dsh-composition-doctor 0.1.3 → 0.2.0

package/dist/core/composition-adapter.js

@@ -1,12 +1,13 @@
 import { parse } from 'yaml';
-function runtimeUnavailableDiagnostic() {
+import { tryDshDump } from './dsh-dump-provider.js';
+function runtimeUnavailableDiagnostic(detail = 'Static YAML was read, but actual resolved composition requires a public provider.') {
     return {
         id: 'runtime-composition-unavailable',
         severity: 'warning',
         title: 'Runtime composition is unavailable',
         evidence: [],
-        explanation: 'Static YAML was read, but actual resolved composition requires a public provider.',
-        remediation: 'Supply a public ResolvedCompositionProvider to resolve runtime composition.'
+        explanation: detail,
+        remediation: 'Install or explicitly provide a compatible public DSH dump provider; static findings remain bounded to the allow-listed metadata.'
     };
 }
 function parseFailedDiagnostic(file, error) {
@@ -14,7 +15,7 @@ function parseFailedDiagnostic(file, error) {
         id: 'composition-parse-failed',
         severity: 'warning',
         title: 'Composition YAML could not be parsed',
-        evidence: [{ source: file.relativePath, detail: error instanceof Error ? error.message : String(error) }],
+        evidence: [{ source: file.relativePath, detail: error instanceof Error ? error.message : String(error), evidenceKind: 'static' }],
         explanation: 'This static composition source was skipped because its YAML is invalid.',
         remediation: 'Correct the YAML syntax and run the static analysis again.'
     };
@@ -26,6 +27,14 @@ function isPlainObject(value) {
     const prototype = Object.getPrototypeOf(value);
     return prototype === Object.prototype || prototype === null;
 }
+function parseYamlValue(text) {
+    return parse(text, {
+        customTags: [
+            { tag: 'tag:yaml.org,2002:js', resolve: (value) => value },
+            { tag: 'tag:yaml.org,2002:js/function', resolve: (value) => value }
+        ]
+    });
+}
 function cloneProviderValue(value, seen = new WeakMap()) {
     if (value === null || typeof value !== 'object')
         return value;
@@ -49,7 +58,7 @@ function cloneProviderValue(value, seen = new WeakMap()) {
     return copy;
 }
 function staticRows(file) {
-    const parsed = parse(file.text);
+    const parsed = parseYamlValue(file.text);
     const entries = Array.isArray(parsed) ? parsed : isRecord(parsed) ? parsed.plugins : undefined;
     if (!Array.isArray(entries))
         return [];
@@ -66,49 +75,56 @@ function staticRows(file) {
         return [row];
     });
 }
-function staticManifestFacts(file) {
-    if (file.relativePath !== 'package.json')
-        return {};
-    try {
-        const manifest = JSON.parse(file.text);
-        const dependencies = manifest.dependencies !== null && typeof manifest.dependencies === 'object' ? manifest.dependencies : {};
-        const bundles = Object.entries(dependencies)
-            .filter((entry) => typeof entry[1] === 'string')
-            .map(([name, version]) => ({ name, version, source: file.relativePath, evidenceKind: 'static' }));
-        const peer = manifest.peerDependencies !== null && typeof manifest.peerDependencies === 'object' ? manifest.peerDependencies : {};
-        const peerRequirements = typeof manifest.name === 'string' ? [{
-                packageName: manifest.name, source: file.relativePath, evidenceKind: 'static',
-                ...(typeof peer.dsh === 'string' ? { dsh: peer.dsh } : {}),
-                ...(typeof peer.cordis === 'string' ? { cordis: peer.cordis } : {}),
-                ...(typeof peer.node === 'string' ? { node: peer.node } : {})
-            }] : [];
-        const supported = Array.isArray(manifest.os) ? manifest.os.filter((value) => typeof value === 'string') : [];
-        const platforms = typeof manifest.name === 'string' && supported.length > 0 ? [{ packageName: manifest.name, source: file.relativePath, evidenceKind: 'static', supported }] : [];
-        return { bundles, peerRequirements, platforms };
-    }
-    catch {
-        return {};
+function inventoryFacts(input) {
+    const bundles = [];
+    const peerRequirements = [];
+    const platforms = [];
+    for (const fact of input.installedPackages) {
+        bundles.push({
+            name: fact.name,
+            source: fact.packageJsonSource,
+            evidenceKind: 'static',
+            ...(fact.requestedSpec === undefined ? {} : { requestedSpec: fact.requestedSpec }),
+            ...(fact.installedVersion === undefined ? {} : { version: fact.installedVersion }),
+            ...(fact.gitRef === undefined ? {} : { gitRef: fact.gitRef }),
+            ...(fact.integrity === undefined ? {} : { integrity: fact.integrity }),
+            ...(fact.repository === undefined ? {} : { repository: fact.repository }),
+            ...(fact.modifiedAt === undefined ? {} : { modifiedAt: fact.modifiedAt })
+        });
+        if (fact.peerDsh !== undefined || fact.peerCordis !== undefined || fact.engineNode !== undefined) {
+            peerRequirements.push({ packageName: fact.name, source: fact.packageJsonSource, evidenceKind: 'static', ...(fact.peerDsh === undefined ? {} : { dsh: fact.peerDsh }), ...(fact.peerCordis === undefined ? {} : { cordis: fact.peerCordis }), ...(fact.engineNode === undefined ? {} : { node: fact.engineNode }) });
+        }
+        if (fact.platform !== undefined && fact.platform.length > 0)
+            platforms.push({ packageName: fact.name, source: fact.packageJsonSource, evidenceKind: 'static', supported: fact.platform });
     }
+    return { bundles, peerRequirements, platforms };
 }
 export async function resolveComposition(input, provider) {
     if (provider) {
         const providedRows = await provider.resolve(input);
         return {
             profileDir: input.profileDir,
-            rows: providedRows.map((row) => ({ ...cloneProviderValue(row), evidenceKind: 'resolved' })),
-            adapterDiagnostics: [], evidenceMode: 'resolved', metadataCoverage: input.metadataCoverage
+            rows: providedRows.map((row) => ({ ...cloneProviderValue(row), evidenceKind: 'composed' })),
+            adapterDiagnostics: [...input.inventoryDiagnostics], evidenceMode: 'composed', runtimeObservation: { observed: false, detail: 'A composition provider supplied a resolved tree; no runtime was started.' }, metadataCoverage: input.metadataCoverage, installedPackages: input.installedPackages
+        };
+    }
+    const resolved = await tryDshDump(input);
+    if (resolved !== undefined) {
+        return {
+            profileDir: input.profileDir,
+            rows: resolved.rows,
+            adapterDiagnostics: [...input.inventoryDiagnostics, ...resolved.diagnostics],
+            evidenceMode: 'composed',
+            runtimeObservation: { observed: false, detail: 'dump-config composes configuration without starting third-party runtime code.' },
+            metadataCoverage: input.metadataCoverage,
+            installedPackages: input.installedPackages,
+            ...inventoryFacts(input)
         };
     }
     const rows = [];
-    const bundles = [];
-    const peerRequirements = [];
-    const platforms = [];
-    const adapterDiagnostics = [runtimeUnavailableDiagnostic()];
+    const facts = inventoryFacts(input);
+    const adapterDiagnostics = [...input.inventoryDiagnostics, runtimeUnavailableDiagnostic()];
     for (const file of input.files) {
-        const facts = staticManifestFacts(file);
-        bundles.push(...(facts.bundles ?? []));
-        peerRequirements.push(...(facts.peerRequirements ?? []));
-        platforms.push(...(facts.platforms ?? []));
         if (file.relativePath !== 'cordis.yml' && file.relativePath !== 'cordis.patch.yml')
             continue;
         try {
@@ -118,5 +134,5 @@ export async function resolveComposition(input, provider) {
             adapterDiagnostics.push(parseFailedDiagnostic(file, error));
         }
     }
-    return { profileDir: input.profileDir, rows, bundles, peerRequirements, platforms, adapterDiagnostics, evidenceMode: 'static', metadataCoverage: input.metadataCoverage };
+    return { profileDir: input.profileDir, rows, ...facts, installedPackages: input.installedPackages, adapterDiagnostics, evidenceMode: 'static', runtimeObservation: { observed: false, detail: 'Only allow-listed static metadata was inspected.' }, metadataCoverage: input.metadataCoverage };
 }

package/dist/core/composition-provenance.js

@@ -0,0 +1,8 @@
+export function rowEvidence(row) {
+    return {
+        source: row.source,
+        subject: row.id ?? row.name ?? 'anonymous-row',
+        detail: `${row.layer === undefined ? 'resolved row' : `layer ${row.layer}`} ${row.replacement === true ? 'replaces the previous row' : 'declared'}`,
+        evidenceKind: row.evidenceKind
+    };
+}

package/dist/core/diff.js

@@ -1,19 +1,12 @@
-import { satisfies as semverSatisfies } from 'semver';
+import { compare as semverCompare } from 'semver';
+import { isSnapshotV2, legacyPlugins } from './snapshot.js';
 function formatChange(change) {
     const before = change.before === undefined ? '' : ` before=${JSON.stringify(change.before)}`;
     const after = change.after === undefined ? '' : ` after=${JSON.stringify(change.after)}`;
     return `- **${change.kind}** \`${change.key}\`${before}${after}`;
 }
-/** Renders the semantic diff without hiding the evidence in a summary-only line. */
 export function renderSnapshotDiffMarkdown(diff) {
-    const sections = [
-        ['Plugins', diff.pluginChanges],
-        ['Cordis rows', diff.rowChanges],
-        ['Tool hooks', diff.hookChanges],
-        ['UI claims', diff.uiConflictChanges],
-        ['Peer requirements', diff.peerChanges],
-        ['Platform requirements', diff.platformChanges]
-    ];
+    const sections = [['Plugins', diff.pluginChanges], ['Cordis rows', diff.rowChanges], ['Tool hooks', diff.hookChanges], ['UI claims', diff.uiConflictChanges], ['Peer requirements', diff.peerChanges], ['Platform requirements', diff.platformChanges]];
     const body = sections.map(([title, values]) => `## ${title}\n\n${values.length === 0 ? 'No changes.' : values.map(formatChange).join('\n')}`).join('\n\n');
     const riskItems = diff.upgradeRisk.items.length === 0 ? '- None.' : diff.upgradeRisk.items.map((item) => `- ${item}`).join('\n');
     return `# DSH Composition Doctor Snapshot Diff\n\n${diff.upgradeRisk.summary}\n\n## Upgrade risk items\n\n${riskItems}\n\n${body}\n`;
@@ -22,13 +15,7 @@ function compareVersions(left, right) {
     if (left === undefined || right === undefined)
         return undefined;
     try {
-        if (semverSatisfies(left, `<${right}`, { includePrerelease: true }))
-            return -1;
-        if (semverSatisfies(left, `>${right}`, { includePrerelease: true }))
-            return 1;
-        if (semverSatisfies(left, `=${right}`, { includePrerelease: true }))
-            return 0;
-        return undefined;
+        return semverCompare(left, right, { includePrerelease: true });
     }
     catch {
         return undefined;
@@ -38,38 +25,50 @@ function changes(before, after, beforeKey, afterKey = beforeKey) {
     const previous = new Map(before.map((item) => [beforeKey(item), item]));
     const next = new Map(after.map((item) => [afterKey(item), item]));
     const result = [];
-    for (const itemKey of [...new Set([...previous.keys(), ...next.keys()])].sort()) {
-        const left = previous.get(itemKey);
-        const right = next.get(itemKey);
+    for (const key of [...new Set([...previous.keys(), ...next.keys()])].sort()) {
+        const left = previous.get(key);
+        const right = next.get(key);
         if (left === undefined)
-            result.push({ kind: 'added', key: itemKey, after: right });
+            result.push({ kind: 'added', key, after: right });
         else if (right === undefined)
-            result.push({ kind: 'removed', key: itemKey, before: left });
+            result.push({ kind: 'removed', key, before: left });
         else if (JSON.stringify(left) !== JSON.stringify(right))
-            result.push({ kind: 'changed', key: itemKey, before: left, after: right });
+            result.push({ kind: 'changed', key, before: left, after: right });
     }
     return result;
 }
+function normalize(snapshot) {
+    if (isSnapshotV2(snapshot)) {
+        return {
+            plugins: legacyPlugins(snapshot), rows: snapshot.rows, hooks: snapshot.hooks, uiClaims: snapshot.uiClaims,
+            peers: snapshot.packages.map((item) => ({ packageName: item.name, source: item.packageJsonSource, dsh: item.peerDsh, cordis: item.peerCordis, node: item.engineNode })),
+            platforms: snapshot.packages.map((item) => ({ packageName: item.name, source: item.packageJsonSource, supported: item.platform })), identityPrefix: ''
+        };
+    }
+    return { plugins: snapshot.plugins, rows: snapshot.rows, hooks: snapshot.hooks, uiClaims: snapshot.uiClaims, peers: snapshot.peers, platforms: snapshot.platforms, identityPrefix: `${snapshot.profile.path}:${snapshot.profile.packageName ?? ''}:` };
+}
 export function diffSnapshots(before, after) {
-    const pluginKey = (profile, item) => `${profile.path}:${profile.packageName ?? ''}:${item.name}:${item.source}`;
-    const pluginChanges = changes(before.plugins, after.plugins, (item) => pluginKey(before.profile, item), (item) => pluginKey(after.profile, item)).map((change) => {
+    const left = normalize(before);
+    const right = normalize(after);
+    const pluginKey = (prefix, item) => `${prefix}${item.name}:${item.source}`;
+    const pluginChanges = changes(left.plugins, right.plugins, (item) => pluginKey(left.identityPrefix, item), (item) => pluginKey(right.identityPrefix, item)).map((change) => {
         const name = change.before?.name ?? change.after?.name ?? change.key;
         if (change.kind !== 'changed')
             return { ...change, name };
         const comparison = compareVersions(change.before?.version, change.after?.version);
         return { ...change, name, kind: comparison === undefined ? 'changed' : comparison < 0 ? 'upgraded' : comparison > 0 ? 'downgraded' : 'changed' };
     });
-    const rowChanges = changes(before.rows, after.rows, (item) => `${item.source}:${item.id ?? item.name ?? ''}`);
-    const hookChanges = changes(before.hooks, after.hooks, (item) => `${item.source}:${item.hook}:${item.packageName ?? ''}`);
-    const uiConflictChanges = changes(before.uiClaims, after.uiClaims, (item) => `${item.kind}:${item.value}:${item.source}`);
-    const peerChanges = changes(before.peers, after.peers, (item) => `${item.source}:${item.packageName}`);
-    const platformChanges = changes(before.platforms, after.platforms, (item) => `${item.source}:${item.packageName}`);
+    const rowChanges = changes(left.rows, right.rows, (item) => `${item.source}:${item.id ?? item.name ?? ''}`);
+    const hookChanges = changes(left.hooks, right.hooks, (item) => `${item.source}:${item.hook}:${item.packageName ?? ''}`);
+    const uiConflictChanges = changes(left.uiClaims, right.uiClaims, (item) => `${item.kind}:${item.value}:${item.source}`);
+    const peerChanges = changes(left.peers, right.peers, (item) => `${item.source ?? ''}:${item.packageName ?? ''}`);
+    const platformChanges = changes(left.platforms, right.platforms, (item) => `${item.source ?? ''}:${item.packageName ?? ''}`);
     const items = pluginChanges.filter((change) => change.kind === 'downgraded' || change.kind === 'upgraded').map((change) => `${change.kind} plugin ${change.name}`);
     if (hookChanges.length > 0)
-        items.push('hook registrations changed; verify runtime ordering in an isolated fixture');
+        items.push('hook registrations changed; runtime ordering remains unverified');
     if (uiConflictChanges.length > 0)
         items.push('UI claims changed; verify ownership conflicts before upgrade');
     if (peerChanges.length > 0 || platformChanges.length > 0)
         items.push('peer or platform requirements changed; verify supported runtime facts');
-    return { pluginChanges, rowChanges, hookChanges, uiConflictChanges, peerChanges, platformChanges, upgradeRisk: { summary: items.length === 0 ? 'No upgrade risks detected from snapshot metadata.' : `Upgrade risk: ${items.join('; ')}. No migration was executed.`, items } };
+    return { pluginChanges, rowChanges, hookChanges, uiConflictChanges, peerChanges, platformChanges, upgradeRisk: { summary: items.length === 0 ? 'No risk indicators changed within the evidence covered by these snapshots.' : `Risk indicators changed: ${items.join('; ')}. No migration was executed.`, items } };
 }

package/dist/core/dsh-dump-parser.js

@@ -0,0 +1,111 @@
+import { parse } from 'yaml';
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+function rowsFrom(value) {
+    if (Array.isArray(value))
+        return value;
+    const object = record(value);
+    if (object === undefined)
+        return [];
+    for (const key of ['rows', 'plugins', 'composition']) {
+        if (Array.isArray(object[key]))
+            return object[key];
+    }
+    const config = record(object.config);
+    if (config !== undefined && Array.isArray(config.plugins))
+        return config.plugins;
+    return [];
+}
+function configKeys(value) {
+    const object = record(value);
+    return object === undefined ? undefined : Object.keys(object).sort();
+}
+function provenanceByRow(stdout) {
+    const result = [];
+    let current;
+    for (const line of stdout.split(/\r?\n/)) {
+        const comment = line.match(/^\s*#\s*==\s*(.+?)\s*$/);
+        if (comment !== null) {
+            current = comment[1];
+            continue;
+        }
+        if (current !== undefined && /^-\s/.test(line))
+            result.push(current);
+    }
+    return result;
+}
+function provenanceParts(label) {
+    if (label === undefined)
+        return {};
+    const parts = label.split(/,\s*patched by\s+/);
+    const source = parts[0];
+    const patches = parts.slice(1).flatMap((part) => part.split(/,\s+/)).filter(Boolean);
+    return { source, provenance: [source, ...patches] };
+}
+export function parseDshDump(stdout, stderr = '') {
+    let parsed;
+    try {
+        try {
+            parsed = JSON.parse(stdout);
+        }
+        catch {
+            parsed = parse(stdout, {
+                customTags: [
+                    { tag: 'tag:yaml.org,2002:js', resolve: (value) => value },
+                    { tag: 'tag:yaml.org,2002:js/function', resolve: (value) => value }
+                ]
+            });
+        }
+    }
+    catch (error) {
+        return {
+            rows: [],
+            diagnostics: [{
+                    id: 'composed-dump-parse-failed', severity: 'warning', title: 'Composed DSH dump could not be parsed',
+                    evidence: [{ source: '<DSH dump>', detail: error instanceof Error ? error.message : String(error), evidenceKind: 'composed' }],
+                    explanation: 'The public dump-config command returned output that was not valid JSON or YAML.',
+                    remediation: 'Use a verified DSH release whose public dump-config output is supported by this adapter.'
+                }]
+        };
+    }
+    const provenanceHints = provenanceByRow(stdout);
+    const legacyProvenanceHints = stdout.split(/\r?\n/).flatMap((line) => {
+        const match = line.match(/^\s*#\s*(?:source|from|file|layer)\s*[:=]\s*(.+?)\s*$/i);
+        return match === null ? [] : [match[1]];
+    });
+    const rawRows = rowsFrom(parsed);
+    const seenIds = new Map();
+    const rows = rawRows.flatMap((entry, index) => {
+        const object = record(entry);
+        if (object === undefined)
+            return [];
+        const provenance = provenanceParts(typeof object.source === 'string' ? object.source : provenanceHints[index] ?? legacyProvenanceHints[index]);
+        const source = typeof object.source === 'string' ? object.source : provenance.source ?? '<DSH dump>';
+        const config = object.config;
+        const row = {
+            ...(typeof object.id === 'string' ? { id: object.id } : {}),
+            ...(typeof object.name === 'string' ? { name: object.name } : typeof object.plugin === 'string' ? { name: object.plugin } : {}),
+            source,
+            ...(config === undefined ? {} : { config, ...(configKeys(config) === undefined ? {} : { configKeys: configKeys(config) }) }),
+            evidenceKind: 'composed',
+            ...(typeof object.layer === 'string' ? { layer: object.layer } : {}),
+            ...(typeof object.layerOrder === 'number' ? { layerOrder: object.layerOrder } : {}),
+            ...(provenance.provenance === undefined ? {} : { provenance: provenance.provenance }),
+            ...(object.replacement === true || object.overridden === true || (provenance.provenance !== undefined && provenance.provenance.length > 1) || (typeof object.id === 'string' && seenIds.has(object.id) && seenIds.get(object.id) !== source) ? { replacement: true } : {})
+        };
+        if (row.id !== undefined)
+            seenIds.set(row.id, row.source);
+        return [row];
+    });
+    const diagnostics = [];
+    const unmatched = stderr.match(/(?:patch[^\r\n]*(?:unmatched|unknown|not found)|(?:unmatched|unknown|not found)[^\r\n]*(?:patch|row|target))[^\r\n]*/gi) ?? [];
+    for (const detail of unmatched)
+        diagnostics.push({
+            id: 'unmatched-patch-target', severity: 'warning', title: 'Resolved patch target did not match a row',
+            evidence: [{ source: '<DSH stderr>', detail, evidenceKind: 'composed' }],
+            explanation: 'The public DSH dump reported a patch target that did not match a resolved row.',
+            remediation: 'Verify the patch row id against the selected bundle/profile composition.'
+        });
+    return { rows, diagnostics };
+}

package/dist/core/dsh-dump-provider.js

@@ -0,0 +1,93 @@
+import { mkdir, mkdtemp, rm, stat, writeFile } from 'node:fs/promises';
+import { execFile } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { extname, join } from 'node:path';
+import { promisify } from 'node:util';
+import { redactYamlPreservingTags, redact } from './redaction.js';
+import { parseDshDump } from './dsh-dump-parser.js';
+const execFileAsync = promisify(execFile);
+const yamlFiles = new Set(['cordis.yml', 'cordis.patch.yml']);
+function unavailable(reason) {
+    return {
+        id: 'runtime-composition-unavailable', severity: 'warning', title: 'Resolved composition is unavailable', evidence: [{ source: '<DSH provider>', detail: reason, evidenceKind: 'static' }],
+        explanation: 'The scan could not obtain final resolved rows from a public DSH dump-config provider, so it used bounded static evidence.',
+        remediation: 'Install a verified DSH CLI or pass a public provider in integration code; do not import private DSH loaders.'
+    };
+}
+function pathCandidates() {
+    const values = (process.env.PATH ?? '').split(process.platform === 'win32' ? ';' : ':').filter(Boolean);
+    return values.flatMap((directory) => process.platform === 'win32' ? [join(directory, 'dsh.cmd'), join(directory, 'dsh.exe'), join(directory, 'dsh')] : [join(directory, 'dsh')]);
+}
+async function findDsh() {
+    const explicit = process.env.DSH_DOCTOR_DSH_BIN;
+    const candidates = explicit === undefined ? pathCandidates() : [explicit];
+    for (const candidate of candidates) {
+        try {
+            if ((await stat(candidate)).isFile())
+                return candidate;
+        }
+        catch { /* executable lookup is best effort */ }
+    }
+    return undefined;
+}
+async function copyRehearsal(input, directory) {
+    for (const file of input.files) {
+        if (file.relativePath === 'package.json') {
+            await writeFile(join(directory, file.relativePath), `${JSON.stringify(redact(JSON.parse(file.text)), null, 2)}\n`, 'utf8');
+        }
+        else if (yamlFiles.has(file.relativePath)) {
+            await writeFile(join(directory, file.relativePath), redactYamlPreservingTags(file.text), 'utf8');
+        }
+    }
+}
+function runtimeUnknownDiagnostic(input) {
+    const tagged = input.files.find((file) => yamlFiles.has(file.relativePath) && /!<[^>]+>|!![A-Za-z0-9_/-]+/.test(file.text));
+    if (tagged === undefined)
+        return undefined;
+    return {
+        id: 'runtime-behavior-unverified', severity: 'warning', title: 'Runtime-dependent configuration remains unverified',
+        evidence: [{ source: tagged.relativePath, detail: 'A custom YAML tag or runtime expression was preserved for dump-config but was not executed.', evidenceKind: 'composed' }],
+        explanation: 'A composed configuration can be structurally resolved while runtime-dependent values remain unknown. dump-config is not a runtime observation.',
+        remediation: 'Keep runtime-observed claims separate unless a supported isolated runtime observation backend is explicitly available.'
+    };
+}
+export async function tryDshDump(input, options = {}) {
+    const dshBin = options.dshBin ?? await findDsh();
+    if (dshBin === undefined)
+        return undefined;
+    const directory = await mkdtemp(join(tmpdir(), 'dsh-doctor-dump-'));
+    try {
+        const home = join(directory, 'dsh-home');
+        const isolatedName = 'doctor-isolated';
+        const profile = join(home, 'profiles', isolatedName);
+        await mkdir(profile, { recursive: true });
+        await copyRehearsal(input, profile);
+        const env = { PATH: process.env.PATH, TEMP: process.env.TEMP, TMP: process.env.TMP, DSH_HOME: home };
+        const extension = extname(dshBin).toLowerCase();
+        const script = ['.js', '.mjs', '.cjs'].includes(extension);
+        const commandShim = process.platform === 'win32' && (extension === '.cmd' || extension === '.bat');
+        const executable = script ? process.execPath : commandShim ? (process.env.ComSpec ?? 'cmd.exe') : dshBin;
+        const args = script ? [dshBin, '--profile', isolatedName, '--dump-config'] : commandShim ? ['/d', '/s', '/c', `call "${dshBin}" --profile ${isolatedName} --dump-config`] : ['--profile', isolatedName, '--dump-config'];
+        try {
+            const result = await execFileAsync(executable, args, { cwd: directory, env, timeout: options.timeoutMs ?? 20_000, windowsHide: true, maxBuffer: 2 * 1024 * 1024 });
+            const parsed = parseDshDump(result.stdout, result.stderr);
+            const runtimeUnknown = runtimeUnknownDiagnostic(input);
+            return { rows: parsed.rows, diagnostics: runtimeUnknown === undefined ? parsed.diagnostics : [...parsed.diagnostics, runtimeUnknown] };
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            // The caller must keep the static rows when the public command cannot
+            // execute.  A default provider failure is represented by the bounded
+            // static-fallback diagnostic in composition-adapter.
+            void detail;
+            return undefined;
+        }
+    }
+    catch (error) {
+        void error;
+        return undefined;
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+}

package/dist/core/package-provenance.js

@@ -0,0 +1,80 @@
+import { createRequire } from 'node:module';
+import { readFile, realpath, stat } from 'node:fs/promises';
+import { dirname, isAbsolute, relative, resolve } from 'node:path';
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+function string(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function repositoryValue(value) {
+    if (typeof value === 'string')
+        return value;
+    const object = record(value);
+    return object === undefined ? undefined : string(object.url);
+}
+function gitRefFrom(repository, manifest) {
+    const explicit = string(manifest.gitHead);
+    if (explicit !== undefined)
+        return explicit;
+    const match = repository?.match(/#([0-9a-f]{7,40})$/i);
+    return match?.[1];
+}
+function packageJsonPath(profileDir, name) {
+    if (!/^(?:@[a-z0-9_.-]+\/)?[a-z0-9_.-]+$/i.test(name))
+        throw new Error(`Invalid bundle package name: ${name}`);
+    const require = createRequire(resolve(profileDir, 'package.json'));
+    return require.resolve(`${name}/package.json`);
+}
+function within(root, candidate) {
+    const relativePath = relative(root, candidate);
+    return relativePath === '' || (!relativePath.startsWith('..') && !isAbsolute(relativePath));
+}
+export async function inspectInstalledPackage(profileDir, name, requestedSpec) {
+    const profileRoot = await realpath(profileDir);
+    const source = packageJsonPath(profileDir, name);
+    const resolvedSource = await realpath(source);
+    if (!within(profileRoot, resolvedSource))
+        throw new Error(`Bundle package resolves outside the selected profile: ${name}`);
+    const manifest = JSON.parse(await readFile(resolvedSource, 'utf8'));
+    const dsh = record(manifest.dsh);
+    const bundle = record(dsh?.bundle);
+    const dist = record(manifest.dist);
+    const peers = record(manifest.peerDependencies);
+    const engines = record(manifest.engines);
+    const scripts = record(manifest.scripts);
+    const peerDsh = string(peers?.['@deepseek-ai/dsh']);
+    const peerCordis = string(peers?.['@deepseek-ai/cordis']) ?? string(peers?.cordis) ?? string(peers?.['@cordisjs/core']);
+    const engineNode = string(engines?.node);
+    const repository = repositoryValue(manifest.repository);
+    const fileStat = await stat(source);
+    const declaredPatch = string(bundle?.patch);
+    const patchPath = declaredPatch === undefined ? undefined : resolve(dirname(resolvedSource), declaredPatch);
+    if (patchPath !== undefined && !within(profileRoot, patchPath))
+        throw new Error(`Bundle patch resolves outside the selected profile: ${name}`);
+    const safePatch = patchPath === undefined ? undefined : await realpath(patchPath).then((resolvedPatch) => {
+        if (!within(profileRoot, resolvedPatch))
+            throw new Error(`Bundle patch resolves outside the selected profile: ${name}`);
+        return resolvedPatch;
+    }).catch((error) => {
+        if (error.code === 'ENOENT')
+            return patchPath;
+        throw error;
+    });
+    return {
+        name,
+        ...(requestedSpec === undefined ? {} : { requestedSpec }),
+        ...(string(manifest.version) === undefined ? {} : { installedVersion: string(manifest.version) }),
+        packageJsonSource: source,
+        ...(safePatch === undefined ? {} : { bundlePatch: safePatch }),
+        ...(repository === undefined ? {} : { repository }),
+        ...(gitRefFrom(repository, manifest) === undefined ? {} : { gitRef: gitRefFrom(repository, manifest) }),
+        ...(string(dist?.integrity) === undefined ? {} : { integrity: string(dist?.integrity) }),
+        modifiedAt: fileStat.mtime.toISOString(),
+        ...(Array.isArray(manifest.os) ? { platform: manifest.os.filter((item) => typeof item === 'string') } : {}),
+        ...(peerDsh === undefined ? {} : { peerDsh }),
+        ...(peerCordis === undefined ? {} : { peerCordis }),
+        ...(engineNode === undefined ? {} : { engineNode }),
+        ...(scripts === undefined ? {} : { lifecycleScripts: ['preinstall', 'install', 'postinstall', 'prepare'].filter((key) => typeof scripts[key] === 'string') })
+    };
+}