@dailephd/my-dev-kit-lab 0.9.3 → 0.9.4

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable changes to my-dev-kit-lab are documented here.
 
+## [0.9.4] - 2026-10-23
+
+### Kit schema-3 and npm 12 compatibility
+
+- Accepted my-dev-kit symbol-index schema `3` in addition to schema `2` for the `incremental-change-staleness` affected-neighborhood evidence. Schema-3 symbols use their persisted qualified `nodeId`; identities are not reconstructed from paths and simple names. Same-name symbols in one file stay distinct, ambiguous names are reported as ambiguous, and missing or mismatched identities stay unresolved. Other schema values are rejected, and schema-2 results are unchanged.
+- Package content checks and `npm run verify:packed-package` accept the npm 11 and npm 12 `npm pack --json` formats through one validator that requires exactly one package, a nonempty file list, and safe relative paths.
+- Corrected the packed-package verifier so a symlink or junction invocation runs, early failures print `PACKED_PACKAGE_VERDICT: FAIL`, and verified failures exit nonzero.
+- Corrected the npm 12 output-prefix assumption in the target `test:security` test without weakening its assertions.
+- Patched vulnerable development-only dependencies by pinning Vite to 7.3.7 and Vitest to 4.1.12 (with `@vitest/mocker` 4.1.12), which clears the dependency-audit advisories GHSA-587h-7wmj-h5pm, GHSA-qxg6-89mg-rqv8, and GHSA-xp26-3454-mjgp. The published runtime dependencies and package contents are unchanged.
+- Security-verdict policy, report and execution schemas, commands, and package contents are unchanged.
+
 ## [0.9.3] - 2026-10-16
 
 - Improved security-validator runtime evidence and secret-scan accuracy while retaining bounded proof and candidate-versus-confirmed finding distinctions.

package/README.md

@@ -6,21 +6,23 @@ my-dev-kit provides local repository indexing and graph-guided retrieval. my-dev
 
 Whole-ecosystem workflows are centralized in [my-dev-kit/docs/ECOSYSTEM_DEVELOPMENT_WORKFLOWS.md](https://github.com/dailephd/my-dev-kit/blob/main/docs/ECOSYSTEM_DEVELOPMENT_WORKFLOWS.md). Its [command-surface compatibility map](https://github.com/dailephd/my-dev-kit/blob/main/docs/ECOSYSTEM_DEVELOPMENT_WORKFLOWS.md#915-command-surface-compatibility-map) documents which Lab outputs can safely seed my-dev-kit investigation, Observer reference work, or Orchestrator evidence, and which look-alike artifacts are not direct inputs.
 
-Version v0.9.3 adds hardened prompt contracts and output validation, extensible reports with metric evidence, broader gallery inputs, and prompt-template comparison. Security validation and verdict strictness remain unchanged. The v0.4.5 context-integrity evaluation remains intentionally frozen against the published `@dailephd/my-dev-kit@1.10.4` and `@dailephd/my-dev-kit-orchestrator@1.2.3` contracts; those versions are historical validation baselines, not a statement that they are the ecosystem's current releases. See [docs/CURRENT_STATE.md](docs/CURRENT_STATE.md) for current state.
+The v0.9.3 release added hardened prompt contracts and output validation, extensible reports with metric evidence, broader gallery inputs, and prompt-template comparison. The v0.4.5 context-integrity evaluation remains intentionally frozen against the published `@dailephd/my-dev-kit@1.10.4` and `@dailephd/my-dev-kit-orchestrator@1.2.3` contracts; those versions are historical validation baselines, not a statement that they are the ecosystem's current releases. See [docs/CURRENT_STATE.md](docs/CURRENT_STATE.md) for current state.
 
 v0.9.0 adds the `agent-success-rate` plugin, the eighth registered experiment plugin, which evaluates implementation patches under the `raw-full-file` and `context-pack` treatments.
 
-v0.9.2 is the previous package release.
+v0.9.3 is the previous package release.
 
 The v0.9.2 release corrected external npm package entrypoint validation, preserved strict Lab self-package validation, eliminated nine inherited false positives, corrected Semgrep failed/incomplete-scan evidence, and included campaign filesystem identity, path-safety, and cross-platform corrections. Security verdict strictness is unchanged. The v0.9.2 release-document state is final; actual npm publication is established separately through registry evidence.
 
 The v0.9.3 release adds configurable Codex/Claude prompt contracts, strict structured-diff output handling, generic report sections, HTML metric evidence and caveats, source-based gallery items including tutorial manifests, and prompt-template comparison. See [docs/CURRENT_STATE.md](docs/CURRENT_STATE.md) for release and validation details.
 
+The v0.9.4 release supports my-dev-kit symbol-index schema 3 alongside schema 2, preserves qualified symbol identities, and handles ambiguous names conservatively. Package inventory validation supports npm 11 and npm 12 formats, and the packed-package verifier reports early failures reliably. Development-only Vite and Vitest dependencies are patched; security-verdict policy is unchanged. See [docs/CURRENT_STATE.md](docs/CURRENT_STATE.md), [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md), [docs/COMMANDS.md](docs/COMMANDS.md), and [docs/WORKFLOWS.md](docs/WORKFLOWS.md).
+
 v0.4.6 adds a supported `my-dev-kit-lab` installed CLI router (`--help`, `--version`, `security validate`, `audit`, the `experiment` family, `report render`, `plots generate`, `gallery build`, `demo final`, and the historical direct final-demo invocation form), a writable lab workspace model kept separate from the installed package and the inspected target, and a permanent packed-tarball installation/execution acceptance gate (`npm run verify:packed-package`). See [docs/ROADMAP.md](docs/ROADMAP.md) and [docs/CURRENT_STATE.md](docs/CURRENT_STATE.md) for status detail and [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) for the runtime path model. The "Installed CLI" section below documents the shipped command surface; the source-checkout `npm run` workflow in Quickstart remains available for contributors.
 
 ## Current capabilities
 
-Package metadata is `0.9.3`. The v0.9.3 release adds configurable Codex/Claude prompt contracts, strict structured-diff output handling, generic report sections, HTML metric evidence and caveats, source-based gallery items including tutorial manifests, and prompt-template comparison. Registered metrics have evidence-based glossary definitions and links, and prompt comparison validates persisted identity and checkpoint evidence. Real-provider improvement remains NOT_VERIFIED because no paid smoke was authorized; its measurement is a separate opt-in empirical objective, not a v0.9.3 release gate. Bounded tool-use remains prompt guidance, not provider enforcement. See [Current State](docs/CURRENT_STATE.md) and [the roadmap](docs/ROADMAP.md).
+Package metadata is `0.9.4`. The v0.9.4 release supports my-dev-kit symbol-index schema 3 alongside schema 2, preserves qualified identities, handles ambiguity conservatively, supports npm 11 and npm 12 package inventories, corrects packed-package verifier behavior, and patches development-only security dependencies. Security-verdict policy is unchanged. The v0.9.3 release added configurable Codex/Claude prompt contracts, strict structured-diff output handling, generic report sections, HTML metric evidence and caveats, source-based gallery items including tutorial manifests, and prompt-template comparison. Registered metrics have evidence-based glossary definitions and links, and prompt comparison validates persisted identity and checkpoint evidence. Real-provider improvement remains NOT_VERIFIED because no paid smoke was authorized; its measurement is a separate opt-in empirical objective, not a v0.9.3 release gate. Bounded tool-use remains prompt guidance, not provider enforcement. See [Current State](docs/CURRENT_STATE.md) and [the roadmap](docs/ROADMAP.md).
 
 - **Run context-strategy experiments:** compare `raw-full-file` with `my-dev-kit-guided` using deterministic fixtures or locally configured Codex and Claude CLIs.
 - **Measure warm-index reuse (v0.5.0–v0.5.1, released):** the `warm-index-reuse` experiment plugin builds one my-dev-kit index per benchmark project, reuses it across that project's tasks, and compares every task with a matched `raw-full-file` baseline. Reports separate one-time index-build cost from per-task retrieval cost, show amortized index cost and cumulative measurements, and include deterministic fake-agent correctness and token evidence; `plots generate` renders four warm-index SVG charts. The v0.5.1 release adds a dedicated 12-task benchmark corpus (`benchmarks/contracts/warm-index-benchmark-cases.json`: six medium and six large/mixed tasks tagged `localized`, `cross-module`, or `broad-change`) for comparing warm-index behavior as task count grows. Estimated context tokens (a character-based context-size estimate) and fake-agent total tokens (simulated harness telemetry) are reported separately, and neither is provider billing telemetry.

package/dist/src/evaluation/affectedNeighborhood.js

@@ -4,7 +4,13 @@ import { compareCodeUnits, interpretIndexManifest, readJson } from "./indexSnaps
 export const AFFECTED_NEIGHBORHOOD_GRAPH_EVIDENCE_SCHEMA_VERSION = "my-dev-kit-lab-affected-neighborhood-graph-evidence-v1";
 export const AFFECTED_NEIGHBORHOOD_SEED_MAPPING_SCHEMA_VERSION = "my-dev-kit-lab-affected-neighborhood-seed-mapping-v1";
 const MANIFEST_FILE = "manifest.json";
-const SUPPORTED_SYMBOL_INDEX_SCHEMA_VERSION = "2";
+/**
+ * Schema 2 (my-dev-kit 1.13.x) identifies a symbol by file path + name. Schema 3 (my-dev-kit 1.14.x)
+ * additionally persists each symbol's actual graph `nodeId`, which may be a distinct `symbolq:` identity
+ * for same-named members. Both are understood; anything else is rejected.
+ */
+const SUPPORTED_SYMBOL_INDEX_SCHEMA_VERSIONS = ["2", "3"];
+const SCHEMA_WITH_PERSISTED_SYMBOL_NODE_IDS = "3";
 const SUPPORTED_CODE_GRAPH_ARTIFACT_KIND = "code-graph";
 const SUPPORTED_CODE_GRAPH_VERSION_PATTERN = /^1\./;
 // Same bounds as the v0.6.0 freshness/snapshot evidence lists.
@@ -57,18 +63,23 @@ function sortWarnings(warnings) {
     return [...warnings].sort((left, right) => compareCodeUnits(left.code, right.code) || compareCodeUnits(left.subject ?? "", right.subject ?? "") || compareCodeUnits(left.message, right.message));
 }
 /**
- * Policy: reads indexed-file membership and baseline symbols from a symbol-index artifact. Only
- * schema version 2 is understood. A file entry whose symbol list is malformed keeps its
- * membership but yields no symbol record; a malformed symbol entry is dropped with a warning.
- * Pure.
+ * Policy: reads indexed-file membership and baseline symbol identities from a symbol-index artifact.
+ * Schema versions 2 and 3 are understood; anything else is unsupported. Under schema 2 a symbol's
+ * identity is its upstream file+name node ID. Under schema 3 it is the `nodeId` the index persisted,
+ * which is never reconstructed from the simple name: same-named members keep distinct identities,
+ * and a record without a usable `nodeId` stays visible as an unmappable identity with a warning
+ * instead of receiving a guessed one. A file entry whose symbol list is malformed keeps its
+ * membership but yields no symbol record; a malformed symbol entry is dropped with a warning. Pure.
  */
 export function interpretSymbolIndexForNeighborhood(symbolIndex) {
     if (!isRecord(symbolIndex)) {
         return { ok: false, message: "Symbol index is not a JSON object." };
     }
-    if (symbolIndex.schemaVersion !== SUPPORTED_SYMBOL_INDEX_SCHEMA_VERSION) {
-        return { ok: false, message: `Symbol index schemaVersion is not the supported ${SUPPORTED_SYMBOL_INDEX_SCHEMA_VERSION}.` };
+    const schemaVersion = symbolIndex.schemaVersion;
+    if (typeof schemaVersion !== "string" || !SUPPORTED_SYMBOL_INDEX_SCHEMA_VERSIONS.includes(schemaVersion)) {
+        return { ok: false, message: `Symbol index schemaVersion is not a supported version (${SUPPORTED_SYMBOL_INDEX_SCHEMA_VERSIONS.join(", ")}).` };
     }
+    const persistsNodeIds = schemaVersion === SCHEMA_WITH_PERSISTED_SYMBOL_NODE_IDS;
     if (!Array.isArray(symbolIndex.files)) {
         return { ok: false, message: "Symbol index does not list indexed files." };
     }
@@ -92,29 +103,57 @@ export function interpretSymbolIndexForNeighborhood(symbolIndex) {
             });
             continue;
         }
-        const seen = new Set();
+        const identities = new Map();
         const duplicates = new Set();
+        const missingNodeIdNames = new Set();
         for (const symbol of entry.symbols) {
             if (!isRecord(symbol) || !nonEmptyString(symbol.name)) {
                 warnings.push({ code: "invalid-symbol-entry", subject: boundedText(filePath), message: "Symbol index entry lacks a symbol name and was ignored." });
                 continue;
             }
-            if (seen.has(symbol.name)) {
-                duplicates.add(symbol.name);
+            const name = symbol.name;
+            let identity;
+            let identityKey;
+            if (!persistsNodeIds) {
+                identity = { name, nodeId: symbolNodeId(filePath, name), persisted: false };
+                identityKey = identity.nodeId;
+            }
+            else if (nonEmptyString(symbol.nodeId)) {
+                identity = { name, nodeId: symbol.nodeId, persisted: true };
+                identityKey = `id:${symbol.nodeId}`;
             }
-            seen.add(symbol.name);
+            else {
+                // No persisted identity: one unmappable identity per name, never a reconstructed one.
+                identity = { name, nodeId: null, persisted: true };
+                identityKey = `missing:${name}`;
+                missingNodeIdNames.add(name);
+            }
+            if (identities.has(identityKey)) {
+                duplicates.add(name);
+                continue;
+            }
+            identities.set(identityKey, identity);
         }
-        records.set(filePath, {
-            symbolNames: [...seen].sort(compareCodeUnits),
-            duplicateSymbolNames: [...duplicates].sort(compareCodeUnits),
-        });
+        for (const name of [...missingNodeIdNames].sort(compareCodeUnits)) {
+            warnings.push({
+                code: "symbol-node-id-missing",
+                subject: boundedText(`${filePath}#${name}`),
+                message: "Schema-3 symbol record has no usable persisted nodeId; its identity is not guessed and it cannot be mapped to a graph node.",
+            });
+        }
+        const sortedRecords = [...identities.values()].sort((left, right) => compareCodeUnits(left.nodeId ?? "", right.nodeId ?? "") || compareCodeUnits(left.name, right.name));
+        const names = [...new Set(sortedRecords.map((record) => record.name))].sort(compareCodeUnits);
+        const sameName = names.filter((name) => sortedRecords.filter((record) => record.name === name).length > 1);
+        // Schema-2 evidence keeps its original shape: each name is its only identity, so no per-record data is added.
+        const fileRecord = { symbolNames: names, duplicateSymbolNames: [...duplicates].sort(compareCodeUnits) };
+        records.set(filePath, persistsNodeIds ? { ...fileRecord, records: sortedRecords, sameNameSymbolNames: sameName } : fileRecord);
     }
     const indexedFilePaths = [...paths].sort(compareCodeUnits);
     const symbolFiles = new Map();
     for (const key of [...records.keys()].sort(compareCodeUnits)) {
         symbolFiles.set(key, records.get(key));
     }
-    return { ok: true, value: { indexedFilePaths, symbolFiles, warnings } };
+    return { ok: true, value: { schemaVersion, indexedFilePaths, symbolFiles, warnings } };
 }
 /**
  * Policy: validates the structure of a code-graph artifact and preserves its nodes and edges by
@@ -234,7 +273,7 @@ export async function loadAffectedNeighborhoodGraphEvidence(options) {
         }
         const symbolIndexSummary = {
             path: normalizePath(path.relative(path.resolve(indexDir), symbolIndexFile)),
-            schemaVersion: SUPPORTED_SYMBOL_INDEX_SCHEMA_VERSION,
+            schemaVersion: symbols.value.schemaVersion,
         };
         const warnings = [...symbols.value.warnings];
         let codeGraphSummary = null;
@@ -310,10 +349,35 @@ function lookupNode(evidence, expectedNodeId, kind) {
 export function lookupFileNode(evidence, filePath) {
     return lookupNode(evidence, fileNodeId(filePath), "file");
 }
-/** Same-file symbol lookup. Never searches for a same-named symbol in another file. */
+/**
+ * Same-file symbol lookup by the upstream file+name identity. Never searches for a same-named symbol
+ * in another file. This is the schema-2 identity only; it does not find a qualified (`symbolq:`) member.
+ */
 export function lookupSymbolNode(evidence, filePath, symbolName) {
     return lookupNode(evidence, symbolNodeId(filePath, symbolName), "symbol");
 }
+/**
+ * Exact lookup of one baseline symbol identity. The node must exist under the identity the index
+ * actually recorded, be a `symbol` node, and (when the graph names a path) belong to the same
+ * file; otherwise it is unresolved. A record without a persisted identity is never mapped, and no
+ * identity is derived from its name.
+ */
+export function lookupSymbolRecordNode(evidence, filePath, record) {
+    if (record.nodeId === null)
+        return { ok: false, expectedNodeId: "", reason: "symbol-node-id-missing" };
+    const lookup = lookupNode(evidence, record.nodeId, "symbol");
+    if (!lookup.ok)
+        return lookup;
+    const node = evidence.nodes.get(lookup.nodeId);
+    if (node && node.path !== null && normalizePath(node.path) !== filePath) {
+        return { ok: false, expectedNodeId: record.nodeId, reason: "graph-node-path-mismatch" };
+    }
+    return lookup;
+}
+/** The baseline identities of one indexed file; evidence without per-record data keeps the schema-2 file+name identity. */
+function symbolRecordsOf(filePath, file) {
+    return file.records ?? file.symbolNames.map((name) => ({ name, nodeId: symbolNodeId(filePath, name), persisted: false }));
+}
 /**
  * Maps confirmed changed indexed files, and the baseline symbols belonging to them, onto baseline
  * graph nodes. Pure and deterministic: consumes only the v0.6.0 snapshot and freshness assessment
@@ -404,18 +468,21 @@ export function mapAffectedNeighborhoodSeeds(input) {
             continue;
         }
         if (record.duplicateSymbolNames.length > 0) {
-            warn("duplicate-symbol-records", `Baseline symbol index lists ${record.duplicateSymbolNames.length} symbol name(s) more than once; each counts as one identity.`, filePath);
+            warn("duplicate-symbol-records", `Baseline symbol index repeats ${record.duplicateSymbolNames.length} identical symbol record(s); each counts as one identity.`, filePath);
         }
-        for (const name of record.symbolNames) {
+        // Each distinct baseline identity is a seed in its own right: same-named members that the index
+        // persisted with different node IDs are never merged, and none is reconstructed from the name.
+        for (const identity of symbolRecordsOf(filePath, record)) {
+            const name = identity.name;
             symbolIdentityCount += 1;
-            const symbolExpectedId = symbolNodeId(filePath, name);
+            const symbolExpectedId = identity.nodeId ?? "";
             let symbolResolvedId = null;
             let symbolReason = null;
             if (!codeGraphLoaded) {
                 symbolReason = "graph-unavailable";
             }
             else {
-                const lookup = lookupSymbolNode(graph, filePath, name);
+                const lookup = lookupSymbolRecordNode(graph, filePath, identity);
                 if (lookup.ok)
                     symbolResolvedId = lookup.nodeId;
                 else
@@ -426,7 +493,12 @@ export function mapAffectedNeighborhoodSeeds(input) {
                 seeds.add(symbolResolvedId);
             }
             else {
-                unresolved.push({ subject: "changed-symbol", path: boundedText(filePath), name: boundedText(name), reason: symbolReason });
+                unresolved.push({
+                    subject: "changed-symbol",
+                    path: boundedText(filePath),
+                    name: boundedText(name),
+                    reason: symbolReason,
+                });
             }
             changedSymbols.push({
                 path: filePath,
@@ -490,11 +562,41 @@ function uniqueSorted(values) {
 function normalizeExpectedPath(value) {
     return normalizePath(value).replace(/^(\.\/)+/, "");
 }
+/**
+ * Candidate graph nodes for one expected symbol in one expected file. A request matches a baseline
+ * identity by its simple name or by that identity's exact persisted node ID; every matching identity
+ * is a distinct candidate (same-named members are never collapsed). A file the symbol index has no
+ * record for keeps the schema-2 file+name lookup. Nothing is derived from the name beyond that.
+ */
+function resolveExpectedSymbolInFile(graph, filePath, request) {
+    const file = graph.symbolFiles.get(filePath);
+    if (!file) {
+        const lookup = lookupSymbolNode(graph, filePath, request);
+        return { nodeIds: lookup.ok ? [lookup.nodeId] : [], identityMissing: false, pathMismatch: !lookup.ok && lookup.reason === "graph-node-path-mismatch" };
+    }
+    const nodeIds = [];
+    let identityMissing = false;
+    let pathMismatch = false;
+    for (const identity of symbolRecordsOf(filePath, file)) {
+        if (identity.name !== request && identity.nodeId !== request)
+            continue;
+        const lookup = lookupSymbolRecordNode(graph, filePath, identity);
+        if (lookup.ok)
+            nodeIds.push(lookup.nodeId);
+        else if (lookup.reason === "symbol-node-id-missing")
+            identityMissing = true;
+        else if (lookup.reason === "graph-node-path-mismatch")
+            pathMismatch = true;
+    }
+    return { nodeIds, identityMissing, pathMismatch };
+}
 /**
  * Policy: maps a task's expected files and symbols to baseline graph nodes. Files resolve only to
  * their exact `file:` node. A symbol resolves only within the task's own expected files and only
- * when exactly one same-name node exists there; zero matches is unresolved and several is
- * ambiguous (no winner is picked, no node is added). Never searches the rest of the graph. Pure.
+ * when exactly one matching identity exists there; zero matches is unresolved and several (in one
+ * file or across files, including same-named members with distinct persisted node IDs) is
+ * ambiguous (no winner is picked, no node is added). A request that is itself a persisted node ID
+ * resolves to exactly that identity. Never searches the rest of the graph. Pure.
  */
 export function mapAffectedNeighborhoodTask(input) {
     const { graph } = input;
@@ -561,15 +663,21 @@ export function mapAffectedNeighborhoodTask(input) {
     const resolvedSymbols = [];
     for (const name of expectedSymbols) {
         // Scope is the task's expected files, whether or not their own file node resolved.
-        const candidates = uniqueSorted(expectedFiles.flatMap((filePath) => {
-            const lookup = lookupSymbolNode(graph, filePath, name);
-            return lookup.ok ? [lookup.nodeId] : [];
-        }));
-        if (candidates.length === 1) {
+        const found = expectedFiles.map((filePath) => resolveExpectedSymbolInFile(graph, filePath, name));
+        const candidates = uniqueSorted(found.flatMap((entry) => entry.nodeIds));
+        // A same-name identity that persisted no node ID cannot be excluded, so a lone mappable candidate
+        // is not trusted as "the" owner when such a sibling exists.
+        const identityMissing = found.some((entry) => entry.identityMissing);
+        if (candidates.length === 1 && !identityMissing) {
             resolvedSymbols.push({ name, nodeId: candidates[0] });
         }
-        else if (candidates.length === 0) {
-            unresolved.push({ subject: "expected-symbol", name: boundedText(name), reason: "graph-node-missing" });
+        else if (candidates.length <= 1) {
+            const reason = identityMissing
+                ? "symbol-node-id-missing"
+                : found.some((entry) => entry.pathMismatch)
+                    ? "graph-node-path-mismatch"
+                    : "graph-node-missing";
+            unresolved.push({ subject: "expected-symbol", name: boundedText(name), reason });
         }
         else {
             ambiguous.push({ name: boundedText(name), candidateNodeIds: candidates });

package/dist/src/securityValidation/packageChecks/parseNpmPackDryRun.js

@@ -14,27 +14,13 @@ export function parseNpmPackDryRun(stdout) {
         return { files: [], parseError: "npm pack --dry-run produced no output" };
     }
     if (/^[\[{]/.test(stdout.trim())) {
-        try {
-            const inventory = JSON.parse(stdout);
-            if (!Array.isArray(inventory) || inventory.length !== 1 ||
-                !inventory[0] || !Array.isArray(inventory[0].files) || !inventory[0].files.length) {
-                return { files: [], parseError: "npm pack JSON must contain exactly one nonempty package inventory" };
-            }
-            const files = [];
-            for (const file of inventory[0].files) {
-                if (!file || typeof file.path !== "string" || !safeInventoryPath(file.path)) {
-                    return { files: [], parseError: "npm pack JSON contains a malformed or unsafe file path" };
-                }
-                // JSON paths are package-relative, unlike text tarball paths. Add the
-                // archive root exactly once so a real nested package/ directory cannot
-                // masquerade as a root entrypoint in the existing detectors.
-                files.push(`package/${file.path.replace(/\\/g, "/").replace(/^(\.\/)+/, "")}`);
-            }
-            return { files };
-        }
-        catch {
-            return { files: [], parseError: "npm pack JSON is unparseable" };
-        }
+        const parsed = parseNpmPackJsonEntry(stdout);
+        if (!parsed.entry)
+            return { files: [], parseError: parsed.parseError };
+        // JSON paths are package-relative, unlike text tarball paths. Add the
+        // archive root exactly once so a real nested package/ directory cannot
+        // masquerade as a root entrypoint in the existing detectors.
+        return { files: parsed.entry.files.map((file) => `package/${file}`) };
     }
     const files = [];
     let inContents = false;
@@ -78,6 +64,45 @@ export function parseNpmPackDryRun(stdout) {
     }
     return { files, totalSize };
 }
+// Validated single-package entry from `npm pack --json` (or --dry-run --json) output, accepting both
+// the npm 11 array shape and the npm 12 identity-keyed object shape. Exactly one package with a
+// nonempty, safe file list is required; anything else is an error, never an empty success.
+export function parseNpmPackJsonEntry(stdout) {
+    try {
+        const packages = packageInventories(JSON.parse(stdout));
+        const inventory = packages?.length === 1 ? packages[0] : null;
+        if (!isPlainObject(inventory) || !Array.isArray(inventory.files) || !inventory.files.length) {
+            return { parseError: "npm pack JSON must contain exactly one nonempty package inventory" };
+        }
+        const files = [];
+        for (const file of inventory.files) {
+            if (!file || typeof file.path !== "string" || !safeInventoryPath(file.path)) {
+                return { parseError: "npm pack JSON contains a malformed or unsafe file path" };
+            }
+            files.push(file.path.replace(/\\/g, "/").replace(/^(\.\/)+/, ""));
+        }
+        const text = (value) => (typeof value === "string" ? value : undefined);
+        return { entry: { name: text(inventory.name), version: text(inventory.version), filename: text(inventory.filename), files } };
+    }
+    catch {
+        return { parseError: "npm pack JSON is unparseable" };
+    }
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+// The package inventories in `npm pack --json` output. npm 11 and earlier print an array of package
+// objects; npm 12 prints one object keyed by package identity whose values are the package objects.
+// Anything else (including a bare package object, or a keyed object holding non-objects) is not a
+// recognized shape and yields null, so it can never be read as an empty or successful package.
+function packageInventories(output) {
+    if (Array.isArray(output))
+        return output;
+    if (!isPlainObject(output))
+        return null;
+    const packages = Object.values(output);
+    return packages.every(isPlainObject) ? packages : null;
+}
 function safeInventoryPath(file) {
     const normalized = file.replace(/\\/g, "/").replace(/^(\.\/)+/, "");
     return Boolean(normalized) && !normalized.startsWith("/") &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dailephd/my-dev-kit-lab",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "type": "module",
   "description": "Evidence, benchmark, and evaluation companion for my-dev-kit.",
   "bin": {
@@ -93,10 +93,10 @@
     "@types/node": "^24.0.0",
     "tsx": "^4.20.3",
     "typescript": "^5.8.3",
-    "vitest": "^4.1.11"
+    "vitest": "4.1.12"
   },
   "overrides": {
-    "vite": "7.3.6"
+    "vite": "7.3.7"
   },
   "engines": {
     "node": ">=24"