Refactor paired execution flow boundaries

shared/verification-snapshot.d.ts

@@ -0,0 +1,8 @@
+export declare const VERIFICATION_SNAPSHOT_EXCLUDE_NAMES: ReadonlySet<string>;
+export declare function isVerificationSnapshotExcludedName(
+  name: string,
+): boolean;
+export declare function computeVerificationSnapshotId(repoDir: string): string;
+export declare function resolveVerificationResponsesDir(
+  hostIpcDir: string,
+): string;

shared/verification-snapshot.js

@@ -0,0 +1,50 @@
+import { createHash } from 'crypto';
+import fs from 'fs';
+import path from 'path';
+
+export const VERIFICATION_SNAPSHOT_EXCLUDE_NAMES = new Set([
+  '.git',
+  'node_modules',
+  '.env',
+]);
+
+export function isVerificationSnapshotExcludedName(name) {
+  return VERIFICATION_SNAPSHOT_EXCLUDE_NAMES.has(name);
+}
+
+function updateVerificationSnapshotHash(hash, repoDir, currentPath) {
+  const relPath = path.relative(repoDir, currentPath) || '.';
+  const stat = fs.lstatSync(currentPath);
+
+  if (stat.isDirectory()) {
+    if (relPath !== '.') {
+      hash.update(`dir\0${relPath}\0`);
+    }
+    for (const entry of fs.readdirSync(currentPath).sort()) {
+      if (isVerificationSnapshotExcludedName(entry)) continue;
+      updateVerificationSnapshotHash(hash, repoDir, path.join(currentPath, entry));
+    }
+    return;
+  }
+
+  if (stat.isSymbolicLink()) {
+    hash.update(`symlink\0${relPath}\0${fs.readlinkSync(currentPath)}\0`);
+    return;
+  }
+
+  if (stat.isFile()) {
+    hash.update(`file\0${relPath}\0`);
+    hash.update(fs.readFileSync(currentPath));
+    hash.update('\0');
+  }
+}
+
+export function computeVerificationSnapshotId(repoDir) {
+  const hash = createHash('sha256');
+  updateVerificationSnapshotHash(hash, repoDir, repoDir);
+  return `fs:${hash.digest('hex').slice(0, 24)}`;
+}
+
+export function resolveVerificationResponsesDir(hostIpcDir) {
+  return path.join(hostIpcDir, 'verification-responses');
+}