Fix cross-platform test regressions and refresh seed artifact

Author: GlitterKill

.github/workflows/AGENTS.md

@@ -156,6 +156,38 @@ Result:
 # fail 0
 ```
 
+### 2026-08-28: Stale Artifact and Windows Test-Environment Regressions
+
+Run `33228840410` failed in jobs `99037773532` (`tests (ubuntu-latest, 24.x)`)
+and `99037773651` (`tests (windows-latest, 24.x)`), step
+`Run tests (including 6 new language adapters + cross-platform paths)`, on
+commit `af4783ba77e63e62a4b29a204fc3bb7b67b0e1ff` from `main`. Build,
+typecheck, lint, config sync, security audit, native, and benchmark jobs passed.
+
+Confirmed causes and fixes:
+
+- `seed-resolution-evaluation.test.ts` failed on both platforms because commit
+  `6a49d8b2` changed `src/retrieval/orchestrator.ts` without regenerating the
+  checked source hash. `npm run benchmark:seed-resolution` refreshed the
+  deterministic artifact.
+- `semantic-pipeline-regressions.test.ts` used LF-only multiline `indexOf`
+  needles against a CRLF Windows checkout. Its shared source reader now
+  normalizes CRLF and lone CR to LF before structural assertions.
+- `mcp-runtime-tool.test.ts` selected hosted Windows PowerShell 5 for one case,
+  reintroducing the 30-second hang previously avoided by commit `a4625045`.
+  The case now uses `pwsh.exe`; the existing stderr detector strips VT control
+  sequences and recognizes PowerShell 7's concise `.ps1:<line>` error record.
+
+The remaining Windows-only lifetime failures were traced with high confidence
+to `%TEMP%` using the `RUNNER~1` short-path alias. The production lifetime
+validator correctly rejects a requested path whose `realpath` differs, so the
+three test helpers now canonicalize each fresh `mkdtemp` directory with
+`realpath`. The production security boundary was not relaxed.
+
+Focused local verification passed 213/213 tests across the seven affected test
+files. Hosted validation of all four fixes is still pending; no workflow YAML
+change was needed.
+
 ## Local Reproduction Caveats
 
 Use the same Node major version as CI when you investigate native crashes. CI runs Node `20.x`, and local reproductions become unreliable if `node_modules` contains native artifacts built under Node `22`.

docs/benchmarks/seed-resolution-evaluation-v2.json

@@ -7,13 +7,13 @@
     "caseCount": 4
   },
   "baseline": {
-    "gitHead": "e93ee67311de91bebcb66511063a1d27dcbd3bb0",
-    "evaluatedSourceDiffSha256": "1817d5a641ae2d4d05afcf63f7e7d8777c54b23e706fbd60ba94372aaddb1234",
+    "gitHead": "af4783ba77e63e62a4b29a204fc3bb7b67b0e1ff",
+    "evaluatedSourceDiffSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
     "sourceHashes": {
       "src/context/engine.ts": "8f2f70e329bd99f0c00675ef556497e330fde5a6e2fa8fdf0c29041724c94ed3",
       "src/graph/slice/start-node-resolver.ts": "180a7020659ad3c52e4595bee0b1d2257e264b24bf9dbe4abc7bd29b46a67e70",
       "src/retrieval/identifier-extraction.ts": "475acdf8dc8f603e650137ab129a8dc1d15139c6711d87e4529f568b9de5da84",
-      "src/retrieval/orchestrator.ts": "16da041a0f8a241006f3325a72c12c9b942d9c6d917a20d8e3d632945513d667",
+      "src/retrieval/orchestrator.ts": "d297cb5dc326fcb114f9c1f34680c2460f5e73b9bddaca6f71e3f42bdb80f469",
       "src/retrieval/seed-resolver.ts": "662604e2076e58cd0f46055298f8296bf63ecb2e4433d714a2a76c714d41efdb"
     },
     "platform": "win32-x64",
@@ -393,8 +393,8 @@
     "sliceStartNodeRecall": 1
   },
   "observedMedianPolicyLatencyMs": {
-    "contextRetrieval": 0.023,
-    "sliceStartNodes": 0.0085
+    "contextRetrieval": 0.0211,
+    "sliceStartNodes": 0.0077
   },
   "reproduction": "npm run benchmark:seed-resolution",
   "check": "npm run build && node --experimental-strip-types scripts/evaluate-seed-resolution.ts --check"

src/mcp/tools/runtime.ts

@@ -8,6 +8,7 @@
 import { access, mkdtemp, realpath, writeFile, rm } from "fs/promises";
 import { join } from "path";
 import { tmpdir } from "os";
+import { stripVTControlCharacters } from "util";
 import { z } from "zod";
 import type { ToolContext } from "../../server.js";
 import { parseActionHandlerArgs } from "../../gateway/dispatch-spine.js";
@@ -301,15 +302,18 @@ const POWERSHELL_STDERR_ERROR_PATTERNS: RegExp[] = [
   /FullyQualifiedErrorId\s*:/,
   /\+\s*CategoryInfo\s*:/,
   /^At line:\d+ char:\d+/m,
+  // PowerShell 7 ConciseView after VT control sequences are stripped.
+  /^[^:\r\n]+:\s+.+\.ps1:\d+(?::\d+)?$/m,
   /is not recognized as (?:the name of )?a cmdlet/i,
   /cannot be retrieved because it has not been set/i,
   /Exception calling ["'][^"']+["']/,
 ];
 
 export function detectPowerShellStderrErrors(stderr: string): boolean {
   if (!stderr) return false;
+  const normalized = stripVTControlCharacters(stderr);
   return POWERSHELL_STDERR_ERROR_PATTERNS.some((pattern) =>
-    pattern.test(stderr),
+    pattern.test(normalized),
   );
 }
 

tests/integration/mcp-runtime-tool.test.ts

@@ -402,10 +402,7 @@ describe("sdl.runtime.execute - MCP Tool Handler", () => {
         const result = await handleRuntimeExecute({
           repoId,
           runtime: "powershell",
-          executable:
-            expected.name === "non-terminating cmdlet error"
-              ? "powershell.exe"
-              : "pwsh.exe",
+          executable: "pwsh.exe",
           code: expected.code,
           persistOutput: false,
           outputMode: "minimal",

tests/unit/observability/lifetime-lock.test.ts

@@ -45,7 +45,9 @@ const children = new Set<ChildProcessWithoutNullStreams>();
 const WORKER_TIMEOUT_MS = 5_000;
 
 async function temporaryDirectory(): Promise<string> {
-  const directory = await mkdtemp(join(tmpdir(), "sdl-lifetime-lock-"));
+  const directory = await realpath(
+    await mkdtemp(join(tmpdir(), "sdl-lifetime-lock-")),
+  );
   temporaryDirectories.push(directory);
   return directory;
 }

tests/unit/observability/lifetime-publication.test.ts

@@ -8,6 +8,7 @@ import {
   mkdtemp,
   open,
   readFile,
+  realpath,
   readdir,
   rename,
   rm,
@@ -55,7 +56,9 @@ function serialized(value: DurableLifetimeRoot): string {
 }
 
 async function temporaryDirectory(): Promise<string> {
-  const directory = await mkdtemp(join(tmpdir(), "sdl-lifetime-publication-"));
+  const directory = await realpath(
+    await mkdtemp(join(tmpdir(), "sdl-lifetime-publication-")),
+  );
   temporaryDirectories.push(directory);
   return directory;
 }

tests/unit/observability/lifetime-store.test.ts

@@ -3,6 +3,7 @@ import {
   lstat,
   mkdtemp,
   readFile,
+  realpath,
   readdir,
   rm,
   unlink,
@@ -50,7 +51,9 @@ function root(generation: number, updatedAt = ISO_1): DurableLifetimeRoot {
 }
 
 async function temporaryDirectory(): Promise<string> {
-  const directory = await mkdtemp(join(tmpdir(), "sdl-lifetime-store-"));
+  const directory = await realpath(
+    await mkdtemp(join(tmpdir(), "sdl-lifetime-store-")),
+  );
   temporaryDirectories.push(directory);
   return directory;
 }

tests/unit/semantic-pipeline-regressions.test.ts

@@ -4,7 +4,10 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
 function readSource(path: string): string {
-  return readFileSync(join(process.cwd(), path), "utf8");
+  return readFileSync(join(process.cwd(), path), "utf8").replace(
+    /\r\n?/g,
+    "\n",
+  );
 }
 
 describe("semantic pipeline regressions", () => {

tests/unit/tool-qa-regressions.test.ts

@@ -122,6 +122,12 @@ describe("SDL tool QA regressions", () => {
       ),
       true,
     );
+    assert.equal(
+      detectPowerShellStderrErrors(
+        "\u001b[31;1mGet-Item: \u001b[0mC:\\Temp\\code.ps1:1\u001b[0m",
+      ),
+      true,
+    );
     assert.equal(
       detectPowerShellStderrErrors("WARNING: package deprecated\n"),
       false,