probatio 0.0.3 → 0.0.5

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Aron Amos
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,6 +1,6 @@
 # Probatio
 
-Probatio (Latin: a testing, a proof) is a free, open-source testing toolkit built for AI agents
+Probatio (Latin: a testing, a proof) is a free testing toolkit under the MIT license, built for AI agents
 (Claude, Grok, ChatGPT, others), working alone or as swarms. Every claim it makes is checkable;
 it remembers what was fixed so agents with small context do not redo or undo work; and it finds
 the bugs a test suite would miss instead of asking anyone to read more tests.

package/dist/cli.js

@@ -10,6 +10,7 @@ import { appendFinding, chooseSealed, fixGap, guardAllows, lineHash, loadState,
 import { git } from "./mutate/patch.js";
 import { generateMutants } from "./mutate/generate.js";
 import { runMutants } from "./mutate/run.js";
+import { LABEL_LEAK_SUMMARY, labelLeaked, readSealedLabel } from "./mutate/sealed.js";
 import { generateNext } from "./mutate/suite-decision.js";
 import { discoverSuite } from "./mutate/suites.js";
 import { tallyRun } from "./mutate/tally.js";
@@ -23,6 +24,8 @@ try {
         finish(await generateCommand(parsed.flags), parsed.human);
     if (group === "mutate" && action === "run")
         finish(await runCommand(parsed.flags), parsed.human);
+    if (group === "mutate" && action === "sealed")
+        finish(await sealedCommand(parsed.flags), parsed.human);
     if (group === "mutate" && action === "tally")
         finish(tallyCommand(parsed.flags), parsed.human);
     if (group === "ledger" && action === "build")
@@ -72,7 +75,7 @@ function usage(ok, summary) {
         ok,
         command: "mutate.help",
         summary,
-        next: "probatio mutate generate writes operator mutants. probatio mutate run confirms each kill twice. probatio mutate tally reads a finished run and does not delete a test. probatio ledger build reverts fix commits. probatio matrix report reads a recorded score table.",
+        next: "probatio mutate generate writes operator mutants. probatio mutate run confirms each kill twice. probatio mutate sealed runs one forward bug and keeps the label file out of the report. probatio mutate tally reads a finished run and does not delete a test. probatio ledger build reverts fix commits. probatio matrix report reads a recorded score table.",
         nextCall: null,
     };
 }
@@ -129,7 +132,7 @@ async function generateCommand(flags) {
         full: path.join(patches, "mutants.json"),
     };
 }
-async function runCommand(flags) {
+async function runCommand(flags, hide = null) {
     const packageDir = path.resolve(requireText(flags, "package"));
     const patchDirs = texts(flags, "patches").map((dir) => path.resolve(dir));
     if (patchDirs.length === 0)
@@ -168,6 +171,7 @@ async function runCommand(flags) {
         timeoutMultiple: int(flags, "timeout-multiple") ?? 5,
         timeoutFloorMs: int(flags, "timeout-floor-ms") ?? 20_000,
         budgetMs: int(flags, "budget-ms") ?? null,
+        hide,
         onProgress: (line) => process.stderr.write(`${line}\n`),
     });
     const resume = report.budgetHit
@@ -203,6 +207,22 @@ async function runCommand(flags) {
 function tallyCommand(flags) {
     return tallyRun(path.resolve(requireText(flags, "out")));
 }
+async function sealedCommand(flags) {
+    const label = readSealedLabel(path.resolve(requireText(flags, "label")));
+    const hide = texts(flags, "hide");
+    const report = await runCommand(flags, hide);
+    const body = JSON.stringify(report);
+    if (!labelLeaked(body, label))
+        return report;
+    return {
+        schemaVersion: SCHEMA_VERSION,
+        ok: false,
+        command: "mutate.sealed",
+        summary: LABEL_LEAK_SUMMARY,
+        next: "Keep the label in its own file. Run the same command again.",
+        nextCall: null,
+    };
+}
 async function ledgerCommand(flags) {
     const packageDir = path.resolve(requireText(flags, "package"));
     const outDir = path.resolve(requireText(flags, "out"));

package/dist/mutate/csharp-coverage.js

@@ -0,0 +1,161 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+/**
+ * One Coverlet run per test name. The collector's report does not name the test,
+ * so each name gets its own results directory.
+ */
+export function writeCsharpCoverage(pkg, testNames, dest, project) {
+    const names = [...new Set(testNames.map((name) => name.trim()).filter((name) => name.length > 0))];
+    if (names.length === 0)
+        return { ok: false, detail: "csharp coverage: no test names" };
+    const work = path.join(path.dirname(dest), "csharp-cover");
+    mkdirSync(work, { recursive: true });
+    const settings = path.join(work, "coverlet.runsettings");
+    // Coverlet skips the test assembly unless asked. A one-project suite keeps the code there.
+    writeFileSync(settings, [
+        '<?xml version="1.0" encoding="utf-8"?>',
+        "<RunSettings>",
+        "  <DataCollectionRunSettings>",
+        "    <DataCollectors>",
+        '      <DataCollector friendlyName="XPlat Code Coverage">',
+        "        <Configuration>",
+        "          <Format>cobertura</Format>",
+        "          <IncludeTestAssembly>true</IncludeTestAssembly>",
+        "        </Configuration>",
+        "      </DataCollector>",
+        "    </DataCollectors>",
+        "  </DataCollectionRunSettings>",
+        "</RunSettings>",
+        "",
+    ].join("\n"));
+    const files = {};
+    const env = dotnetEnv();
+    for (const name of names) {
+        const results = path.join(work, safe(name));
+        mkdirSync(results, { recursive: true });
+        const args = ["test", "--nologo", "--verbosity", "quiet", "--settings", settings];
+        if (project)
+            args.push(project);
+        args.push("--filter", `FullyQualifiedName~${name}`, "--collect", "XPlat Code Coverage", "--results-directory", results);
+        const ran = spawnSync("dotnet", args, { cwd: pkg, encoding: "utf8", env, timeout: 180_000, maxBuffer: 16 * 1024 * 1024 });
+        if (ran.status !== 0 || ran.error)
+            continue;
+        const report = findCobertura(results);
+        if (!report)
+            continue;
+        let text = "";
+        try {
+            text = readFileSync(report, "utf8");
+        }
+        catch {
+            continue;
+        }
+        addCobertura(files, text, pkg, name);
+    }
+    if (Object.keys(files).length === 0)
+        return { ok: false, detail: "csharp coverage: no covered lines" };
+    writeFileSync(dest, `${JSON.stringify({ files }, null, 2)}\n`);
+    return { ok: true, detail: `${Object.keys(files).length} files` };
+}
+function addCobertura(files, text, pkg, test) {
+    const sources = [...text.matchAll(/<source>([^<]+)<\/source>/g)].map((match) => match[1].trim());
+    for (const part of text.split(/<class\b/).slice(1)) {
+        const headEnd = part.indexOf(">");
+        if (headEnd < 0)
+            continue;
+        const filename = /filename="([^"]+)"/.exec(part.slice(0, headEnd))?.[1];
+        if (!filename)
+            continue;
+        const bodyEnd = part.indexOf("</class>");
+        const body = bodyEnd >= 0 ? part.slice(0, bodyEnd) : part;
+        const rel = coberturaRel(filename, sources, pkg);
+        if (!rel)
+            continue;
+        for (const tag of body.match(/<line\b[^>]*\/?>/g) ?? []) {
+            const number = /number="(\d+)"/.exec(tag);
+            const hits = /hits="(\d+)"/.exec(tag);
+            if (!number || !hits || Number(hits[1]) <= 0)
+                continue;
+            addHit(files, rel, Number(number[1]), test);
+        }
+    }
+}
+function coberturaRel(filename, sources, pkg) {
+    const norm = filename.split("\\").join("/");
+    const candidates = norm.startsWith("/") || /^[A-Za-z]:\//.test(norm) ? [norm] : [norm];
+    for (const source of sources) {
+        const root = source.endsWith("/") || source.endsWith("\\") ? source : `${source}/`;
+        candidates.push(path.normalize(`${root}${norm}`));
+    }
+    for (const candidate of candidates) {
+        const rel = underPkg(candidate, pkg);
+        if (rel)
+            return rel;
+    }
+    return null;
+}
+function underPkg(filename, pkg) {
+    if (!existsSync(filename))
+        return null;
+    let file = filename;
+    let root = pkg;
+    try {
+        file = realpathSync(filename);
+        root = realpathSync(pkg);
+    }
+    catch {
+        return null;
+    }
+    const rel = path.relative(root, file);
+    if (!rel || rel.startsWith(".."))
+        return null;
+    return rel.split(path.sep).join("/");
+}
+function findCobertura(dir) {
+    const found = [];
+    const visit = (current) => {
+        let entries;
+        try {
+            entries = readdirSync(current);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const full = path.join(current, entry);
+            let info;
+            try {
+                info = statSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (info.isDirectory()) {
+                visit(full);
+                continue;
+            }
+            if (entry === "coverage.cobertura.xml")
+                found.push(full);
+        }
+    };
+    visit(dir);
+    return found[0] ?? null;
+}
+function addHit(files, file, line, test) {
+    const lines = files[file] ?? {};
+    const key = String(line);
+    const names = lines[key] ?? [];
+    if (!names.includes(test))
+        names.push(test);
+    lines[key] = names;
+    files[file] = lines;
+}
+function dotnetEnv() {
+    if (process.env.DOTNET_ROLL_FORWARD)
+        return process.env;
+    return { ...process.env, DOTNET_ROLL_FORWARD: "Major" };
+}
+function safe(value) {
+    return value.replace(/[^A-Za-z0-9._-]+/g, "_");
+}

package/dist/mutate/run.js

@@ -1,13 +1,15 @@
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { affectedTests } from "./affected.js";
 import { binaryFromCommand, readCoverageMap, selectionFor, writeLlvmCoverage } from "./coverage-map.js";
+import { writeCsharpCoverage } from "./csharp-coverage.js";
 import { writeGoCoverage } from "./go-coverage.js";
 import { writeJavaCoverage } from "./java-coverage.js";
+import { writeRustCoverage } from "./rust-coverage.js";
 import { applyPatch, changedLines, chooseDirection, filesInDiff, git, restoreTree } from "./patch.js";
 import { killLabel } from "./kill-label.js";
 import { TIMEOUT_FLOOR_MS, TIMEOUT_MULTIPLE, TIMEOUT_NEXT, WHOLE_PROGRAM_TEST, WHOLE_SUITE_NEXT, campaignSummary, decideSuite, hasLineMap, noCoverageNext, resumeNext, scaleStop, timeoutLimitMs, } from "./suite-decision.js";
@@ -64,6 +66,7 @@ export async function runMutants(options) {
     const worktrees = await createWorktrees(repo, packageDir, run.id, commit, options.workers, options.outDir);
     if ("error" in worktrees)
         return failReport(options.outDir, run.id, commit, worktrees.error);
+    hidePaths(worktrees.dirs, repo, packageDir, options.hide ?? []);
     const budgetMs = options.budgetMs ?? (options.maxMinutes == null ? null : options.maxMinutes * 60_000);
     let budgetStarted = 0;
     const overBudget = () => budgetMs !== null && budgetStarted !== 0 && Date.now() - budgetStarted > budgetMs;
@@ -196,11 +199,9 @@ async function prepare(pkg, options, progress) {
         if (baselineFailed.length > 0) {
             return { ok: false, error: "baseline already failing", baselineFailed, suiteCommand: spec.command };
         }
-        if (collect && !existsSync(mapPath) && (spec.kind === "go" || spec.kind === "maven")) {
-            progress(spec.kind === "go" ? "go line map" : "java line map");
-            const written = spec.kind === "go"
-                ? writeGoCoverage(pkg, baseline.report.names, mapPath)
-                : writeJavaCoverage(pkg, baseline.report.names, mapPath);
+        if (collect && !existsSync(mapPath) && languageMapKind(spec.kind)) {
+            progress(languageMapLabel(spec.kind));
+            const written = writeLanguageMap(spec.kind, pkg, baseline.report.names, mapPath, spec.project);
             if (!written.ok)
                 writeFileSync(path.join(options.outDir, "coverage-error.txt"), `${written.detail}\n`);
         }
@@ -541,14 +542,29 @@ async function createWorktrees(repo, packageDir, runId, commit, workers, outDir)
         dirs.push(dir);
     }
     writeFileSync(path.join(outDir, "worktrees.json"), `${JSON.stringify(dirs)}\n`);
-    const linked = nodeModulesOf(repo, packageDir);
+    const sources = nodeModuleSources(repo, packageDir);
     for (const dir of dirs) {
-        const dest = path.join(packageIn(dir, repo, packageDir), "node_modules");
-        if (linked && !existsSync(dest))
-            symlinkSync(linked, dest, "dir");
+        const pkgRoot = packageIn(dir, repo, packageDir);
+        for (const source of sources) {
+            const dest = path.join(pkgRoot, source.rel);
+            if (existsSync(dest))
+                continue;
+            mkdirSync(path.dirname(dest), { recursive: true });
+            symlinkSync(source.abs, dest, "dir");
+        }
     }
     return { dirs };
 }
+function hidePaths(dirs, repo, packageDir, hide) {
+    for (const dir of dirs) {
+        const pkg = packageIn(dir, repo, packageDir);
+        for (const rel of hide) {
+            if (!rel || path.isAbsolute(rel))
+                continue;
+            rmSync(path.join(pkg, rel), { force: true });
+        }
+    }
+}
 function removeWorktrees(repo, dirs, outDir) {
     for (const dir of dirs) {
         git(repo, ["worktree", "remove", "--force", dir]);
@@ -569,11 +585,30 @@ function recordedWorktrees(outDir) {
         return [];
     }
 }
-/** A fresh worktree has no installed dependencies. Use the main checkout's node_modules. */
-function nodeModulesOf(repo, packageDir) {
-    const local = path.join(packageDir, "node_modules");
-    if (existsSync(local))
-        return local;
+/**
+ * Installed dependency directories to mirror into a fresh worktree.
+ * A package can keep node_modules at its root or under a nested example.
+ * A run that starts from a worktree looks beside the main checkout too.
+ */
+function nodeModuleSources(repo, packageDir) {
+    const roots = [packageDir];
+    const main = mainCheckoutPackage(repo, packageDir);
+    if (main && path.resolve(main) !== path.resolve(packageDir))
+        roots.push(main);
+    const found = [];
+    const seen = new Set();
+    for (const root of roots) {
+        for (const abs of findNodeModules(root)) {
+            const rel = path.relative(root, abs);
+            if (seen.has(rel))
+                continue;
+            seen.add(rel);
+            found.push({ rel, abs });
+        }
+    }
+    return found;
+}
+function mainCheckoutPackage(repo, packageDir) {
     const common = git(repo, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
     if (common.status !== 0)
         return null;
@@ -583,8 +618,40 @@ function nodeModulesOf(repo, packageDir) {
     const rel = path.relative(repo, packageDir);
     if (rel.startsWith(".."))
         return null;
-    const candidate = path.join(path.dirname(gitDir), rel, "node_modules");
-    return existsSync(candidate) ? candidate : null;
+    return path.join(path.dirname(gitDir), rel);
+}
+function findNodeModules(root) {
+    const out = [];
+    const visit = (dir) => {
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const name of entries) {
+            if (name === ".git" || name === "target" || name === "dist")
+                continue;
+            const full = path.join(dir, name);
+            let info;
+            try {
+                info = statSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (!info.isDirectory())
+                continue;
+            if (name === "node_modules") {
+                out.push(full);
+                continue;
+            }
+            visit(full);
+        }
+    };
+    visit(root);
+    return out;
 }
 function packageIn(worktree, repo, packageDir) {
     const rel = path.relative(repo, packageDir);
@@ -672,10 +739,33 @@ function reportOf(results, context) {
         flakyIds: results.filter((result) => result.outcome === "flaky").slice(0, 10).map((result) => result.id),
         kills: results
             .filter((result) => result.outcome === "killed" && result.cause !== null)
-            .map((result) => ({ id: result.id, cause: result.cause, killedBy: result.killedBy, next: result.next })),
+            .map((result) => ({ id: result.id, cause: result.cause, killedBy: result.killedBy, next: result.next, files: result.files })),
         full: path.join(context.outDir, "results"),
     };
 }
+function languageMapKind(kind) {
+    return kind === "go" || kind === "maven" || kind === "cargo" || kind === "dotnet";
+}
+function languageMapLabel(kind) {
+    if (kind === "go")
+        return "go line map";
+    if (kind === "maven")
+        return "java line map";
+    if (kind === "cargo")
+        return "rust line map";
+    return "csharp line map";
+}
+function writeLanguageMap(kind, pkg, names, dest, project) {
+    if (kind === "go")
+        return writeGoCoverage(pkg, names, dest);
+    if (kind === "maven")
+        return writeJavaCoverage(pkg, names, dest);
+    if (kind === "cargo")
+        return writeRustCoverage(pkg, names, dest);
+    if (kind === "dotnet")
+        return writeCsharpCoverage(pkg, names, dest, project);
+    return { ok: false, detail: "no line map writer" };
+}
 function failReport(outDir, runId, commit, error, baselineFailed, next, suiteCommand = "", baselineMs = null, notStarted = []) {
     const summary = baselineFailed && baselineFailed.length > 0 ? `${error}: ${baselineFailed.join("; ")}` : error;
     return {
@@ -838,10 +928,20 @@ function sha256(text) {
     return createHash("sha256").update(text).digest("hex");
 }
 function failureId(pkg, failure) {
+    // Pytest already reports a node id (tests/test_gate.py::test_low). Prepending the
+    // file doubles it, and pytest then exits 4 and collects nothing.
+    if (pytestNodeId(failure.name))
+        return failure.name;
     const rel = failure.file ? path.relative(pkg, failure.file) : "";
     const file = !rel || rel.startsWith("..") ? path.basename(failure.file || "") : rel.split(path.sep).join("/");
     return `${file}::${failure.name}`;
 }
+function pytestNodeId(name) {
+    const mark = name.indexOf("::");
+    if (mark <= 0)
+        return false;
+    return name.slice(0, mark).endsWith(".py");
+}
 function testArg(pkg, file, testsDir) {
     const rel = path.relative(pkg, file);
     if (rel && !rel.startsWith(".."))

package/dist/mutate/rust-coverage.js

@@ -0,0 +1,159 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, realpathSync, writeFileSync } from "node:fs";
+import path from "node:path";
+/**
+ * One instrumented test binary, then one profile per test name.
+ * A single cargo test profile does not say which test hit the line.
+ */
+export function writeRustCoverage(pkg, testNames, dest) {
+    const names = [...new Set(testNames.map((name) => name.trim()).filter((name) => name.length > 0 && !/\s/.test(name)))];
+    if (names.length === 0)
+        return { ok: false, detail: "rust coverage: no test names" };
+    const llvmCov = findTool("llvm-cov");
+    const llvmProf = findTool("llvm-profdata");
+    if (!llvmCov || !llvmProf)
+        return { ok: false, detail: "rust coverage: llvm tool missing" };
+    const env = { ...process.env, RUSTFLAGS: "-C instrument-coverage", CARGO_INCREMENTAL: "0" };
+    const built = spawnSync("cargo", ["test", "--no-run", "--message-format=json"], {
+        cwd: pkg,
+        encoding: "utf8",
+        env,
+        timeout: 180_000,
+        maxBuffer: 32 * 1024 * 1024,
+    });
+    if (built.status !== 0 || built.error)
+        return { ok: false, detail: clip(built.stderr || built.stdout || built.error?.message || "cargo test --no-run failed") };
+    const exes = testExecutables(built.stdout);
+    if (exes.length === 0)
+        return { ok: false, detail: "rust coverage: no test executable" };
+    const work = path.join(path.dirname(dest), "rust-cover");
+    mkdirSync(work, { recursive: true });
+    const files = {};
+    for (const name of names) {
+        for (const exe of exes) {
+            const raw = path.join(work, `${safe(name)}-${safe(path.basename(exe))}.profraw`);
+            const ran = spawnSync(exe, [name, "--exact", "--test-threads=1"], {
+                cwd: pkg,
+                encoding: "utf8",
+                env: { ...env, LLVM_PROFILE_FILE: raw },
+                timeout: 60_000,
+            });
+            if (!existsSync(raw))
+                continue;
+            if (!new RegExp(`^test ${escapeRegExp(name)} \\.\\.\\. ok`, "m").test(`${ran.stdout}\n${ran.stderr}`))
+                continue;
+            const merged = path.join(work, `${safe(name)}-${safe(path.basename(exe))}.profdata`);
+            const merge = spawnSync(llvmProf, ["merge", "-sparse", "-o", merged, raw], { encoding: "utf8" });
+            if (merge.status !== 0)
+                continue;
+            const exported = spawnSync(llvmCov, ["export", exe, `-instr-profile=${merged}`], { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+            if (exported.status !== 0)
+                continue;
+            for (const hit of llvmHits(exported.stdout, pkg))
+                addHit(files, hit.file, hit.line, name);
+        }
+    }
+    if (Object.keys(files).length === 0)
+        return { ok: false, detail: "rust coverage: no covered lines" };
+    writeFileSync(dest, `${JSON.stringify({ files }, null, 2)}\n`);
+    return { ok: true, detail: `${Object.keys(files).length} files` };
+}
+function testExecutables(stdout) {
+    const found = [];
+    for (const line of stdout.split("\n")) {
+        if (!line.startsWith("{"))
+            continue;
+        try {
+            const msg = JSON.parse(line);
+            if (msg.reason !== "compiler-artifact" || !msg.executable || !msg.profile?.test)
+                continue;
+            if (!found.includes(msg.executable))
+                found.push(msg.executable);
+        }
+        catch {
+            continue;
+        }
+    }
+    return found;
+}
+function llvmHits(stdout, pkg) {
+    const start = stdout.indexOf("{");
+    if (start < 0)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout.slice(start));
+    }
+    catch {
+        return [];
+    }
+    const hits = [];
+    for (const group of parsed.data ?? []) {
+        for (const file of group.files ?? []) {
+            if (!file.filename)
+                continue;
+            const rel = underPkg(file.filename, pkg);
+            if (!rel)
+                continue;
+            for (const segment of file.segments ?? []) {
+                const line = segment[0];
+                const count = segment[2] ?? 0;
+                if (!line || count <= 0)
+                    continue;
+                hits.push({ file: rel, line });
+            }
+        }
+    }
+    return hits;
+}
+function underPkg(filename, pkg) {
+    let file = filename;
+    let root = pkg;
+    try {
+        if (existsSync(filename))
+            file = realpathSync(filename);
+    }
+    catch {
+        // keep the path llvm reported
+    }
+    try {
+        root = realpathSync(pkg);
+    }
+    catch {
+        // keep the package path
+    }
+    const rel = path.relative(root, file);
+    if (!rel || rel.startsWith(".."))
+        return null;
+    return rel.split(path.sep).join("/");
+}
+function addHit(files, file, line, test) {
+    const lines = files[file] ?? {};
+    const key = String(line);
+    const names = lines[key] ?? [];
+    if (!names.includes(test))
+        names.push(test);
+    lines[key] = names;
+    files[file] = lines;
+}
+function findTool(name) {
+    const fromXcrun = spawnSync("xcrun", ["--find", name], { encoding: "utf8" });
+    const xcrunPath = fromXcrun.stdout?.trim() ?? "";
+    if (fromXcrun.status === 0 && xcrunPath && existsSync(xcrunPath))
+        return xcrunPath;
+    const which = spawnSync("sh", ["-c", `command -v ${name}`], { encoding: "utf8" });
+    const found = which.stdout?.trim() ?? "";
+    if (which.status === 0 && found)
+        return found;
+    return null;
+}
+function safe(value) {
+    return value.replace(/[^A-Za-z0-9._-]+/g, "_");
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function clip(text) {
+    const line = text.trim().split("\n").find((item) => item.trim()) ?? "rust coverage failed";
+    return line.slice(0, 240);
+}

package/dist/mutate/sealed.js

@@ -0,0 +1,25 @@
+import { readFileSync } from "node:fs";
+/** The label stays in its own file. The run report must not repeat these three values. */
+export function readSealedLabel(file) {
+    let text = "";
+    try {
+        text = readFileSync(file, "utf8");
+    }
+    catch {
+        throw new Error("label file could not be read");
+    }
+    const bugId = field(text, "bug_id");
+    const issueId = field(text, "issue_id");
+    const expectedFail = field(text, "expected_fail");
+    if (!bugId || !issueId || !expectedFail)
+        throw new Error("label file needs bug_id, issue_id, and expected_fail");
+    return { bugId, issueId, expectedFail };
+}
+export function labelLeaked(body, label) {
+    return body.includes(label.bugId) || body.includes(label.issueId) || body.includes(label.expectedFail);
+}
+export const LABEL_LEAK_SUMMARY = "The label was copied into the report.";
+function field(text, key) {
+    const match = text.match(new RegExp(`^${key}=(.*)$`, "m"));
+    return match?.[1]?.trim() ?? "";
+}

package/dist/mutate/suite-decision.js

@@ -30,7 +30,7 @@ export function timeoutLimitMs(baselineMs, multiple, floorMs) {
     return Math.max(floor, scaled);
 }
 /** Kinds that collect a per-line map on the baseline. Other kinds pay the whole suite. */
-const LINE_MAP_KINDS = new Set(["node", "pytest", "c", "go", "maven"]);
+const LINE_MAP_KINDS = new Set(["node", "pytest", "c", "go", "maven", "cargo", "dotnet"]);
 /** A baseline this long, with no line map, is too expensive to repeat for a large batch. */
 export const SLOW_BASELINE_MS = 5_000;
 /** Pending mutants above this count, on a slow unmapped suite, are not started. */

package/dist/mutate/suites.js

@@ -131,10 +131,12 @@ function nodeSuite(pkg) {
     return { kind: "node", files, command: "node --test" };
 }
 function mochaSuite(pkg) {
-    const files = walk(pkg, (rel) => isNodeTest(rel) || (rel.split("/").includes("test") && rel.endsWith(".ts")));
-    if (files.length === 0 || !usesMocha(pkg))
+    if (!usesMocha(pkg))
         return null;
-    return { kind: "mocha", files, command: "mocha --reporter json" };
+    const files = mochaFiles(pkg);
+    if (files.length === 0)
+        return null;
+    return { kind: "mocha", files, command: shown("mocha", buildMochaArgs(pkg, files)) };
 }
 /** A Makefile `test` target that links the project's own COBOL tests, instead of one file. */
 function makeTestSuite(pkg) {
@@ -185,14 +187,119 @@ export function sourceCandidates(pkg) {
     return walk(pkg, (rel) => SOURCE_EXT.test(rel) && (hasSegment(rel, "tests") || hasSegment(rel, "test")));
 }
 function pythonTests(pkg, testsDir) {
-    const roots = new Set([testsDir, "tests", "test"]);
+    const configured = pytestTestPaths(pkg);
+    const roots = new Set(configured ?? [testsDir, "tests", "test"]);
     return walk(pkg, (rel) => {
         const base = path.posix.basename(rel);
-        if (!/^test_.*\.py$/.test(base) && !/_test\.py$/.test(base))
+        if (!/^test_.*\.py$/.test(base) && !/_test\.py$/.test(base) && !/^tests_.*\.py$/.test(base))
             return false;
+        if (configured)
+            return configured.some((root) => rel === root || rel.startsWith(`${root}/`));
         return rel.split("/").some((part) => roots.has(part));
     });
 }
+/** Directories pytest itself would collect. A missing setting keeps the broader walk. */
+function pytestTestPaths(pkg) {
+    const fromPyproject = readPyprojectTestPaths(path.join(pkg, "pyproject.toml"));
+    if (fromPyproject)
+        return fromPyproject;
+    for (const file of ["pytest.ini", "tox.ini", "setup.cfg"]) {
+        const found = readIniTestPaths(path.join(pkg, file));
+        if (found)
+            return found;
+    }
+    return null;
+}
+function readPyprojectTestPaths(file) {
+    if (!existsSync(file))
+        return null;
+    const text = readFileSync(file, "utf8");
+    const section = /\[tool\.pytest\.ini_options\][^\n]*\n([\s\S]*?)(?:\n\[|\s*$)/.exec(text)?.[1];
+    if (!section)
+        return null;
+    const key = /testpaths\s*=\s*([\s\S]*?)(?:\n[A-Za-z]|\s*$)/.exec(section)?.[1];
+    if (!key)
+        return null;
+    const quoted = [...key.matchAll(/"([^"]+)"|'([^']+)'/g)].map((match) => (match[1] ?? match[2]).trim()).filter(Boolean);
+    return quoted.length > 0 ? quoted : null;
+}
+function readIniTestPaths(file) {
+    if (!existsSync(file))
+        return null;
+    const text = readFileSync(file, "utf8");
+    const section = /\[(?:pytest|tool:pytest)\][^\n]*\n([\s\S]*?)(?:\n\[|\s*$)/.exec(text)?.[1];
+    if (!section)
+        return null;
+    const key = /testpaths\s*=\s*([\s\S]*?)(?:\n[A-Za-z]|\s*$)/.exec(section)?.[1];
+    if (!key)
+        return null;
+    const paths = key
+        .split(/\s+/)
+        .map((item) => item.trim())
+        .filter((item) => item.length > 0 && !item.startsWith("#"));
+    return paths.length > 0 ? paths : null;
+}
+const MOCHA_SKIP_DIR = new Set(["support", "fixtures", "helpers", "helper"]);
+/** Mocha files the project would run: node-style names, TypeScript under test/, or describe/it scripts. */
+function mochaFiles(pkg) {
+    return walk(pkg, (rel) => {
+        const parts = rel.split("/");
+        if (parts.some((part) => MOCHA_SKIP_DIR.has(part.toLowerCase())))
+            return false;
+        const inTest = parts.some((part) => part === "test" || part === "tests");
+        if (!inTest)
+            return false;
+        if (isNodeTest(rel))
+            return true;
+        if (parts.includes("test") && /\.tsx?$/.test(rel))
+            return true;
+        if (!/\.(?:js|mjs|cjs)$/.test(rel))
+            return false;
+        let text = "";
+        try {
+            text = readFileSync(path.join(pkg, rel), "utf8");
+        }
+        catch {
+            return false;
+        }
+        return /\bdescribe\s*\(/.test(text) || /\bit\s*\(/.test(text);
+    });
+}
+/** Args after the mocha binary: reporter, the project's own --require, and files when package.json has no mocha.spec. */
+export function buildMochaArgs(pkg, files) {
+    const config = readMochaConfig(pkg);
+    const args = ["--reporter", "json", "--timeout", "20000"];
+    const fromConfig = new Set((config?.require ?? []).filter((name) => name !== "esm"));
+    for (const name of scriptRequires(pkg)) {
+        if (name === "esm" || fromConfig.has(name))
+            continue;
+        args.push("--require", name);
+    }
+    const hasSpec = Boolean(config?.spec && config.spec.length > 0);
+    if (!hasSpec)
+        args.push(...files);
+    return args;
+}
+function scriptRequires(pkg) {
+    const file = path.join(pkg, "package.json");
+    if (!existsSync(file))
+        return [];
+    let script = "";
+    try {
+        const body = JSON.parse(readFileSync(file, "utf8"));
+        script = body.scripts?.test ?? "";
+    }
+    catch {
+        return [];
+    }
+    const found = [];
+    for (const match of script.matchAll(/(?:^|\s)--require(?:=|\s+)(\S+)/g)) {
+        const name = match[1].replace(/^['"]|['"]$/g, "");
+        if (name && name !== "esm" && !found.includes(name))
+            found.push(name);
+    }
+    return found;
+}
 function isPytest(pkg, testsDir, files) {
     if (existsSync(path.join(pkg, "pytest.ini")) || existsSync(path.join(pkg, "conftest.py")))
         return true;
@@ -224,6 +331,11 @@ function tag(result, command, wholeSuite, selectedTests) {
 function shown(bin, args) {
     return [bin, ...args.map((arg) => (/\s/.test(arg) ? JSON.stringify(arg) : arg))].join(" ");
 }
+function shellQuote(value) {
+    if (/^[A-Za-z0-9_:.]+$/.test(value))
+        return value;
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
 async function launch(pkg, spec, files, pattern, names, timeoutMs, env, hooks) {
     const selection = names && names.length > 0 ? names : namesFromPattern(pattern);
     const wantsNames = selection.length > 0;
@@ -256,12 +368,15 @@ async function launch(pkg, spec, files, pattern, names, timeoutMs, env, hooks) {
         return tag(runPython(pkg, files, k, timeoutMs, env, "py-pytest-reporter.py", plan.nodeIds), command, false, selection);
     }
     if (spec.kind === "cargo") {
-        if (selection.length > 1) {
-            return tag(spawnCollected("cargo", ["test", "--", "--test-threads=1"], pkg, env, timeoutMs), "cargo test -- --test-threads=1", true, selection);
+        if (selection.length === 0) {
+            return tag(spawnCollected("cargo", ["test", "--", "--test-threads=1"], pkg, env, timeoutMs), "cargo test -- --test-threads=1", false, selection);
+        }
+        if (selection.length === 1) {
+            const args = ["test", selection[0], "--", "--exact", "--test-threads=1"];
+            return tag(spawnCollected("cargo", args, pkg, env, timeoutMs), shown("cargo", args), false, selection);
         }
-        const filter = selection.length === 1 ? selection[0] : null;
-        const args = filter ? ["test", filter, "--", "--test-threads=1"] : ["test", "--", "--test-threads=1"];
-        return tag(spawnCollected("cargo", args, pkg, env, timeoutMs), shown("cargo", args), false, selection);
+        const script = selection.map((name) => `cargo test ${shellQuote(name)} -- --exact --test-threads=1`).join(" && ");
+        return tag(spawnCollected("sh", ["-c", script], pkg, env, timeoutMs), script, false, selection);
     }
     if (spec.kind === "go") {
         const filter = goRunFilter(names, pattern);
@@ -357,8 +472,10 @@ function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function runShell(pkg, command, timeoutMs, env) {
+    // A command can be pytest. Baseline writes a .pyc, and a same-size patch in that same second leaves it valid.
+    clearBytecode(pkg);
     const child = /\b(java|javac|mvn)\b/.test(command) ? javaEnv(env) : env;
-    return spawnCollected("sh", ["-c", command], pkg, child, timeoutMs);
+    return spawnCollected("sh", ["-c", command], pkg, { ...child, PYTHONDONTWRITEBYTECODE: "1" }, timeoutMs);
 }
 async function runNode(pkg, files, pattern, timeoutMs, env, hooks) {
     const tsx = path.join(pkg, "node_modules", ".bin", "tsx");
@@ -434,20 +551,15 @@ async function runMocha(pkg, files, timeoutMs, env) {
     if (prepared && (prepared.code !== 0 || prepared.timedOut))
         return prepared;
     const config = readMochaConfig(pkg);
-    const args = [mocha, "--reporter", "json", "--timeout", "20000"];
-    if (config) {
+    const args = [mocha, ...buildMochaArgs(pkg, files)];
+    if (config && config.require.includes("esm")) {
         // The `esm` loader throws on current Node before any test runs. Drop that one require and keep the rest of the project's mocha config.
         const requires = config.require.filter((name) => name !== "esm");
-        if (requires.length !== config.require.length) {
-            const dir = path.join(pkg, ".probatio-suite");
-            mkdirSync(dir, { recursive: true });
-            const override = path.join(dir, "mocha-package.json");
-            writeFileSync(override, `${JSON.stringify({ mocha: { extension: config.extension, require: requires, spec: config.spec } }, null, 2)}\n`);
-            args.push("--package", override);
-        }
-    }
-    else {
-        args.push(...files);
+        const dir = path.join(pkg, ".probatio-suite");
+        mkdirSync(dir, { recursive: true });
+        const override = path.join(dir, "mocha-package.json");
+        writeFileSync(override, `${JSON.stringify({ mocha: { extension: config.extension, require: requires, spec: config.spec } }, null, 2)}\n`);
+        args.push("--package", override);
     }
     return spawnCollected(process.execPath, args, pkg, env, timeoutMs);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "probatio",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "description": "Mutation runner for AI agents. Scores a test suite by the bugs it catches.",
   "type": "module",
   "bin": {
@@ -14,6 +14,7 @@
     "url": "git+https://github.com/IronAdamant/Probatio.git"
   },
   "homepage": "https://github.com/IronAdamant/Probatio#readme",
+  "license": "MIT",
   "bugs": {
     "url": "https://github.com/IronAdamant/Probatio/issues"
   },