@dailephd/my-dev-kit-lab 0.7.0 → 0.7.2

package/dist/src/evaluation/syntheticRepository/prng.js

@@ -0,0 +1,47 @@
+const UINT32_RANGE = 4294967296;
+const IDENTITY_PATTERN = /^[0-9a-f]{64}$/;
+/** Initial uint32 state: the first four bytes of the SHA-256 identity digest, big-endian. */
+export function syntheticRepositoryPrngInitialState(identity) {
+    if (!IDENTITY_PATTERN.test(identity)) {
+        throw new Error("PRNG identity must be a lowercase 64-character SHA-256 hex string.");
+    }
+    const b0 = Number.parseInt(identity.slice(0, 2), 16);
+    const b1 = Number.parseInt(identity.slice(2, 4), 16);
+    const b2 = Number.parseInt(identity.slice(4, 6), 16);
+    const b3 = Number.parseInt(identity.slice(6, 8), 16);
+    return ((b0 << 24) | (b1 << 16) | (b2 << 8) | b3) >>> 0;
+}
+/** Generator-owned Mulberry32 stream (version "mulberry32-v1"). Never reads Math.random. */
+export function createSyntheticRepositoryPrng(identity) {
+    let state = syntheticRepositoryPrngInitialState(identity);
+    const nextUint32 = () => {
+        state = (state + 0x6d2b79f5) >>> 0;
+        let t = Math.imul(state ^ (state >>> 15), 1 | state);
+        t ^= t + Math.imul(t ^ (t >>> 7), 61 | t);
+        return (t ^ (t >>> 14)) >>> 0;
+    };
+    const nextInt = (maxExclusive) => {
+        if (!Number.isInteger(maxExclusive) || maxExclusive < 1 || maxExclusive > UINT32_RANGE) {
+            throw new RangeError(`nextInt bound must be an integer between 1 and ${UINT32_RANGE} (received ${maxExclusive}).`);
+        }
+        const limit = UINT32_RANGE - (UINT32_RANGE % maxExclusive);
+        let value = nextUint32();
+        while (value >= limit)
+            value = nextUint32();
+        return value % maxExclusive;
+    };
+    return {
+        nextUint32,
+        nextFloat: () => nextUint32() / UINT32_RANGE,
+        nextInt,
+        shuffle(items) {
+            for (let index = items.length - 1; index > 0; index -= 1) {
+                const swapIndex = nextInt(index + 1);
+                const held = items[index];
+                items[index] = items[swapIndex];
+                items[swapIndex] = held;
+            }
+            return items;
+        },
+    };
+}

package/dist/src/evaluation/syntheticRepository/renderPython.js

@@ -0,0 +1,68 @@
+import { assertLogicalPath, buildRenderContext, canonicalText, compareLogicalPaths, exportedSymbolOf, patternCommentLines, SyntheticRepositoryRenderError, } from "./renderShared.js";
+const PY_PROJECT_TOML = canonicalText([
+    "[project]",
+    'name = "synthetic-repository"',
+    'version = "0.0.0"',
+    "",
+    "[tool.pytest.ini_options]",
+    'pythonpath = ["src"]',
+    'testpaths = ["tests"]',
+]);
+/**
+ * Dotted module name of a planned source path. Source modules live under `src/`, which is the Python
+ * import root (`pythonpath = ["src"]`); directories are implicit namespace packages, so no `__init__.py`
+ * support files are needed and none can inflate the planned source-file count.
+ */
+export function pythonModuleName(logicalPath) {
+    if (!logicalPath.startsWith("src/") || !logicalPath.endsWith(".py")) {
+        throw new SyntheticRepositoryRenderError([`python source path ${JSON.stringify(logicalPath)} must be under src/ and end in .py.`]);
+    }
+    return logicalPath.slice("src/".length, -".py".length).split("/").join(".");
+}
+function renderModule(module, context, pathOf) {
+    const dependencies = (context.importsByModule.get(module.moduleId) ?? []).map((target) => ({
+        symbol: exportedSymbolOf(context, target),
+        moduleName: pythonModuleName(pathOf(target)),
+    }));
+    const lines = [`"""Synthetic module ${module.moduleId} (dependency level ${module.level}). Generated by my-dev-kit-lab."""`];
+    for (const dependency of dependencies)
+        lines.push(`from ${dependency.moduleName} import ${dependency.symbol.name}`);
+    for (const pattern of context.patternsByModule.get(module.moduleId) ?? []) {
+        lines.push("", ...patternCommentLines(pattern, "#"));
+    }
+    (context.symbolsByModule.get(module.moduleId) ?? []).forEach((symbol, position) => {
+        lines.push("", "", `def ${symbol.name}(input_value: int) -> int:`, `    """Synthetic symbol ${symbol.name} of ${module.moduleId}."""`, `    total = input_value + ${symbol.ordinal}`);
+        if (position === 0) {
+            for (const dependency of dependencies)
+                lines.push(`    total += ${dependency.symbol.name}(total) % 7`);
+        }
+        lines.push("    return total");
+    });
+    return canonicalText(lines);
+}
+function renderTest(test, context, pathOf) {
+    const names = test.targetSymbolIds.map((symbolId) => context.symbolById.get(symbolId).name);
+    return canonicalText([
+        `from ${pythonModuleName(pathOf(test.targetModuleId))} import ${names.join(", ")}`,
+        "",
+        "",
+        `def test_case_${test.testId.slice("test_".length)}():`,
+        ...names.map((name) => `    assert isinstance(${name}(1), int)`),
+    ]);
+}
+/** Deterministic projection of a Python plan into files, sorted by logical path. */
+export function renderPythonRepository(plan) {
+    const context = buildRenderContext(plan);
+    const pathOf = (moduleId) => context.moduleById.get(moduleId).path;
+    const files = [];
+    for (const module of plan.modules) {
+        assertLogicalPath(module.path, ".py");
+        files.push({ path: module.path, role: "source", language: "python", content: renderModule(module, context, pathOf) });
+    }
+    for (const test of plan.testFiles) {
+        assertLogicalPath(test.path, ".py");
+        files.push({ path: test.path, role: "test", language: "python", content: renderTest(test, context, pathOf) });
+    }
+    files.push({ path: "pyproject.toml", role: "support", content: PY_PROJECT_TOML });
+    return files.sort(compareLogicalPaths);
+}

package/dist/src/evaluation/syntheticRepository/renderRepository.js

@@ -0,0 +1,39 @@
+import { inspectRepositoryFiles } from "./inspection.js";
+import { renderPythonRepository } from "./renderPython.js";
+import { SyntheticRepositoryRenderError } from "./renderShared.js";
+import { renderTypeScriptRepository } from "./renderTypeScript.js";
+/**
+ * Renders a frozen plan into its complete generated file set (sorted by logical path) and proves the files
+ * realize the plan: counts, import edges, patterns and depth are re-measured from the rendered bytes and must
+ * equal the plan, otherwise rendering fails closed. No filesystem access.
+ */
+export function renderSyntheticRepository(plan) {
+    const files = plan.language === "typescript" ? renderTypeScriptRepository(plan) : renderPythonRepository(plan);
+    const inspection = inspectRepositoryFiles(plan.language, files);
+    const errors = [...inspection.issues];
+    const expected = {
+        sourceFileCount: plan.requested.sourceFileCount,
+        moduleDepth: plan.requested.moduleDepth,
+        internalImportCount: plan.requested.internalImportCount,
+        symbolCount: plan.requested.symbolCount,
+        testFileCount: plan.requested.testFileCount,
+        repeatedPatternCount: plan.requested.repeatedPatternCount,
+    };
+    for (const key of Object.keys(expected)) {
+        if (inspection.dimensions[key] !== expected[key]) {
+            errors.push(`rendered ${key} ${inspection.dimensions[key]} does not equal planned ${expected[key]}.`);
+        }
+    }
+    const plannedEdges = new Map(plan.modules.map((module) => [module.moduleId, module.path]));
+    const expectedEdges = plan.importEdges
+        .map((edge) => `${plannedEdges.get(edge.from)} -> ${plannedEdges.get(edge.to)}`)
+        .sort();
+    if (expectedEdges.join("\n") !== inspection.importEdges.join("\n"))
+        errors.push("rendered import edges do not equal the planned import edges.");
+    const plannedNames = plan.symbols.map((symbol) => symbol.name).sort();
+    if (plannedNames.join("\n") !== [...inspection.symbolNames].sort().join("\n"))
+        errors.push("rendered symbols do not equal the planned symbols.");
+    if (errors.length > 0)
+        throw new SyntheticRepositoryRenderError(errors);
+    return files;
+}

package/dist/src/evaluation/syntheticRepository/renderShared.js

@@ -0,0 +1,93 @@
+import path from "node:path";
+/** Thrown when a plan cannot be faithfully rendered or a rendered file set disagrees with its plan. */
+export class SyntheticRepositoryRenderError extends Error {
+    errors;
+    constructor(errors) {
+        super(`Synthetic repository rendering failed: ${errors.join("; ")}`);
+        this.name = "SyntheticRepositoryRenderError";
+        this.errors = [...errors];
+    }
+}
+/** Distinct marker token of one counted repeated pattern occurrence. Appears nowhere else in generated text. */
+export const REPEATED_PATTERN_MARKER = "@synthetic-pattern";
+const PATTERN_ROLE_LINES = {
+    "helper-block": ["Repeated helper block: shared utility shape reused across modules."],
+    "table-block": ["Repeated table block: static lookup shape reused across modules."],
+    "doc-block": ["Repeated documentation block: explanatory text reused across modules."],
+    "guard-block": ["Repeated guard block: input validation shape reused across modules."],
+};
+/** Canonical text: LF only, no BOM, exactly one trailing newline. Rejects any host line ending or BOM in input lines. */
+export function canonicalText(lines) {
+    for (const line of lines) {
+        if (line.includes("\r") || line.includes("\n") || line.includes("")) {
+            throw new SyntheticRepositoryRenderError(["rendered line contains a carriage return, newline or byte-order mark."]);
+        }
+    }
+    return `${lines.join("\n")}\n`;
+}
+export function patternCommentLines(pattern, comment) {
+    return [
+        `${comment} ${REPEATED_PATTERN_MARKER} ${pattern.patternId} ordinal=${pattern.ordinal} role=${pattern.role}`,
+        ...PATTERN_ROLE_LINES[pattern.role].map((line) => `${comment} ${line}`),
+        `${comment} @end-synthetic-pattern ${pattern.patternId}`,
+    ];
+}
+export function buildRenderContext(plan) {
+    const symbolById = new Map(plan.symbols.map((symbol) => [symbol.symbolId, symbol]));
+    const moduleById = new Map(plan.modules.map((module) => [module.moduleId, module]));
+    const symbolsByModule = new Map();
+    for (const module of plan.modules) {
+        const own = module.symbolIds.map((symbolId) => symbolById.get(symbolId));
+        if (own.length === 0 || own.some((symbol) => symbol === undefined)) {
+            throw new SyntheticRepositoryRenderError([`module ${module.moduleId} has no resolvable planned symbol.`]);
+        }
+        symbolsByModule.set(module.moduleId, own);
+    }
+    const patternsByModule = new Map();
+    for (const pattern of plan.repeatedPatterns) {
+        if (!moduleById.has(pattern.targetModuleId)) {
+            throw new SyntheticRepositoryRenderError([`pattern ${pattern.patternId} targets missing module ${pattern.targetModuleId}.`]);
+        }
+        const list = patternsByModule.get(pattern.targetModuleId) ?? [];
+        list.push(pattern);
+        patternsByModule.set(pattern.targetModuleId, list);
+    }
+    const importsByModule = new Map();
+    for (const edge of plan.importEdges) {
+        if (!moduleById.has(edge.from) || !moduleById.has(edge.to)) {
+            throw new SyntheticRepositoryRenderError([`import edge ${edge.from} -> ${edge.to} references a missing module.`]);
+        }
+        const list = importsByModule.get(edge.from) ?? [];
+        list.push(edge.to);
+        importsByModule.set(edge.from, list);
+    }
+    return { symbolsByModule, patternsByModule, importsByModule, moduleById, symbolById };
+}
+/** The symbol other modules import from `moduleId`: its first planned symbol. */
+export function exportedSymbolOf(context, moduleId) {
+    return context.symbolsByModule.get(moduleId)[0];
+}
+/** Rejects planned paths that are not plain relative POSIX logical paths. */
+export function assertLogicalPath(logicalPath, extension) {
+    const segments = logicalPath.split("/");
+    if (logicalPath.length === 0 ||
+        logicalPath.startsWith("/") ||
+        logicalPath.includes("\\") ||
+        logicalPath.includes(":") ||
+        segments.some((segment) => segment === "" || segment === "." || segment === "..") ||
+        !logicalPath.endsWith(extension)) {
+        throw new SyntheticRepositoryRenderError([`planned path ${JSON.stringify(logicalPath)} cannot be rendered as a safe ${extension} path.`]);
+    }
+}
+/** Relative POSIX specifier from the directory of `fromPath` to `toPath`. */
+export function relativeSpecifier(fromPath, toPath) {
+    const relative = path.posix.relative(path.posix.dirname(fromPath), toPath);
+    return relative.startsWith(".") ? relative : `./${relative}`;
+}
+export function compareLogicalPaths(left, right) {
+    if (left.path < right.path)
+        return -1;
+    if (left.path > right.path)
+        return 1;
+    return 0;
+}

package/dist/src/evaluation/syntheticRepository/renderTypeScript.js

@@ -0,0 +1,82 @@
+import { assertLogicalPath, buildRenderContext, canonicalText, compareLogicalPaths, exportedSymbolOf, patternCommentLines, relativeSpecifier, } from "./renderShared.js";
+const TS_PACKAGE_JSON = canonicalText([
+    "{",
+    '  "name": "synthetic-repository",',
+    '  "version": "0.0.0",',
+    '  "private": true,',
+    '  "type": "module",',
+    '  "scripts": {',
+    '    "test": "vitest run"',
+    "  }",
+    "}",
+]);
+const TS_CONFIG_JSON = canonicalText([
+    "{",
+    '  "compilerOptions": {',
+    '    "target": "ES2022",',
+    '    "module": "NodeNext",',
+    '    "moduleResolution": "NodeNext",',
+    '    "strict": true,',
+    '    "noEmit": true,',
+    '    "skipLibCheck": true',
+    "  },",
+    '  "include": ["src", "tests"]',
+    "}",
+]);
+/** `.ts` logical path to the NodeNext `.js` import specifier. */
+function importSpecifier(fromPath, toPath) {
+    return relativeSpecifier(fromPath, toPath).replace(/\.ts$/, ".js");
+}
+function renderModule(module, context, pathOf) {
+    const lines = [`// Synthetic module ${module.moduleId} (dependency level ${module.level}). Generated by my-dev-kit-lab.`];
+    const dependencies = (context.importsByModule.get(module.moduleId) ?? []).map((target) => ({
+        target,
+        symbol: exportedSymbolOf(context, target),
+    }));
+    for (const dependency of dependencies) {
+        lines.push(`import { ${dependency.symbol.name} } from "${importSpecifier(module.path, pathOf(dependency.target))}";`);
+    }
+    for (const pattern of context.patternsByModule.get(module.moduleId) ?? []) {
+        lines.push("", ...patternCommentLines(pattern, "//"));
+    }
+    (context.symbolsByModule.get(module.moduleId) ?? []).forEach((symbol, position) => {
+        lines.push("", `/** Synthetic symbol ${symbol.name} of ${module.moduleId}. */`, `export function ${symbol.name}(input: number): number {`, `  let total = input + ${symbol.ordinal};`);
+        if (position === 0) {
+            for (const dependency of dependencies)
+                lines.push(`  total += ${dependency.symbol.name}(total) % 7;`);
+        }
+        lines.push("  return total;", "}");
+    });
+    return canonicalText(lines);
+}
+function renderTest(test, context) {
+    const target = context.moduleById.get(test.targetModuleId);
+    const names = test.targetSymbolIds.map((symbolId) => context.symbolById.get(symbolId).name);
+    return canonicalText([
+        'import { describe, expect, it } from "vitest";',
+        `import { ${names.join(", ")} } from "${importSpecifier(test.path, target.path)}";`,
+        "",
+        `describe("${test.testId}", () => {`,
+        `  it("exercises ${target.moduleId}", () => {`,
+        ...names.map((name) => `    expect(typeof ${name}(1)).toBe("number");`),
+        "  });",
+        "});",
+    ]);
+}
+/** Deterministic projection of a TypeScript plan into files, sorted by logical path. */
+export function renderTypeScriptRepository(plan) {
+    const context = buildRenderContext(plan);
+    const pathOf = (moduleId) => context.moduleById.get(moduleId).path;
+    const files = [];
+    for (const module of plan.modules) {
+        assertLogicalPath(module.path, ".ts");
+        files.push({ path: module.path, role: "source", language: "typescript", content: renderModule(module, context, pathOf) });
+    }
+    for (const test of plan.testFiles) {
+        assertLogicalPath(test.path, ".test.ts");
+        files.push({ path: test.path, role: "test", language: "typescript", content: renderTest(test, context) });
+    }
+    files.push({ path: "package.json", role: "support", content: TS_PACKAGE_JSON });
+    files.push({ path: "tsconfig.json", role: "support", content: TS_CONFIG_JSON });
+    return files.sort(compareLogicalPaths);
+}

package/dist/src/evaluation/syntheticRepository/topology.js

@@ -0,0 +1,96 @@
+import { maxImportEdges } from "./config.js";
+import { SyntheticRepositoryPlanningError } from "./types.js";
+/**
+ * Plans the acyclic import graph: exactly `internalImportCount` unique edges whose longest chain has exactly
+ * `moduleDepth` modules. Modules live on `moduleDepth` levels and may only import modules on a deeper level,
+ * so the longest chain can never exceed `moduleDepth`; one spine chain guarantees it reaches it.
+ * Assumes a validated request (feasibility is also re-checked defensively).
+ */
+export function planTopology(request, prng) {
+    const { sourceFileCount, moduleDepth, internalImportCount } = request;
+    if (internalImportCount > maxImportEdges(sourceFileCount, moduleDepth) || internalImportCount < moduleDepth - 1) {
+        throw new SyntheticRepositoryPlanningError([
+            `topology request is infeasible: ${sourceFileCount} modules, depth ${moduleDepth}, ${internalImportCount} edges.`,
+        ]);
+    }
+    const levelSizes = new Array(moduleDepth).fill(1);
+    for (let extra = moduleDepth; extra < sourceFileCount; extra += 1) {
+        levelSizes[prng.nextInt(moduleDepth)] += 1;
+    }
+    let sumOfSquares = levelSizes.reduce((total, size) => total + size * size, 0);
+    let capacity = (sourceFileCount * sourceFileCount - sumOfSquares) / 2;
+    while (capacity < internalImportCount) {
+        let largest = 0;
+        let smallest = 0;
+        for (let level = 1; level < moduleDepth; level += 1) {
+            if (levelSizes[level] > levelSizes[largest])
+                largest = level;
+            if (levelSizes[level] < levelSizes[smallest])
+                smallest = level;
+        }
+        if (levelSizes[largest] - levelSizes[smallest] < 2) {
+            throw new SyntheticRepositoryPlanningError(["topology rebalancing exhausted before reaching the requested edge count."]);
+        }
+        const from = levelSizes[largest];
+        const to = levelSizes[smallest];
+        sumOfSquares += (from - 1) * (from - 1) + (to + 1) * (to + 1) - from * from - to * to;
+        levelSizes[largest] -= 1;
+        levelSizes[smallest] += 1;
+        capacity = (sourceFileCount * sourceFileCount - sumOfSquares) / 2;
+    }
+    const levelStart = [];
+    const levelEnd = [];
+    const levelOfModule = new Array(sourceFileCount);
+    let cursor = 0;
+    for (let level = 0; level < moduleDepth; level += 1) {
+        levelStart.push(cursor);
+        for (let count = 0; count < levelSizes[level]; count += 1) {
+            levelOfModule[cursor] = level;
+            cursor += 1;
+        }
+        levelEnd.push(cursor);
+    }
+    // Candidate edge ranks: modules in index order, each followed by the modules on strictly deeper levels.
+    const cumulative = new Array(sourceFileCount + 1);
+    cumulative[0] = 0;
+    for (let module = 0; module < sourceFileCount; module += 1) {
+        cumulative[module + 1] = cumulative[module] + (sourceFileCount - levelEnd[levelOfModule[module]]);
+    }
+    const totalRanks = cumulative[sourceFileCount];
+    const rankToEdge = (rank) => {
+        let low = 0;
+        let high = sourceFileCount - 1;
+        while (low < high) {
+            const middle = Math.ceil((low + high) / 2);
+            if (cumulative[middle] <= rank)
+                low = middle;
+            else
+                high = middle - 1;
+        }
+        return [low, levelEnd[levelOfModule[low]] + (rank - cumulative[low])];
+    };
+    const spineRanks = [];
+    for (let level = 0; level + 1 < moduleDepth; level += 1) {
+        spineRanks.push(cumulative[levelStart[level]]);
+    }
+    const extraEdges = internalImportCount - spineRanks.length;
+    const freeRanks = totalRanks - spineRanks.length;
+    const chosen = new Set();
+    for (let upper = freeRanks - extraEdges; upper < freeRanks; upper += 1) {
+        const pick = prng.nextInt(upper + 1);
+        chosen.add(chosen.has(pick) ? upper : pick);
+    }
+    const ranks = [...spineRanks];
+    for (const freeIndex of chosen) {
+        let rank = freeIndex;
+        for (const spineRank of spineRanks) {
+            if (spineRank <= rank)
+                rank += 1;
+            else
+                break;
+        }
+        ranks.push(rank);
+    }
+    ranks.sort((left, right) => left - right);
+    return { levelSizes, levelOfModule, edges: ranks.map(rankToEdge) };
+}

package/dist/src/evaluation/syntheticRepository/types.js

@@ -0,0 +1,26 @@
+export const SYNTHETIC_REPOSITORY_CONFIG_SCHEMA_ID = "my-dev-kit-lab-synthetic-repository-config-v1";
+export const SYNTHETIC_REPOSITORY_CONFIG_SCHEMA_VERSION = "1.0.0";
+export const SYNTHETIC_REPOSITORY_PLAN_SCHEMA_ID = "my-dev-kit-lab-synthetic-repository-plan-v1";
+export const SYNTHETIC_REPOSITORY_PLAN_SCHEMA_VERSION = "1.0.0";
+export const SYNTHETIC_REPOSITORY_IDENTITY_ALGORITHM_VERSION = "sha256-canonical-json-v1";
+export const SYNTHETIC_REPOSITORY_PRNG_VERSION = "mulberry32-v1";
+export const SYNTHETIC_REPOSITORY_LANGUAGES = ["typescript", "python"];
+export const SYNTHETIC_REPOSITORY_PATTERN_ROLES = ["helper-block", "table-block", "doc-block", "guard-block"];
+/** Thrown for invalid configuration or case input; `errors` carries every labelled validation error. */
+export class SyntheticRepositoryConfigError extends Error {
+    errors;
+    constructor(errors) {
+        super(`Invalid synthetic repository configuration: ${errors.join("; ")}`);
+        this.name = "SyntheticRepositoryConfigError";
+        this.errors = [...errors];
+    }
+}
+/** Thrown when a plan cannot be produced or fails its own invariant verification. */
+export class SyntheticRepositoryPlanningError extends Error {
+    errors;
+    constructor(errors) {
+        super(`Synthetic repository planning failed: ${errors.join("; ")}`);
+        this.name = "SyntheticRepositoryPlanningError";
+        this.errors = [...errors];
+    }
+}

package/dist/src/evaluation/targetImmutability/captureTargetSnapshot.js

@@ -18,7 +18,7 @@ function isInsideRoot(resolvedRoot, candidate) {
     const relative = path.relative(resolvedRoot, candidate);
     return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
 }
-async function snapshotPathEntry(resolvedPath) {
+async function snapshotPathEntry(resolvedPath, maxHashedFileBytes) {
     let stats;
     try {
         stats = await lstat(resolvedPath);
@@ -38,6 +38,15 @@ async function snapshotPathEntry(resolvedPath) {
         return { state: "directory", sha256: null, symbolicLinkTarget: null };
     }
     if (stats.isFile()) {
+        if (maxHashedFileBytes !== undefined && stats.size > maxHashedFileBytes) {
+            // Safe mode: a file above the bound is fingerprinted by metadata and its contents are never read.
+            return {
+                state: "file",
+                sha256: null,
+                symbolicLinkTarget: null,
+                contentFingerprint: { sizeBytes: stats.size, mtimeMs: stats.mtimeMs }
+            };
+        }
         const contents = await readFile(resolvedPath);
         return { state: "file", sha256: sha256Hex(contents), symbolicLinkTarget: null };
     }
@@ -69,8 +78,9 @@ async function runRequiredGit(resolvedRoot, args, targetRootPath) {
         : `git ${args.join(" ")} failed: ${result.message}`;
     return { ok: false, code, targetRootPath, message };
 }
-export async function captureTargetSnapshot(config) {
+export async function captureTargetSnapshot(config, options = {}) {
     const resolvedTargetRootPath = path.resolve(config.targetRootPath);
+    const maxHashedFileBytes = options.externalLocalSafe?.maxHashedFileBytes;
     let rootStats;
     try {
         rootStats = await lstat(resolvedTargetRootPath);
@@ -113,13 +123,14 @@ export async function captureTargetSnapshot(config) {
             };
         }
         try {
-            const entry = await snapshotPathEntry(resolvedPath);
+            const entry = await snapshotPathEntry(resolvedPath, maxHashedFileBytes);
             configuredFiles.push({
                 relativePath,
                 resolvedPath,
                 state: entry.state,
                 sha256: entry.sha256,
-                symbolicLinkTarget: entry.symbolicLinkTarget
+                symbolicLinkTarget: entry.symbolicLinkTarget,
+                ...(entry.contentFingerprint ? { contentFingerprint: entry.contentFingerprint } : {})
             });
         }
         catch (error) {
@@ -183,15 +194,25 @@ export async function captureTargetSnapshot(config) {
     const untrackedFiles = [];
     for (const untrackedRelativePath of untrackedPaths) {
         const resolvedPath = path.resolve(resolvedTargetRootPath, untrackedRelativePath);
-        const entry = await snapshotPathEntry(resolvedPath);
+        const entry = await snapshotPathEntry(resolvedPath, maxHashedFileBytes);
         const state = entry.state === "directory" ? "other" : entry.state;
         untrackedFiles.push({
             path: untrackedRelativePath,
             state,
             sha256: entry.sha256,
-            symbolicLinkTarget: entry.symbolicLinkTarget
+            symbolicLinkTarget: entry.symbolicLinkTarget,
+            ...(entry.contentFingerprint ? { contentFingerprint: entry.contentFingerprint } : {})
         });
     }
+    let ignoredPaths;
+    if (maxHashedFileBytes !== undefined) {
+        // Safe mode: Lab-created files in ignored locations (for example a stray index directory) are invisible to
+        // `git status`, so record the ignored path set by name. Contents are never read.
+        const ignoredOutcome = await runRequiredGit(resolvedTargetRootPath, ["ls-files", "--others", "--ignored", "--exclude-standard", "-z"], config.targetRootPath);
+        if (!ignoredOutcome.ok)
+            return ignoredOutcome;
+        ignoredPaths = ignoredOutcome.stdout.split("\0").filter((entry) => entry.length > 0).sort();
+    }
     const git = {
         availability: "available",
         branch,
@@ -199,7 +220,8 @@ export async function captureTargetSnapshot(config) {
         statusEntries,
         worktreeDiffSha256,
         stagedDiffSha256,
-        untrackedFiles
+        untrackedFiles,
+        ...(ignoredPaths !== undefined ? { ignoredPaths } : {})
     };
     return {
         ok: true,

package/dist/src/evaluation/targetImmutability/compareTargetSnapshots.js

@@ -38,6 +38,10 @@ export function compareTargetSnapshots(before, after) {
             mutations.push(mutation(`git.untracked:${afterEntry.path}`, "git-untracked-file", `git.untrackedFiles.${afterEntry.path}`, null, afterEntry));
         }
     }
+    if ((before.git.ignoredPaths !== undefined || after.git.ignoredPaths !== undefined) &&
+        !isDeepStrictEqual(before.git.ignoredPaths ?? null, after.git.ignoredPaths ?? null)) {
+        mutations.push(mutation("git.ignored-paths", "git-ignored-paths", "git.ignoredPaths", (before.git.ignoredPaths ?? null), (after.git.ignoredPaths ?? null)));
+    }
     const afterConfiguredByPath = new Map(after.configuredFiles.map((entry) => [entry.relativePath, entry]));
     for (const beforeEntry of before.configuredFiles) {
         const afterEntry = afterConfiguredByPath.get(beforeEntry.relativePath);

package/dist/src/experiments/plugins/contextWindowScaling/index.js

@@ -12,3 +12,4 @@ export * from "./projectProfile.js";
 export * from "./relevantFiles.js";
 export * from "./successEvidence.js";
 export * from "./types.js";
+export * from "./syntheticInputs.js";

package/dist/src/experiments/plugins/contextWindowScaling/localSubjectErrors.js

@@ -0,0 +1,35 @@
+/**
+ * Thrown when a local-subject execution did not complete cleanly. The primary code is the first issue in the
+ * ordered list (execution, mutation, snapshot, cleanup); every issue is retained so a secondary failure never
+ * masks the primary one. `caseEvidence` and `immutability` are runtime-only partial evidence for forensics and
+ * must not be persisted without the later privacy projection.
+ */
+export class LocalSubjectExecutionError extends Error {
+    code;
+    issues;
+    caseEvidence;
+    immutability;
+    constructor(issues, partial = {}) {
+        if (issues.length === 0)
+            throw new Error("LocalSubjectExecutionError requires at least one issue.");
+        super(`Local subject execution failed (${issues[0].code}): ${issues.map((issue) => issue.message).join("; ")}`);
+        this.name = "LocalSubjectExecutionError";
+        this.code = issues[0].code;
+        this.issues = [...issues];
+        this.caseEvidence = partial.caseEvidence ?? null;
+        this.immutability = partial.immutability ?? null;
+    }
+}
+/** Replaces absolute private roots in a message so errors never carry the target or scratch location. */
+export function redactPrivatePaths(message, privatePaths) {
+    let redacted = message;
+    for (const privatePath of privatePaths) {
+        if (!privatePath)
+            continue;
+        const variants = new Set([privatePath, privatePath.replace(/\\/g, "/"), privatePath.replace(/\//g, "\\")]);
+        for (const variant of variants) {
+            redacted = redacted.split(variant).join("<private-path>");
+        }
+    }
+    return redacted;
+}