project-tiny-context-harness 0.2.84 → 0.6.0

package/dist/lib/long-task-verifier-v2.js

@@ -0,0 +1,266 @@
+import { deliveryCompileFreshness } from "./long-task-freshness.js";
+import { assertVerifierAuthorityCurrent } from "./long-task-freshness.js";
+import { enrichCheckResultFindings, enrichFinding, } from "./long-task-finding-context.js";
+import { executeCheckRunner } from "./long-task-check-runner.js";
+import { evaluateCheckEvidence, evaluateGlobalCounterfactuals, evaluateOutcomeCounterfactuals, } from "./long-task-evidence-v2.js";
+import { findScopeEscapes, matchesRepoPattern } from "./long-task-paths.js";
+import { activeAuthorityIdentityMatches, loadActiveLongTaskAuthority, writeProgressRecord, } from "./long-task-state.js";
+import { createProgressRecord } from "./long-task-progress.js";
+import { changedWorkspacePaths, createWorkspaceSnapshot, repositoryRoot, } from "./long-task-workspace.js";
+export async function verifyDeliveryContract(workdir, selection = {}) {
+    const repository = await repositoryRoot(process.cwd());
+    const active = (await loadActiveLongTaskAuthority(repository, { migrate_legacy: true })).authority;
+    if (!active)
+        throw new Error("active_task_missing");
+    if (active.workdir !== (await resolved(workdir)))
+        throw new Error("active_task_workdir_mismatch");
+    await assertVerifierAuthorityCurrent(repository, active.verifier_identity);
+    const compiled = active.authority_snapshot;
+    const expectedAuthority = {
+        task_id: active.task_id,
+        authority_revision: active.authority_revision,
+        compiled_identity: active.active_authority_identity,
+        worktree_identity: active.worktree_identity,
+    };
+    const selected = selectChecks(compiled, selection);
+    const snapshot = await createWorkspaceSnapshot(compiled.repository_root, compiled.workdir, `verify-${compiled.task.id}`);
+    try {
+        const run = await runDeliveryChecks(compiled, snapshot, selected, true);
+        const records = run.check_results.map((result) => {
+            const check = selected.find((item) => item.internal_id === result.internal_id);
+            if (!check)
+                throw new Error(`compiled_check_not_found:${result.internal_id}`);
+            return createProgressRecord(compiled, snapshot.manifest, check, result);
+        });
+        let authorityChanged = false;
+        try {
+            const current = (await loadActiveLongTaskAuthority(repository)).authority;
+            authorityChanged =
+                !current || !activeAuthorityIdentityMatches(current, expectedAuthority);
+        }
+        catch {
+            authorityChanged = true;
+        }
+        if (authorityChanged) {
+            run.findings.push({
+                code: "active_authority_changed_during_verify",
+                outcome_key: null,
+                check_key: null,
+                message: "Active Authority changed while targeted verification was running.",
+                next_action: "Discard the stale progress and rerun verification against the active Authority Revision.",
+            });
+            return {
+                schema_version: "long-task-targeted-progress-v2",
+                compiled_identity: compiled.compiled_identity,
+                snapshot_sha256: snapshot.manifest.snapshot_sha256,
+                acceptance_authorized: false,
+                selected_outcome: selection.outcome ?? null,
+                selected_check: selection.check ?? null,
+                updated_progress_records: [],
+                check_results: run.check_results,
+                findings: run.findings,
+                completed_at: new Date().toISOString(),
+            };
+        }
+        await Promise.all(records.map((record) => writeProgressRecord(workdir, record)));
+        return {
+            schema_version: "long-task-targeted-progress-v2",
+            compiled_identity: compiled.compiled_identity,
+            snapshot_sha256: snapshot.manifest.snapshot_sha256,
+            acceptance_authorized: false,
+            selected_outcome: selection.outcome ?? null,
+            selected_check: selection.check ?? null,
+            updated_progress_records: records.map((record) => record.check_internal_id),
+            check_results: run.check_results,
+            findings: run.findings,
+            completed_at: new Date().toISOString(),
+        };
+    }
+    finally {
+        await snapshot.dispose();
+    }
+}
+async function resolved(workdir) {
+    return (await import("node:path")).default.resolve(workdir);
+}
+export async function runDeliveryChecks(compiled, snapshot, checks, includeCounterfactuals, finalGate = false) {
+    const findings = await preRunFindings(compiled, snapshot.manifest);
+    if (finalGate)
+        findings.push(...finalPathFindings(compiled, snapshot.manifest));
+    if (findings.length)
+        return {
+            snapshot: snapshot.manifest,
+            check_results: [],
+            findings: findings.map((finding) => enrichFinding(compiled, finding)),
+        };
+    const rawExecutions = new Map();
+    const mainCheckResults = [];
+    for (const check of checks) {
+        let raw = rawExecutions.get(check.raw_execution_identity);
+        if (!raw) {
+            raw = await executeCheckRunner(check, snapshot.root);
+            rawExecutions.set(check.raw_execution_identity, raw);
+        }
+        const outcome = check.outcome_key
+            ? compiled.outcomes.find((item) => item.key === check.outcome_key)
+            : undefined;
+        mainCheckResults.push(await evaluateCheckEvidence(check, raw, snapshot.root, outcome));
+    }
+    const counterfactualFindings = [];
+    if (includeCounterfactuals) {
+        const selectedGlobalCheckKeys = new Set(checks
+            .filter((check) => check.outcome_key === null)
+            .map((check) => check.key));
+        if (selectedGlobalCheckKeys.size)
+            counterfactualFindings.push(...(await evaluateGlobalCounterfactuals(compiled, snapshot.root, selectedGlobalCheckKeys, snapshot.manifest)));
+        const outcomeKeys = new Set(checks
+            .map((check) => check.outcome_key)
+            .filter((key) => Boolean(key)));
+        for (const outcome of compiled.outcomes.filter((item) => outcomeKeys.has(item.key))) {
+            const selectedKeys = new Set(checks
+                .filter((check) => check.outcome_key === outcome.key)
+                .map((check) => check.key));
+            counterfactualFindings.push(...(await evaluateOutcomeCounterfactuals({
+                ...outcome,
+                acceptance: {
+                    ...outcome.acceptance,
+                    counterfactual_controls: outcome.acceptance.counterfactual_controls.filter((control) => selectedKeys.has(control.check_key)),
+                },
+            }, snapshot.root, snapshot.manifest)));
+        }
+    }
+    const unassignedCounterfactuals = counterfactualFindings.filter((finding) => !mainCheckResults.some((result) => findingBelongsToCheck(finding, result)));
+    const unassignedFinding = unassignedCounterfactuals.length
+        ? unassignedCounterfactualFinding(unassignedCounterfactuals)
+        : null;
+    const checkResults = applyCounterfactualFindings(mainCheckResults, counterfactualFindings, unassignedFinding).map((result) => enrichCheckResultFindings(compiled, result));
+    findings.push(...checkResults.flatMap((result) => result.findings));
+    if (unassignedFinding && !checkResults.length)
+        findings.push(unassignedFinding);
+    return {
+        snapshot: snapshot.manifest,
+        check_results: checkResults,
+        findings: findings.map((finding) => enrichFinding(compiled, finding)),
+    };
+}
+function applyCounterfactualFindings(checkResults, findings, unassignedFinding) {
+    return checkResults.map((result, index) => {
+        const projected = findings.filter((finding) => findingBelongsToCheck(finding, result));
+        const invariantFindings = unassignedFinding && index === 0 ? [unassignedFinding] : [];
+        const projectedFindings = [...projected, ...invariantFindings];
+        if (!projectedFindings.length)
+            return result;
+        return {
+            ...result,
+            status: result.status === "passed" ? "invalid_evidence" : result.status,
+            claim_proofs: [],
+            findings: [...result.findings, ...projectedFindings],
+        };
+    });
+}
+function findingBelongsToCheck(finding, result) {
+    return (finding.check_key !== null &&
+        finding.check_key === result.check_key &&
+        finding.outcome_key === result.outcome_key);
+}
+function unassignedCounterfactualFinding(actual) {
+    return {
+        code: "counterfactual_finding_unassigned",
+        outcome_key: null,
+        check_key: null,
+        message: "A Counterfactual Finding could not be assigned to its owning Check Result.",
+        actual,
+        next_action: "Repair the Counterfactual evaluator ownership invariant before trusting verification progress.",
+    };
+}
+function finalPathFindings(compiled, manifest) {
+    const findings = [];
+    for (const check of allCompiledChecks(compiled))
+        for (const pattern of check.expected_output_paths)
+            if (!manifest.files.some((file) => matchesRepoPattern(file.path, pattern)))
+                findings.push({
+                    code: "expected_output_path_missing",
+                    outcome_key: check.outcome_key,
+                    check_key: check.key,
+                    message: `Expected output path did not exist: ${pattern}`,
+                    expected: pattern,
+                    next_action: "Create the declared output and rerun verification.",
+                });
+    for (const outcome of compiled.outcomes)
+        for (const binding of outcome.technical.bindings)
+            if (binding.existence === "planned" &&
+                !plannedBindingRequiredPatterns(binding).every((pattern) => manifest.files.some((file) => matchesRepoPattern(file.path, pattern))))
+                findings.push({
+                    code: "binding_missing",
+                    outcome_key: outcome.key,
+                    check_key: null,
+                    claim_keys: outcome.generated_claims.some((claim) => claim.local_key === `obligation.${binding.key}`)
+                        ? [`obligation.${binding.key}`]
+                        : [],
+                    message: `Planned binding is missing: ${binding.target}`,
+                    expected: binding.carrier_paths,
+                    next_action: "Implement the declared binding and rerun verification.",
+                });
+    return findings;
+}
+function plannedBindingRequiredPatterns(binding) {
+    return binding.kind === "file" || binding.kind === "path_glob"
+        ? [binding.target]
+        : binding.carrier_paths;
+}
+export function allCompiledChecks(compiled) {
+    return [
+        ...compiled.global.acceptance.checks,
+        ...compiled.outcomes.flatMap((outcome) => outcome.acceptance.checks),
+    ];
+}
+function selectChecks(compiled, selection) {
+    const checks = allCompiledChecks(compiled);
+    if (selection.outcome &&
+        !compiled.outcomes.some((outcome) => outcome.key === selection.outcome))
+        throw new Error(`outcome_not_found:${selection.outcome}`);
+    const filtered = checks.filter((check) => (!selection.outcome || check.outcome_key === selection.outcome) &&
+        (!selection.check || check.key === selection.check));
+    if (selection.check && !filtered.length)
+        throw new Error(`check_not_found:${selection.check}`);
+    return filtered;
+}
+async function preRunFindings(compiled, current) {
+    const stale = await deliveryCompileFreshness(compiled);
+    if (stale.length)
+        return stale.map((code) => ({
+            code,
+            outcome_key: null,
+            check_key: null,
+            message: "A compiled Contract input changed.",
+            next_action: "Run ty-context long-task compile --revise after reviewing the Contract change.",
+        }));
+    const protectedAuthorityFiles = new Set([
+        ...Object.keys(compiled.contract_files),
+        ...Object.keys(compiled.source_hashes),
+        ...Object.keys(compiled.context_snapshot.sha256),
+        ...allCompiledChecks(compiled).flatMap((check) => Object.keys(check.verification_input_hashes)),
+    ]);
+    const changed = changedWorkspacePaths(compiled.initial_task_base.workspace_manifest, current).filter((file) => !protectedAuthorityFiles.has(file));
+    const allowed = compiled.outcomes.flatMap((outcome) => [
+        ...outcome.technical.expected_change_paths,
+        ...outcome.technical.allowed_support_paths,
+    ]);
+    const forbidden = [
+        ...compiled.global.technical.forbidden_paths.map((entry) => entry.path),
+        ...compiled.outcomes.flatMap((outcome) => outcome.technical.forbidden_paths),
+    ];
+    const escaped = findScopeEscapes(changed, allowed, forbidden);
+    return escaped.length
+        ? [
+            {
+                code: "scope_escape",
+                outcome_key: null,
+                check_key: null,
+                message: `Changed paths are outside the Contract boundary: ${escaped.join(",")}`,
+                actual: escaped,
+                next_action: "Review risk/ownership, revise declared change paths and recompile in the same Goal.",
+            },
+        ]
+        : [];
+}

package/dist/lib/long-task-workspace-runtime-types.d.ts

@@ -0,0 +1,23 @@
+export interface WorkspaceFileV2 {
+    path: string;
+    mode: number;
+    size: number;
+    sha256: string;
+}
+export interface WorkspaceFingerprintV2 {
+    head: string;
+    head_tree: string;
+    index_tree: string;
+    staged_diff_sha256: string;
+    unstaged_diff_sha256: string;
+    untracked_sha256: string;
+    status_sha256: string;
+    identity: string;
+}
+export interface WorkspaceManifestV2 {
+    repository_root: string;
+    git_head: string;
+    files: WorkspaceFileV2[];
+    fingerprint: WorkspaceFingerprintV2;
+    snapshot_sha256: string;
+}

package/dist/lib/long-task-workspace-runtime-types.js

@@ -0,0 +1 @@
+export {};

package/dist/lib/long-task-workspace.d.ts

@@ -0,0 +1,25 @@
+import type { WorkspaceFingerprintV2, WorkspaceManifestV2 } from "./long-task-delivery-types.js";
+export interface WorkspaceSnapshotV2 {
+    root: string;
+    manifest: WorkspaceManifestV2;
+    preparation_ms: number;
+    dispose(): Promise<void>;
+}
+export declare function repositoryRoot(start: string): Promise<string>;
+export declare function gitCommonDir(root: string): Promise<string>;
+export declare function captureWorkspaceFingerprint(rootInput: string, excludedPrefixes?: string[]): Promise<WorkspaceFingerprintV2>;
+export declare function captureWorkspaceManifest(rootInput: string, workdirInput: string, _copyRoot?: string, additionalExcludedWorkdirs?: string[]): Promise<WorkspaceManifestV2>;
+export declare function createWorkspaceSnapshot(rootInput: string, workdirInput: string, label: string, additionalExcludedWorkdirs?: string[]): Promise<WorkspaceSnapshotV2>;
+export declare function changedWorkspacePaths(baseline: WorkspaceManifestV2, current: WorkspaceManifestV2): string[];
+export declare function currentGitState(root: string): Promise<{
+    head: string;
+    tree: string;
+    dirty: string[];
+}>;
+export declare function currentGitTree(root: string): Promise<string>;
+export declare function gitPath(root: string, pathSpec: string): Promise<string>;
+export declare function gitConfigGet(root: string, name: string): Promise<string | null>;
+export declare function gitConfigSet(root: string, name: string, value: string): Promise<void>;
+export declare function gitConfigUnset(root: string, name: string): Promise<void>;
+export declare function resolveInsideRepository(rootInput: string, relativeInput: string, label: string): string;
+export declare function repoRelative(rootInput: string, fileInput: string): string;

package/dist/lib/long-task-workspace.js

@@ -0,0 +1,366 @@
+import { spawn } from "node:child_process";
+import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, symlink, } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
+export async function repositoryRoot(start) {
+    return path.resolve(await gitOutput(path.resolve(start), ["rev-parse", "--show-toplevel"]));
+}
+export async function gitCommonDir(root) {
+    return path.resolve(await gitOutput(root, [
+        "rev-parse",
+        "--path-format=absolute",
+        "--git-common-dir",
+    ]));
+}
+export async function captureWorkspaceFingerprint(rootInput, excludedPrefixes = []) {
+    const root = path.resolve(rootInput);
+    const [head, headTree, indexTree, staged, unstaged, statusBytes, untracked] = await Promise.all([
+        gitOutput(root, ["rev-parse", "HEAD"]),
+        gitOutput(root, ["rev-parse", "HEAD^{tree}"]),
+        gitOutput(root, ["write-tree"]),
+        gitBuffer(root, scopedDiffArgs(["diff", "--cached", "--binary", "--no-ext-diff"], excludedPrefixes)),
+        gitBuffer(root, scopedDiffArgs(["diff", "--binary", "--no-ext-diff"], excludedPrefixes)),
+        Promise.all([
+            gitBuffer(root, scopedDiffArgs(["diff", "--cached", "--raw", "-z", "-M"], excludedPrefixes)),
+            gitBuffer(root, scopedDiffArgs(["diff", "--raw", "-z", "-M"], excludedPrefixes)),
+        ]).then((rows) => Buffer.concat(rows)),
+        untrackedIdentity(root, excludedPrefixes),
+    ]);
+    const unsigned = {
+        head,
+        head_tree: headTree,
+        index_tree: indexTree,
+        staged_diff_sha256: sha256Hex(staged),
+        unstaged_diff_sha256: sha256Hex(unstaged),
+        untracked_sha256: untracked,
+        status_sha256: sha256Hex(statusBytes),
+    };
+    return {
+        ...unsigned,
+        identity: sha256Hex(canonicalValueJson(unsigned)),
+    };
+}
+export async function captureWorkspaceManifest(rootInput, workdirInput, _copyRoot, additionalExcludedWorkdirs = []) {
+    const root = path.resolve(rootInput);
+    const workdir = path.resolve(workdirInput);
+    const workdirRelative = repoRelative(root, workdir);
+    if (!workdirRelative)
+        throw new Error("long_task_workdir_must_not_be_repository_root");
+    const excluded = excludedPrefixes(root, [
+        workdir,
+        ...additionalExcludedWorkdirs,
+    ]);
+    const [indexBytes, modifiedBytes, untrackedBytes, fingerprint] = await Promise.all([
+        gitBuffer(root, ["ls-files", "--stage", "-z"]),
+        gitBuffer(root, ["diff", "--name-only", "-z"]),
+        gitBuffer(root, ["ls-files", "--others", "--exclude-standard", "-z"]),
+        captureWorkspaceFingerprint(root, excluded),
+    ]);
+    const files = new Map();
+    for (const record of splitZero(indexBytes)) {
+        const tab = record.indexOf("\t");
+        if (tab < 0)
+            continue;
+        const [modeText, objectId, stage] = record.slice(0, tab).split(" ");
+        const relative = record.slice(tab + 1).replace(/\\/gu, "/");
+        if (stage !== "0" || excludedPath(relative, excluded))
+            continue;
+        files.set(relative, {
+            path: relative,
+            mode: Number.parseInt(modeText, 8),
+            size: 0,
+            sha256: `git:${objectId}`,
+        });
+    }
+    const overlays = new Set([
+        ...splitZero(modifiedBytes),
+        ...splitZero(untrackedBytes),
+    ]);
+    const overlayNames = [...overlays]
+        .map((raw) => raw.replace(/\\/gu, "/"))
+        .filter((relative) => !excludedPath(relative, excluded));
+    const overlayInfo = new Map(await Promise.all(overlayNames.map(async (relative) => [
+        relative,
+        await stat(path.join(root, ...relative.split("/")), {
+            bigint: true,
+        }).catch(() => null),
+    ])));
+    const overlayHashes = await gitObjectIds(root, overlayNames.filter((relative) => overlayInfo.get(relative)?.isFile()));
+    for (const relative of overlayNames) {
+        const absolute = path.join(root, ...relative.split("/"));
+        const info = overlayInfo.get(relative);
+        if (!info?.isFile()) {
+            files.delete(relative);
+            continue;
+        }
+        const bytes = await readFile(absolute);
+        files.set(relative, {
+            path: relative,
+            mode: gitFileMode(Number(info.mode)),
+            size: bytes.length,
+            sha256: `git:${overlayHashes.get(relative)}`,
+        });
+    }
+    return {
+        repository_root: root,
+        git_head: fingerprint.head,
+        files: [...files.values()].sort((a, b) => a.path.localeCompare(b.path)),
+        fingerprint,
+        snapshot_sha256: fingerprint.identity,
+    };
+}
+export async function createWorkspaceSnapshot(rootInput, workdirInput, label, additionalExcludedWorkdirs = []) {
+    const started = performance.now();
+    const root = path.resolve(rootInput);
+    const workdir = path.resolve(workdirInput);
+    const excluded = excludedPrefixes(root, [
+        workdir,
+        ...additionalExcludedWorkdirs,
+    ]);
+    const manifest = await captureWorkspaceManifest(root, workdir, undefined, additionalExcludedWorkdirs);
+    const before = manifest.fingerprint;
+    const temporary = await mkdtemp(path.join(os.tmpdir(), `ty-context-${safe(label)}-`));
+    try {
+        await gitVoid(root, [
+            "checkout-index",
+            "--all",
+            "--force",
+            `--prefix=${temporary.replace(/\\/gu, "/")}/`,
+        ]);
+        const [modified, untracked] = await Promise.all([
+            gitBuffer(root, ["diff", "--name-only", "-z"]),
+            gitBuffer(root, ["ls-files", "--others", "--exclude-standard", "-z"]),
+        ]);
+        for (const raw of new Set([
+            ...splitZero(modified),
+            ...splitZero(untracked),
+        ])) {
+            const relative = raw.replace(/\\/gu, "/");
+            if (excludedPath(relative, excluded))
+                continue;
+            const source = path.join(root, ...relative.split("/"));
+            const target = path.join(temporary, ...relative.split("/"));
+            const info = await stat(source).catch(() => null);
+            if (!info?.isFile()) {
+                await rm(target, { recursive: true, force: true });
+                continue;
+            }
+            await mkdir(path.dirname(target), { recursive: true });
+            await copyFile(source, target);
+        }
+        await removeExcludedSnapshotPaths(temporary, excluded);
+        await linkDependencyTrees(root, temporary, [
+            workdir,
+            ...additionalExcludedWorkdirs,
+        ]);
+        const after = await captureWorkspaceFingerprint(root, excluded);
+        if (after.identity !== before.identity)
+            throw new Error("workspace_changed_during_snapshot");
+        return {
+            root: temporary,
+            manifest,
+            preparation_ms: performance.now() - started,
+            dispose: () => rm(temporary, { recursive: true, force: true }),
+        };
+    }
+    catch (error) {
+        await rm(temporary, { recursive: true, force: true });
+        throw error;
+    }
+}
+export function changedWorkspacePaths(baseline, current) {
+    const before = new Map(baseline.files.map((file) => [file.path, `${file.mode}:${file.sha256}`]));
+    const after = new Map(current.files.map((file) => [file.path, `${file.mode}:${file.sha256}`]));
+    return [...new Set([...before.keys(), ...after.keys()])]
+        .filter((file) => before.get(file) !== after.get(file))
+        .sort();
+}
+export async function currentGitState(root) {
+    const [head, tree, raw] = await Promise.all([
+        gitOutput(root, ["rev-parse", "HEAD"]),
+        gitOutput(root, ["rev-parse", "HEAD^{tree}"]),
+        gitOutput(root, ["status", "--short", "--untracked-files=all"]),
+    ]);
+    return {
+        head,
+        tree,
+        dirty: raw ? raw.split(/\r?\n/u).filter(Boolean) : [],
+    };
+}
+export async function currentGitTree(root) {
+    return gitOutput(root, ["rev-parse", "HEAD^{tree}"]);
+}
+export async function gitPath(root, pathSpec) {
+    return path.resolve(await gitOutput(root, [
+        "rev-parse",
+        "--path-format=absolute",
+        "--git-path",
+        pathSpec,
+    ]));
+}
+export async function gitConfigGet(root, name) {
+    try {
+        return await gitOutput(root, ["config", "--local", "--get", name]);
+    }
+    catch (error) {
+        if (message(error).includes("git_exit:1"))
+            return null;
+        throw error;
+    }
+}
+export async function gitConfigSet(root, name, value) {
+    await gitVoid(root, ["config", "--local", name, value]);
+}
+export async function gitConfigUnset(root, name) {
+    try {
+        await gitVoid(root, ["config", "--local", "--unset-all", name]);
+    }
+    catch (error) {
+        if (!message(error).includes("git_exit:5"))
+            throw error;
+    }
+}
+export function resolveInsideRepository(rootInput, relativeInput, label) {
+    if (!relativeInput || path.isAbsolute(relativeInput))
+        throw new Error(`unsafe_path:${label}:${relativeInput}`);
+    const normalized = relativeInput.replace(/\\/gu, "/");
+    if (normalized.split("/").includes(".."))
+        throw new Error(`unsafe_path:${label}:${relativeInput}`);
+    const root = path.resolve(rootInput);
+    const resolved = path.resolve(root, ...normalized.split("/"));
+    if (resolved !== root && !resolved.startsWith(`${root}${path.sep}`))
+        throw new Error(`unsafe_path:${label}:${relativeInput}`);
+    return resolved;
+}
+export function repoRelative(rootInput, fileInput) {
+    const value = path
+        .relative(path.resolve(rootInput), path.resolve(fileInput))
+        .replace(/\\/gu, "/");
+    if (value.startsWith("../") || path.isAbsolute(value))
+        throw new Error(`path_outside_repository:${fileInput}`);
+    return value;
+}
+async function untrackedIdentity(root, excluded) {
+    const names = splitZero(await gitBuffer(root, ["ls-files", "--others", "--exclude-standard", "-z"]))
+        .map((name) => name.replace(/\\/gu, "/"))
+        .filter((name) => !excludedPath(name, excluded))
+        .sort();
+    const hashes = await gitObjectIds(root, names);
+    const rows = names.map((name) => [
+        name,
+        hashes.get(name) ?? "missing",
+    ]);
+    return sha256Hex(canonicalValueJson(rows));
+}
+function excludedPrefixes(root, workdirs) {
+    return [
+        ...workdirs.map((workdir) => repoRelative(root, path.resolve(workdir))),
+        "project_context",
+        "tmp/ty-context/long-task-runs",
+    ].filter(Boolean);
+}
+function excludedPath(relative, excluded) {
+    const normalized = relative.replace(/\\/gu, "/");
+    return (normalized.split("/").includes("node_modules") ||
+        excluded.some((prefix) => normalized === prefix || normalized.startsWith(`${prefix}/`)));
+}
+async function removeExcludedSnapshotPaths(snapshotRoot, excluded) {
+    for (const relative of excluded)
+        await rm(path.join(snapshotRoot, ...relative.split("/")), {
+            recursive: true,
+            force: true,
+        });
+    async function visit(directory) {
+        for (const entry of await readdir(directory, { withFileTypes: true })) {
+            const target = path.join(directory, entry.name);
+            if (entry.isDirectory() && entry.name === "node_modules") {
+                await rm(target, { recursive: true, force: true });
+            }
+            else if (entry.isDirectory())
+                await visit(target);
+        }
+    }
+    await visit(snapshotRoot);
+}
+async function linkDependencyTrees(sourceRoot, snapshotRoot, workdirs) {
+    const protectedWorkdirs = workdirs.map((workdir) => repoRelative(sourceRoot, workdir));
+    async function visit(directory, relative = "") {
+        for (const entry of await readdir(directory, { withFileTypes: true })) {
+            const next = relative ? `${relative}/${entry.name}` : entry.name;
+            if (protectedWorkdirs.some((protectedWorkdir) => next === protectedWorkdir ||
+                next.startsWith(`${protectedWorkdir}/`)) ||
+                entry.name === ".git")
+                continue;
+            const source = path.join(directory, entry.name);
+            if (entry.isDirectory() && entry.name === "node_modules") {
+                const target = path.join(snapshotRoot, ...next.split("/"));
+                await mkdir(path.dirname(target), { recursive: true });
+                await rm(target, { recursive: true, force: true });
+                await symlink(source, target, process.platform === "win32" ? "junction" : "dir");
+            }
+            else if (entry.isDirectory())
+                await visit(source, next);
+        }
+    }
+    await visit(sourceRoot);
+}
+function splitZero(value) {
+    return value.toString("utf8").split("\0").filter(Boolean);
+}
+function scopedDiffArgs(base, excluded) {
+    return [
+        ...base,
+        "--",
+        ".",
+        ...excluded.map((prefix) => `:(exclude)${prefix}/**`),
+        ":(exclude)**/node_modules/**",
+    ];
+}
+async function gitObjectIds(root, names) {
+    if (!names.length)
+        return new Map();
+    const output = await gitBufferInput(root, ["hash-object", "--stdin-paths"], Buffer.from(`${names.join("\n")}\n`, "utf8"));
+    const ids = output.toString("utf8").trim().split(/\r?\n/u);
+    return new Map(names.map((name, index) => [name, ids[index]]));
+}
+function gitFileMode(mode) {
+    return mode & 0o111 ? 0o100755 : 0o100644;
+}
+async function gitOutput(root, argv) {
+    return (await gitBuffer(root, argv)).toString("utf8").trim();
+}
+async function gitVoid(root, argv) {
+    await gitBuffer(root, argv);
+}
+async function gitBuffer(root, argv) {
+    return gitBufferInput(root, argv);
+}
+async function gitBufferInput(root, argv, input) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("git", argv, {
+            cwd: root,
+            shell: false,
+            windowsHide: true,
+        });
+        const stdout = [];
+        const stderr = [];
+        child.stdout.on("data", (chunk) => stdout.push(chunk));
+        child.stderr.on("data", (chunk) => stderr.push(chunk));
+        child.on("error", reject);
+        if (input)
+            child.stdin.end(input);
+        child.on("close", (code) => {
+            if (code === 0)
+                resolve(Buffer.concat(stdout));
+            else
+                reject(new Error(`git_exit:${code}:${argv.join(" ")}:${Buffer.concat(stderr).toString("utf8").trim()}`));
+        });
+    });
+}
+function safe(value) {
+    return value.replace(/[^A-Za-z0-9._-]/gu, "-").slice(0, 80);
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}