@mrclrchtr/supi-lsp 11.0.1 → 11.2.0

package/README.md

@@ -20,7 +20,7 @@ npm install @mrclrchtr/supi-lsp
 
 ## Language-server support
 
-SuPi provides 13 built-in server definitions. All are enabled unless `lsp.servers.<key>.enabled` is `false`. Install the language servers yourself; SuPi does not download or install them. Built-in commands must be on `PATH`; a configured absolute command path is also supported. Code Intelligence starts the runtime only for trusted projects.
+SuPi provides 13 built-in server definitions. All are enabled unless `lsp.servers.<key>.enabled` is `false`. Install the language servers yourself; SuPi does not download or install them. Built-in commands must be on `PATH`, except project-local native TypeScript; a configured absolute command path is also supported. Code Intelligence starts the runtime only for trusted projects.
 
 ### Built-in route matrix
 
@@ -28,7 +28,7 @@ This matrix describes the default routing configuration, not a live test or a gu
 
 | Language / config key | Default command and arguments | File extensions | Root markers for automatic discovery |
 |---|---|---|---|
-| TypeScript / JavaScript — `typescript` | `typescript-language-server --stdio` | `.ts`, `.tsx`, `.js`, `.jsx`, `.mts`, `.cts`, `.mjs`, `.cjs` | `tsconfig.json`, `jsconfig.json`, `package.json` |
+| TypeScript / JavaScript — `typescript` | Project-local native `tsc --lsp --stdio`, otherwise `typescript-language-server --stdio` | `.ts`, `.tsx`, `.js`, `.jsx`, `.mts`, `.cts`, `.mjs`, `.cjs` | `tsconfig.json`, `jsconfig.json`, `package.json` |
 | Python — `python` | `pyright-langserver --stdio` | `.py`, `.pyi` | `pyproject.toml`, `setup.py`, `setup.cfg`, `requirements.txt`, `pyrightconfig.json` |
 | Rust — `rust` | `rust-analyzer` | `.rs` | `Cargo.toml` |
 | Go — `go` | `gopls serve` | `.go`, `.mod` | `go.mod`, `go.sum` |
@@ -59,7 +59,7 @@ A configured route is not a ready server. Features depend on the active server,
 | Hover, definitions, references, implementations, document/workspace symbols | Supported through the server's corresponding LSP methods; availability and coverage differ by server. |
 | Diagnostics | Native pull, the eligible TypeScript request adapter, or ambient push. Push observation alone cannot confirm that a file is clean. See the diagnostic policy below. |
 | `rename_symbol` | Requires server rename support and validated text edits; uses `prepareRename` when advertised. |
-| `update_imports` / `delete_dead_code` | Requires matching `source.organizeImports` / `source.removeUnused` code actions that produce validated text edits. |
+| `update_imports` / `delete_dead_code` | Requires matching `source.organizeImports` / (`source.removeUnused` or `source.removeUnusedImports`) code actions that produce validated text edits. Imports-only advertisement reports limited support, not arbitrary unused-declaration removal. |
 | `extract_function` / `extract_variable` | Unavailable for all languages: standard LSP code actions do not provide a safe exact extraction-name contract. |
 
 The [operation-support model](src/config/operation-support.ts) separates server advertisement from SuPi planning limits. A server can advertise an action that SuPi cannot safely turn into a plan.
@@ -72,6 +72,40 @@ Pyright remains the default Python server, but the audited server lacks implemen
 
 JDTLS acceptance uses a compatible pinned JDK and isolated writable `-data` and `-configuration` directories. Keep test workspaces separate from personal JDTLS state. The [capability baseline](../../docs/conventions/code-language-baseline.md) defines the operation and evidence requirements.
 
+### TypeScript compiler selection
+
+The default TypeScript route prefers a project-local stable native TS7 server. Native launches use the selected package's declared `tsc` Node launcher with `--lsp --stdio`; neither TLS nor a global native executable is required. Legacy compiler launches still require `typescript-language-server` (TLS) on PATH. Nothing is installed automatically.
+
+| Configuration | Launch policy |
+|---|---|
+| No explicit launch fields | Prefer stable native TS7 as `typescript`, then as `@typescript/native`. Otherwise use legacy `typescript`, or—only if absent—`@typescript/typescript6`. If all are absent, retain TLS's existing lookup. |
+| `lsp.servers.typescript.typescriptPackage` | Resolve exactly this installed package name/alias. No arbitrary alias scan, package subpath, URL, or filesystem-path selector. |
+| Explicit `command` **or** `args` | Manual launch, including inherited values equal to defaults. No automatic compiler selection or initialization-option injection. |
+| Explicit `initializationOptions.tsserver.path` | Use the configured path without automatic compiler selection. |
+| Package selector plus any explicit launch field above | Configuration conflict; the failure identifies fields and their configuration origins when available. Remove one side and reload. |
+
+For example, select a compiler installed as `my-ts6` without changing the TLS command:
+
+```json
+{ "lsp": { "servers": { "typescript": { "typescriptPackage": "my-ts6" } } } }
+```
+
+- Resolve packages using the route root's normal Node package search paths, including hoisted and symlinked packages. A package whose actual identity is `@typescript/typescript6`, including one installed as `typescript` or another alias, resolves `@typescript/old` from the wrapper's dependency graph. Pass the underlying implementation's actual `lib/tsserver.js` through `initializationOptions.tsserver.path`; preserve other initialization options.
+- Native-first precedence deliberately replaces canonical-package-first selection: a native `@typescript/native` alias wins over legacy `typescript`. This alias must resolve to the stable native `typescript` package, not legacy TS or the old preview package. Other aliases require `typescriptPackage`.
+- A consulted broken symlink, malformed manifest, missing compiler version, unsupported identity/major, or prerelease is an error, not absence. Stable TS7 releases are eligible without a patch allowlist; unknown native majors and preview/nightly packages require manual launch. Do not inspect lower-priority packages after a native winner. Only the winner's launch files are validated, so a legacy loser's missing `tsserver.js` does not block a healthy native alias.
+- Never fall back after resolution or startup failure of the selected package. Manual launches receive no automatic initialization-option injection.
+- Discovery, missing-server warnings, lazy starts, and recovery use the same policy. Every actual start/retry resolves fresh package files using the active settings snapshot. Installing or repairing a compiler can be followed by explicit health refresh; changing settings requires reload/restart. Healthy clients do not hot-swap.
+- `code_health` and `/supi-ci-status` show the `native` or `tsserver` backend and resolved compiler version when known, separately from wrapper version. Manual/legacy-fallback launches have no inferred compiler identity. Missing versions remain unknown. Selection failures identify the package/root and a corrective action.
+- Topmost-root collapsing remains unchanged. Mixed nested backends, Windows live qualification, dependency watchers, performance benchmarking, and full TLS/native feature parity are outside this change. Existing legacy TLS support is not deliberately removed.
+
+Focused qualification pins native TypeScript **7.0.2**, TLS **6.0.2**, ordinary TypeScript **6.0.3**, and `@typescript/typescript6` **6.0.2** backed by `@typescript/old` → TypeScript **6.0.3**. The wrapper's dependency range does not guarantee that compiler version; the lockfile and [prerequisite pins](../../scripts/language-baseline/pins.json) fix these combinations. SuPi retains TS6 for its compiler-API dependency and legacy-server tests. Workspace typechecking and declaration builds use the native TS7 launcher directly to avoid ambiguity between the installed `tsc` binaries.
+
+The required [Linux/macOS CI matrix](../../.github/workflows/ci.yml) keeps [selection/layout tests](__tests__/unit/typescript-launch.test.ts), [real native lifecycle tests](__tests__/integration/workspace-runtime.integration.typescript-native.test.ts), and [wrapper lifecycle tests](__tests__/integration/workspace-runtime.integration.typescript-launch.test.ts) separate from the [public TS/JS semantic matrix](../supi-code-intelligence/__tests__/acceptance/language-baseline-harness.ts). Required missing/unavailable behavior fails rather than skips. The matrix covers hover, definitions, references, meaningful implementations, document/workspace symbols, confirmed error → clean diagnostics, refresh, cross-file invalidation, Unicode-safe rename plan/apply and stale-plan rejection, and precise organize-imports. The TypeScript public matrix also checks unused-import removal, unchanged source during planning, stale-plan rejection, and preservation of unrelated text; native support is imports-only. Native TSX/JSX and module suffixes receive routing/synchronization checks rather than duplicate matrices. Existing stale-result and edit-safety suites remain in place.
+
+[Bounded config comparisons](__tests__/integration/typescript-config-coverage.test.ts) compare TS6 and native TS7 `--showConfig` root-file coverage for TS/JS defaults, include/exclude, `allowJs`/`checkJs`, inherited patterns (including late-created files), and separate referenced projects. These cases found no false exclusion; filtering is unchanged. **Config coverage state is not TypeScript program membership**: imports may bring excluded files into a program, and references do not merge root-file lists.
+
+Native `delete_dead_code` consumes `source.removeUnusedImports` through the same safe plan/apply workflow ([#554](https://github.com/mrclrchtr/supi/issues/554)). This mapping removes unused imports only: operation support reports `server: advertised`, `supi: limited`, with an imports-only reason. It does not qualify arbitrary unused-declaration removal. Extraction remains unavailable ([#467](https://github.com/mrclrchtr/supi/issues/467)); no TLS/native feature-parity claim is made. Only the pinned combinations are tested, not every stable TS7 release. Focused qualification passed on macOS arm64 (Node 24.22.1) and Linux arm64 (Debian container, Node 24.22.0), including the native/TS6 public TS/JS matrix. The unused-import follow-up has local macOS arm64 verification only; its Linux verification remains pending. The pinned Linux/macOS CI jobs remain pending until they run; this is not a qualification claim for the complete multi-language baseline.
+
 ### Java startup and project JDKs
 
 The JDK that starts JDTLS can differ from the JDK that builds your project. Set a compatible server runtime through the Java route without changing the shell or project compiler:
@@ -153,7 +187,7 @@ Caller cancellation or deadline stops only that caller's wait. Explicit diagnost
 
 If another request first opens a document during an active semantic or diagnostic request, the client can synchronize and repeat the request once. The retry retains the caller's original signal and deadline. Content, workspace, close, and lifecycle changes still reject stale results. A diagnostic retry collects new request evidence; it does not promote an old cache. This retry is not route recovery. A second enrollment during the retry still rejects the result. Semantic failure reasons state whether the retry failed or was exhausted. The bounded `request.retry` debug event records the retry reason and outcome with the public call's opaque operation ID, when supplied. A completed RPC alone does not establish accepted semantic evidence.
 
-A read-only semantic request can also retry once after an LSP `ContentModified` error (`-32801`). This retry shares the same one-retry budget as enrollment; it does not add another try. The client keeps the original request parameters and checks changes from the first failed input revision. It runs the full input sync before retry and checks current inputs before it accepts a result. An enrollment is still the only input change that can permit a retry. A content, workspace, close, lifecycle, or retirement change blocks it. Client replacement, caller cancellation, and a deadline also block retry. The post-request check rejects a result if inputs change while that attempt runs. This error-code retry applies only to read-only semantic requests. Diagnostics, rename, code actions, and refactors keep the default policy and do not retry `ContentModified`. See the [LSP 3.17 message-ordering rule](https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/#messageOrdering), the [retry guard](src/client/client-request-enrollment.ts), and the [client query path](src/client/client.ts).
+A read-only semantic request can also retry once after an LSP `ContentModified` error (`-32801`). This retry shares the same one-retry budget as enrollment; it does not add another try. Before this protocol retry, the client waits 100 ms so an immediate retry does not race the same server analysis. The wait is cancellable, respects the original absolute deadline, and does not delay enrollment-only retries. The client keeps the original request parameters and checks changes from the first failed input revision. It runs the full input sync before retry and checks current inputs before it accepts a result. An enrollment is still the only input change that can permit a retry. A content, workspace, close, lifecycle, or retirement change blocks it. Client replacement, caller cancellation, and a deadline also block retry. The post-request check rejects a result if inputs change while that attempt runs. This error-code retry applies only to read-only semantic requests. Diagnostics, rename, code actions, and refactors keep the default policy and do not retry `ContentModified`. See the [LSP 3.17 message-ordering rule](https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/#messageOrdering), the [retry guard](src/client/client-request-enrollment.ts), and the [client query path](src/client/client.ts).
 
 Diagnostic collection does not close and reopen a document to obtain confirmation. It does not send a no-op `didChange` for that purpose. Refresh retains unchanged documents and their current server state, and resynchronizes changed or invalidated documents. A client restart may reopen tracked documents to restore client state; that is recovery, not diagnostic confirmation.
 
@@ -253,8 +287,11 @@ Disable one language with `lsp.servers.<language>.enabled: false`. Use `/supi-ci
 - negotiated operation support in project-server status
 
 Operation-specific planners request `source.organizeImports` for import updates and
-`source.removeUnused` for dead-code removal. They match the returned `CodeAction.kind`,
-not its title. Edit-only actions are validated before planning. Command actions,
+both `source.removeUnused` and `source.removeUnusedImports` for dead-code removal.
+These distinct kinds are alternatives, not parent/child kinds; either exact kind
+or its dotted descendants can match the returned `CodeAction.kind`, never its title.
+An imports-only advertisement reports a SuPi limitation rather than general
+unused-declaration support. Edit-only actions are validated before planning. Command actions,
 resource operations, snippets, annotations, malformed actions, and stale responses
 stay unavailable. Distinct matching plans return an ambiguous result instead of
 selecting the first action. Rename uses `prepareRename` when the server advertises

package/node_modules/@mrclrchtr/supi-code-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrclrchtr/supi-code-runtime",
-  "version": "11.0.1",
+  "version": "11.2.0",
   "description": "Shared workspace context and capability contracts for code intelligence",
   "license": "MIT",
   "repository": {

package/node_modules/@mrclrchtr/supi-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrclrchtr/supi-core",
-  "version": "11.0.1",
+  "version": "11.2.0",
   "description": "Shared settings, configuration, reporting, and session infrastructure",
   "license": "MIT",
   "repository": {

package/node_modules/@mrclrchtr/supi-core/src/debug-registry.ts

@@ -14,6 +14,8 @@ export interface DebugRegistryConfig {
   enabled: boolean;
   /** What the agent-callable debug tool may return. */
   agentAccess: DebugAgentAccess;
+  /** Whether Agent Run retrospective capture is explicitly enabled. */
+  agentRunRetrospectivesEnabled: boolean;
   /** Maximum number of session-local events to keep in memory. */
   maxEvents: number;
 }
@@ -21,6 +23,7 @@ export interface DebugRegistryConfig {
 export const DEBUG_REGISTRY_DEFAULTS: DebugRegistryConfig = {
   enabled: false,
   agentAccess: "sanitized",
+  agentRunRetrospectivesEnabled: false,
   maxEvents: 100,
 };
 
@@ -75,6 +78,9 @@ export interface DebugEventQueryResult {
 /** Receives a sanitized event whenever the registry records one. */
 export type DebugEventListener = (event: DebugEventView) => void;
 
+/** Receives sanitized events for persistence; separate from ordinary event subscriptions. */
+export type DebugPersistenceSink = (event: DebugEventView) => void;
+
 export interface DebugSummary {
   total: number;
   byLevel: Partial<Record<DebugLevel, number>>;
@@ -85,6 +91,7 @@ interface DebugRegistryState {
   config: DebugRegistryConfig;
   events: DebugEvent[];
   listeners: Set<DebugEventListener>;
+  persistenceSinks: Set<DebugPersistenceSink>;
   nextId: number;
 }
 
@@ -111,13 +118,15 @@ function getState(): DebugRegistryState {
       config: cloneConfig(DEBUG_REGISTRY_DEFAULTS),
       events: [],
       listeners: new Set(),
+      persistenceSinks: new Set(),
       nextId: 1,
     };
     (globalThis as Record<symbol, unknown>)[REGISTRY_KEY] = state;
   }
   // Keep the shared registry compatible with extension reloads that reuse an
-  // instance created before listeners existed.
+  // instance created before listener sets existed.
   if (!state.listeners) state.listeners = new Set();
+  if (!state.persistenceSinks) state.persistenceSinks = new Set();
   return state;
 }
 
@@ -200,6 +209,19 @@ export function isDebugRegistryEnabled(): boolean {
   return getState().config.enabled;
 }
 
+/**
+ * Return whether a retrospective can be captured: Debug and its explicit opt-in
+ * must be enabled, and at least one persistence sink must be registered.
+ */
+export function canRecordAgentRunRetrospective(): boolean {
+  const state = getState();
+  return (
+    state.config.enabled &&
+    state.config.agentRunRetrospectivesEnabled &&
+    state.persistenceSinks.size > 0
+  );
+}
+
 /** Best-effort redaction helper for data exposed through sanitized debug views. */
 export function redactDebugData<T>(value: T): T {
   return redactValue(value, 8) as T;
@@ -226,6 +248,16 @@ export function subscribeDebugEvents(listener: DebugEventListener): () => void {
   return () => state.listeners.delete(listener);
 }
 
+/**
+ * Register a sanitized event persistence sink. Sinks are tracked separately from
+ * ordinary listeners so eligibility checks only succeed when logging is active.
+ */
+export function subscribeDebugPersistence(sink: DebugPersistenceSink): () => void {
+  const state = getState();
+  state.persistenceSinks.add(sink);
+  return () => state.persistenceSinks.delete(sink);
+}
+
 /** Record a session-local debug event if debugging is enabled. */
 export function recordDebugEvent(input: DebugEventInput): DebugEvent | null {
   const state = getState();
@@ -251,6 +283,13 @@ export function recordDebugEvent(input: DebugEventInput): DebugEvent | null {
       // Debug-event consumers must not alter producer behavior.
     }
   }
+  for (const sink of state.persistenceSinks) {
+    try {
+      sink(toSanitizedView(event));
+    } catch {
+      // Persistence failures must not alter producer behavior.
+    }
+  }
   return {
     ...event,
     data: event.data === undefined ? undefined : redactDebugData(event.data),
@@ -309,5 +348,6 @@ export function resetDebugRegistry(): void {
   state.config = cloneConfig(DEBUG_REGISTRY_DEFAULTS);
   state.events = [];
   state.listeners.clear();
+  state.persistenceSinks.clear();
   state.nextId = 1;
 }

package/node_modules/ignore/README.md

@@ -282,6 +282,12 @@ Returns `function(path)` the filter function.
 
 > New in 5.0.0
 
+**This method is NOT meant for ordinary users or everyday use.** If all you need is to tell whether a `pathname` is ignored, this is not the method you are looking for.
+
+`.test()` is meant for packages that build upon `ignore`. Besides whether a `pathname` is ignored, it tells whether a negative pattern unignored it, which such a package can use to control its own caching, such as what to cache and when a cached result can be reused.
+
+If you only need to know whether a `pathname` should be ignored, use `.ignores()` instead. It returns that answer as a boolean, and always agrees with `.test(pathname).ignored`.
+
 Returns `TestResult`
 
 ```ts
@@ -291,7 +297,8 @@ interface TestResult {
   // true if a negative pattern matched the `pathname` itself, and no parent
   //   directory of it is ignored -- see "When both are false" below
   unignored: boolean
-  // The `IgnoreRule` which ignores the pathname
+  // The `IgnoreRule` which ignores the pathname: the last rule to match, the
+  //   one `git check-ignore -v` reports
   rule?: IgnoreRule
 }
 
@@ -339,13 +346,15 @@ To tell the two situations apart, test the parent directories of the `pathname`,
 ['foobar/'].some(dir => ig2.test(dir).unignored) // true
 ```
 
-`unignored` is meant for packages that implement their own caching mechanism upon `node-ignore`. To simply tell whether a `pathname` is ignored, use `.ignores()` or check `TestResult::ignored`.
-
 ## .checkIgnore(target: string): TestResult
 
 > new in 7.0.0
 
-Debugs gitignore / exclude files, which is equivalent to `git check-ignore -v`. Usually this method is used for other packages to implement the function of `git check-ignore -v` upon `node-ignore`
+Debugs gitignore / exclude files the way `git check-ignore -v` does. Usually this method is used for other packages to implement the function of `git check-ignore -v` upon `node-ignore`. Apart from the [known differences](#known-differences-from-git):
+
+- `ignored` is what `git check-ignore` answers for `target`.
+- When `ignored` is `true`, `rule` is the rule `git check-ignore -v` reports. Its `pattern` is the pattern as it was added, so trailing spaces that git trims are still there.
+- When the last pattern to match is a negative one, `git check-ignore -v` reports it, while `.checkIgnore()` returns `unignored: true` and no `rule`. For a directory passed with a trailing slash, `unignored` is also `true` when a negative pattern re-includes the directory itself, which `git check-ignore -v` does not report.
 
 - **target** `string` the target to test.
 
@@ -471,13 +480,30 @@ not in `git`. For ASCII paths and patterns there is no difference.
 code runs against a real repository, pass the value of the repository's
 `core.ignorecase` explicitly.
 
-### `***` and friends follow the documentation, not the binary
+### A run of asterisks
+
+`git` reads a run of two or more asterisks as a globstar whenever the run
+fills a path segment: it starts the pattern or follows a `/`, and it ends
+the pattern or comes before a `/`. `ignore` does the same, so `***/foo`,
+`a/***` and `a/***/b` behave exactly as `**/foo`, `a/**` and `a/**/b`.
+
+`git` takes two more cases as a globstar, and `ignore` does not:
+
+- **A run right after a literal prefix**, as in `a**/b` or `a***/b`. Before
+  matching, `git` strips the part of a pattern that holds no wildcard, and
+  the run then starts what is left. gitignore(5) lists the positions where
+  `**` is special and calls every other run "regular asterisks", which is
+  what `ignore` does here.
+- **A run next to an escaped slash**, as in `**\/b` or `x\/**/b`.
+
+```js
+ignore().add('a**/b').ignores('axy/z/b')   // false;  git: true
+ignore().add('**\\/b').ignores('x/y/b')    // false;  git: true
+ignore().add('x\\/**/b').ignores('x/y/z/b') // false;  git: true
+```
 
-gitignore(5) says a run of more than two asterisks is "considered regular
-asterisks". The `git` binary, however, strips the literal prefix of a
-pattern before matching, which makes patterns like `***/foo`, `a/***` and
-`a**/b` behave as `**` globstars there. `ignore` follows the documented
-behavior. If you need the globstar, write `**`.
+To get a globstar in either case, give the run a segment of its own, such as
+`a*/**/b`.
 
 ### `checkIgnore()` and a directory passed with a trailing slash
 

package/node_modules/ignore/index.d.ts

@@ -50,8 +50,9 @@ declare namespace ignore {
      */
     unignored: boolean
     /**
-     * The rule that ignores the pathname. Present exactly when `ignored` is
-     *   true.
+     * The rule that ignores the pathname, or the parent directory it is
+     *   ignored with: the last rule to match, which is the rule
+     *   `git check-ignore -v` reports. Present exactly when `ignored` is true.
      */
     rule?: IgnoreRule
   }

package/node_modules/ignore/index.js

@@ -15,6 +15,8 @@ const ESCAPE = '\\'
 const REGEX_LITERAL_SPECIAL = /[.*+?()[\]{}^$|\\/]/
 const BOM = '\uFEFF'
 const REGEX_INVALID_TRAILING_BACKSLASH = /(?:[^\\]|^)\\$/
+// A run of two or more asterisks is a globstar (#175)
+const REGEX_ANCHORED_GLOBSTAR = /^\/\*{2,}$/
 const REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION = /^\\!/
 const REGEX_REPLACE_LEADING_EXCAPED_HASH = /^\\#/
 const REGEX_SPLITALL_CRLF = /\r?\n/g
@@ -423,6 +425,21 @@ const REPLACERS = [
     ESCAPE + SPACE
   ],
 
+  // git's wildmatch() reads a run of two or more asterisks as one globstar
+  //   whenever the run fills a path segment: it starts the pattern or follows
+  //   a `/`, and it ends the pattern or comes before a `/`. A run of two is
+  //   already `**`; a longer one is folded into `**` here, so the steps
+  //   below only ever have to know `**`.
+  // `***/foo` -> `**/foo`, `a/***/b` -> `a/**/b`, `a/***` -> `a/**`
+  // git also takes a run beside a literal prefix (`a***/b`) or beside an
+  //   escaped slash (`***\/b`) as a globstar, and this does not; the README
+  //   lists both, under "A run of asterisks".
+  [
+    /(^|\/)\*{3,}(?=\/|$)/g,
+    (_, start) => `${start}**`,
+    '*'
+  ],
+
   // Escape metacharacters
   // which is written down by users but means special for regular expressions.
 
@@ -853,6 +870,15 @@ const pinWildcards = source => {
 
 // @param {pattern}
 const makeRegexPrefix = pattern => {
+  // `/**` matches every path, as `**` does. The translation below only finds
+  //   a globstar beside a slash it keeps, and the leading one is turned into
+  //   an anchor, so `/**` would come out as `/*` and match one level only.
+  //   Here rather than in `createRule`, so that `checkSourceOf`, which
+  //   compiles `/**/` again without its trailing slash, gets it too.
+  if (REGEX_ANCHORED_GLOBSTAR.test(pattern)) {
+    pattern = '**'
+  }
+
   const {source, sources} = extractBrackets(pattern)
 
   const replaced = REPLACERS.reduce(
@@ -1271,17 +1297,10 @@ class RuleManager {
 
   // Test one single path without recursively checking parent directories
   //
-  // - checkUnignored `boolean` whether should check if the path is unignored,
-  //   setting `checkUnignored` to `false` could reduce additional
-  //   path matching.
-  // - check `string` either `MODE_IGNORE` or `MODE_CHECK_IGNORE`
-
-  // @returns {TestResult} true if a file is ignored
-  test (path, checkUnignored, mode) {
-    let ignored = false
-    let unignored = false
-    let matchedRule
+  // - mode `string` either `MODE_IGNORE` or `MODE_CHECK_IGNORE`
 
+  // @returns {TestResult}
+  test (path, mode) {
     // Most of a .gitignore is patterns with no slash in them, and running
     //   those against the whole path makes the regular expression engine walk
     //   every directory name on the way to the only segment that could match.
@@ -1296,52 +1315,40 @@ class RuleManager {
       ? basenameOf(path)
       : path
 
+    // The last rule to match decides, as in git, and it is the rule
+    //   `git check-ignore -v` reports, so the scan runs from the end and stops
+    //   at the first match.
     // A plain loop rather than `forEach`, so that `path`, `basename` and
     //   `shortcut` are locals. As a callback they became closure variables,
     //   and reaching for one of those once per rule cost 10% of a scan over a
     //   large rule set -- more than the shortcut they were there to serve.
-    for (let index = 0; index < length; index ++) {
+    for (let index = length - 1; index >= 0; index --) {
       const rule = rules[index]
-      const {negative} = rule
-
-      //          |           ignored : unignored
-      // -------- | ---------------------------------------
-      // negative |   0:0   |   0:1   |   1:0   |   1:1
-      // -------- | ------- | ------- | ------- | --------
-      //     0    |  TEST   |  TEST   |  SKIP   |    X
-      //     1    |  TESTIF |  SKIP   |  TEST   |    X
-
-      // - SKIP: always skip
-      // - TEST: always test
-      // - TESTIF: only test if checkUnignored
-      // - X: that never happen
-      const skip = unignored === negative && ignored !== unignored
-        || negative && !ignored && !unignored && !checkUnignored
-
-      if (!skip && rule[mode].test(
+
+      if (rule[mode].test(
         shortcut && rule._basenameOnly
           ? basename
           : path
       )) {
-        ignored = !negative
-        unignored = negative
+        const {negative} = rule
 
-        matchedRule = negative
-          ? UNDEFINED
-          : rule
-      }
-    }
+        const ret = {
+          ignored: !negative,
+          unignored: negative
+        }
 
-    const ret = {
-      ignored,
-      unignored
-    }
+        if (!negative) {
+          ret.rule = rule
+        }
 
-    if (matchedRule) {
-      ret.rule = matchedRule
+        return ret
+      }
     }
 
-    return ret
+    return {
+      ignored: false,
+      unignored: false
+    }
   }
 }
 
@@ -1457,7 +1464,7 @@ class Ignore {
   }
 
   // @returns {TestResult}
-  _test (originalPath, cache, checkUnignored) {
+  _test (originalPath, cache) {
     const path = originalPath
       // Supports nullable path
       && checkPath.convert(originalPath)
@@ -1470,7 +1477,7 @@ class Ignore {
         : RETURN_FALSE
     )
 
-    return this._t(path, cache, checkUnignored)
+    return this._t(path, cache)
   }
 
   checkIgnore (path) {
@@ -1483,7 +1490,7 @@ class Ignore {
     // Like `git check-ignore`: a directory excluded by itself or by an
     //   ancestor settles it, and only then is the literal 'abc/' matched
     //   against the rules (see `checkSourceOf`).
-    const dir = this._t(path, this._testCache, true)
+    const dir = this._t(path, this._testCache)
 
     if (dir.ignored) {
       return dir
@@ -1501,10 +1508,7 @@ class Ignore {
     path,
 
     // The cache for the result of a certain checking
-    cache,
-
-    // Whether should check if the path is unignored
-    checkUnignored
+    cache
   ) {
     if (path in cache) {
       return cache[path]
@@ -1514,18 +1518,18 @@ class Ignore {
 
     // If the path contains a parent directory, check the parent first
     const parent = parentPath
-      ? this._t(parentPath, cache, checkUnignored)
+      ? this._t(parentPath, cache)
       : UNDEFINED
 
     return cache[path] = parent && parent.ignored
       // > It is not possible to re-include a file if a parent directory of
       // >   that file is excluded.
       ? parent
-      : this._rules.test(path, checkUnignored, MODE_IGNORE)
+      : this._rules.test(path, MODE_IGNORE)
   }
 
   ignores (path) {
-    return this._test(path, this._ignoreCache, false).ignored
+    return this._test(path, this._ignoreCache).ignored
   }
 
   createFilter () {
@@ -1538,7 +1542,7 @@ class Ignore {
 
   // @returns {TestResult}
   test (path) {
-    return this._test(path, this._testCache, true)
+    return this._test(path, this._testCache)
   }
 }