project-tiny-context-harness 0.8.12 → 0.8.16

package/dist/lib/long-task-status-projection.js

@@ -1,3 +1,4 @@
+import { outcomeResultExternallyBlocked } from "./long-task-claims.js";
 import { progressRecordFresh } from "./long-task-progress.js";
 export function projectDeliveryStatus(input) {
     const outcomes = projectOutcomes(input);
@@ -46,7 +47,8 @@ function projectOutcomes(input) {
         });
         outcomes[outcome.key] = states.includes("progress_failing")
             ? "progress_failing"
-            : states.includes("blocked_external")
+            : outcomeResultExternallyBlocked(input.compiled, outcome.key) ||
+                states.includes("blocked_external")
                 ? "blocked_external"
                 : states.includes("progress_stale")
                     ? "progress_stale"
@@ -99,7 +101,9 @@ function projectFindings(input) {
 function readyOutcomes(compiled, outcomes, stages) {
     return compiled.outcomes
         .filter((outcome) => stages[outcome.stage] !== "locked" &&
+        stages[outcome.stage] !== "blocked_external" &&
         stages[outcome.stage] !== "progress_passing" &&
+        outcomes[outcome.key] !== "blocked_external" &&
         outcomes[outcome.key] !== "progress_passing" &&
         outcome.depends_on.every((dependency) => outcomes[dependency] === "progress_passing"))
         .map((outcome) => outcome.key);

package/dist/lib/long-task-target-policy.d.ts

@@ -1,4 +1,4 @@
-import type { CompiledClaimsV2 } from "./long-task-claims.js";
+import { type CompiledClaimsV2 } from "./long-task-claims.js";
 import type { DeliveryContractV2 } from "./long-task-delivery-types.js";
 type Reporter = (message: string) => void;
 export declare function validateExecutionTargets(contract: DeliveryContractV2, report?: Reporter): void;

package/dist/lib/long-task-target-policy.js

@@ -1,3 +1,4 @@
+import { outcomeResultExternallyBlocked, } from "./long-task-claims.js";
 const FAMILY_CAPABILITY = {
     browser: "browser-runtime",
     native: "native-runtime",
@@ -94,6 +95,8 @@ function validateCriticalPathTargets(contract, requiredTargetRefs, report) {
         const outcome = contract.outcomes.find((candidate) => candidate.key === outcomeKey);
         if (!outcome)
             continue;
+        if (outcomeResultExternallyBlocked(contract, outcome.key))
+            continue;
         for (const targetRef of requiredTargetRefs)
             if (!outcome.acceptance.checks.some((check) => provesSuccess(check, targetRef)))
                 issue(report, "critical_path_required_target_proof_missing", `${outcome.key}:${targetRef}`);

package/dist/lib/long-task-verifier-authority.js

@@ -37,6 +37,8 @@ function changedVerifierFiles(previous, next) {
         ...Object.keys(next.bundle_files),
     ]);
     const changed = [...files].filter((file) => previous.bundle_files[file] !== next.bundle_files[file]);
+    if (previous.bundle_sha256 !== next.bundle_sha256)
+        changed.push("<bundle>");
     if (previous.schema_sha256 !== next.schema_sha256)
         changed.push("<schema>");
     if (previous.hook_sha256 !== next.hook_sha256)

package/dist/lib/long-task-verifier-dependency-closure.js

@@ -167,11 +167,15 @@ function localSpecifierBase(importer, specifier) {
     const base = specifier.startsWith("/")
         ? specifier.slice(1)
         : path.posix.normalize(path.posix.join(path.posix.dirname(importer), specifier));
-    return base === ".." || base.startsWith("../") ? null : base;
+    const canonicalBase = base.replace(/\/+$/u, "") || ".";
+    return canonicalBase === ".." || canonicalBase.startsWith("../")
+        ? null
+        : canonicalBase;
 }
 function runtimePatternOwns(base, pattern) {
-    return (matchesRepoPattern(base, pattern) ||
-        classifyRepositoryPatternOverlap(`${base}/**`, pattern).status ===
+    const directoryPattern = base === "." ? "**" : `${base}/**`;
+    return ((base !== "." && matchesRepoPattern(base, pattern)) ||
+        classifyRepositoryPatternOverlap(directoryPattern, pattern).status ===
             "proven_overlap");
 }
 function sortRecord(value) {

package/dist/lib/long-task-verifier-v2.js

@@ -2,6 +2,7 @@ import { deliveryCompileFreshness } from "./long-task-freshness.js";
 import { assertVerifierAuthorityCurrent } from "./long-task-freshness.js";
 import { enrichCheckResultFindings, enrichFinding, } from "./long-task-finding-context.js";
 import { executeCheckRunner } from "./long-task-check-runner.js";
+import { prepareExecutionObservationUniverse } from "./long-task-execution-observation.js";
 import { evaluateCheckEvidence, evaluateGlobalCounterfactuals, evaluateOutcomeCounterfactuals, } from "./long-task-evidence-v2.js";
 import { matchesRepoPattern } from "./long-task-paths.js";
 import { activeAuthorityIdentityMatches, loadActiveLongTaskAuthority, writeProgressRecord, } from "./long-task-state.js";
@@ -85,6 +86,12 @@ async function resolved(workdir) {
     return (await import("node:path")).default.resolve(workdir);
 }
 export async function runDeliveryChecks(compiled, snapshot, checks, includeCounterfactuals, finalGate = false) {
+    const observationAuthorityPaths = [
+        compiled.contract_file,
+        ...Object.keys(compiled.contract_files),
+        ...Object.keys(compiled.source_hashes),
+        ...compiled.context_snapshot.files,
+    ];
     const findings = await preRunFindings(compiled, snapshot.manifest);
     if (finalGate)
         findings.push(...finalPathFindings(compiled, snapshot.manifest));
@@ -95,17 +102,46 @@ export async function runDeliveryChecks(compiled, snapshot, checks, includeCount
             findings: findings.map((finding) => enrichFinding(compiled, finding)),
         };
     const rawExecutions = new Map();
+    const completeChecks = allCompiledChecks(compiled);
+    const selectedExecutionGroups = rawExecutionGroups(checks);
+    const completeExecutionGroups = selectedExecutionGroups.map((group) => completeChecks.filter((check) => check.raw_execution_identity === group[0].raw_execution_identity));
+    const preparedExecutionGroups = await prepareExecutionObservationUniverse({
+        groups: completeExecutionGroups,
+        snapshot_root: snapshot.root,
+        workspace_manifest: snapshot.manifest,
+        protected_authority_paths: observationAuthorityPaths,
+    });
+    try {
+        const pending = [];
+        for (const [index, group] of selectedExecutionGroups.entries()) {
+            const prepared = preparedExecutionGroups[index];
+            if (!prepared)
+                throw new Error("raw_execution_group_prepare_missing");
+            pending.push({
+                raw_execution_identity: group[0].raw_execution_identity,
+                raw: await executeCheckRunner(group[0], prepared.execution_root, prepared.runner_context),
+                prepared,
+            });
+        }
+        const finalized = await Promise.all(pending.map(async (entry) => ({
+            raw_execution_identity: entry.raw_execution_identity,
+            raw: await entry.prepared.finalize(entry.raw),
+        })));
+        for (const entry of finalized)
+            rawExecutions.set(entry.raw_execution_identity, entry.raw);
+    }
+    finally {
+        await Promise.all(preparedExecutionGroups.map((prepared) => prepared.dispose()));
+    }
     const mainCheckResults = [];
     for (const check of checks) {
-        let raw = rawExecutions.get(check.raw_execution_identity);
-        if (!raw) {
-            raw = await executeCheckRunner(check, snapshot.root);
-            rawExecutions.set(check.raw_execution_identity, raw);
-        }
+        const raw = rawExecutions.get(check.raw_execution_identity);
+        if (!raw)
+            throw new Error("raw_execution_group_result_missing");
         const outcome = check.outcome_key
             ? compiled.outcomes.find((item) => item.key === check.outcome_key)
             : undefined;
-        mainCheckResults.push(await evaluateCheckEvidence(check, raw, snapshot.root, outcome));
+        mainCheckResults.push(await evaluateCheckEvidence(check, raw, snapshot.root, outcome, observationAuthorityPaths));
     }
     const counterfactualFindings = [];
     if (includeCounterfactuals) {
@@ -122,7 +158,7 @@ export async function runDeliveryChecks(compiled, snapshot, checks, includeCount
             passingCheckIds.has(check.internal_id))
             .map((check) => check.key));
         if (selectedGlobalCheckKeys.size)
-            counterfactualFindings.push(...(await evaluateGlobalCounterfactuals(compiled, snapshot.root, selectedGlobalCheckKeys, snapshot.manifest)));
+            counterfactualFindings.push(...(await evaluateGlobalCounterfactuals(compiled, snapshot.root, selectedGlobalCheckKeys, snapshot.manifest, mainCheckResults, rawExecutions, completeChecks)));
         const outcomeKeys = new Set(checks
             .map((check) => check.outcome_key)
             .filter((key) => Boolean(key)));
@@ -137,7 +173,7 @@ export async function runDeliveryChecks(compiled, snapshot, checks, includeCount
                     ...outcome.acceptance,
                     counterfactual_controls: outcome.acceptance.counterfactual_controls.filter((control) => selectedKeys.has(control.check_key)),
                 },
-            }, snapshot.root, snapshot.manifest, compiled.context_snapshot.files)));
+            }, snapshot.root, snapshot.manifest, observationAuthorityPaths, mainCheckResults, rawExecutions, completeChecks)));
         }
     }
     const unassignedCounterfactuals = counterfactualFindings.filter((finding) => !mainCheckResults.some((result) => findingBelongsToCheck(finding, result)));
@@ -154,6 +190,17 @@ export async function runDeliveryChecks(compiled, snapshot, checks, includeCount
         findings: findings.map((finding) => enrichFinding(compiled, finding)),
     };
 }
+function rawExecutionGroups(checks) {
+    const groups = new Map();
+    for (const check of checks) {
+        const group = groups.get(check.raw_execution_identity);
+        if (group)
+            group.push(check);
+        else
+            groups.set(check.raw_execution_identity, [check]);
+    }
+    return [...groups.values()];
+}
 function applyCounterfactualFindings(checkResults, findings, unassignedFinding) {
     return checkResults.map((result, index) => {
         const projected = findings.filter((finding) => findingBelongsToCheck(finding, result));
@@ -200,7 +247,9 @@ function finalPathFindings(compiled, manifest) {
     for (const outcome of compiled.outcomes)
         for (const binding of outcome.technical.bindings)
             if (binding.existence === "planned" &&
-                !plannedBindingRequiredPatterns(binding).every((pattern) => manifest.files.some((file) => matchesRepoPattern(file.path, pattern))))
+                !plannedBindingRequiredPatterns(binding).every((pattern) => manifest.files.some((file) => matchesRepoPattern(file.path, pattern))) &&
+                !outcome.acceptance.checks.some((check) => (check.observation_authorities ?? []).some((authority) => authority.authority === "package_static_json_exact" &&
+                    authority.carrier_refs.some((carrier) => carrier.binding_ref === `${outcome.key}.${binding.key}`))))
                 findings.push({
                     code: "binding_missing",
                     outcome_key: outcome.key,
@@ -212,6 +261,18 @@ function finalPathFindings(compiled, manifest) {
                     expected: binding.carrier_paths,
                     next_action: "Implement the declared binding and rerun verification.",
                 });
+    for (const check of allCompiledChecks(compiled))
+        for (const runtimePath of check.process_runtime_closure
+            ?.allowed_runtime_files ?? [])
+            if (!manifest.files.some((file) => file.path === runtimePath))
+                findings.push({
+                    code: "process_runtime_input_missing",
+                    outcome_key: check.outcome_key,
+                    check_key: check.key,
+                    message: `Declared process runtime input did not exist in the Final Gate candidate: ${runtimePath}`,
+                    expected: runtimePath,
+                    next_action: "Materialize the Source-backed product root and every declared production runtime input, then rerun Final Gate.",
+                });
     return findings;
 }
 function plannedBindingRequiredPatterns(binding) {

package/dist/lib/long-task-workspace-manifest.d.ts

@@ -0,0 +1,8 @@
+import type { WorkspaceFingerprintV2, WorkspaceManifestV2 } from "./long-task-delivery-types.js";
+export declare function captureWorkspaceFingerprint(rootInput: string, excludedPrefixes?: string[]): Promise<WorkspaceFingerprintV2>;
+export declare function captureWorkspaceManifest(rootInput: string, workdirInput: string, _copyRoot?: string, additionalExcludedWorkdirs?: string[]): Promise<WorkspaceManifestV2>;
+export declare function changedWorkspacePaths(baseline: WorkspaceManifestV2, current: WorkspaceManifestV2): string[];
+export declare function changedWorkspacePathsFromHead(rootInput: string, workdirInput: string, additionalExcludedWorkdirs?: string[]): Promise<string[]>;
+export declare function workspaceFingerprintExcludedPrefixes(root: string, workdirs: string[]): string[];
+export declare function workspaceSnapshotExcludedPrefixes(root: string, workdirs: string[]): string[];
+export declare function workspacePathExcluded(relative: string, excluded: string[]): boolean;

package/dist/lib/long-task-workspace-manifest.js

@@ -0,0 +1,173 @@
+import { readFile, stat } from "node:fs/promises";
+import path from "node:path";
+import { gitBuffer, gitBufferInput, gitOutput, repoRelative, splitGitZero, } from "./long-task-git.js";
+import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
+export async function captureWorkspaceFingerprint(rootInput, excludedPrefixes = []) {
+    const root = path.resolve(rootInput);
+    const indexTree = await gitOutput(root, ["write-tree"]);
+    const [head, headTree, staged, unstaged, statusBytes, untracked] = await Promise.all([
+        gitOutput(root, ["rev-parse", "HEAD"]),
+        gitOutput(root, ["rev-parse", "HEAD^{tree}"]),
+        gitBuffer(root, scopedDiffArgs(["diff", "--cached", "--binary", "--no-ext-diff"], excludedPrefixes)),
+        gitBuffer(root, scopedDiffArgs(["diff", "--binary", "--no-ext-diff"], excludedPrefixes)),
+        Promise.all([
+            gitBuffer(root, scopedDiffArgs(["diff", "--cached", "--raw", "-z", "-M"], excludedPrefixes)),
+            gitBuffer(root, scopedDiffArgs(["diff", "--raw", "-z", "-M"], excludedPrefixes)),
+        ]).then((rows) => Buffer.concat(rows)),
+        untrackedIdentity(root, excludedPrefixes),
+    ]);
+    const unsigned = {
+        head,
+        head_tree: headTree,
+        index_tree: indexTree,
+        staged_diff_sha256: sha256Hex(staged),
+        unstaged_diff_sha256: sha256Hex(unstaged),
+        untracked_sha256: untracked,
+        status_sha256: sha256Hex(statusBytes),
+    };
+    return {
+        ...unsigned,
+        identity: sha256Hex(canonicalValueJson(unsigned)),
+    };
+}
+export async function captureWorkspaceManifest(rootInput, workdirInput, _copyRoot, additionalExcludedWorkdirs = []) {
+    const root = path.resolve(rootInput);
+    const workdir = path.resolve(workdirInput);
+    const workdirRelative = repoRelative(root, workdir);
+    if (!workdirRelative)
+        throw new Error("long_task_workdir_must_not_be_repository_root");
+    const excluded = workspaceFingerprintExcludedPrefixes(root, [
+        workdir,
+        ...additionalExcludedWorkdirs,
+    ]);
+    const fingerprint = await captureWorkspaceFingerprint(root, excluded);
+    const [indexBytes, modifiedBytes, untrackedBytes] = await Promise.all([
+        gitBuffer(root, ["ls-files", "--stage", "-z"]),
+        gitBuffer(root, ["diff", "--name-only", "-z"]),
+        gitBuffer(root, ["ls-files", "--others", "--exclude-standard", "-z"]),
+    ]);
+    const files = new Map();
+    for (const record of splitGitZero(indexBytes)) {
+        const tab = record.indexOf("\t");
+        if (tab < 0)
+            continue;
+        const [modeText, objectId, stage] = record.slice(0, tab).split(" ");
+        const relative = record.slice(tab + 1).replace(/\\/gu, "/");
+        if (stage !== "0" || workspacePathExcluded(relative, excluded))
+            continue;
+        files.set(relative, {
+            path: relative,
+            mode: Number.parseInt(modeText, 8),
+            size: 0,
+            sha256: `git:${objectId}`,
+        });
+    }
+    const overlays = new Set([
+        ...splitGitZero(modifiedBytes),
+        ...splitGitZero(untrackedBytes),
+    ]);
+    const overlayNames = [...overlays]
+        .map((raw) => raw.replace(/\\/gu, "/"))
+        .filter((relative) => !workspacePathExcluded(relative, excluded));
+    const overlayInfo = new Map(await Promise.all(overlayNames.map(async (relative) => [
+        relative,
+        await stat(path.join(root, ...relative.split("/")), {
+            bigint: true,
+        }).catch(() => null),
+    ])));
+    const overlayHashes = await gitObjectIds(root, overlayNames.filter((relative) => overlayInfo.get(relative)?.isFile()));
+    for (const relative of overlayNames) {
+        const absolute = path.join(root, ...relative.split("/"));
+        const info = overlayInfo.get(relative);
+        if (!info?.isFile()) {
+            files.delete(relative);
+            continue;
+        }
+        const bytes = await readFile(absolute);
+        files.set(relative, {
+            path: relative,
+            mode: gitFileMode(Number(info.mode)),
+            size: bytes.length,
+            sha256: `git:${overlayHashes.get(relative)}`,
+        });
+    }
+    return {
+        repository_root: root,
+        git_head: fingerprint.head,
+        files: [...files.values()].sort((a, b) => a.path.localeCompare(b.path)),
+        fingerprint,
+        snapshot_sha256: fingerprint.identity,
+    };
+}
+export function changedWorkspacePaths(baseline, current) {
+    const before = new Map(baseline.files.map((file) => [file.path, `${file.mode}:${file.sha256}`]));
+    const after = new Map(current.files.map((file) => [file.path, `${file.mode}:${file.sha256}`]));
+    return [...new Set([...before.keys(), ...after.keys()])]
+        .filter((file) => before.get(file) !== after.get(file))
+        .sort();
+}
+export async function changedWorkspacePathsFromHead(rootInput, workdirInput, additionalExcludedWorkdirs = []) {
+    const root = path.resolve(rootInput);
+    const workdir = path.resolve(workdirInput);
+    const excluded = workspaceFingerprintExcludedPrefixes(root, [
+        workdir,
+        ...additionalExcludedWorkdirs,
+    ]);
+    const [trackedBytes, untrackedBytes] = await Promise.all([
+        gitBuffer(root, scopedDiffArgs(["diff", "--name-only", "--no-renames", "--no-ext-diff", "-z", "HEAD"], excluded)),
+        gitBuffer(root, ["ls-files", "--others", "--exclude-standard", "-z"]),
+    ]);
+    return [
+        ...new Set([...splitGitZero(trackedBytes), ...splitGitZero(untrackedBytes)]
+            .map((raw) => raw.replace(/\\/gu, "/"))
+            .filter((relative) => !workspacePathExcluded(relative, excluded))),
+    ].sort();
+}
+export function workspaceFingerprintExcludedPrefixes(root, workdirs) {
+    return [
+        ...workspaceSnapshotExcludedPrefixes(root, workdirs),
+        "project_context",
+    ].filter(Boolean);
+}
+export function workspaceSnapshotExcludedPrefixes(root, workdirs) {
+    return [
+        ...workdirs.map((workdir) => repoRelative(root, path.resolve(workdir))),
+        "tmp/ty-context/long-task-runs",
+    ].filter(Boolean);
+}
+export function workspacePathExcluded(relative, excluded) {
+    const normalized = relative.replace(/\\/gu, "/");
+    return (normalized.split("/").includes("node_modules") ||
+        excluded.some((prefix) => normalized === prefix || normalized.startsWith(`${prefix}/`)));
+}
+async function untrackedIdentity(root, excluded) {
+    const names = splitGitZero(await gitBuffer(root, ["ls-files", "--others", "--exclude-standard", "-z"]))
+        .map((name) => name.replace(/\\/gu, "/"))
+        .filter((name) => !workspacePathExcluded(name, excluded))
+        .sort();
+    const hashes = await gitObjectIds(root, names);
+    const rows = names.map((name) => [
+        name,
+        hashes.get(name) ?? "missing",
+    ]);
+    return sha256Hex(canonicalValueJson(rows));
+}
+async function gitObjectIds(root, names) {
+    if (!names.length)
+        return new Map();
+    const output = await gitBufferInput(root, ["hash-object", "--stdin-paths"], Buffer.from(`${names.join("\n")}\n`, "utf8"));
+    const ids = output.toString("utf8").trim().split(/\r?\n/u);
+    return new Map(names.map((name, index) => [name, ids[index]]));
+}
+function scopedDiffArgs(base, excluded) {
+    return [
+        ...base,
+        "--",
+        ".",
+        ...excluded.map((prefix) => `:(exclude)${prefix}/**`),
+        ":(exclude)**/node_modules/**",
+    ];
+}
+function gitFileMode(mode) {
+    return mode & 0o111 ? 0o100755 : 0o100644;
+}

package/dist/lib/long-task-workspace-snapshot.d.ts

@@ -0,0 +1,8 @@
+import type { WorkspaceManifestV2 } from "./long-task-delivery-types.js";
+export interface WorkspaceSnapshotV2 {
+    root: string;
+    manifest: WorkspaceManifestV2;
+    preparation_ms: number;
+    dispose(): Promise<void>;
+}
+export declare function createWorkspaceSnapshot(rootInput: string, workdirInput: string, label: string, additionalExcludedWorkdirs?: string[]): Promise<WorkspaceSnapshotV2>;

package/dist/lib/long-task-workspace-snapshot.js

@@ -0,0 +1,176 @@
+import { copyFile, mkdir, mkdtemp, readdir, rm, stat, symlink, } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { GitCommandError, gitBuffer, gitEffectiveConfigGet, gitVoid, repoRelative, splitGitZero, } from "./long-task-git.js";
+import { captureWorkspaceFingerprint, captureWorkspaceManifest, workspaceFingerprintExcludedPrefixes, workspacePathExcluded, workspaceSnapshotExcludedPrefixes, } from "./long-task-workspace-manifest.js";
+const MAX_CHECKOUT_INDEX_ATTEMPTS = 2;
+export async function createWorkspaceSnapshot(rootInput, workdirInput, label, additionalExcludedWorkdirs = []) {
+    const started = performance.now();
+    const root = path.resolve(rootInput);
+    const workdir = path.resolve(workdirInput);
+    const fingerprintExcluded = workspaceFingerprintExcludedPrefixes(root, [
+        workdir,
+        ...additionalExcludedWorkdirs,
+    ]);
+    const snapshotExcluded = workspaceSnapshotExcludedPrefixes(root, [
+        workdir,
+        ...additionalExcludedWorkdirs,
+    ]);
+    const manifest = await captureWorkspaceManifest(root, workdir, undefined, additionalExcludedWorkdirs);
+    const before = manifest.fingerprint;
+    const temporary = await checkoutIndexIntoFreshRoot(root, label, before.identity, fingerprintExcluded);
+    try {
+        await overlayTrackedEolDifferences(root, temporary);
+        const [modified, untracked] = await Promise.all([
+            gitBuffer(root, ["diff", "--name-only", "-z"]),
+            gitBuffer(root, ["ls-files", "--others", "--exclude-standard", "-z"]),
+        ]);
+        for (const raw of new Set([
+            ...splitGitZero(modified),
+            ...splitGitZero(untracked),
+        ])) {
+            const relative = raw.replace(/\\/gu, "/");
+            if (workspacePathExcluded(relative, snapshotExcluded))
+                continue;
+            const source = path.join(root, ...relative.split("/"));
+            const target = path.join(temporary, ...relative.split("/"));
+            const info = await stat(source).catch(() => null);
+            if (!info?.isFile()) {
+                await rm(target, { recursive: true, force: true });
+                continue;
+            }
+            await mkdir(path.dirname(target), { recursive: true });
+            await copyFile(source, target);
+        }
+        await removeExcludedSnapshotPaths(temporary, snapshotExcluded);
+        await linkDependencyTrees(root, temporary, [
+            workdir,
+            ...additionalExcludedWorkdirs,
+        ]);
+        const after = await captureWorkspaceFingerprint(root, fingerprintExcluded);
+        if (after.identity !== before.identity)
+            throw new Error("workspace_changed_during_snapshot");
+        return {
+            root: temporary,
+            manifest,
+            preparation_ms: performance.now() - started,
+            dispose: () => rm(temporary, { recursive: true, force: true }),
+        };
+    }
+    catch (error) {
+        await rm(temporary, { recursive: true, force: true });
+        throw error;
+    }
+}
+async function checkoutIndexIntoFreshRoot(root, label, expectedFingerprint, fingerprintExcluded) {
+    for (let attempt = 1; attempt <= MAX_CHECKOUT_INDEX_ATTEMPTS; attempt += 1) {
+        const temporary = await mkdtemp(path.join(os.tmpdir(), `ty-context-${safe(label)}-`));
+        try {
+            await gitVoid(root, [
+                "checkout-index",
+                "--all",
+                "--force",
+                "--ignore-skip-worktree-bits",
+                `--prefix=${temporary.replace(/\\/gu, "/")}/`,
+            ]);
+            return temporary;
+        }
+        catch (error) {
+            await rm(temporary, { recursive: true, force: true });
+            if (!retryableUnclassifiedCheckout(error) ||
+                attempt === MAX_CHECKOUT_INDEX_ATTEMPTS)
+                throw error;
+            const current = await captureWorkspaceFingerprint(root, fingerprintExcluded);
+            if (current.identity !== expectedFingerprint)
+                throw new Error("workspace_changed_during_snapshot");
+        }
+    }
+    throw new Error("workspace_snapshot_checkout_attempts_exhausted");
+}
+function retryableUnclassifiedCheckout(error) {
+    return (error instanceof GitCommandError &&
+        error.exitCode === 1 &&
+        error.signal === null &&
+        error.stdoutBytes === 0 &&
+        error.stderrBytes === 0);
+}
+async function removeExcludedSnapshotPaths(snapshotRoot, excluded) {
+    for (const relative of excluded)
+        await rm(path.join(snapshotRoot, ...relative.split("/")), {
+            recursive: true,
+            force: true,
+        });
+    async function visit(directory) {
+        for (const entry of await readdir(directory, { withFileTypes: true })) {
+            const target = path.join(directory, entry.name);
+            if (entry.isDirectory() && entry.name === "node_modules") {
+                await rm(target, { recursive: true, force: true });
+            }
+            else if (entry.isDirectory())
+                await visit(target);
+        }
+    }
+    await visit(snapshotRoot);
+}
+async function overlayTrackedEolDifferences(sourceRoot, snapshotRoot) {
+    const [raw, autocrlf] = await Promise.all([
+        gitBuffer(sourceRoot, ["ls-files", "--eol", "-z"]),
+        gitEffectiveConfigGet(sourceRoot, "core.autocrlf"),
+    ]);
+    for (const record of splitGitZero(raw)) {
+        const tab = record.indexOf("\t");
+        if (tab < 0)
+            continue;
+        const metadata = record.slice(0, tab);
+        const relative = record.slice(tab + 1).replace(/\\/gu, "/");
+        const match = metadata.match(/^i\/(\S+)\s+w\/(\S+)\s+attr\/(.*)$/u);
+        if (!match)
+            continue;
+        const [, indexEol, worktreeEol, attributesRaw] = match;
+        const expected = checkoutEol(indexEol, attributesRaw.trim(), autocrlf);
+        if (worktreeEol === expected)
+            continue;
+        const source = path.join(sourceRoot, ...relative.split("/"));
+        const target = path.join(snapshotRoot, ...relative.split("/"));
+        const info = await stat(source).catch(() => null);
+        if (!info?.isFile())
+            continue;
+        await mkdir(path.dirname(target), { recursive: true });
+        await copyFile(source, target);
+    }
+}
+function checkoutEol(indexEol, attributes, autocrlf) {
+    const explicit = attributes.match(/(?:^|\s)eol=(lf|crlf)(?:\s|$)/u)?.[1];
+    if (explicit)
+        return explicit;
+    if (/(?:^|\s)-text(?:\s|$)/u.test(attributes))
+        return indexEol;
+    if (indexEol === "-text" || indexEol === "none")
+        return indexEol;
+    return autocrlf?.toLowerCase() === "true" ? "crlf" : indexEol;
+}
+async function linkDependencyTrees(sourceRoot, snapshotRoot, workdirs) {
+    const protectedWorkdirs = workdirs.map((workdir) => repoRelative(sourceRoot, workdir));
+    async function visit(directory, relative = "") {
+        for (const entry of await readdir(directory, { withFileTypes: true })) {
+            const next = relative ? `${relative}/${entry.name}` : entry.name;
+            if (protectedWorkdirs.some((protectedWorkdir) => next === protectedWorkdir ||
+                next.startsWith(`${protectedWorkdir}/`)) ||
+                entry.name === ".git")
+                continue;
+            const source = path.join(directory, entry.name);
+            if (entry.isDirectory() && entry.name === "node_modules") {
+                const target = path.join(snapshotRoot, ...next.split("/"));
+                await mkdir(path.dirname(target), { recursive: true });
+                await rm(target, { recursive: true, force: true });
+                await symlink(source, target, process.platform === "win32" ? "junction" : "dir");
+            }
+            else if (entry.isDirectory())
+                await visit(source, next);
+        }
+    }
+    await visit(sourceRoot);
+}
+function safe(value) {
+    return value.replace(/[^A-Za-z0-9._-]/gu, "-").slice(0, 80);
+}

package/dist/lib/long-task-workspace.d.ts

@@ -1,26 +1,5 @@
-import type { WorkspaceFingerprintV2, WorkspaceManifestV2 } from "./long-task-delivery-types.js";
-export interface WorkspaceSnapshotV2 {
-    root: string;
-    manifest: WorkspaceManifestV2;
-    preparation_ms: number;
-    dispose(): Promise<void>;
-}
-export declare function repositoryRoot(start: string): Promise<string>;
-export declare function gitCommonDir(root: string): Promise<string>;
-export declare function captureWorkspaceFingerprint(rootInput: string, excludedPrefixes?: string[]): Promise<WorkspaceFingerprintV2>;
-export declare function captureWorkspaceManifest(rootInput: string, workdirInput: string, _copyRoot?: string, additionalExcludedWorkdirs?: string[]): Promise<WorkspaceManifestV2>;
-export declare function createWorkspaceSnapshot(rootInput: string, workdirInput: string, label: string, additionalExcludedWorkdirs?: string[]): Promise<WorkspaceSnapshotV2>;
-export declare function changedWorkspacePaths(baseline: WorkspaceManifestV2, current: WorkspaceManifestV2): string[];
-export declare function changedWorkspacePathsFromHead(rootInput: string, workdirInput: string, additionalExcludedWorkdirs?: string[]): Promise<string[]>;
-export declare function currentGitState(root: string): Promise<{
-    head: string;
-    tree: string;
-    dirty: string[];
-}>;
-export declare function currentGitTree(root: string): Promise<string>;
-export declare function gitPath(root: string, pathSpec: string): Promise<string>;
-export declare function gitConfigGet(root: string, name: string): Promise<string | null>;
-export declare function gitConfigSet(root: string, name: string, value: string): Promise<void>;
-export declare function gitConfigUnset(root: string, name: string): Promise<void>;
-export declare function resolveInsideRepository(rootInput: string, relativeInput: string, label: string): string;
-export declare function repoRelative(rootInput: string, fileInput: string): string;
+export { resolveInsideRepository } from "./repository-path-safety.js";
+export { currentGitState, currentGitTree, gitCommonDir, gitConfigGet, gitConfigSet, gitConfigUnset, gitPath, repoRelative, repositoryRoot, } from "./long-task-git.js";
+export { captureWorkspaceFingerprint, captureWorkspaceManifest, changedWorkspacePaths, changedWorkspacePathsFromHead, } from "./long-task-workspace-manifest.js";
+export { createWorkspaceSnapshot } from "./long-task-workspace-snapshot.js";
+export type { WorkspaceSnapshotV2 } from "./long-task-workspace-snapshot.js";