@hunter-harness/workflow-harness 0.2.22 → 0.2.24

package/harness/bundles/java/cursor/scripts/harness_deploy.py

@@ -16,6 +16,7 @@ import re
 import shutil
 import subprocess
 import sys
+import time
 import uuid
 from pathlib import Path
 from typing import Any, Iterable
@@ -38,6 +39,7 @@ HEADING_RE = re.compile(r"^(#{2,6})\s+(.+?)\s*$")
 FRAGMENT_HINT_RE = re.compile(r"^>\s*片段：\[\[shared/[^\]]+\]\]\s*.*$")
 
 BUILD_MARKER = ".harness-build.json"
+_REPLACE_RETRY_DELAYS_SECONDS = (0.05, 0.1, 0.2, 0.4, 0.8)
 # Install-side managed manifests record which files a prior install owned, so a
 # later conservative install can delete removed managed files while preserving
 # user-owned files (design §3.8 要点4). Skills manifest lives in the skills
@@ -76,6 +78,23 @@ def now_iso() -> str:
     return dt.datetime.now().astimezone().isoformat(timespec="seconds")
 
 
+def replace_with_retry(source: Path, target: Path) -> None:
+    """Bounded retry for transient directory locks during atomic swaps.
+
+    Windows indexers and antivirus scanners may briefly hold a newly generated
+    bundle directory. Retrying only ``PermissionError`` keeps real path and
+    contract failures fail-fast while avoiding an expensive full bundle rerun.
+    """
+    for attempt in range(len(_REPLACE_RETRY_DELAYS_SECONDS) + 1):
+        try:
+            os.replace(source, target)
+            return
+        except PermissionError:
+            if attempt >= len(_REPLACE_RETRY_DELAYS_SECONDS):
+                raise
+            time.sleep(_REPLACE_RETRY_DELAYS_SECONDS[attempt])
+
+
 def emit_json(payload: dict[str, Any], *, ok: bool = True) -> int:
     print(json.dumps(payload, ensure_ascii=False, indent=2))
     return 0 if ok else 1
@@ -596,15 +615,15 @@ def cmd_build(
     if out_dir.exists():
         if (out_dir / BUILD_MARKER).is_file():
             old_backup = out_dir.parent / f".{out_dir.name}.old-{uuid.uuid4().hex[:8]}"
-            os.replace(out_dir, old_backup)
+            replace_with_retry(out_dir, old_backup)
         else:
             shutil.rmtree(staging, ignore_errors=True)
             raise ValueError(f"refusing to overwrite unmarked out_dir: {out_dir}")
     try:
-        os.replace(staging, out_dir)
+        replace_with_retry(staging, out_dir)
     except OSError:
         if old_backup is not None and old_backup.exists():
-            os.replace(old_backup, out_dir)
+            replace_with_retry(old_backup, out_dir)
         raise
     if old_backup is not None:
         shutil.rmtree(old_backup, ignore_errors=True)

package/harness/bundles/java/cursor/scripts/harness_integration.py

@@ -43,6 +43,7 @@ if hasattr(sys.stderr, "reconfigure"):
     sys.stderr.reconfigure(encoding="utf-8")
 
 STEP_ORDER = ["preflight", "prepare", "merge", "verify", "push", "cleanup"]
+DEFAULT_VERIFY_TIMEOUT_SECONDS = 1800
 HEAVY_WORKTREE_ROOTS = (
     "node_modules", ".venv", "venv", "build", "dist", "target", ".cache", "__pycache__"
 )
@@ -56,6 +57,48 @@ def now_iso() -> str:
     return dt.datetime.now().astimezone().isoformat(timespec="milliseconds")
 
 
+def _split_verify_command(raw: str, *, platform: str = sys.platform) -> list[str]:
+    # Harness profile/CLI commands use one portable quoting contract. Keep
+    # POSIX tokenization on Windows too; executable normalization happens later.
+    return shlex.split(raw, posix=True)
+
+
+def _dedupe_verify_commands(
+    commands: Sequence[Sequence[str]],
+) -> list[list[str]]:
+    """Preserve order while preventing explicit/profile duplicate execution."""
+    result: list[list[str]] = []
+    seen: set[tuple[str, ...]] = set()
+    for command in commands:
+        normalized = tuple(str(item) for item in command)
+        if normalized in seen:
+            continue
+        seen.add(normalized)
+        result.append(list(normalized))
+    return result
+
+
+def _normalize_verify_command(
+    command: Sequence[str],
+    *,
+    platform: str = sys.platform,
+    resolver: Callable[[str], str | None] = shutil.which,
+) -> list[str]:
+    """Resolve Windows package-manager wrappers without enabling shell mode."""
+    result = [str(item) for item in command]
+    if not result or not platform.lower().startswith("win"):
+        return result
+    executable = Path(result[0]).name.lower()
+    if Path(executable).suffix:
+        return result
+    if executable not in {"npm", "npx", "pnpm", "yarn", "corepack"}:
+        return result
+    resolved = resolver(executable + ".cmd") or resolver(executable)
+    if resolved:
+        result[0] = resolved
+    return result
+
+
 class IntegrationError(Exception):
     code = "INTEGRATION_ERROR"
 
@@ -224,6 +267,11 @@ def load_journal(project_root: Path, transaction_id: str) -> dict[str, Any]:
 def _pid_alive(pid: int) -> bool:
     if pid <= 0:
         return False
+    # On Windows, os.kill(pid, 0) can transiently report EINVAL for the
+    # current low-priority/background process. The current process is
+    # unambiguously alive, so avoid reclaiming its lock on that platform race.
+    if pid == os.getpid():
+        return True
     try:
         os.kill(pid, 0)
     except ProcessLookupError:
@@ -878,7 +926,7 @@ class IntegrationTransaction:
         commands: list[list[str]] = []
         for index, item in enumerate(required):
             if isinstance(item, str) and item.strip():
-                commands.append(shlex.split(item.strip()))
+                commands.append(_split_verify_command(item.strip()))
                 continue
             if not isinstance(item, dict):
                 raise ValueError(f"requiredOnMerge[{index}] must be string or object")
@@ -886,18 +934,26 @@ class IntegrationTransaction:
             if isinstance(raw, list) and raw and all(isinstance(x, str) and x for x in raw):
                 commands.append([str(x) for x in raw])
             elif isinstance(raw, str) and raw.strip():
-                commands.append(shlex.split(raw.strip()))
+                commands.append(_split_verify_command(raw.strip()))
             else:
                 raise ValueError(f"requiredOnMerge[{index}].command missing")
         return commands
 
-    def verify(self, commands: Sequence[Sequence[str]] | None = None) -> dict[str, Any]:
+    def verify(
+        self,
+        commands: Sequence[Sequence[str]] | None = None,
+        *,
+        timeout_seconds: float = DEFAULT_VERIFY_TIMEOUT_SECONDS,
+    ) -> dict[str, Any]:
         commands = list(commands or [])
         # Wave-2 H-9: append profile mergeVerification.requiredOnMerge commands.
         try:
             commands.extend(self._required_on_merge_commands())
         except Exception as exc:  # noqa: BLE001 — surface as verify plan error
             raise VerifyPlanMissingError(f"mergeVerification load failed: {exc}") from exc
+        commands = _dedupe_verify_commands(commands)
+        if timeout_seconds <= 0:
+            raise VerifyPlanMissingError("verification timeout must be greater than zero")
 
         def action(journal: dict[str, Any]) -> None:
             if not commands or any(
@@ -910,21 +966,67 @@ class IntegrationTransaction:
             intg_root = Path(journal["integrationRoot"]).resolve()
             results: list[dict[str, Any]] = []
             for command in commands:
+                executable_command = _normalize_verify_command(command)
                 started = dt.datetime.now().astimezone()
-                proc = subprocess.run(
-                    list(command),
-                    cwd=str(intg_root),
-                    capture_output=True,
-                    text=True,
-                    encoding="utf-8",
-                    errors="replace",
-                    check=False,
-                )
+                try:
+                    proc = subprocess.run(
+                        executable_command,
+                        cwd=str(intg_root),
+                        capture_output=True,
+                        text=True,
+                        encoding="utf-8",
+                        errors="replace",
+                        check=False,
+                        timeout=timeout_seconds,
+                    )
+                except subprocess.TimeoutExpired:
+                    finished = dt.datetime.now().astimezone()
+                    results.append(
+                        {
+                            "command": list(command),
+                            "resolvedCommand": executable_command,
+                            "exitCode": None,
+                            "timedOut": True,
+                            "timeoutSeconds": timeout_seconds,
+                            "startedAt": started.isoformat(timespec="milliseconds"),
+                            "finishedAt": finished.isoformat(timespec="milliseconds"),
+                            "durationMs": int(
+                                (finished - started).total_seconds() * 1000
+                            ),
+                        }
+                    )
+                    journal["verifyResults"] = results
+                    self._save(journal)
+                    raise VerificationFailedError(
+                        f"command timed out after {timeout_seconds}s: {' '.join(command)}"
+                    )
+                except FileNotFoundError as exc:
+                    finished = dt.datetime.now().astimezone()
+                    results.append(
+                        {
+                            "command": list(command),
+                            "resolvedCommand": executable_command,
+                            "exitCode": None,
+                            "error": str(exc),
+                            "startedAt": started.isoformat(timespec="milliseconds"),
+                            "finishedAt": finished.isoformat(timespec="milliseconds"),
+                            "durationMs": int(
+                                (finished - started).total_seconds() * 1000
+                            ),
+                        }
+                    )
+                    journal["verifyResults"] = results
+                    self._save(journal)
+                    raise VerifyPlanMissingError(
+                        f"verification executable not found: {executable_command[0]}"
+                    ) from exc
                 finished = dt.datetime.now().astimezone()
                 results.append(
                     {
                         "command": list(command),
+                        "resolvedCommand": executable_command,
                         "exitCode": proc.returncode,
+                        "timedOut": False,
                         "startedAt": started.isoformat(timespec="milliseconds"),
                         "finishedAt": finished.isoformat(timespec="milliseconds"),
                         "durationMs": int(
@@ -1449,11 +1551,16 @@ def _parse_verify_commands(values: Sequence[str] | None) -> list[list[str]]:
     POSIX shlex semantics: single/double quotes group tokens, backslash
     escapes the next character (quote Windows paths).
     """
-    return [shlex.split(value) for value in (values or [])]
+    return [_split_verify_command(value) for value in (values or [])]
 
 
 def cmd_verify(args: argparse.Namespace) -> int:
-    return _emit(_txn_from_args(args).verify(commands=_parse_verify_commands(args.command)))
+    return _emit(
+        _txn_from_args(args).verify(
+            commands=_parse_verify_commands(args.command),
+            timeout_seconds=float(args.timeout_seconds),
+        )
+    )
 
 
 def cmd_push(args: argparse.Namespace) -> int:
@@ -1543,6 +1650,11 @@ def build_parser() -> argparse.ArgumentParser:
     p_verify.add_argument("--feature-branch", required=True)
     p_verify.add_argument("--temp-root", required=True)
     p_verify.add_argument("--command", action="append")
+    p_verify.add_argument(
+        "--timeout-seconds",
+        type=float,
+        default=DEFAULT_VERIFY_TIMEOUT_SECONDS,
+    )
     p_verify.set_defaults(func=cmd_verify)
 
     return parser

package/harness/bundles/java/cursor/scripts/harness_ledger.py

@@ -219,14 +219,30 @@ def sha256_file(path: Path) -> str:
     return digest.hexdigest()
 
 
-def compute_inputs_hash(file_paths: list[str]) -> tuple[str, list[str]]:
+def compute_inputs_hash(
+    file_paths: list[str], *, project_root: Path | str | None = None
+) -> tuple[str, list[str]]:
     """Per-file content sha256 → sort digests → hash again (order-independent)."""
+    root = (
+        Path(project_root).expanduser().resolve()
+        if project_root is not None
+        else None
+    )
     by_path: dict[str, str] = {}
     for raw in file_paths:
         path = resolve_path(raw)
         if not path.is_file():
             raise FileNotFoundError(f"file not found: {raw}")
-        by_path[path.as_posix()] = sha256_file(path)
+        if root is not None:
+            try:
+                logical_path = path.relative_to(root).as_posix()
+            except ValueError as exc:
+                raise ValueError(
+                    f"INPUT_OUTSIDE_PROJECT: {path} is outside {root}"
+                ) from exc
+        else:
+            logical_path = path.as_posix()
+        by_path[logical_path] = sha256_file(path)
 
     # Stable file list for callers; bind every resolved path to its digest.
     # Hashing only the content multiset let a path swap incorrectly reuse a
@@ -1056,6 +1072,7 @@ def decide_can_reuse(
     requested_profile_hash: str | None = None,
     requested_environment_hash: str | None = None,
     requested_db_schema_hash: str | None = None,
+    project_root: Path | str | None = None,
 ) -> dict[str, Any]:
     ledger, ledger_path = load_ledger(change_dir)
     if ledger is None:
@@ -1220,8 +1237,10 @@ def decide_can_reuse(
         }
 
     try:
-        current_hash, current_files = compute_inputs_hash(files)
-    except FileNotFoundError as exc:
+        current_hash, current_files = compute_inputs_hash(
+            files, project_root=project_root
+        )
+    except (FileNotFoundError, ValueError) as exc:
         return {
             "ok": True,
             "reuse": False,
@@ -1351,7 +1370,9 @@ def cmd_hash(args: argparse.Namespace) -> int:
         files, project_root = input_files_from_args(args)
         if not files:
             return emit_error("hash requires --files or --files-from", as_json=as_json)
-        inputs_hash, inputs_files = compute_inputs_hash(files)
+        inputs_hash, inputs_files = compute_inputs_hash(
+            files, project_root=project_root
+        )
     except (OSError, FileNotFoundError) as exc:
         return emit_error(str(exc), as_json=as_json)
 
@@ -1418,6 +1439,7 @@ def cmd_can_reuse(args: argparse.Namespace) -> int:
             requested_profile_hash=getattr(args, "profile_hash", None),
             requested_environment_hash=getattr(args, "environment_hash", None),
             requested_db_schema_hash=getattr(args, "db_schema_hash", None),
+            project_root=project_root,
         )
     except (OSError, ValueError, json.JSONDecodeError) as exc:
         return emit_error(f"can-reuse failed: {exc}", as_json=as_json)
@@ -1470,7 +1492,9 @@ def cmd_record(args: argparse.Namespace) -> int:
 
     try:
         status = normalize_status(args.status)
-        inputs_hash, inputs_files = compute_inputs_hash(files)
+        inputs_hash, inputs_files = compute_inputs_hash(
+            files, project_root=project_root
+        )
         ledger, _existing_path = load_ledger(change_dir)
         if ledger is None:
             ledger = {

package/harness/bundles/java/cursor/scripts/harness_preflight.py

@@ -374,12 +374,14 @@ def _resolve_agents_root(skills_root: Path, agents_root: Path | None) -> tuple[P
     return (skills_root / "agents").resolve(), None
 
 
-def _read_host_capabilities(skills_root: Path) -> set[str]:
+def _read_host_capabilities(skills_root: Path) -> tuple[set[str], bool]:
     """Read agent capabilities declared by the host adapter (retro §5.3).
 
     Adapter installs may declare available agent roles in
     `meta/runtime.json` under `agentCapabilities` (list of role names).
-    Returns an empty set if the file or field is absent.
+    Returns ``(capabilities, manifest_present)``. ``manifest_present`` is true
+    only when a readable capability list exists; an unrelated runtime.json
+    must not turn an unknown host into a hard "agent missing" failure.
     """
     # runtime.json lives in the change's meta/ dir, but agent capabilities are
     # project-level. Check the adapter's runtime.json at the project root.
@@ -398,8 +400,8 @@ def _read_host_capabilities(skills_root: Path) -> set[str]:
             continue
         caps = data.get("agentCapabilities")
         if isinstance(caps, list):
-            return {str(c) for c in caps if isinstance(c, str)}
-    return set()
+            return {str(c) for c in caps if isinstance(c, str)}, True
+    return set(), False
 
 
 def cmd_check_agents(
@@ -420,7 +422,7 @@ def cmd_check_agents(
         }
 
     resolved_agents_root, _ = _resolve_agents_root(skills_root, agents_root)
-    host_capabilities = _read_host_capabilities(skills_root)
+    host_capabilities, capability_manifest_present = _read_host_capabilities(skills_root)
     host_callable = agent_name in host_capabilities
 
     # Three independent fields (retro §5.3):
@@ -437,32 +439,37 @@ def cmd_check_agents(
         agent_path = resolved_agents_root / filename
         definition_present = agent_path.is_file()
 
-    # If no local definition and host doesn't declare the role, we can't
-    # determine usability. Distinguish "host says no" from "unknown".
+    # Codex/Cursor bundles intentionally do not install fixed harness-* agent
+    # definitions. Missing host capabilities therefore select the normal
+    # inline path instead of reporting UNKNOWN/"subagent unavailable".
     if not definition_present and not host_callable:
-        # Check if this adapter is known to not support custom agents
         adapter_name = skills_root.parent.name
         if adapter_name in (".agents", ".cursor"):
-            # Codex/Cursor: may support via host manifest. If runtime.json
-            # has agentCapabilities but this role isn't listed, it's a
-            # genuine "not available". If no agentCapabilities field at all,
-            # we can't know — return UNKNOWN.
-            runtime_path = skills_root.parent / "runtime.json"
-            if not runtime_path.is_file():
-                return {
-                    "ok": True,
-                    "action": "check-agents",
-                    "agent": agent_name,
-                    "usable": False,
-                    "definitionPresent": False,
-                    "hostCallable": False,
-                    "toolContractValid": False,
-                    "reasonCode": "UNKNOWN",
-                    "reason": (
-                        "no local agent definition and no host capability manifest; "
-                        "cannot determine agent availability"
-                    ),
-                }
+            reason_code = (
+                "HOST_CAPABILITY_NOT_DECLARED"
+                if capability_manifest_present
+                else "INLINE_BY_ADAPTER"
+            )
+            return {
+                "ok": True,
+                "action": "check-agents",
+                "agent": agent_name,
+                "usable": False,
+                "executionMode": "inline",
+                "fallbackPolicy": "inline-no-retry",
+                "definitionPresent": False,
+                "hostCallable": False,
+                "toolContractValid": False,
+                "capabilityManifestPresent": capability_manifest_present,
+                "reasonCode": reason_code,
+                "reason": (
+                    "host capability manifest does not declare this fixed agent; "
+                    "use the normal inline path"
+                    if capability_manifest_present
+                    else "adapter uses inline execution unless the host explicitly "
+                    "declares a callable agent capability"
+                ),
+            }
         return {
             "ok": False,
             "action": "check-agents",
@@ -470,9 +477,12 @@ def cmd_check_agents(
             "path": str(agent_path) if agent_path else None,
             "agentsRoot": str(resolved_agents_root) if resolved_agents_root else None,
             "usable": False,
+            "executionMode": "unavailable",
+            "fallbackPolicy": "inline-no-retry",
             "definitionPresent": False,
             "hostCallable": False,
             "toolContractValid": False,
+            "capabilityManifestPresent": capability_manifest_present,
             "reasonCode": "AGENT_DEFINITION_NOT_FOUND",
             "reason": f"agent file not found and host does not declare role: {agent_name}",
         }
@@ -488,9 +498,13 @@ def cmd_check_agents(
                 "agent": agent_name,
                 "path": str(agent_path),
                 "usable": False,
+                "executionMode": "unavailable",
+                "fallbackPolicy": "inline-no-retry",
                 "definitionPresent": True,
                 "hostCallable": host_callable,
                 "toolContractValid": False,
+                "capabilityManifestPresent": capability_manifest_present,
+                "reasonCode": "AGENT_DEFINITION_UNREADABLE",
                 "reason": f"cannot read agent file: {exc}",
             }
 
@@ -502,9 +516,13 @@ def cmd_check_agents(
                 "agent": agent_name,
                 "path": str(agent_path),
                 "usable": False,
+                "executionMode": "unavailable",
+                "fallbackPolicy": "inline-no-retry",
                 "definitionPresent": True,
                 "hostCallable": host_callable,
                 "toolContractValid": False,
+                "capabilityManifestPresent": capability_manifest_present,
+                "reasonCode": "AGENT_DEFINITION_INVALID",
                 "reason": f"frontmatter parse failed: {err or 'unknown'}",
             }
 
@@ -525,7 +543,7 @@ def cmd_check_agents(
     name_field = meta.get("name") if meta else None
     tools_field = meta.get("tools") if meta else None
 
-    reason_code = "READY" if usable else "AGENT_DEFINITION_NOT_FOUND"
+    reason_code = "READY" if usable else "TOOL_CONTRACT_INVALID"
     if not definition_present and host_callable:
         reason_code = "DEFINITION_NOT_FOUND_HOST_CAPABLE"
 
@@ -536,9 +554,12 @@ def cmd_check_agents(
         "path": str(agent_path) if agent_path else None,
         "agentsRoot": str(resolved_agents_root) if resolved_agents_root else None,
         "usable": usable,
+        "executionMode": "delegated" if usable else "unavailable",
+        "fallbackPolicy": "inline-no-retry",
         "definitionPresent": definition_present,
         "hostCallable": host_callable,
         "toolContractValid": tool_contract_valid,
+        "capabilityManifestPresent": capability_manifest_present,
         "reasonCode": reason_code,
         "reason": (
             "agent available; "

package/harness/bundles/java/cursor/scripts/harness_profile.py

@@ -66,6 +66,16 @@ DEFAULT_EXCLUDED_ROOTS: tuple[str, ...] = (
     ".cache",
 )
 
+
+def profile_defaults_fingerprint() -> str:
+    """Fingerprint generated defaults so old profiles are refreshed safely."""
+    payload = {
+        "schemaVersion": SCHEMA_VERSION,
+        "excludedRoots": list(DEFAULT_EXCLUDED_ROOTS),
+    }
+    encoded = json.dumps(payload, ensure_ascii=False, sort_keys=True).encode("utf-8")
+    return f"sha256:{hashlib.sha256(encoded).hexdigest()}"
+
 # 覆盖层级（spec §3.2）：unitTest ⊂ unitTestFull；package 独立；submit 复用 unitTestFull。
 VERIFICATION_KEYS: tuple[str, ...] = (
     "compile",
@@ -330,6 +340,7 @@ def _node_commands(project: Path) -> dict[str, Any]:
 def empty_profile_skeleton(excluded: tuple[str, ...] | list[str]) -> dict[str, Any]:
     return {
         "schemaVersion": SCHEMA_VERSION,
+        "defaultsFingerprint": profile_defaults_fingerprint(),
         "detectedAt": "",
         "projectType": "unknown",
         "toolPaths": {"node": "", "mvn": ""},
@@ -596,6 +607,28 @@ def check(project: Path) -> dict[str, Any]:
     issues: list[str] = []
     stale = False
 
+    expected_defaults_fingerprint = profile_defaults_fingerprint()
+    if profile.get("defaultsFingerprint") != expected_defaults_fingerprint:
+        stale = True
+        issues.append(
+            "defaultsFingerprint is missing or outdated; run detect to refresh generated defaults"
+        )
+
+    excluded_roots = {
+        str(item).replace("\\", "/").strip("/")
+        for item in (profile.get("excludedRoots") or [])
+        if isinstance(item, str) and item.strip("/")
+    }
+    missing_excluded_roots = [
+        item for item in DEFAULT_EXCLUDED_ROOTS if item not in excluded_roots
+    ]
+    if missing_excluded_roots:
+        stale = True
+        issues.append(
+            "excludedRoots missing generated defaults: "
+            + ", ".join(missing_excluded_roots)
+        )
+
     fp = profile.get("fingerprint") or {}
     stored_pom = fp.get("pomHash") or "" if isinstance(fp, dict) else ""
     current_pom = sha256_file(project / "pom.xml") if (project / "pom.xml").is_file() else ""

package/harness/bundles/java/cursor/scripts/harness_test_guard.py

@@ -32,6 +32,24 @@ MODE = "force-track-touched"
 MANIFEST_REL = Path("evidence") / "test-tracking.json"
 SNAPSHOT_REL = Path("evidence") / "test-guard-snapshot.json"
 PROFILE_REL = Path(".harness") / "config" / "build-profile.json"
+MANDATORY_EXCLUDED_ROOTS = (
+    ".git",
+    ".harness",
+    ".worktrees",
+    ".claude/worktrees",
+    ".codex/worktrees",
+    ".cursor/worktrees",
+    ".codebuddy/worktrees",
+    ".codeium/worktrees",
+    "target",
+    "build",
+    "dist",
+    "node_modules",
+    ".gradle",
+    "__pycache__",
+    ".pytest_cache",
+    ".cache",
+)
 REASONS = ("tdd-created", "stale-test-repair", "test-updated")
 
 
@@ -213,11 +231,14 @@ def _profile_config(project: Path) -> tuple[list[str], list[str]] | None:
     if not isinstance(paths, list):
         return [], []
     excluded = profile.get("excludedRoots") if isinstance(profile, dict) else None
-    excluded_roots = (
+    configured_roots = (
         [item.replace("\\", "/").strip("/") for item in excluded if isinstance(item, str) and item]
         if isinstance(excluded, list)
         else []
     )
+    excluded_roots = list(
+        dict.fromkeys([*configured_roots, *MANDATORY_EXCLUDED_ROOTS])
+    )
     patterns = [
         item.replace("\\", "/") for item in paths if isinstance(item, str) and item
     ]
@@ -254,11 +275,8 @@ def _allowed_test_path(project: Path, rel: str) -> bool:
     if config is None:
         return _standard_test_path(rel)
     patterns, excluded_roots = config
-    rel_parts = tuple(os.path.normcase(part) for part in rel.split("/"))
-    for excluded in excluded_roots:
-        excluded_parts = tuple(os.path.normcase(part) for part in excluded.split("/"))
-        if rel_parts[: len(excluded_parts)] == excluded_parts:
-            return False
+    if _path_is_excluded(rel, excluded_roots):
+        return False
     return any(_matches_pattern(rel, pattern) for pattern in patterns)
 
 
@@ -820,8 +838,12 @@ def _path_is_excluded(rel: str, excluded_roots: list[str]) -> bool:
         excluded_parts = tuple(
             os.path.normcase(part) for part in excluded.split("/") if part
         )
-        if excluded_parts and rel_parts[: len(excluded_parts)] == excluded_parts:
-            return True
+        if not excluded_parts:
+            continue
+        width = len(excluded_parts)
+        for index in range(len(rel_parts) - width + 1):
+            if rel_parts[index : index + width] == excluded_parts:
+                return True
     return False