devrites 4.7.0 → 5.1.0

package/engine/internal/install/update.go

@@ -65,7 +65,7 @@ func runUpdate(opts Options) error {
 	if err != nil {
 		return fmt.Errorf("resolve payload %s: %w", opts.PayloadDir, err)
 	}
-	if err := hostpack.ValidatePayload(os.DirFS(payload), true); err != nil {
+	if err := hostpack.ValidatePayload(os.DirFS(payload), true, true); err != nil {
 		return fmt.Errorf("local update payload under %s is invalid: %w", payload, err)
 	}
 	installFlags := manifestHeader(mf, "devrites-flags")
@@ -153,6 +153,7 @@ func runRemoteUpdate(opts Options, target, installed string) error {
 	if opts.Force {
 		args = append(args, "--force")
 	}
+	// #nosec G204 -- re-execs the located engine binary with fixed migration args
 	cmd := exec.CommandContext(ctx, candidate.EnginePath, args...)
 	cmd.Stdout = opts.Stdout
 	cmd.Stderr = opts.Stderr

package/engine/internal/lib/candidate.go

@@ -103,11 +103,12 @@ func readBoundedRegularFile(name string, limit int64) ([]byte, error) {
 	if before.Size() < 0 || before.Size() > limit {
 		return nil, fmt.Errorf("artifact exceeds %s limit", byteLimitName(limit))
 	}
+	// #nosec G304 -- candidate artifact path; size cap checked above
 	file, err := os.Open(name)
 	if err != nil {
 		return nil, err
 	}
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 	opened, err := file.Stat()
 	if err != nil {
 		return nil, err
@@ -440,11 +441,12 @@ func hashCandidateFile(digest hash.Hash, project string, row candidateRow) error
 		return errors.New("present path disappeared before reading")
 	}
 	name := filepath.Join(project, filepath.FromSlash(row.path))
+	// #nosec G304 -- row path validated against the workspace contract (validateCandidateRow)
 	file, err := os.Open(name)
 	if err != nil {
 		return err
 	}
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 	opened, err := file.Stat()
 	if err != nil {
 		return err

package/engine/internal/lib/candidate_test.go

@@ -435,7 +435,7 @@ func TestCandidateIdentityRejectsSpecialFile(t *testing.T) {
 	if err != nil {
 		t.Skipf("Unix-domain sockets unavailable: %v", err)
 	}
-	defer listener.Close()
+	defer func() { _ = listener.Close() }()
 	if _, _, err := CandidateIdentity(root, "feature"); err == nil || !strings.Contains(err.Error(), "regular file") {
 		t.Fatalf("error=%v, want special-file rejection", err)
 	}

package/engine/internal/lib/environment_report.go

@@ -0,0 +1,109 @@
+package lib
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/devrites/devrites/internal/devritespaths"
+	"github.com/devrites/devrites/internal/version"
+)
+
+// PathProbe records whether one project-relative path exists.
+type PathProbe struct {
+	Path    string `json:"path"`
+	Present bool   `json:"present"`
+}
+
+// EnvironmentReport is a read-only snapshot of install and code-index presence.
+type EnvironmentReport struct {
+	EngineVersion string      `json:"engine_version"`
+	ProjectRoot   string      `json:"project_root"`
+	DevritesRoot  string      `json:"devrites_root,omitempty"`
+	Manifest      PathProbe   `json:"manifest"`
+	Indexes       []PathProbe `json:"indexes"`
+}
+
+func projectRootFromDevritesRoot(root string) string {
+	if root == "" {
+		wd, err := os.Getwd()
+		if err != nil {
+			return "."
+		}
+		return wd
+	}
+	if filepath.Base(root) == devritespaths.DevritesRootName {
+		return filepath.Dir(root)
+	}
+	return root
+}
+
+func probePath(projectRoot, rel string) PathProbe {
+	abs := filepath.Join(projectRoot, filepath.FromSlash(rel))
+	info, err := os.Stat(abs)
+	return PathProbe{Path: rel, Present: err == nil && info != nil}
+}
+
+// EnvironmentReportFor builds a report for one project root.
+func EnvironmentReportFor(devritesRoot, projectRoot string) (EnvironmentReport, error) {
+	if projectRoot == "" {
+		projectRoot = projectRootFromDevritesRoot(devritesRoot)
+	}
+	abs, err := filepath.Abs(projectRoot)
+	if err != nil {
+		return EnvironmentReport{}, err
+	}
+	report := EnvironmentReport{
+		EngineVersion: version.Version,
+		ProjectRoot:   abs,
+		Manifest:      probePath(abs, devritespaths.ManifestName),
+		Indexes: []PathProbe{
+			probePath(abs, ".codegraph"),
+			probePath(abs, ".code-review-graph"),
+			probePath(abs, ".codebase-memory"),
+		},
+	}
+	if devritesRoot != "" {
+		report.DevritesRoot = devritesRoot
+	}
+	return report, nil
+}
+
+// WriteEnvironmentReportJSON prints one JSON object to stdout.
+func WriteEnvironmentReportJSON(devritesRoot, projectRoot string, stdout io.Writer) error {
+	report, err := EnvironmentReportFor(devritesRoot, projectRoot)
+	if err != nil {
+		return fmt.Errorf("build environment report: %w", err)
+	}
+	enc := json.NewEncoder(stdout)
+	enc.SetIndent("", "  ")
+	if err := enc.Encode(report); err != nil {
+		return fmt.Errorf("encode environment report: %w", err)
+	}
+	return nil
+}
+
+// RunEnvironmentCheck implements `devrites-engine check indexes`.
+func RunEnvironmentCheck(devritesRoot string, args []string, stdout, stderr io.Writer) int {
+	projectRoot := ""
+	for i := 0; i < len(args); i++ {
+		if args[i] == "--root" {
+			if i+1 >= len(args) {
+				fmt.Fprintln(stderr, "indexes: --root requires a path")
+				return 2
+			}
+			projectRoot = args[i+1]
+			i++
+			continue
+		}
+		fmt.Fprintf(stderr, "indexes: unexpected argument %q\n", args[i])
+		return 2
+	}
+	if err := WriteEnvironmentReportJSON(devritesRoot, projectRoot, stdout); err != nil {
+		fmt.Fprintf(stderr, "indexes: %v\n", err)
+		return 2
+	}
+	return 0
+}

package/engine/internal/lib/environment_report_test.go

@@ -0,0 +1,54 @@
+package lib
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/devrites/devrites/internal/devritespaths"
+)
+
+func TestEnvironmentReportForDetectsManifestAndIndexes(t *testing.T) {
+	project := t.TempDir()
+	root := filepath.Join(project, devritespaths.DevritesRootName)
+	manifestPath := filepath.Join(project, devritespaths.ManifestName)
+	if err := os.MkdirAll(filepath.Dir(manifestPath), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(manifestPath, []byte("devrites\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(project, ".codegraph"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	report, err := EnvironmentReportFor(root, project)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if report.ProjectRoot != project {
+		t.Fatalf("project root = %q, want %q", report.ProjectRoot, project)
+	}
+	if !report.Manifest.Present {
+		t.Fatal("expected manifest present")
+	}
+	if len(report.Indexes) != 3 {
+		t.Fatalf("indexes = %d, want 3", len(report.Indexes))
+	}
+	if !report.Indexes[0].Present {
+		t.Fatalf("expected .codegraph present, got %+v", report.Indexes)
+	}
+}
+
+func TestRunEnvironmentCheckWritesJSON(t *testing.T) {
+	project := t.TempDir()
+	var stdout, stderr bytes.Buffer
+	if code := RunEnvironmentCheck("", []string{"--root", project}, &stdout, &stderr); code != 0 {
+		t.Fatalf("code=%d stderr=%q", code, stderr.String())
+	}
+	if !strings.Contains(stdout.String(), `"engine_version"`) || !strings.Contains(stdout.String(), `"manifest"`) {
+		t.Fatalf("stdout=%q", stdout.String())
+	}
+}

package/engine/internal/lib/migrate.go

@@ -88,6 +88,7 @@ func Migrate(root string, args []string, stdout, stderr io.Writer) int {
 	var exit int
 	var result string
 	err = state.WithFeatureLock(root, slug, func() error {
+		// #nosec G304 -- workspace ledger path resolved from the operator root
 		raw, err := os.ReadFile(ledger)
 		if err != nil {
 			return err

package/engine/internal/lib/open_visual.go

@@ -77,7 +77,9 @@ func OpenVisual(root string, args []string, stdout, stderr io.Writer) int {
 	var idReport VisualIDConsistency
 	idsChecked := false
 	if !outlineMissing {
+		// #nosec G304 -- visual evidence files inside the workspace
 		htmlBody, herr := os.ReadFile(htmlPath)
+		// #nosec G304 -- visual evidence files inside the workspace
 		outlineBody, oerr := os.ReadFile(outlinePath)
 		switch {
 		case herr != nil:
@@ -239,12 +241,15 @@ func openLocalFile(path string) error {
 	switch runtime.GOOS {
 	case "darwin":
 		// argv only — no shell.
+		// #nosec G204 -- fixed platform opener; path passed as argv, no shell
 		cmd = exec.Command("open", path)
 	case "windows":
 		// Avoid cmd.exe /c shell composition; FileProtocolHandler takes one path argv.
+		// #nosec G204 -- fixed platform opener; path passed as argv, no shell
 		cmd = exec.Command("rundll32.exe", "url.dll,FileProtocolHandler", path)
 	default:
 		// argv only — no shell.
+		// #nosec G204 -- fixed platform opener; path passed as argv, no shell
 		cmd = exec.Command("xdg-open", path)
 	}
 	if err := cmd.Start(); err != nil {

package/engine/internal/lib/resolve.go

@@ -98,6 +98,7 @@ func resolveMutation(mode, qid, payload, qfile, sfile string, stdout, stderr io.
 		fmt.Fprintf(stdout, "Reason:   %s\n", payload)
 		fmt.Fprintf(stdout, "Workspace: questions.md + state.md updated.\n")
 	case "batch":
+		// #nosec G304 -- operator-passed --batch file argument
 		data, err := os.ReadFile(payload)
 		if err != nil {
 			return fail(stderr, "Batch file not found: "+payload, 5)
@@ -188,6 +189,7 @@ func nowUTC() string { return clockNow().UTC().Format("2006-01-02T15:04:05Z") }
 // status, answer, and answered-at time in one pass. Returns 0, or 3 (qid
 // not found) / 4 (qid not open), writing the message on failure.
 func resolveQuestion(qfile, qid, status, answer string, stderr io.Writer) int {
+	// #nosec G304 -- questions.md path inside the feature workspace
 	data, err := os.ReadFile(qfile)
 	if err != nil {
 		return fail(stderr, "questions.md missing at "+qfile, 2)
@@ -284,6 +286,7 @@ var (
 // running, clears the Next step, and appends a Log entry. It is a no-op when the
 // workspace is not waiting on this question.
 func clearAwaiting(sfile, qid string) error {
+	// #nosec G304 -- state.md path inside the feature workspace
 	data, err := os.ReadFile(sfile)
 	if err != nil {
 		return fmt.Errorf("read state %s: %w", sfile, err)

package/engine/internal/lib/secretscan.go

@@ -385,6 +385,7 @@ func scanWorktreePaths(project string, paths []string, budget *secretScanBudget)
 		if info.Size() < 0 || info.Size() > budget.bytesRemaining {
 			return nil, errSecretScanLimit
 		}
+		// #nosec G304 -- workspace walk; size budget checked above
 		file, err := os.Open(fullPath)
 		if err != nil {
 			return nil, err

package/engine/internal/lib/skilltrust.go

@@ -68,11 +68,12 @@ func ScanSkillTrust(path string) (SkillTrustResult, error) {
 	if info.Size() > 1<<20 {
 		return SkillTrustResult{}, fmt.Errorf("skill-trust: %q exceeds 1 MiB limit", path)
 	}
+	// #nosec G304 -- installed skill file; 1 MiB cap checked above
 	file, err := os.Open(path)
 	if err != nil {
 		return SkillTrustResult{}, err
 	}
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 	raw, err := io.ReadAll(io.LimitReader(file, 1<<20+1))
 	if err != nil {
 		return SkillTrustResult{}, err

package/engine/internal/lib/util.go

@@ -65,6 +65,7 @@ func runGitCommandIO(dir string, env []string, input []byte, stdout io.Writer, a
 	ctx, cancel := context.WithTimeout(context.Background(), gitCommandTimeout)
 	defer cancel()
 	commandArgs := append([]string{"-C", dir}, args...)
+	// #nosec G204 -- git -C <operator repo dir>; fixed binary, sanitized env
 	cmd := exec.CommandContext(ctx, "git", commandArgs...)
 	cmd.WaitDelay = 2 * time.Second
 	if input != nil {

package/engine/internal/lib/workspace_read.go

@@ -21,6 +21,7 @@ func readWorkspaceArtifact(root, slug, name string) ([]byte, error) {
 	if info.Size() > 1<<20 {
 		return nil, fmt.Errorf("task-graph: %s exceeds 1 MiB limit", name)
 	}
+	// #nosec G304 -- workspace task-graph file; 1 MiB cap checked above
 	raw, err := os.ReadFile(path)
 	if err != nil {
 		return nil, fmt.Errorf("task-graph: cannot read %s: %w", name, err)

package/engine/internal/markdowntext/markdowntext_fuzz_test.go

@@ -0,0 +1,36 @@
+package markdowntext
+
+import (
+	"bytes"
+	"testing"
+	"unicode/utf8"
+)
+
+func FuzzStructural(f *testing.F) {
+	f.Add([]byte("# Title\n\n```go\nfmt.Println()\n```\n"))
+	f.Add([]byte("~~~\nunclosed fence\n"))
+	f.Add([]byte("   ```\n  ~~~\n"))
+	f.Add([]byte("code ``` inline\n| not | a | fence |\n"))
+	f.Add([]byte("line\r\nwith\r\ncrlf\r\n"))
+	f.Add([]byte("\xff\xfe invalid utf8 \x00"))
+	f.Add([]byte(""))
+	f.Fuzz(func(t *testing.T, input []byte) {
+		out, err := Structural(input)
+		if err != nil {
+			if utf8.Valid(input) && bytes.IndexByte(input, 0) < 0 {
+				t.Fatalf("Structural rejected input without malformed UTF-8 or NUL: %v", err)
+			}
+			return
+		}
+		if len(out) != len(input) {
+			t.Fatalf("Structural changed length: %d -> %d", len(input), len(out))
+		}
+		if !utf8.Valid(out) {
+			t.Fatal("Structural emitted invalid UTF-8")
+		}
+		stable, err := Structural(out)
+		if err != nil || !bytes.Equal(stable, out) {
+			t.Fatal("Structural is not idempotent")
+		}
+	})
+}

package/engine/internal/parallel/cli.go

@@ -225,6 +225,7 @@ func readJSONInput(path string, stdin io.Reader) ([]byte, error) {
 	if strings.Contains(path, "..") {
 		return nil, fmt.Errorf("json path must not contain '..'")
 	}
+	// #nosec G304 -- path traversal refused just above
 	return os.ReadFile(path)
 }
 

package/engine/internal/parallel/git.go

@@ -18,6 +18,7 @@ const gitTimeout = 60 * time.Second
 func git(repo string, args ...string) (string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), gitTimeout)
 	defer cancel()
+	// #nosec G204 -- git -C <worktree>; fixed binary, sanitized env
 	cmd := exec.CommandContext(ctx, "git", append([]string{"-C", repo}, args...)...)
 	env := append(gitenv.Sanitize(os.Environ()),
 		"GIT_TERMINAL_PROMPT=0",

package/engine/internal/parallel/lease.go

@@ -20,6 +20,9 @@ const (
 	WrightGreen   = "green"
 	WrightRed     = "red"
 	WrightGap     = "gap"
+
+	MinParallelSlices = 2
+	MaxParallelSlices = 10
 )
 
 var (
@@ -95,6 +98,13 @@ func validateSliceID(id string) error {
 	return nil
 }
 
+func checkParallelSliceCount(n int) error {
+	if n < MinParallelSlices || n > MaxParallelSlices {
+		return fmt.Errorf("parallel requires %d-%d slices (got %d)", MinParallelSlices, MaxParallelSlices, n)
+	}
+	return nil
+}
+
 func ValidateLease(lease *Lease) error {
 	if lease == nil {
 		return fmt.Errorf("lease is nil")
@@ -113,8 +123,8 @@ func ValidateLease(lease *Lease) error {
 	default:
 		return fmt.Errorf("invalid lease status %q", lease.Status)
 	}
-	if len(lease.Slices) < 2 || len(lease.Slices) > 3 {
-		return fmt.Errorf("lease must have 2 or 3 slices (got %d)", len(lease.Slices))
+	if err := checkParallelSliceCount(len(lease.Slices)); err != nil {
+		return err
 	}
 	if lease.N != len(lease.Slices) {
 		return fmt.Errorf("lease n=%d does not match slices=%d", lease.N, len(lease.Slices))
@@ -213,6 +223,7 @@ func WriteLease(path string, lease *Lease) error {
 }
 
 func ReadLease(path string) (*Lease, error) {
+	// #nosec G304 -- lease file under the engine-managed work dir
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return nil, err

package/engine/internal/parallel/ops.go

@@ -29,7 +29,7 @@ type CreateOpts struct {
 	Slices  []SlicePaths
 }
 
-// Create path-disjoint-gates, creates <=3 worktrees from base, and writes a running lease.
+// Create path-disjoint-gates, creates 2-10 worktrees from base, and writes a running lease.
 func Create(opts CreateOpts) (*Lease, error) {
 	if err := validateSlug(opts.Slug); err != nil {
 		return nil, err
@@ -37,8 +37,8 @@ func Create(opts CreateOpts) (*Lease, error) {
 	if err := validateBatchID(opts.BatchID); err != nil {
 		return nil, err
 	}
-	if len(opts.Slices) < 2 || len(opts.Slices) > 3 {
-		return nil, fmt.Errorf("create requires 2 or 3 slices (got %d)", len(opts.Slices))
+	if err := checkParallelSliceCount(len(opts.Slices)); err != nil {
+		return nil, err
 	}
 	if _, err := CheckPathDisjoint(opts.Slices, opts.Root); err != nil {
 		return nil, err

package/engine/internal/parallel/parallel_test.go

@@ -1,6 +1,7 @@
 package parallel
 
 import (
+	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -146,6 +147,109 @@ func TestCreateAbortCleanup(t *testing.T) {
 	}
 }
 
+func TestCreateAcceptsFourSlices(t *testing.T) {
+	t.Parallel()
+	repo, _ := setupRepo(t)
+	for _, name := range []string{"c.go", "d.go"} {
+		if err := os.WriteFile(filepath.Join(repo, "src", name), []byte("package main\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	gitOk(t, repo, "add", ".")
+	gitOk(t, repo, "commit", "-m", "more files")
+	base := gitOk(t, repo, "rev-parse", "HEAD")
+	lease, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    "demo-four",
+		BatchID: "batch4",
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go"}},
+			{ID: "slice-c", Paths: []string{"src/c.go"}},
+			{ID: "slice-d", Paths: []string{"src/d.go"}},
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if lease.N != 4 || len(lease.Slices) != 4 {
+		t.Fatalf("want 4 slices, got n=%d slices=%d", lease.N, len(lease.Slices))
+	}
+}
+
+func TestCreateRefusesCountOutsideBounds(t *testing.T) {
+	t.Parallel()
+	repo, base := setupRepo(t)
+	_, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    "demo-one",
+		BatchID: "batch1",
+		BaseSHA: base,
+		Slices:  []SlicePaths{{ID: "slice-a", Paths: []string{"src/a.go"}}},
+	})
+	if err == nil || !strings.Contains(err.Error(), "2-10 slices") {
+		t.Fatalf("expected 2-10 bound for N=1, got %v", err)
+	}
+
+	slices := make([]SlicePaths, MaxParallelSlices+1)
+	for i := range slices {
+		name := fmt.Sprintf("src/x%d.go", i)
+		if err := os.WriteFile(filepath.Join(repo, name), []byte("package main\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		slices[i] = SlicePaths{ID: fmt.Sprintf("s%d", i), Paths: []string{name}}
+	}
+	gitOk(t, repo, "add", ".")
+	gitOk(t, repo, "commit", "-m", "eleven")
+	base = gitOk(t, repo, "rev-parse", "HEAD")
+	_, err = Create(CreateOpts{
+		Root:    repo,
+		Slug:    "demo-eleven",
+		BatchID: "batch11",
+		BaseSHA: base,
+		Slices:  slices,
+	})
+	if err == nil || !strings.Contains(err.Error(), "2-10 slices") {
+		t.Fatalf("expected 2-10 bound for N=11, got %v", err)
+	}
+}
+
+func TestValidateLeaseBounds(t *testing.T) {
+	t.Parallel()
+	ok := validTestLease(MaxParallelSlices)
+	if err := ValidateLease(ok); err != nil {
+		t.Fatalf("N=%d should validate: %v", MaxParallelSlices, err)
+	}
+	tooMany := validTestLease(MaxParallelSlices + 1)
+	if err := ValidateLease(tooMany); err == nil || !strings.Contains(err.Error(), "2-10 slices") {
+		t.Fatalf("N=%d should refuse, got %v", MaxParallelSlices+1, err)
+	}
+}
+
+func validTestLease(n int) *Lease {
+	slices := make([]LeaseSlice, n)
+	for i := range slices {
+		id := fmt.Sprintf("s%d", i)
+		slices[i] = LeaseSlice{
+			ID:           id,
+			Paths:        []string{fmt.Sprintf("src/%s.go", id)},
+			WorktreePath: "/tmp/" + id,
+			Branch:       "devrites/parallel/x/batch/" + id,
+			WrightStatus: WrightPending,
+		}
+	}
+	return &Lease{
+		BatchID:             "batch1",
+		CreatedAt:           "2026-08-23T00:00:00Z",
+		BaseSHA:             "abcdef1",
+		N:                   n,
+		Status:              StatusRunning,
+		ControlPIDOrSession: "test",
+		Slices:              slices,
+	}
+}
+
 func TestCreateRefusesOverlap(t *testing.T) {
 	repo, base := setupRepo(t)
 	_, err := Create(CreateOpts{

package/engine/internal/parallel/pathdisjoint.go

@@ -32,6 +32,12 @@ func NormalizePath(raw string) (string, error) {
 	}
 	parts := make([]string, 0, strings.Count(path, "/")+1)
 	for part := range strings.SplitSeq(path, "/") {
+		// Edge whitespace on a segment would survive segment filtering and
+		// make normalization non-idempotent ("0\n." collapsing to "0\n"),
+		// so reject it outright like the other malformed shapes.
+		if trimmed := strings.TrimSpace(part); trimmed != part {
+			return "", fmt.Errorf("path segment must not have leading or trailing whitespace: %q", raw)
+		}
 		if part == "" || part == "." {
 			continue
 		}

package/engine/internal/parallel/pathdisjoint_fuzz_test.go

@@ -0,0 +1,43 @@
+package parallel
+
+import (
+	"strings"
+	"testing"
+)
+
+func FuzzPathDisjoint(f *testing.F) {
+	f.Add("src/a.go", []byte(`{"slices":[{"id":"a","paths":["src/a.go"]},{"id":"b","paths":["src/b.go"]}]}`))
+	f.Add("../escape", []byte(`[{"id":"a","paths":["/abs"]},{"id":"b","paths":[".devrites/state.md"]}]`))
+	f.Add("src\\windows.go", []byte(`{"slices":[{"id":"a","paths":["src", "src"]}]}`))
+	f.Add("src//double/", []byte(`not json`))
+	f.Add(".devrites", []byte(`{"slices":[]}`))
+	f.Fuzz(func(t *testing.T, raw string, doc []byte) {
+		normalized, err := NormalizePath(raw)
+		if err == nil {
+			if normalized == "" || strings.HasPrefix(normalized, "/") || strings.Contains(normalized, "\\") {
+				t.Fatalf("NormalizePath accepted %q into %q", raw, normalized)
+			}
+			for _, part := range strings.Split(normalized, "/") {
+				if part == "" || part == "." || part == ".." {
+					t.Fatalf("NormalizePath accepted %q into %q with bad segment %q", raw, normalized, part)
+				}
+			}
+			again, err := NormalizePath(normalized)
+			if err != nil || again != normalized {
+				t.Fatalf("NormalizePath not idempotent: %q -> %q (err %v)", normalized, again, err)
+			}
+		}
+
+		slices, err := ParseSlicesJSON(doc)
+		if err != nil {
+			return
+		}
+		ids, err := CheckPathDisjoint(slices, "")
+		if err != nil {
+			return
+		}
+		if len(ids) != len(slices) {
+			t.Fatalf("CheckPathDisjoint returned %d ids for %d slices", len(ids), len(slices))
+		}
+	})
+}

package/engine/internal/parallel/pathdisjoint_test.go

@@ -9,7 +9,10 @@ import (
 
 func TestNormalizePathRejectsDirty(t *testing.T) {
 	t.Parallel()
-	cases := []string{"", " ", "/", "/abs", `C:\windows`, `..`, "a/../b", "../x"}
+	cases := []string{"", " ", "/", "/abs", `C:\windows`, `..`, "a/../b", "../x",
+		// Segment-edge whitespace previously survived normalization
+		// ("0 /." collapsed to "0 "), making the mapping non-idempotent.
+		"0 /.", "src /a.go", "./ \n/x"}
 	for _, raw := range cases {
 		if _, err := NormalizePath(raw); err == nil {
 			t.Fatalf("NormalizePath(%q) should fail", raw)

package/engine/internal/parallel/testdata/fuzz/FuzzPathDisjoint/a449b81b4711b7b4

@@ -0,0 +1,3 @@
+go test fuzz v1
+string("0 /")
+[]byte("0")