# Doctor: local and remote diagnostics

Inspect files, dependencies and HTTP responses with diagnostic codes and CI exit statuses.

Requires WU CLI `1.2.0` and WU Framework `4.0.0` for application APIs. Check `wu --version` and the project dependencies.

```sh
wu info
wu doctor --json
wu doctor --url https://example.com --route /guide/ --entry /apps/cart/entry.js --json
```

`wu info` shows effective configuration. Local doctor uses the native binary; remote doctor uses Node `>=20` and makes GET requests without cookies or credentials. It neither executes JavaScript nor repairs files. JSON output excludes ANSI and update notices. Local JSON mode does not probe port `3000`; human-readable output retains that legacy check.

| Code | Check |
| --- | --- |
| `WU_D000` | Project not found. |
| `WU_D001` | Application directories. |
| `WU_D002` | Shell entry or build. |
| `WU_D003` | Consistent ranges compatible with the catalogue’s target Framework version. |
| `WU_D004` | Directory overrides and toolchains. |
| `WU_D005` | Port collisions. |
| `WU_D006` | Sensitive files in public output. |
| `WU_D007` | Security headers and inline handlers. |
| `WU_D008` | HTTP check guidance or local response. |
| `WU_D009` | Framework used by multiple apps missing from `shared`. |

Reports include `schemaVersion: 1`, `tool`, `mode`, `ok`, `checks`, `problems` and `diagnostics`; local reports also include `version`. Each diagnostic has `code`, `severity` and `message`. A category can produce several findings. Warnings can remain with exit `0`; errors produce `1`. Invalid options or remote execution failures produce `2`.

`WU_D003` accepts ranges limited to the catalogue’s Framework major, such as `^4.0.0`, `4.x`, `4.2.3` or `>=4 <5`. It rejects incompatible, malformed, empty or cross-major ranges, such as `^3 || ^4` and `>=4`. Shell and app declarations must match; local dependencies retain their destination checks.

<span id="alcance-del-escaneo-remoto"></span>

<span class="section-anchor" id="section-1"></span>

## Remote scan scope

`--url` selects HTTP or HTTPS. Repeat `--route` for pages and `--entry` for modules or explicitly included external origins. `--timeout` defaults to `5000` ms per response, including its body, and accepts `100`–`30000`. The scan follows static references; computed imports and runtime-discovered apps require browser tests.

The scan is limited to 32 resources, 40 requests, 3 redirects per resource, 2 MiB per response and 30 seconds overall. Incomplete inspection is an error. Diagnostics distinguish HTTP status, incorrect MIME, inline CSP, HTML asset fallbacks, network failures and skipped external origins. Split large sites into focused scans.

<span id="integridad-de-un-despliegue"></span>

<span class="section-anchor" id="section-2"></span>

## Deployment integrity

```sh
wu doctor --url https://example.com --integrity --pubkey keys/deploy.pub.json --json
```

`--integrity` verifies `wu-integrity.json`, created by `wu build --sign`, and compares the published signature, bytes, MIME, CSP and import maps. `--pubkey` accepts a trusted PEM or JWK. Without it, the embedded key proves only consistency and produces `WU_INTEGRITY_UNPINNED`. This mode has separate limits: up to 10000 files, a 32 MiB manifest and 64 MiB files; it does not use the normal scan’s 32-resource limit.

The local scan checks CSP on every page in `dist/`; the remote scan also discovers apps from `#wu-apps`. Neither replaces mounting apps in a browser. For signing and publishing, see [build](/docs/cli/build/).

<span id="referencia-de-implementación"></span>

<span class="section-anchor" id="section-3"></span>

## Implementation references

- `wu-cli/src/commands/doctor.zig`
- `wu-cli/src/commands/doctor-remote.cjs`
- `wu-cli/tests/doctor-policy.test.cjs`
- `wu-cli/tests/doctor-remote-apps.test.cjs`
- `wu-cli/tests/build-deploy.test.cjs`