peachsim 0.1.630 → 0.1.631

package/cli/app-fonts.ts

@@ -139,6 +139,16 @@ export function discoverNativeLinkedAppFonts(opts: {
         collectFontFiles(root, relativeRoot.split(path.sep).join('/'))
       }
 
+      // the bundle path is the entry relative to metro's root, so a bundle at
+      // /apps/app/index.bundle served for /repo/apps/app puts that root at /repo.
+      const bundleDir = path.posix
+        .dirname(new URL(opts.bundleUrl).pathname)
+        .replace(/^\/+/, '')
+      const appRelativeDir = bundleDir.split('/').join(path.sep)
+      const metroRootCandidates = [selectedAppDir]
+      if (bundleDir && selectedAppDir.endsWith(path.sep + appRelativeDir)) {
+        metroRootCandidates.push(selectedAppDir.slice(0, -appRelativeDir.length - 1))
+      }
       const vectorIconRequire = createRequire(path.join(selectedAppDir, 'package.json'))
       for (const dependencyName of vectorIconDependencies) {
         try {
@@ -150,10 +160,19 @@ export function discoverNativeLinkedAppFonts(opts: {
           const packageRoot = entryPath.slice(0, markerIndex + marker.length - 1)
           const fontsDir =
             dependencyName === 'react-native-vector-icons' ? 'Fonts' : 'fonts'
-          collectFontFiles(
-            path.join(packageRoot, fontsDir),
-            path.posix.join('node_modules', dependencyName, fontsDir),
-          )
+          // the package can sit outside the app (a hoisted workspace
+          // node_modules or a pnpm store). metro resolves asset paths against
+          // its config.projectRoot, which is the app in expo's monorepo setup
+          // but the repo root when metro.config sets it there, so offer the
+          // path from each candidate root; the reachability check keeps the
+          // one metro actually serves.
+          const fontsRoot = path.join(packageRoot, fontsDir)
+          for (const metroRoot of metroRootCandidates) {
+            collectFontFiles(
+              fontsRoot,
+              path.relative(metroRoot, fontsRoot).split(path.sep).join('/'),
+            )
+          }
         } catch {}
       }
     }

package/cli/bridge-flow-runner.ts

@@ -2710,38 +2710,45 @@ export class SootSimBridgeFlowRunner {
     }
 
     try {
-      // per-step watchdog: abort if nothing forward-progresses for 10s.
-      // catches dead bundles / frozen bridges / hung ws calls. explicit
-      // wait steps (extendedWaitUntil, waitFor) opt out and keep their
-      // own timeout — the user asked for that time; don't override.
-      const hasExplicitWait = !!(
-        step.extendedWaitUntil ||
-        step.waitFor ||
-        step.scrollUntilVisible ||
-        step.launchApp ||
-        step.runFlow ||
-        // retry reruns its body on failure, so its wall time is the body's
-        // times the retry count — the 10s no-progress watchdog is the wrong
-        // budget and would report "bridge probably hung" for a slow retry.
-        step.retry ||
-        // runScript http calls are synchronous with a 5-minute upstream
-        // timeout — the 10s watchdog would kill legitimate setup scripts.
-        step.runScript ||
-        // takeScreenshot self-governs: it retries a bounded visual settle that
-        // already fails with its own reason. sharing the watchdog's 10s budget
-        // meant the watchdog always won that race, reporting "bridge probably
-        // hung" for a screen that was merely still animating.
-        step.takeScreenshot ||
-        // assertions wait out maestro's lookup window, longer than 10s, and
-        // every query they make times out on its own, so they report their
-        // own failure instead of the watchdog's guess.
-        step.assertVisible ||
-        step.assertNotVisible
+      // simple commands have a wall-clock watchdog. bounded operations keep
+      // their own lookup, settle and bridge deadlines, so the watchdog cannot
+      // report a completed step while its action continues in the background.
+      const hasBoundedWait = !!(
+        // taps combine bounded lookup, settling and delivery. a wall-clock
+        // watchdog can finish the step while that action is still running.
+        // let these operations finish before starting the next command.
+        (
+          step.tapOn ||
+          step.doubleTapOn ||
+          step.longPressOn ||
+          step.extendedWaitUntil ||
+          step.waitFor ||
+          step.scrollUntilVisible ||
+          step.launchApp ||
+          step.runFlow ||
+          // retry reruns its body on failure, so its wall time is the body's
+          // times the retry count — the 10s no-progress watchdog is the wrong
+          // budget and would report "bridge probably hung" for a slow retry.
+          step.retry ||
+          // runScript http calls are synchronous with a 5-minute upstream
+          // timeout — the 10s watchdog would kill legitimate setup scripts.
+          step.runScript ||
+          // takeScreenshot self-governs: it retries a bounded visual settle that
+          // already fails with its own reason. sharing the watchdog's 10s budget
+          // meant the watchdog always won that race, reporting "bridge probably
+          // hung" for a screen that was merely still animating.
+          step.takeScreenshot ||
+          // assertions wait out maestro's lookup window, longer than 10s, and
+          // every query they make times out on its own, so they report their
+          // own failure instead of the watchdog's guess.
+          step.assertVisible ||
+          step.assertNotVisible
+        )
       )
       const STEP_WATCHDOG_MS = 10_000
       const body = this.runStepInner(step)
       let screenshotPath: string | undefined
-      if (hasExplicitWait) {
+      if (hasBoundedWait) {
         const result = await body
         if (typeof result === 'string') screenshotPath = result
       } else {

package/cli/command-registry.ts

@@ -48,6 +48,7 @@ const NODE_COMMAND_NAMES = [
   'claim',
   'close',
   'compat',
+  'project-report',
   'report-issue',
   'desktop',
   'login',

package/cli/commands/compat.ts

@@ -1,7 +1,6 @@
 // peach compat — scan dependencies with the shared compatibility engine.
 
-import { existsSync, readFileSync } from 'node:fs'
-import { dirname, join, relative, resolve } from 'node:path'
+import { relative, resolve } from 'node:path'
 import {
   COMPAT_RESULT_CAVEAT,
   formatDetailedScanLines,
@@ -9,13 +8,13 @@ import {
   scanDeps,
   type ScanResult,
 } from '@peach/compat/web'
-import { findProjectRoot, scanWorkspace } from './detect'
-
-interface PackageManifest {
-  name?: string
-  dependencies?: Record<string, string>
-  devDependencies?: Record<string, string>
-}
+import {
+  findProjectRoot,
+  scanWorkspace,
+  installedManifest,
+  readProjectManifest,
+} from './detect'
+import type { ProjectManifest } from './projectReportContract'
 
 export async function runCompat(args: string[]): Promise<void> {
   if (args.includes('--help') || args.includes('-h')) {
@@ -41,7 +40,7 @@ flags:
   const packageName = args.find(
     (arg, index) => !arg.startsWith('-') && (appIndex < 0 || index !== appIndex + 1),
   )
-  const pkg = readPackageJson(appDir)
+  const pkg = readProjectManifest(appDir)
   if (!pkg) {
     console.error(`  no package.json found in ${appDir}`)
     process.exitCode = 1
@@ -65,7 +64,7 @@ flags:
   const workspaceRoot = findProjectRoot(appDir)
   const elsewhere = scanWorkspace(workspaceRoot).apps.flatMap((app) => {
     if (resolve(app.dir) === appDir) return []
-    const manifest = readPackageJson(app.dir)
+    const manifest = readProjectManifest(app.dir)
     if (!manifest) return []
     const result = scanDeps(installedManifest(app.dir, manifest))
     return result.packages.length > 0 ? [{ dir: app.dir, result }] : []
@@ -114,57 +113,9 @@ function report(args: string[], result: ScanResult): void {
   console.log(`\n  ${COMPAT_RESULT_CAVEAT}\n`)
 }
 
-// the declared range is often not a version: pnpm and bun catalogs write
-// `catalog:`, a workspace dependency writes `workspace:*`, and a pinned tarball
-// writes a URL. none of those match a verified version range, so a whole app
-// reports as unverified. the installed tree holds the version that will
-// actually run, so ask it, and keep the declared range for anything the project
-// has not installed.
-function installedManifest(appDir: string, pkg: PackageManifest): PackageManifest {
-  const resolveVersion = (name: string, declared: string): string => {
-    let dir = appDir
-    while (true) {
-      const manifest = join(dir, 'node_modules', name, 'package.json')
-      if (existsSync(manifest)) {
-        try {
-          const parsed: unknown = JSON.parse(readFileSync(manifest, 'utf8'))
-          if (parsed && typeof parsed === 'object' && 'version' in parsed) {
-            const version = parsed.version
-            if (typeof version === 'string') return version
-          }
-        } catch {}
-        return declared
-      }
-      const parent = dirname(dir)
-      if (parent === dir) return declared
-      dir = parent
-    }
-  }
-  const mapped = (deps: Record<string, string> | undefined) =>
-    deps &&
-    Object.fromEntries(
-      Object.entries(deps).map(([name, declared]) => [
-        name,
-        resolveVersion(name, declared),
-      ]),
-    )
-  return {
-    name: pkg.name,
-    dependencies: mapped(pkg.dependencies),
-    devDependencies: mapped(pkg.devDependencies),
-  }
-}
-
-function readPackageJson(appDir: string): PackageManifest | null {
-  const packagePath = resolve(appDir, 'package.json')
-  if (!existsSync(packagePath)) return null
-  const parsed: unknown = JSON.parse(readFileSync(packagePath, 'utf8'))
-  return parsed && typeof parsed === 'object' ? parsed : null
-}
-
 function scanOnePackage(
   appDir: string,
-  pkg: PackageManifest,
+  pkg: ProjectManifest,
   packageName: string,
 ): ScanResult {
   const installed = installedManifest(appDir, pkg)

package/cli/commands/control.ts

@@ -73,7 +73,9 @@ import {
 } from '../current-sim'
 import { getDriver } from '../drivers/registry'
 import { openUrl as openUrlInBrowser } from '../open-url'
+import { diagnosticsAllowedForCurrentProcess } from '../privacy'
 import { rethrowIfExit, rnxExit } from '../run-rnx'
+import { collectRuntimeDiagnostics } from '../runtime-diagnostics'
 import { rnxSelfInvocation } from '../self-invocation'
 import {
   BridgeSimLockedError,
@@ -695,11 +697,13 @@ async function filterReachableAppFonts(
       }
     }),
   )
-  const reachable: DiscoveredAppFontSpec[] = []
+  // a font offered from more than one candidate metro root keeps the first
+  // url metro served.
+  const reachable = new Map<string, DiscoveredAppFontSpec>()
   for (const spec of results) {
-    if (spec !== null) reachable.push(spec)
+    if (spec !== null && !reachable.has(spec.family)) reachable.set(spec.family, spec)
   }
-  return reachable
+  return [...reachable.values()]
 }
 
 async function resolveShellUrl(
@@ -1293,7 +1297,8 @@ function printAgentListenHint(quiet: boolean): void {
 // a splash; the caller can `peach describe` again a second later. for
 // warm loads it's the real screen. guarded by --no-describe.
 async function maybeDescribeAfterOpen(wsPort: number, simId: string, args: string[]) {
-  if (args.includes('--no-describe')) return
+  const noDescribe = args.includes('--no-describe')
+  if (noDescribe && !diagnosticsAllowedForCurrentProcess()) return
   const prevQuiet = process.env.SOOTSIM_QUIET_TARGET_NOTICE
   process.env.SOOTSIM_QUIET_TARGET_NOTICE = '1'
   try {
@@ -1302,7 +1307,7 @@ async function maybeDescribeAfterOpen(wsPort: number, simId: string, args: strin
     // seconds on a still-routing guest app, which is exactly what we want
     // to skip for the open-side describe. caller can `peach describe`
     // again later for post-routing state.
-    await waitForTreeStable(wsPort, simId, { stableMs: 150, maxMs: 400 })
+    if (!noDescribe) await waitForTreeStable(wsPort, simId, { stableMs: 150, maxMs: 400 })
     const bridge = createBridge(wsPort, {
       commandTimeoutMs: 3000,
       simId,
@@ -1310,6 +1315,7 @@ async function maybeDescribeAfterOpen(wsPort: number, simId: string, args: strin
       simIdSource: 'flag',
     })
     try {
+      if (noDescribe) return
       let readyProbe: Awaited<ReturnType<typeof inspectWaitReady>> | null = null
       try {
         readyProbe = await inspectWaitReady(bridge, 1)
@@ -1341,6 +1347,7 @@ async function maybeDescribeAfterOpen(wsPort: number, simId: string, args: strin
       console.log('')
       console.log(result.tree)
     } finally {
+      await collectRuntimeDiagnostics(bridge)
       bridge.close()
     }
   } catch {

package/cli/commands/detect.ts

@@ -1,11 +1,21 @@
 // project detection — finds project root, detects framework, scans monorepo workspaces
 
-import { existsSync, readFileSync, readdirSync, statSync } from 'fs'
-import { basename, dirname, join } from 'path'
+import {
+  existsSync,
+  lstatSync,
+  opendirSync,
+  readFileSync,
+  readdirSync,
+  statSync,
+} from 'node:fs'
+import { basename, dirname, join } from 'node:path'
+import JSON5 from 'json5'
+import { parse as parseYaml } from 'yaml'
+import type { DependencyVersion, ProjectManifest } from './projectReportContract'
 
 export type Framework = 'one' | 'expo' | 'bare' | 'unknown'
 export type PackageManager = 'bun' | 'pnpm' | 'npm' | 'yarn'
-export type MonorepoType = 'turbo' | 'pnpm' | 'nx' | 'npm-workspaces' | 'single'
+export type MonorepoType = 'turbo' | 'pnpm' | 'nx' | 'lerna' | 'npm-workspaces' | 'single'
 
 export interface DetectedProject {
   dir: string
@@ -25,7 +35,8 @@ export interface DetectedWorkspace {
 
 const CONFIG_EXTENSIONS = ['ts', 'js', 'cjs', 'mjs', 'mts', 'cts']
 
-export function findProjectRoot(cwd: string): string {
+export function findProjectRoot(cwd: string, includeNativeRepository = false): string {
+  let swiftRoot: string | undefined
   let dir = cwd
   while (true) {
     if (
@@ -37,22 +48,30 @@ export function findProjectRoot(cwd: string): string {
       return dir
     }
 
-    const pkgPath = join(dir, 'package.json')
-    if (existsSync(pkgPath)) {
-      try {
-        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
-        if (pkg.workspaces) return dir
-      } catch {}
-    }
+    if (metadataValue(readProjectJson(join(dir, 'package.json')), 'workspaces'))
+      return dir
 
+    if (includeNativeRepository) {
+      if (existsSync(join(dir, '.git'))) return dir
+      if (!swiftRoot && existsSync(join(dir, 'Package.swift'))) swiftRoot = dir
+    }
     const parent = dirname(dir)
     if (parent === dir) break
     dir = parent
   }
-  return cwd
+  return swiftRoot ?? cwd
 }
 
 export function detectPackageManager(root: string): PackageManager {
+  const manager = metadataValue(
+    readProjectJson(join(root, 'package.json')),
+    'packageManager',
+  )
+  if (typeof manager === 'string') {
+    const name = manager.split('@')[0]
+    if (name === 'bun' || name === 'pnpm' || name === 'npm' || name === 'yarn')
+      return name
+  }
   if (existsSync(join(root, 'bun.lock')) || existsSync(join(root, 'bun.lockb'))) {
     return 'bun'
   }
@@ -66,13 +85,9 @@ export function detectMonorepoType(root: string): MonorepoType {
   if (existsSync(join(root, 'nx.json'))) return 'nx'
   if (existsSync(join(root, 'pnpm-workspace.yaml'))) return 'pnpm'
 
-  const pkgPath = join(root, 'package.json')
-  if (existsSync(pkgPath)) {
-    try {
-      const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
-      if (pkg.workspaces) return 'npm-workspaces'
-    } catch {}
-  }
+  if (existsSync(join(root, 'lerna.json'))) return 'lerna'
+  if (metadataValue(readProjectJson(join(root, 'package.json')), 'workspaces'))
+    return 'npm-workspaces'
   return 'single'
 }
 
@@ -87,14 +102,14 @@ export function detectProject(dir: string): DetectedProject | null {
   const pkgPath = join(dir, 'package.json')
   if (!existsSync(pkgPath)) return null
 
-  let pkg: any
-  try {
-    pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
-  } catch {
-    return null
-  }
+  const pkg = readProjectManifest(dir)
+  if (!pkg) return null
 
   const deps = { ...pkg.dependencies, ...pkg.devDependencies }
+  const devCommand = metadataValue(
+    metadataValue(readProjectJson(pkgPath), 'scripts'),
+    'dev',
+  )
   const framework = detectFramework(deps)
 
   if (framework === 'unknown') return null
@@ -112,7 +127,7 @@ export function detectProject(dir: string): DetectedProject | null {
     hasMetroConfig: CONFIG_EXTENSIONS.some((ext) =>
       existsSync(join(dir, `metro.config.${ext}`)),
     ),
-    devCommand: pkg.scripts?.dev || null,
+    devCommand: typeof devCommand === 'string' ? devCommand : null,
   }
 }
 
@@ -199,3 +214,251 @@ export function scanWorkspace(root: string): DetectedWorkspace {
 
   return { root, type, packageManager, apps }
 }
+
+// reports inspect metadata without evaluating app config or following directory
+// symlinks. this also finds native projects outside package-manager workspaces.
+const REPORT_SKIP_DIRS = new Set([
+  'node_modules',
+  'Pods',
+  'Carthage',
+  'build',
+  'dist',
+  'dist-lib',
+  'DerivedData',
+  'vendor',
+  'coverage',
+  'target',
+  'tmp',
+  'cache',
+  'artifacts',
+  'test-results',
+  'playwright-report',
+])
+
+export function scanRepository(root: string): {
+  directories: string[]
+  truncated: boolean
+  unreadable: number
+} {
+  const directories: string[] = []
+  const pending = [{ dir: root, depth: 0 }]
+  let entries = 0
+  let cursor = 0
+  let truncated = false
+  let unreadable = 0
+  while (cursor < pending.length && entries < 200_000 && directories.length < 10_000) {
+    const next = pending[cursor++]
+    if (!next) break
+    directories.push(next.dir)
+    let handle: ReturnType<typeof opendirSync>
+    try {
+      handle = opendirSync(next.dir)
+    } catch {
+      unreadable++
+      continue
+    }
+    try {
+      let entry
+      while (entries < 200_000 && (entry = handle.readSync())) {
+        entries++
+        if (
+          !entry.isDirectory() ||
+          entry.name.startsWith('.') ||
+          REPORT_SKIP_DIRS.has(entry.name)
+        )
+          continue
+        if (next.depth >= 12) {
+          truncated = true
+          continue
+        }
+        pending.push({ dir: join(next.dir, entry.name), depth: next.depth + 1 })
+      }
+    } finally {
+      handle.closeSync()
+    }
+  }
+  return {
+    directories: directories.sort(),
+    truncated: truncated || cursor < pending.length || entries >= 200_000,
+    unreadable,
+  }
+}
+
+// inspect only regular, bounded metadata files. errors are data, never a reason
+// to execute project code. symlinks may point outside the checkout.
+export function readProjectMetadata(path: string): string | null {
+  try {
+    const info = lstatSync(path)
+    if (!info.isFile() || info.size > 4 * 1024 * 1024) return null
+    return readFileSync(path, 'utf8')
+  } catch {
+    return null
+  }
+}
+
+export function metadataValue(value: unknown, key: string): unknown {
+  if (!value || typeof value !== 'object') return undefined
+  return Object.getOwnPropertyDescriptor(value, key)?.value
+}
+
+export function readProjectJson(path: string): unknown {
+  const text = readProjectMetadata(path)
+  if (text === null) return null
+  try {
+    const value: unknown = JSON.parse(text)
+    return value
+  } catch {
+    return null
+  }
+}
+
+export function readProjectManifest(dir: string): ProjectManifest | null {
+  const parsed = readProjectJson(join(dir, 'package.json'))
+  if (!parsed || typeof parsed !== 'object') return null
+  const record = (value: unknown): Record<string, string> => {
+    if (!value || typeof value !== 'object') return {}
+    return Object.fromEntries(
+      Object.entries(value).filter(
+        (entry): entry is [string, string] =>
+          typeof entry[1] === 'string' &&
+          /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/i.test(entry[0]) &&
+          entry[0] !== '.' &&
+          entry[0] !== '..',
+      ),
+    )
+  }
+  const name = metadataValue(parsed, 'name')
+  return {
+    ...(typeof name === 'string' ? { name } : {}),
+    dependencies: record(metadataValue(parsed, 'dependencies')),
+    devDependencies: record(metadataValue(parsed, 'devDependencies')),
+  }
+}
+
+// resolve each dependency at its nearest installation/lockfile boundary, so an
+// uninstalled nested project never inherits another app's hoisted version.
+export function resolveManifestVersions(
+  dir: string,
+  manifest: ProjectManifest,
+  locks = new Map<string, Map<string, string>>(),
+): Record<string, DependencyVersion> {
+  const resolveVersion = (name: string, declared: string): DependencyVersion => {
+    if (!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/i.test(name))
+      return { version: declared, source: 'declared' }
+    let current = dir
+    while (true) {
+      // installed packages commonly use symlinks; read just this known manifest,
+      // never traverse their dependency trees.
+      try {
+        const file = join(current, 'node_modules', name, 'package.json')
+        if (statSync(file).size <= 256 * 1024) {
+          const value: unknown = JSON.parse(readFileSync(file, 'utf8'))
+          const version = metadataValue(value, 'version')
+          if (typeof version === 'string') return { version, source: 'installed' }
+        }
+      } catch {}
+      let lock = locks.get(current)
+      if (!lock) {
+        lock = readLockedVersions(current)
+        locks.set(current, lock)
+      }
+      const version = lock.get(name)
+      if (version) return { version, source: 'lockfile' }
+      if (
+        [
+          'bun.lock',
+          'bun.lockb',
+          'package-lock.json',
+          'pnpm-lock.yaml',
+          'yarn.lock',
+        ].some((file) => existsSync(join(current, file)))
+      )
+        break
+      const parent = dirname(current)
+      if (parent === current) break
+      current = parent
+    }
+    return { version: declared, source: 'declared' }
+  }
+  return Object.fromEntries(
+    Object.entries({ ...manifest.dependencies, ...manifest.devDependencies }).map(
+      ([name, declared]) => [name, resolveVersion(name, declared)],
+    ),
+  )
+}
+
+function readLockedVersions(dir: string): Map<string, string> {
+  const versions = new Map<string, string>()
+  const put = (name: string, value: unknown) => {
+    if (typeof value !== 'string') return
+    // multiple resolutions without an installed tree are ambiguous; report the
+    // declared range rather than choosing a transitive package's version.
+    const before = versions.get(name)
+    versions.set(name, before === undefined || before === value ? value : '')
+  }
+  const bun = readProjectMetadata(join(dir, 'bun.lock'))
+  if (bun) {
+    try {
+      const rootVersions = new Map<string, string>()
+      const parsed: unknown = JSON5.parse(bun)
+      const packages = metadataValue(parsed, 'packages')
+      if (packages && typeof packages === 'object') {
+        for (const [key, tuple] of Object.entries(packages)) {
+          if (!Array.isArray(tuple) || typeof tuple[0] !== 'string') continue
+          const match = /^((?:@[^/]+\/)?[^@]+)@([\d][\w.+-]*)$/.exec(tuple[0])
+          if (match) put(match[1], match[2])
+          // bun's root resolution wins over nested duplicate package keys.
+          if (match && key === match[1]) rootVersions.set(match[1], match[2])
+        }
+      }
+      for (const [name, version] of rootVersions) versions.set(name, version)
+    } catch {}
+  }
+  const npm = metadataValue(readProjectJson(join(dir, 'package-lock.json')), 'packages')
+  if (npm && typeof npm === 'object') {
+    for (const [key, value] of Object.entries(npm)) {
+      if (key.startsWith('node_modules/') && !key.slice(13).includes('/node_modules/'))
+        put(key.slice(13), metadataValue(value, 'version'))
+    }
+  }
+  const pnpm = readProjectMetadata(join(dir, 'pnpm-lock.yaml'))
+  if (pnpm) {
+    try {
+      const parsed: unknown = parseYaml(pnpm)
+      const packages = metadataValue(parsed, 'packages')
+      if (packages && typeof packages === 'object')
+        for (const key of Object.keys(packages)) {
+          const match = /^\/?((?:@[^/]+\/)?[^@]+)@([\d][\w.+-]*)/.exec(key)
+          if (match) put(match[1], match[2])
+        }
+    } catch {}
+  }
+  const yarn = readProjectMetadata(join(dir, 'yarn.lock'))
+  if (yarn) {
+    let names: string[] = []
+    for (const line of yarn.split('\n')) {
+      if (/^\S.*:\s*$/.test(line))
+        names = [...line.matchAll(/(?:^|[", ]+)((?:@[^/\s]+\/)?[^@" ,]+)@/g)].map(
+          (match) => match[1],
+        )
+      const version = /^\s+version[ :]+["']?([\d][\w.+-]*)/.exec(line)
+      if (version) for (const name of names) put(name, version[1])
+    }
+  }
+  return versions
+}
+
+export function installedManifest(
+  dir: string,
+  manifest: ProjectManifest,
+): ProjectManifest {
+  const versions = resolveManifestVersions(dir, manifest)
+  const mapped = (deps: Record<string, string> | undefined) =>
+    deps &&
+    Object.fromEntries(Object.keys(deps).map((name) => [name, versions[name].version]))
+  return {
+    name: manifest.name,
+    dependencies: mapped(manifest.dependencies),
+    devDependencies: mapped(manifest.devDependencies),
+  }
+}

package/cli/commands/inspect/core.ts

@@ -1287,7 +1287,7 @@ export interface ConsoleEntry {
 // One root error boundary in the tenant worker) can be live and screaming in
 // the driver's console while the agent's `sootsim_errors` reports nothing.
 // Merge both, dedup, so worker + root-error-boundary failures always surface.
-function consoleEntriesEval(level: 'error' | 'warn', limit: number): string {
+export function consoleEntriesEval(level: 'error' | 'warn', limit: number): string {
   const getter = level === 'error' ? 'getErrors' : 'getWarnings'
   return `(() => {
     const out = []