jules-orchestrator-kit 0.57.0 → 0.59.0

package/README.md

@@ -204,7 +204,7 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 * **Fail-Closed Security & Secret Redaction:** Evaluates explicit Deny rules before Allow rules against canonicalized, case-folded paths. Redacts high-entropy keys and base64-encoded credentials (such as Kubernetes `Secret` manifests).
 * **Complexity & Cost Router:** Zero-dependency heuristic classifier (`src/router.mjs`) routing mechanical tasks to lightweight models while reserving primary models for complex refactors, with a `node --check` syntax-verification gate that transparently escalates a FAST-tier result to the primary provider if it left broken JS on disk.
 * **Terminal UI & Diagnostic Matrix (`agentctl doctor`):** Interactive terminal dashboard, task sidecar manager, and automated transactional self-repair.
-* **Verified Test Suite:** Tested with **864 unit tests across 121 suites passing in < 15.0s**.
+* **Verified Test Suite:** Tested with **940 unit tests across 130 suites passing in < 15.0s**.
 
 <br/>
 
@@ -237,7 +237,7 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 | `doctor` | `agentctl doctor [--probe] [--json]` | Diagnostic check runner. `--probe` additionally starts the configured provider's CLI to confirm it answers, rather than only finding it on `PATH`. | `0` (Healthy), `1` (Failures) |
 | `queue` | `agentctl queue [--dag] [--concurrency <n>] [--dry-run] [--json]` | Consumes and executes task envelopes in `.agent/jules-queue/` with Kahn's DAG dependency resolution. Non-task files (manifests, `README.md`) are skipped, and `--dry-run` previews without moving anything. | `0` (Complete) |
 | `swarm` | `agentctl swarm [--json]` | Runs parallel multi-agent swarm across worker slots with PID liveness detection. | `0` (Complete) |
-| `check` / `gate` / `audit`| `agentctl check [--mode working-tree] [--fix] [--json] [--json-report <path>]` | Runs security, secret scanning, rules budget audit, and tiered verification gates (with declarative assertion support) against working tree or branch. | `0` (Approved), `1` (Budget/Arg), `3` (Scope), `4` (Verify), `5` (Diff >75K), `6` (Secret), `8` (Flaky) |
+| `check` / `gate` / `audit`| `agentctl check [--mode working-tree] [--fix] [--allow-protected] [--allow-test-modifications] [--json] [--json-report <path>]` | Runs security, secret scanning, rules budget audit, and tiered verification gates (with declarative assertion support) against working tree or branch. | `0` (Approved), `1` (Budget/Arg), `3` (Scope), `4` (Verify), `5` (Diff >75K), `6` (Secret), `8` (Flaky) |
 | `mutate` / `mutation` | `agentctl mutate [--min-score <n>] [--max-mutants <n>] [--cmd <testCmd>] [--json]` | Runs zero-dependency diff mutation testing harness on changed hunks with operator inversion and safety rollback. | `0` (Passed), `1` (Score Low) |
 | `coverage` | `agentctl coverage [--min <pct>] [--cmd <testCmd>] [--base <ref>] [--json]` | Runs native zero-dependency V8 diff coverage check against added diff lines. | `0` (Passed), `1` (Low Coverage) |
 | `probe` / `stability` | `agentctl probe [--repeat <n>] [--min <passRate>] [--cmd <testCmd>] [--json]` | Probes test suite flakiness across N consecutive iterations with oscillation detection. | `0` (Passed), `1` (Flaky) |
@@ -249,7 +249,7 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 | `resume` | `agentctl resume <sessionId> --response "<reply>"` | Streams engineer response back into active Google Jules warm session context window. | `0` (Resumed), `1` (Error) |
 | `test-gen` | `agentctl test-gen --title <t> --spec <s> [--run]` | Scaffolds falsifiable unit tests, verifies RED failure state, and locks test in `scope.deny`. | `0` (Scaffolded/Red) |
 | `dashboard` | `agentctl dashboard [port]` | Starts zero-dependency local HTTP telemetry and audit visualizer dashboard. | `0` (Running) |
-| `evidence` | `agentctl evidence <generate\|verify\|show>` | Generates, verifies, or prints SHA-256 cryptographic evidence manifests with test-tamper locking. | `0` (Verified), `1` (Tamper) |
+| `evidence` | `agentctl evidence <generate\|verify\|show>` | Generates, verifies, or prints SHA-256 evidence manifests (unkeyed digests: tamper-evident, not signed) with test-tamper locking. | `0` (Verified), `1` (Tamper) |
 | `flaky` | `agentctl flaky <status\|heal\|reset>` | Manages Wilson-quarantined tests (Exit Code 8) and dispatches automated anti-flakiness healing swarms. | `0` (Healed/Listed) |
 | `mcp` | `agentctl mcp` | Starts stdio Model Context Protocol (MCP) server for Claude, Cursor, and Antigravity. | `0` / Stdio stream |
 | `mcp init` | `agentctl mcp init [--target cursor\|vscode\|claude\|all]` | 1-click config scaffolding for Cursor (`.cursor/mcp.json`), VS Code tasks (`tasks.json`), and Claude Desktop. | `0` (Scaffolded) |

package/bin/agentctl.mjs

@@ -61,7 +61,7 @@ Commands:
   swarm                 Run parallel task swarm
   mcp                   Start stdio Model Context Protocol (MCP) server
   clean                 Clean stale branches, worktrees, locks, and ledgers
-  lock <action>         Manage mutex locks (acquire | release | status)
+  lock <action>         Manage mutex locks (acquire [--ttl <min>] [--pid <n>] | release | status)
   doctor                Run system diagnostics and stack resolution checks
   providers             List agent providers and whether this machine can reach them (--json)
   provider set <name>   Switch the active provider in .agent/config.yml
@@ -383,6 +383,12 @@ async function main() {
           committed: { type: "boolean" },
           fix: { type: "boolean" },
           "allow-protected": { type: "boolean" },
+          // The tamper guard has always had an override — `allowTestModifications`
+          // — and it was reachable only from JavaScript. So a legitimate change
+          // of spec, which necessarily rewrites what a test expects, hit a
+          // CRITICAL finding at exit 6 with no documented way past it. A guard
+          // with no override is not a guard, it is an outage.
+          "allow-test-modifications": { type: "boolean" },
           json: { type: "boolean", short: "j" },
           "json-report": { type: "string" },
           "dry-run": { type: "boolean", short: "d" },
@@ -402,6 +408,7 @@ async function main() {
         mode: selectedMode,
         fix: values.fix,
         allowProtected: values["allow-protected"],
+        allowTestModifications: values["allow-test-modifications"],
         jsonReport: values["json-report"],
       });
 
@@ -1278,14 +1285,46 @@ async function main() {
     case "lock": {
       const action = args[1];
       if (action === "acquire") {
-        const agent = args[2] || "agent";
-        const taskId = args[3] || "task-1";
-        const filePaths = args.slice(4);
-        const res = acquireLock(agent, taskId, filePaths, root);
+        // A lock taken from the command line outlives the command. The process
+        // that runs `lock acquire` writes the record and exits; the agent it
+        // speaks for is somewhere else entirely. So this is a time-bounded
+        // lease, not a pid the next acquire can test for liveness — that test
+        // always said "dead" and handed the same files to the next caller.
+        //
+        // `--pid` is the escape hatch for a caller that *does* have a durable
+        // process to point at: the lock then releases itself when that process
+        // dies, exactly as an in-process acquire does.
+        const flagIdx = args.findIndex((a, i) => i >= 2 && a.startsWith("--"));
+        const positional = flagIdx === -1 ? args.slice(2) : args.slice(2, flagIdx);
+        const { values } = parseArgs({
+          args: flagIdx === -1 ? [] : args.slice(flagIdx),
+          options: {
+            ttl: { type: "string" },
+            pid: { type: "string" },
+          },
+          allowPositionals: false,
+        });
+        const agent = positional[0] || "agent";
+        const taskId = positional[1] || "task-1";
+        const filePaths = positional.slice(2);
+        const ttlMinutes = Number(values.ttl);
+        const ownerPid = Number(values.pid);
+        const bindsToProcess = Number.isInteger(ownerPid) && ownerPid > 0;
+        const res = acquireLock(agent, taskId, filePaths, root, {
+          lease: !bindsToProcess,
+          ownerPid: bindsToProcess ? ownerPid : undefined,
+          ttlMs: Number.isFinite(ttlMinutes) && ttlMinutes > 0 ? ttlMinutes * 60_000 : undefined,
+        });
         if (res.ok) {
-          console.log(`✅ Acquired lock for ${taskId}`);
+          const held = filePaths.length ? ` (${filePaths.length} path${filePaths.length === 1 ? "" : "s"})` : "";
+          const until = bindsToProcess ? `bound to pid ${ownerPid}` : `expires ${new Date(Date.now() + (Number.isFinite(ttlMinutes) && ttlMinutes > 0 ? ttlMinutes : 120) * 60_000).toISOString()}`;
+          console.log(`✅ Acquired lock for ${taskId}${held} — ${until}`);
         } else {
-          console.log(`❌ Lock conflict detected: held by ${res.holder}`);
+          const overlap = Array.isArray(res.conflictingFiles) && res.conflictingFiles.length
+            ? `\n   Contested paths: ${res.conflictingFiles.join(", ")}`
+            : "";
+          const until = res.expiresAt ? `\n   Held until ${res.expiresAt} (or until \`agentctl lock release ${res.taskId}\`).` : "";
+          console.log(`❌ Lock conflict detected: held by ${res.holder} (task ${res.taskId})${overlap}${until}`);
           process.exit(1);
         }
       } else if (action === "release") {
@@ -2672,9 +2711,16 @@ async function main() {
         if (values.json) {
           console.log(JSON.stringify(res, null, 2));
         } else {
-          console.log(`\n🛡️ Cryptographic Evidence Manifest Generated!`);
+          // "Signature" was the wrong word and the wrong promise. There is no
+          // key anywhere in this system: the value is a SHA-256 digest of the
+          // manifest, so anyone who can write the file can also recompute it
+          // and have `evidence verify` agree. What it proves is that the
+          // manifest has not been edited *since* it was written — tamper
+          // evidence, not authorship. Calling that a signature invites an
+          // operator to trust it for something it cannot do.
+          console.log(`\n🛡️ Evidence Manifest Generated!`);
           console.log(`   Manifest ID : ${res.manifest.manifestId}`);
-          console.log(`   Signature   : ${res.manifest.evidenceHash}`);
+          console.log(`   Digest      : ${res.manifest.evidenceHash}`);
           console.log(`   Location    : ${res.manifestPath}`);
           console.log(`   Test Files  : ${res.manifest.testIntegrity.testFileCount}`);
           console.log(`   Tampered    : ${res.manifest.testIntegrity.tamperDetected ? "YES (FAILED)" : "NO (VERIFIED)"}\n`);
@@ -2690,7 +2736,7 @@ async function main() {
           if (res.ok) {
             console.log(`\n✅ Evidence Verification PASSED`);
             console.log(`   Manifest ID : ${res.manifestId}`);
-            console.log(`   Signature   : ${res.evidenceHash}\n`);
+            console.log(`   Digest      : ${res.evidenceHash}\n`);
           } else {
             console.error(`\n❌ Evidence Verification FAILED`);
             console.error(`   Reason      : ${res.reason}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.57.0",
+  "version": "0.59.0",
   "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents — Google Jules, Claude Code, Codex and Gemini CLI.",
   "repository": {
     "type": "git",

package/src/config.mjs

@@ -28,6 +28,34 @@ const DEFAULTS = {
   baseBranch: "main",
 };
 
+// A CI definition is code the forge runs with the repository's own
+// credentials, on the next push, without review. `.github/**` was the only one
+// listed, so the gate's answer depended on which forge the project happened to
+// use: an identical exfiltration job placed in `.gitlab-ci.yml` was approved
+// where `.github/workflows/x.yml` was rejected. A safety gate that is only
+// safe on GitHub is not a safety gate.
+const CI_DEFINITIONS = [
+  ".github/**",
+  ".gitlab-ci.yml",
+  "**/.gitlab-ci.yml",
+  ".gitlab/ci/**",
+  ".circleci/**",
+  "azure-pipelines.yml",
+  "azure-pipelines.yaml",
+  "**/azure-pipelines.yml",
+  "Jenkinsfile",
+  "**/Jenkinsfile",
+  ".travis.yml",
+  ".drone.yml",
+  "bitbucket-pipelines.yml",
+  ".buildkite/**",
+  ".woodpecker.yml",
+  ".woodpecker/**",
+  "appveyor.yml",
+  ".teamcity/**",
+  ".githooks/**",
+];
+
 export const BUILTIN_DENY = [
   ".git/**",
   "**/.env",
@@ -36,7 +64,7 @@ export const BUILTIN_DENY = [
   "**/*.key",
   "**/id_rsa*",
   ".agent/jules-queue/**",
-  ".github/**",
+  ...CI_DEFINITIONS,
 ];
 
 export const BUILTIN_PROTECT = [
@@ -59,6 +87,50 @@ export const BUILTIN_PROTECT = [
   "**/Makefile",
   "**/.npmrc",
   "**/.netrc",
+
+  // Build definitions that execute arbitrary code at install or build time.
+  // The same tier as package.json: legitimately edited, so not denied, but not
+  // edited quietly either.
+  "setup.py",
+  "**/setup.py",
+  "setup.cfg",
+  "**/setup.cfg",
+  "build.rs",
+  "**/build.rs",
+  "pom.xml",
+  "**/pom.xml",
+  "build.gradle",
+  "**/build.gradle",
+  "build.gradle.kts",
+  "**/build.gradle.kts",
+  "CMakeLists.txt",
+  "**/CMakeLists.txt",
+  "Gemfile",
+  "**/Gemfile",
+  "Dockerfile",
+  "**/Dockerfile",
+
+  // Test-runner configuration decides which tests run and what counts as a
+  // pass. Rewriting it is the cheapest way to make a suite green without
+  // touching a single assertion — `--passWithNoTests`, an added ignore
+  // pattern, a conftest.py fixture that stubs the thing under test — and the
+  // tamper guard reads test *files*, so none of it was visible to anything.
+  "conftest.py",
+  "**/conftest.py",
+  "pytest.ini",
+  "**/pytest.ini",
+  "tox.ini",
+  "**/tox.ini",
+  "jest.config.*",
+  "**/jest.config.*",
+  "vitest.config.*",
+  "**/vitest.config.*",
+  "**/.mocharc.*",
+  "karma.conf.*",
+  "**/karma.conf.*",
+  "phpunit.xml",
+  "**/phpunit.xml",
+  "**/.nycrc*",
 ];
 
 const BLOCKED_KEYS = new Set(["__proto__", "constructor", "prototype"]);

package/src/coverage.mjs

@@ -1,4 +1,5 @@
 import { readFileSync, readdirSync, mkdtempSync, rmSync, existsSync, realpathSync } from "node:fs";
+import { isTestPath } from "./test-paths.mjs";
 import { join, resolve, relative, isAbsolute } from "node:path";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
@@ -18,12 +19,7 @@ export function isExcludedFromCoverage(filePath = "") {
     norm.startsWith(".agent/") ||
     norm.startsWith(".github/") ||
     norm.startsWith(".git/") ||
-    norm.startsWith("test/") ||
-    norm.startsWith("tests/") ||
-    norm.includes("/__tests__/") ||
-    norm.includes(".test.") ||
-    norm.includes(".spec.") ||
-    norm.includes("_test.") ||
+    isTestPath(norm) ||
     norm.endsWith(".md") ||
     norm.endsWith(".json") ||
     norm.endsWith(".yml") ||

package/src/engine.mjs

@@ -1,4 +1,5 @@
 import { loadConfig, parseYaml, normalizeScope } from "./config.mjs";
+import { isTestPath } from "./test-paths.mjs";
 import { checkScope, scanDiff, scanBinaryPayloads, redactSecrets } from "./security.mjs";
 import { changedFiles, diffBytes, diffText, binaryDiffEntries, symlinkChanges, showFromOrigin, runCmd } from "./git.mjs";
 import { createProvider, ProviderRateLimitError, ProviderUnavailableError } from "./provider.mjs";
@@ -274,7 +275,7 @@ export async function gate(opts = {}) {
   }
 
   // Phase 3: Diff Secret Scanner & Security Checks
-  const secretResult = scanDiff(diffStr, { root });
+  const secretResult = scanDiff(diffStr, { root, allowTestModifications: opts.allowTestModifications === true });
   // A binary file reaches the scanner as one summary line, so its contents were
   // never looked at — a NUL byte in front of a token was enough to hide it.
   // Inspect those files directly and fold the verdict in.
@@ -494,10 +495,7 @@ export async function gate(opts = {}) {
   const postTestHash = postTestHashResult.treeHash;
   let testTampered = false;
   if (config.evidence?.strictTestLock && !opts.allowTestModifications && preTestHashResult.fileCount > 0) {
-    const changedTestFile = files.find((f) => {
-      const lower = f.toLowerCase();
-      return lower.startsWith("test/") || lower.startsWith("tests/") || lower.includes(".test.") || lower.includes(".spec.");
-    });
+    const changedTestFile = files.find((f) => isTestPath(f));
     if (changedTestFile && preTestHash !== postTestHash) {
       testTampered = true;
     }

package/src/evidence.mjs

@@ -14,6 +14,7 @@ import {
 import { join, resolve, relative, isAbsolute, sep, extname } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import { execSync } from "node:child_process";
+import { isTestPath } from "./test-paths.mjs";
 
 /**
  * Normalizes file path to POSIX slashes.
@@ -54,6 +55,30 @@ export function computeFileHash(filePath) {
  * @param {string} [baseDir]
  * @returns {string[]}
  */
+/**
+ * Directories whose contents a build or a test run regenerates.
+ *
+ * These are not hashed. The test-integrity hash is taken before and after the
+ * verification command and any difference is reported as tampering — so a
+ * runner that writes its own cache *inside* the test tree accused itself. That
+ * is exactly what pytest does: it drops `tests/__pycache__/*.pyc` on first
+ * collection, the post-run hash no longer matched the pre-run hash, and every
+ * Python project on earth failed the gate with "test files changed during the
+ * run". A false accusation of tampering is worse than a missed one; it teaches
+ * the user to pass --allow-test-modifications by reflex.
+ */
+const ARTIFACT_DIRS = new Set([
+  ".git", "node_modules", "target", "vendor",
+  "__pycache__", ".pytest_cache", ".mypy_cache", ".ruff_cache", ".tox",
+  ".venv", "venv", ".gradle", ".nyc_output", "coverage", "htmlcov",
+  ".next", ".nuxt", ".turbo", ".cache", ".parcel-cache",
+]);
+
+/** Compiled output. Regenerated from the sources that are hashed instead. */
+const ARTIFACT_EXTENSIONS = new Set([
+  ".pyc", ".pyo", ".pyd", ".class", ".o", ".obj", ".so", ".dll", ".dylib", ".exe", ".log",
+]);
+
 export function findFilesRecursively(dir, baseDir = dir) {
   if (!existsSync(dir)) return [];
   const results = [];
@@ -61,12 +86,11 @@ export function findFilesRecursively(dir, baseDir = dir) {
     const entries = readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
       const fullPath = join(dir, entry.name);
-      if (entry.name === ".git" || entry.name === "node_modules" || entry.name === "target" || entry.name === "vendor") {
-        continue;
-      }
+      if (ARTIFACT_DIRS.has(entry.name)) continue;
       if (entry.isDirectory()) {
         results.push(...findFilesRecursively(fullPath, baseDir));
       } else if (entry.isFile()) {
+        if (ARTIFACT_EXTENSIONS.has(extname(entry.name).toLowerCase())) continue;
         results.push(normalizePath(relative(baseDir, fullPath)));
       }
     }
@@ -141,20 +165,7 @@ export function computeDirectoryHash(root, options = {}) {
 
   // Filter test files if specifically looking for test suites
   if (options.testOnly) {
-    fileList = fileList.filter((f) => {
-      const lower = f.toLowerCase();
-      return (
-        lower.startsWith("test/") ||
-        lower.startsWith("tests/") ||
-        lower.startsWith("__tests__/") ||
-        lower.startsWith("spec/") ||
-        lower.includes(".test.") ||
-        lower.includes(".spec.") ||
-        lower.includes("_test.") ||
-        lower.endsWith("test.sol") ||
-        lower.endsWith(".t.sol")
-      );
-    });
+    fileList = fileList.filter((f) => isTestPath(f));
   }
 
   const fileHashes = {};
@@ -579,7 +590,7 @@ export function generateEvidenceMarkdown(manifest) {
   const lines = [
     "### 🛡️ Autonomous Verification & Evidence Proof",
     "",
-    `> **Evidence Manifest**: \`${manifest.manifestId}\` | **Signature**: \`${manifest.evidenceHash?.slice(0, 16)}...\``,
+    `> **Evidence Manifest**: \`${manifest.manifestId}\` | **Digest**: \`${manifest.evidenceHash?.slice(0, 16)}...\``,
     "",
     "| Gate / Policy | Status | Evidence Record |",
     "| :--- | :---: | :--- |",

package/src/git.mjs

@@ -1,5 +1,5 @@
 import { execFileSync, execSync } from "node:child_process";
-import { readFileSync, existsSync, statSync, readlinkSync } from "node:fs";
+import { readFileSync, existsSync, statSync, lstatSync, readlinkSync } from "node:fs";
 import { join, delimiter } from "node:path";
 import { normalizePath, canonicalizePath } from "./config.mjs";
 
@@ -382,6 +382,25 @@ export function diffText(root = process.cwd(), base = "main", mode = "committed"
     for (const file of untrackedFiles) {
       try {
         const fullPath = join(root, file);
+
+        // A symlink is its target *path*, never its target's contents — that is
+        // how git stores one and how `git diff` renders one. Reading through
+        // the link instead pulled whatever it pointed at into the diff, so
+        // `ln -s /etc/passwd notes.md` shipped that file's contents to the
+        // provider as ordinary added lines under an innocent name. Emit the
+        // link the way a committed symlink is emitted, and let checkScope judge
+        // the target it resolves to.
+        let linkStat = null;
+        try {
+          linkStat = lstatSync(fullPath);
+        } catch (_) {}
+        if (linkStat && linkStat.isSymbolicLink()) {
+          const target = readlinkSync(fullPath);
+          untrackedDiff += `\ndiff --git a/${file} b/${file}\nnew file mode 120000\n--- /dev/null\n+++ b/${file}\n`;
+          untrackedDiff += `@@ -0,0 +1 @@\n+${target}\n\\n`;
+          continue;
+        }
+
         if (existsSync(fullPath)) {
           const content = readFileSync(fullPath, "utf-8");
           const addedLines = content.split(/\r?\n/);
@@ -502,17 +521,48 @@ export function symlinkChanges(root = process.cwd(), base = "main", mode = "comm
     }
     if (!target) continue;
 
-    const linkDir = normalizePath(entry.file).split("/").slice(0, -1).join("/");
-    const resolved = normalizePath(target).startsWith("/")
-      ? normalizePath(target)
-      : canonicalizePath(linkDir ? `${linkDir}/${target}` : target);
+    results.push({ link: entry.file, target: resolveLinkTarget(entry.file, target) });
+  }
 
-    results.push({ link: entry.file, target: resolved });
+  // An untracked symlink appears in no `git diff --raw` at all, so in
+  // working-tree mode — the default for `agentctl check` — the loop above sees
+  // nothing. `ln -s /etc/os-release leak.txt` therefore reached checkScope as
+  // the plain name `leak.txt` and passed; committing the identical link to a
+  // branch and checking that was caught. The gate's answer must not depend on
+  // whether the attacker ran `git add`.
+  if (mode === "working-tree" || mode === "working") {
+    const untrackedRaw =
+      git(["-c", "core.quotePath=false", "ls-files", "-z", "--others", "--exclude-standard"], {
+        cwd: root,
+        raw: true,
+        ignoreError: true,
+      }) || "";
+    for (const rel of untrackedRaw.split("\0").map(normalizePath).filter(Boolean)) {
+      if (seen.has(rel)) continue;
+      let target = "";
+      try {
+        if (!lstatSync(join(root, rel)).isSymbolicLink()) continue;
+        target = readlinkSync(join(root, rel));
+      } catch (_) {
+        continue;
+      }
+      if (!target) continue;
+      seen.add(rel);
+      results.push({ link: rel, target: resolveLinkTarget(rel, target) });
+    }
   }
 
   return results;
 }
 
+/** Where a symlink at `link` pointing at `target` lands, as a repo-relative or absolute path. */
+function resolveLinkTarget(link, target) {
+  const linkDir = normalizePath(link).split("/").slice(0, -1).join("/");
+  return normalizePath(target).startsWith("/")
+    ? normalizePath(target)
+    : canonicalizePath(linkDir ? `${linkDir}/${target}` : target);
+}
+
 export function binaryDiffEntries(root = process.cwd(), base = "main", mode = "committed") {
   const entries = new Map();
   for (const entry of parseRawDiff(root, base, mode)) {

package/src/mutation.mjs

@@ -1,4 +1,5 @@
 import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { isTestPath } from "./test-paths.mjs";
 import { resolve, isAbsolute } from "node:path";
 import { createHash } from "node:crypto";
 import { diffText, runCmd } from "./git.mjs";
@@ -195,14 +196,7 @@ export function isExcludedFromMutation(filePath = "") {
   const normalized = filePath.replace(/\\/g, "/").toLowerCase();
 
   // Exclude test files
-  if (
-    normalized.includes(".test.") ||
-    normalized.includes(".spec.") ||
-    normalized.includes("_test.") ||
-    normalized.includes("/test/") ||
-    normalized.includes("/tests/") ||
-    normalized.includes("/__tests__/")
-  ) {
+  if (isTestPath(normalized)) {
     return true;
   }