@dailephd/my-dev-kit-lab 0.8.2 → 0.9.0

package/dist/src/evaluation/agentSuccess/validateAgentSuccessTask.js

@@ -0,0 +1,297 @@
+import { TASK_LOCALITIES } from "../types.js";
+import { normalizeProjectRelativePath } from "./taskPaths.js";
+import { AGENT_SUCCESS_TASK_SCHEMA_VERSION, AgentSuccessTaskValidationError, MAX_VERIFICATION_CHECK_TIMEOUT_MS } from "./taskTypes.js";
+const MAX_ISSUES = 50;
+const MAX_SHORT_TEXT = 1000;
+const MAX_INSTRUCTION = 20_000;
+const MAX_FIXTURE_PATCH_BYTES = 1_048_576;
+const MAX_CHECK_ARGS = 64;
+const MAX_CHECK_ARG_LENGTH = 4096;
+const ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const CHECK_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const TASK_FIELDS = [
+    "schemaVersion",
+    "id",
+    "title",
+    "benchmarkProject",
+    "projectProfileRef",
+    "taskLocality",
+    "query",
+    "sourceRoots",
+    "rawIncludeGlobs",
+    "instruction",
+    "expectedEditFiles",
+    "allowedEditFiles",
+    "protectedFiles",
+    "taskChecks",
+    "regressionChecks",
+    "behaviorFacts",
+    "deterministicFixture"
+];
+const CHECK_FIELDS = ["id", "executable", "args", "timeoutMs"];
+const FACT_FIELDS = ["id", "text", "required", "verificationCheckIds"];
+const FIXTURE_FIELDS = ["id", "patch", "notes"];
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+class IssueCollector {
+    issues = [];
+    add(code, path, message) {
+        if (this.issues.length < MAX_ISSUES)
+            this.issues.push({ code, path, message });
+    }
+}
+function rejectUnknownFields(collector, value, allowed, base) {
+    for (const key of Object.keys(value)) {
+        if (!allowed.includes(key))
+            collector.add("UNKNOWN_FIELD", base === "" ? key : `${base}.${key}`, `unknown field "${key}".`);
+    }
+}
+function readText(collector, source, key, base, maxLength) {
+    const path = base === "" ? key : `${base}.${key}`;
+    const value = source[key];
+    if (value === undefined) {
+        collector.add("MISSING_FIELD", path, "required field is missing.");
+        return "";
+    }
+    if (typeof value !== "string" || value.trim() === "") {
+        collector.add("INVALID_TYPE", path, "must be a non-empty string.");
+        return "";
+    }
+    if (value.length > maxLength) {
+        collector.add("INVALID_VALUE", path, `must be at most ${maxLength} characters.`);
+    }
+    return value;
+}
+function readArray(collector, source, key) {
+    const value = source[key];
+    if (value === undefined) {
+        collector.add("MISSING_FIELD", key, "required field is missing.");
+        return undefined;
+    }
+    if (!Array.isArray(value)) {
+        collector.add("INVALID_TYPE", key, "must be an array.");
+        return undefined;
+    }
+    return value;
+}
+/** Normalizes, rejects duplicates, and returns the list sorted in code-unit order. */
+function readPathList(collector, source, key, requireNonEmpty) {
+    const raw = readArray(collector, source, key);
+    if (raw === undefined)
+        return [];
+    if (requireNonEmpty && raw.length === 0)
+        collector.add("INVALID_VALUE", key, "must not be empty.");
+    const seen = new Set();
+    raw.forEach((entry, index) => {
+        const normalized = normalizeProjectRelativePath(entry);
+        const path = `${key}[${index}]`;
+        if (!normalized.ok) {
+            collector.add(normalized.code, path, `unsafe or malformed project-relative path.`);
+            return;
+        }
+        if (seen.has(normalized.path)) {
+            collector.add("DUPLICATE_PATH", path, `duplicate path after normalization: ${normalized.path}.`);
+            return;
+        }
+        seen.add(normalized.path);
+    });
+    return [...seen].sort();
+}
+function readGlobList(collector, source, key) {
+    const raw = readArray(collector, source, key);
+    if (raw === undefined)
+        return [];
+    if (raw.length === 0)
+        collector.add("INVALID_VALUE", key, "must not be empty.");
+    const globs = [];
+    raw.forEach((entry, index) => {
+        const path = `${key}[${index}]`;
+        if (typeof entry !== "string" || entry.trim() === "" || entry.includes("\0")) {
+            collector.add("INVALID_TYPE", path, "must be a non-empty string without NUL.");
+        }
+        else if (/^([A-Za-z]:|[\\/])/.test(entry) || entry.replace(/\\/g, "/").split("/").includes("..")) {
+            collector.add("INVALID_VALUE", path, "must be a project-relative glob without traversal.");
+        }
+        else {
+            globs.push(entry);
+        }
+    });
+    return globs;
+}
+function readChecks(collector, source, key) {
+    const raw = readArray(collector, source, key);
+    if (raw === undefined)
+        return [];
+    if (raw.length < 1)
+        collector.add("TOO_FEW_CHECKS", key, "at least one check is required.");
+    const checks = [];
+    raw.forEach((entry, index) => {
+        const base = `${key}[${index}]`;
+        if (!isRecord(entry)) {
+            collector.add("NOT_OBJECT", base, "must be an object.");
+            return;
+        }
+        rejectUnknownFields(collector, entry, CHECK_FIELDS, base);
+        const id = entry.id;
+        if (typeof id !== "string" || !CHECK_ID_PATTERN.test(id)) {
+            collector.add("INVALID_VALUE", `${base}.id`, `must match ${CHECK_ID_PATTERN.source}.`);
+        }
+        if (entry.executable !== "node") {
+            collector.add("INVALID_EXECUTABLE", `${base}.executable`, 'the only supported executable is "node".');
+        }
+        const args = entry.args;
+        if (!Array.isArray(args) ||
+            args.length > MAX_CHECK_ARGS ||
+            !args.every((arg) => typeof arg === "string" && !arg.includes("\0") && arg.length <= MAX_CHECK_ARG_LENGTH)) {
+            collector.add("INVALID_TYPE", `${base}.args`, `must be an array of at most ${MAX_CHECK_ARGS} strings without NUL.`);
+        }
+        const timeoutMs = entry.timeoutMs;
+        if (typeof timeoutMs !== "number" || !Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_VERIFICATION_CHECK_TIMEOUT_MS) {
+            collector.add("INVALID_TIMEOUT", `${base}.timeoutMs`, `must be a finite number in (0, ${MAX_VERIFICATION_CHECK_TIMEOUT_MS}].`);
+        }
+        if (typeof id === "string" && Array.isArray(args) && typeof timeoutMs === "number") {
+            checks.push({ id, executable: "node", args: args, timeoutMs });
+        }
+    });
+    return checks;
+}
+function readFacts(collector, source, checkIds) {
+    const raw = readArray(collector, source, "behaviorFacts");
+    if (raw === undefined)
+        return [];
+    const facts = [];
+    const seen = new Set();
+    raw.forEach((entry, index) => {
+        const base = `behaviorFacts[${index}]`;
+        if (!isRecord(entry)) {
+            collector.add("NOT_OBJECT", base, "must be an object.");
+            return;
+        }
+        rejectUnknownFields(collector, entry, FACT_FIELDS, base);
+        const id = readText(collector, entry, "id", base, 128);
+        const text = readText(collector, entry, "text", base, MAX_SHORT_TEXT);
+        if (id !== "" && seen.has(id))
+            collector.add("DUPLICATE_FACT_ID", `${base}.id`, `duplicate fact id: ${id}.`);
+        seen.add(id);
+        if (typeof entry.required !== "boolean")
+            collector.add("INVALID_TYPE", `${base}.required`, "must be a boolean.");
+        const ids = entry.verificationCheckIds;
+        if (!Array.isArray(ids) || !ids.every((value) => typeof value === "string")) {
+            collector.add("INVALID_TYPE", `${base}.verificationCheckIds`, "must be an array of strings.");
+            return;
+        }
+        ids.forEach((checkId, checkIndex) => {
+            if (!checkIds.has(checkId)) {
+                collector.add("UNRESOLVED_CHECK_ID", `${base}.verificationCheckIds[${checkIndex}]`, `unknown check id: ${checkId}.`);
+            }
+        });
+        if (entry.required === true && ids.length === 0) {
+            collector.add("REQUIRED_FACT_UNMAPPED", `${base}.verificationCheckIds`, "a required fact must reference at least one check.");
+        }
+        facts.push({ id, text, required: entry.required === true, verificationCheckIds: [...ids] });
+    });
+    return facts;
+}
+function readFixture(collector, source) {
+    const raw = source.deterministicFixture;
+    if (raw === undefined)
+        return undefined;
+    if (!isRecord(raw)) {
+        collector.add("NOT_OBJECT", "deterministicFixture", "must be an object.");
+        return undefined;
+    }
+    rejectUnknownFields(collector, raw, FIXTURE_FIELDS, "deterministicFixture");
+    const id = readText(collector, raw, "id", "deterministicFixture", 128);
+    const patch = readText(collector, raw, "patch", "deterministicFixture", MAX_FIXTURE_PATCH_BYTES);
+    const fixture = { id, patch };
+    if (raw.notes !== undefined) {
+        if (typeof raw.notes === "string")
+            fixture.notes = raw.notes;
+        else
+            collector.add("INVALID_TYPE", "deterministicFixture.notes", "must be a string.");
+    }
+    return fixture;
+}
+/**
+ * Validates an AgentSuccessTaskV1 candidate. Closed-set: unknown fields are rejected. Returns the normalized
+ * task (POSIX paths, sorted, de-duplicated by rejection) or a bounded, deterministically ordered issue list.
+ */
+export function validateAgentSuccessTask(input) {
+    const collector = new IssueCollector();
+    if (!isRecord(input)) {
+        collector.add("NOT_OBJECT", "", "a task must be an object.");
+        return { ok: false, issues: collector.issues };
+    }
+    rejectUnknownFields(collector, input, TASK_FIELDS, "");
+    if (input.schemaVersion !== AGENT_SUCCESS_TASK_SCHEMA_VERSION) {
+        collector.add("INVALID_SCHEMA_VERSION", "schemaVersion", `must equal ${AGENT_SUCCESS_TASK_SCHEMA_VERSION}.`);
+    }
+    const id = readText(collector, input, "id", "", 128);
+    if (id !== "" && !ID_PATTERN.test(id))
+        collector.add("INVALID_VALUE", "id", `must match ${ID_PATTERN.source}.`);
+    const title = readText(collector, input, "title", "", MAX_SHORT_TEXT);
+    const benchmarkProject = readText(collector, input, "benchmarkProject", "", MAX_SHORT_TEXT);
+    const projectProfileRef = readText(collector, input, "projectProfileRef", "", MAX_SHORT_TEXT);
+    const query = readText(collector, input, "query", "", MAX_SHORT_TEXT);
+    const instruction = readText(collector, input, "instruction", "", MAX_INSTRUCTION);
+    const taskLocality = input.taskLocality;
+    if (!TASK_LOCALITIES.includes(taskLocality)) {
+        collector.add("INVALID_VALUE", "taskLocality", `must be one of ${TASK_LOCALITIES.join(", ")}.`);
+    }
+    const sourceRoots = readPathList(collector, input, "sourceRoots", true);
+    const rawIncludeGlobs = readGlobList(collector, input, "rawIncludeGlobs");
+    const expectedEditFiles = readPathList(collector, input, "expectedEditFiles", false);
+    const allowedEditFiles = readPathList(collector, input, "allowedEditFiles", false);
+    const protectedFiles = readPathList(collector, input, "protectedFiles", false);
+    const allowed = new Set(allowedEditFiles);
+    expectedEditFiles.forEach((file) => {
+        if (!allowed.has(file))
+            collector.add("EXPECTED_NOT_ALLOWED", "expectedEditFiles", `${file} is not in allowedEditFiles.`);
+    });
+    const protectedSet = new Set(protectedFiles);
+    for (const file of [...expectedEditFiles, ...allowedEditFiles]) {
+        if (protectedSet.has(file))
+            collector.add("PROTECTED_OVERLAP", "protectedFiles", `${file} is also an expected or allowed edit file.`);
+    }
+    const taskChecks = readChecks(collector, input, "taskChecks");
+    const regressionChecks = readChecks(collector, input, "regressionChecks");
+    const checkIds = new Set();
+    for (const check of [...taskChecks, ...regressionChecks]) {
+        if (checkIds.has(check.id))
+            collector.add("DUPLICATE_CHECK_ID", "taskChecks", `check id used more than once: ${check.id}.`);
+        checkIds.add(check.id);
+    }
+    const behaviorFacts = readFacts(collector, input, checkIds);
+    const deterministicFixture = readFixture(collector, input);
+    if (collector.issues.length > 0) {
+        return { ok: false, issues: collector.issues };
+    }
+    const task = {
+        schemaVersion: AGENT_SUCCESS_TASK_SCHEMA_VERSION,
+        id,
+        title,
+        benchmarkProject,
+        projectProfileRef,
+        taskLocality: taskLocality,
+        query,
+        sourceRoots,
+        rawIncludeGlobs,
+        instruction,
+        expectedEditFiles,
+        allowedEditFiles,
+        protectedFiles,
+        taskChecks,
+        regressionChecks,
+        behaviorFacts,
+        ...(deterministicFixture ? { deterministicFixture } : {})
+    };
+    return { ok: true, task };
+}
+/** Throwing variant for callers that treat an invalid task as a programming/configuration error. */
+export function assertAgentSuccessTask(input) {
+    const result = validateAgentSuccessTask(input);
+    if (!result.ok)
+        throw new AgentSuccessTaskValidationError(result.issues);
+    return result.task;
+}

package/dist/src/evaluation/agentSuccess/validatePatchPolicy.js

@@ -0,0 +1,66 @@
+import { normalizeProjectRelativePath } from "./taskPaths.js";
+import { DEFAULT_PATCH_BOUNDS } from "./patchTypes.js";
+const MAX_REPORTED_REJECTIONS = 20;
+const SYMLINK_MODE = "120000";
+const GITLINK_MODE = "160000";
+function describeStatus(file) {
+    if (file.isNew || (file.oldPath === null && file.newPath !== null))
+        return "added";
+    if (file.isDelete || (file.newPath === null && file.oldPath !== null))
+        return "deleted";
+    return "modified";
+}
+/**
+ * Applies the Lab's patch policy to a parsed diff. Everything a patch could use to escape the benchmark
+ * copy or to alter protected files is rejected here, before Git sees the patch. A file outside the task's
+ * allowed edit scope is NOT rejected: such edits are legitimate evidence for later measurement.
+ */
+export function validatePatchPolicy(files, options) {
+    const bounds = options.bounds ?? DEFAULT_PATCH_BOUNDS;
+    const rejections = [];
+    const reject = (rejection) => {
+        if (rejections.length < MAX_REPORTED_REJECTIONS)
+            rejections.push(rejection);
+    };
+    const protectedSet = new Set();
+    for (const entry of options.protectedFiles) {
+        const normalized = normalizeProjectRelativePath(entry);
+        if (normalized.ok)
+            protectedSet.add(normalized.path);
+    }
+    const accepted = new Map();
+    for (const file of files) {
+        const label = file.newPath ?? file.oldPath ?? file.gitHeaderPath ?? undefined;
+        if (file.binary)
+            reject({ code: "BINARY_PATCH", path: label, message: "binary patches are not accepted." });
+        if (file.rename || file.copy)
+            reject({ code: "RENAME_OR_COPY", path: label, message: "rename and copy patches are not accepted." });
+        if (file.oldPath !== null && file.newPath !== null && file.oldPath !== file.newPath) {
+            reject({ code: "PATH_MISMATCH", path: label, message: "the old and new paths differ." });
+        }
+        if (file.oldMode === SYMLINK_MODE || file.newMode === SYMLINK_MODE) {
+            reject({ code: "SYMLINK_MODE", path: label, message: "symbolic-link entries are not accepted." });
+        }
+        if (file.oldMode === GITLINK_MODE || file.newMode === GITLINK_MODE || file.subproject) {
+            reject({ code: "SUBMODULE", path: label, message: "submodule/gitlink changes are not accepted." });
+        }
+        const candidates = new Set([file.oldPath, file.newPath, file.oldPath === null && file.newPath === null ? file.gitHeaderPath : null].filter((value) => value !== null));
+        for (const candidate of candidates) {
+            const normalized = normalizeProjectRelativePath(candidate);
+            if (!normalized.ok) {
+                reject({ code: "UNSAFE_PATH", message: `unsafe patch path (${normalized.code}).` });
+                continue;
+            }
+            if (protectedSet.has(normalized.path)) {
+                reject({ code: "PROTECTED_PATH", path: normalized.path, message: "the patch touches a protected file." });
+            }
+            accepted.set(normalized.path, describeStatus(file));
+        }
+    }
+    if (accepted.size > bounds.maxChangedPaths) {
+        rejections.unshift({ code: "TOO_MANY_PATHS", message: `the patch changes more than ${bounds.maxChangedPaths} paths.` });
+    }
+    if (rejections.length > 0)
+        return { ok: false, rejections: rejections.slice(0, MAX_REPORTED_REJECTIONS) };
+    return { ok: true, files: [...accepted].map(([path, status]) => ({ path, status })).sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)) };
+}

package/dist/src/evaluation/agentSuccess/verificationTypes.js

@@ -0,0 +1 @@
+export const VERIFICATION_OUTPUT_LIMIT_BYTES = 1_048_576;

package/dist/src/evaluation/benchmarkSandbox/createBenchmarkSandbox.js

@@ -0,0 +1,127 @@
+import { constants as fsConstants } from "node:fs";
+import { copyFile, lstat, mkdir, realpath, rm, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { resolveWithinRoot } from "../../core/pathSafety.js";
+import { BenchmarkSandboxError } from "./errors.js";
+import { excerptGitFailure, runSandboxGit } from "./gitExecutor.js";
+import { BENCHMARK_SANDBOX_EXCLUDED_NAMES, isSameOrInside, resolvePhysicalPath, SANDBOX_ID_PATTERN } from "./pathPolicy.js";
+import { digestTreeSnapshot, scanProjectTree, snapshotProjectTree } from "./treeSnapshot.js";
+import { BENCHMARK_SANDBOX_BASELINE_BRANCH, BENCHMARK_SANDBOX_OWNER_MARKER_FILE, BENCHMARK_SANDBOX_SCHEMA_VERSION } from "./types.js";
+const BASELINE_COMMIT_MESSAGE = "benchmark sandbox baseline";
+/** Fixed dates make the baseline commit id a pure function of the copied content, so repeated runs agree. */
+const BASELINE_COMMIT_DATE_ENV = Object.freeze({ GIT_AUTHOR_DATE: "2000-01-01T00:00:00Z", GIT_COMMITTER_DATE: "2000-01-01T00:00:00Z" });
+async function pathExists(target) {
+    try {
+        await lstat(target);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function resolveCanonicalProjectRoot(canonicalProjectRoot) {
+    let stats;
+    try {
+        stats = await lstat(path.resolve(canonicalProjectRoot));
+    }
+    catch {
+        throw new BenchmarkSandboxError("CANONICAL_ROOT_INVALID", "the canonical project root does not exist.");
+    }
+    if (stats.isSymbolicLink() || !(await stat(path.resolve(canonicalProjectRoot))).isDirectory()) {
+        throw new BenchmarkSandboxError("CANONICAL_ROOT_INVALID", "the canonical project root must be a real directory.");
+    }
+    return realpath(path.resolve(canonicalProjectRoot));
+}
+async function mustGit(target, args, label, env) {
+    const result = await runSandboxGit(target, args, { label, env });
+    if (result.unavailable) {
+        throw new BenchmarkSandboxError("GIT_UNAVAILABLE", "the git executable is not available.");
+    }
+    if (!result.ok) {
+        throw new BenchmarkSandboxError("GIT_FAILED", `git ${args[0] ?? ""} failed: ${excerptGitFailure(result)}`);
+    }
+    return result;
+}
+/**
+ * Creates one independent, Git-backed disposable copy of a controlled benchmark project inside the
+ * caller-supplied runtime root. Nothing is ever written to the canonical project, and the runtime root is
+ * never defaulted. Order: validate -> scan source (reject links) -> copy -> manifest -> fresh Git baseline.
+ * Any failure after the sandbox directory exists removes that (owned) directory before rethrowing.
+ */
+export async function createBenchmarkSandbox(options) {
+    if (!SANDBOX_ID_PATTERN.test(options.sandboxId)) {
+        throw new BenchmarkSandboxError("INVALID_SANDBOX_ID", `sandbox id must match ${SANDBOX_ID_PATTERN.source}.`);
+    }
+    const canonicalProjectRoot = await resolveCanonicalProjectRoot(options.canonicalProjectRoot);
+    const runtimeRoot = path.resolve(options.runtimeRoot);
+    const physicalRuntimeRoot = await resolvePhysicalPath(runtimeRoot);
+    if (isSameOrInside(canonicalProjectRoot, physicalRuntimeRoot) || isSameOrInside(physicalRuntimeRoot, canonicalProjectRoot)) {
+        throw new BenchmarkSandboxError("RUNTIME_OVERLAP", "the runtime root and the canonical project must not overlap.");
+    }
+    const sandboxRoot = resolveWithinRoot(runtimeRoot, options.sandboxId);
+    if (await pathExists(sandboxRoot)) {
+        throw new BenchmarkSandboxError("SANDBOX_EXISTS", "refusing to overwrite an existing sandbox directory.");
+    }
+    // Reject links and unsupported entries before anything is created under the runtime root.
+    const sourceFiles = await scanProjectTree(canonicalProjectRoot, BENCHMARK_SANDBOX_EXCLUDED_NAMES);
+    if (sourceFiles.length === 0) {
+        throw new BenchmarkSandboxError("EMPTY_PROJECT", "the canonical project has no copyable files.");
+    }
+    await mkdir(runtimeRoot, { recursive: true });
+    await mkdir(sandboxRoot);
+    try {
+        const marker = {
+            schemaVersion: BENCHMARK_SANDBOX_SCHEMA_VERSION,
+            sandboxId: options.sandboxId,
+            runtimeRoot,
+            canonicalProjectRoot
+        };
+        await writeFile(path.join(sandboxRoot, BENCHMARK_SANDBOX_OWNER_MARKER_FILE), `${JSON.stringify(marker, null, 2)}\n`, "utf8");
+        const projectRoot = path.join(sandboxRoot, "project");
+        const evidenceRoot = path.join(sandboxRoot, "evidence");
+        await mkdir(projectRoot);
+        await mkdir(evidenceRoot);
+        for (const relativePath of sourceFiles) {
+            const segments = relativePath.split("/");
+            const destination = path.join(projectRoot, ...segments);
+            await mkdir(path.dirname(destination), { recursive: true });
+            await copyFile(path.join(canonicalProjectRoot, ...segments), destination, fsConstants.COPYFILE_EXCL);
+        }
+        const manifest = await snapshotProjectTree(projectRoot, { excludedNames: [".git"] });
+        if (manifest.length !== sourceFiles.length || manifest.some((entry, index) => entry.path !== sourceFiles[index])) {
+            throw new BenchmarkSandboxError("COPY_MISMATCH", "the copied tree does not match the scanned source file list.");
+        }
+        const git = { projectRoot, evidenceRoot };
+        await mustGit(git, ["init", "-q", `--initial-branch=${BENCHMARK_SANDBOX_BASELINE_BRANCH}`], "init");
+        await mustGit(git, ["config", "user.name", "my-dev-kit-lab sandbox"], "config-name");
+        await mustGit(git, ["config", "user.email", "sandbox@my-dev-kit-lab.invalid"], "config-email");
+        await mustGit(git, ["config", "commit.gpgsign", "false"], "config-gpg");
+        await mustGit(git, ["config", "core.autocrlf", "false"], "config-autocrlf");
+        await mustGit(git, ["config", "core.longpaths", "true"], "config-longpaths");
+        await mustGit(git, ["config", "core.symlinks", "false"], "config-symlinks");
+        await mustGit(git, ["add", "-A", "--force"], "add");
+        await mustGit(git, ["commit", "-q", "--no-verify", "-m", BASELINE_COMMIT_MESSAGE], "commit", BASELINE_COMMIT_DATE_ENV);
+        const commit = (await mustGit(git, ["rev-parse", "HEAD"], "rev-parse")).stdout.trim();
+        const status = await mustGit(git, ["status", "--porcelain"], "status");
+        if (status.stdout.trim() !== "") {
+            throw new BenchmarkSandboxError("BASELINE_NOT_CLEAN", "git status is not clean after the baseline commit.");
+        }
+        return {
+            schemaVersion: BENCHMARK_SANDBOX_SCHEMA_VERSION,
+            sandboxId: options.sandboxId,
+            sandboxRoot,
+            projectRoot,
+            evidenceRoot,
+            runtimeRoot,
+            canonicalProjectRoot,
+            baseline: { commit, fileCount: manifest.length, digest: digestTreeSnapshot(manifest), manifest }
+        };
+    }
+    catch (error) {
+        // Only this call's own directory exists at this point; removal cannot touch anything else.
+        await rm(sandboxRoot, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 }).catch(() => undefined);
+        if (error instanceof BenchmarkSandboxError)
+            throw error;
+        throw new BenchmarkSandboxError("COPY_FAILED", error instanceof Error ? error.message : String(error));
+    }
+}

package/dist/src/evaluation/benchmarkSandbox/errors.js

@@ -0,0 +1,11 @@
+const MAX_MESSAGE_LENGTH = 500;
+/** Bounded, typed failure of sandbox creation, baseline, or tree inspection. */
+export class BenchmarkSandboxError extends Error {
+    code;
+    constructor(code, message) {
+        const bounded = message.length > MAX_MESSAGE_LENGTH ? `${message.slice(0, MAX_MESSAGE_LENGTH)}...` : message;
+        super(`Benchmark sandbox error (${code}): ${bounded}`);
+        this.name = "BenchmarkSandboxError";
+        this.code = code;
+    }
+}

package/dist/src/evaluation/benchmarkSandbox/gitExecutor.js

@@ -0,0 +1,60 @@
+import path from "node:path";
+import { runMeasuredCommand } from "../../core/runMeasuredCommand.js";
+import { buildMinimalHostEnv } from "./minimalHostEnv.js";
+// Git (including Git for Windows) opens this as an empty config file; os.devNull (\\.\nul) is rejected by Git on Windows.
+const NULL_CONFIG_PATH = process.platform === "win32" ? "NUL" : "/dev/null";
+const DEFAULT_GIT_TIMEOUT_MS = 60_000;
+const GIT_OUTPUT_LIMIT_BYTES = 8 * 1024 * 1024;
+const sequenceByEvidenceRoot = new Map();
+function nextSequence(evidenceRoot) {
+    const next = (sequenceByEvidenceRoot.get(evidenceRoot) ?? 0) + 1;
+    sequenceByEvidenceRoot.set(evidenceRoot, next);
+    return next;
+}
+/**
+ * Runs Git for a sandbox through the shared measured-command owner (structured arguments, shell:false,
+ * bounded output, awaited tree termination, evidence files). The environment is isolated from the user's
+ * and the system's Git configuration so hashes and diffs do not depend on the developer machine.
+ */
+export async function runSandboxGit(target, args, options = {}) {
+    const label = (options.label ?? args[0] ?? "git").replace(/[^A-Za-z0-9_-]/g, "-").slice(0, 32);
+    const commandId = `git-${String(nextSequence(target.evidenceRoot)).padStart(4, "0")}-${label}`;
+    const env = buildMinimalHostEnv(process.env, {
+        GIT_CONFIG_NOSYSTEM: "1",
+        GIT_CONFIG_GLOBAL: NULL_CONFIG_PATH,
+        GIT_TERMINAL_PROMPT: "0",
+        GIT_OPTIONAL_LOCKS: "0",
+        HOME: target.evidenceRoot,
+        USERPROFILE: target.evidenceRoot,
+        ...options.env
+    });
+    const result = await runMeasuredCommand({
+        commandId,
+        executable: "git",
+        args: ["-c", "core.quotepath=false", "-c", "core.autocrlf=false", "-c", "core.fsmonitor=false", ...args],
+        cwd: target.projectRoot,
+        outDir: path.join(target.evidenceRoot, "git"),
+        env,
+        inheritParentEnv: false,
+        stdinText: options.stdin,
+        timeoutMs: options.timeoutMs ?? DEFAULT_GIT_TIMEOUT_MS,
+        stdoutMaxBytes: GIT_OUTPUT_LIMIT_BYTES,
+        stderrMaxBytes: GIT_OUTPUT_LIMIT_BYTES,
+        terminateProcessTree: true
+    });
+    const unavailable = result.resolvedCommand?.resolutionKind === "unavailable";
+    return {
+        ok: result.ok,
+        exitCode: result.exitCode,
+        stdout: result.stdout,
+        stderr: result.stderr,
+        timedOut: result.timedOut === true,
+        unavailable,
+        error: result.error
+    };
+}
+/** Bounded single-line excerpt of Git diagnostics for error messages. */
+export function excerptGitFailure(result) {
+    const text = (result.stderr || result.stdout || result.error || "no output").trim().replace(/\s+/g, " ");
+    return text.length > 300 ? `${text.slice(0, 300)}...` : text;
+}

package/dist/src/evaluation/benchmarkSandbox/index.js

@@ -0,0 +1,8 @@
+export * from "./errors.js";
+export * from "./types.js";
+export { createBenchmarkSandbox } from "./createBenchmarkSandbox.js";
+export { removeBenchmarkSandbox } from "./removeBenchmarkSandbox.js";
+export { digestTreeSnapshot, scanProjectTree, sha256OfBuffer, snapshotProjectTree } from "./treeSnapshot.js";
+export { buildMinimalHostEnv } from "./minimalHostEnv.js";
+export { excerptGitFailure, runSandboxGit } from "./gitExecutor.js";
+export { BENCHMARK_SANDBOX_EXCLUDED_NAMES, SANDBOX_ID_PATTERN } from "./pathPolicy.js";

package/dist/src/evaluation/benchmarkSandbox/minimalHostEnv.js

@@ -0,0 +1,37 @@
+/**
+ * Variables a child process needs to locate and start `node` or `git` on the supported platforms. Nothing
+ * else is forwarded from the parent: provider keys, tokens, cookies and project secrets must never reach
+ * Lab-run verification or Git processes. Names are matched case-insensitively (Windows environments are).
+ */
+const FORWARDED_NAMES = [
+    "path",
+    "systemroot",
+    "systemdrive",
+    "windir",
+    "comspec",
+    "pathext",
+    "temp",
+    "tmp",
+    "tmpdir",
+    "lang",
+    "lc_all"
+];
+/** Defense in depth: even an allowed name is dropped if it looks credential-like. */
+const CREDENTIAL_LIKE = /(key|token|secret|passw|credential|auth|cookie|session)/i;
+export function buildMinimalHostEnv(source = process.env, extras = {}) {
+    const env = {};
+    const actualNames = Object.keys(source);
+    for (const wanted of FORWARDED_NAMES) {
+        const actual = actualNames.find((name) => name.toLowerCase() === wanted);
+        if (actual === undefined)
+            continue;
+        const value = source[actual];
+        if (value === undefined || CREDENTIAL_LIKE.test(actual))
+            continue;
+        env[actual] = value;
+    }
+    for (const [name, value] of Object.entries(extras)) {
+        env[name] = value;
+    }
+    return env;
+}

package/dist/src/evaluation/benchmarkSandbox/pathPolicy.js

@@ -0,0 +1,49 @@
+import { realpath } from "node:fs/promises";
+import path from "node:path";
+/** Sandbox identities become one directory name beneath the caller's runtime root. */
+export const SANDBOX_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+/**
+ * Directory/file names never copied into a sandbox and never part of its baseline. `.git` would import the
+ * canonical history; the rest are generated or Lab-internal outputs that are not benchmark source.
+ */
+export const BENCHMARK_SANDBOX_EXCLUDED_NAMES = Object.freeze([
+    ".git",
+    "node_modules",
+    "dist",
+    "build",
+    "coverage",
+    "lab-output",
+    ".my-dev-kit-context",
+    ".my-dev-kit-orchestrator"
+]);
+/**
+ * Physical path of a path that may not exist yet: the realpath of the deepest existing ancestor plus the
+ * not-yet-created remainder. Resolving physically (not lexically) is what makes overlap checks hold across
+ * links, junctions, and Windows drive aliases.
+ */
+export async function resolvePhysicalPath(candidate) {
+    const resolved = path.resolve(candidate);
+    const remainder = [];
+    let current = resolved;
+    for (;;) {
+        try {
+            const physical = await realpath(current);
+            return remainder.length === 0 ? physical : path.join(physical, ...remainder.reverse());
+        }
+        catch (error) {
+            const code = error.code;
+            const parent = path.dirname(current);
+            if ((code !== "ENOENT" && code !== "ENOTDIR") || parent === current)
+                return resolved;
+            remainder.push(path.basename(current));
+            current = parent;
+        }
+    }
+}
+/** True when `candidate` equals `root` or lies beneath it. Both arguments must already be physical paths. */
+export function isSameOrInside(root, candidate) {
+    const relative = path.relative(root, candidate);
+    if (relative === "")
+        return true;
+    return !(relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative));
+}