@dailephd/my-dev-kit-lab 0.8.2 → 0.9.1

package/benchmarks/projects/agent-success-task-board-node/tests/summary-edge.check.mjs

@@ -0,0 +1,67 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { INVALID_PROJECT, createTaskBoard } from "../src/index.js";
+
+test("a project's completed count never exceeds its total", () => {
+  const { service, summarize } = createTaskBoard();
+  service.createTask({ title: "Solo", projectId: "alpha" });
+  for (const title of ["x", "y", "z"]) {
+    const task = service.createTask({ title, projectId: "beta" });
+    service.completeTask(task.id);
+  }
+  const summary = summarize("alpha");
+  assert.equal(summary.total, 1);
+  assert.equal(summary.completed, 0);
+  assert.ok(summary.completed <= summary.total);
+  assert.equal(summary.open, 1);
+});
+
+test("unrelated tasks in the store do not change a project's summary", () => {
+  const { service, summarize } = createTaskBoard();
+  const a = service.createTask({ title: "A", projectId: "core" });
+  service.createTask({ title: "B", projectId: "core" });
+  service.completeTask(a.id);
+  const before = summarize("core");
+  const noise = service.createTask({ title: "Noise", projectId: "core-extras" });
+  service.createTask({ title: "More noise", projectId: "CORE2" });
+  service.completeTask(noise.id);
+  service.importTasks([{ externalId: "n-1", title: "Imported noise", projectId: "c" }]);
+  assert.deepEqual(summarize("core"), before);
+});
+
+test("an unknown project has an empty, consistent summary", () => {
+  const { service, summarize } = createTaskBoard();
+  service.createTask({ title: "A", projectId: "known" });
+  assert.deepEqual(summarize("missing"), { projectId: "missing", total: 0, completed: 0, open: 0, taskIds: [] });
+});
+
+test("blank project identities are rejected consistently", () => {
+  const { service, store, summarize } = createTaskBoard();
+  assert.throws(() => service.createTask({ title: "Task", projectId: "   " }), { code: INVALID_PROJECT });
+  assert.throws(() => service.createTask({ title: "Task", projectId: "" }), { code: INVALID_PROJECT });
+  assert.throws(
+    () => service.importTasks([{ externalId: "ext-1", title: "Task", projectId: " " }]),
+    { code: INVALID_PROJECT }
+  );
+  assert.throws(() => summarize("  "), { code: INVALID_PROJECT });
+  assert.equal(store.list().length, 0);
+});
+
+test("summaries are deterministic and list ids in creation order", () => {
+  const build = () => {
+    const { service, summarize } = createTaskBoard();
+    service.createTask({ title: "1", projectId: "p" });
+    service.createTask({ title: "2", projectId: "q" });
+    service.createTask({ title: "3", projectId: "P" });
+    service.importTasks([{ externalId: "e-1", title: "4", projectId: "p " }]);
+    return summarize("p");
+  };
+  assert.deepEqual(build(), build());
+  assert.deepEqual(build().taskIds, ["task-1", "task-3", "task-4"]);
+});
+
+test("the default project is used for tasks created without one", () => {
+  const { service, summarize } = createTaskBoard();
+  service.createTask({ title: "No project given" });
+  assert.equal(summarize("inbox").total, 1);
+});

package/benchmarks/projects/agent-success-task-board-node/tests/summary-primary.check.mjs

@@ -0,0 +1,54 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { createTaskBoard } from "../src/index.js";
+
+test("tasks created with differently written project names share one project identity", () => {
+  const { service, store, summarize } = createTaskBoard();
+  service.createTask({ title: "One", projectId: "web" });
+  service.createTask({ title: "Two", projectId: "  WEB " });
+  service.createTask({ title: "Three", projectId: "Web" });
+  assert.deepEqual(
+    store.list().map((task) => task.projectId),
+    ["web", "web", "web"]
+  );
+  const summary = summarize("web");
+  assert.equal(summary.projectId, "web");
+  assert.equal(summary.total, 3);
+});
+
+test("a summary only counts tasks of the requested project", () => {
+  const { service, summarize } = createTaskBoard();
+  const web = service.createTask({ title: "Web task", projectId: "web" });
+  service.createTask({ title: "Web app task", projectId: "web-app" });
+  service.createTask({ title: "Webhook task", projectId: "webhooks" });
+  const other = service.createTask({ title: "Docs task", projectId: "docs" });
+  service.completeTask(other.id);
+  const summary = summarize("web");
+  assert.equal(summary.total, 1);
+  assert.equal(summary.completed, 0);
+  assert.equal(summary.open, 1);
+  assert.deepEqual(summary.taskIds, [web.id]);
+});
+
+test("completed and open counts are correct for the requested project", () => {
+  const { service, summarize } = createTaskBoard();
+  const a = service.createTask({ title: "A", projectId: "ops" });
+  service.createTask({ title: "B", projectId: "ops" });
+  service.createTask({ title: "C", projectId: "ops" });
+  service.createTask({ title: "Elsewhere", projectId: "labs" });
+  service.completeTask(a.id);
+  assert.deepEqual(summarize(" OPS "), {
+    projectId: "ops",
+    total: 3,
+    completed: 1,
+    open: 2,
+    taskIds: ["task-1", "task-2", "task-3"]
+  });
+});
+
+test("imported tasks join the same normalized project identity", () => {
+  const { service, summarize } = createTaskBoard();
+  service.createTask({ title: "Manual", projectId: "ops" });
+  service.importTasks([{ externalId: "ext-1", title: "Imported", projectId: " OPS" }]);
+  assert.equal(summarize("ops").total, 2);
+});

package/benchmarks/projects/agent-success-task-board-node/tests/title-edge.check.mjs

@@ -0,0 +1,39 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { INVALID_TITLE, ValidationError, createTaskBoard, validateTitle } from "../src/index.js";
+
+test("rejected titles leave the store and id sequence untouched", () => {
+  const { service, store } = createTaskBoard();
+  assert.throws(() => service.createTask({ title: "  \t " }), { code: INVALID_TITLE });
+  assert.throws(() => service.createTask({ title: "" }), { code: INVALID_TITLE });
+  assert.equal(store.list().length, 0);
+  const task = service.createTask({ title: "First" });
+  assert.equal(task.id, "task-1");
+  assert.equal(store.list().length, 1);
+});
+
+test("interior whitespace is preserved while surrounding whitespace is removed", () => {
+  const { service } = createTaskBoard();
+  assert.equal(service.createTask({ title: "  Fix  the   bug " }).title, "Fix  the   bug");
+  assert.equal(service.createTask({ title: "\n\tPlan sprint\t\n" }).title, "Plan sprint");
+});
+
+test("already-trimmed titles keep their meaning", () => {
+  const { service } = createTaskBoard();
+  assert.equal(service.createTask({ title: "Ship it" }).title, "Ship it");
+  assert.equal(service.createTask({ title: "a" }).title, "a");
+});
+
+test("validateTitle returns the normalized title and throws the documented error", () => {
+  assert.equal(validateTitle("  Triage  "), "Triage");
+  assert.throws(
+    () => validateTitle("   "),
+    (error) => error instanceof ValidationError && error.code === INVALID_TITLE
+  );
+});
+
+test("imported task titles are normalized the same way", () => {
+  const { service } = createTaskBoard();
+  const { imported } = service.importTasks([{ externalId: "ext-1", title: "  Imported item  " }]);
+  assert.equal(imported[0].title, "Imported item");
+});

package/benchmarks/projects/agent-success-task-board-node/tests/title-primary.check.mjs

@@ -0,0 +1,29 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { INVALID_TITLE, ValidationError, createTaskBoard } from "../src/index.js";
+
+test("createTask trims surrounding whitespace from the title", () => {
+  const { service } = createTaskBoard();
+  const task = service.createTask({ title: "  Write release notes  " });
+  assert.equal(task.title, "Write release notes");
+});
+
+test("the stored task retains the normalized title", () => {
+  const { service, store } = createTaskBoard();
+  const task = service.createTask({ title: "\tReview backlog " });
+  assert.equal(store.get(task.id).title, "Review backlog");
+  assert.deepEqual(
+    store.list().map((entry) => entry.title),
+    ["Review backlog"]
+  );
+});
+
+test("a whitespace-only title is rejected with the invalid-title error", () => {
+  const { service } = createTaskBoard();
+  for (const title of ["   ", "\t", "\n  \r\n"]) {
+    assert.throws(
+      () => service.createTask({ title }),
+      (error) => error instanceof ValidationError && error.code === INVALID_TITLE
+    );
+  }
+});

package/dist/src/agents/adapters/claudeAdapter.js

@@ -54,8 +54,8 @@ export const claudeAdapter = {
 };
 /**
  * Parses a single JSON result envelope (`{ "result": "..." }`) when stdout is valid JSON, never
- * the raw envelope itself. Falls back to the legacy plain-text behavior when stdout is not valid
- * JSON, so existing argv-mode text output keeps working unchanged.
+ * the raw envelope itself. Malformed JSON-shaped output stays empty; legacy plain text output
+ * retains its fallback.
  */
 export function parseClaudeFinalAnswer(text) {
     const trimmedInput = text.trim();
@@ -71,9 +71,12 @@ export function parseClaudeFinalAnswer(text) {
                 // Valid JSON object without a string result: empty, never the raw envelope.
                 return { finalAnswerText: "", finalAnswerParseStatus: "empty" };
             }
+            return { finalAnswerText: "", finalAnswerParseStatus: "empty" };
         }
         catch {
-            // Not valid JSON; fall through to the legacy plain-text behavior below.
+            // A malformed envelope is not a legacy text answer.
+            if (/^[\[{]/.test(trimmedInput))
+                return { finalAnswerText: "", finalAnswerParseStatus: "empty" };
         }
     }
     return { finalAnswerText: trimmedInput, finalAnswerParseStatus: trimmedInput ? "parsed" : "empty" };

package/dist/src/agents/adapters/codexAdapter.js

@@ -1,6 +1,7 @@
 import { runMeasuredCommand } from "../../core/runMeasuredCommand.js";
 import { applyPromptToCommandTemplate } from "../runAgentPrompt.js";
 import { parseAgentTokenUsage } from "../parseAgentTokenUsage.js";
+import { trustedProviderLaunch } from "../providerBuildObservation.js";
 // v0.5.2 Batch 2 -- frozen stdin invocation for the real-agent evaluation transport. Every flag
 // here is planner-owned; do not add sandbox/model/approval-policy flags in this batch.
 const CODEX_STDIN_ARGS = [
@@ -51,13 +52,21 @@ export const codexAdapter = {
 /**
  * Recognizes a Codex JSONL event stream (at least one line parses to an object with a string
  * `type`) and, when recognized, uses the LAST `item.completed` `agent_message` text as the final
- * answer -- never the raw JSONL. Falls back to the legacy plain-text behavior when no event-shaped
- * line is found, so non-JSONL Codex output (and existing tests) keep working unchanged.
+ * answer -- never the raw JSONL. JSON-shaped output without an answer stays empty. Plain text
+ * retains the legacy fallback. A single formatted JSON event is supported as well.
  */
 export function parseCodexFinalAnswer(text) {
-    let sawEventLine = false;
+    let sawEventLine = /^[\s]*[\[{]/.test(text);
     let lastAgentMessageText = null;
-    for (const line of text.split(/\r?\n/)) {
+    const candidates = function* () {
+        const trimmed = text.trim();
+        if (trimmed.startsWith("{") || trimmed.startsWith("["))
+            yield trimmed;
+        for (const match of text.matchAll(/[^\r\n]+/g))
+            if (match[0].trim() !== trimmed)
+                yield match[0];
+    };
+    for (const line of candidates()) {
         const trimmedLine = line.trim();
         if (!trimmedLine)
             continue;
@@ -69,7 +78,10 @@ export function parseCodexFinalAnswer(text) {
             // Agent output can mix JSONL with incidental non-JSON noise; ignore malformed lines.
             continue;
         }
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        if (!parsed || typeof parsed !== "object")
+            continue;
+        sawEventLine = true;
+        if (Array.isArray(parsed))
             continue;
         const event = parsed;
         if (typeof event.type !== "string")
@@ -95,7 +107,10 @@ export function parseCodexFinalAnswer(text) {
 export async function runCliAgent(request, adapter) {
     const started = Date.now();
     const command = adapter.buildCommand(request);
-    const available = await adapter.isAvailable(request);
+    if (request.trustedExecutable && (request.commandTemplate || request.promptTransport !== "stdin" || adapter.id === "fake-agent"))
+        throw new Error("INVALID_TRUSTED_PROVIDER_REQUEST");
+    const launch = request.trustedExecutable ? await trustedProviderLaunch(request.trustedExecutable, adapter.id) : null;
+    const available = launch !== null || await adapter.isAvailable(request);
     if (!available) {
         const ended = Date.now();
         const status = request.requireAvailable ? "failed" : "skipped";
@@ -127,18 +142,20 @@ export async function runCliAgent(request, adapter) {
     }
     const measured = await runMeasuredCommand({
         commandId: `${adapter.id}-agent-run`,
-        commandString: command.command,
-        extraArgs: command.args,
+        ...(launch ? { executable: launch.executable, args: [...launch.prefix, ...command.args], resolveCommand: false } : { commandString: command.command, extraArgs: command.args }),
         cwd: request.commandTemplate?.cwd ?? request.cwd,
         outDir: request.outDir,
         env: request.env,
         timeoutMs: request.timeoutMs,
-        stdinText: command.stdinText
+        stdinText: command.stdinText,
+        ...(launch ? { stdoutMaxBytes: 8 * 1024 * 1024, stderrMaxBytes: 1024 * 1024, terminateProcessTree: true } : {})
     });
     const ended = Date.now();
     const combinedOutput = `${measured.stdout}\n${measured.stderr}`;
     const parsedAnswer = adapter.parseFinalAnswer(measured.stdout || measured.stderr);
     const parsedUsage = adapter.parseTokenUsage(combinedOutput);
+    // Bound campaigns require process-channel diagnostics. Never search final agent message/patch bodies.
+    const condition = launch ? trustedProcessCondition(measured.stdout, measured.stderr, measured.timedOut === true) : null;
     return {
         runId: request.runId,
         agentId: adapter.id,
@@ -164,6 +181,30 @@ export async function runCliAgent(request, adapter) {
         tokenUsageSource: parsedUsage.tokenUsageSource,
         tokenUsageReliability: parsedUsage.tokenUsageReliability,
         warnings: parsedUsage.warnings,
-        errors: measured.ok ? [] : [measured.error ?? "Agent command failed."]
+        errors: [...(measured.ok ? [] : [measured.error ?? "Agent command failed."]), ...(condition === "limit" ? ["Provider rate limit reached."] : condition === "timeout" ? ["Provider command timed out."] : [])]
     };
 }
+function trustedProcessCondition(stdout, stderr, timedOut) {
+    if (timedOut)
+        return "timeout";
+    const diagnostics = [];
+    const isPatch = (text) => /^(?:diff --git |@@ |\+\+\+ |--- )/m.test(text);
+    // Non-interactive CLI diagnostic lines, not arbitrary substrings or diff additions.
+    if (!isPatch(stderr))
+        diagnostics.push(...stderr.split(/\r?\n/).filter(line => /^(?:error:\s*)?(?:rate limit (?:exceeded|reached)|usage limit (?:exceeded|reached)|quota (?:exceeded|exhausted)|too many requests|you(?:'ve| have) (?:hit|reached) (?:your |the )?(?:usage |session |rate )?limit)/i.test(line.trim())));
+    for (const line of stdout.split(/\r?\n/).slice(0, 1000)) {
+        try {
+            const event = JSON.parse(line);
+            if (!event || typeof event !== "object")
+                continue;
+            if (event.type !== "error" && event.type !== "turn.failed" && event.is_error !== true)
+                continue;
+            const error = event.error;
+            const message = typeof error === "string" ? error : error && typeof error === "object" ? error.message : event.message;
+            if (typeof message === "string" && message.length <= 2048 && !isPatch(message))
+                diagnostics.push(message);
+        }
+        catch { /* Not a structured error event; agent output is deliberately not diagnostic evidence. */ }
+    }
+    return diagnostics.some(text => /\b(?:rate\s+limit|usage\s+limit|quota|too many requests|session\s+limit)\b/i.test(text)) ? "limit" : null;
+}

package/dist/src/agents/index.js

@@ -2,6 +2,7 @@ export * from "./types.js";
 export * from "./agentRegistry.js";
 export * from "./runAgentPrompt.js";
 export * from "./parseAgentTokenUsage.js";
+export { normalizeAgentTokenUsageV091, normalizeAgentDurationV091 } from "./normalizeAgentTelemetry.js";
 export * from "./adapters/fakeAgentAdapter.js";
 export * from "./adapters/codexAdapter.js";
 export * from "./adapters/claudeAdapter.js";

package/dist/src/agents/normalizeAgentTelemetry.js

@@ -0,0 +1,50 @@
+const EVIDENCE_LEVEL = {
+    "provider-reported": "provider-reported",
+    "cli-json": "cli-reported",
+    "agent-reported": "parsed-from-output",
+    "estimated-from-text": "estimated",
+    otel: "unavailable",
+    unavailable: "unavailable"
+};
+function normalizeCount(value) {
+    return typeof value === "number" && Number.isFinite(value) && Number.isInteger(value) && value >= 0 ? value : null;
+}
+/**
+ * Classifies the legacy evidence channel, not the origin of each individual field.
+ * Parser-derived totals are preserved; missing totals are never calculated here.
+ * The existing contract has no verified OTel attribution, so its channel remains unavailable.
+ */
+export function normalizeAgentTokenUsageV091(usage, reliability) {
+    const counts = {
+        totalTokens: normalizeCount(usage.totalTokens),
+        inputTokens: normalizeCount(usage.inputTokens),
+        outputTokens: normalizeCount(usage.outputTokens),
+        cachedInputTokens: normalizeCount(usage.cachedInputTokens),
+        reasoningTokens: normalizeCount(usage.reasoningTokens)
+    };
+    const numericReasons = {};
+    for (const key of Object.keys(counts)) {
+        numericReasons[key] = counts[key] !== null ? null : usage[key] == null ? "missing-token-count" : "invalid-token-count";
+    }
+    const hasCount = Object.values(counts).some((count) => count !== null);
+    return {
+        source: usage.source,
+        reliability,
+        evidenceLevel: EVIDENCE_LEVEL[usage.source],
+        classificationReason: usage.source === "otel" ? "unattributed-source" : usage.source === "unavailable" ? "source-unavailable" : null,
+        numericAvailability: hasCount ? "available" : "unavailable",
+        condition: hasCount ? "token-available" : "token-unavailable",
+        ...counts,
+        numericReasons
+    };
+}
+/** Accepts the current Lab wall-clock measurement, never provider-reported timing. */
+export function normalizeAgentDurationV091(durationMs) {
+    if (durationMs == null) {
+        return { durationMs: null, source: "unavailable", reason: "missing-duration" };
+    }
+    if (!Number.isFinite(durationMs) || durationMs < 0) {
+        return { durationMs: null, source: "unavailable", reason: "invalid-duration" };
+    }
+    return { durationMs, source: "lab-wall-clock", reason: null };
+}

package/dist/src/agents/parseAgentTokenUsage.js

@@ -13,11 +13,11 @@ const numberFields = {
 };
 export function parseAgentTokenUsage(text) {
     const warnings = [];
-    const jsonUsage = parseJsonUsage(text);
+    const jsonUsage = parseJsonUsage(text, warnings);
     if (jsonUsage.found) {
         return buildResult(jsonUsage.usage, "cli-json", text, warnings);
     }
-    const plainTextUsage = parsePlainTextUsage(text);
+    const plainTextUsage = jsonUsage.structured ? { found: false, usage: {} } : parsePlainTextUsage(text);
     if (plainTextUsage.found) {
         return buildResult(plainTextUsage.usage, "agent-reported", text, warnings);
     }
@@ -29,57 +29,84 @@ export function parseAgentTokenUsage(text) {
         warnings
     };
 }
-function parseJsonUsage(text) {
-    const usage = {};
+function parseJsonUsage(text, warnings) {
+    let usage;
+    let structured = false;
+    let visited = 0;
+    const warn = (message) => { if (!warnings.includes(message))
+        warnings.push(message); };
+    const visit = (value, depth) => {
+        if (!value || typeof value !== "object")
+            return;
+        if (++visited > 2048 || depth > 16) {
+            warn("Token usage traversal limit reached; additional envelopes were ignored.");
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const child of value) {
+                if (visited > 2048)
+                    break;
+                visit(child, depth + 1);
+            }
+            return;
+        }
+        const record = value;
+        const local = {};
+        for (const [key, aliases] of Object.entries(numberFields)) {
+            for (const alias of aliases) {
+                const count = record[alias];
+                if (count === undefined)
+                    continue;
+                if (typeof count !== "number" || !Number.isFinite(count) || !Number.isInteger(count) || count < 0) {
+                    warn("Invalid token count ignored in agent output.");
+                    continue;
+                }
+                if (local[key] !== undefined && local[key] !== count)
+                    warn("Conflicting token aliases; legacy maximum precedence retained within one usage record.");
+                local[key] = Math.max(local[key] ?? 0, count);
+            }
+        }
+        if (hasAnyUsage(local)) {
+            if (usage === undefined)
+                usage = local;
+            else if (JSON.stringify(usage) !== JSON.stringify(local))
+                warn("Multiple token usage records; first valid record retained without combining attempts.");
+        }
+        // Supported envelope traversal only: patch/tool payload objects are not usage metadata.
+        for (const key of ["usage", "token_usage", "tokenUsage", "response", "message", "data", "event", "result"]) {
+            if (visited > 2048)
+                break;
+            visit(record[key], depth + 1);
+        }
+    };
+    let candidates = 0;
     for (const candidate of collectJsonCandidates(text)) {
+        if (++candidates > 4096) {
+            warn("Token usage candidate limit reached; additional lines were ignored.");
+            break;
+        }
         try {
-            mergeUsage(usage, extractUsage(JSON.parse(candidate)));
+            const value = JSON.parse(candidate);
+            structured = true;
+            visit(value, 0);
         }
         catch {
             // Agent output is often mixed JSONL plus text; malformed lines are ignored.
         }
     }
-    return { found: hasAnyUsage(usage), usage };
+    return { found: usage !== undefined, usage: usage ?? {}, structured };
 }
-function collectJsonCandidates(text) {
+function* collectJsonCandidates(text) {
     const trimmed = text.trim();
-    const candidates = [];
     if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
-        candidates.push(trimmed);
+        yield trimmed;
     }
-    for (const line of text.split(/\r?\n/)) {
-        const lineTrimmed = line.trim();
-        if (lineTrimmed.startsWith("{") || lineTrimmed.startsWith("[")) {
-            candidates.push(lineTrimmed);
+    for (const match of text.matchAll(/[^\r\n]+/g)) {
+        const lineTrimmed = match[0].trim();
+        if (lineTrimmed !== trimmed && (lineTrimmed.startsWith("{") || lineTrimmed.startsWith("["))) {
+            yield lineTrimmed;
         }
     }
-    return [...new Set(candidates)];
-}
-function extractUsage(value) {
-    const usage = {};
-    visit(value, usage);
-    return usage;
-}
-function visit(value, usage) {
-    if (!value || typeof value !== "object") {
-        return;
-    }
-    if (Array.isArray(value)) {
-        value.forEach((item) => visit(item, usage));
-        return;
-    }
-    const record = value;
-    for (const [usageKey, fieldNames] of Object.entries(numberFields)) {
-        for (const fieldName of fieldNames) {
-            const fieldValue = record[fieldName];
-            if (typeof fieldValue === "number" && Number.isFinite(fieldValue)) {
-                usage[usageKey] = Math.max(usage[usageKey] ?? 0, fieldValue);
-            }
-        }
-    }
-    for (const child of Object.values(record)) {
-        visit(child, usage);
-    }
 }
 function parsePlainTextUsage(text) {
     const usage = {};
@@ -91,20 +118,15 @@ function parsePlainTextUsage(text) {
         ["totalTokens", /total\s+tokens?\s*[:=]\s*(\d+)/i]
     ];
     for (const [key, pattern] of patterns) {
-        const match = text.match(pattern);
+        const match = text.match(new RegExp(pattern.source.replace("(\\d+)", "(\\d+)(?![\\d.eE])"), pattern.flags));
         if (match?.[1]) {
-            usage[key] = Number(match[1]);
+            const count = Number(match[1]);
+            if (Number.isFinite(count) && Number.isInteger(count))
+                usage[key] = count;
         }
     }
     return { found: hasAnyUsage(usage), usage };
 }
-function mergeUsage(target, source) {
-    for (const key of Object.keys(numberFields)) {
-        if (source[key] !== undefined) {
-            target[key] = Math.max(target[key] ?? 0, source[key]);
-        }
-    }
-}
 function hasAnyUsage(usage) {
     return Object.values(usage).some((value) => typeof value === "number");
 }

package/dist/src/agents/providerBuildObservation.js

@@ -0,0 +1,97 @@
+import { createHash } from "node:crypto";
+import { lstat, mkdtemp, readFile, realpath, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { resolveCommand } from "../core/resolveCommand.js";
+import { runMeasuredCommand } from "../core/runMeasuredCommand.js";
+const launches = new WeakMap();
+const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const fail = () => { throw new Error("PROVIDER_BUILD_UNVERIFIABLE: use a native executable or an attributable node entrypoint; unsupported wrappers cannot authorize a campaign."); };
+async function inspect(alias) {
+    const actual = await realpath(alias);
+    const stat = await lstat(actual);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 256 * 1024 * 1024 || stat.size === 0)
+        return fail();
+    const bytes = await readFile(actual);
+    if (bytes.length !== stat.size || await realpath(alias) !== actual)
+        return fail();
+    return { proof: { alias: path.resolve(alias), actual, digest: hash(bytes) }, bytes };
+}
+function native(bytes) {
+    return bytes.subarray(0, 2).toString() === "MZ" || bytes.subarray(0, 4).equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46])) || ["feedface", "feedfacf", "cefaedfe", "cffaedfe", "cafebabe"].includes(bytes.subarray(0, 4).toString("hex"));
+}
+/** Read-only task-free observation. All temporary version diagnostics are removed. No shell templates. */
+export async function observeProviderBuild(providerId, options = {}) {
+    if (providerId !== "codex" && providerId !== "claude")
+        return fail();
+    const cwd = await mkdtemp(path.join(os.tmpdir(), "lab-provider-build-"));
+    try {
+        const env = { ...process.env, ...options.env };
+        const resolved = resolveCommand(providerId, { cwd, env, allowPowerShellShim: false });
+        if (!resolved.resolvedPath || resolved.resolutionKind === "unavailable")
+            return fail();
+        const selected = await inspect(resolved.resolvedPath);
+        let executable = selected.proof.actual;
+        const prefix = [];
+        const files = [selected.proof];
+        let limitation = "Observed launch bytes only; transitive dependencies are not attested.";
+        if (!native(selected.bytes)) {
+            const text = selected.bytes.toString("utf8");
+            // A deliberately closed, attributable wrapper subset. Never execute arbitrary wrapper text.
+            const cmd = /^@echo off\r?\n(?:node|"([^"\r\n]+)") "([^"\r\n]+)" %\*\r?\n?$/i.exec(text);
+            const shebang = /^#!\/usr\/bin\/env node\r?\n/.test(text);
+            if (!cmd && !shebang)
+                return fail();
+            const node = resolveCommand(cmd?.[1] ?? "node", { cwd, env, allowPowerShellShim: false });
+            if (!node.resolvedPath || node.resolutionKind === "unavailable")
+                return fail();
+            const interpreter = await inspect(node.resolvedPath);
+            if (!native(interpreter.bytes))
+                return fail();
+            files.push(interpreter.proof);
+            executable = interpreter.proof.actual;
+            if (cmd) {
+                if (!path.isAbsolute(cmd[2]))
+                    return fail();
+                const entry = await inspect(cmd[2]);
+                files.push(entry.proof);
+                prefix.push(entry.proof.actual);
+            }
+            else
+                prefix.push(selected.proof.actual);
+            limitation = "Restricted node wrapper, interpreter and entrypoint bytes observed; transitive dependencies are not attested.";
+        }
+        const version = await runMeasuredCommand({ commandId: `${providerId}-build-version`, executable, args: [...prefix, "--version"], resolveCommand: false, cwd, outDir: cwd, env, timeoutMs: 5000, stdoutMaxBytes: 4096, stderrMaxBytes: 4096, terminateProcessTree: true });
+        const observedVersion = version.stdout.trim();
+        if (!version.ok || version.timedOut || version.outputLimit || !/^[\x20-\x7e]{1,512}$/.test(observedVersion) || !/\d+\.\d+/.test(observedVersion))
+            return fail();
+        const capability = Object.freeze({ providerId });
+        const bytes = Buffer.from(JSON.stringify({ contract: "local-provider-launch-v1", providerId, origin: "inspected-local-executable", executable, prefix, files, version: observedVersion, adapterContract: `${providerId}-fixed-stdin-v1`, limitation }));
+        launches.set(capability, { executable, prefix, files, bytes });
+        await trustedProviderObservation(capability, providerId);
+        return capability;
+    }
+    catch {
+        return fail();
+    }
+    finally {
+        await rm(cwd, { recursive: true, force: true });
+    }
+}
+export async function trustedProviderObservation(capability, providerId) {
+    const launch = launches.get(capability);
+    if (!launch || capability.providerId !== providerId)
+        return fail();
+    for (const file of launch.files) {
+        const current = await inspect(file.alias);
+        if (current.proof.actual !== file.actual || current.proof.digest !== file.digest)
+            throw new Error("PROVIDER_BUILD_CHANGED");
+    }
+    return Buffer.from(launch.bytes);
+}
+/** Fixed adapter args are appended by the adapter owner; no PATH lookup occurs on this launch. */
+export async function trustedProviderLaunch(capability, providerId) {
+    await trustedProviderObservation(capability, providerId);
+    const launch = launches.get(capability);
+    return { executable: launch.executable, prefix: [...launch.prefix] };
+}

package/dist/src/audits/core/projectInventory.js

@@ -145,6 +145,7 @@ const EXCLUDED_DIR_NAMES = new Set([
     ".my-dev-kit",
     ".my-dev-kit-v1",
     ".my-dev-kit-lab",
+    ".my-dev-kit-context",
     "__pycache__",
     ".idea",
     ".vscode",