@redue/cli 0.0.0-stage → 0.1.0-alpha.10

package/src/decision-profile.mjs

@@ -0,0 +1,32 @@
+// Opt-in, bounded local diagnostics. Never include paths, command arguments,
+// environment values, source, or probe output in a timing record.
+import fs from 'node:fs';
+import {AsyncLocalStorage} from 'node:async_hooks';
+import {randomUUID} from 'node:crypto';
+
+const file=process.env.REDUE_DECISION_PROFILE_FILE;
+export const profiling=process.env.REDUE_DECISION_PROFILE==='1'&&!!file;
+
+const traces=new AsyncLocalStorage();
+const safe=value=>typeof value==='string'&&/^[a-zA-Z0-9_-]{1,64}$/.test(value)?value:undefined;
+const clean=value=>Object.fromEntries(['request','generation','work'].map(key=>[key,safe(value?.[key])]).filter(([,v])=>v));
+let base={};
+try{base=clean(JSON.parse(process.env.REDUE_PROFILE_CONTEXT||'{}'));}catch{}
+export const traceContext=()=>profiling?{...base,...traces.getStore()}:{};
+export function traceBase(value){if(profiling)base=clean(value);}
+export const traceId=()=>randomUUID();
+export const traceScope=(value,fn)=>profiling?traces.run({...traceContext(),...clean(value)},fn):fn();
+export const traceEnvironment=()=>profiling?{...process.env,REDUE_PROFILE_CONTEXT:JSON.stringify(traceContext())}:process.env;
+export function mark(phase,fields={}){timing(phase,performance.now(),fields);}
+
+export function timing(phase,started,counts={}) {
+  if(!profiling)return;
+  const memory=process.memoryUsage();
+  try{fs.appendFileSync(file,'REDUE_TIMING '+JSON.stringify({
+      at:Date.now(),monoNs:process.hrtime.bigint().toString(),pid:process.pid,phase,...traceContext(),
+      ms:Math.round((performance.now()-started)*10)/10,
+      rssMiB:Math.round(memory.rss/1048576*10)/10,
+      ...counts
+    })+'\n');}
+  catch{/* Diagnostics must never change probe or verification behavior. */}
+}

package/src/decision-validation.mjs

@@ -0,0 +1,41 @@
+// Deterministic reuse keys for already-resolved plans. These are not receipts
+// or a second content cache: the existing InputIndex still reads current bytes
+// and membership. A changed key falls back to provider discovery.
+import fs from 'node:fs';
+import path from 'node:path';
+import {execFileSync} from 'node:child_process';
+import micromatch from './glob.mjs';
+import {sha} from './plan.mjs';
+
+export function inputKey(row) {
+  return sha(JSON.stringify([row.plan.id,row.files.size,row.sum.toString('hex')]));
+}
+export function planGuard(bundle) {
+  const root=bundle.root;
+  const paths=new Set(['package.json','package-lock.json','.npmrc','.yarnrc.yml',
+    'pnpm-workspace.yaml','.pnpmfile.cjs','.pnpmfile.mjs',
+    ...bundle.workspaceManifests||[],...bundle.configurationInputs||[],
+    ...Object.values(bundle.plans).flatMap(plan=>plan.resolutionTriggers||[])]);
+  const patterns=bundle.workspacePatterns?.length?bundle.workspacePatterns:
+    (()=>{const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json')));
+      return Array.isArray(pkg.workspaces)?pkg.workspaces:pkg.workspaces?.packages||[];})();
+  if(patterns.length){
+    const files=execFileSync('git',['ls-files','--cached','--others','--exclude-standard',
+      '-z','--',':(glob)**/package.json'],{cwd:root,
+      env:{...process.env,GIT_OPTIONAL_LOCKS:'0'},timeout:5000,maxBuffer:32*1024*1024})
+      .toString().split('\0').filter(Boolean);
+    for(const file of files)if(micromatch.isMatch(path.posix.dirname(file),patterns,{dot:true}))
+      paths.add(file);
+  }
+  const values=[...paths].sort().map(rel=>{
+    const file=path.isAbsolute(rel)?rel:path.join(root,rel);
+    try{const st=fs.lstatSync(file,{bigint:true});
+      if(st.isSymbolicLink())return [rel,'link',fs.readlinkSync(file)];
+      if(st.isDirectory())return [rel,'directory',String(st.dev),String(st.ino)];
+      if(!st.isFile())throw Error('unobservable plan dependency');
+      return [rel,sha(fs.readFileSync(file))];
+    }catch(e){if(e.code==='ENOENT')return [rel,'missing'];throw e;}
+  });
+  const rootStat=fs.statSync(root,{bigint:true});
+  return sha(JSON.stringify([String(rootStat.dev),String(rootStat.ino),values]));
+}

package/src/declared-plan.mjs

@@ -0,0 +1,125 @@
+// A single-project plan. Declarations are explicit;
+// this provider does not infer complete coverage from a successful command.
+import fs from 'node:fs';
+import path from 'node:path';
+import {createHash} from 'node:crypto';
+import {permittedRoots,resolveDeclaredInstalled} from './installed-inputs.mjs';
+import {qualifyTypeScript} from './typescript-qualification.mjs';
+import {yarnWorkspaceTypecheckInputs} from './yarn-workspace-inputs.mjs';
+import {pnpmTypecheckInputs} from './pnpm-inputs.mjs';
+import {observedRelative,withinPath,realObservedPath} from './path-identity.mjs';
+import {timing} from './decision-profile.mjs';
+
+const identity=value=>createHash('sha256').update(JSON.stringify(value)).digest('hex');
+const safePattern=value=>{
+  if(typeof value!=='string'||!value)throw Error('input pattern must be nonempty');
+  const raw=value.startsWith('!')?value.slice(1):value;
+  if(!raw||path.isAbsolute(raw)||raw.split(/[\\/]/).includes('..'))
+    throw Error(`unsafe repository-relative input pattern: ${value}`);
+  return value;
+};
+
+export function discoverDeclared(config) {
+  const root=realObservedPath(config.root),plans={},configurationInputs=new Set(),
+    workspaceManifests=new Set(),workspacePatterns=new Set();
+  if(!Array.isArray(config.checks)||!config.checks.length)throw Error('selected checks required');
+  for(const selected of config.checks){
+    if(typeof selected.name!=='string'||!selected.name||plans[selected.name])
+      throw Error('check names must be unique nonempty strings');
+    if(!Array.isArray(selected.command)||!selected.command.length||
+      !selected.command.every(item=>typeof item==='string'&&item))
+      throw Error(`exact command required for ${selected.name}`);
+    const cwd=path.resolve(root,selected.cwd||'.');
+    if(!withinPath(cwd,root))throw Error('check cwd escapes checkout');
+    for(const key of ['inputs','generatedInputs','installedInputs']){
+      if(!Array.isArray(selected[key]||[]))throw Error(`${key} must be a path-pattern array`);
+      for(const value of selected[key]||[])safePattern(value);
+    }
+    if(!selected.inputs?.some(value=>!value.startsWith('!')))
+      throw Error(`positive source inputs required for ${selected.name}`);
+    for(const argv of selected.probes||[])if(!Array.isArray(argv)||!argv.length||
+      !argv.every(value=>typeof value==='string'&&value))
+      throw Error('state probes must be exact nonempty argv arrays');
+    if(!Array.isArray(selected.environment?.variables||[])||
+      !(selected.environment?.variables||[]).every(value=>typeof value==='string'&&value))
+      throw Error('environment variables must be a string array');
+    if(!Array.isArray(selected.environment?.prefixes||[])||
+      !(selected.environment?.prefixes||[]).every(value=>
+        typeof value==='string'&&/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)))
+      throw Error('environment prefixes must be simple nonempty names');
+    if(!Array.isArray(selected.environment?.pathExecutables||[])||
+      !(selected.environment?.pathExecutables||[]).every(value=>
+        typeof value==='string'&&/^[A-Za-z_][A-Za-z0-9_-]*$/.test(value)))
+      throw Error('PATH executables must be simple command names');
+    const allowedRoots=permittedRoots(root,selected.allowedExternalRoots||[]);
+    let workspace=null,workspaceIssue=null;
+    const workspaceStarted=performance.now();
+    if(selected.qualification==='yarn-workspace-tsc-v1'){
+      try{workspace=yarnWorkspaceTypecheckInputs(root,selected.workspace,
+        selected.command[4]);}
+      catch(e){workspaceIssue=e.message;}
+    }
+    if(selected.qualification==='pnpm-tsc-v1'){
+      try{workspace=pnpmTypecheckInputs(root,selected.workspace||'.',
+        selected.script||selected.command.at(-1));}
+      catch(e){workspaceIssue=e.message;}
+    }
+    timing('plan.workspace_inputs',workspaceStarted,{available:workspace?1:0});
+    const installedStarted=performance.now();
+    const installed=resolveDeclaredInstalled(root,
+      [...(selected.installedInputs||[]),...(workspace?.installed||[])],allowedRoots);
+    timing('plan.installed_resolution',installedStarted,{mappings:installed.mappings.length});
+    const automatic=qualifyTypeScript(root,selected,
+      {workspace,issue:workspaceIssue});
+    const sourcePatterns=[...new Set([...selected.inputs,...(workspace?.source||[]),
+      ...(workspace?.generated||[])])].sort();
+    const additivePatterns=[...new Set([...(selected.generatedInputs||[]),
+      ...installed.internalPatterns])].sort();
+    const unresolved=[...installed.unresolved,...(automatic?.issues||[]),
+      ...(workspace?.limitations||[]),
+      ...(workspaceIssue?[workspaceIssue]:[])];
+    for(const item of workspace?.configurationInputs||[])configurationInputs.add(item);
+    for(const item of workspace?.workspacePatterns||[])workspacePatterns.add(item);
+    for(const item of workspace?.closure||[])workspaceManifests.add(item.manifest);
+    if(!automatic)for(const category of ['source','generated','installedDependencies',
+      'environment','toolchain','runtime'])if(!selected.coverage?.[category])
+      unresolved.push(selected.coverageReasons?.[category]||
+        `${category} coverage not reviewed for this command`);
+    if((selected.probes||[]).length&&!automatic&&!selected.coverage?.probeContinuity)
+      unresolved.push('probe state continuity during execution not established');
+    const installedPhysicalRoots=[...new Set(installed.physicalRoots
+      .filter(file=>withinPath(file,root)&&observedRelative(root,file)!=='')
+      .map(file=>observedRelative(root,file)))].sort();
+    const externalPatterns=installed.externalPatterns;
+    const plan={name:selected.name,provider:'declared-project@1',inputResolutionVersion:1,
+      root,cwd,selectedConfigHash:identity(selected),command:selected.command,
+      target:selected.name,taskCommand:null,taskGraph:[],
+      patterns:[...new Set([...sourcePatterns,...additivePatterns])].sort(),
+      sourcePatterns,additivePatterns,generated:[],
+      declaredGeneratedInputs:[...new Set([...(selected.generatedInputs||[]),
+        ...(workspace?.generated||[])])].sort(),
+      declaredInstalledInputs:[...new Set([...(selected.installedInputs||[]),
+        ...(workspace?.installed||[])])].sort(),
+      installation:workspace?.installation||null,
+      ...(workspace?.synchronizedInstalledRead?{synchronizedInstalledRead:true}:{}),
+      installedInstances:workspace?.installedInstances||[],
+      resolutionCandidates:[],resolutionFindings:workspace?.absences||[],
+      installedPhysicalRoots,externalPatterns,
+      externalObservationRoots:Object.keys(externalPatterns).sort(),
+      resolutionLinks:installed.links,
+      resolutionTriggers:[...new Set([...installed.triggers,
+        ...(workspace?.linkTriggers||[]),
+        ...(workspace?.resolutionCandidates||[]).map(row=>row.path)])],
+      installedMappings:installed.mappings,effectiveEnvironmentGlobs:{},
+      probes:selected.probes||[],environment:selected.environment||{},
+      qualification:selected.qualification||null,
+      executionProvenance:'declared-command',
+      unresolved:[...new Set(unresolved)].sort()};
+    plan.resolutionCandidates=workspace?.resolutionCandidates||[];
+    plan.id=identity(plan);plans[selected.name]=plan;
+  }
+  return {schema:1,provider:'declared-project@1',root,plans,discoveredAt:Date.now(),
+    workspaceCount:1,workspacePatterns:[...workspacePatterns],
+    configurationInputs:[...configurationInputs].sort(),
+    workspaceManifests:[...workspaceManifests].sort()};
+}

package/src/direct-run-certificate.mjs

@@ -0,0 +1,40 @@
+// A caller validates discovery, never an execution outcome. No persistent cache.
+import {createHash} from 'node:crypto';
+import {spawnSync} from 'node:child_process';
+import {inflateSync} from 'node:zlib';
+import {fileURLToPath} from 'node:url';
+import {timing} from './decision-profile.mjs';
+const hash=value=>createHash('sha256').update(value).digest('hex');
+export function directRunCertificateAllowed(selected) {
+  return process.platform==='darwin'&&selected.qualification==='npm-typescript-direct-v1'&&
+    selected.probes?.length===1&&
+    selected.probes[0][1]===fileURLToPath(new URL('direct-typescript-probe.mjs',import.meta.url))&&
+    !(process.env.VSTATE_TEST_FAULTS==='1'&&process.env.VSTATE_TEST_FULL_RUN_PROBES==='1');
+}
+export function validateDirectRunCertificate(plan,selected,snapshot) {
+  const started=performance.now(),c=snapshot?.discoveryCertificate;
+  const fallback=reason=>{timing('cli.run_certificate',started,{outcome:'fallback',reason});return null;};
+  if(!directRunCertificateAllowed(selected))return fallback('unsupported');
+  if(!snapshot?.observationHealthy||!c||c.schema!==1||c.planId!==plan.id||
+    c.planId!==snapshot.planId||c.cwd!==plan.cwd||
+    c.probeDefinition!==hash(JSON.stringify(selected.probes))||
+    ![c.output,c.context,c.stderrHash].every(s=>typeof s==='string'&&/^[a-f0-9]{64}$/.test(s))||
+    typeof c.queryData!=='string'||c.queryData.length>512*1024)
+    return fallback('certificate_unavailable');
+  try{
+    const queries=JSON.parse(inflateSync(Buffer.from(c.queryData,'base64'),{maxOutputLength:8*1024*1024}));
+    const argv=selected.probes[0];
+    const value=hash(JSON.stringify([[argv,0,hash(c.output),c.stderrHash]]));
+    if(value!==snapshot.probeHash)return fallback('probe_identity_changed');
+    // The built-in child checks the current implementation, actual caller
+    // environment, context, content, membership and previously absent queries.
+    // The daemon environment is never substituted for the caller's.
+    const out=spawnSync(argv[0],[...argv.slice(1),'--redue-validate-queries'],{
+      cwd:plan.cwd,env:process.env,timeout:10000,maxBuffer:1024*1024,
+      input:JSON.stringify({schema:1,context:c.context,queries})});
+    if(out.error||out.signal||out.status!==0||out.stdout.toString()!==c.context||
+      hash(out.stderr)!==c.stderrHash)return fallback('caller_validation_failed');
+    timing('cli.run_certificate',started,{outcome:'reused',queries:queries.length});
+    return value;
+  }catch{return fallback('certificate_invalid');}
+}

package/src/direct-typescript-probe.mjs

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+import {createHash} from 'node:crypto';
+import {directProject,directInterpretation} from './direct-typescript.mjs';
+import {typeScriptInputFacts} from './typescript-input-facts.mjs';
+import {contextOnly,probeResult} from './probe-result.mjs';
+import {realObservedPath} from './path-identity.mjs';
+import path from 'node:path';
+import {queriesMatch} from './typescript-list.mjs';
+import {timing,mark} from './decision-profile.mjs';
+const hash=value=>createHash('sha256').update(JSON.stringify(value)).digest('hex');
+try{
+  const [rootArg,script]=process.argv.slice(2),root=realObservedPath(rootArg);
+  // Verify all installed implementation bytes before loading compiler API/code,
+  // including the optimized context-only path. A version label is insufficient.
+  const implementationStarted=performance.now();
+  const compiler=directProject(root,script);
+  timing('direct_probe.implementation',implementationStarted,{version:compiler.version});
+  const context={interpretation:directInterpretation,compiler:compiler.digest,
+    entry:compiler.entry,node:[realObservedPath(process.execPath),process.version]};
+  const contextHash=hash(context);
+  if(process.argv.includes('--redue-validate-queries')){
+    // Internal, process-local discovery certificate; never a verification receipt.
+    // Verify the current implementation above before queryAnswer can load its API.
+    const started=performance.now();mark('certificate.input_start');
+    // A synchronous fd-0 read can stall with spawnSync's piped input on macOS
+    // Node 22.13.0. Drain the stream without blocking its input delivery. The
+    // parent's existing deadline and the same size limit remain authoritative.
+    const chunks=[];let bytes=0;
+    for await(const chunk of process.stdin){
+      bytes+=chunk.length;if(bytes>8*1024*1024)throw Error('certificate too large');
+      chunks.push(chunk);
+    }
+    const raw=Buffer.concat(chunks).toString('utf8');mark('certificate.input_complete',{bytes});
+    const certificate=JSON.parse(raw),kinds=new Set(['readDirectory','readFile',
+      'fileExists','directoryExists','realpath','directories','entries']);
+    if(certificate.schema!==1||certificate.context!==contextHash||
+      !Array.isArray(certificate.queries)||!certificate.queries.length||
+      certificate.queries.some(q=>!Array.isArray(q)||q.length<3||q.length>4||
+        !kinds.has(q[0])||typeof q[1]!=='string'||!path.isAbsolute(q[1])||
+        q[0]==='readDirectory'&&(q[3]?.tsRoot!==compiler.tsRoot||!Array.isArray(q[3]?.args)||
+          q[3]?.argsVersion!==1||!Array.isArray(q[3]?.undefinedArguments)||
+          q[3].undefinedArguments.some(i=>!Number.isInteger(i)||i<0||i>=q[3].args.length))))
+      throw Error('certificate unavailable');
+    mark('certificate.queries_start',{queries:certificate.queries.length});
+    const matched=queriesMatch(certificate.queries);
+    mark('certificate.queries_complete',{matched});
+    timing('direct_probe.query_validation',started,{queries:certificate.queries.length,matched:matched?1:0});
+    if(!matched)throw Error('compiler queries changed');
+    process.stdout.write(contextHash);
+    process.exit(0);
+  }
+  if(!contextOnly(contextHash)){
+    const {queries,...inputs}=typeScriptInputFacts(root,compiler.tsRoot,compiler.entry);
+    probeResult(hash({root,script,...inputs,...context}),contextHash,queries);
+  }
+}catch(e){console.error(`VSTATE_REASON:${e.code&&/^[a-z-]+$/.test(e.code)?e.code:'typescript-contract-unavailable'}`);process.exitCode=2;}

package/src/direct-typescript.mjs

@@ -0,0 +1,76 @@
+// Versioned, explicit offline compiler recipe. No package manager is executed.
+import fs from 'node:fs';
+import path from 'node:path';
+import {createHash} from 'node:crypto';
+import {createRequire} from 'node:module';
+import {realObservedPath,withinPath} from './path-identity.mjs';
+export const directInterpretation='npm-direct-typescript@1';
+export const directQualification='npm-typescript-direct-v1';
+const reviewed={
+  '5.5.2':{entry:'lib/tsc.js',digest:'953b4844b5f6edc745be844b6c367c227b59029b73c4182f508f90cc47e21816'},
+  '5.6.3':{entry:'lib/tsc.js',digest:'e674b5dc4dac50f6e91be30094aeea983a1f340231717e62b0b6199ae3049eb2'},
+  '5.9.3':{entry:'lib/_tsc.js',digest:'d1b32e75475710fdc85102b1365254d84ceb192d3639d962c53fe1355ce274ca'},
+};
+const fail=code=>{throw Object.assign(Error(code),{code});};
+const hash=bytes=>createHash('sha256').update(bytes).digest('hex');
+export const directEnvironment={variables:['NODE_ENV','NODE_OPTIONS','NODE_PATH','NODE_COMPILE_CACHE','VSCODE_INSPECTOR_OPTIONS'],
+  prefixes:['NODE_','DYLD_','LD_','TSGO_','TSC_','TS_ETW_'],executableIdentity:true};
+export function directEnvironmentIssue(env=process.env){
+  if(![22,24].includes(Number(process.versions.node.split('.')[0])))return 'direct-node-version-unsupported';
+  if(env.VSCODE_INSPECTOR_OPTIONS)return 'direct-execution-environment-unsupported';
+  for(const [key,value] of Object.entries(env)){
+    // The 5.5.2 API can require this unreviewed module during probe loading.
+    // Reject even empty/case aliases; do not mutate the caller's environment.
+    if(/^TS_ETW_MODULE_PATH$/i.test(key))return 'direct-execution-environment-unsupported';
+    if(/^NODE_/i.test(key)){
+      // Node 22.13.0 predates env-proxy initialization. This injected flag is
+      // inert there, but remains strictly fingerprinted as NODE_ context.
+      if(key==='NODE_USE_ENV_PROXY'&&value==='1'&&process.version==='v22.13.0'&&
+        !process.allowedNodeEnvironmentFlags.has('--use-env-proxy'))continue;
+      if(key==='NODE_ENV'&&['','production','test'].includes(value))continue;
+      if(value!=='')return 'direct-execution-environment-unsupported';
+    }
+    if(/^(DYLD_|LD_|TSGO_|TSC_)/i.test(key)&&value!=='')return 'direct-execution-environment-unsupported';
+  }
+  return null;
+}
+export function directCompiler(root,{verify=true}={}){
+  root=realObservedPath(root);
+  const manifest=createRequire(path.join(root,'package.json')).resolve('typescript/package.json');
+  const tsRoot=path.dirname(realObservedPath(manifest));
+  if(!withinPath(tsRoot,root)||tsRoot!==realObservedPath(path.join(root,'node_modules/typescript')))
+    fail('direct-typescript-layout-unsupported');
+  const version=JSON.parse(fs.readFileSync(manifest)).version,spec=reviewed[version];
+  if(!spec)fail('direct-typescript-version-unsupported');
+  if(verify){
+    const files=[];
+    const walk=(dir,relative='')=>{
+      for(const entry of fs.readdirSync(dir,{withFileTypes:true})){
+        const name=relative?relative+'/'+entry.name:entry.name,full=path.join(dir,entry.name);
+        if(entry.isDirectory())walk(full,name);
+        else if(entry.isFile())files.push([name,full]);
+        else fail('direct-typescript-implementation-unreviewed');
+      }
+    };walk(tsRoot);
+    const digest=createHash('sha256');
+    for(const [name,file] of files.sort(([a],[b])=>a<b?-1:a>b?1:0))digest.update(name+'\0'+hash(fs.readFileSync(file))+'\0');
+    if(digest.digest('hex')!==spec.digest)fail('direct-typescript-implementation-unreviewed');
+  }
+  return {tsRoot,version,entry:path.join(tsRoot,spec.entry),digest:spec.digest};
+}
+export function directProject(root,script,{verify=true}={}){
+  const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json')));
+  if(pkg.workspaces||pkg.packageManager&&!/^npm@/.test(pkg.packageManager)||
+    !['package-lock.json','npm-shrinkwrap.json'].some(file=>fs.existsSync(path.join(root,file)))||
+    ['yarn.lock','pnpm-lock.yaml','bun.lock','bun.lockb'].some(file=>fs.existsSync(path.join(root,file))))
+    fail('direct-npm-project-unsupported');
+  if(pkg.scripts?.[script]?.trim()!=='tsc --noEmit'||pkg.scripts?.['pre'+script]||pkg.scripts?.['post'+script])
+    fail('typecheck-script-changed');
+  const issue=directEnvironmentIssue();if(issue)fail(issue);
+  return directCompiler(root,{verify});
+}
+// Provenance only: retain a digest, never proxy URLs/credentials or a raw dump.
+// No npm process runs in this recipe; these keys are not compiler applicability.
+export function observedNpmContext(env=process.env){
+  return hash(JSON.stringify(Object.entries(env).filter(([key])=>/^npm_/i.test(key)||/^(?:https?_proxy|all_proxy|no_proxy)$/i.test(key)).sort(([a],[b])=>a<b?-1:a>b?1:0)));
+}

package/src/executable-lookup.mjs

@@ -0,0 +1,18 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+// Resolve the same project-local PATH that will be used for execution. Windows
+// command shims have no extension in package scripts but normally end in .cmd.
+export function findExecutable(name,{platform=process.platform,env=process.env,
+  cwd=process.cwd(),paths=path,access=fs.accessSync,realpath=fs.realpathSync}={}) {
+  if(!name||paths.basename(name)!==name)return null;
+  // An extensionless POSIX shell shim can coexist with npm.cmd on Windows.
+  // CreateProcess cannot run the shell shim, so prefer native PATHEXT files.
+  const suffixes=platform==='win32'&&!paths.extname(name)?
+    [...(env.PATHEXT||'.COM;.EXE;.BAT;.CMD').split(';').filter(Boolean),'']:[''];
+  for(const folder of (env.PATH||'').split(paths.delimiter))for(const suffix of suffixes) {
+    const candidate=paths.join(folder||cwd,name+suffix);
+    try{access(candidate,fs.constants.X_OK);return realpath(candidate);}catch{}
+  }
+  return null;
+}

package/src/glob.mjs

@@ -0,0 +1,9 @@
+import picomatch from 'picomatch';
+
+// These are the exact delegates used by micromatch 4.0.8 matcher/isMatch,
+// with the same pinned picomatch 2.3.2. REDUE does not use brace expansion;
+// importing the smaller dependency avoids shipping its unused vulnerable parser.
+export default {
+  matcher(pattern,options){return picomatch(pattern,options);},
+  isMatch(file,patterns,options){return picomatch(patterns,options)(file);}
+};

package/src/history-worker.mjs

@@ -0,0 +1,23 @@
+// Native history is an optional acceleration. Keep its operations off the
+// control thread so a wedged native call cannot block status or shutdown.
+import fs from 'node:fs';
+import {mark} from './decision-profile.mjs';
+mark('history.worker_loaded');
+import watcher from '@parcel/watcher';
+
+try {
+  const [root,previous,next,backend,faultFile]=process.argv.slice(2);
+  let fault;
+  try {fault=faultFile&&fs.readFileSync(faultFile,'utf8').trim();}
+  catch(e){if(e.code!=='ENOENT')throw e;}
+  if(fault==='hang')Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0);
+  if(fault==='fail')throw Error('injected history failure');
+  mark('history.snapshot_start');
+  await watcher.writeSnapshot(root,next,{backend});
+  mark('history.snapshot_complete');
+  const changes=previous?await watcher.getEventsSince(root,previous,{backend}):[];
+  mark('history.events_complete',{events:changes.length});
+  process.send({ok:true,changes});
+} catch(error) {
+  process.send({ok:false,error:error.message,code:error.code||error.name});
+}