Doctor: local and remote diagnostics

Requires WU CLI 1.2.0 and WU Framework 4.0.0 for application APIs. Check wu --version and the project dependencies.

wu info
wu doctor --json
wu doctor --url https://example.com --route /guide/ --entry /apps/cart/entry.js --json

wu info shows effective configuration. Local doctor uses the native binary; remote doctor uses Node >=20 and makes GET requests without cookies or credentials. It neither executes JavaScript nor repairs files. JSON output excludes ANSI and update notices. Local JSON mode does not probe port 3000; human-readable output retains that legacy check.

Reports include schemaVersion: 1, tool, mode, ok, checks, problems and diagnostics; local reports also include version. Each diagnostic has code, severity and message. A category can produce several findings. Warnings can remain with exit 0; errors produce 1. Invalid options or remote execution failures produce 2.

WU_D003 accepts ranges limited to the catalogue’s Framework major, such as ^4.0.0, 4.x, 4.2.3 or >=4 <5. It rejects incompatible, malformed, empty or cross-major ranges, such as ^3 || ^4 and >=4. Shell and app declarations must match; local dependencies retain their destination checks.

Remote scan scope

--url selects HTTP or HTTPS. Repeat --route for pages and --entry for modules or explicitly included external origins. --timeout defaults to 5000 ms per response, including its body, and accepts 100–30000. The scan follows static references; computed imports and runtime-discovered apps require browser tests.

The scan is limited to 32 resources, 40 requests, 3 redirects per resource, 2 MiB per response and 30 seconds overall. Incomplete inspection is an error. Diagnostics distinguish HTTP status, incorrect MIME, inline CSP, HTML asset fallbacks, network failures and skipped external origins. Split large sites into focused scans.

Deployment integrity

wu doctor --url https://example.com --integrity --pubkey keys/deploy.pub.json --json

--integrity verifies wu-integrity.json, created by wu build --sign, and compares the published signature, bytes, MIME, CSP and import maps. --pubkey accepts a trusted PEM or JWK. Without it, the embedded key proves only consistency and produces WU_INTEGRITY_UNPINNED. This mode has separate limits: up to 10000 files, a 32 MiB manifest and 64 MiB files; it does not use the normal scan’s 32-resource limit.

The local scan checks CSP on every page in dist/; the remote scan also discovers apps from #wu-apps. Neither replaces mounting apps in a browser. For signing and publishing, see build.

Implementation references

• wu-cli/src/commands/doctor.zig
• wu-cli/src/commands/doctor-remote.cjs
• wu-cli/tests/doctor-policy.test.cjs
• wu-cli/tests/doctor-remote-apps.test.cjs
• wu-cli/tests/build-deploy.test.cjs