WP-10: OS and package inventory

Debian inspector (dpkg-query, apt-get -s upgrade, snap list, os-release,
reboot-required) behind a CommandRunner port with tested parsers, fake
inspector for dev, persisted inventory snapshot, package_refresh job,
/api/system/inventory, Updates page with OS card, summary and filterable
package table.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/infrastructure/src/host/debian.rs

@@ -2,7 +2,7 @@
 use std::sync::Arc;
 
 use async_trait::async_trait;
-use domain::host::{OsInfo, Package};
+use domain::host::{OsInfo, Package, PackageSource};
 use domain::ports::HostInspector;
 use domain::DomainError;
 
@@ -21,32 +21,134 @@ impl DebianInspector {
 #[async_trait]
 impl HostInspector for DebianInspector {
     async fn os_info(&self) -> Result<OsInfo, DomainError> {
-        todo!()
+        let r = &self.runner;
+        let (name, version) =
+            parse_os_release(&r.read_file("/etc/os-release").await?.unwrap_or_default());
+        let uptime_secs = r
+            .read_file("/proc/uptime")
+            .await?
+            .and_then(|s| s.split_whitespace().next()?.parse::<f64>().ok())
+            .unwrap_or(0.0) as u64;
+        Ok(OsInfo {
+            hostname: r.run("hostname", &[]).await?.stdout.trim().to_string(),
+            name,
+            version,
+            kernel: r.run("uname", &["-r"]).await?.stdout.trim().to_string(),
+            uptime_secs,
+            reboot_required: r.read_file("/var/run/reboot-required").await?.is_some(),
+        })
     }
 
     async fn packages(&self) -> Result<Vec<Package>, DomainError> {
-        todo!()
+        let r = &self.runner;
+        let dpkg = r
+            .run(
+                "dpkg-query",
+                &["-W", "-f", "${Package}\t${Version}\t${Status}\n"],
+            )
+            .await?;
+        if !dpkg.success {
+            return Err(DomainError::Unavailable(format!(
+                "dpkg-query failed: {}",
+                dpkg.stderr.trim()
+            )));
+        }
+        // refresh the package index first; a failure here is logged but not fatal
+        let _ = r.run("apt-get", &["update", "-q"]).await;
+        let sim = r
+            .run(
+                "apt-get",
+                &[
+                    "-s",
+                    "--with-new-pkgs",
+                    "-o",
+                    "Debug::NoLocking=1",
+                    "upgrade",
+                ],
+            )
+            .await?;
+        let upgrades: std::collections::HashMap<String, (String, bool)> =
+            parse_apt_simulation(&sim.stdout)
+                .into_iter()
+                .map(|(n, v, s)| (n, (v, s)))
+                .collect();
+        let mut packages: Vec<Package> = parse_dpkg(&dpkg.stdout)
+            .into_iter()
+            .map(|(name, installed)| {
+                let up = upgrades.get(&name);
+                Package {
+                    candidate: up.map(|(v, _)| v.clone()),
+                    is_security: up.is_some_and(|(_, s)| *s),
+                    name,
+                    source: PackageSource::Apt,
+                    installed,
+                }
+            })
+            .collect();
+        if let Ok(snap) = r.run("snap", &["list"]).await {
+            packages.extend(
+                parse_snap_list(&snap.stdout)
+                    .into_iter()
+                    .map(|(name, installed)| Package {
+                        name,
+                        source: PackageSource::Snap,
+                        installed,
+                        candidate: None,
+                        is_security: false,
+                    }),
+            );
+        }
+        Ok(packages)
     }
 }
 
 /// `dpkg-query -W -f '${Package}\t${Version}\t${Status}\n'` → (name, version) of installed packages.
-pub fn parse_dpkg(_out: &str) -> Vec<(String, String)> {
-    todo!()
+pub fn parse_dpkg(out: &str) -> Vec<(String, String)> {
+    out.lines()
+        .filter_map(|l| {
+            let mut it = l.split('\t');
+            let (name, version, status) = (it.next()?, it.next()?, it.next()?);
+            (status.trim() == "install ok installed")
+                .then(|| (name.to_string(), version.to_string()))
+        })
+        .collect()
 }
 
 /// `apt-get -s upgrade` → (name, candidate version, is_security) for lines starting with `Inst`.
-pub fn parse_apt_simulation(_out: &str) -> Vec<(String, String, bool)> {
-    todo!()
+pub fn parse_apt_simulation(out: &str) -> Vec<(String, String, bool)> {
+    out.lines()
+        .filter_map(|l| {
+            let rest = l.strip_prefix("Inst ")?;
+            let name = rest.split_whitespace().next()?;
+            let paren = &rest[rest.find('(')? + 1..];
+            let version = paren.split_whitespace().next()?;
+            let is_security = paren.to_ascii_lowercase().contains("security");
+            Some((name.to_string(), version.to_string(), is_security))
+        })
+        .collect()
 }
 
 /// `snap list` → (name, version) skipping the header.
-pub fn parse_snap_list(_out: &str) -> Vec<(String, String)> {
-    todo!()
+pub fn parse_snap_list(out: &str) -> Vec<(String, String)> {
+    out.lines()
+        .skip(1)
+        .filter_map(|l| {
+            let mut it = l.split_whitespace();
+            Some((it.next()?.to_string(), it.next()?.to_string()))
+        })
+        .collect()
 }
 
 /// `/etc/os-release` → (PRETTY_NAME, VERSION_ID).
-pub fn parse_os_release(_content: &str) -> (String, String) {
-    todo!()
+pub fn parse_os_release(content: &str) -> (String, String) {
+    let get = |key: &str| {
+        content
+            .lines()
+            .find_map(|l| l.strip_prefix(key)?.strip_prefix('='))
+            .map(|v| v.trim().trim_matches('"').to_string())
+            .unwrap_or_default()
+    };
+    (get("PRETTY_NAME"), get("VERSION_ID"))
 }
 
 #[cfg(test)]