dsh-composition-doctor 0.1.3 → 0.2.1

package/dist/core/redaction.js

@@ -1,4 +1,5 @@
-const secretProperty = /key|token|secret|password|credential|authorization/i;
+import { visit, parseDocument, Scalar } from 'yaml';
+const secretProperty = /key|token|secret|password|credential|authorization|cookie|private|passphrase|session|env/i;
 export function redact(value) {
     const seen = new WeakMap();
     const visit = (current) => {
@@ -23,3 +24,29 @@ export function redact(value) {
     };
     return visit(value);
 }
+/**
+ * Redact YAML through its AST.  In particular, this preserves custom tags
+ * such as !!js instead of round-tripping through a plain JavaScript value.
+ * Tagged values are never executed.
+ */
+export function redactYamlPreservingTags(text) {
+    const document = parseDocument(text, { keepSourceTokens: true });
+    visit(document, {
+        Pair: (_key, pair) => {
+            const key = pair.key instanceof Scalar ? String(pair.key.value) : String(pair.key ?? '');
+            if (!secretProperty.test(key))
+                return;
+            if (pair.value instanceof Scalar) {
+                pair.value.value = '[REDACTED]';
+            }
+            else {
+                // A secret collection is replaced as a scalar; no value is evaluated,
+                // and an unsupported collection shape is not silently copied.
+                pair.value = document.createNode('[REDACTED]');
+            }
+        }
+    });
+    if (document.errors.length > 0)
+        throw document.errors[0];
+    return String(document);
+}

package/dist/core/rules.js

@@ -64,9 +64,9 @@ function peerDiagnostics(model) {
 function bundleDiagnostics(bundles) {
     const diagnostics = [];
     for (const bundle of bundles) {
-        if (bundle.gitRef !== undefined && bundle.gitRef.length > 0)
+        if ((bundle.gitRef !== undefined && bundle.gitRef.length > 0) || (bundle.integrity !== undefined && bundle.integrity.length > 0))
             continue;
-        diagnostics.push(diagnostic('missing-provenance', 'warning', 'Bundle provenance is unavailable', [evidence(bundle.source, bundle.name, 'No Git ref or immutable provenance was declared.', bundle.evidenceKind, bundle.name, bundle.version)], `The origin of ${bundle.name} cannot be verified from the selected metadata.`, 'Record an immutable Git ref, registry integrity hash, or other package provenance in the selected profile metadata.'));
+        diagnostics.push(diagnostic('missing-provenance', 'warning', 'Bundle provenance is unavailable', [evidence(bundle.source, bundle.name, 'No Git ref or registry integrity was observed.', bundle.evidenceKind, bundle.name, bundle.version)], `The origin of ${bundle.name} cannot be verified from the selected metadata.`, 'Record an immutable Git ref or registry integrity hash in the selected package metadata.'));
     }
     for (const [name, group] of groups(bundles.filter((bundle) => bundle.profile !== undefined), (bundle) => bundle.name)) {
         if (new Set(group.map((bundle) => bundle.version ?? 'unknown')).size < 2)
@@ -75,22 +75,69 @@ function bundleDiagnostics(bundles) {
     }
     return diagnostics;
 }
-export function analyseComposition(model) {
-    const diagnostics = [...model.adapterDiagnostics];
-    for (const [id, rows] of groups(model.rows.filter((row) => row.id !== undefined), (row) => row.id)) {
-        if (rows.length < 2)
+function rowKeys(row) {
+    if (row.configKeys !== undefined)
+        return new Set(row.configKeys);
+    if (row.config !== null && typeof row.config === 'object' && !Array.isArray(row.config))
+        return new Set(Object.keys(row.config));
+    return new Set();
+}
+function rowDiagnostics(rows) {
+    const diagnostics = [];
+    for (const [id, group] of groups(rows.filter((row) => row.id !== undefined), (row) => row.id)) {
+        const layers = groups(group, (row) => row.layer ?? row.source);
+        if (layers.size === 1 && group.length > 1) {
+            diagnostics.push(diagnostic('duplicate-row-in-same-layer', 'warning', 'Duplicate composition row id in one layer', group.map((row) => evidence(row.source, id, `row id ${id} is declared more than once in the same layer`, row.evidenceKind, row.name)), `The DSH public row semantics do not establish which declaration should win within one layer for ${id}.`, 'Give the row a unique id or verify the final resolved tree with a public dump provider.'));
             continue;
-        diagnostics.push(diagnostic('duplicate-row-id', 'error', 'Duplicate composition row id', rows.map((row) => evidence(row.source, id, `row id ${id}`, row.evidenceKind, row.name)), `Multiple concrete composition rows claim the id ${id}.`, 'Give one row a unique id or remove the duplicate declaration.'));
+        }
+        if (layers.size < 2)
+            continue;
+        const ordered = [...group].sort((left, right) => (left.layerOrder ?? Number.MAX_SAFE_INTEGER) - (right.layerOrder ?? Number.MAX_SAFE_INTEGER));
+        const previous = ordered[ordered.length - 2];
+        const current = ordered[ordered.length - 1];
+        diagnostics.push(diagnostic('intentional-row-override', 'info', 'Later composition layer overrides a row', [evidence(previous.source, id, `row id ${id} is overridden by a later layer`, previous.evidenceKind, previous.name), evidence(current.source, id, `row id ${id} replaces the earlier row`, current.evidenceKind, current.name)], `The same row id occurs across layers, which is compatible with DSH patch precedence when the later layer intentionally owns the row.`, 'Confirm the resolved provenance and keep the override documented.'));
+        const missing = [...rowKeys(previous)].filter((key) => !rowKeys(current).has(key)).sort();
+        if (missing.length > 0 && (current.replacement === true || current.configKeys !== undefined)) {
+            diagnostics.push(diagnostic('row-config-replacement-risk', 'warning', 'Row replacement drops earlier config keys', [evidence(current.source, id, `replacement omits keys: ${missing.join(', ')}`, current.evidenceKind, current.name)], `The later row replacement for ${id} does not contain all keys observed in the earlier config. Secret values are not included.`, 'Copy the required non-secret config keys into the replacing row or verify that their absence is intentional.'));
+        }
     }
-    for (const [claim, values] of groups(model.uiClaims ?? [], (value) => `${value.kind}:${value.value}`)) {
+    return diagnostics;
+}
+function uiMode(claim) {
+    if (claim.mode !== undefined)
+        return claim.mode;
+    if (claim.kind === 'sidebar')
+        return 'list-contribution';
+    if (claim.kind === 'web-route')
+        return 'exact-route';
+    return 'single-owner';
+}
+function uiDiagnostics(claims) {
+    const diagnostics = [];
+    for (const [claim, values] of groups(claims, (value) => `${uiMode(value)}:${value.kind}:${value.value}`)) {
         if (values.length < 2)
             continue;
-        diagnostics.push(diagnostic('ui-ownership-conflict', 'error', 'Duplicate UI ownership claim', values.map((value) => evidence(value.source, claim, `${value.kind} ${value.value}`, value.evidenceKind, value.packageName, value.version)), `Multiple concrete declarations claim the same ${claim} UI surface.`, 'Assign the UI surface to one package or give each declaration a distinct slot, layout, sidebar entry, or route.'));
+        const mode = uiMode(values[0]);
+        if (mode === 'list-contribution' && new Set(values.map((value) => value.contributionId ?? value.packageName ?? value.source)).size > 1)
+            continue;
+        const severity = mode === 'prefix-route' ? 'warning' : 'error';
+        const id = mode === 'exact-route' ? 'ui-exact-route-conflict' : mode === 'fallback-owner' ? 'ui-fallback-owner-conflict' : 'ui-ownership-conflict';
+        diagnostics.push(diagnostic(id, severity, mode === 'exact-route' ? 'Exact web route has multiple owners' : 'UI ownership claim conflicts', values.map((value) => evidence(value.source, claim, `${value.kind} ${value.value}`, value.evidenceKind, value.packageName, value.version)), mode === 'prefix-route' ? `Multiple prefix route claims may shadow one another; ownership is not proven.` : `Multiple concrete declarations claim the same ${claim} surface.`, 'Assign one owner, or provide distinct list contribution ids where the public UI API allows multiple contributors.'));
+    }
+    return diagnostics;
+}
+export function analyseComposition(model) {
+    const diagnostics = [...model.adapterDiagnostics];
+    const requestedMode = model.evidenceMode ?? 'static';
+    const runtimeObserved = requestedMode === 'runtime-observed' && model.runtimeObservation?.observed === true;
+    if (requestedMode === 'runtime-observed' && !runtimeObserved) {
+        diagnostics.push(diagnostic('runtime-observation-unavailable', 'warning', 'Runtime observation is unavailable', [], 'The model requested runtime-observed evidence without a successful isolated runtime observation.', 'Keep this finding composed or static until a supported isolation backend returns observed runtime facts.'));
     }
+    diagnostics.push(...rowDiagnostics(model.rows), ...uiDiagnostics(model.uiClaims ?? []));
     for (const [hook, values] of groups((model.hooks ?? []).filter((value) => value.hook === 'tools/pre-execute' || value.hook === 'tools/execute' || value.hook === 'tools/post-execute'), (value) => value.hook)) {
         if (values.length < 2)
             continue;
-        diagnostics.push(diagnostic('hook-order-risk', 'warning', 'Multiple tool waterfall registrations', values.map((value) => evidence(value.source, hook, `registered ${hook}`, value.evidenceKind, value.packageName, value.version)), `Multiple listeners register ${hook}; static metadata does not establish their runtime order.`, 'Declare explicit ordering where the public DSH API supports it, then verify the resolved hook order in an isolated fixture.'));
+        diagnostics.push(diagnostic('hook-order-risk', 'warning', 'Multiple tool waterfall registrations', values.map((value) => evidence(value.source, hook, `registered ${hook}`, value.evidenceKind, value.packageName, value.version)), `Multiple listeners register ${hook}; runtime listener order is unverified.`, 'Declare explicit ordering where the public DSH API supports it, then verify the resolved hook order in an isolated fixture.'));
     }
     for (const [path, writes] of groups(model.patchWrites ?? [], (write) => write.path)) {
         if (writes.length < 2)
@@ -101,12 +148,15 @@ export function analyseComposition(model) {
     const platform = model.runtime?.platform;
     for (const requirement of model.platforms ?? []) {
         const item = evidence(requirement.source, requirement.packageName, `supports ${requirement.supported.join(', ')}; observed ${platform ?? 'unknown'}`, requirement.evidenceKind, requirement.packageName);
-        if (platform === undefined || !requirement.supported.includes(platform)) {
+        const excluded = requirement.supported.includes(`!${platform ?? ''}`);
+        const positive = requirement.supported.filter((value) => !value.startsWith('!'));
+        const supported = platform !== undefined && !excluded && (positive.length === 0 || positive.includes(platform));
+        if (!supported) {
             diagnostics.push(diagnostic('platform-mismatch', 'warning', 'Declared platform does not include selected runtime', [item], platform === undefined ? `No runtime platform was supplied for ${requirement.packageName}.` : `${requirement.packageName} declares ${requirement.supported.join(', ')}, not ${platform}.`, 'Use a supported platform or verify an intentional override in an isolated fixture.'));
         }
     }
     diagnostics.sort((left, right) => left.id.localeCompare(right.id) || left.title.localeCompare(right.title) || left.evidence[0]?.source.localeCompare(right.evidence[0]?.source ?? '') || 0);
-    const evidenceMode = model.evidenceMode ?? 'static';
+    const evidenceMode = runtimeObserved ? 'runtime-observed' : requestedMode === 'runtime-observed' ? 'composed' : requestedMode;
     const unverifiedFindings = diagnostics.filter((item) => item.id === 'runtime-composition-unavailable' || item.evidence.some((entry) => entry.evidenceKind === 'static')).map((item) => item.id);
-    return { schemaVersion: 1, generatedAt: new Date().toISOString(), profileDir: model.profileDir, evidenceMode, ...(model.metadataCoverage === undefined ? {} : { metadataCoverage: model.metadataCoverage }), unverifiedFindings, diagnostics };
+    return { schemaVersion: 1, evidenceSchemaVersion: 2, generatedAt: new Date().toISOString(), profileDir: model.profileDir, evidenceMode, runtimeObserved, ...(model.metadataCoverage === undefined ? {} : { metadataCoverage: model.metadataCoverage }), unverifiedFindings, diagnostics };
 }

package/dist/core/snapshot.js

@@ -1,59 +1,79 @@
+import { basename, isAbsolute } from 'node:path';
+import { analyseComposition } from './rules.js';
 import { resolveComposition } from './composition-adapter.js';
-function isRecord(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
+function isRecord(value) { return value !== null && typeof value === 'object' && !Array.isArray(value); }
+function slashPath(value) { return value.replaceAll('\\', '/'); }
+function isWindowsAbsolute(value) { return /^[A-Za-z]:\//.test(value); }
+function normalizedSource(source, profileDir) {
+    const normalized = slashPath(source);
+    const root = slashPath(profileDir).replace(/\/+$/, '');
+    if (!isAbsolute(source) && !isWindowsAbsolute(normalized))
+        return normalized;
+    if (normalized === root)
+        return '<PROFILE>';
+    const prefix = `${root}/`;
+    return normalized.startsWith(prefix) ? `<PROFILE>/${normalized.slice(prefix.length)}` : `<EXTERNAL>/${basename(normalized)}`;
 }
-function stringMap(value) {
-    if (!isRecord(value))
-        return [];
-    return Object.entries(value).flatMap(([name, version]) => typeof version === 'string' ? [[name, version]] : []);
+function sortJson(values) { return [...values].sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right))); }
+function packageSnapshot(fact) {
+    return {
+        name: fact.name,
+        ...(fact.requestedSpec === undefined ? {} : { requestedSpec: fact.requestedSpec }),
+        ...(fact.installedVersion === undefined ? {} : { installedVersion: fact.installedVersion }),
+        packageJsonSource: `<BUNDLE:${fact.name}>/package.json`,
+        ...(fact.bundlePatch === undefined ? {} : { bundlePatch: `<BUNDLE:${fact.name}>/${basename(fact.bundlePatch)}` }),
+        ...(fact.repository === undefined ? {} : { repository: fact.repository }),
+        ...(fact.gitRef === undefined ? {} : { gitRef: fact.gitRef }),
+        ...(fact.integrity === undefined ? {} : { integrity: fact.integrity }),
+        ...(fact.platform === undefined ? {} : { platform: [...fact.platform].sort() }),
+        ...(fact.peerDsh === undefined ? {} : { peerDsh: fact.peerDsh }),
+        ...(fact.peerCordis === undefined ? {} : { peerCordis: fact.peerCordis }),
+        ...(fact.engineNode === undefined ? {} : { engineNode: fact.engineNode })
+    };
 }
-function sortBySource(values) {
-    return [...values].sort((left, right) => left.source.localeCompare(right.source) || JSON.stringify(left).localeCompare(JSON.stringify(right)));
+function packageFromBundle(bundle, profileDir) {
+    return { name: bundle.name, ...(bundle.requestedSpec === undefined ? {} : { requestedSpec: bundle.requestedSpec }), ...(bundle.version === undefined ? {} : { installedVersion: bundle.version }), packageJsonSource: normalizedSource(bundle.source, profileDir), ...(bundle.repository === undefined ? {} : { repository: bundle.repository }), ...(bundle.gitRef === undefined ? {} : { gitRef: bundle.gitRef }), ...(bundle.integrity === undefined ? {} : { integrity: bundle.integrity }) };
 }
-function manifestSnapshot(input) {
-    const file = input.files.find((candidate) => candidate.relativePath === 'package.json');
+function lockKind(input) {
+    const file = input?.files.find((item) => ['pnpm-lock.yaml', 'package-lock.json', 'yarn.lock'].includes(item.relativePath));
     if (file === undefined)
-        return { plugins: [], peers: [], platforms: [] };
+        return {};
+    return { kind: file.relativePath === 'pnpm-lock.yaml' ? 'pnpm' : file.relativePath === 'yarn.lock' ? 'yarn' : 'npm', lockfileHash: file.sha256 };
+}
+function snapshotFromModel(model, input) {
+    const profileDir = model.profileDir;
+    const report = analyseComposition(model);
+    const manifest = input?.files.find((candidate) => candidate.relativePath === 'package.json');
+    let profileName;
     try {
-        const manifest = JSON.parse(file.text);
-        const packageName = typeof manifest.name === 'string' ? manifest.name : undefined;
-        const plugins = [...stringMap(manifest.dependencies), ...stringMap(manifest.devDependencies)]
-            .map(([name, version]) => ({ name, version, source: file.relativePath }))
-            .sort((left, right) => left.name.localeCompare(right.name) || left.version.localeCompare(right.version));
-        const peers = packageName === undefined ? [] : [{
-                packageName,
-                source: file.relativePath,
-                ...Object.fromEntries(stringMap(manifest.peerDependencies).filter(([name]) => name === '@deepseek-ai/dsh' || name === '@deepseek-ai/cordis' || name === 'node').map(([name, range]) => [name === '@deepseek-ai/dsh' ? 'dsh' : name === '@deepseek-ai/cordis' ? 'cordis' : 'node', range]))
-            }];
-        const platforms = packageName === undefined || !Array.isArray(manifest.os) ? [] : [{ packageName, source: file.relativePath, supported: manifest.os.filter((platform) => typeof platform === 'string').sort() }];
-        return { ...(packageName === undefined ? {} : { packageName }), plugins, peers, platforms };
-    }
-    catch {
-        return { plugins: [], peers: [], platforms: [] };
+        profileName = manifest === undefined ? undefined : JSON.parse(manifest.text).name;
     }
-}
-function snapshotFromModel(model, profile, hashes, plugins = []) {
+    catch { /* hash-only metadata is still valid */ }
+    const packages = model.installedPackages?.map(packageSnapshot) ?? model.bundles?.map((bundle) => packageFromBundle(bundle, profileDir)) ?? [];
+    const hashes = Object.fromEntries((input?.files ?? []).filter((file) => ['package.json', 'pnpm-lock.yaml', 'package-lock.json', 'yarn.lock'].includes(file.relativePath)).map((file) => [file.relativePath, file.sha256]));
     return {
-        schemaVersion: 1,
-        profile,
-        plugins: [...plugins].sort((left, right) => left.name.localeCompare(right.name) || (left.version ?? '').localeCompare(right.version ?? '')),
-        rows: model.rows.map(({ id, name, source }) => ({ ...(id === undefined ? {} : { id }), ...(name === undefined ? {} : { name }), source })).sort((left, right) => left.source.localeCompare(right.source) || (left.id ?? '').localeCompare(right.id ?? '')),
-        hooks: sortBySource((model.hooks ?? []).map(({ hook, source, packageName, version }) => ({ hook, source, ...(packageName === undefined ? {} : { packageName }), ...(version === undefined ? {} : { version }) }))),
-        uiClaims: sortBySource((model.uiClaims ?? []).map(({ kind, value, source, packageName, version }) => ({ kind, value, source, ...(packageName === undefined ? {} : { packageName }), ...(version === undefined ? {} : { version }) }))),
-        peers: sortBySource((model.peerRequirements ?? []).map(({ packageName, source, dsh, cordis, node }) => ({ packageName, source, ...(dsh === undefined ? {} : { dsh }), ...(cordis === undefined ? {} : { cordis }), ...(node === undefined ? {} : { node }) }))),
-        platforms: sortBySource((model.platforms ?? []).map(({ packageName, source, supported }) => ({ packageName, source, supported: [...supported].sort() }))),
-        bundles: sortBySource((model.bundles ?? []).map(({ name, version, source, gitRef, profile: bundleProfile }) => ({ name, source, ...(version === undefined ? {} : { version }), ...(gitRef === undefined ? {} : { gitRef }), ...(bundleProfile === undefined ? {} : { profile: bundleProfile }) }))),
+        schemaVersion: 2,
+        doctorVersion: '0.1.3',
+        runtime: { ...(model.runtime?.dsh === undefined ? {} : { dsh: model.runtime.dsh }), ...(model.runtime?.cordis === undefined ? {} : { cordis: model.runtime.cordis }), node: model.runtime?.node ?? process.versions.node, platform: model.runtime?.platform ?? process.platform },
+        profile: { ...(profileName === undefined ? {} : { name: profileName }), ...(manifest === undefined ? {} : { manifestHash: manifest.sha256 }) },
+        packages: sortJson(packages),
+        rows: model.rows.map((row) => ({ ...(row.id === undefined ? {} : { id: row.id }), ...(row.name === undefined ? {} : { name: row.name }), source: normalizedSource(row.source, profileDir), ...(row.layer === undefined ? {} : { layer: row.layer }), ...(row.configKeys === undefined ? {} : { configKeys: [...row.configKeys].sort() }), ...(row.replacement === true ? { replacement: true } : {}) })).sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right))),
+        hooks: sortJson((model.hooks ?? []).map(({ hook, source, packageName, version }) => ({ hook, source: normalizedSource(source, profileDir), ...(packageName === undefined ? {} : { packageName }), ...(version === undefined ? {} : { version }) }))),
+        uiClaims: sortJson((model.uiClaims ?? []).map(({ kind, value, source, packageName, version, mode, contributionId }) => ({ kind, value, source: normalizedSource(source, profileDir), ...(packageName === undefined ? {} : { packageName }), ...(version === undefined ? {} : { version }), ...(mode === undefined ? {} : { mode }), ...(contributionId === undefined ? {} : { contributionId }) }))),
+        conflicts: sortJson(report.diagnostics.map((item) => ({ id: item.id, severity: item.severity, subjects: item.evidence.map((entry) => `${normalizedSource(entry.source, profileDir)}:${entry.subject ?? ''}`).sort() }))),
+        packageManager: lockKind(input),
         hashes
     };
 }
-/** Creates a structural, redacted snapshot from already allow-listed profile input or a resolved model. */
 export async function createSnapshot(input) {
-    if ('files' in input) {
-        const manifest = manifestSnapshot(input);
-        const hashes = Object.fromEntries(input.files
-            .filter((file) => file.relativePath === 'package.json' || file.relativePath === 'pnpm-lock.yaml' || file.relativePath === 'package-lock.json' || file.relativePath === 'yarn.lock')
-            .map((file) => [file.relativePath, file.sha256]));
-        return snapshotFromModel(await resolveComposition(input), { path: input.profileDir, ...(manifest.packageName === undefined ? {} : { packageName: manifest.packageName }) }, hashes, manifest.plugins);
-    }
-    return snapshotFromModel(input, { path: input.profileDir }, {}, input.bundles?.map(({ name, version, source }) => ({ name, source, ...(version === undefined ? {} : { version }) })) ?? []);
+    if ('files' in input)
+        return snapshotFromModel(await resolveComposition(input), input);
+    return snapshotFromModel(input);
+}
+export function isSnapshotV2(value) { return isRecord(value) && value.schemaVersion === 2 && Array.isArray(value.packages) && isRecord(value.profile); }
+export function isSnapshotV1(value) { return isRecord(value) && value.schemaVersion === 1 && Array.isArray(value.plugins); }
+export function legacyPlugins(snapshot) {
+    if (isSnapshotV1(snapshot))
+        return snapshot.plugins;
+    return snapshot.packages.map((item) => ({ name: item.name, ...(item.installedVersion === undefined ? {} : { version: item.installedVersion }), source: item.packageJsonSource }));
 }

package/dist/plugin/index.js

@@ -7,6 +7,7 @@ export const name = 'dsh-composition-doctor';
 export const inject = ['webServer'];
 export const Config = z.object({ reportDir: z.string().default(defaultReportDirectory) });
 export const latestReportPath = '/dsh-composition-doctor/reports/latest';
+const maxReportBytes = 2 * 1024 * 1024;
 function reportDirectory(config) {
     return resolveReportDirectory(config.reportDir);
 }
@@ -34,8 +35,12 @@ async function latestReport(config) {
             const fileStat = await lstat(candidate);
             if (!fileStat.isFile())
                 continue;
+            if (fileStat.size > maxReportBytes)
+                continue;
             const text = await readFile(candidate, 'utf8');
-            JSON.parse(text);
+            const value = JSON.parse(text);
+            if (!isAnalysisReport(value))
+                continue;
             return text.endsWith('\n') ? text : `${text}\n`;
         }
         catch {
@@ -45,6 +50,13 @@ async function latestReport(config) {
     }
     return undefined;
 }
+function isAnalysisReport(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const report = value;
+    const legacy = report.evidenceSchemaVersion === undefined && report.evidenceMode === 'resolved';
+    return report.schemaVersion === 1 && (report.evidenceSchemaVersion === 2 || legacy) && Array.isArray(report.diagnostics) && (report.evidenceMode === 'static' || report.evidenceMode === 'composed' || report.evidenceMode === 'runtime-observed' || report.evidenceMode === 'mixed' || legacy) && typeof report.generatedAt === 'string' && (report.runtimeObserved === undefined || typeof report.runtimeObserved === 'boolean');
+}
 function route(config) {
     return {
         kind: 'exact',

package/dist/reports/markdown.js

@@ -1,7 +1,7 @@
 function formatEvidence(item) {
     const subject = item.subject === undefined ? '' : ` — ${item.subject}`;
     const packageLabel = item.packageName === undefined ? '' : ` (${item.packageName}${item.version === undefined ? '' : `@${item.version}`})`;
-    return `- \`${item.source}\`${subject}${packageLabel}: ${item.detail}`;
+    return `- [${item.evidenceKind}] \`${item.source}\`${subject}${packageLabel}: ${item.detail}`;
 }
 function formatDiagnostic(item) {
     const evidence = item.evidence.length === 0 ? '- No concrete source evidence was supplied.' : item.evidence.map(formatEvidence).join('\n');
@@ -11,5 +11,5 @@ export function renderMarkdown(report) {
     const summary = ['error', 'warning', 'info'].map((severity) => `${severity}: ${report.diagnostics.filter((item) => item.severity === severity).length}`).join(', ');
     const body = report.diagnostics.length === 0 ? 'No diagnostics were produced.' : report.diagnostics.map(formatDiagnostic).join('\n\n');
     const coverage = report.metadataCoverage === undefined ? '' : `\nMetadata coverage: ${report.metadataCoverage.mode}; unscanned: ${report.metadataCoverage.unscannedSurfaces.join('; ')}\n`;
-    return `# DSH Composition Doctor Report\n\nSchema: ${report.schemaVersion}\n\nProfile: \`${report.profileDir}\`\n\nGenerated: ${report.generatedAt}\n\nEvidence mode: ${report.evidenceMode}\n${coverage}\nSummary: ${summary}\n\n${body}\n`;
+    return `# DSH Composition Doctor Report\n\nSchema: ${report.schemaVersion}; evidence schema: ${report.evidenceSchemaVersion}\n\nProfile: \`${report.profileDir}\`\n\nGenerated: ${report.generatedAt}\n\nEvidence mode: ${report.evidenceMode}; runtime observed: ${report.runtimeObserved ? 'yes' : 'no'}\n${coverage}\nSummary: ${summary}\n\n${body}\n`;
 }

package/dist/reports/schema.js

@@ -0,0 +1,49 @@
+/** JSON Schema for the report wire format. Report schemaVersion remains 1;
+ * evidenceSchemaVersion is additive and separates evidence capability names. */
+export const analysisReportJsonSchema = {
+    $schema: 'https://json-schema.org/draft/2020-12/schema',
+    type: 'object',
+    required: ['schemaVersion', 'evidenceSchemaVersion', 'generatedAt', 'profileDir', 'evidenceMode', 'runtimeObserved', 'unverifiedFindings', 'diagnostics'],
+    properties: {
+        schemaVersion: { const: 1 },
+        evidenceSchemaVersion: { const: 2 },
+        generatedAt: { type: 'string' },
+        profileDir: { type: 'string' },
+        evidenceMode: { enum: ['static', 'composed', 'runtime-observed', 'mixed'] },
+        runtimeObserved: { type: 'boolean' },
+        unverifiedFindings: { type: 'array', items: { type: 'string' } },
+        diagnostics: {
+            type: 'array',
+            items: {
+                type: 'object',
+                required: ['id', 'severity', 'title', 'evidence', 'explanation', 'remediation'],
+                properties: {
+                    id: { type: 'string' },
+                    severity: { enum: ['info', 'warning', 'error'] },
+                    title: { type: 'string' },
+                    explanation: { type: 'string' },
+                    remediation: { type: 'string' },
+                    evidence: {
+                        type: 'array',
+                        items: {
+                            type: 'object',
+                            required: ['source', 'detail', 'evidenceKind'],
+                            properties: {
+                                source: { type: 'string' },
+                                detail: { type: 'string' },
+                                evidenceKind: { enum: ['static', 'composed', 'runtime-observed'] },
+                                subject: { type: 'string' },
+                                packageName: { type: 'string' },
+                                version: { type: 'string' },
+                                severity: { enum: ['info', 'warning', 'error'] }
+                            },
+                            additionalProperties: false
+                        }
+                    }
+                },
+                additionalProperties: false
+            }
+        }
+    },
+    additionalProperties: true
+};

package/package.json

@@ -1,10 +1,17 @@
 {
   "name": "dsh-composition-doctor",
-  "version": "0.1.3",
+  "version": "0.2.1",
   "private": false,
   "description": "Read-only DSH and Cordis composition diagnostics, snapshots, diffs, and isolated preflight.",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/lemonxiny55/dsh-composition-doctor.git"
+  },
   "main": "./dist/plugin/index.js",
+  "bin": {
+    "dsh-doctor": "./dist/cli/main.js"
+  },
   "exports": {
     ".": "./dist/plugin/index.js",
     "./client": "./dist/client.js",
@@ -16,6 +23,7 @@
     "cordis.patch.yml",
     "README.md",
     "README.zh.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "dsh": {
@@ -37,13 +45,6 @@
   "engines": {
     "node": ">=20"
   },
-  "packageManager": "pnpm@10.17.1",
-  "scripts": {
-    "test": "pnpm build && vitest run",
-    "typecheck": "tsc --noEmit",
-    "build": "tsc && node scripts/build-client.mjs",
-    "dsh-doctor": "node dist/cli/main.js"
-  },
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.1",
     "semver": "^7.7.2",
@@ -54,5 +55,11 @@
     "esbuild": "^0.28.2",
     "typescript": "^5.9.2",
     "vitest": "^3.2.4"
+  },
+  "scripts": {
+    "test": "pnpm build && vitest run",
+    "typecheck": "tsc --noEmit",
+    "build": "tsc && node scripts/build-client.mjs",
+    "dsh-doctor": "node dist/cli/main.js"
   }
-}
+}