independent-tests 0.1.0 → 0.2.0

package/bin/platform.mjs

@@ -0,0 +1,145 @@
+// What differs between macOS, Linux and Windows on the host, in one place,
+// so the rest reads the same on all three:
+//
+// - relative paths (manifest keys, test ids, toolchain.json paths, the
+//   paths a judge prints) always use "/", whatever the OS writes (`slash`);
+// - a command line string goes through the OS shell (`shellSync`): sh on
+//   macOS and Linux, cmd.exe on Windows, as npm runs a package's scripts;
+// - a command found on PATH honours PATHEXT, and npm's `.cmd` shims run
+//   through cmd.exe (`spawnCommand`), since Node refuses to spawn them
+//   directly;
+// - a process and everything it started is killed by its group on macOS
+//   and Linux (it was spawned `detached`) and by `taskkill /T` on Windows,
+//   where `detached` would open a console window instead (`GROUP`,
+//   `killTree`);
+// - a venv keeps its interpreter in bin/ or, on Windows, Scripts/.
+//
+// Claude Code's OS sandbox (and sandbox-exec, bwrap) exist on macOS and
+// Linux only: on Windows the sessions run with the file tools' deny rules
+// and the transcript audit, not an OS sandbox (`OS_SANDBOX`, lib.mjs
+// `sessionSettings`, backends.mjs `placement`).
+
+import { spawnSync } from "node:child_process";
+import { existsSync, statSync } from "node:fs";
+import { delimiter, dirname, extname, isAbsolute, join, sep } from "node:path";
+
+export const WINDOWS = process.platform === "win32";
+/** Whether this OS has a sandbox the sessions run under: macOS and Linux. */
+export const OS_SANDBOX = process.platform === "darwin" || process.platform === "linux";
+
+/** A relative path with "/" between its parts, on every OS. */
+export const slash = (path) => (sep === "/" ? path : path.split(sep).join("/"));
+/** `path` is `folder` or inside it; both absolute paths of this OS. */
+export const inside = (path, folder) =>
+  path === folder || path.startsWith(folder.endsWith(sep) ? folder : `${folder}${sep}`);
+
+/** The interpreter a venv holds, relative to the folder above `.venv`, with "/": `.venv/bin/python` or `.venv/Scripts/python.exe`. */
+export const venvBin = (name, venv = ".venv") =>
+  WINDOWS ? `${venv}/Scripts/${name}.exe` : `${venv}/bin/${name}`;
+/** The folder of a venv's executables, by name: `bin` or `Scripts`. */
+export const VENV_BIN_DIR = WINDOWS ? "Scripts" : "bin";
+/** The Python that starts a venv: `python3` on macOS and Linux; on Windows `python` (`python3` there is often the Store's stub). */
+export const DEFAULT_PYTHON = WINDOWS ? "python" : "python3";
+
+/** The PATH key of an environment: Windows keeps it as `Path`, and two spellings in one environment are undefined. */
+export const pathKey = (env) => Object.keys(env).find((key) => key.toUpperCase() === "PATH") ?? "PATH";
+/** `env` with `dirs` first on its PATH. */
+export function prependPath(env, dirs) {
+  const key = pathKey(env);
+  return { ...env, [key]: [...dirs, env[key]].filter(Boolean).join(delimiter) };
+}
+
+/**
+ * The first `name` on PATH, or null: `command -v` on every OS. On Windows
+ * each PATHEXT extension is tried, `.exe` and `.cmd` among them; a name
+ * with a folder in it is only checked.
+ */
+export function which(name, env = process.env) {
+  const exts = WINDOWS && extname(name) === "" ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+  const isFile = (path) => {
+    try {
+      return statSync(path).isFile();
+    } catch {
+      return false;
+    }
+  };
+  if (isAbsolute(name) || name.includes("/") || name.includes(sep))
+    return exts.map((ext) => `${name}${ext}`).find(isFile) ?? null;
+  for (const dir of (env[pathKey(env)] ?? "").split(delimiter).filter(Boolean))
+    for (const ext of exts) if (isFile(join(dir, `${name}${ext}`))) return join(dir, `${name}${ext}`);
+  return null;
+}
+
+/** A command line string through the OS shell: sh on macOS and Linux, cmd.exe on Windows. */
+export const shellSync = (command, options = {}) =>
+  spawnSync(command, { windowsHide: true, ...options, shell: true });
+
+/** An argument quoted for cmd.exe, when it needs it. */
+const cmdQuote = (arg) => (/^[\w@.:/\\=,+-]+$/.test(arg) ? arg : `"${arg.replaceAll('"', '""')}"`);
+/**
+ * `[bin, argv, options]` to spawn `bin argv` with: unchanged on macOS and
+ * Linux; on Windows `bin` found on the PATH of `env`, and npm's `.cmd`
+ * shims (npx, npm, pnpm, corepack, node_modules/.bin/vitest) run through
+ * cmd.exe with each argument quoted.
+ */
+export function commandOf(bin, argv, env = process.env) {
+  if (!WINDOWS) return [bin, argv, {}];
+  const found = which(bin, env);
+  if (found === null || !/\.(cmd|bat)$/i.test(found)) return [found ?? bin, argv, { windowsHide: true }];
+  return [[cmdQuote(found), ...argv.map(cmdQuote)].join(" "), [], { windowsHide: true, shell: true }];
+}
+/** `spawnSync(bin, argv, options)` through `commandOf`: npm's shims run on Windows too. */
+export function spawnCommand(bin, argv, options = {}) {
+  const [file, args, extra] = commandOf(bin, argv, options.env);
+  return spawnSync(file, args, { ...options, ...extra });
+}
+
+/**
+ * Spawn options for a process whose whole tree `killTree` takes down: a
+ * process group leader on macOS and Linux; on Windows no console window,
+ * and taskkill finds the tree by parent.
+ */
+export const GROUP = WINDOWS ? { windowsHide: true } : { detached: true };
+/** Kills `pid` and everything it started (spawned with `GROUP`); quiet when it is gone. */
+export function killTree(pid) {
+  if (pid === undefined || pid === null) return;
+  if (WINDOWS) {
+    spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
+    return;
+  }
+  try {
+    process.kill(-pid, "SIGKILL");
+  } catch {}
+}
+
+/**
+ * Git for Windows' bash, which Claude Code's Bash tool runs on Windows:
+ * CLAUDE_CODE_GIT_BASH_PATH, else bin/bash.exe beside the git on PATH.
+ * Never System32's bash.exe, which starts WSL. Null when there is none.
+ */
+export function gitBash() {
+  const given = process.env.CLAUDE_CODE_GIT_BASH_PATH;
+  if (given && existsSync(given)) return given;
+  const git = which("git");
+  if (git === null) return null;
+  // <Git>/cmd/git.exe or <Git>/bin/git.exe or <Git>/mingw64/bin/git.exe.
+  for (let at = dirname(git); dirname(at) !== at; at = dirname(at)) {
+    const bash = join(at, "bin", "bash.exe");
+    if (existsSync(bash)) return bash;
+  }
+  return null;
+}
+
+/**
+ * Text as the transcript audit compares it: on Windows "\" (and JSON's
+ * "\\") as "/", Git Bash's `/c/` as `c:/`, and lower case, since a session
+ * may name one path in any of those forms. Unchanged elsewhere.
+ */
+export const comparable = WINDOWS
+  ? (text) =>
+      text
+        .replaceAll("\\\\", "/")
+        .replaceAll("\\", "/")
+        .replace(/(^|[\s"'=(:;])\/([a-z])\//gi, "$1$2:/")
+        .toLowerCase()
+  : (text) => text;

package/bin/run.mjs

@@ -28,6 +28,7 @@ import { existsSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import {
   AGENT,
+  backendOf,
   DEFAULT_MODEL,
   RUNS,
   args,
@@ -61,11 +62,12 @@ const git = (dir, ...argv) =>
 
 const { options, rest } = args();
 const runs = Number(options.runs ?? 1);
-// --backend runs the agent on another backend (lib.mjs `backendOf`); its
-// variant is the backend's name unless --model names a model.
-const backend = typeof options.backend === "string" ? options.backend : undefined;
+// --backend runs the agent on another backend (lib.mjs `backendOf`, by
+// default whichever agent the person has); its variant is the backend's
+// name unless --model names a model.
+const backend = backendOf({ backend: typeof options.backend === "string" ? options.backend : undefined, kind: "agent" });
 const model =
-  typeof options.model === "string" ? options.model : (backend ?? "claude-cli") === "claude-cli" ? DEFAULT_MODEL : undefined;
+  typeof options.model === "string" ? options.model : backend === "claude-cli" ? DEFAULT_MODEL : undefined;
 const noPublic = options["no-public"] === true;
 // --brief red-team briefs the agent with prompts/agent-red-team.md (pass the
 // public suite with the least general code; bin/red-team-audit.mjs), and its

package/bin/runners/boundary.mjs

@@ -39,6 +39,10 @@
 // JSON); the service's output is kept in memory, never written into the
 // tree, and its tail goes to stderr only when it did not become ready.
 // Exit code: the suite command's.
+//
+// On Windows a shell string runs through cmd.exe, the group is the
+// tether's process tree (`taskkill /T`), and there is no resident-memory
+// ceiling, only the heap cap.
 
 import { spawn, spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
@@ -59,9 +63,16 @@ const HEAP_MB = Number(process.env.INDEPENDENT_TESTS_TEST_HEAP_MB ?? 512);
 const MAX_RSS_MB = Number(process.env.INDEPENDENT_TESTS_TEST_MAX_RSS_MB ?? 1024);
 const LIFETIME_MS = Number(process.env.INDEPENDENT_TESTS_SERVICE_MINUTES ?? 30) * 60_000;
 const OUTPUT_CHARS = 4_000;
+const WINDOWS = process.platform === "win32";
 
-/** An argv array as given, a string through `sh -c`. */
-const argvOf = (command) => (Array.isArray(command) ? command : ["sh", "-c", command]);
+/** An argv array as given, a string through `sh -c` (cmd.exe on Windows). */
+const argvOf = (command) =>
+  Array.isArray(command) ? command : WINDOWS ? [process.env.ComSpec || "cmd.exe", "/d", "/s", "/c", command] : ["sh", "-c", command];
+/** Kills `pid`'s group (its tree on Windows). */
+const killGroup = (pid) => {
+  if (WINDOWS) spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
+  else process.kill(-pid, "SIGKILL");
+};
 
 // The tether: leader of its own group, the service a child in it. Its
 // argv[1] is the service's argv as JSON; its stdin is a pipe from this
@@ -71,19 +82,23 @@ const { spawn, spawnSync } = require("node:child_process");
 const [bin, ...argv] = JSON.parse(process.argv[1]);
 const maxMb = Number(process.argv[2]);
 const lifetime = Number(process.argv[3]);
+const windows = process.platform === "win32";
 const down = (why) => {
   if (why) process.stderr.write("\\n@@boundary " + why + "\\n");
-  try { process.kill(-process.pid, "SIGKILL"); } catch {}
+  try {
+    if (windows) spawnSync("taskkill", ["/pid", String(process.pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
+    else process.kill(-process.pid, "SIGKILL");
+  } catch {}
   process.exit(137);
 };
-const child = spawn(bin, argv, { stdio: ["ignore", "inherit", "inherit"] });
+const child = spawn(bin, argv, { stdio: ["ignore", "inherit", "inherit"], windowsHide: true });
 child.on("error", (error) => down("service did not start: " + error.message));
 child.on("exit", (code, signal) => down("service exited " + (signal ?? code)));
 process.stdin.on("end", () => down(null));
 process.stdin.on("close", () => down(null));
 process.stdin.resume();
 setTimeout(() => down("service killed after its time limit"), lifetime);
-setInterval(() => {
+if (!windows) setInterval(() => {
   const pids = (spawnSync("pgrep", ["-g", String(process.pid)], { encoding: "utf8" }).stdout || "").split("\\n").filter(Boolean);
   if (pids.length === 0) return;
   const rss = (spawnSync("ps", ["-o", "rss=", "-p", pids.join(",")], { encoding: "utf8" }).stdout || "").split(/\\s+/).filter(Boolean);
@@ -98,7 +113,7 @@ let inner = null;
 const takeDown = () => {
   if (tether === null) return;
   try {
-    process.kill(-tether.pid, "SIGKILL");
+    killGroup(tether.pid);
   } catch {}
   tether = null;
 };
@@ -162,7 +177,8 @@ if (config.service !== undefined) {
       NODE_OPTIONS: `${process.env.NODE_OPTIONS ?? ""} --max-old-space-size=${HEAP_MB}`.trim(),
     };
     tether = spawn(process.execPath, ["-e", TETHER, JSON.stringify(argvOf(start)), String(MAX_RSS_MB), String(LIFETIME_MS)], {
-      detached: true,
+      detached: !WINDOWS,
+      windowsHide: true,
       env: serviceEnv,
       stdio: ["pipe", "pipe", "pipe"],
     });
@@ -189,7 +205,10 @@ if (config.service !== undefined) {
   }
 }
 
-inner = spawn(bin, args, { env, stdio: ["ignore", "inherit", "inherit"] });
+// On Windows a bare name (npm, npx) is often a .cmd shim, which only cmd.exe runs.
+inner = WINDOWS && !/[\\/]|\.exe$/i.test(bin)
+  ? spawn([bin, ...args].map((arg) => (/^[\w@.:/\\=,+-]+$/.test(arg) ? arg : `"${arg.replaceAll('"', '""')}"`)).join(" "), { env, stdio: ["ignore", "inherit", "inherit"], shell: true, windowsHide: true })
+  : spawn(bin, args, { env, stdio: ["ignore", "inherit", "inherit"] });
 const code = await new Promise((resolve) => {
   inner.on("error", (error) => {
     console.error(`boundary: ${bin}: ${error.message}`);

package/bin/runners/guard.mjs

@@ -16,22 +16,24 @@
 // Input on stdin: { bin, argv, timeoutMs, maxRssMb }. Output: the child's
 // stdout and stderr, then one stderr line `@@guard {"reason", "peakMb"}`;
 // exit code the child's, or 137 when the guard killed it.
+//
+// On Windows the time limit kills the process tree (`taskkill /T`); there
+// is no resident-memory ceiling there, only the heap cap the callers set.
 
 import { spawn, spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
+import { GROUP, WINDOWS, commandOf, killTree } from "../platform.mjs";
 
 const { bin, argv, timeoutMs, maxRssMb = 1024 } = JSON.parse(readFileSync(0, "utf8"));
-const child = spawn(bin, argv, { stdio: ["ignore", "pipe", "pipe"], detached: true });
+const [file, args, options] = commandOf(bin, argv);
+const child = spawn(file, args, { stdio: ["ignore", "pipe", "pipe"], ...GROUP, ...options });
 child.stdout.pipe(process.stdout);
 child.stderr.pipe(process.stderr);
 let reason = null;
 let peakMb = 0;
-const killGroup = () => {
-  try {
-    process.kill(-child.pid, "SIGKILL");
-  } catch {}
-};
+const killGroup = () => killTree(child.pid);
 const groupRssMb = () => {
+  if (WINDOWS) return 0;
   const pids = (spawnSync("pgrep", ["-g", String(child.pid)], { encoding: "utf8" }).stdout ?? "").split("\n").filter(Boolean);
   if (pids.length === 0) return 0;
   const rss = (spawnSync("ps", ["-o", "rss=", "-p", pids.join(",")], { encoding: "utf8" }).stdout ?? "").split(/\s+/).filter(Boolean);

package/bin/runners/pytest.mjs

@@ -27,13 +27,14 @@ import { tmpdir } from "node:os";
 import { delimiter, dirname, isAbsolute, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 import { OUTPUT_CHARS, build, config, guardedSync, print } from "./shared.mjs";
+import { DEFAULT_PYTHON } from "../platform.mjs";
 
 export const REPORTER_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "template-python", "sandbox");
 
 const {
   suite,
   files,
-  python: pythonOption = "python3",
+  python: pythonOption = DEFAULT_PYTHON,
   build: command = null,
   args: extra = [],
   perFile = true,
@@ -43,7 +44,7 @@ const {
   pythonPath = [],
 } = config("node bin/runners/pytest.mjs '<json>'");
 const root = realpathSync(process.cwd());
-const python = pythonOption.includes("/") && !isAbsolute(pythonOption) ? join(root, pythonOption) : pythonOption;
+const python = /[\\/]/.test(pythonOption) && !isAbsolute(pythonOption) ? join(root, pythonOption) : pythonOption;
 const env = {
   ...process.env,
   PYTHONDONTWRITEBYTECODE: "1",

package/bin/runners/shared.mjs

@@ -10,8 +10,9 @@
 
 import { spawnSync } from "node:child_process";
 import { existsSync, realpathSync } from "node:fs";
-import { delimiter, dirname, join } from "node:path";
+import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { prependPath, shellSync, slash, spawnCommand } from "../platform.mjs";
 
 export const OUTPUT_CHARS = 4_000;
 
@@ -87,18 +88,19 @@ export function withBins(cwd) {
     if (existsSync(join(at, "node_modules", ".bin"))) bins.push(join(at, "node_modules", ".bin"));
     if (dirname(at) === at) break;
   }
-  return { ...process.env, PATH: [...bins, process.env.PATH].join(delimiter) };
+  return prependPath(process.env, bins);
 }
 
 /**
- * Runs the build: an argv array as given, a string through `sh -c` with the
- * repository's binaries on PATH, or nothing when it is null.
+ * Runs the build: an argv array as given, a string through the OS shell
+ * (sh, or cmd.exe on Windows, as npm runs scripts) with the repository's
+ * binaries on PATH, or nothing when it is null.
  */
 export function build(command, cwd) {
   if (command === null || command === undefined) return { compiled: true, compileOutput: "" };
   const run = Array.isArray(command)
-    ? spawnSync(command[0], command.slice(1), { cwd, encoding: "utf8" })
-    : spawnSync("sh", ["-c", command], { cwd, encoding: "utf8", env: withBins(cwd) });
+    ? spawnCommand(command[0], command.slice(1), { cwd, encoding: "utf8" })
+    : shellSync(command, { cwd, encoding: "utf8", env: withBins(cwd) });
   const compiled = run.status === 0;
   return {
     compiled,
@@ -113,7 +115,8 @@ export function build(command, cwd) {
  * ids in every staged tree, and the baseline would read them as regressions.
  */
 export function print(result) {
-  const roots = [...new Set([process.cwd(), realpathSync(process.cwd())].flatMap((path) => [path, path.replace(/^\/private\//, "/")]))].sort((a, b) => b.length - a.length);
+  const roots = [...new Set([process.cwd(), realpathSync(process.cwd())].flatMap((path) => [path, path.replace(/^\/private\//, "/"), slash(path)]))].sort((a, b) => b.length - a.length);
+
   for (const file of result.files)
     for (const test of file.tests) for (const root of roots) test.name = test.name.replaceAll(root, "<root>");
   const tests = result.files.flatMap((file) => file.tests);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "independent-tests",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Hidden, calibrated test suites for AI coding agents: a public suite the agent works against and a hidden suite it never sees that judges the result.",
   "keywords": [
     "ai-agents",
@@ -8,6 +8,8 @@
     "hidden-tests",
     "test-generation",
     "claude-code",
+    "codex",
+    "cursor",
     "evaluation",
     "acceptance-tests",
     "typescript",
@@ -46,11 +48,10 @@
     "RESULTS.md",
     "SKILL.md"
   ],
-  "engines": {
-    "node": ">=22.12.0"
+  "scripts": {
+    "test": "node test/smoke.mjs"
   },
-  "os": [
-    "darwin",
-    "linux"
-  ]
+  "engines": {
+    "node": "^20.19.0 || >=22.0.0"
+  }
 }

package/prompts/agent.md

@@ -10,7 +10,7 @@ Implement the specification in `spec.md`.
   `spec.md`, add at least one case whose inputs differ from every public
   test and from every example the spec writes down: other values, other
   sizes, other orders, other combinations. After `npm run build`,
-  `node --test "tests/own/**/*.test.js"` runs them.
+  `node sandbox/test.mjs tests/own` runs them.
 - Everything else (`tests/public/`, `sandbox/`, `package.json`,
   `tsconfig.json`, the lockfile) is harness, and a submission that changes
   any of it is rejected.

package/prompts/exec/agent.md

@@ -13,7 +13,7 @@ Implement the specification in `spec.md`: a command, `node src/cli.js`.
   each scenario in `spec.md`, add at least one case whose inputs differ from
   every public test and from every example the spec writes down: other
   values, other sizes, other orders, other combinations. After
-  `npm run build`, `node --env-file=sandbox.env --test "tests/own/**/*.test.js"`
+  `npm run build`, `node sandbox/test.mjs tests/own`
   runs them.
 - Everything else (`tests/public/`, `sandbox/`, `sandbox.env`,
   `package.json`, `tsconfig.json`, the lockfile) is harness, and a submission

package/prompts/http/agent.md

@@ -16,7 +16,7 @@ Implement the specification in `spec.md`: an HTTP service.
   callback parameter you take from them). For each scenario in `spec.md`, add
   at least one case whose inputs differ from every public test and from every
   example the spec writes down: other values, other sizes, other orders,
-  other combinations. `node sandbox/boundary.mjs -- node --test "tests/own/**/*.test.js"`
+  other combinations. `node sandbox/boundary.mjs -- node sandbox/test.mjs tests/own`
   runs them.
 - Everything else (`tests/public/`, `sandbox/`, `sandbox.env`,
   `package.json`, `tsconfig.json`, the lockfile) is harness, and a submission

package/template/package-lock.json

@@ -11,7 +11,7 @@
         "typescript": "5.9.3"
       },
       "engines": {
-        "node": ">=22.12.0"
+        "node": "^20.19.0 || >=22.0.0"
       }
     },
     "node_modules/typescript": {

package/template/package.json

@@ -4,12 +4,12 @@
   "private": true,
   "type": "module",
   "engines": {
-    "node": ">=22.12.0"
+    "node": "^20.19.0 || >=22.0.0"
   },
   "packageManager": "npm@10.9.2",
   "scripts": {
     "build": "tsc -p tsconfig.json",
-    "test": "npm run build && node --env-file=sandbox.env --test \"tests/public/**/*.test.js\""
+    "test": "npm run build && node sandbox/test.mjs"
   },
   "devDependencies": {
     "typescript": "5.9.3"

package/template/sandbox/run.mjs

@@ -9,7 +9,7 @@
 
 import { spawnSync } from "node:child_process";
 import { existsSync, readdirSync } from "node:fs";
-import { join, relative } from "node:path";
+import { join, relative, sep } from "node:path";
 
 const SUITES = { public: "tests/public", private: "tests/private" };
 const FILE_TIMEOUT_MS = 120_000;
@@ -71,7 +71,8 @@ const compiled = compile.status === 0;
 const files = listTests(dir)
   .sort()
   .map((source) => {
-    const file = relative(root, source);
+    // "/" on every OS: test ids are `file :: name`.
+    const file = relative(root, source).split(sep).join("/");
     const runtime = file.replace(/\.tsx?$/, ".js");
     if (!compiled) return { file, crashed: true, timedOut: false, tests: [] };
     const run = spawnSync(

package/template/sandbox/test.mjs

@@ -0,0 +1,30 @@
+// What `npm test` runs after the build: node:test over every compiled
+// tests/public/**/*.test.js, with sandbox.env loaded, its output as
+// node:test prints it. The files are listed here rather than globbed on
+// the command line: Node 20 takes no glob there, and Windows' shell
+// expands none.
+//
+//   node sandbox/test.mjs [folder]     default tests/public
+
+import { spawnSync } from "node:child_process";
+import { existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+
+const folder = process.argv[2] ?? join("tests", "public");
+
+function listTests(at) {
+  if (!existsSync(at)) return [];
+  return readdirSync(at, { withFileTypes: true }).flatMap((entry) => {
+    const path = join(at, entry.name);
+    if (entry.isDirectory()) return listTests(path);
+    return entry.name.endsWith(".test.js") ? [path] : [];
+  });
+}
+
+const files = listTests(folder).sort();
+if (files.length === 0) {
+  console.error(`No compiled tests under ${folder}/ (run the build first).`);
+  process.exit(1);
+}
+const run = spawnSync(process.execPath, ["--env-file=sandbox.env", "--test", ...files], { stdio: "inherit" });
+process.exitCode = run.status ?? 1;

package/template-python/README.md

@@ -12,7 +12,8 @@ part of a submission.
   one, present only where the grader stages it; `tests/own/` the agent's.
 - `python3 sandbox/run.py public` runs a suite and prints JSON;
   `python3 sandbox/compile_check.py` parses everything;
-  `.venv/bin/python -m pytest tests/own` runs pytest directly.
+  `.venv/bin/python -m pytest tests/own` (`.venv/Scripts/python` on
+  Windows) runs pytest directly.
 - `sandbox/independent_tests_reporter.py` is the pytest plugin both
   `sandbox/run.py` and `bin/runners/pytest.mjs` read results from. A test
   named `test_<kind>_<n>__...` is keyed to that spec scenario.

package/template-python/sandbox/run.py

@@ -4,7 +4,8 @@
 #
 #   python3 sandbox/run.py public|private|own
 #
-# Any python3 starts it; the suite runs on the project's .venv/bin/python,
+# Any python3 starts it; the suite runs on the project's .venv/bin/python
+# (.venv/Scripts/python.exe on Windows),
 # which holds pytest. The grader runs the same suites through
 # bin/runners/pytest.mjs, which this file cannot reach; the two must agree
 # on the shape. A file that fails before any test reports is `crashed`: it
@@ -27,7 +28,8 @@ if suite not in SUITES:
     print("usage: python3 sandbox/run.py public|private|own", file=sys.stderr)
     sys.exit(2)
 ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-PYTHON = os.path.join(ROOT, ".venv", "bin", "python")
+# Windows keeps a venv's interpreter in Scripts/.
+PYTHON = os.path.join(ROOT, ".venv", "Scripts", "python.exe") if os.name == "nt" else os.path.join(ROOT, ".venv", "bin", "python")
 if not os.path.exists(PYTHON):
     PYTHON = sys.executable
 directory = os.path.join(ROOT, SUITES[suite])
@@ -47,7 +49,7 @@ def list_tests(at):
         dirs[:] = [d for d in dirs if d != "__pycache__"]
         for name in files:
             if name.startswith("test_") and name.endswith(".py"):
-                found.append(os.path.relpath(os.path.join(base, name), ROOT))
+                found.append(os.path.relpath(os.path.join(base, name), ROOT).replace(os.sep, "/"))
     return sorted(found)