dsh-plugin-local-infer 0.1.3 → 0.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-local-infer",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "publishConfig": {
     "access": "public"
   },
@@ -63,6 +63,11 @@
       "types": "./packages/ui/lib/index.d.ts",
       "default": "./packages/ui/lib/index.js"
     },
+    "./orchestrator": {
+      "types": "./packages/orchestrator/lib/index.d.ts",
+      "default": "./packages/orchestrator/lib/index.js"
+    },
+    "./orchestrator/locale/en.json": "./packages/orchestrator/locale/en.json",
     "./package.json": "./package.json"
   },
   "files": [
@@ -85,13 +90,18 @@
     "packages/tool/lib/**/*.d.ts",
     "packages/ui/package.json",
     "packages/ui/lib/**/*.js",
-    "packages/ui/lib/**/*.d.ts"
+    "packages/ui/lib/**/*.d.ts",
+    "packages/orchestrator/package.json",
+    "packages/orchestrator/lib/**/*.js",
+    "packages/orchestrator/lib/**/*.d.ts",
+    "packages/orchestrator/prompt.md",
+    "packages/orchestrator/locale/en.json"
   ],
   "peerDependencies": {
-    "@deepseek-ai/cordis": ">=4.0.5-alpha.2"
+    "@deepseek-ai/cordis": ">=4.0.6-alpha.2"
   },
   "scripts": {
-    "build": "tsc -b",
+    "build": "tsc -b && node scripts/build-client.mjs && node scripts/build-format.mjs",
     "typecheck": "tsc -b",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
@@ -100,13 +110,20 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^22.10.0",
-    "@vitest/coverage-v8": "^5.0.4",
-    "eslint": "^10.12.0",
+    "@types/node": "^26.6.6",
+    "@types/react": "^18.3.31",
+    "@types/react-dom": "^18.3.7",
+    "@vitest/coverage-v8": "^5.0.5",
+    "esbuild": "^0.28.2",
+    "eslint": "^10.14.0",
+    "eslint-plugin-react-hooks": "^7.1.1",
+    "jsdom": "^30.1.3",
+    "react": "^18.2.0",
+    "react-dom": "^18.3.1",
     "tsx": "^4.23.15",
-    "typescript": "^5.9.0",
-    "typescript-eslint": "^8.71.2",
-    "vite-tsconfig-paths": "^5.1.4",
-    "vitest": "^5.0.4"
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.72.1",
+    "vitest": "^5.0.5",
+    "yaml": "^2.4.2"
   }
 }

package/packages/core/lib/adapter.d.ts

@@ -32,8 +32,15 @@ export interface LaunchPlan {
     containerName?: string;
     modelId?: string;
     modelDirectory?: string;
+    modelFile?: string;
     port: number;
     healthUrl: string;
+    os?: 'linux' | 'windows' | 'macos';
+    configFile?: {
+        path: string;
+        content: string;
+    };
+    pid?: number;
 }
 /**
  * EnginePlatformConfig is the per-engine platform config the user adds for a
@@ -77,13 +84,19 @@ export interface ProcessExitInfo {
  * fired once with the ProcessExitInfo when the child ends (a crash, a signal
  * like a pkill, or a clean stop); a listener registered after the child has
  * already ended fires immediately. A host that cannot watch (a stub, or a
- * container it cannot read) omits it.
+ * container it cannot read) omits it. `hasExited`, when the host tracks the
+ * child's exit state, reports whether the child has settled (exited, been
+ * signalled, or failed to spawn): a state read a poll can check between
+ * attempts, separate from the one-shot onExit listener. A handle that cannot
+ * report its exit state (a stub) omits it, and a caller that cannot check
+ * falls back to the full poll.
  */
 export interface ProcessHandle {
     pid: number;
     kill(): void;
     logs?: string;
     onExit?(listener: (exit: ProcessExitInfo) => void): void;
+    hasExited?(): boolean;
 }
 /**
  * FetchResult is the answer to a health poll: the HTTP status and whether it
@@ -93,6 +106,24 @@ export interface FetchResult {
     status: number;
     ok: boolean;
 }
+/**
+ * RunOptions tunes a host command run: `shell` names the shell the command
+ * line runs in, read from the engine OS profile (the Windows vcpkg build route
+ * names pwsh.exe, because its steps set $env: variables). Absent runs
+ * the host's default shell. `signal` is the card's cancel: an abort kills the
+ * in-flight child (SIGINT, then SIGTERM), so a canceled Get/Launch download
+ * stops instead of running on behind the card. `graceMs` overrides the 5 s
+ * SIGTERM escalation window of that abort path, so a test can exercise the
+ * escalation without waiting. `needsSudo` declares that the command line runs
+ * sudo, stated by the caller (a hand-written link line), never parsed from
+ * the command text; the host applies the sudo-prompt rule to a declared run.
+ */
+export interface RunOptions {
+    shell?: string;
+    signal?: AbortSignal;
+    graceMs?: number;
+    needsSudo?: boolean;
+}
 /**
  * LifecycleHost is the injectable execution surface an adapter drives its
  * deploy, health-check, and stop steps through. The providers ship a node
@@ -102,7 +133,7 @@ export interface FetchResult {
  * DSH debug mode captures the full build-to-launch sequence the plugin runs.
  */
 export interface LifecycleHost {
-    run(command: string): Promise<CommandOutcome>;
+    run(command: string, options?: RunOptions): Promise<CommandOutcome>;
     /**
      * Optional: run a command line and stream each stdout/stderr chunk to
      * onOutput while it runs, so the Get step can append build output to the
@@ -111,8 +142,16 @@ export interface LifecycleHost {
      * build legitimately runs past any fixed cap, and the card prices a
      * stalled step with its own output-idle watchdog.
      */
-    runStream?(command: string, onOutput: (chunk: string) => void): Promise<CommandOutcome>;
+    runStream?(command: string, onOutput: (chunk: string) => void, options?: RunOptions): Promise<CommandOutcome>;
     spawn(argv: readonly string[], env: Record<string, string>, cwd?: string): ProcessHandle;
+    /**
+     * Optional: write a file to the host, creating missing parent directories.
+     * The deploy step calls it to land the rendered config file the plan's
+     * `configFile` names before the spawn, so the engine's config flag points
+     * at a path that exists. A host that cannot write files (a test stub)
+     * omits it, and the deploy step skips the write without failing.
+     */
+    writeFile?(path: string, content: string): Promise<void>;
     fetch(url: string): Promise<FetchResult>;
     debug?: DebugLogger;
 }
@@ -120,10 +159,16 @@ export interface LifecycleHost {
  * HealthCheckOptions tunes the poll: the interval between attempts and the
  * attempt cap. The service passes the config's healthPollMs and
  * healthMaxAttempts through; the adapter's defaults keep a bare call working.
+ * `onLog` is the launch run's log sink (the same sink LaunchOptions and
+ * DeployOptions carry): the health poll writes its `> GET <healthUrl>` line
+ * through it once before the first request and the settled verdict after, so
+ * the live run reads what the poll is waiting for. Absent (a headless poll)
+ * and the poll runs without logging.
  */
 export interface HealthCheckOptions {
     pollMs?: number;
     maxAttempts?: number;
+    onLog?: CommandLogger;
 }
 /**
  * LaunchStep is the phase of a launch the card's Launch control prices: the
@@ -135,13 +180,59 @@ export interface HealthCheckOptions {
  * rebuild. The card times out only the launch step; the rebuild steps (prereqs,
  * download, build) run as long as they need to.
  */
-export type LaunchStep = 'prereqs' | 'download' | 'build' | 'launch';
+/**
+ * LAUNCH_STEPS is the step-name tuple the LaunchStep union derives from: the
+ * one runtime home of the four phase names. The client machine mirrors the
+ * tuple as its LAUNCH_PHASE_STATES (the card bundle carries no core code); the
+ * ui suite pins the two sides equal so a name added on one side without the
+ * other fails a test, not the button.
+ */
+export declare const LAUNCH_STEPS: readonly ["prereqs", "download", "build", "launch"];
+/** The LaunchStep union, derived from the LAUNCH_STEPS tuple. */
+export type LaunchStep = (typeof LAUNCH_STEPS)[number];
 /**
  * LaunchProgress is the callback the launch flow calls as each phase begins.
  * The route threads it from the streamed launch response through the service
  * and the adapter's deploy step; a launch with no progress sink omits it.
  */
 export type LaunchProgress = (step: LaunchStep) => void;
+/**
+ * CommandLogger receives the `$ <command>` line of each mutating command the
+ * deploy and stop steps run, before the child spawns, so the run's log reads
+ * command first and the CLI's output after. The launch and stop run paths
+ * thread their run-log sink through this seam; a caller with no run log (a
+ * headless service call) passes none and the steps run as they did before.
+ */
+export type CommandLogger = (line: string) => void;
+/**
+ * COMMAND_LOG_PREFIX leads the exec audit rule's command line in every run
+ * log: `$ ` then the command, newline-terminated. Every exec site (the service
+ * runners, the adapters' auditRun, the acquire step's echo, the Get steps'
+ * extra-command emit) formats through commandLogLine, so the marker has one
+ * home. The marker is also exported for the test stubs that replay a real
+ * service or runner's writes.
+ */
+export declare const COMMAND_LOG_PREFIX = "$ ";
+/**
+ * commandLogLine formats one exec audit rule line: the COMMAND_LOG_PREFIX, the
+ * command, and the newline. The `$ <command>` line reaches the run's log sink
+ * before the child spawns.
+ */
+export declare function commandLogLine(command: string): string;
+/**
+ * URL_LOG_PREFIX leads the URL audit rule's request line in every run log:
+ * `> GET ` then the URL. The health polls format through urlLogLine, so the
+ * marker has one home (the exec rule's URL twin).
+ */
+export declare const URL_LOG_PREFIX = "> GET ";
+/**
+ * urlLogLine formats one URL audit rule line: the URL_LOG_PREFIX, the URL, an
+ * optional settled verdict word the poll appends after a space (`ready`,
+ * `still downloading: ...`), and the newline. The bare line reaches the run's
+ * log sink before the first request; the verdict line lands after the poll
+ * returns.
+ */
+export declare function urlLogLine(url: string, verdict?: string): string;
 /**
  * EngineLaunchState is the phase of an engine start the health poll reports:
  * downloading (the engine is fetching its engine or model files, the health
@@ -169,14 +260,33 @@ export interface HealthResult {
  * rebuilds the engine and leaves its binary out of the path links it into
  * /usr/local/bin; the gate decides whether that sudo link runs (on) or is
  * written to the card's Logs section for the user to run (off). `autoRebuild`
- * is the card's "Auto Rebuild" checkbox: when false, the git sync (fetch,
- * rebase, and the conditional rebuild) is skipped and the checkout launches
- * as-is. Absent reads as true (the rebuild runs).
+ * is the card's "Auto Rebuild" checkbox: when false, the engine acquisition
+ * steps (the git sync with its fetch, rebase, and conditional rebuild, the
+ * docker image pull, and the Strata binary installer) are skipped and the
+ * already-present checkout, image, or binary launches as-is. Absent reads as
+ * true (the acquisition runs), the rule every guard prices through
+ * autoRebuildEnabled. `onLog` is the launch run's
+ * log sink: a deploy that runs a mutating command (an image pull, a model
+ * download) writes its `$ <command>` line through it before the child spawns,
+ * so the launch's live run reads the command first. Absent (a headless
+ * launch) and the deploy runs without logging them.
  */
 export interface DeployOptions {
     allowRunDeps?: boolean;
     autoRebuild?: boolean;
+    onLog?: CommandLogger;
 }
+/**
+ * autoRebuildEnabled reports whether a launch's engine acquisition steps
+ * (the git sync with its conditional rebuild, the docker image pull, the
+ * Strata binary installer, the compose `--pull` mode, the Get steps'
+ * sync/build skip) run: the card's Auto Rebuild flag, with only an explicit
+ * false disabling them so the already-present checkout, image, or binary
+ * launches as-is. An absent flag (a CLI launch, a legacy caller) reads as
+ * enabled. Every guard prices the flag through this one predicate, so the
+ * absent-means-enabled rule cannot drift between adapters.
+ */
+export declare function autoRebuildEnabled(autoRebuild?: boolean): boolean;
 /**
  * DeployResult reports whether a build-or-pull succeeded, with a detail for the
  * UI. `handle` is the spawned engine process when the deploy step started one
@@ -215,7 +325,14 @@ export declare abstract class EngineAdapter {
     abstract renderLaunch(config: Config, hw: HardwareProfile): LaunchPlan;
     abstract healthCheck(plan: LaunchPlan, options?: HealthCheckOptions): Promise<HealthResult>;
     abstract deploy(plan: LaunchPlan, platform?: EnginePlatformConfig, onProgress?: LaunchProgress, options?: DeployOptions): Promise<DeployResult>;
-    abstract stop(plan: LaunchPlan): Promise<void>;
+    /**
+     * stop signals the engine the plan names. The optional `log` is the stop
+     * run's log sink: an adapter that stops through a command (compose down,
+     * docker stop, a pid signal) writes its `$ <command>` line through it
+     * before the child runs, so the stop's live run reads the command first.
+     * An adapter that only signals a tracked handle logs nothing.
+     */
+    abstract stop(plan: LaunchPlan, log?: CommandLogger): Promise<void>;
     /**
      * Optional: the host deps this engine's deploy step needs for a build mode,
      * declared by the adapter that knows its own toolchain. The service asks a
@@ -265,5 +382,12 @@ export declare abstract class EngineAdapter {
      * process omits it, and the reserve falls back to the GPU-usage rule.
      */
     launchSignature?(config?: Config): EngineLaunchSignature | undefined;
+    /**
+     * planKey is the children-map key an adapter tracks a spawned engine
+     * process under: the plan's engine id and port, the pair that identifies
+     * one running engine. The base class owns the rule, so every adapter
+     * tracks and stops the exact process it started.
+     */
+    protected planKey(plan: LaunchPlan): string;
 }
-//# sourceMappingURL=adapter.d.ts.map
+//# sourceMappingURL=adapter.d.ts.map

package/packages/core/lib/adapter.js

@@ -1,3 +1,67 @@
+/**
+ * LaunchStep is the phase of a launch the card's Launch control prices: the
+ * system-dependency install (prereqs), the model and git checkout download
+ * (download), the source build or image pull (build), and the health poll that
+ * waits for the engine to come ready (launch). The service and the adapters
+ * report the step as each phase begins, so the card's button reads the phase
+ * that is actually running instead of a single "Launching..." for the whole
+ * rebuild. The card times out only the launch step; the rebuild steps (prereqs,
+ * download, build) run as long as they need to.
+ */
+/**
+ * LAUNCH_STEPS is the step-name tuple the LaunchStep union derives from: the
+ * one runtime home of the four phase names. The client machine mirrors the
+ * tuple as its LAUNCH_PHASE_STATES (the card bundle carries no core code); the
+ * ui suite pins the two sides equal so a name added on one side without the
+ * other fails a test, not the button.
+ */
+export const LAUNCH_STEPS = ['prereqs', 'download', 'build', 'launch'];
+/**
+ * COMMAND_LOG_PREFIX leads the exec audit rule's command line in every run
+ * log: `$ ` then the command, newline-terminated. Every exec site (the service
+ * runners, the adapters' auditRun, the acquire step's echo, the Get steps'
+ * extra-command emit) formats through commandLogLine, so the marker has one
+ * home. The marker is also exported for the test stubs that replay a real
+ * service or runner's writes.
+ */
+export const COMMAND_LOG_PREFIX = '$ ';
+/**
+ * commandLogLine formats one exec audit rule line: the COMMAND_LOG_PREFIX, the
+ * command, and the newline. The `$ <command>` line reaches the run's log sink
+ * before the child spawns.
+ */
+export function commandLogLine(command) {
+    return `${COMMAND_LOG_PREFIX}${command}\n`;
+}
+/**
+ * URL_LOG_PREFIX leads the URL audit rule's request line in every run log:
+ * `> GET ` then the URL. The health polls format through urlLogLine, so the
+ * marker has one home (the exec rule's URL twin).
+ */
+export const URL_LOG_PREFIX = '> GET ';
+/**
+ * urlLogLine formats one URL audit rule line: the URL_LOG_PREFIX, the URL, an
+ * optional settled verdict word the poll appends after a space (`ready`,
+ * `still downloading: ...`), and the newline. The bare line reaches the run's
+ * log sink before the first request; the verdict line lands after the poll
+ * returns.
+ */
+export function urlLogLine(url, verdict) {
+    return `${URL_LOG_PREFIX}${url}${verdict === undefined ? '' : ` ${verdict}`}\n`;
+}
+/**
+ * autoRebuildEnabled reports whether a launch's engine acquisition steps
+ * (the git sync with its conditional rebuild, the docker image pull, the
+ * Strata binary installer, the compose `--pull` mode, the Get steps'
+ * sync/build skip) run: the card's Auto Rebuild flag, with only an explicit
+ * false disabling them so the already-present checkout, image, or binary
+ * launches as-is. An absent flag (a CLI launch, a legacy caller) reads as
+ * enabled. Every guard prices the flag through this one predicate, so the
+ * absent-means-enabled rule cannot drift between adapters.
+ */
+export function autoRebuildEnabled(autoRebuild) {
+    return autoRebuild !== false;
+}
 /**
  * EngineAdapter is the abstract base one subclass implements per engine. It
  * owns the engine's parameter surface and turns a config into a launch plan,
@@ -8,5 +72,14 @@
  * from the config.
  */
 export class EngineAdapter {
+    /**
+     * planKey is the children-map key an adapter tracks a spawned engine
+     * process under: the plan's engine id and port, the pair that identifies
+     * one running engine. The base class owns the rule, so every adapter
+     * tracks and stops the exact process it started.
+     */
+    planKey(plan) {
+        return `${plan.engineId}:${plan.port}`;
+    }
 }
-//# sourceMappingURL=adapter.js.map
+//# sourceMappingURL=adapter.js.map

package/packages/core/lib/config.d.ts

@@ -17,4 +17,4 @@ export interface CustomArg {
     key: string;
     value?: string;
 }
-//# sourceMappingURL=config.d.ts.map
+//# sourceMappingURL=config.d.ts.map

package/packages/core/lib/config.js

@@ -1,2 +1,2 @@
 export {};
-//# sourceMappingURL=config.js.map
+//# sourceMappingURL=config.js.map

package/packages/core/lib/debug.d.ts

@@ -41,4 +41,4 @@ export interface CreateCommandDebugLoggerArgs {
  * no sink is wired, so a bare host never throws on a missing logger.
  */
 export declare function createCommandDebugLogger(args: CreateCommandDebugLoggerArgs): DebugLogger;
-//# sourceMappingURL=debug.d.ts.map
+//# sourceMappingURL=debug.d.ts.map

package/packages/core/lib/debug.js

@@ -40,4 +40,4 @@ export function createCommandDebugLogger(args) {
         return NOOP_DEBUG_LOGGER;
     return args.emit;
 }
-//# sourceMappingURL=debug.js.map
+//# sourceMappingURL=debug.js.map

package/packages/core/lib/defaults.d.ts

@@ -98,4 +98,4 @@ export declare function presetFromFetch(source: PresetSource, content: string, f
  * supplied each value in the result, in key order.
  */
 export declare function resolveDefaults(presets: readonly Preset[], specs: readonly ParameterSpec[], engineId: string, modelId: string, hw: HardwareProfile, explicit?: Config): ResolvedDefaults;
-//# sourceMappingURL=defaults.d.ts.map
+//# sourceMappingURL=defaults.d.ts.map

package/packages/core/lib/defaults.js

@@ -92,4 +92,4 @@ function overlayPreset(preset, config, sources) {
         sources.set(key, preset.source);
     }
 }
-//# sourceMappingURL=defaults.js.map
+//# sourceMappingURL=defaults.js.map

package/packages/core/lib/deps.d.ts

@@ -9,14 +9,15 @@ export type DepStatus = 'satisfied' | 'missing' | 'installing' | 'failed';
 /**
  * PackageManager is the detected host package manager the install commands are
  * keyed against. The same dep renders the right commands for the user's OS
- * through this key.
+ * through this key. Windows keys on winget, the package manager that ships
+ * with the OS.
  */
-export type PackageManager = 'apt' | 'dnf' | 'pacman' | 'brew';
+export type PackageManager = 'apt' | 'dnf' | 'pacman' | 'brew' | 'winget';
 /**
  * PackageManagerProbes are the raw which-probe results a detection run
- * collects: which of the four package-manager binaries exist on the host, plus
- * the OS. The pure mapping below turns them into the single winner; the
- * probes are the service's job.
+ * collects: which of the package-manager binaries exist on the host, plus the
+ * OS. The pure mapping below turns them into the single winner; the probes are
+ * the service's job.
  */
 export interface PackageManagerProbes {
     os: 'linux' | 'windows' | 'macos';
@@ -24,6 +25,7 @@ export interface PackageManagerProbes {
     dnf: boolean;
     pacman: boolean;
     brew: boolean;
+    winget: boolean;
 }
 /**
  * InstallCommands is one dep's install block for one package manager: the
@@ -53,15 +55,29 @@ export interface SystemDep {
 }
 /**
  * EngineDepPlan is the per-engine answer to "which host deps does this engine
- * need": the docker list and the local list. A docker build skips the compile
- * toolchain entirely; a local build needs it. The providers ship the plans as
- * data, so adding an engine is a data edit.
+ * need": the docker list, the optional binary list, and the per-OS local
+ * lists. A docker build skips the compile toolchain entirely; a local build
+ * needs it. The providers ship the plans as data, so adding an engine is a
+ * data edit. The local lists are per-OS, sourced from the engine OS profile's
+ * deps by the providers (the Windows profile carries the winget toolchain,
+ * the shared Linux profile the apt/dnf/pacman/brew toolchain); a host OS
+ * reads its own list, and an OS with no dedicated list (macOS) reads the
+ * Linux list.
  */
 export interface EngineDepPlan {
     docker: readonly SystemDep[];
-    local: readonly SystemDep[];
     binary?: readonly SystemDep[];
+    local?: Partial<Record<'linux' | 'windows' | 'macos', readonly SystemDep[]>>;
 }
+/**
+ * osLabel is the friendly OS name the install string's header and the card's
+ * System dependencies section show: WSL on a WSL2 kernel, Windows on Windows,
+ * OSX on macOS, and Linux on every other Linux host.
+ */
+export declare function osLabel(hw: {
+    os: 'linux' | 'windows' | 'macos';
+    wsl2?: boolean;
+}): string;
 /**
  * DepCheck is the per-dep answer from checkDeps: the dep and its current
  * status.
@@ -72,18 +88,28 @@ export interface DepCheck {
 }
 /**
  * CommandOutcome is the answer to one install command: whether it exited
- * clean and a detail the UI shows when it did not.
+ * clean and a detail the UI shows when it did not. `stdout`, when the host
+ * captures the child's streams, is the tail of the captured output of a clean
+ * exit (stdout then stderr, capped by the host's tail rule so success output
+ * can follow its `$ <command>` log line without regurgitating a huge blob).
+ * A failed run carries the output in `detail` instead, and a host that does
+ * not capture output (a test stub) omits `stdout`.
  */
 export interface CommandOutcome {
     ok: boolean;
     detail?: string;
+    stdout?: string;
 }
 /**
  * CommandRunner runs one shell command line and reports the exit. The
  * Play/Run path takes it as a parameter, so the tests stub it and never run a
- * real sudo in CI.
+ * real sudo in CI. `needsSudo` carries the dep's sudo declaration
+ * (SystemDep.requiresSudo) to the runner so it can apply the sudo-prompt rule;
+ * the need is declared in data, never parsed from the command text.
  */
-export type CommandRunner = (command: string) => Promise<CommandOutcome>;
+export type CommandRunner = (command: string, options?: {
+    needsSudo?: boolean;
+}) => Promise<CommandOutcome>;
 /**
  * InstallResult is the outcome of the Play/Run path: overall success and the
  * per-dep status after re-running the probes.
@@ -111,10 +137,11 @@ export interface SystemDepProvisioner {
 }
 /**
  * detectPackageManager picks the single package manager the install commands
- * key against, from the which-probe results. macOS keys on brew. Linux tries
- * the distro-native manager in the order the plan lists them (apt, dnf,
- * pacman); a distro that ships two keeps the first. Windows has no command
- * set yet and reads as undetected, which the renderer degrades to.
+ * key against, from the which-probe results. macOS keys on brew. Windows keys
+ * on winget, the package manager that ships with the OS. Linux tries the
+ * distro-native manager in the order the plan lists them (apt, dnf, pacman);
+ * a distro that ships two keeps the first. A host whose manager probe reads
+ * absent reads as undetected, which the renderer degrades to.
  */
 export declare function detectPackageManager(probes: PackageManagerProbes): PackageManager | undefined;
 /**
@@ -149,4 +176,4 @@ export declare function renderInstallString(deps: readonly SystemDep[], hw: Hard
  * a state the plugin did not see.
  */
 export declare function runInstall(deps: readonly SystemDep[], hw: HardwareProfile, runCommand: CommandRunner): Promise<InstallResult>;
-//# sourceMappingURL=deps.d.ts.map
+//# sourceMappingURL=deps.d.ts.map

package/packages/core/lib/deps.js

@@ -1,14 +1,30 @@
+/**
+ * osLabel is the friendly OS name the install string's header and the card's
+ * System dependencies section show: WSL on a WSL2 kernel, Windows on Windows,
+ * OSX on macOS, and Linux on every other Linux host.
+ */
+export function osLabel(hw) {
+    if (hw.os === 'windows')
+        return 'Windows';
+    if (hw.os === 'macos')
+        return 'OSX';
+    return hw.wsl2 === true ? 'WSL' : 'Linux';
+}
 /**
  * detectPackageManager picks the single package manager the install commands
- * key against, from the which-probe results. macOS keys on brew. Linux tries
- * the distro-native manager in the order the plan lists them (apt, dnf,
- * pacman); a distro that ships two keeps the first. Windows has no command
- * set yet and reads as undetected, which the renderer degrades to.
+ * key against, from the which-probe results. macOS keys on brew. Windows keys
+ * on winget, the package manager that ships with the OS. Linux tries the
+ * distro-native manager in the order the plan lists them (apt, dnf, pacman);
+ * a distro that ships two keeps the first. A host whose manager probe reads
+ * absent reads as undetected, which the renderer degrades to.
  */
 export function detectPackageManager(probes) {
     if (probes.os === 'macos') {
         return probes.brew ? 'brew' : undefined;
     }
+    if (probes.os === 'windows') {
+        return probes.winget ? 'winget' : undefined;
+    }
     if (probes.os === 'linux') {
         if (probes.apt)
             return 'apt';
@@ -46,7 +62,7 @@ export async function checkDeps(deps, hw) {
  * in. It is the order the plan lists them, so the block the user's host
  * would have picked sits at the top.
  */
-const MANAGER_ORDER = ['apt', 'dnf', 'pacman', 'brew'];
+const MANAGER_ORDER = ['apt', 'dnf', 'pacman', 'brew', 'winget'];
 /**
  * renderInstallString emits the copy/paste block for the user's detected OS
  * and package manager, mirroring the qwen-ninfer header: the apt and CUDA-
@@ -59,7 +75,7 @@ const MANAGER_ORDER = ['apt', 'dnf', 'pacman', 'brew'];
 export function renderInstallString(deps, hw) {
     const pm = hw.packageManager;
     const lines = [];
-    lines.push(`# System dependencies on ${hw.os}`);
+    lines.push(`# System dependencies on ${osLabel(hw)}`);
     if (pm === undefined) {
         lines.push('# No package manager detected; blocks are grouped by manager.');
     }
@@ -131,7 +147,7 @@ export async function runInstall(deps, hw, runCommand) {
         }
         let failure;
         for (const command of commands.commands) {
-            const outcome = await runCommand(command);
+            const outcome = await runCommand(command, { needsSudo: dep.requiresSudo });
             if (!outcome.ok) {
                 failure = outcome;
                 break;
@@ -165,4 +181,4 @@ export async function runInstall(deps, hw, runCommand) {
 async function isSatisfied(dep, hw) {
     return dep.detect === undefined ? false : await dep.detect(hw);
 }
-//# sourceMappingURL=deps.js.map
+//# sourceMappingURL=deps.js.map

package/packages/core/lib/estimator.d.ts

@@ -135,4 +135,4 @@ export declare const DEFAULT_OS_RESERVE_MIB: number;
  * no reserve of its own.
  */
 export declare function estimateVram(model: VramModel | undefined, config: Config, hw: HardwareProfile, specs?: readonly ParameterSpec[], options?: EstimateOptions): VramEstimate;
-//# sourceMappingURL=estimator.d.ts.map
+//# sourceMappingURL=estimator.d.ts.map

package/packages/core/lib/estimator.js

@@ -235,4 +235,4 @@ export function estimateVram(model, config, hw, specs, options) {
     };
     return { breakdown, verdict, source: model.source };
 }
-//# sourceMappingURL=estimator.js.map
+//# sourceMappingURL=estimator.js.map

package/packages/core/lib/guideline.d.ts

@@ -61,4 +61,4 @@ export declare function evaluateGuidelines(guidelines: readonly Guideline[], spe
  * OS reserve, so the rule prices the same usable budget the meter does.
  */
 export declare function modelGuidelines(model: VramModel, config: Config, hw: HardwareProfile, options?: EstimateOptions): GuidelineResult[];
-//# sourceMappingURL=guideline.d.ts.map
+//# sourceMappingURL=guideline.d.ts.map

package/packages/core/lib/guideline.js

@@ -115,4 +115,4 @@ export function modelGuidelines(model, config, hw, options) {
     }
     return results;
 }
-//# sourceMappingURL=guideline.js.map
+//# sourceMappingURL=guideline.js.map

package/packages/core/lib/hardware.d.ts

@@ -64,4 +64,4 @@ export declare function parseNvidiaSmiGpu(output: string): GpuProbe | null;
  * formats off.
  */
 export declare function detectHardware(probes: HardwareProbes): HardwareProfile;
-//# sourceMappingURL=hardware.d.ts.map
+//# sourceMappingURL=hardware.d.ts.map

package/packages/core/lib/hardware.js

@@ -57,4 +57,4 @@ export function detectHardware(probes) {
     }
     return profile;
 }
-//# sourceMappingURL=hardware.js.map
+//# sourceMappingURL=hardware.js.map