repro-surgeon 0.1.0

package/docs/evidence/dependency-removal.json

@@ -0,0 +1,109 @@
+{
+  "date": "2026-09-06",
+  "kind": "owned-public-dependency-removal",
+  "fixtureGenerator": "scripts/validate-dependency.mjs",
+  "package": "picomatch",
+  "installedVersion": "4.0.7",
+  "runtime": {
+    "node": "v24.7.0",
+    "npm": "11.5.1",
+    "platform": "darwin",
+    "arch": "arm64",
+    "tool": "0.1.0"
+  },
+  "settings": {
+    "command": [
+      "node",
+      "check.cjs"
+    ],
+    "oracle": {
+      "exitCode": 1,
+      "allOf": [
+        "OWNED_DEPENDENCY_TOTAL_MISMATCH: expected 12, got 13"
+      ],
+      "noneOf": [
+        "UNRELATED_DEPENDENCY_FAILURE",
+        "Cannot find module"
+      ]
+    },
+    "budget": {
+      "maxEvaluations": 8,
+      "maxSeconds": 120
+    },
+    "runs": {
+      "baseline": 3,
+      "candidate": 2,
+      "final": 3
+    },
+    "allowInstallScripts": false,
+    "reduce": {
+      "files": false,
+      "syntax": false,
+      "json": false,
+      "dependencies": true
+    }
+  },
+  "sourceHash": "2b68d61aaf59c75ef98252db282721903063db57e668ee6b655cc21831cdbc13",
+  "sourceUnchanged": true,
+  "initial": {
+    "files": 4,
+    "bytes": 1139,
+    "sourceBytes": 310,
+    "dependencies": 1
+  },
+  "current": {
+    "files": 4,
+    "bytes": 625,
+    "sourceBytes": 310,
+    "dependencies": 0
+  },
+  "baseline": [
+    "reproduced",
+    "reproduced",
+    "reproduced"
+  ],
+  "evaluations": 2,
+  "totalMs": 2474,
+  "verification": {
+    "status": "verified",
+    "runs": 3,
+    "snapshotHash": "5849b96b1d4751a2f431a8dc2dcf0dfc4752c3b59460d0abc3f9ec604ed4a2fe",
+    "environment": "fresh-directory"
+  },
+  "controls": [
+    {
+      "kind": "trigger-removed",
+      "exitCode": 0,
+      "status": "absent"
+    },
+    {
+      "kind": "different-failure",
+      "exitCode": 1,
+      "status": "absent"
+    }
+  ],
+  "manifestDependencyRemoved": true,
+  "lockDependencyRemoved": true,
+  "exportedMetadataMatchesAccepted": true,
+  "acceptedChanges": [
+    {
+      "kind": "dependencies",
+      "paths": [
+        "package.json",
+        "package-lock.json"
+      ],
+      "confirmations": 2
+    }
+  ],
+  "standalone": {
+    "exitCode": 0
+  },
+  "timingScope": {
+    "totalMs": "Reduction, export verification and standalone verification; excludes fixture lock generation, installation proof and controls."
+  },
+  "limits": [
+    "The pinned public package was unused by the locally authored failure command.",
+    "Source bytes and file count did not decrease; this validates the dependency pass and exact exported npm metadata.",
+    "One macOS ARM64 environment; not general package-manager, platform or performance coverage."
+  ]
+}

package/docs/evidence/next-frameworks.json

@@ -0,0 +1,271 @@
+{
+  "date": "2026-09-06",
+  "kind": "independent-next-report-reconstructions",
+  "runtime": {
+    "node": "v24.7.0",
+    "npm": "11.5.1",
+    "platform": "darwin",
+    "arch": "arm64",
+    "tool": "0.1.0"
+  },
+  "validationScript": "scripts/validate-next.mjs",
+  "provenance": "Independently authored reconstructions of reported triggers; the original reproduction repositories were not copied or executed.",
+  "cases": [
+    {
+      "name": "next-container",
+      "fixture": "examples/next-container",
+      "upstreamIssue": "https://github.com/vercel/next.js/issues/98261",
+      "nextVersion": "16.3.4",
+      "settings": {
+        "command": [
+          "npm",
+          "run",
+          "build"
+        ],
+        "oracle": {
+          "exitCode": 1,
+          "allOf": [
+            "Parsing CSS source code failed",
+            "@container scroll-content",
+            "Unexpected end of input"
+          ],
+          "noneOf": [
+            "Module not found",
+            "Cannot find module",
+            "Failed to fetch"
+          ]
+        },
+        "budget": {
+          "maxEvaluations": 80,
+          "maxSeconds": 900
+        },
+        "runs": {
+          "baseline": 3,
+          "candidate": 2,
+          "final": 3
+        },
+        "allowInstallScripts": false,
+        "reduce": {
+          "files": true,
+          "syntax": true,
+          "json": true,
+          "dependencies": false
+        }
+      },
+      "sourceHash": "779ebdbe72d3ca4e1da159cf28634c761aed3b838d8a81f492ff38d1b06d644f",
+      "sourceUnchanged": true,
+      "initial": {
+        "files": 10,
+        "bytes": 33310,
+        "sourceBytes": 2116,
+        "dependencies": 3
+      },
+      "current": {
+        "files": 7,
+        "bytes": 31389,
+        "sourceBytes": 195,
+        "dependencies": 3
+      },
+      "baseline": [
+        "reproduced",
+        "reproduced",
+        "reproduced"
+      ],
+      "evaluations": 26,
+      "searchMs": 237328.937125,
+      "totalMs": 289801,
+      "verification": {
+        "status": "verified",
+        "runs": 3,
+        "snapshotHash": "edcd4a94f38488bf6864afec1178eb44d1a653ae605875f709f31cc992d0996b",
+        "environment": "fresh-directory"
+      },
+      "controls": [
+        {
+          "kind": "trigger-removed",
+          "exitCode": 0,
+          "status": "absent"
+        },
+        {
+          "kind": "different-failure",
+          "exitCode": 1,
+          "status": "absent"
+        }
+      ]
+    },
+    {
+      "name": "next-root-param",
+      "fixture": "examples/next-root-param",
+      "upstreamIssue": "https://github.com/vercel/next.js/issues/97927",
+      "nextVersion": "16.3.3",
+      "settings": {
+        "command": [
+          "npm",
+          "run",
+          "build"
+        ],
+        "oracle": {
+          "exitCode": 1,
+          "allOf": [
+            ".next/types/root-params.d.ts(4,23): error TS1005: '(' expected.",
+            ".next/types/root-params.d.ts(4,33): error TS1005: ';' expected.",
+            "Failed to type check."
+          ],
+          "noneOf": [
+            "Module not found",
+            "Cannot find module",
+            "Failed to fetch"
+          ]
+        },
+        "budget": {
+          "maxEvaluations": 80,
+          "maxSeconds": 900
+        },
+        "runs": {
+          "baseline": 3,
+          "candidate": 2,
+          "final": 3
+        },
+        "allowInstallScripts": false,
+        "reduce": {
+          "files": true,
+          "syntax": true,
+          "json": true,
+          "dependencies": false
+        }
+      },
+      "sourceHash": "8f71fa4567549db642f9096d43fa67f9ef4c463583c5b373e98daa846cccf5a4",
+      "sourceUnchanged": true,
+      "initial": {
+        "files": 11,
+        "bytes": 36521,
+        "sourceBytes": 2794,
+        "dependencies": 7
+      },
+      "current": {
+        "files": 6,
+        "bytes": 33777,
+        "sourceBytes": 50,
+        "dependencies": 7
+      },
+      "baseline": [
+        "reproduced",
+        "reproduced",
+        "reproduced"
+      ],
+      "evaluations": 12,
+      "searchMs": 256606.08345800004,
+      "totalMs": 330056,
+      "verification": {
+        "status": "verified",
+        "runs": 3,
+        "snapshotHash": "a20b644dd14aa32d50ab79e07ddeb63b77ff805c5b857e592acbf20b24c20c58",
+        "environment": "fresh-directory"
+      },
+      "controls": [
+        {
+          "kind": "trigger-removed",
+          "exitCode": 0,
+          "status": "absent"
+        },
+        {
+          "kind": "different-failure",
+          "exitCode": 1,
+          "status": "absent"
+        }
+      ]
+    },
+    {
+      "name": "next-css-bom",
+      "fixture": "examples/next-css-bom",
+      "upstreamIssue": "https://github.com/vercel/next.js/issues/96374",
+      "nextVersion": "16.3.0-canary.103",
+      "settings": {
+        "command": [
+          "npm",
+          "run",
+          "build"
+        ],
+        "oracle": {
+          "exitCode": 1,
+          "allOf": [
+            "Parsing CSS source code failed",
+            "AtKeyword(\"layer\")"
+          ],
+          "noneOf": [
+            "Module not found",
+            "Cannot find module",
+            "Failed to fetch"
+          ]
+        },
+        "budget": {
+          "maxEvaluations": 80,
+          "maxSeconds": 900
+        },
+        "runs": {
+          "baseline": 3,
+          "candidate": 2,
+          "final": 3
+        },
+        "allowInstallScripts": false,
+        "reduce": {
+          "files": true,
+          "syntax": true,
+          "json": true,
+          "dependencies": false
+        }
+      },
+      "sourceHash": "51de138f74a3518ddf6c4404d6db333c200b4067bb59d20dda480b3ee4c3f5f0",
+      "sourceUnchanged": true,
+      "initial": {
+        "files": 10,
+        "bytes": 33544,
+        "sourceBytes": 2015,
+        "dependencies": 3
+      },
+      "current": {
+        "files": 7,
+        "bytes": 31654,
+        "sourceBytes": 125,
+        "dependencies": 3
+      },
+      "baseline": [
+        "reproduced",
+        "reproduced",
+        "reproduced"
+      ],
+      "evaluations": 26,
+      "searchMs": 191995.6436249999,
+      "totalMs": 218977,
+      "verification": {
+        "status": "verified",
+        "runs": 3,
+        "snapshotHash": "dabfe035b15992d774c667c70d7fc027abc9367fb8acfad41b173133dc424d43",
+        "environment": "fresh-directory"
+      },
+      "controls": [
+        {
+          "kind": "trigger-removed",
+          "exitCode": 0,
+          "status": "absent"
+        },
+        {
+          "kind": "different-failure",
+          "exitCode": 1,
+          "status": "absent"
+        }
+      ]
+    }
+  ],
+  "timingScope": {
+    "searchMs": "Recorded calibration and search elapsed time.",
+    "totalMs": "Reduction plus export verification; excludes preceding controls and their dependency setup."
+  },
+  "limits": [
+    "One macOS ARM64 environment; fresh directories on the same host, not framework container or OS-matrix coverage.",
+    "Dependency reduction disabled at the pinned framework versions.",
+    "Source bytes include fixture documentation and configuration but exclude package metadata and generated verification files.",
+    "Preserving an early diagnostic does not establish later build validity or identical semantic root cause.",
+    "These are local observations, not competitive performance benchmarks or current-version bug claims."
+  ]
+}

package/docs/evidence/next-pages.json

@@ -0,0 +1,152 @@
+{
+  "date": "2026-09-06",
+  "kind": "owned-seeded-next-pages-failure",
+  "fixture": "examples/next-pages",
+  "validationScript": "scripts/validate-pages.mjs",
+  "provenance": "Independently authored seeded application failure; no external reproduction source",
+  "runtime": {
+    "node": "v24.7.0",
+    "npm": "11.5.1",
+    "platform": "darwin",
+    "arch": "arm64",
+    "tool": "0.1.0"
+  },
+  "adapter": {
+    "name": "next",
+    "version": "16.3.4",
+    "router": "pages"
+  },
+  "settings": {
+    "command": [
+      "npm",
+      "run",
+      "build"
+    ],
+    "oracle": {
+      "exitCode": 1,
+      "allOf": [
+        "OWNED_PAGES_TOTAL_MISMATCH: expected 12, got 13",
+        "Error occurred prerendering page \"/\""
+      ],
+      "noneOf": [
+        "Module not found",
+        "Cannot find module",
+        "UNRELATED_PAGES_FAILURE",
+        "Failed to fetch"
+      ]
+    },
+    "budget": {
+      "maxEvaluations": 24,
+      "maxSeconds": 600
+    },
+    "runs": {
+      "baseline": 3,
+      "candidate": 2,
+      "final": 3
+    },
+    "allowInstallScripts": false,
+    "reduce": {
+      "files": true,
+      "syntax": true,
+      "json": false,
+      "dependencies": false
+    }
+  },
+  "sourceHash": "fa9695f4025ad1be39c96e5c7a7abad0775dfa93db820378b75943743f277c1b",
+  "sourceUnchanged": true,
+  "initial": {
+    "files": 8,
+    "bytes": 33618,
+    "sourceBytes": 2424,
+    "dependencies": 3
+  },
+  "current": {
+    "files": 5,
+    "bytes": 31465,
+    "sourceBytes": 271,
+    "dependencies": 3
+  },
+  "baseline": [
+    "reproduced",
+    "reproduced",
+    "reproduced"
+  ],
+  "evaluations": 24,
+  "searchMs": 395901.142542,
+  "totalMs": 451370,
+  "verification": {
+    "status": "verified",
+    "runs": 3,
+    "snapshotHash": "5d4207f5df01aad0c69bd3d4929a1764f0e6a4008e660b7da9eb02ea6881665d",
+    "environment": "fresh-directory"
+  },
+  "controls": [
+    {
+      "kind": "trigger-removed",
+      "exitCode": 0,
+      "status": "absent"
+    },
+    {
+      "kind": "different-failure",
+      "exitCode": 1,
+      "status": "absent"
+    }
+  ],
+  "acceptedChanges": [
+    {
+      "kind": "files",
+      "paths": [
+        "README.md",
+        "lib/unused-catalog.js",
+        "repro-surgeon.json"
+      ],
+      "confirmations": 2
+    },
+    {
+      "kind": "syntax",
+      "paths": [
+        "pages/health.jsx"
+      ],
+      "confirmations": 2
+    },
+    {
+      "kind": "syntax",
+      "paths": [
+        "pages/index.jsx"
+      ],
+      "confirmations": 2
+    },
+    {
+      "kind": "syntax",
+      "paths": [
+        "pages/index.jsx"
+      ],
+      "confirmations": 2
+    },
+    {
+      "kind": "syntax",
+      "paths": [
+        "pages/index.jsx"
+      ],
+      "confirmations": 2
+    },
+    {
+      "kind": "syntax",
+      "paths": [
+        "pages/index.jsx"
+      ],
+      "confirmations": 2
+    }
+  ],
+  "timingScope": {
+    "searchMs": "Recorded calibration and search elapsed time.",
+    "totalMs": "Reduction plus export verification; excludes preceding controls and their dependency setup."
+  },
+  "limits": [
+    "Independently authored application exception in getStaticProps; not an upstream Next.js bug.",
+    "One macOS ARM64 environment; three fresh-directory export checks, with no separate standalone Pages verifier run claimed.",
+    "Search stopped at 24 candidate evaluations; dependency reduction was disabled.",
+    "Source-byte reduction includes unused fixture documentation and configuration.",
+    "A local validation result, not a speed or minimality benchmark."
+  ]
+}

package/docs/evidence/rounding.json

@@ -0,0 +1,46 @@
+{
+  "date": "2026-09-06",
+  "kind": "seeded-example-and-ablation",
+  "runtime": {
+    "node": "v24.7.0",
+    "npm": "11.5.1",
+    "platform": "darwin",
+    "arch": "arm64",
+    "tool": "0.1.0"
+  },
+  "full": {
+    "initial": {
+      "files": 10,
+      "bytes": 3498,
+      "sourceBytes": 3173,
+      "dependencies": 0
+    },
+    "current": {
+      "files": 5,
+      "bytes": 845,
+      "sourceBytes": 520,
+      "dependencies": 0
+    },
+    "evaluations": 115,
+    "searchMs": 6561.4935829999995,
+    "verifiedRuns": 3
+  },
+  "filesOnly": {
+    "initial": {
+      "files": 10,
+      "bytes": 3498,
+      "sourceBytes": 3173,
+      "dependencies": 0
+    },
+    "current": {
+      "files": 5,
+      "bytes": 1453,
+      "sourceBytes": 1128,
+      "dependencies": 0
+    },
+    "evaluations": 20,
+    "searchMs": 1927.597042,
+    "verifiedRuns": 3
+  },
+  "limits": "One local run per setting, same source and failure check; no external competitor or independent human benchmark."
+}

package/docs/report-surface.md

@@ -0,0 +1,22 @@
+# Offline report surface
+
+The report is the review surface for one `RunReport`. It answers three questions in order: did the exported snapshot reproduce under fresh verification, how much was removed while preserving the configured failure, and what evidence should a developer inspect before sharing it?
+
+The visual direction is **The Evidence Signal Sheet**. A continuous route connects baseline, reduction, and fresh verification. One compact branch marker and count summarize discarded trials beneath the reduction stage, while the full trial list keeps each decision inspectable and the retained-file list shows what reached the verified endpoint. This is functional process navigation; it does not use literal transit imagery.
+
+The first viewport combines run identity with the highest-contrast verification block, then exposes the complete evidence path and a large before-to-after source result. Detailed sections follow in this order:
+
+1. Reduction decisions with local text search, accepted/rejected/invalid filters, and expandable decision evidence.
+2. Retained files with local path search, exact byte counts, and within-run size bars.
+3. Runtime and adapter metadata.
+4. Findings, warnings, and excluded paths that need review before sharing.
+
+Every value in the document comes from the supplied report or a transparent calculation over its recorded metrics. The report uses honest empty and interrupted states: pending or failed verification, a paused or failed run, no accepted reduction, no trials, no retained files, and no review findings all receive explicit labels.
+
+The HTML is a single offline file with inline CSS and JavaScript, system fonts, and no remote assets. Search, filters, native details controls, and command copy work without a server. The copy action includes a legacy local fallback and reports its result in a polite live region. Responsive layouts preserve the reading sequence, focus is conspicuous, and print output exposes evidence hidden by interactive filters. The report authors no motion effects, so it does not need a global reduced-motion reset.
+
+All report strings are HTML-escaped before insertion. Exact user-configured oracle strings and filenames remain visible because they are essential review evidence. A shared public-data projection removes raw trial diagnostics and replaces private setup/verification errors with generic failure summaries before both HTML and JSON output, including direct API calls. Baseline labels use explicit completed/required observation counts rather than inferring evidence from the overall run status. Keep detailed errors in the private checkpoint and logs.
+
+The implementation deliberately avoids a generalized dashboard, comparative benchmark claims, and inferred confidence scores. It does not imply that completion equals verification: run state and fresh-verification state remain separate and can disagree visibly.
+
+Browser QA should confirm the route at desktop and narrow widths, filter counts and zero-result behavior, keyboard focus order, copy success and fallback messaging, details expansion, print output, and every failed/paused/empty state with actual engine-produced reports.

package/docs/troubleshooting.md

@@ -0,0 +1,47 @@
+# Troubleshooting
+
+## The baseline does not reproduce
+
+Inspect the private run logs and the inventory from `doctor --json`. Check that the command is finite, the exact exit code matches, and required fragments survive ANSI normalization. A `.gitignore` rule may hide a needed fixture; use `include` for ordinary ignored source. Hard-excluded credential/environment files cannot be included. Supply required environment variable names explicitly. Do not weaken a useful oracle merely to get a green result.
+
+Many application builds need external services, environment configuration or generated assets. Arrange those dependencies in a reproducible, trusted command, or select a smaller standalone project before reducing. The CLI does not start databases or record browser interactions.
+
+## npm setup fails
+
+Use one npm package with a current `package-lock.json` version 2 or 3. npm must be able to install its public registry dependencies without local paths or credentials. Workspaces, Git dependencies, private registries, alternative package managers and `npm-shrinkwrap.json` are diagnosed as unsupported. Keep using the original application's package manager there; prepare a separate portable reproduction input when necessary.
+
+Install scripts are disabled by default. Some native packages require them. For trusted source, explicitly set `execution.allowInstallScripts` to true and retry with a new run. Inspect setup errors before changing this setting. A package that rewrites exported source during installation will fail integrity verification.
+
+If the tool reports ancestor `node_modules` in the temporary directory, select a normal OS temporary location outside any repository or dependency tree. Dependency isolation depends on keeping execution directories away from ancestor packages.
+
+## A run stops before finishing
+
+Normal search budget exhaustion proceeds to verification of the best accepted source. An interrupted or budget-limited incomplete baseline stays paused. Resume with larger **total** budgets, not an additional allowance:
+
+```sh
+repro-surgeon resume ./my-app-repro --max-evaluations 500 --max-seconds 1800
+```
+
+If a single command needs more time, change `execution.timeoutMs` in the input configuration and start a new run. Editing saved checkpoint configuration is refused. Runtime versions are part of a checkpoint: return to the recorded tool, Node, npm and platform, or start over in the new environment.
+
+## A crash left a lock
+
+Normal Ctrl-C releases the run lock after checkpointing. A hard kill or machine crash may leave `run.lock`. The tool deliberately refuses automatic stale-lock deletion because concurrent recovery can give two processes ownership of the same run.
+
+Stop all processes using that run directory and verify that none still owns it. Then remove only the `run.lock` file named in the error and retry `resume`. Do not remove a lock while a run or export is active. If a checkpoint or blob checksum is corrupt, retain the directory for diagnosis and start a new run; bypassing the integrity check is unsafe.
+
+## The export fails independent verification
+
+The accepted observation may depend on nondeterminism, an undeclared dependency, a side effect, external state or a broad error match. Inspect the verification result and private logs. Fix those assumptions and start a new reduction. A failed independent check is not a verified reproduction.
+
+If exported files were edited, hashes will no longer match. Keep the original export for comparison. To reduce a modified project, use it as a new input with a newly authored configuration; do not manually relabel it verified.
+
+## The result is larger than expected
+
+The reducer reports the best candidate found by enabled passes within its budget. Try a larger budget, review pinned paths, or isolate a project with fewer environmental dependencies. Framework paths are conservatively protected; source contents can still be simplified. An opaque binary or stylesheet can be removed as a file but is not structurally rewritten. License notices stay with the source.
+
+File counts include package metadata. Source bytes omit package metadata; total snapshot bytes include it. Installed dependencies and generated verification metadata are separate from those reduction metrics.
+
+## Sharing or reporting a problem
+
+Review the reduced source, report, diagnostic strings and metadata before posting. Share the `repro/` directory and any selected evidence you have inspected. Keep the original snapshots and private logs in the parent run directory private. For tool bugs, include versions, the command, oracle and a small licensed case. Use the [security policy](../SECURITY.md) for sensitive reports.