+		  const counts = { info: 0, warning: 0, error: 0 };
+		  for (const diagnostic of report.diagnostics) counts[diagnostic.severity] += 1;
+		  return { report, counts, graph: buildConflictGraph(report) };
+		}
+		function isReport(value) {
+		  if (value === null || typeof value !== "object") return false;
+		  const candidate = value;
+		  return candidate.schemaVersion === 1 && Array.isArray(candidate.diagnostics);
+		}
+		function text(document, value) {
+		  return document.createTextNode(value);
+		}
+		function button(document, label, onClick) {
+		  const element = document.createElement("button");
+		  element.type = "button";
+		  element.textContent = label;
+		  element.addEventListener("click", onClick);
+		  return element;
+		}
+		async function fetchReport(fetcher = globalThis.fetch) {
+		  const response = await fetcher(clientReportPath, { method: "GET", cache: "no-store" });
+		  if (!response.ok) throw new Error(`Report request failed (${response.status})`);
+		  const value = await response.json();
+		  if (!isReport(value)) throw new Error("The latest report has an unsupported schema.");
+		  return value;
+		}
+		function download(document, content, filename, mime) {
+		  const link = document.createElement("a");
+		  link.href = URL.createObjectURL(new Blob([content], { type: mime }));
+		  link.download = filename;
+		  link.click();
+		  URL.revokeObjectURL(link.href);
+		}
+		function createReportView(document = globalThis.document, translate = (key) => ({
+		  title: "DSH Composition Doctor",
+		  exportJson: "Export JSON",
+		  exportMarkdown: "Export Markdown",
+		  loading: "Loading the latest local report\u2026",
+		  unavailable: "The latest report is unavailable."
+		})[key] ?? key) {
+		  const root = document.createElement("section");
+		  root.dataset.plugin = nameForDom;
+		  root.setAttribute("aria-labelledby", "dsh-composition-doctor-title");
+		  const heading = document.createElement("h2");
+		  heading.id = "dsh-composition-doctor-title";
+		  heading.append(text(document, translate("title")));
+		  root.append(heading);
+		  const status = document.createElement("p");
+		  status.textContent = translate("loading");
+		  root.append(status);
+		  const actions = document.createElement("p");
+		  actions.append(
+		    button(document, translate("exportJson"), () => {
+		      void fetchReport().then((report) => download(document, `${JSON.stringify(report, null, 2)}
+		`, "dsh-composition-doctor-report.json", "application/json")).catch(() => void 0);
+		    }),
+		    text(document, " "),
+		    button(document, translate("exportMarkdown"), () => {
+		      void fetchReport().then((report) => download(document, renderMarkdown(report), "dsh-composition-doctor-report.md", "text/markdown")).catch(() => void 0);
+		    })
+		  );
+		  root.append(actions);
+		  void fetchReport().then((report) => {
+		    const model = toReportViewModel(report);
+		    status.textContent = `Diagnostics: ${model.counts.error} error, ${model.counts.warning} warning, ${model.counts.info} info. Conflict graph: ${model.graph.nodes.length} evidence nodes.`;
+		    const list = document.createElement("ul");
+		    for (const diagnostic of report.diagnostics) {
+		      const item = document.createElement("li");
+		      item.textContent = `[${diagnostic.severity}] ${diagnostic.title}`;
+		      list.append(item);
+		    }
+		    root.append(list);
+		  }).catch((error) => {
+		    status.textContent = error instanceof Error ? error.message : translate("unavailable");
+		  });
+		  return root;
+		}
+		var nameForDom = "dsh-composition-doctor";
+		
+		// src/client/index.ts
+		var name = "dsh-composition-doctor";
+		var registration = Object.freeze({
+		  id: name,
+		  actions: ["export-json", "export-markdown"],
+		  component: () => createReportView()
+		});
+		var apply = Object.assign(
+		  (ctx) => {
+		    const messages = {
+		      zh: { title: "DSH \u7EC4\u5408\u533B\u751F", exportJson: "\u5BFC\u51FA JSON", exportMarkdown: "\u5BFC\u51FA Markdown" },
+		      en: { title: "DSH Composition Doctor", exportJson: "Export JSON", exportMarkdown: "Export Markdown" }
+		    };
+		    const disposeLocale = ctx.locale?.register("dshCompositionDoctor", messages);
+		    const t = ctx.locale?.bind("dshCompositionDoctor") ?? ((key) => messages.en[key] ?? key);
+		    const disposeSlot = ctx.slots.inject("settings.plugins.tab", () => ctx.slots.register({
+		      name: "settings.plugins.tab",
+		      id: registration.id,
+		      order: 70,
+		      locale: "dshCompositionDoctor",
+		      label: () => t("title")
+		    }, () => createReportView(void 0, t)));
+		    return () => {
+		      if (typeof disposeSlot === "function") disposeSlot();
+		      if (typeof disposeLocale === "function") disposeLocale();
+		    };
+		  },
+		  { inject: ["slots", "locale"] }
+		);
+		function clientRegistration() {
+		  return registration;
+		}
+		var index_default = apply;
+		
+		return module.exports;
+	}
+});

package/dist/core/composition-adapter.js

@@ -0,0 +1,91 @@
+import { parse } from 'yaml';
+function runtimeUnavailableDiagnostic() {
+    return {
+        id: 'runtime-composition-unavailable',
+        severity: 'warning',
+        title: 'Runtime composition is unavailable',
+        evidence: [],
+        explanation: 'Static YAML was read, but actual resolved composition requires a public provider.',
+        remediation: 'Supply a public ResolvedCompositionProvider to resolve runtime composition.'
+    };
+}
+function parseFailedDiagnostic(file, error) {
+    return {
+        id: 'composition-parse-failed',
+        severity: 'warning',
+        title: 'Composition YAML could not be parsed',
+        evidence: [{ source: file.relativePath, detail: error instanceof Error ? error.message : String(error) }],
+        explanation: 'This static composition source was skipped because its YAML is invalid.',
+        remediation: 'Correct the YAML syntax and run the static analysis again.'
+    };
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function isPlainObject(value) {
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function cloneProviderValue(value, seen = new WeakMap()) {
+    if (value === null || typeof value !== 'object')
+        return value;
+    const existing = seen.get(value);
+    if (existing !== undefined)
+        return existing;
+    if (Array.isArray(value)) {
+        const copy = [];
+        seen.set(value, copy);
+        for (const item of value)
+            copy.push(cloneProviderValue(item, seen));
+        return copy;
+    }
+    if (!isPlainObject(value))
+        return value;
+    const copy = Object.create(null);
+    seen.set(value, copy);
+    for (const property of Object.keys(value)) {
+        copy[property] = cloneProviderValue(value[property], seen);
+    }
+    return copy;
+}
+function staticRows(file) {
+    const parsed = parse(file.text);
+    const entries = Array.isArray(parsed) ? parsed : isRecord(parsed) ? parsed.plugins : undefined;
+    if (!Array.isArray(entries))
+        return [];
+    return entries.flatMap((entry) => {
+        if (!isRecord(entry))
+            return [];
+        const row = { source: file.relativePath, evidenceKind: 'static' };
+        if (typeof entry.id === 'string')
+            row.id = entry.id;
+        if (typeof entry.name === 'string')
+            row.name = entry.name;
+        if ('config' in entry)
+            row.config = entry.config;
+        return [row];
+    });
+}
+export async function resolveComposition(input, provider) {
+    if (provider) {
+        const providedRows = await provider.resolve(input);
+        return {
+            profileDir: input.profileDir,
+            rows: providedRows.map((row) => ({ ...cloneProviderValue(row), evidenceKind: 'resolved' })),
+            adapterDiagnostics: []
+        };
+    }
+    const rows = [];
+    const adapterDiagnostics = [runtimeUnavailableDiagnostic()];
+    for (const file of input.files) {
+        if (file.relativePath !== 'cordis.yml' && file.relativePath !== 'cordis.patch.yml')
+            continue;
+        try {
+            rows.push(...staticRows(file));
+        }
+        catch (error) {
+            adapterDiagnostics.push(parseFailedDiagnostic(file, error));
+        }
+    }
+    return { profileDir: input.profileDir, rows, adapterDiagnostics };
+}