@dailephd/my-dev-kit-lab 0.9.0 → 0.9.2

package/dist/src/experiments/plugins/agentSuccessRate/realAgentExecution.js

@@ -1,6 +1,7 @@
 import { mkdtemp, readdir, rm } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { normalizeAgentDurationV091, normalizeAgentTokenUsageV091 } from "../../../agents/index.js";
 import { resolveWithinRoot } from "../../../core/pathSafety.js";
 import { isSameOrInside, resolvePhysicalPath } from "../../../evaluation/benchmarkSandbox/pathPolicy.js";
 import { classifyAgentRunOutcome } from "../../../evaluation/classifyAgentRunOutcome.js";
@@ -52,18 +53,33 @@ function toProviderStatus(status) {
         case "agent-unavailable":
         case "agent-limit-reached":
         case "invalid-output":
+        case "not-invoked":
             return status;
         default:
             return "failed";
     }
 }
+/** Runtime-only projection. The evaluation pipeline copies named legacy fields, never this envelope. */
+export function projectAgentSuccessProviderTelemetryV091(result, providerStatus, durationMs) {
+    const tokenUsage = normalizeAgentTokenUsageV091(result?.tokenUsage ?? { source: "unavailable" }, result?.tokenUsageReliability ?? "unavailable");
+    const conflict = result !== null && result.tokenUsage.source !== result.tokenUsageSource;
+    if (conflict) {
+        // Retain both identities and reliability; disagreement cannot certify either channel.
+        tokenUsage.evidenceLevel = "unavailable";
+        tokenUsage.classificationReason = "unattributed-source";
+    }
+    return {
+        normalizedTelemetry: { providerStatus, tokenUsage, duration: normalizeAgentDurationV091(durationMs) },
+        tokenUsageSourceConflict: conflict ? { usageSource: result.tokenUsage.source, resultSource: result.tokenUsageSource } : null
+    };
+}
 function tokenEvidence(result) {
-    const finite = (value) => (typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null);
+    const normalized = normalizeAgentTokenUsageV091(result.tokenUsage, result.tokenUsageReliability);
     return {
         // Only provider-, agent-, CLI- or telemetry-reported totals count; a text-length estimate is not provider usage.
-        totalTokens: result.tokenUsageSource === "unavailable" || result.tokenUsageSource === "estimated-from-text" ? null : finite(result.tokenUsage.totalTokens),
-        inputTokens: finite(result.tokenUsage.inputTokens),
-        outputTokens: finite(result.tokenUsage.outputTokens),
+        totalTokens: [result.tokenUsageSource, result.tokenUsage.source].some((source) => source === "unavailable" || source === "estimated-from-text") ? null : normalized.totalTokens,
+        inputTokens: normalized.inputTokens,
+        outputTokens: normalized.outputTokens,
         source: result.tokenUsageSource,
         reliability: result.tokenUsageReliability
     };
@@ -95,6 +111,7 @@ export function createRealAgentProposalSource(args) {
     const { settings } = args;
     const attemptNumber = args.attemptNumber ?? 1;
     return async ({ treatmentId, invoke, notInvokedReason }) => {
+        let runtimeTelemetry = projectAgentSuccessProviderTelemetryV091(null, "not-invoked", null);
         const context = args.contexts[treatmentId];
         const task = args.task;
         const contextArtifactPath = context.text !== null ? agentSuccessContextArtifactPath(task.benchmarkProject, task.caseId, treatmentId) : null;
@@ -128,6 +145,7 @@ export function createRealAgentProposalSource(args) {
             realAgent.providerStatusReason = boundMessage(reason, settings.privateRoots);
             return {
                 kind: "no-proposal",
+                ...runtimeTelemetry,
                 realAgent,
                 agentDurationMs: measured.agentDurationMs ?? null,
                 agentTokenUsage: measured.agentTokenUsage ?? null,
@@ -138,7 +156,7 @@ export function createRealAgentProposalSource(args) {
         if (!invoke) {
             realAgent.context.contextArtifactPath = null;
             realAgent.providerStatusReason = boundMessage(notInvokedReason ?? "not-invoked", settings.privateRoots);
-            return { kind: "no-proposal", realAgent, agentDurationMs: null, agentTokenUsage: null, errors: [], contextFile: null };
+            return { kind: "no-proposal", ...runtimeTelemetry, realAgent, agentDurationMs: null, agentTokenUsage: null, errors: [], contextFile: null };
         }
         if (context.availability === "unavailable" || context.text === null) {
             return noProposal(`context-unavailable: ${context.reason ?? "unknown"}`, "CONTEXT_UNAVAILABLE", `The ${treatmentId} context could not be built (${context.reason ?? "unknown"}); the provider was not invoked.`);
@@ -186,6 +204,7 @@ export function createRealAgentProposalSource(args) {
                     promptVariant: buildTransportVariant(task, treatmentId),
                     promptText,
                     promptTransport: "stdin",
+                    trustedExecutable: settings.trustedExecutable,
                     timeoutMs: settings.timeoutMs,
                     requireAvailable: false,
                     env: settings.env,
@@ -218,7 +237,9 @@ export function createRealAgentProposalSource(args) {
                 realAgent.providerStatus = "failed";
             if (notNeutral || !realAgent.providerInvoked)
                 realAgent.agentArtifactDirectory = null;
-            return noProposal(notNeutral ? "provider-cwd-not-neutral" : "provider-invocation-error", notNeutral ? "AGENT_CWD_NOT_NEUTRAL" : "PROVIDER_FAILED", notNeutral ? "The provider working directory overlapped a protected root; the provider was not invoked." : `The provider invocation raised an error: ${invocationError ?? "unknown"}`, { agentDurationMs: notNeutral ? null : Date.now() - wallStarted });
+            const agentDurationMs = notNeutral ? null : Date.now() - wallStarted;
+            runtimeTelemetry = projectAgentSuccessProviderTelemetryV091(null, realAgent.providerStatus, agentDurationMs);
+            return noProposal(notNeutral ? "provider-cwd-not-neutral" : "provider-invocation-error", notNeutral ? "AGENT_CWD_NOT_NEUTRAL" : "PROVIDER_FAILED", notNeutral ? "The provider working directory overlapped a protected root; the provider was not invoked." : `The provider invocation raised an error: ${invocationError ?? "unknown"}`, { agentDurationMs });
         }
         // Provider health is classified with the answer text withheld: patch content must never be read as a limit/timeout.
         const classification = classifyAgentRunOutcome({ agentRunResult: { ...result, finalAnswerText: "" } });
@@ -234,6 +255,7 @@ export function createRealAgentProposalSource(args) {
         };
         const agentDurationMs = Number.isFinite(result.durationMs) && result.durationMs >= 0 ? result.durationMs : Date.now() - wallStarted;
         const agentTokenUsage = tokenEvidence(result);
+        runtimeTelemetry = projectAgentSuccessProviderTelemetryV091(result, providerStatus, agentDurationMs);
         if (providerStatus !== "completed") {
             return noProposal(classification.statusReason, PROVIDER_STATUS_CODES[providerStatus] ?? "PROVIDER_FAILED", `Provider ${settings.providerId} ended with status ${providerStatus}: ${classification.statusReason}`, {
                 agentDurationMs,
@@ -245,6 +267,6 @@ export function createRealAgentProposalSource(args) {
         }
         realAgent.finalAnswerAvailable = true;
         realAgent.providerStatusReason = null;
-        return { kind: "proposal", text: result.finalAnswerText, realAgent, agentDurationMs, agentTokenUsage, errors: [], contextFile };
+        return { kind: "proposal", ...runtimeTelemetry, text: result.finalAnswerText, realAgent, agentDurationMs, agentTokenUsage, errors: [], contextFile };
     };
 }

package/dist/src/experiments/plugins/agentSuccessRate/timeoutPresets.js

@@ -0,0 +1,9 @@
+export const AGENT_TIMEOUT_PRESETS = Object.freeze({
+    codex: Object.freeze({ standard: 240000, extended: 900000, maximum: 1800000 }),
+    claude: Object.freeze({ standard: 240000, extended: 900000, maximum: 1800000 })
+});
+export function resolveAgentTimeoutPreset(provider, preset) {
+    if (!Object.hasOwn(AGENT_TIMEOUT_PRESETS, provider) || !Object.hasOwn(AGENT_TIMEOUT_PRESETS[provider], preset))
+        throw new Error("--timeout-preset must be standard, extended or maximum for codex or claude.");
+    return AGENT_TIMEOUT_PRESETS[provider][preset];
+}

package/dist/src/report/experiments/agentSuccessCampaignProgressReportModel.js

@@ -0,0 +1 @@
+export { CAMPAIGN_PROGRESS_SCHEMA, validateCampaignProgress } from "../../experiments/plugins/agentSuccessRate/campaignProgress.js";

package/dist/src/report/experiments/buildAgentSuccessCampaignProgressReport.js

@@ -0,0 +1,6 @@
+import { assertValidatedCampaignProgress } from "../../experiments/plugins/agentSuccessRate/campaignProgress.js";
+/** All representations copy the same validated revision; no renderer evaluates tasks. */
+export function buildAgentSuccessCampaignProgressReport(snapshot, boundary) {
+    assertValidatedCampaignProgress(snapshot, boundary);
+    return structuredClone(snapshot.model);
+}

package/dist/src/report/experiments/buildAgentSuccessRateReport.js

@@ -1,3 +1,4 @@
+import { validateCampaignProgress } from "../../experiments/plugins/agentSuccessRate/campaignProgress.js";
 import { attemptEvidenceOf } from "../../experiments/plugins/agentSuccessRate/attemptEvidence.js";
 import { AGENT_SUCCESS_RATE_PLUGIN_ID, AGENT_SUCCESS_RATE_REAL_AGENT_EXECUTION_MODE, AGENT_SUCCESS_RATE_TREATMENT_IDS } from "../../experiments/plugins/agentSuccessRate/metadata.js";
 import { AGENT_SUCCESS_RATE_REPORT_SCHEMA_VERSION } from "./agentSuccessRateReportModel.js";
@@ -211,7 +212,17 @@ export function buildAgentSuccessRateReport(run) {
         })()
         : null;
     const overall = total === 0 || evaluable === 0 ? "unavailable" : unavailable === 0 ? "complete" : "partial";
+    const progress = run.agentSuccessCampaignProgress;
+    let campaignEvidence;
+    if (progress !== undefined) {
+        validateCampaignProgress(progress);
+        if (progress.state !== "complete" || !progress.finalScientificArtifactsAvailable)
+            throw new Error("Campaign final report requires complete validated evidence.");
+        const { schemaVersion, campaignIdentity, checkpointGeneration, checkpointRevision, state, selectedCaseCount, totalTreatmentUnits, unitCounts, caseCounts, comparisons, finalScientificArtifactsAvailable } = progress;
+        campaignEvidence = structuredClone({ schemaVersion, campaignIdentity, checkpointGeneration, checkpointRevision, state, selectedCaseCount, totalTreatmentUnits, unitCounts, caseCounts, comparisons, finalScientificArtifactsAvailable });
+    }
     return {
+        ...(campaignEvidence ? { campaignEvidence } : {}),
         schemaVersion: AGENT_SUCCESS_RATE_REPORT_SCHEMA_VERSION,
         identity: {
             runId: run.runId,

package/dist/src/report/experiments/buildPluginExperimentReport.js

@@ -17,7 +17,7 @@ const RETRIEVAL_QUERY_STRATEGY_COMPARISON_BULK_KEYS = ["caseExecutionEvidence",
 // Same for context-pack-generation: the typed section presents execution evidence and analysis.
 const CONTEXT_PACK_GENERATION_BULK_KEYS = ["caseExecutionEvidence", "analysis"];
 // Same for agent-success-rate: the typed section presents execution evidence and analysis.
-const AGENT_SUCCESS_RATE_BULK_KEYS = ["caseExecutionEvidence", "analysis"];
+const AGENT_SUCCESS_RATE_BULK_KEYS = ["caseExecutionEvidence", "analysis", "agentSuccessCampaignProgress"];
 const V043_BULK_ARRAY_KEYS = [
     "v043StageContextExecutions",
     "v043StageContextEvaluations",

package/dist/src/report/experiments/renderAgentSuccessCampaignProgressHtml.js

@@ -0,0 +1,6 @@
+import { renderAgentSuccessCampaignProgressText } from "./renderAgentSuccessCampaignProgressText.js";
+/** A static accessible projection of the same text; every dynamic character is escaped. */
+export function renderAgentSuccessCampaignProgressHtml(model) {
+    const text = renderAgentSuccessCampaignProgressText(model).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Campaign progress</title></head><body><main><h1>Campaign progress and evidence</h1><pre style="white-space:pre-wrap">${text}</pre></main></body></html>\n`;
+}

package/dist/src/report/experiments/renderAgentSuccessCampaignProgressText.js

@@ -0,0 +1,25 @@
+export function renderAgentSuccessCampaignProgressText(m) {
+    return [
+        "Agent Success Rate Campaign Progress", `Schema: ${m.schemaVersion}`, `Campaign: ${m.campaignIdentity}`, `Execution mode: ${m.executionMode}`,
+        `Checkpoint revision: ${m.checkpointGeneration} (${m.checkpointRevision})`, `State: ${m.state}`,
+        `Completed evaluations: ${m.unitCounts.completed}/${m.totalTreatmentUnits} treatment units`,
+        `Completed cases: ${m.caseCounts.completed}/${m.selectedCaseCount}`,
+        ...Object.entries(m.unitCounts).map(([s, n]) => `Treatment state ${s}: ${n}`),
+        ...Object.entries(m.caseCounts).map(([s, n]) => `Case state ${s}: ${n}`),
+        `Provider limit: ${m.knownProviderLimit}; uncertainty: ${m.knownUncertainty}`,
+        `Diagnostics: ${m.diagnostics.join(", ") || "none"}`,
+        `Scientific results: ${m.scientificCompleteness}; validated final artifacts: ${m.finalScientificArtifactsAvailable}`,
+        `Completed cases: ${m.completedCaseIds.join(", ") || "none"}`, `Unfinished cases: ${m.unfinishedCaseIds.join(", ") || "none"}`,
+        ...m.cases.flatMap(c => c.treatments.flatMap(t => [
+            `${c.caseId} / ${t.treatmentId}: ${t.state}; evaluated task success=${t.evaluatedTaskSuccess ?? "unavailable"}; epochs=${t.epochCount}; historical limits=${t.historicalProviderLimitCount}; diagnostics=${t.diagnostics.join(", ") || "none"}`,
+            ...t.attempts.map(a => `  Attempt ${a.attemptNumber}: provider invoked=${a.providerInvoked}; Lab duration=${a.duration.durationMs ?? "unavailable"} ms (${a.duration.source}); tokens=${a.tokens.totalTokens ?? "unavailable"}; input=${a.tokens.inputTokens ?? "unavailable"}; output=${a.tokens.outputTokens ?? "unavailable"}; source=${a.tokens.source}; reliability=${a.tokens.reliability}; category=${a.tokens.evidenceLevel}; numeric availability=${a.tokens.numericAvailability}; interpretation=${a.tokenInterpretation}`)
+        ])),
+        "Comparisons (context-pack minus raw-full-file; descriptive matched subset means):",
+        ...m.comparisons.flatMap(q => [
+            `${q.quantity}: ${q.quality}; basis=${q.basis}; measurement=${q.measurementBasis}; matched=${q.matchedCaseIds.length}/${q.selectedCaseCount}; excluded=${q.excludedCaseIds.length}`,
+            `  Matched: ${q.matchedCaseIds.join(", ") || "none"}; excluded: ${q.excludedCaseIds.join(", ") || "none"}`,
+            `  Raw mean=${q.rawFullFileMean ?? "unavailable"}; context mean=${q.contextPackMean ?? "unavailable"}; delta=${q.meanDifference ?? "unavailable"}; unit=${q.unit}`,
+            ...q.reasons.map((r, i) => `  ${r}: ${q.reasonExplanations[i]}`)
+        ]), "Scientific limitations:", ...m.limitations.map(l => `- ${l}`), ""
+    ].join("\n");
+}

package/dist/src/report/experiments/renderAgentSuccessRateHtml.js

@@ -1,4 +1,4 @@
-import { AGENT_SUCCESS_BASIS_LABEL, formatAgentSuccessMetric, formatAgentSuccessPairs, formatAgentSuccessTotal } from "./renderAgentSuccessRateText.js";
+import { AGENT_SUCCESS_BASIS_LABEL, formatAgentSuccessMetric, formatAgentSuccessPairs, formatAgentSuccessTotal, renderCampaignEvidenceSummary } from "./renderAgentSuccessRateText.js";
 function escapeHtml(value) {
     return String(value ?? "")
         .replaceAll("&", "&")
@@ -22,6 +22,8 @@ export function renderAgentSuccessRateHtml(report) {
     const realMode = report.identity.executionMode === "real-agent";
     const m = formatAgentSuccessMetric;
     const parts = [];
+    if (report.campaignEvidence)
+        parts.push(`<section><h2>Campaign evidence</h2><pre>${escapeHtml(renderCampaignEvidenceSummary(report))}</pre></section>`);
     parts.push(`<section id="agent-success-rate">
     <h2>Agent Success Rate</h2>
     <h3>Experiment identity</h3>

package/dist/src/report/experiments/renderAgentSuccessRateText.js

@@ -1,3 +1,8 @@
+export function renderCampaignEvidenceSummary(report) {
+    const m = report.campaignEvidence;
+    return m ? [`Campaign evidence: ${m.state}; checkpoint revision ${m.checkpointGeneration} (${m.checkpointRevision}); completed evaluations ${m.unitCounts.completed}/${m.totalTreatmentUnits}; completed cases ${m.caseCounts.completed}/${m.selectedCaseCount}`,
+        ...m.comparisons.map(q => `${q.quantity}: ${q.quality}; ${q.basis}; ${q.measurementBasis}; matched ${q.matchedCaseIds.length}/${q.selectedCaseCount}; excluded ${q.excludedCaseIds.length}; raw=${q.rawFullFileMean ?? "unavailable"}; context=${q.contextPackMean ?? "unavailable"}; delta=${q.meanDifference ?? "unavailable"}; unit=${q.unit}; reasons=${q.reasons.join(", ") || "none"}; ${q.reasonExplanations.join(" ")}`)].join("\n") : "";
+}
 /** One display form for every metric: an absent value is labelled, never rendered as zero. */
 export function formatAgentSuccessMetric(metric) {
     if (!metric)
@@ -135,5 +140,7 @@ export function renderAgentSuccessRateTextLines(report) {
         lines.push(`error ${error.caseId} / ${error.treatmentId} attempt ${error.attemptNumber} ${sanitize(error.code)}: ${sanitize(error.message)}`);
     for (const artifact of report.artifacts)
         lines.push(`artifact ${sanitize(artifact.id)}: ${artifact.path ?? "[reference withheld]"}`);
+    if (report.campaignEvidence)
+        lines.push(renderCampaignEvidenceSummary(report));
     return lines;
 }

package/dist/src/report/experiments/writeAgentSuccessCampaignProgressReport.js

@@ -0,0 +1,139 @@
+import { lstat, mkdir, open, readdir, realpath } from "node:fs/promises";
+import path from "node:path";
+import { campaignAssert, campaignHash, canonicalCampaignJson } from "../../experiments/plugins/agentSuccessRate/campaignIdentity.js";
+import { validateCampaignOutputPath } from "../../experiments/plugins/agentSuccessRate/campaignCheckpointStore.js";
+import { readCampaignProgressScientificFamily } from "../../experiments/plugins/agentSuccessRate/campaignProgress.js";
+import { resolvePhysicalPath } from "../../evaluation/benchmarkSandbox/pathPolicy.js";
+import { agentSuccessRatePlugin, mapAgentSuccessRateToRun } from "../../experiments/plugins/agentSuccessRate/plugin.js";
+import { writePluginExperimentReports } from "./writePluginExperimentReports.js";
+import { buildPluginExperimentReport } from "./buildPluginExperimentReport.js";
+import { renderPluginExperimentReportText } from "./renderPluginExperimentReportText.js";
+import { renderPluginExperimentReportHtml } from "./renderPluginExperimentReportHtml.js";
+import { buildAgentSuccessCampaignProgressReport } from "./buildAgentSuccessCampaignProgressReport.js";
+import { renderAgentSuccessCampaignProgressText } from "./renderAgentSuccessCampaignProgressText.js";
+import { renderAgentSuccessCampaignProgressHtml } from "./renderAgentSuccessCampaignProgressHtml.js";
+async function plain(p, kind) {
+    const s = await lstat(p);
+    campaignAssert(!s.isSymbolicLink() && (kind === "file" ? s.isFile() : s.isDirectory()) && path.resolve(await realpath(p)) === path.resolve(p), "PROGRESS_UNSAFE_PATH");
+}
+async function writeExclusive(p, content) {
+    const h = await open(p, "wx");
+    try {
+        await h.writeFile(content, "utf8");
+        await h.sync();
+    }
+    finally {
+        await h.close();
+    }
+}
+async function readExpected(p, expected, code) {
+    await plain(p, "file");
+    const length = Buffer.byteLength(expected);
+    campaignAssert(length <= 64 * 1024 * 1024, "PROGRESS_DATA_BOUND");
+    const h = await open(p, "r");
+    try {
+        const before = await h.stat();
+        campaignAssert(before.isFile() && before.size === length, code);
+        const buffer = Buffer.alloc(length + 1);
+        let size = 0;
+        for (;;) {
+            const n = await h.read(buffer, size, buffer.length - size, size);
+            size += n.bytesRead;
+            if (!n.bytesRead || size === buffer.length)
+                break;
+        }
+        campaignAssert(size === length && (await h.stat()).size === length && buffer.subarray(0, size).toString("utf8") === expected, code);
+    }
+    finally {
+        await h.close();
+    }
+}
+async function owned(parent, name, owner) {
+    const p = path.join(parent, name);
+    let created = false;
+    try {
+        await mkdir(p);
+        created = true;
+    }
+    catch (e) {
+        if (e.code !== "EEXIST")
+            throw e;
+    }
+    await plain(p, "directory");
+    if (created)
+        await writeExclusive(path.join(p, "owner.json"), owner);
+    await readExpected(path.join(p, "owner.json"), owner, "PROGRESS_OWNER_MISMATCH");
+    return p;
+}
+/** Revision-specific files are exclusive. The manifest is published last and verified before returning success. */
+export async function writeAgentSuccessCampaignProgressReport(args) {
+    const model = buildAgentSuccessCampaignProgressReport(args.snapshot, args.boundary);
+    await validateCampaignOutputPath(args.boundary);
+    // The checkpoint store has already validated this output root. Use the same physical identity for
+    // publication: a legitimate OS alias (for example macOS /var -> /private/var) is not a redirect
+    // created inside the campaign tree, and comparing it to the lexical spelling rejects valid roots.
+    const root = await resolvePhysicalPath(args.boundary.outputRoot);
+    await plain(root, "directory");
+    const family = await owned(root, "campaign-progress-v1", "agent-success-rate-campaign-progress-v1");
+    const identity = await owned(family, model.campaignIdentity, `agent-success-rate-campaign-progress-v1:${model.campaignIdentity}`);
+    // Ownership blockers can change without a checkpoint transition. Keep both projections immutable at that revision.
+    const modelDigest = campaignHash(canonicalCampaignJson(model));
+    const revision = `revision-${String(model.checkpointGeneration).padStart(10, "0")}-${model.checkpointRevision}-${modelDigest.slice(0, 16)}`;
+    const outDir = path.join(identity, revision);
+    const scientific = model.state === "complete" ? await readCampaignProgressScientificFamily(args.snapshot, args.boundary) : null;
+    const run = scientific ? mapAgentSuccessRateToRun({ runId: scientific.execution.runId, startedAt: scientific.execution.startedAt, completedAt: scientific.execution.completedAt,
+        target: { kind: "self", targetRoot: "[redacted]", toolRoot: "[redacted]", packageName: "@dailephd/my-dev-kit-lab", packageVersion: "0.9.0", hasPackageJson: true, hasLockfile: true, branch: null, commit: null, hasGit: false, isSelf: true },
+        caseEvidence: scientific.execution.cases.map(c => ({ ...c, caseName: c.caseId })), analysis: scientific.analysis.analysis, patchArtifactPaths: [],
+        providerId: scientific.execution.realAgent?.providerId, ...(scientific.execution.realAgent ? { realSettings: { timeoutMs: scientific.execution.realAgent.timeoutMs, repairAttempts: scientific.execution.realAgent.repairAttempts ?? 0 } } : {}) }) : null;
+    if (run)
+        Object.assign(run, { agentSuccessCampaignProgress: model });
+    const files = [
+        { name: "agent-success-rate-campaign-progress.json", content: `${JSON.stringify(model, null, 2)}\n`, phase: "json-written" },
+        { name: "agent-success-rate-campaign-progress.txt", content: renderAgentSuccessCampaignProgressText(model), phase: "text-written" },
+        { name: "agent-success-rate-campaign-progress.html", content: renderAgentSuccessCampaignProgressHtml(model), phase: "html-written" }
+    ];
+    if (run) {
+        const built = buildPluginExperimentReport({ run, plugin: agentSuccessRatePlugin.metadata, outputRoot: outDir, generatedAt: run.completedAt });
+        const report = { ...built, metadata: { ...built.metadata, outputRoot: "[redacted]" } };
+        files.push({ name: "report.json", content: `${JSON.stringify({ report, outputPaths: { outDir: "[redacted]", jsonPath: "report.json", htmlPath: "report.html", textPath: "report.txt" } }, null, 2)}\n`, phase: "json-written" }, { name: "report.txt", content: renderPluginExperimentReportText(report), phase: "text-written" }, { name: "report.html", content: renderPluginExperimentReportHtml(report), phase: "html-written" });
+    }
+    const marker = canonicalCampaignJson({ schemaVersion: "agent-success-rate-campaign-progress-publication-v1", campaignIdentity: model.campaignIdentity, checkpointGeneration: model.checkpointGeneration, checkpointRevision: model.checkpointRevision, modelDigest, files: files.map(f => ({ name: f.name, sha256: campaignHash(f.content), bytes: Buffer.byteLength(f.content) })) });
+    let created = false;
+    try {
+        await mkdir(outDir);
+        created = true;
+    }
+    catch (e) {
+        if (e.code !== "EEXIST")
+            throw e;
+    }
+    await plain(outDir, "directory");
+    if (created) {
+        for (const file of files.slice(0, 3)) {
+            await writeExclusive(path.join(outDir, file.name), file.content);
+            await args.failureHook?.(file.phase);
+        }
+        // Exclusive directory reservation owns these ordinary report names; the existing writer remains their owner.
+        if (run)
+            await writePluginExperimentReports({ run, plugin: agentSuccessRatePlugin.metadata, outputRoot: outDir, generatedAt: run.completedAt, redactOutputRoot: true, exclusive: true });
+        for (const f of files)
+            await readExpected(path.join(outDir, f.name), f.content, "PROGRESS_SNAPSHOT_INTEGRITY");
+        // The legacy writer owns report rendering. Flush its campaign-only output before committing the group marker.
+        for (const f of files.slice(3)) {
+            const h = await open(path.join(outDir, f.name), "r+");
+            try {
+                await h.sync();
+            }
+            finally {
+                await h.close();
+            }
+        }
+        await args.failureHook?.("before-manifest");
+        await writeExclusive(path.join(outDir, "manifest.json"), marker);
+    }
+    campaignAssert((await readdir(outDir)).sort().join(",") === [...files.map(f => f.name), "manifest.json"].sort().join(","), "PROGRESS_INCOMPLETE_OR_UNKNOWN_SNAPSHOT");
+    await readExpected(path.join(outDir, "manifest.json"), marker, "PROGRESS_SNAPSHOT_COLLISION");
+    for (const f of files)
+        await readExpected(path.join(outDir, f.name), f.content, "PROGRESS_SNAPSHOT_INTEGRITY");
+    return { model, outputPaths: { outDir, jsonPath: path.join(outDir, files[0].name), textPath: path.join(outDir, files[1].name), htmlPath: path.join(outDir, files[2].name), manifestPath: path.join(outDir, "manifest.json") } };
+}

package/dist/src/report/experiments/writePluginExperimentReports.js

@@ -31,9 +31,10 @@ export async function writePluginExperimentReports(args) {
     const serializedPaths = args.redactOutputRoot
         ? { outDir: "[redacted]", jsonPath: "report.json", htmlPath: "report.html", textPath: "report.txt" }
         : outputPaths;
-    await writeFile(outputPaths.jsonPath, `${JSON.stringify({ report, outputPaths: serializedPaths }, null, 2)}\n`, "utf8");
-    await writeFile(outputPaths.htmlPath, renderPluginExperimentReportHtml(report), "utf8");
-    await writeFile(outputPaths.textPath, renderPluginExperimentReportText(report), "utf8");
+    const writeOptions = args.exclusive ? { encoding: "utf8", flag: "wx" } : "utf8";
+    await writeFile(outputPaths.jsonPath, `${JSON.stringify({ report, outputPaths: serializedPaths }, null, 2)}\n`, writeOptions);
+    await writeFile(outputPaths.htmlPath, renderPluginExperimentReportHtml(report), writeOptions);
+    await writeFile(outputPaths.textPath, renderPluginExperimentReportText(report), writeOptions);
     return { report, outputPaths };
 }
 function readString(value) {

package/dist/src/securityValidation/packageChecks/parseNpmPackDryRun.js

@@ -13,6 +13,29 @@ export function parseNpmPackDryRun(stdout) {
     if (!stdout.trim()) {
         return { files: [], parseError: "npm pack --dry-run produced no output" };
     }
+    if (/^[\[{]/.test(stdout.trim())) {
+        try {
+            const inventory = JSON.parse(stdout);
+            if (!Array.isArray(inventory) || inventory.length !== 1 ||
+                !inventory[0] || !Array.isArray(inventory[0].files) || !inventory[0].files.length) {
+                return { files: [], parseError: "npm pack JSON must contain exactly one nonempty package inventory" };
+            }
+            const files = [];
+            for (const file of inventory[0].files) {
+                if (!file || typeof file.path !== "string" || !safeInventoryPath(file.path)) {
+                    return { files: [], parseError: "npm pack JSON contains a malformed or unsafe file path" };
+                }
+                // JSON paths are package-relative, unlike text tarball paths. Add the
+                // archive root exactly once so a real nested package/ directory cannot
+                // masquerade as a root entrypoint in the existing detectors.
+                files.push(`package/${file.path.replace(/\\/g, "/").replace(/^(\.\/)+/, "")}`);
+            }
+            return { files };
+        }
+        catch {
+            return { files: [], parseError: "npm pack JSON is unparseable" };
+        }
+    }
     const files = [];
     let inContents = false;
     let totalSize;
@@ -35,10 +58,8 @@ export function parseNpmPackDryRun(stdout) {
             if (match?.[1]) {
                 files.push(match[1].trim());
             }
-            else {
-                // Fallback: take the whole line if size pattern doesn't match
-                files.push(line);
-            }
+            else
+                return { files: [], parseError: "Malformed npm tarball contents line" };
         }
         const totalMatch = line.match(/total files\s*:\s*(\d+)/i) ?? line.match(/unpacked size\s*:\s*([\d.]+\s*[kKmMgGbB]+)/i);
         if (totalMatch?.[1]) {
@@ -52,5 +73,14 @@ export function parseNpmPackDryRun(stdout) {
             parseError: "npm pack --dry-run: no files detected in tarball contents section",
         };
     }
+    if (files.some((file) => !safeInventoryPath(file))) {
+        return { files: [], parseError: "npm pack contains an unsafe file path" };
+    }
     return { files, totalSize };
 }
+function safeInventoryPath(file) {
+    const normalized = file.replace(/\\/g, "/").replace(/^(\.\/)+/, "");
+    return Boolean(normalized) && !normalized.startsWith("/") &&
+        !/[\x00-\x1f\x7f:]/.test(normalized) &&
+        normalized.split("/").every((part) => Boolean(part) && part !== "." && part !== "..");
+}

package/dist/src/securityValidation/packageChecks/requiredPackageContents.js

@@ -1,3 +1,5 @@
+import fs from "node:fs/promises";
+import path from "node:path";
 export const REQUIRED_PACKAGE_CONTENTS = [
     "CHANGELOG.md",
     "LICENSE",
@@ -20,15 +22,117 @@ export const REQUIRED_PACKAGE_CONTENTS = [
     "examples/token-savings-cases.json",
 ];
 function normalizeTarballPath(file) {
-    const normalized = file.replace(/\\/g, "/");
+    const normalized = file.replace(/\\/g, "/").replace(/^(\.\/)+/, "");
     return normalized.startsWith("package/")
         ? normalized.slice("package/".length)
         : normalized;
 }
+// Policy belongs beside the existing required-file detector. Identity is
+// supplied by the existing target resolver, never inferred from package name.
+export async function requiredContentsForTarget(target) {
+    const required = new Set(target.isSelf ? REQUIRED_PACKAGE_CONTENTS : ["package.json"]);
+    const findings = [];
+    function invalid(field, reason) {
+        findings.push({
+            id: `npm-pack-metadata-${findings.length}`,
+            title: `Package metadata cannot be validated: ${field}`,
+            severity: "blocker",
+            category: "package-content",
+            description: reason,
+            evidence: `package.json field: ${field}; ${reason}`,
+            affectedFiles: ["package.json"],
+            recommendation: "Provide readable package metadata with supported, safe package-relative entrypoint paths and rerun validation.",
+            releaseImpact: "Blocker: required package evidence is incomplete",
+        });
+    }
+    function entry(value, field, exportsPath = false) {
+        if (typeof value !== "string") {
+            invalid(field, "Malformed entrypoint: expected a nonempty string.");
+            return;
+        }
+        const normalized = value.replace(/\\/g, "/");
+        const relative = normalized.replace(/^(\.\/)+/, "");
+        if (!relative || normalized !== normalized.trim() ||
+            /[\x00-\x1f\x7f:*?#%]/.test(normalized) || normalized.startsWith("/") ||
+            relative.split("/").some((part) => !part || part === ".." || part === "." || part === "node_modules") ||
+            (exportsPath && !normalized.startsWith("./"))) {
+            invalid(field, "Unsafe or unsupported entrypoint path (absolute, escaping, pattern, URL, or ambiguous path).");
+            return;
+        }
+        required.add(relative);
+    }
+    try {
+        const metadata = JSON.parse(await fs.readFile(path.join(target.targetRoot, "package.json"), "utf8"));
+        if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+            invalid("package.json", "Malformed package metadata: expected an object.");
+        }
+        else if (!target.isSelf) {
+            const pkg = metadata;
+            if ("bin" in pkg) {
+                if (typeof pkg.bin === "string")
+                    entry(pkg.bin, "bin");
+                else if (pkg.bin && typeof pkg.bin === "object" && !Array.isArray(pkg.bin)) {
+                    for (const key of Object.keys(pkg.bin).sort()) {
+                        if (!key || key === "." || key === ".." || /[\\/:\x00-\x1f\x7f]/.test(key)) {
+                            invalid("bin", "Unsafe or unsupported executable name in bin map.");
+                        }
+                        else
+                            entry(pkg.bin[key], `bin.${key}`);
+                    }
+                }
+                else
+                    invalid("bin", "Malformed bin: expected a string or object map.");
+            }
+            if ("main" in pkg) {
+                if (typeof pkg.main === "string" && pkg.main && !path.posix.extname(pkg.main.replace(/\\/g, "/"))) {
+                    invalid("main", "Unsupported or ambiguous main: extensionless or directory resolution is not validated; declare an exact runtime file.");
+                }
+                else
+                    entry(pkg.main, "main");
+            }
+            if ("exports" in pkg && pkg.exports !== null) {
+                if (typeof pkg.exports === "string")
+                    entry(pkg.exports, "exports", true);
+                else if (pkg.exports && typeof pkg.exports === "object" && !Array.isArray(pkg.exports)) {
+                    const exports = pkg.exports;
+                    const keys = Object.keys(exports).sort();
+                    if (!keys.length || keys.some((key) => key !== "." && (!key.startsWith("./") || /[\\:*?#%\x00-\x1f\x7f]/.test(key) ||
+                        key.slice(2).split("/").some((part) => !part || part === "." || part === "..")))) {
+                        invalid("exports", "Unsupported or ambiguous exports: conditional or pattern mappings require additional evidence.");
+                    }
+                    else
+                        for (const key of keys) {
+                            if (exports[key] === null)
+                                continue; // Explicitly excluded subpath.
+                            if (typeof exports[key] !== "string") {
+                                invalid(`exports.${key}`, "Unsupported exports shape: conditional objects and fallback arrays are not validated.");
+                            }
+                            else
+                                entry(exports[key], `exports.${key}`, true);
+                        }
+                }
+                else
+                    invalid("exports", "Unsupported exports shape: expected an exact string or subpath map.");
+            }
+            // npm automatically ships existing root README and license files. Do not
+            // invent a documentation requirement for packages without those files.
+            for (const file of (await fs.readdir(target.targetRoot, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+                if (file.isFile() && /^(readme|licen[cs]e)(\..*)?$/i.test(file.name))
+                    required.add(file.name);
+            }
+        }
+    }
+    catch {
+        invalid("package.json", "Package metadata is missing, unreadable, or unparseable.");
+    }
+    return { requiredFiles: [...required].sort(), findings };
+}
 export function detectMissingRequiredContents(options) {
     const present = new Set(options.files.map(normalizeTarballPath));
     const required = [...(options.requiredFiles ?? REQUIRED_PACKAGE_CONTENTS)]
-        .map(normalizeTarballPath)
+        // Requirements are package-relative declarations, not archive paths. A
+        // literal package/ directory in an entrypoint must not be stripped.
+        .map((file) => file.replace(/\\/g, "/").replace(/^(\.\/)+/, ""))
         .sort((left, right) => left.localeCompare(right));
     const missing = required.filter((file) => !present.has(file));
     const findings = missing.map((file, index) => ({