@opengsd/gsd-core 1.7.0 → 1.9.0

package/scripts/gen-capability-registry.cjs

@@ -71,6 +71,7 @@ const {
   validateArtifactKindEntry,
   validateArtifactLayout,
   validateRuntimeBody,
+  collectReviewerWarnings,
   materializeHookFragments,
   validateAgainstContract,
   validateConsumesGlobal,
@@ -128,6 +129,71 @@ function loadCentralConfigKeys(schemaPath = CONFIG_SCHEMA_PATH) {
   return new Set(Array.isArray(manifest.validKeys) ? manifest.validKeys : []);
 }
 
+/**
+ * Loads the central config-schema's DYNAMIC key patterns (#2797).
+ *
+ * `loadCentralConfigKeys` above reads `validKeys` only, so a federated key
+ * claimed by a central *pattern* was invisible to the exclusivity check. That is
+ * not a cosmetic gap: `isCentralConfigKey` consults these same patterns, and
+ * `mergeFederatedConfig` skips every key for which it returns true — so an
+ * overlapping slice is inert while the build stays green.
+ *
+ * The patterns are read from the SAME manifest the runtime reads and compiled
+ * with the same `source`, rather than re-implementing a matcher here, so the two
+ * cannot drift.
+ *
+ * Failure contract MATCHES `loadCentralConfigKeys` above deliberately — the two
+ * read the same file and must not disagree about what a broken one means:
+ *   - ENOENT → empty list. Legitimately absent.
+ *   - Any other read error, or a JSON parse error → prominent stderr + throw.
+ *
+ * An earlier revision swallowed the parse error and returned []. That is
+ * fail-OPEN on the gate this function exists to feed: with zero patterns,
+ * `validateCrossCapability`'s pattern-collision check silently passes and an
+ * inert federated slice ships green. It was masked in the one production call
+ * site only because `loadCentralConfigKeys` runs first against the same path and
+ * throws — a coincidence of ordering, not a guarantee, and this function is
+ * exported and called standalone.
+ *
+ * A single unparseable PATTERN is still skipped rather than fatal: that is a
+ * per-entry defect the central schema's own tests own, and skipping one pattern
+ * degrades to "checked less" rather than blocking every build.
+ */
+function loadCentralConfigPatterns(schemaPath = CONFIG_SCHEMA_PATH) {
+  let raw;
+  try {
+    raw = fs.readFileSync(schemaPath, 'utf8');
+  } catch (err) {
+    if (err && err.code === 'ENOENT') return [];
+    process.stderr.write(
+      '  ERROR  Failed to read config-schema manifest at ' + schemaPath + ': ' + err.message + '\n',
+    );
+    throw new ExitError(1, 'could not read config-schema manifest');
+  }
+
+  let manifest;
+  try {
+    manifest = JSON.parse(raw);
+  } catch (err) {
+    process.stderr.write(
+      '  ERROR  Config-schema manifest at ' + schemaPath + ' is broken (JSON parse error): ' + err.message + '\n',
+    );
+    throw new ExitError(1, 'config-schema manifest JSON is malformed');
+  }
+  const declared = Array.isArray(manifest.dynamicKeyPatterns) ? manifest.dynamicKeyPatterns : [];
+  const out = [];
+  for (const entry of declared) {
+    const src = entry && typeof entry.source === 'string' ? entry.source : null;
+    if (!src) continue;
+    try {
+      out.push(new RegExp(src));
+    } catch {
+      // Unparseable pattern — the central schema's own tests own that failure.
+    }
+  }
+  return out;
+}
+
 // ─── ADR-857 Phase 4a: Derived views ─────────────────────────────────────────
 
 // (Config-slice validation, per-capability validators, contract validators,
@@ -335,14 +401,21 @@ function runConsistencyGate(capabilityClusters, profileMembership, capMap) {
  *   (used during 3a-impl while migration is in-progress).
  * @param {string} [capabilitiesDir]    Override capabilities dir (for testing with fixtures).
  */
-function loadAndValidate(centralKeys, capabilitiesDir) {
+function loadAndValidate(centralKeys, capabilitiesDir, centralPatterns) {
   const resolvedCentralKeys = centralKeys !== undefined ? centralKeys : loadCentralConfigKeys();
+  // #2797: patterns default to the real manifest unless a caller passes its own
+  // (tests pass [] to isolate the exact-key path).
+  const resolvedCentralPatterns = centralPatterns !== undefined ? centralPatterns : loadCentralConfigPatterns();
   const resolvedCapDir = capabilitiesDir !== undefined ? capabilitiesDir : CAPABILITIES_DIR;
   const errors = [];
   const capMap = new Map();
+  // ADR-2782 D4 — non-fatal diagnostics (e.g. an unknown field inside a reviewer
+  // body). These NEVER fail the build; they surface on stderr so a forward-built
+  // manifest degrades visibly instead of silently.
+  const warnings = [];
 
   if (!fs.existsSync(resolvedCapDir)) {
-    return { capMap, errors };
+    return { capMap, errors, warnings };
   }
 
   // Compute wired points ONCE before iterating capabilities so the filesystem
@@ -366,6 +439,10 @@ function loadAndValidate(centralKeys, capabilitiesDir) {
       continue;
     }
 
+    // Collected BEFORE the error short-circuit below so a manifest that is both
+    // forward-built and invalid still reports why it looked unfamiliar.
+    for (const w of collectReviewerWarnings(cap)) warnings.push(folderId + '/capability.json: ' + w);
+
     const capErrors = validateCapability(cap, folderId);
     if (capErrors.length > 0) {
       for (const e of capErrors) errors.push(folderId + '/capability.json: ' + e);
@@ -397,7 +474,7 @@ function loadAndValidate(centralKeys, capabilitiesDir) {
   }
 
   // Cross-capability invariants — capMap contains only fully-valid capabilities at this point.
-  const crossErrors = validateCrossCapability(capMap, resolvedCentralKeys);
+  const crossErrors = validateCrossCapability(capMap, resolvedCentralKeys, resolvedCentralPatterns);
   errors.push(...crossErrors);
 
   // C2: Global consumes-satisfiability — runs after capMap is fully built so cross-capability
@@ -406,7 +483,7 @@ function loadAndValidate(centralKeys, capabilitiesDir) {
   const consumesErrors = validateConsumesGlobal(capMap);
   errors.push(...consumesErrors);
 
-  return { capMap, errors };
+  return { capMap, errors, warnings };
 }
 
 /**
@@ -446,6 +523,46 @@ function buildRegistry(capMap) {
     if (capId === '__proto__' || capId === 'constructor' || capId === 'prototype') continue;
     capabilities[capId] = cap;
 
+    // Federated config slice — harvested from ANY role that declares one.
+    //
+    // ADR-2782 D1/D9: this loop was nested inside the `role === 'feature'` branch,
+    // so a `role: "runtime"` capability's `config` was read by nothing and dropped
+    // in silence — the actual reason reviewer config keys are stranded in the
+    // central schema. (The often-cited reason, that the runtime body forbids
+    // feature-only fields, does not apply: `config` is NOT in
+    // FEATURE_FIELDS_FORBIDDEN_ON_RUNTIME.) Owning a config slice is a property of
+    // DECLARING one, not of being a feature. Verified inert at introduction — no
+    // shipped capability declares `config` on a non-feature role — so this changes
+    // no existing key; it stops a latent silent drop and unblocks Phase 4 (#2797).
+    for (const key of Object.keys(cap.config || {})) {
+      // S2b: inline literal guard at each write site (CodeQL barrier)
+      if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue;
+      configKeys[key] = capId;
+
+      // Build configSchema entry — validate the slice first (throw on violation)
+      const slice = (cap.config || {})[key];
+      const sliceErrors = validateConfigSliceEntry(capId, key, slice);
+      if (sliceErrors.length > 0) {
+        throw new Error(
+          'configSchema validation failed during registry build:\n' +
+          sliceErrors.map((e) => '  ' + e).join('\n'),
+        );
+      }
+      // S2b: inline literal guard for configSchema write site
+      if (key !== '__proto__' && key !== 'constructor' && key !== 'prototype') {
+        configSchema[key] = {
+          owner: capId,
+          type: slice.type,
+          default: slice.default,
+          description: slice.description,
+        };
+        // Preserve values array for enum types if present
+        if (slice.type === 'enum' && Array.isArray(slice.values)) {
+          configSchema[key].values = slice.values;
+        }
+      }
+    }
+
     if (cap.role === 'feature') {
       for (const skill of (cap.skills || [])) {
         // S2b: inline literal guard at each write site (CodeQL barrier)
@@ -457,34 +574,6 @@ function buildRegistry(capMap) {
         if (agent === '__proto__' || agent === 'constructor' || agent === 'prototype') continue;
         byAgent[agent] = capId;
       }
-      for (const key of Object.keys(cap.config || {})) {
-        // S2b: inline literal guard at each write site (CodeQL barrier)
-        if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue;
-        configKeys[key] = capId;
-
-        // Build configSchema entry — validate the slice first (throw on violation)
-        const slice = (cap.config || {})[key];
-        const sliceErrors = validateConfigSliceEntry(capId, key, slice);
-        if (sliceErrors.length > 0) {
-          throw new Error(
-            'configSchema validation failed during registry build:\n' +
-            sliceErrors.map((e) => '  ' + e).join('\n'),
-          );
-        }
-        // S2b: inline literal guard for configSchema write site
-        if (key !== '__proto__' && key !== 'constructor' && key !== 'prototype') {
-          configSchema[key] = {
-            owner: capId,
-            type: slice.type,
-            default: slice.default,
-            description: slice.description,
-          };
-          // Preserve values array for enum types if present
-          if (slice.type === 'enum' && Array.isArray(slice.values)) {
-            configSchema[key].values = slice.values;
-          }
-        }
-      }
 
       for (const step of (cap.steps || [])) {
         if (VALID_LOOP_POINTS.has(step.point)) {
@@ -741,7 +830,11 @@ function main() {
   if (flag === '--check') {
     // Fix #3: read the REAL central config keys so collision detection fires and is visible.
     const centralKeys = loadCentralConfigKeys();
-    const { capMap, errors } = loadAndValidate(centralKeys);
+    const { capMap, errors, warnings } = loadAndValidate(centralKeys);
+
+    // ADR-2782 D4 — non-fatal manifest diagnostics. Emitted BEFORE the hard-error
+    // exit so a forward-built manifest still explains itself on a failing build.
+    for (const w of warnings) process.stderr.write(w + '\n');
 
     // Separate pending-migration warnings from hard errors
     const { hardErrors, pendingMigrationWarnings } = classifyCrossErrors(errors);
@@ -778,7 +871,11 @@ function main() {
   } else if (flag === '--write') {
     // Fix #3: read the REAL central config keys so collision detection fires and is visible.
     const centralKeys = loadCentralConfigKeys();
-    const { capMap, errors } = loadAndValidate(centralKeys);
+    const { capMap, errors, warnings } = loadAndValidate(centralKeys);
+
+    // ADR-2782 D4 — non-fatal manifest diagnostics. Emitted BEFORE the hard-error
+    // exit so a forward-built manifest still explains itself on a failing build.
+    for (const w of warnings) process.stderr.write(w + '\n');
 
     // Separate pending-migration warnings from hard errors
     const { hardErrors, pendingMigrationWarnings } = classifyCrossErrors(errors);
@@ -828,6 +925,7 @@ module.exports = {
   validateCrossCapability,
   classifyCrossErrors,
   loadCentralConfigKeys,
+  loadCentralConfigPatterns,
   loadAndValidate,
   buildRegistry,
   serializeRegistry,

package/scripts/gen-emitted-baseline.cjs

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * gen-emitted-baseline.cjs — publishes the emitted-baseline artifact the
+ * differential attribution check reads via `resolveBaseline()` (#2724, ADR-2719 §5).
+ *
+ * ## Why this exists
+ *
+ * Phase 3 (#2723) built `resolveBaseline()` (tests/helpers/emitted-baseline.cjs) and its
+ * cache-key staleness discipline, but nothing produced the artifact it reads — the
+ * dual-run window instead read the baseline straight off the committed golden fixtures
+ * at the base ref (`baselineManifestsAtRef`). Phase 4 deletes those fixtures, so
+ * something has to build and publish `{version, sha, manifests, sizes}` for real.
+ *
+ * ## What it does
+ *
+ * Builds the emitted manifest set (19 real installer spawns) and the workflow/agent size
+ * maps for the tree at `--dir <path>` (default: THIS script's own checkout — i.e.
+ * whatever commit is currently checked out where `gen-emitted-baseline.cjs` itself
+ * lives). Writes the result to `--out <path>` (default `.gsd-cache/emitted-baseline.json`).
+ *
+ * `--dir` decouples "which copy of this script runs" from "which tree gets measured"
+ * (#2767). The MEASUREMENT SCHEMA — this script, and the `currentManifests`/
+ * `currentSizes`/`buildParityManifest` functions it calls — always comes from wherever
+ * `gen-emitted-baseline.cjs` itself is being run from (relative `require`s resolve
+ * there); only the tree being measured (which `bin/install.js` gets spawned, which
+ * `hooks/`/`gsd-core/workflows/`/`agents/` get read) moves to `--dir`. That is what lets
+ * a differential apply ONE definition of "the emitted manifest" to two different
+ * commits and stay comparable even as that definition evolves — see
+ * `tests/helpers/emitted-runtime.cjs`'s `buildBaselineAtRef` for the caller that
+ * exercises this for real, and why it must NOT run the `--dir` tree's own copy of this
+ * script (which may be an older version, or — for any base ref that predates the PR
+ * that added this script at all — may not exist there yet).
+ *
+ * ## Callers
+ *
+ *   1. CI's push-to-`next` job runs this straight after `next` advances (no `--dir`,
+ *      measuring its own checkout), then uploads `.gsd-cache/emitted-baseline.json` as a
+ *      cache entry keyed on the merge sha (.github/workflows/test.yml,
+ *      `publish-emitted-baseline` job).
+ *   2. `tests/emitted-attribution.test.cjs`'s real-tree test passes
+ *      `buildBaselineAtRef` (tests/helpers/emitted-runtime.cjs) to `resolveBaseline()`
+ *      as the `buildFallback` for a cache miss: it checks out `base` into a throwaway
+ *      `git worktree`, symlinks in `node_modules` and runs `npm run build:lib` there
+ *      (this script and the test helpers are Node-builtins-only per CONTRIBUTING.md's
+ *      "No external dependencies in core", but `tests/helpers/install-shared.cjs`
+ *      requires the TSC-compiled, gitignored `gsd-core/bin/lib/*.cjs`, so that one build
+ *      step is unavoidable), then spawns THIS repo's OWN `gen-emitted-baseline.cjs`
+ *      with `--dir <worktree> --out <tmp>` and reads the artifact back.
+ *
+ * Every git subprocess is bounded (CLAUDE.md → KNOWN DEFECTS: unbounded subprocesses
+ * hang CI silently).
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+const { runMain, ExitError } = require('./lib/cli-exit.cjs');
+const { BUILD_SCRIPT } = require('../tests/helpers/install-shared.cjs');
+const { currentManifests, currentSizes, git } = require('../tests/helpers/emitted-runtime.cjs');
+const { BASELINE_VERSION } = require('../tests/helpers/emitted-baseline.cjs');
+
+const REPO_ROOT = path.join(__dirname, '..');
+const DEFAULT_OUT = path.join(REPO_ROOT, '.gsd-cache', 'emitted-baseline.json');
+
+// Reuses emitted-runtime.cjs's `git()` (not a local execFileSync) so the
+// `-c safe.directory=<dir>` fix for the remote runner's dubious-ownership
+// mount (#2767) has exactly one source of truth — see that module's
+// `safeDirArgs` doc comment.
+function resolveHeadSha(cwd) {
+  return git(['rev-parse', 'HEAD'], { cwd }).trim();
+}
+
+function parseArgs(argv) {
+  let out = DEFAULT_OUT;
+  let dir = REPO_ROOT;
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === '--out') {
+      out = argv[i + 1];
+      i++;
+    } else if (argv[i] === '--dir') {
+      dir = argv[i + 1];
+      i++;
+    } else {
+      throw new ExitError(2, `gen-emitted-baseline: unknown argument "${argv[i]}"`);
+    }
+  }
+  if (!out || typeof out !== 'string') {
+    throw new ExitError(2, 'gen-emitted-baseline: --out requires a path');
+  }
+  if (!dir || typeof dir !== 'string') {
+    throw new ExitError(2, 'gen-emitted-baseline: --dir requires a path');
+  }
+  return {
+    out: path.isAbsolute(out) ? out : path.join(process.cwd(), out),
+    dir: path.isAbsolute(dir) ? dir : path.join(process.cwd(), dir),
+  };
+}
+
+async function main() {
+  const { out, dir } = parseArgs(process.argv.slice(2));
+
+  if (!fs.existsSync(dir)) {
+    throw new ExitError(1, `gen-emitted-baseline: --dir "${dir}" does not exist`);
+  }
+
+  const sha = resolveHeadSha(dir);
+  if (!/^[0-9a-f]{40}$/.test(sha)) {
+    throw new ExitError(1, `gen-emitted-baseline: HEAD of "${dir}" did not resolve to a 40-hex sha: ${sha}`);
+  }
+
+  // hooks/dist is gitignored and built; a scoped CI checkout may not have run
+  // build:hooks yet. Idempotent, mirrors the real-tree test. Built INSIDE `dir` — the
+  // MEASURED tree's own hooks/ source, not this script's — so a `--dir` pointed at a
+  // different checkout (e.g. a base-ref worktree) reflects that checkout's hooks, not
+  // the caller's. `dir === REPO_ROOT` (the default, no `--dir`) collapses to the
+  // pre-#2767 behavior of building this own repo's hooks/dist.
+  const buildScript = dir === REPO_ROOT ? BUILD_SCRIPT : path.join(dir, 'scripts', 'build-hooks.js');
+  execFileSync(process.execPath, [buildScript], { cwd: dir, encoding: 'utf-8', stdio: 'pipe', timeout: 120_000 });
+
+  // The measurement SCHEMA (currentManifests/currentSizes/buildParityManifest) is
+  // always THIS script's own — only the tree being measured moves with `repoRoot`.
+  const manifests = currentManifests({ repoRoot: dir });
+  const sizes = currentSizes({ repoRoot: dir });
+
+  const artifact = { version: BASELINE_VERSION, sha, manifests, sizes };
+
+  fs.mkdirSync(path.dirname(out), { recursive: true });
+  fs.writeFileSync(out, `${JSON.stringify(artifact, null, 2)}\n`, 'utf8');
+
+  const familyCount = Object.keys(manifests).length;
+  const sizeCount = Object.keys(sizes).length;
+  process.stdout.write(
+    `gen-emitted-baseline: wrote ${out} (dir=${dir}, sha=${sha.slice(0, 12)}, ${familyCount} families, ${sizeCount} sized files)\n`,
+  );
+  return 0;
+}
+
+if (require.main === module) {
+  runMain(main);
+}
+
+module.exports = { parseArgs, resolveHeadSha, DEFAULT_OUT, REPO_ROOT };

package/scripts/gen-test-timings.cjs

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+// Regenerate the per-file test timing table used to weight chunk packing in
+// scripts/run-tests.cjs (issue #2456).
+//
+// The chunk packer needs to know what each test file actually COSTS. Before
+// #2456 it guessed from the filename (`^(?:install|codex-)` scored 12x,
+// everything else 1) and was wrong in both directions — installer-migration-
+// authoring.test.cjs scored 12x but runs ~0.1s, while the two heaviest files in
+// the suite (run-tests-harness.test.cjs and release-tarball-smoke.install
+// .test.cjs) both scored 1. This script replaces the guess with measurement.
+//
+// Input is one or more node:test reporter event streams as emitted by
+// `gsd-test` (`~/.local/state/gsd-test/runs/<run-id>/test-events-<os>-node<v>
+// .jsonl`). Each stream carries one `test:summary` event per test FILE, whose
+// `data.duration_ms` is that file's total wall-clock and whose `data.file` is
+// its absolute in-container path.
+//
+// Usage:
+//   node scripts/gen-test-timings.cjs <events.jsonl> [<events.jsonl> ...]
+//   node scripts/gen-test-timings.cjs ~/.local/state/gsd-test/runs/*/test-events-*.jsonl
+//   node scripts/gen-test-timings.cjs events.jsonl --out tests/test-timings.json
+//
+// When several streams are supplied (multiple lanes, e.g. node22 + node24), a
+// file's recorded time is the MAX across them, not the mean: the packer exists
+// to keep the SLOWEST lane's slowest chunk away from the per-chunk timeout, so
+// the conservative bound is the right one to balance against.
+//
+// The table is ADVISORY and deliberately un-gated — there is no `--check` mode
+// and no CI lint that fails on staleness, because timing data legitimately
+// varies run to run. A file missing from the table falls back to the table's
+// median weight, so a stale table degrades chunk BALANCE gracefully instead of
+// failing the build. Regenerate it when the suite's cost profile has visibly
+// drifted, not on a schedule.
+'use strict';
+
+const fs = require('fs');
+const { basename, dirname, join } = require('path');
+const { ExitError, runMain } = require('./lib/cli-exit.cjs');
+
+const DEFAULT_OUT = join(__dirname, '..', 'tests', 'test-timings.json');
+const SCHEMA_VERSION = 1;
+
+function parseArgs(argv) {
+  const inputs = [];
+  let out = DEFAULT_OUT;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--out') {
+      const value = argv[++i];
+      if (!value) return { error: '--out requires a path' };
+      out = value;
+    } else if (arg.startsWith('--out=')) {
+      const value = arg.slice('--out='.length);
+      if (!value) return { error: '--out requires a path' };
+      out = value;
+    } else if (arg.startsWith('-')) {
+      return { error: `unknown flag "${arg}"` };
+    } else {
+      inputs.push(arg);
+    }
+  }
+  if (inputs.length === 0) {
+    return { error: 'usage: gen-test-timings.cjs <reporter-events.jsonl> [...] [--out <path>]' };
+  }
+  return { inputs, out };
+}
+
+// Fold one reporter event stream into `acc`, keeping the MAX duration seen for
+// each test file. Returns per-stream counters plus any basename collisions
+// found WITHIN this stream.
+//
+// Keying is by BASENAME, matching how run-tests.cjs weights a selected file:
+// the reporter reports absolute in-container paths (/work/tests/foo.test.cjs)
+// while the harness carries paths relative to its test dir, so the basename is
+// the only stable join key between the two. A basename seen in two different
+// directories would make the table ambiguous, so it must fail loudly.
+//
+// Collision detection is scoped to a SINGLE stream deliberately. Every lane
+// writes its own stream under its own container root (`/work/tests` on Linux,
+// `C:/work/tests` on Windows), so comparing directories ACROSS streams reports
+// every shared basename as a collision — which is the script's own documented
+// usage (globbing `test-events-*.jsonl` across lanes). Within one stream the
+// root is constant, so a differing directory is a real collision.
+function foldStream(text, acc) {
+  const dirsByBase = new Map();
+  let files = 0;
+  let malformed = 0;
+  for (const line of text.split('\n')) {
+    if (line.trim() === '') continue;
+    let event;
+    try {
+      event = JSON.parse(line);
+    } catch {
+      malformed++;
+      continue;
+    }
+    if (!event || event.type !== 'test:summary') continue;
+    const data = event.data;
+    if (!data || typeof data.file !== 'string') continue;
+    const ms = data.duration_ms;
+    if (typeof ms !== 'number' || !Number.isFinite(ms) || ms < 0) continue;
+    const path = data.file.replace(/\\/g, '/');
+    const base = basename(path);
+    if (!dirsByBase.has(base)) dirsByBase.set(base, new Set());
+    dirsByBase.get(base).add(dirname(path));
+    const prev = acc.get(base);
+    if (prev === undefined || ms > prev) acc.set(base, ms);
+    files++;
+  }
+  const collisions = [...dirsByBase.entries()]
+    .filter(([, dirs]) => dirs.size > 1)
+    .map(([base, dirs]) => `${base} (${[...dirs].sort().join(', ')})`);
+  return { files, malformed, collisions };
+}
+
+function main() {
+  const parsed = parseArgs(process.argv.slice(2));
+  if (parsed.error) throw new ExitError(2, `gen-test-timings: ${parsed.error}`);
+
+  const acc = new Map();
+  const allCollisions = new Set();
+  const sources = [];
+  for (const input of parsed.inputs) {
+    let text;
+    try {
+      text = fs.readFileSync(input, 'utf8');
+    } catch (err) {
+      throw new ExitError(2, `gen-test-timings: cannot read "${input}": ${err.message}`);
+    }
+    const { files, malformed, collisions } = foldStream(text, acc);
+    for (const c of collisions) allCollisions.add(c);
+    sources.push(basename(input));
+    console.error(
+      `gen-test-timings: ${basename(input)} — ${files} file summaries` +
+        (malformed > 0 ? `, ${malformed} unparseable lines skipped` : ''),
+    );
+  }
+
+  if (acc.size === 0) {
+    throw new ExitError(
+      2,
+      'gen-test-timings: no `test:summary` events with a file and duration_ms were found. ' +
+        'Check that the input is a node:test reporter event stream (test-events-<os>-node<v>.jsonl).',
+    );
+  }
+
+  // A basename that resolves to two different directories within one lane makes
+  // the table ambiguous: run-tests.cjs joins on basename alone, so one file's
+  // measured cost would silently be applied to the other. Fail rather than emit
+  // a table that lies.
+  if (allCollisions.size > 0) {
+    throw new ExitError(
+      2,
+      `gen-test-timings: basename collision — the table cannot key on basename alone:\n  ${[...allCollisions].sort().join('\n  ')}`,
+    );
+  }
+
+  // Every key must be a plain test-file basename. This is a data-integrity
+  // check on a stream we do not control (the reporter emits whatever path the
+  // runner saw), and it structurally excludes a computed key like `__proto__`
+  // or `constructor` from being written into the table object below — the
+  // `js/prototype-polluting-assignment` shape, even though the value here is
+  // always a number and could not actually pollute.
+  const SAFE_BASENAME_RE = /^[A-Za-z0-9._-]+\.test\.cjs$/;
+  const rejected = [...acc.keys()].filter((base) => !SAFE_BASENAME_RE.test(base));
+  if (rejected.length > 0) {
+    throw new ExitError(
+      2,
+      `gen-test-timings: refusing to emit non-test-file keys: ${rejected.sort().join(', ')}`,
+    );
+  }
+
+  // Sorted keys keep the checked-in diff reviewable: a regeneration shows only
+  // the files whose cost actually moved, not a reshuffled object.
+  const timings = Object.create(null);
+  for (const base of [...acc.keys()].sort()) {
+    timings[base] = Math.round(acc.get(base));
+  }
+
+  const payload = {
+    schema_version: SCHEMA_VERSION,
+    generated_by: 'scripts/gen-test-timings.cjs',
+    unit: 'ms',
+    sources: sources.sort(),
+    file_count: acc.size,
+    timings,
+  };
+
+  fs.writeFileSync(parsed.out, `${JSON.stringify(payload, null, 2)}\n`, 'utf8');
+  const totalMs = [...acc.values()].reduce((sum, ms) => sum + ms, 0);
+  console.error(
+    `gen-test-timings: wrote ${parsed.out} — ${acc.size} files, ${(totalMs / 1000).toFixed(1)}s total`,
+  );
+  return 0;
+}
+
+if (require.main === module) {
+  runMain(main);
+}
+
+module.exports = { parseArgs, foldStream };