@dailephd/my-dev-kit-lab 0.9.1 → 0.9.2

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to my-dev-kit-lab are documented here.
 
+## [Unreleased]
+
+## [0.9.2] - 2026-10-13
+
+### Security validation and cross-platform corrections
+
+- Corrected external npm package validation to derive required entrypoints from validated package metadata while preserving the strict Lab self-package inventory. Missing declared entrypoints, invalid or incomplete metadata, failed or incomplete package evidence, and forbidden contents remain blockers.
+- Eliminated nine inherited Lab-only false positives when validating the external Orchestrator package. This does not change the Orchestrator package or its independent security findings and release status.
+- Corrected Semgrep failed and incomplete scan evidence so neither can produce a false `PASS`; unavailable optional scanners remain explicitly `SKIPPED`.
+- Corrected campaign filesystem identity and path-safety behavior and cross-platform compatibility.
+- Preserved security verdict strictness, severity mappings, mandatory checks, and existing command and report contracts.
+
+This section records the intended v0.9.2 release contents. Registry publication status is established through npm evidence, not this changelog.
+
 ## [0.9.1] - 2026-10-12
 
 ### Normalized provider telemetry and resumable campaigns
@@ -11,8 +25,6 @@ All notable changes to my-dev-kit-lab are documented here.
 - Added public campaign CLI options, Codex and Claude timeout presets, campaign progress summaries, and strong/partial/unavailable metric-specific evidence classifications.
 - Preserved partial evidence without presenting it as complete scientific analysis; uncertain provider invocations are not replayed automatically. Real-provider use remains explicitly opted in and depends on the existing provider adapters.
 
-## [Unreleased]
-
 ## [0.9.0] - 2026-10-10
 
 ### Agent success rate

package/README.md

@@ -6,11 +6,15 @@ my-dev-kit provides local repository indexing and graph-guided retrieval. my-dev
 
 Whole-ecosystem workflows are centralized in [my-dev-kit/docs/ECOSYSTEM_DEVELOPMENT_WORKFLOWS.md](https://github.com/dailephd/my-dev-kit/blob/main/docs/ECOSYSTEM_DEVELOPMENT_WORKFLOWS.md). Its [command-surface compatibility map](https://github.com/dailephd/my-dev-kit/blob/main/docs/ECOSYSTEM_DEVELOPMENT_WORKFLOWS.md#915-command-surface-compatibility-map) documents which Lab outputs can safely seed my-dev-kit investigation, Observer reference work, or Orchestrator evidence, and which look-alike artifacts are not direct inputs.
 
-The latest release is v0.9.1 (normalized provider telemetry and resumable agent-success-rate campaigns), and the repository package version is 0.9.1. The previous release is v0.9.0 (agent-success-rate implementation-patch evaluation). The v0.4.5 context-integrity evaluation remains intentionally frozen against the published `@dailephd/my-dev-kit@1.10.4` and `@dailephd/my-dev-kit-orchestrator@1.2.3` contracts; those versions are historical validation baselines, not a statement that they are the ecosystem's current releases. See [docs/CURRENT_STATE.md](docs/CURRENT_STATE.md) for current state.
+The current release-document and package-metadata version is v0.9.2. It corrects external npm package entrypoint validation, preserves strict Lab self-package validation, eliminates nine inherited false positives, corrects Semgrep failed/incomplete-scan evidence, and includes campaign filesystem identity, path-safety, and cross-platform corrections; security verdict strictness is unchanged. v0.9.1 (normalized provider telemetry and resumable agent-success-rate campaigns) is the previous published release. Publication is established separately through registry evidence. The v0.4.5 context-integrity evaluation remains intentionally frozen against the published `@dailephd/my-dev-kit@1.10.4` and `@dailephd/my-dev-kit-orchestrator@1.2.3` contracts; those versions are historical validation baselines, not a statement that they are the ecosystem's current releases. See [docs/CURRENT_STATE.md](docs/CURRENT_STATE.md) for current state.
 
 v0.9.0 adds the `agent-success-rate` plugin, the eighth registered experiment plugin, which evaluates implementation patches under the `raw-full-file` and `context-pack` treatments.
 
-v0.9.1 adds normalized provider telemetry and resumable campaign execution. v0.9.2 remains planned.
+v0.9.1 is the previous published package release.
+
+The v0.9.2 release corrects external npm package entrypoint validation, preserves strict Lab self-package validation, eliminates nine inherited false positives, corrects Semgrep failed/incomplete-scan evidence, and includes campaign filesystem identity, path-safety, and cross-platform corrections. Security verdict strictness is unchanged. Readiness was accepted for the exact implementation SHA, and the release candidate passed its release-PR validation. The current release-document state is final; actual npm publication is established separately through registry evidence.
+
+The original prompt/report/gallery feature milestone remains planned for v0.9.3. See [docs/CURRENT_STATE.md](docs/CURRENT_STATE.md) for implementation-stage evidence and lifecycle state.
 
 v0.4.6 adds a supported `my-dev-kit-lab` installed CLI router (`--help`, `--version`, `security validate`, `audit`, the `experiment` family, `report render`, `plots generate`, `gallery build`, `demo final`, and the historical direct final-demo invocation form), a writable lab workspace model kept separate from the installed package and the inspected target, and a permanent packed-tarball installation/execution acceptance gate (`npm run verify:packed-package`). See [docs/ROADMAP.md](docs/ROADMAP.md) and [docs/CURRENT_STATE.md](docs/CURRENT_STATE.md) for status detail and [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) for the runtime path model. The "Installed CLI" section below documents the shipped command surface; the source-checkout `npm run` workflow in Quickstart remains available for contributors.
 
@@ -284,6 +288,8 @@ See [docs/METRICS.md](docs/METRICS.md) for full metric definitions.
 
 `npm run security:validate` (contributor/source-checkout) and `my-dev-kit-lab security validate` (installed CLI) both call the same standalone security-validation command owner. It checks local CLI/package boundaries and can inspect another local project with `--target <path>`. The generic audit command can reuse those results through `--types security`, but it does not replace the standalone validator or its reports.
 
+**External npm package validation (v0.9.2 release documentation):** the external-target package-content correction keeps Lab self-validation's strict required inventory and checks external packages against declared entrypoints. Missing entrypoints, invalid or incomplete metadata, failed package evidence, and forbidden contents remain blockers. The nine inherited Lab-only Orchestrator false positives are eliminated. The prompt/report/gallery feature scope is preserved as planned v0.9.3 work. Earlier failed readiness attempts remain historical and are superseded by the accepted readiness result for the exact validated SHA; see [CURRENT_STATE.md](docs/CURRENT_STATE.md).
+
 Android validation uses `--profile android`. Its default path is static and non-destructive: it starts zero Gradle processes, zero external tools, and zero network operations. Only confirmed `SecurityFinding` records can become audit issues; Android `CandidateEvidence` remains review-only evidence.
 
 Optional local scanners are reported as `skipped` when unavailable, never as passed. This local availability rule does not make CodeQL coverage optional for release readiness: the exact candidate must pass the repository-controlled GitHub CodeQL workflow and have its Code Scanning alerts reviewed. The framework does not provide runtime isolation proof, device or APK/AAB analysis, signing verification, Play Console validation, automatic fixes, or manual pentesting. Manual pentest remains deferred until post-v1/version TBD.

package/dist/src/commands/runExperimentRunCommand.js

@@ -1,4 +1,4 @@
-import { lstat, mkdir, readFile, readdir, realpath } from "node:fs/promises";
+import { lstat, mkdir, readFile, readdir } from "node:fs/promises";
 import path from "node:path";
 import { parseAgentCommandTemplate } from "../agents/index.js";
 import { parseAgentId } from "../agents/agentRegistry.js";
@@ -23,7 +23,7 @@ import { validateAgentSuccessRateConfig } from "../experiments/plugins/agentSucc
 import { AGENT_SUCCESS_RATE_DEFAULT_AGENT_TIMEOUT_MS } from "../experiments/plugins/agentSuccessRate/realAgentExecution.js";
 import { AGENT_SUCCESS_RATE_TREATMENT_IDS } from "../experiments/plugins/agentSuccessRate/metadata.js";
 import { executeAgentSuccessCampaignV2, prepareAgentSuccessCampaign } from "../experiments/plugins/agentSuccessRate/campaignExecution.js";
-import { readCampaignCheckpointV2, validateCampaignOutputPath } from "../experiments/plugins/agentSuccessRate/campaignCheckpointStore.js";
+import { readCampaignCheckpointV2, resolveCampaignRoot, validateCampaignOutputPath } from "../experiments/plugins/agentSuccessRate/campaignCheckpointStore.js";
 import { validateCampaignLimitAuthorization } from "../experiments/plugins/agentSuccessRate/campaignRecovery.js";
 import { campaignIdentifier } from "../experiments/plugins/agentSuccessRate/campaignIdentity.js";
 import { readCampaignProgress } from "../experiments/plugins/agentSuccessRate/campaignProgress.js";
@@ -263,7 +263,8 @@ async function runAgentCampaignCommand(args, context, outputRoot, inputs, runId,
         const executingMetadata = JSON.parse(await readFile(path.join(context.packageRoot, "package.json"), "utf8"));
         if (executingMetadata.name !== packageName || typeof executingMetadata.version !== "string" || !validPackageVersion.test(executingMetadata.version))
             throw new Error();
-        if (!(await lstat(path.join(sourceRoot, "src"))).isDirectory() || path.resolve(await realpath(sourceRoot)).toLowerCase() !== sourceRoot.toLowerCase())
+        await resolveCampaignRoot(sourceRoot);
+        if (!(await lstat(path.join(sourceRoot, "src"))).isDirectory())
             throw new Error();
         const metadata = JSON.parse(await readFile(path.join(sourceRoot, "package.json"), "utf8"));
         if (metadata.name !== packageName || metadata.version !== executingMetadata.version)

package/dist/src/experiments/plugins/agentSuccessRate/campaignCheckpointStore.js

@@ -46,7 +46,7 @@ async function plainAncestors(candidate) {
     }
 }
 /** Resolve filesystem aliases before inspecting ancestors (macOS exposes /var as /private/var). */
-async function resolveCampaignRoot(candidate) {
+export async function resolveCampaignRoot(candidate) {
     const resolved = path.resolve(candidate);
     let existing = resolved;
     const remainder = [];

package/dist/src/experiments/plugins/agentSuccessRate/campaignProgress.js

@@ -1,5 +1,6 @@
-import { lstat, readFile, realpath } from "node:fs/promises";
+import { lstat, readFile } from "node:fs/promises";
 import path from "node:path";
+import { isSameOrInside, resolvePhysicalPath } from "../../../evaluation/benchmarkSandbox/pathPolicy.js";
 import { normalizeAgentDurationV091 as normalizedDuration, normalizeAgentTokenUsageV091 as normalizedTokens } from "../../../agents/normalizeAgentTelemetry.js";
 import { validateAgentSuccessRateExecutionArtifact } from "./executionArtifact.js";
 import { validateAgentSuccessRateAnalysisArtifact, validateAgentSuccessRateArtifactFamily } from "./analysisArtifact.js";
@@ -88,7 +89,8 @@ export async function readCampaignProgressScientificFamily(snapshot, boundary) {
     const load = async (name) => {
         const ref = cp.finalization.artifacts.find(a => a.path === name);
         const file = path.join(boundary.outputRoot, name), stat = await lstat(file);
-        campaignAssert(stat.isFile() && !stat.isSymbolicLink() && stat.size === ref.bytes && path.resolve(await realpath(file)).toLowerCase() === path.resolve(file).toLowerCase(), "SCIENTIFIC_ARTIFACT_UNSAFE");
+        const [physicalRoot, physicalFile] = await Promise.all([resolvePhysicalPath(boundary.outputRoot), resolvePhysicalPath(file)]);
+        campaignAssert(stat.isFile() && !stat.isSymbolicLink() && stat.size === ref.bytes && isSameOrInside(physicalRoot, physicalFile) && path.dirname(physicalFile) === physicalRoot, "SCIENTIFIC_ARTIFACT_UNSAFE");
         const bytes = await readFile(file);
         campaignAssert(bytes.length === ref.bytes && campaignHash(bytes) === ref.sha256, "SCIENTIFIC_ARTIFACT_CHANGED");
         return JSON.parse(bytes.toString("utf8"));

package/dist/src/report/experiments/writeAgentSuccessCampaignProgressReport.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { campaignAssert, campaignHash, canonicalCampaignJson } from "../../experiments/plugins/agentSuccessRate/campaignIdentity.js";
 import { validateCampaignOutputPath } from "../../experiments/plugins/agentSuccessRate/campaignCheckpointStore.js";
 import { readCampaignProgressScientificFamily } from "../../experiments/plugins/agentSuccessRate/campaignProgress.js";
+import { resolvePhysicalPath } from "../../evaluation/benchmarkSandbox/pathPolicy.js";
 import { agentSuccessRatePlugin, mapAgentSuccessRateToRun } from "../../experiments/plugins/agentSuccessRate/plugin.js";
 import { writePluginExperimentReports } from "./writePluginExperimentReports.js";
 import { buildPluginExperimentReport } from "./buildPluginExperimentReport.js";
@@ -13,7 +14,7 @@ import { renderAgentSuccessCampaignProgressText } from "./renderAgentSuccessCamp
 import { renderAgentSuccessCampaignProgressHtml } from "./renderAgentSuccessCampaignProgressHtml.js";
 async function plain(p, kind) {
     const s = await lstat(p);
-    campaignAssert(!s.isSymbolicLink() && (kind === "file" ? s.isFile() : s.isDirectory()) && path.resolve(await realpath(p)).toLowerCase() === path.resolve(p).toLowerCase(), "PROGRESS_UNSAFE_PATH");
+    campaignAssert(!s.isSymbolicLink() && (kind === "file" ? s.isFile() : s.isDirectory()) && path.resolve(await realpath(p)) === path.resolve(p), "PROGRESS_UNSAFE_PATH");
 }
 async function writeExclusive(p, content) {
     const h = await open(p, "wx");
@@ -68,7 +69,10 @@ async function owned(parent, name, owner) {
 export async function writeAgentSuccessCampaignProgressReport(args) {
     const model = buildAgentSuccessCampaignProgressReport(args.snapshot, args.boundary);
     await validateCampaignOutputPath(args.boundary);
-    const root = path.resolve(args.boundary.outputRoot);
+    // The checkpoint store has already validated this output root. Use the same physical identity for
+    // publication: a legitimate OS alias (for example macOS /var -> /private/var) is not a redirect
+    // created inside the campaign tree, and comparing it to the lexical spelling rejects valid roots.
+    const root = await resolvePhysicalPath(args.boundary.outputRoot);
     await plain(root, "directory");
     const family = await owned(root, "campaign-progress-v1", "agent-success-rate-campaign-progress-v1");
     const identity = await owned(family, model.campaignIdentity, `agent-success-rate-campaign-progress-v1:${model.campaignIdentity}`);

package/dist/src/securityValidation/packageChecks/parseNpmPackDryRun.js

@@ -13,6 +13,29 @@ export function parseNpmPackDryRun(stdout) {
     if (!stdout.trim()) {
         return { files: [], parseError: "npm pack --dry-run produced no output" };
     }
+    if (/^[\[{]/.test(stdout.trim())) {
+        try {
+            const inventory = JSON.parse(stdout);
+            if (!Array.isArray(inventory) || inventory.length !== 1 ||
+                !inventory[0] || !Array.isArray(inventory[0].files) || !inventory[0].files.length) {
+                return { files: [], parseError: "npm pack JSON must contain exactly one nonempty package inventory" };
+            }
+            const files = [];
+            for (const file of inventory[0].files) {
+                if (!file || typeof file.path !== "string" || !safeInventoryPath(file.path)) {
+                    return { files: [], parseError: "npm pack JSON contains a malformed or unsafe file path" };
+                }
+                // JSON paths are package-relative, unlike text tarball paths. Add the
+                // archive root exactly once so a real nested package/ directory cannot
+                // masquerade as a root entrypoint in the existing detectors.
+                files.push(`package/${file.path.replace(/\\/g, "/").replace(/^(\.\/)+/, "")}`);
+            }
+            return { files };
+        }
+        catch {
+            return { files: [], parseError: "npm pack JSON is unparseable" };
+        }
+    }
     const files = [];
     let inContents = false;
     let totalSize;
@@ -35,10 +58,8 @@ export function parseNpmPackDryRun(stdout) {
             if (match?.[1]) {
                 files.push(match[1].trim());
             }
-            else {
-                // Fallback: take the whole line if size pattern doesn't match
-                files.push(line);
-            }
+            else
+                return { files: [], parseError: "Malformed npm tarball contents line" };
         }
         const totalMatch = line.match(/total files\s*:\s*(\d+)/i) ?? line.match(/unpacked size\s*:\s*([\d.]+\s*[kKmMgGbB]+)/i);
         if (totalMatch?.[1]) {
@@ -52,5 +73,14 @@ export function parseNpmPackDryRun(stdout) {
             parseError: "npm pack --dry-run: no files detected in tarball contents section",
         };
     }
+    if (files.some((file) => !safeInventoryPath(file))) {
+        return { files: [], parseError: "npm pack contains an unsafe file path" };
+    }
     return { files, totalSize };
 }
+function safeInventoryPath(file) {
+    const normalized = file.replace(/\\/g, "/").replace(/^(\.\/)+/, "");
+    return Boolean(normalized) && !normalized.startsWith("/") &&
+        !/[\x00-\x1f\x7f:]/.test(normalized) &&
+        normalized.split("/").every((part) => Boolean(part) && part !== "." && part !== "..");
+}

package/dist/src/securityValidation/packageChecks/requiredPackageContents.js

@@ -1,3 +1,5 @@
+import fs from "node:fs/promises";
+import path from "node:path";
 export const REQUIRED_PACKAGE_CONTENTS = [
     "CHANGELOG.md",
     "LICENSE",
@@ -20,15 +22,117 @@ export const REQUIRED_PACKAGE_CONTENTS = [
     "examples/token-savings-cases.json",
 ];
 function normalizeTarballPath(file) {
-    const normalized = file.replace(/\\/g, "/");
+    const normalized = file.replace(/\\/g, "/").replace(/^(\.\/)+/, "");
     return normalized.startsWith("package/")
         ? normalized.slice("package/".length)
         : normalized;
 }
+// Policy belongs beside the existing required-file detector. Identity is
+// supplied by the existing target resolver, never inferred from package name.
+export async function requiredContentsForTarget(target) {
+    const required = new Set(target.isSelf ? REQUIRED_PACKAGE_CONTENTS : ["package.json"]);
+    const findings = [];
+    function invalid(field, reason) {
+        findings.push({
+            id: `npm-pack-metadata-${findings.length}`,
+            title: `Package metadata cannot be validated: ${field}`,
+            severity: "blocker",
+            category: "package-content",
+            description: reason,
+            evidence: `package.json field: ${field}; ${reason}`,
+            affectedFiles: ["package.json"],
+            recommendation: "Provide readable package metadata with supported, safe package-relative entrypoint paths and rerun validation.",
+            releaseImpact: "Blocker: required package evidence is incomplete",
+        });
+    }
+    function entry(value, field, exportsPath = false) {
+        if (typeof value !== "string") {
+            invalid(field, "Malformed entrypoint: expected a nonempty string.");
+            return;
+        }
+        const normalized = value.replace(/\\/g, "/");
+        const relative = normalized.replace(/^(\.\/)+/, "");
+        if (!relative || normalized !== normalized.trim() ||
+            /[\x00-\x1f\x7f:*?#%]/.test(normalized) || normalized.startsWith("/") ||
+            relative.split("/").some((part) => !part || part === ".." || part === "." || part === "node_modules") ||
+            (exportsPath && !normalized.startsWith("./"))) {
+            invalid(field, "Unsafe or unsupported entrypoint path (absolute, escaping, pattern, URL, or ambiguous path).");
+            return;
+        }
+        required.add(relative);
+    }
+    try {
+        const metadata = JSON.parse(await fs.readFile(path.join(target.targetRoot, "package.json"), "utf8"));
+        if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+            invalid("package.json", "Malformed package metadata: expected an object.");
+        }
+        else if (!target.isSelf) {
+            const pkg = metadata;
+            if ("bin" in pkg) {
+                if (typeof pkg.bin === "string")
+                    entry(pkg.bin, "bin");
+                else if (pkg.bin && typeof pkg.bin === "object" && !Array.isArray(pkg.bin)) {
+                    for (const key of Object.keys(pkg.bin).sort()) {
+                        if (!key || key === "." || key === ".." || /[\\/:\x00-\x1f\x7f]/.test(key)) {
+                            invalid("bin", "Unsafe or unsupported executable name in bin map.");
+                        }
+                        else
+                            entry(pkg.bin[key], `bin.${key}`);
+                    }
+                }
+                else
+                    invalid("bin", "Malformed bin: expected a string or object map.");
+            }
+            if ("main" in pkg) {
+                if (typeof pkg.main === "string" && pkg.main && !path.posix.extname(pkg.main.replace(/\\/g, "/"))) {
+                    invalid("main", "Unsupported or ambiguous main: extensionless or directory resolution is not validated; declare an exact runtime file.");
+                }
+                else
+                    entry(pkg.main, "main");
+            }
+            if ("exports" in pkg && pkg.exports !== null) {
+                if (typeof pkg.exports === "string")
+                    entry(pkg.exports, "exports", true);
+                else if (pkg.exports && typeof pkg.exports === "object" && !Array.isArray(pkg.exports)) {
+                    const exports = pkg.exports;
+                    const keys = Object.keys(exports).sort();
+                    if (!keys.length || keys.some((key) => key !== "." && (!key.startsWith("./") || /[\\:*?#%\x00-\x1f\x7f]/.test(key) ||
+                        key.slice(2).split("/").some((part) => !part || part === "." || part === "..")))) {
+                        invalid("exports", "Unsupported or ambiguous exports: conditional or pattern mappings require additional evidence.");
+                    }
+                    else
+                        for (const key of keys) {
+                            if (exports[key] === null)
+                                continue; // Explicitly excluded subpath.
+                            if (typeof exports[key] !== "string") {
+                                invalid(`exports.${key}`, "Unsupported exports shape: conditional objects and fallback arrays are not validated.");
+                            }
+                            else
+                                entry(exports[key], `exports.${key}`, true);
+                        }
+                }
+                else
+                    invalid("exports", "Unsupported exports shape: expected an exact string or subpath map.");
+            }
+            // npm automatically ships existing root README and license files. Do not
+            // invent a documentation requirement for packages without those files.
+            for (const file of (await fs.readdir(target.targetRoot, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+                if (file.isFile() && /^(readme|licen[cs]e)(\..*)?$/i.test(file.name))
+                    required.add(file.name);
+            }
+        }
+    }
+    catch {
+        invalid("package.json", "Package metadata is missing, unreadable, or unparseable.");
+    }
+    return { requiredFiles: [...required].sort(), findings };
+}
 export function detectMissingRequiredContents(options) {
     const present = new Set(options.files.map(normalizeTarballPath));
     const required = [...(options.requiredFiles ?? REQUIRED_PACKAGE_CONTENTS)]
-        .map(normalizeTarballPath)
+        // Requirements are package-relative declarations, not archive paths. A
+        // literal package/ directory in an entrypoint must not be stripped.
+        .map((file) => file.replace(/\\/g, "/").replace(/^(\.\/)+/, ""))
         .sort((left, right) => left.localeCompare(right));
     const missing = required.filter((file) => !present.has(file));
     const findings = missing.map((file, index) => ({

package/dist/src/securityValidation/packageChecks/runPackageChecks.js

@@ -3,7 +3,9 @@ import { runSecurityCommand, resolveNpmCommand } from "../commandRunner.js";
 import { writeCheckResult } from "../artifacts.js";
 import { parseNpmPackDryRun } from "./parseNpmPackDryRun.js";
 import { detectForbiddenContents } from "./forbiddenPackageContents.js";
-import { detectMissingRequiredContents } from "./requiredPackageContents.js";
+import { detectMissingRequiredContents, requiredContentsForTarget } from "./requiredPackageContents.js";
+import { resolveValidationTarget } from "../validate/resolveTarget.js";
+import { discoverPackageRoot } from "../../runtime/packageRoot.js";
 // Run npm pack --dry-run and inspect the resulting file list for forbidden contents.
 // Does not publish anything.
 export async function runPackageChecks(options) {
@@ -12,20 +14,23 @@ export async function runPackageChecks(options) {
     const allFindings = [];
     const checks = [];
     const npm = resolveNpmCommand();
+    const target = options.target ?? resolveValidationTarget(path.resolve(cwd), discoverPackageRoot());
+    if (path.resolve(target.targetRoot) !== path.resolve(cwd)) {
+        throw new Error("Package check cwd does not match the resolved target root");
+    }
+    const policy = await requiredContentsForTarget(target);
     // npm pack --dry-run to get the tarball file list
     const startedAt = new Date().toISOString();
     const cmd = await runSecurityCommand({
         command: npm,
-        args: ["pack", "--dry-run"],
+        args: ["pack", "--dry-run", "--json", "--ignore-scripts", "--cache", path.resolve(rawOutputDir, "npm-cache")],
         cwd,
         timeoutMs: commandTimeoutMs,
     });
     const finishedAt = new Date().toISOString();
-    // npm pack --dry-run writes the tarball filename to stdout on some npm
-    // versions and the detailed file list to stderr. Prefer whichever stream
-    // contains the tarball contents section, then fall back to combined output.
-    const packOutput = [cmd.stdout, cmd.stderr].find((stream) => /tarball contents/i.test(stream)) ??
-        [cmd.stdout, cmd.stderr].filter(Boolean).join("\n");
+    // Supported npm versions emit JSON on stdout. Lifecycle scripts are disabled
+    // so inspection cannot build, install, or rewrite the target.
+    const packOutput = cmd.stdout;
     const parsed = parseNpmPackDryRun(packOutput);
     const { findings: contentFindings } = detectForbiddenContents({
         files: parsed.files,
@@ -36,20 +41,28 @@ export async function runPackageChecks(options) {
     const { findings: missingRequiredFindings } = detectMissingRequiredContents({
         files: parsed.files,
         checkId: "npm-pack",
+        requiredFiles: policy.requiredFiles,
     });
-    const packageFindings = [...contentFindings, ...missingRequiredFindings];
+    const evidenceFindings = [];
+    if (cmd.exitCode !== 0 || cmd.timedOut || cmd.skipped || parsed.parseError || parsed.files.length === 0) {
+        evidenceFindings.push({
+            id: "npm-pack-evidence-invalid",
+            title: "npm package inventory could not be validated",
+            severity: "blocker",
+            category: "package-content",
+            description: "A successful npm pack operation and a nonempty, parseable inventory are required.",
+            evidence: `exitCode=${String(cmd.exitCode)}; timedOut=${cmd.timedOut}; skipped=${cmd.skipped}; ${parsed.parseError ?? ""}; ${cmd.stderr.slice(0, 500)}`,
+            recommendation: "Resolve the package command or inventory failure and rerun validation.",
+            releaseImpact: "Blocker: required package evidence is unavailable",
+        });
+    }
+    const packageFindings = [...policy.findings, ...evidenceFindings, ...contentFindings, ...missingRequiredFindings];
     allFindings.push(...packageFindings);
     const packCheck = {
         id: "npm-pack-dry-run",
         name: "npm pack --dry-run (tarball file list)",
         category: "package-content",
-        status: cmd.timedOut
-            ? "failed"
-            : parsed.parseError && parsed.files.length === 0
-                ? "warning"
-                : packageFindings.length > 0
-                    ? "failed"
-                    : "passed",
+        status: packageFindings.length > 0 ? "failed" : "passed",
         severity: packageFindings.length > 0
             ? packageFindings.some((f) => f.severity === "blocker")
                 ? "blocker"
@@ -60,7 +73,9 @@ export async function runPackageChecks(options) {
         durationMs: cmd.durationMs,
         findings: packageFindings,
         skippedReason: undefined,
-        command: "npm pack --dry-run",
+        command: "npm pack --dry-run --json --ignore-scripts",
+        commandCwd: cwd,
+        exitCode: cmd.exitCode,
     };
     await writeCheckResult({
         result: packCheck,

package/dist/src/securityValidation/staticScans/semgrep.js

@@ -5,16 +5,35 @@ import { resolveCommand } from "../../core/resolveCommand.js";
 import { skippedCheck } from "../cliAdversarial/runAdversarialCheck.js";
 export function parseSemgrepJson(raw) {
     if (!raw.trim()) {
-        return { findings: [], rawOutput: raw };
+        return { findings: [], parseError: "Semgrep produced no JSON scan evidence", rawOutput: raw };
     }
     try {
         const parsed = JSON.parse(raw);
-        const results = Array.isArray(parsed["results"]) ? parsed["results"] : [];
-        const findings = results.map((r) => {
+        if (!isRecord(parsed) || !Array.isArray(parsed.results)) {
+            return { findings: [], parseError: "Semgrep JSON requires a results array", rawOutput: raw };
+        }
+        const findings = [];
+        let parseError = !Array.isArray(parsed.errors) || !isRecord(parsed.paths) ||
+            !Array.isArray(parsed.paths.scanned) || parsed.paths.scanned.some((file) => typeof file !== "string")
+            ? "Semgrep JSON requires errors and paths.scanned arrays" : undefined;
+        for (const [index, r] of parsed.results.entries()) {
+            if (!isRecord(r) || typeof r.check_id !== "string" || !r.check_id ||
+                typeof r.path !== "string" || !r.path || !isRecord(r.start) ||
+                !Number.isInteger(r.start.line) || Number(r.start.line) < 1 || !isRecord(r.extra) ||
+                (r.extra.message !== undefined && typeof r.extra.message !== "string") ||
+                (r.extra.metadata !== undefined && !isRecord(r.extra.metadata))) {
+                parseError ??= `Malformed Semgrep result at index ${index}`;
+                continue;
+            }
             const item = r;
             const checkId = typeof item["check_id"] === "string" ? item["check_id"] : "unknown";
             const extra = item["extra"] ?? {};
             const metadata = extra["metadata"] ?? {};
+            if ((extra.severity !== undefined && (typeof extra.severity !== "string" || !extra.severity.trim())) ||
+                (extra.severity === undefined && (typeof metadata.severity !== "string" || !metadata.severity.trim()))) {
+                parseError ??= `Missing or malformed Semgrep severity at index ${index}`;
+                continue;
+            }
             const severity = typeof extra["severity"] === "string"
                 ? extra["severity"]
                 : typeof metadata["severity"] === "string"
@@ -24,9 +43,14 @@ export function parseSemgrepJson(raw) {
             const filePath = typeof item["path"] === "string" ? item["path"] : "";
             const startObj = item["start"] ?? {};
             const line = typeof startObj["line"] === "number" ? startObj["line"] : 0;
-            return { ruleId: checkId, severity, message, path: filePath, line };
-        });
-        return { findings, rawOutput: raw };
+            findings.push({ ruleId: checkId, severity, message, path: filePath, line });
+        }
+        // Semgrep's CLI contract reports partial/fatal analysis in errors even
+        // when the process exits zero. Retain matches, but never call this clean.
+        const analysisError = Array.isArray(parsed.errors) && parsed.errors.length > 0
+            ? `Semgrep reported ${parsed.errors.length} analysis error(s): ${JSON.stringify(parsed.errors).slice(0, 500)}`
+            : undefined;
+        return { findings, parseError, analysisError, rawOutput: raw };
     }
     catch (err) {
         return {
@@ -36,6 +60,9 @@ export function parseSemgrepJson(raw) {
         };
     }
 }
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 function semgrepSeverityToSecurity(semgrepSeverity) {
     switch (semgrepSeverity.toUpperCase()) {
         case "ERROR":
@@ -88,67 +115,25 @@ export async function runSemgrepCheck(options) {
         "--quiet",
         scanTarget,
     ];
-    const cmd = await runSecurityCommand({
-        command,
-        args: scanArgs,
-        cwd: targetRoot,
-        timeoutMs,
-    });
+    let cmd;
+    try {
+        cmd = await runSecurityCommand({ command, args: scanArgs, cwd: targetRoot, timeoutMs });
+    }
+    catch (error) {
+        cmd = { command, args: scanArgs, cwd: targetRoot, exitCode: null, durationMs: 0,
+            stdout: "", stderr: error instanceof Error ? error.message : String(error), timedOut: false, skipped: false };
+    }
     const finishedAt = new Date().toISOString();
-    // Semgrep exits 0 = no findings, 1 = findings found, other = error.
-    const isError = cmd.exitCode !== 0 && cmd.exitCode !== 1;
-    const isTimedOut = cmd.timedOut;
-    if (isTimedOut || (isError && !cmd.stdout.trim())) {
-        return {
-            id: "semgrep-scan",
-            name: "Semgrep static analysis",
-            category: "static-scan",
-            status: "failed",
-            severity: "major",
-            startedAt,
-            finishedAt,
-            durationMs: cmd.durationMs,
-            findings: [
-                {
-                    id: "semgrep-execution-error",
-                    title: "Semgrep execution failed",
-                    severity: "major",
-                    category: "static-scan",
-                    description: isTimedOut
-                        ? "Semgrep timed out."
-                        : `Semgrep exited with code ${String(cmd.exitCode)}. stderr: ${cmd.stderr.slice(0, 500)}`,
-                    recommendation: "Check semgrep installation and .semgrep.yml config.",
-                    releaseImpact: "Review before release",
-                },
-            ],
-            command: [command, ...scanArgs].join(" "),
-        };
+    // Distinguish positively established absence from a failed attempted scan.
+    // Network, permission, generic npm, or native spawn errors are not absence.
+    const unavailable = !cmd.timedOut && cmd.exitCode !== 0 && !cmd.stdout.trim() && ((cmd.skipped && cmd.exitCode === null && Boolean(cmd.skippedReason?.match(/\b(semgrep|scanner|cli)\b.*(unavailable|not installed|not found|not on PATH)/i))) ||
+        (useNpx && !cmd.skipped && cmd.exitCode === 1 && /could not determine executable to run/i.test(cmd.stderr)));
+    if (unavailable) {
+        return { ...skippedCheck({ id: "semgrep-scan", name: "Semgrep static analysis", category: "static-scan",
+                reason: cmd.skippedReason ?? "Semgrep CLI is unavailable; the npx fallback package provides no executable." }),
+            command: [command, ...scanArgs].join(" "), commandCwd: targetRoot, exitCode: cmd.exitCode };
     }
     const parsed = parseSemgrepJson(cmd.stdout);
-    if (parsed.parseError) {
-        return {
-            id: "semgrep-scan",
-            name: "Semgrep static analysis",
-            category: "static-scan",
-            status: "warning",
-            severity: "minor",
-            startedAt,
-            finishedAt,
-            durationMs: cmd.durationMs,
-            findings: [
-                {
-                    id: "semgrep-parse-error",
-                    title: "Could not parse Semgrep output",
-                    severity: "minor",
-                    category: "static-scan",
-                    description: `JSON parse error: ${parsed.parseError}`,
-                    recommendation: "Verify semgrep version produces valid JSON output.",
-                    releaseImpact: "Review before release",
-                },
-            ],
-            command: [command, ...scanArgs].join(" "),
-        };
-    }
     const securityFindings = parsed.findings.map((f) => ({
         id: `semgrep-${f.ruleId.replace(/[^a-z0-9-]/gi, "-")}`,
         title: f.ruleId,
@@ -160,6 +145,23 @@ export async function runSemgrepCheck(options) {
             ? "Should fix before release"
             : "Review before release",
     }));
+    const executionFailed = cmd.timedOut || cmd.skipped || (cmd.exitCode !== 0 && cmd.exitCode !== 1) ||
+        (cmd.exitCode === 1 && parsed.findings.length === 0);
+    const evidenceError = executionFailed
+        ? `Semgrep execution failed: exitCode=${String(cmd.exitCode)}, timedOut=${cmd.timedOut}, skipped=${cmd.skipped}. ${cmd.stderr.slice(0, 500)}`
+        : parsed.parseError ?? parsed.analysisError;
+    if (evidenceError) {
+        securityFindings.push({
+            id: executionFailed ? "semgrep-execution-error" : parsed.parseError ? "semgrep-parse-error" : "semgrep-analysis-error",
+            title: "Semgrep scan evidence is incomplete or unsuccessful",
+            severity: "major",
+            category: "static-scan",
+            description: evidenceError,
+            evidence: `exitCode=${String(cmd.exitCode)}; ${parsed.parseError ?? parsed.analysisError ?? ""}`,
+            recommendation: "Resolve the scanner execution or analysis error and rerun with valid JSON scan evidence.",
+            releaseImpact: "Review before release",
+        });
+    }
     const hasBlockerOrMajor = securityFindings.some((f) => f.severity === "blocker" || f.severity === "major");
     return {
         id: "semgrep-scan",
@@ -176,5 +178,7 @@ export async function runSemgrepCheck(options) {
         durationMs: cmd.durationMs,
         findings: securityFindings,
         command: [command, ...scanArgs].join(" "),
+        commandCwd: targetRoot,
+        exitCode: cmd.exitCode,
     };
 }

package/dist/src/securityValidation/types.js

@@ -1,7 +1,3 @@
-// Core types for the my-dev-kit-lab security-validation framework.
-// These types describe the vocabulary for checks, findings, results, and verdicts
-// used by dependency checks (Prompt 3), CLI adversarial tests (Prompts 4–5),
-// static scans (Prompt 6), fuzz smoke tests (Prompt 7), and the release report (Prompt 8).
 export const SECURITY_SEVERITIES = [
     "blocker",
     "major",

package/dist/src/securityValidation/validate/runSecurityValidation.js

@@ -80,7 +80,7 @@ export async function runSecurityValidation(options) {
     // missing package.json gracefully.
     if (selectedChecks.has("package")) {
         try {
-            const pkgOutput = await runPackageChecks({ cwd: target.targetRoot, config });
+            const pkgOutput = await runPackageChecks({ cwd: target.targetRoot, config, target });
             collectMany(pkgOutput.checks);
         }
         catch (err) {

package/docs/METRICS.md

@@ -940,7 +940,7 @@ Cumulative versus final: durations and tokens accumulate over all provider attem
 - Provider telemetry can be unavailable, and in deterministic-fixture mode both treatments receive the same reference patch, so those results measure the pipeline only.
 
 
-## Campaign progress evidence (v0.9.1 implemented; unreleased)
+## Campaign progress evidence (v0.9.1 released)
 
 Token evidence levels are `provider-reported`, `cli-reported`, `parsed-from-output`, `unavailable`, and `estimated`. The original telemetry source is retained. Numeric availability is recorded per token field, so partial measurements remain partial and normalization never fills missing fields or invents totals; unattributed OpenTelemetry evidence is unavailable. Duration provenance is `lab-wall-clock` for valid observed elapsed time and `unavailable` for missing or invalid values; campaign comparison time is Lab-measured wall-clock duration, not provider-native time.
 

package/examples/tutorial-browser/prepare.mjs

@@ -1,14 +1,14 @@
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const sourceRoot = path.dirname(fileURLToPath(import.meta.url));
-const targetRoot = process.argv[2];
-if (!targetRoot) {
-  console.error("prepare requires a target root argument");
-  process.exit(2);
-}
-fs.mkdirSync(path.join(targetRoot, "app"), { recursive: true });
-fs.mkdirSync(path.join(targetRoot, "out"), { recursive: true });
-for (const file of ["index.html", "server.mjs"]) fs.copyFileSync(path.join(sourceRoot, file), path.join(targetRoot, "app", file));
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const sourceRoot = path.dirname(fileURLToPath(import.meta.url));
+const targetRoot = process.argv[2];
+if (!targetRoot) {
+  console.error("prepare requires a target root argument");
+  process.exit(2);
+}
+fs.mkdirSync(path.join(targetRoot, "app"), { recursive: true });
+fs.mkdirSync(path.join(targetRoot, "out"), { recursive: true });
+for (const file of ["index.html", "server.mjs"]) fs.copyFileSync(path.join(sourceRoot, file), path.join(targetRoot, "app", file));
 fs.writeFileSync(path.join(targetRoot, "out", "report.json"), JSON.stringify({ prepared: true, counts: { widgets: 3 } }, null, 2), "utf8");

package/examples/tutorial-browser/server.mjs

@@ -1,14 +1,14 @@
-import http from "node:http";
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const root = path.dirname(fileURLToPath(import.meta.url));
-const port = Number(process.env.TUTORIAL_FIXTURE_PORT || 0);
-const server = http.createServer((req, res) => {
-  const url = new URL(req.url ?? "/", "http://127.0.0.1");
-  if (url.pathname === "/api/status") { res.writeHead(200, { "content-type": "application/json" }); res.end(JSON.stringify({ ok: true, widgets: 3 })); return; }
-  const filePath = url.pathname === "/" ? path.join(root, "index.html") : path.join(root, url.pathname);
-  fs.readFile(filePath, (error, contents) => { if (error) { res.writeHead(404); res.end("not found"); return; } res.writeHead(200, { "content-type": filePath.endsWith(".html") ? "text/html" : "application/octet-stream" }); res.end(contents); });
-});
+import http from "node:http";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = path.dirname(fileURLToPath(import.meta.url));
+const port = Number(process.env.TUTORIAL_FIXTURE_PORT || 0);
+const server = http.createServer((req, res) => {
+  const url = new URL(req.url ?? "/", "http://127.0.0.1");
+  if (url.pathname === "/api/status") { res.writeHead(200, { "content-type": "application/json" }); res.end(JSON.stringify({ ok: true, widgets: 3 })); return; }
+  const filePath = url.pathname === "/" ? path.join(root, "index.html") : path.join(root, url.pathname);
+  fs.readFile(filePath, (error, contents) => { if (error) { res.writeHead(404); res.end("not found"); return; } res.writeHead(200, { "content-type": filePath.endsWith(".html") ? "text/html" : "application/octet-stream" }); res.end(contents); });
+});
 server.listen(port, "127.0.0.1", () => console.log("tutorial fixture listening on " + server.address().port));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dailephd/my-dev-kit-lab",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "type": "module",
   "description": "Evidence, benchmark, and evaluation companion for my-dev-kit.",
   "bin": {