@redue/cli 0.0.0-stage → 0.1.0-alpha.2

package/src/linux-inotify.py

@@ -0,0 +1,228 @@
+#!/usr/bin/env python3
+"""Linux-only inotify transport. Emits paths and continuity faults, never file data.
+
+Unlike the pinned Parcel inotify backend, IN_Q_OVERFLOW is reported. The Node
+engine owns all content inspection and deterministic reconciliation.
+"""
+import ctypes
+import errno
+import json
+import os
+import re
+import select
+import struct
+import sys
+import time
+
+IN_MODIFY = 0x00000002
+IN_ATTRIB = 0x00000004
+IN_CLOSE_WRITE = 0x00000008
+IN_MOVED_FROM = 0x00000040
+IN_MOVED_TO = 0x00000080
+IN_CREATE = 0x00000100
+IN_DELETE = 0x00000200
+IN_DELETE_SELF = 0x00000400
+IN_MOVE_SELF = 0x00000800
+IN_UNMOUNT = 0x00002000
+IN_Q_OVERFLOW = 0x00004000
+IN_IGNORED = 0x00008000
+IN_ISDIR = 0x40000000
+FILE_MASK = IN_MODIFY | IN_ATTRIB | IN_CLOSE_WRITE | IN_DELETE_SELF | IN_MOVE_SELF
+MASK = (IN_MODIFY | IN_ATTRIB | IN_CLOSE_WRITE | IN_MOVED_FROM |
+        IN_MOVED_TO | IN_CREATE | IN_DELETE | IN_DELETE_SELF |
+        IN_MOVE_SELF | IN_UNMOUNT)
+HEADER = struct.Struct('iIII')
+LOCAL_FILESYSTEMS = {'ext2', 'ext3', 'ext4', 'xfs', 'btrfs', 'f2fs',
+                     'tmpfs', 'zfs'}
+
+
+def emit(kind, **fields):
+    print(json.dumps({'kind': kind, **fields}, ensure_ascii=True), flush=True)
+
+
+def filesystem_type(folder):
+    best = ('', None)
+    with open('/proc/self/mountinfo', encoding='utf-8') as mounts:
+        for line in mounts:
+            before, after = line.rstrip('\n').split(' - ', 1)
+            point = re.sub(r'\\([0-7]{3})', lambda m: chr(int(m[1], 8)),
+                           before.split()[4])
+            if (folder == point or folder.startswith(point.rstrip('/') + '/')) \
+                    and len(point) > len(best[0]):
+                best = (point, after.split()[0])
+    return best[1]
+
+
+def main(root):
+    root = os.path.realpath(root)
+    if filesystem_type(root) not in LOCAL_FILESYSTEMS:
+        emit('gap', reason='inotify_filesystem_untrusted')
+        return 2
+    libc = ctypes.CDLL(None, use_errno=True)
+    libc.inotify_init1.argtypes = [ctypes.c_int]
+    libc.inotify_init1.restype = ctypes.c_int
+    libc.inotify_add_watch.argtypes = [ctypes.c_int, ctypes.c_char_p, ctypes.c_uint32]
+    libc.inotify_add_watch.restype = ctypes.c_int
+    libc.inotify_rm_watch.argtypes = [ctypes.c_int, ctypes.c_int]
+    libc.inotify_rm_watch.restype = ctypes.c_int
+    fd = libc.inotify_init1(os.O_NONBLOCK | os.O_CLOEXEC)
+    if fd < 0:
+        raise OSError(ctypes.get_errno(), 'inotify_init1 failed')
+    watches = {}
+    file_watches = {}
+    file_paths = {}
+    intentional_removals = set()
+
+    def add_tree(folder):
+        stack = [folder]
+        while stack:
+            current = stack.pop()
+            wd = libc.inotify_add_watch(fd, os.fsencode(current), MASK)
+            if wd < 0:
+                raise OSError(ctypes.get_errno(), 'inotify_add_watch failed')
+            watches[wd] = current
+            with os.scandir(current) as entries:
+                for entry in entries:
+                    if entry.is_dir(follow_symlinks=False):
+                        stack.append(entry.path)
+
+    def drain():
+        while True:
+            try:
+                block = os.read(fd, 65536)
+            except BlockingIOError:
+                return True
+            if not block:
+                emit('gap', reason='inotify_closed')
+                return False
+            offset = 0
+            while offset < len(block):
+                wd, mask, _, length = HEADER.unpack_from(block, offset)
+                offset += HEADER.size
+                raw = block[offset:offset + length].split(b'\0', 1)[0]
+                offset += length
+                if mask & IN_Q_OVERFLOW:
+                    emit('gap', reason='inotify_overflow')
+                    return False
+                if wd in intentional_removals and mask & IN_IGNORED:
+                    intentional_removals.remove(wd)
+                    continue
+                if wd in file_watches:
+                    if mask & (IN_UNMOUNT | IN_DELETE_SELF | IN_MOVE_SELF | IN_IGNORED):
+                        emit('gap', reason='inotify_file_watch_lost')
+                        return False
+                    for watched in file_watches[wd]:
+                        emit('event', type='update', path=watched)
+                    continue
+                parent = watches.get(wd)
+                if parent is None:
+                    emit('gap', reason='inotify_watch_unknown')
+                    return False
+                target = os.path.join(parent, os.fsdecode(raw)) if raw else parent
+                if mask & (IN_UNMOUNT | IN_DELETE_SELF | IN_MOVE_SELF | IN_IGNORED):
+                    emit('gap', reason='inotify_watch_lost')
+                    return False
+                if (mask & IN_ISDIR) and (mask & (IN_CREATE | IN_MOVED_TO)):
+                    try:
+                        add_tree(target)
+                    except OSError as error:
+                        emit('gap', reason='inotify_watch_add_failed', errno=error.errno)
+                        return False
+                    # Contents can appear before their new directory receives
+                    # a watch. The engine reconciles instead of guessing.
+                    emit('gap', reason='inotify_new_directory')
+                    return False
+                if (mask & IN_ISDIR) and (mask & (IN_DELETE | IN_MOVED_FROM)):
+                    emit('gap', reason='inotify_directory_removed')
+                    return False
+                event = ('delete' if mask & (IN_DELETE | IN_MOVED_FROM) else
+                         'create' if mask & (IN_CREATE | IN_MOVED_TO) else 'update')
+                emit('event', type=event, path=target)
+
+    def replace_file_watches(paths):
+        requested = set(paths)
+        removed = False
+        for old in set(file_paths) - requested:
+            wd = file_paths.pop(old)
+            aliases = file_watches[wd]
+            aliases.remove(old)
+            if not aliases:
+                del file_watches[wd]
+                intentional_removals.add(wd)
+                libc.inotify_rm_watch(fd, wd)
+                removed = True
+        # Consume IN_IGNORED before adding new watches so a recycled watch
+        # descriptor cannot be mistaken for an intentionally removed one.
+        if removed and not drain():
+            return False
+        for added in requested - set(file_paths):
+            absolute = os.path.abspath(added)
+            if os.path.commonpath((root, absolute)) != root or \
+                    os.path.commonpath((root, os.path.realpath(absolute))) != root:
+                raise ValueError('installed watch escaped checkout')
+            wd = libc.inotify_add_watch(fd, os.fsencode(absolute), FILE_MASK)
+            if wd < 0:
+                raise OSError(ctypes.get_errno(), 'installed inotify_add_watch failed')
+            file_paths[added] = wd
+            file_watches.setdefault(wd, set()).add(added)
+        return True
+
+    try:
+        add_tree(root)
+        emit('ready', watches=len(watches))
+        stdin = b''
+        heartbeat = time.monotonic()
+        while True:
+            injected = os.environ.get('VSTATE_TEST_LINUX_GAP_FILE') if \
+                os.environ.get('VSTATE_TEST_FAULTS') == '1' else None
+            if injected and os.path.exists(injected):
+                with open(injected, encoding='utf-8') as source:
+                    reason = source.read(64).strip()
+                os.unlink(injected)
+                emit('gap', reason=reason if reason in
+                     ('inotify_overflow', 'inotify_watch_lost',
+                      'inotify_watch_add_failed') else 'inotify_test_gap')
+                return 2
+            readable, _, _ = select.select([fd, 0], [], [], 0.25)
+            if fd in readable and not drain():
+                return 2
+            if 0 in readable:
+                chunk = os.read(0, 4096)
+                if not chunk:
+                    return 0
+                stdin += chunk
+                while b'\n' in stdin:
+                    line, stdin = stdin.split(b'\n', 1)
+                    message = json.loads(line)
+                    if message.get('kind') == 'barrier':
+                        hang = os.environ.get('VSTATE_TEST_LINUX_HANG_FILE') if \
+                            os.environ.get('VSTATE_TEST_FAULTS') == '1' else None
+                        if hang and os.path.exists(hang):
+                            continue
+                        if not drain():
+                            return 2
+                        emit('barrier', id=message['id'])
+                    elif message.get('kind') == 'watch-files':
+                        try:
+                            if not replace_file_watches(message['paths']):
+                                return 2
+                        except (OSError, ValueError) as error:
+                            emit('gap', reason='inotify_file_watch_add_failed',
+                                 errno=getattr(error, 'errno', None))
+                            return 2
+                        if not drain():
+                            return 2
+                        emit('watched', id=message['id'], files=len(file_paths))
+            if time.monotonic() - heartbeat >= 1:
+                emit('heartbeat', watches=len(watches))
+                heartbeat = time.monotonic()
+    finally:
+        os.close(fd)
+
+
+if __name__ == '__main__':
+    try:
+        sys.exit(main(sys.argv[1]))
+    except (OSError, ValueError, IndexError) as error:
+        emit('gap', reason='inotify_backend_error', errno=getattr(error, 'errno', None))
+        sys.exit(2)

package/src/linux-observer.mjs

@@ -0,0 +1,79 @@
+import path from 'node:path';
+import {spawn} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+import {randomUUID} from 'node:crypto';
+
+const helper=path.join(path.dirname(fileURLToPath(import.meta.url)),'linux-inotify.py');
+const fault=(reason,code)=>Object.assign(Error(reason),{code:code||reason});
+
+export function subscribeLinux(root,callback) {
+  return new Promise((resolve,reject)=>{
+    const child=spawn('python3',['-u',helper,root],
+      {stdio:['pipe','pipe','ignore']});
+    let ready=false,closing=false,ended=false,buffer='',last=Date.now();
+    const barriers=new Map();
+    const startup=setTimeout(()=>fail(fault('Linux observer startup timed out')),10000);
+    const heartbeat=setInterval(()=>{
+      if(ready&&!closing&&!barriers.size&&Date.now()-last>4000)
+        fail(fault('Linux observer heartbeat unavailable'));
+    },1000);
+    const cleanup=()=>{clearTimeout(startup);clearInterval(heartbeat);
+      for(const [id,pending] of barriers){clearTimeout(pending.timer);
+        pending.reject(fault('Linux observer unavailable'));barriers.delete(id);}};
+    const fail=error=>{
+      if(ended)return;ended=true;cleanup();
+      if(!ready)reject(error);else if(!closing)callback(error,[]);
+      child.kill('SIGTERM');
+    };
+    const request=(kind,fields={},timeoutMs=5000)=>{
+      if(ended||closing)return Promise.reject(fault('Linux observer unavailable'));
+      return new Promise((done,no)=>{
+        const id=randomUUID();const timer=setTimeout(()=>{
+          barriers.delete(id);no(fault(`Linux observer ${kind} timed out`));
+          fail(fault(`Linux observer ${kind} timed out`));
+        },timeoutMs);
+        barriers.set(id,{resolve:done,reject:no,timer});
+        child.stdin.write(JSON.stringify({kind,id,...fields})+'\n');
+      });
+    };
+    child.on('error',fail);
+    child.stdin.on('error',fail);
+    child.stdout.on('error',fail);
+    child.on('exit',(code,signal)=>{
+      if(!closing&&!ended)fail(fault(`Linux observer exited: ${code??signal}`));
+      else cleanup();
+    });
+    child.stdout.on('data',data=>{
+      buffer+=data.toString();
+      if(buffer.length>1024*1024){fail(fault('Linux observer output backlog'));return;}
+      for(;;){const end=buffer.indexOf('\n');if(end<0)break;
+        const line=buffer.slice(0,end);buffer=buffer.slice(end+1);
+        let message;try{message=JSON.parse(line);}catch{fail(fault('Linux observer protocol error'));return;}
+        last=Date.now();
+        if(message.kind==='ready'){
+          ready=true;clearTimeout(startup);
+          resolve({
+            synchronize(timeoutMs=5000){return request('barrier',{},timeoutMs);},
+            watchFiles(paths,timeoutMs=30000){
+              return request('watch-files',{paths},timeoutMs);
+            },
+            async unsubscribe(){
+              if(closing)return;closing=true;cleanup();child.stdin.end();
+              if(ended||child.exitCode!==null||child.signalCode!==null)return;
+              const exit=new Promise(done=>child.once('exit',done));
+              child.kill('SIGTERM');
+              const killer=setTimeout(()=>child.kill('SIGKILL'),1000);
+              await exit;clearTimeout(killer);
+            },
+            get pid(){return child.pid;}
+          });
+        }else if(message.kind==='event')callback(null,[{type:message.type,path:message.path}]);
+        else if(message.kind==='gap'){fail(fault(message.reason,message.reason));return;}
+        else if(message.kind==='barrier'||message.kind==='watched'){
+          const pending=barriers.get(message.id);if(!pending)continue;
+          barriers.delete(message.id);clearTimeout(pending.timer);pending.resolve();
+        }else if(message.kind!=='heartbeat'){fail(fault('Linux observer protocol error'));return;}
+      }
+    });
+  });
+}

package/src/node-onboarding.mjs

@@ -0,0 +1,263 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import {spawnSync} from 'node:child_process';
+import micromatch from './glob.mjs';
+import {yarnWorkspaceTypecheckInputs} from './yarn-workspace-inputs.mjs';
+import {pnpmInstallInfo,pnpmProjectInfo,pnpmTypecheckInputs} from './pnpm-inputs.mjs';
+import {realObservedPath} from './path-identity.mjs';
+import {findExecutable} from './executable-lookup.mjs';
+
+const exists=file=>{try{fs.accessSync(file);return true;}catch{return false;}};
+const readJson=file=>JSON.parse(fs.readFileSync(file,'utf8'));
+const scriptNames={
+  typecheck:['typecheck','type-check','check:types','types:check'],
+  test:['test','test:unit','test:check'],
+  lint:['lint','lint:check'],
+  build:['build'],
+};
+const sourceExtensions='**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json,jsonc}';
+const likelyDirs=['src','app','apps','pages','lib','packages','test','tests','__tests__','scripts'];
+const toolConfigs=['tsconfig.json','tsconfig.base.json','vite.config.ts','vite.config.js',
+  'vitest.config.ts','vitest.config.js','jest.config.js','jest.config.ts',
+  'eslint.config.js','eslint.config.mjs','.eslintrc','.eslintrc.json',
+  '.eslintrc.js','.npmrc','.yarnrc.yml'];
+function installedNpmVersion() {
+  try{
+    const executable=findExecutable('npm');
+    if(!executable)return null;
+    const manifest=readJson(process.platform==='win32'?
+      path.join(path.dirname(executable),'node_modules','npm','package.json'):
+      path.join(path.dirname(path.dirname(executable)),'package.json'));
+    if(manifest.name==='npm')return manifest.version;
+  }catch{}
+  return null;
+}
+
+function manager(root,pkg) {
+  const declared=pkg.packageManager?.match(/^(npm|yarn|pnpm|bun)@([^+\s]+)/);
+  const locks=['package-lock.json','npm-shrinkwrap.json','yarn.lock','pnpm-lock.yaml',
+    'bun.lock','bun.lockb'].filter(name=>exists(path.join(root,name)));
+  const kinds=new Set(locks.map(name=>name.startsWith('package-lock')||name==='npm-shrinkwrap.json'?
+    'npm':name==='yarn.lock'?'yarn':name.startsWith('pnpm')?'pnpm':'bun'));
+  if(declared)kinds.add(declared[1]);
+  if(kinds.size!==1)return {name:null,version:declared?.[2]||null,layout:'unknown',
+    issue:kinds.size?'package-manager declaration conflicts with lockfiles':
+      'no supported lockfile or packageManager declaration'};
+  const name=[...kinds][0],version=declared?.[1]===name?declared[2]:null;
+  if(name==='bun')return {name,version,layout:'unsupported',
+    issue:'bun installation layout is not supported in this alpha'};
+  if(name==='pnpm'){
+    try{const installed=pnpmInstallInfo(root);
+      return {name,version:installed.version,
+        layout:`node-modules/${installed.linker}`,issue:null,lockfiles:locks,
+        workspacePatterns:installed.patterns};}
+    catch(e){let project;try{project=pnpmProjectInfo(root);}catch{}
+      return {name,version:project?.version||version,
+        layout:project?.linker||'recording-only',issue:e.message,
+        lockfiles:locks,workspacePatterns:project?.patterns||[]};}
+  }
+  if(name==='npm')return {name,version:version||installedNpmVersion(),
+    layout:'node-modules',issue:null,
+    lockfiles:locks};
+  const yarnrc=path.join(root,'.yarnrc.yml');
+  if(!exists(yarnrc)){
+    const classicLock=exists(path.join(root,'yarn.lock'))&&
+      /^# yarn lockfile v1\s*$/m.test(fs.readFileSync(path.join(root,'yarn.lock'),'utf8').slice(0,256));
+    const classic=version?.startsWith('1.')||(!version&&classicLock);
+    return {name,version:version||null,layout:classic?'node-modules':'unknown',
+      issue:!version?'Yarn version is not declared; Corepack may select a different version or edit package.json':
+        classic?null:'Yarn linker is not declared; node-modules layout cannot be assumed',
+      lockfiles:locks};
+  }
+  const text=fs.readFileSync(yarnrc,'utf8');
+  const linker=text.match(/^\s*nodeLinker\s*:\s*['"]?([\w-]+)/m)?.[1];
+  const mode=text.match(/^\s*nmMode\s*:\s*['"]?([\w-]+)/m)?.[1]||'classic';
+  if(linker!=='node-modules')return {name,version,layout:linker||'unknown',
+    issue:`Yarn ${linker||'unspecified'} linker is outside the node-modules alpha path`,
+    lockfiles:locks};
+  if(mode!=='classic')return {name,version,layout:`node-modules/${mode}`,
+    issue:`Yarn nmMode ${mode} is not yet observed safely`,lockfiles:locks};
+  return {name,version,layout:'node-modules/classic',issue:null,lockfiles:locks};
+}
+const exactTypeScript=script=>script.trim()==='tsc --noEmit';
+function sourceLinkIssue(root) {
+  const stack=likelyDirs.filter(name=>exists(path.join(root,name)));
+  let inspected=0;
+  while(stack.length){
+    const rel=stack.pop(),full=path.join(root,rel);
+    if(fs.lstatSync(full).isSymbolicLink())
+      return `${rel} is a source link; declare its permitted observation boundary explicitly`;
+    let entries;try{entries=fs.readdirSync(full,{withFileTypes:true});}
+    catch{return `${rel} cannot be inspected; source input coverage needs review`;}
+    for(const entry of entries){
+      if(++inspected>100000)return 'source tree is too large for init link inspection';
+      const child=`${rel}/${entry.name}`;
+      if(entry.isSymbolicLink())return `${child} is a source link; declare its permitted observation boundary explicitly`;
+      if(entry.isDirectory()&&!['.git','node_modules'].includes(entry.name))stack.push(child);
+    }
+  }
+  return null;
+}
+function sourceInputs(root,kind,lockfiles) {
+  const files=['package.json',...lockfiles,...toolConfigs.filter(name=>exists(path.join(root,name)))];
+  if(kind==='typecheck')return [...new Set(['package.json',...lockfiles,
+    'tsconfig.json',sourceExtensions,
+    '!node_modules/**','!.git/**'])];
+  const dirs=likelyDirs.filter(name=>exists(path.join(root,name)))
+    .map(name=>`${name}/**`);
+  return [...new Set([...files,...(dirs.length?dirs:['package.json'])])];
+}
+function classify(kind,scriptName,script,pkg,managerInfo,root) {
+  const value=script.trim();
+  if(managerInfo.issue)return {level:managerInfo.name==='pnpm'?'recording':'unsupported',
+    reason:managerInfo.issue};
+  if(kind==='typecheck'&&exactTypeScript(value)&&
+    !pkg.scripts?.['pre'+scriptName]&&!pkg.scripts?.['post'+scriptName]&&
+    managerInfo.name==='npm'&&
+    exists(path.join(root,'tsconfig.json'))&&
+    exists(path.join(root,'node_modules/typescript/package.json')))
+    return {level:'ready',reason:'canonical local tsc --noEmit; checked again before reuse',
+      qualification:'typescript-noemit-v1'};
+  if(kind==='typecheck')return {level:'recording',reason:
+    'TypeScript invocation, installation, or configuration is outside the automatic noEmit contract'};
+  if(kind==='test')return {level:'recording',reason:/\b(vitest|jest)\b/.test(value)?
+    'test framework detected; caches, transforms and runtime inputs need review':
+    'test script detected; runtime and generated inputs need review'};
+  if(kind==='lint')return {level:'recording',reason:/\beslint\b/.test(value)?
+    'ESLint detected; plugin/config and resolver inputs need review':
+    'lint script detected; tool and config inputs need review'};
+  return {level:'recording',reason:/\bvite\b/.test(value)?
+    'Vite detected; build environment and generated inputs need review':
+    'build script detected; generated and runtime inputs need review'};
+}
+function selectScript(kind,names,scripts) {
+  const preferred=names.find(name=>typeof scripts[name]==='string'&&
+    scripts[name].trim()&&!/^echo\s+["']?Error: no test specified/.test(scripts[name]));
+  if(preferred)return {script:preferred};
+  const candidates=Object.keys(scripts).filter(name=>{
+    const value=scripts[name]?.trim();
+    if(typeof value!=='string')return false;
+    if(kind==='typecheck')return exactTypeScript(value);
+    if(kind==='test')return /^(?:vitest|jest)(?:\s|$)/.test(value);
+    if(kind==='lint')return /^eslint(?:\s|$)/.test(value);
+    return /^vite\s+build(?:\s|$)/.test(value);
+  });
+  return candidates.length===1?{script:candidates[0]}:
+    candidates.length>1?{ambiguous:candidates}:{};
+}
+function workspaceManifests(root,patterns) {
+  const listing=spawnSync('git',['ls-files','--cached','--others','--exclude-standard',
+    '-z','--',':(glob)**/package.json'],{cwd:root,encoding:'utf8',timeout:5000,
+    maxBuffer:32*1024*1024,stdio:['ignore','pipe','ignore'],
+    env:{...process.env,GIT_OPTIONAL_LOCKS:'0'}});
+  if(listing.status!==0||listing.error)throw Error('workspace package manifests cannot be inspected');
+  const matched=listing.stdout.split('\0').filter(Boolean).filter(file=>{
+    const dir=path.posix.dirname(file);
+    return dir!=='.'&&!dir.split('/').includes('node_modules')&&
+      micromatch.isMatch(dir,patterns,{dot:true});
+  }).sort();
+  if(matched.length>50)throw Error('more than 50 workspace packages found; select checks explicitly');
+  return matched.map(file=>({file,pkg:readJson(path.join(root,file))}));
+}
+export function discoverNodeProject(root) {
+  root=realObservedPath(root);
+  const packageFile=path.join(root,'package.json');
+  if(!exists(packageFile))throw Error('run init from a repository containing package.json');
+  const pkg=readJson(packageFile),pm=manager(root,pkg),scripts=pkg.scripts||{};
+  const git=spawnSync('git',['rev-parse','--show-toplevel'],{cwd:root,
+    encoding:'utf8',timeout:3000,stdio:['ignore','pipe','ignore']});
+  const repositoryIssue=git.status===0?null:
+    'Git checkout is unavailable; filesystem observation needs a checkout';
+  const observationIssue=repositoryIssue||sourceLinkIssue(root);
+  const workspacePatterns=pm.name==='pnpm'?pm.workspacePatterns:
+    Array.isArray(pkg.workspaces)?pkg.workspaces:pkg.workspaces?.packages;
+  const workspaces=Boolean(pkg.workspaces)||Boolean(workspacePatterns?.length);
+  if(workspaces&&(!Array.isArray(workspacePatterns)||
+    workspacePatterns.some(value=>typeof value!=='string'||path.isAbsolute(value)||
+      value.split('/').includes('..'))))
+    throw Error('workspace patterns need a supported project-relative package list');
+  const checks=[],ambiguous=[];
+  for(const [kind,names] of Object.entries(scriptNames)) {
+    const selected=selectScript(kind,names,scripts),script=selected.script;
+    if(selected.ambiguous)ambiguous.push({kind,scripts:selected.ambiguous});
+    if(!script)continue;
+    let classification=observationIssue?{level:'unsupported',reason:observationIssue}:
+      classify(kind,script,scripts[script],pkg,pm,root);
+    if(workspaces&&classification.level==='ready')classification={level:'recording',
+      reason:'workspace task and installed-input closure need explicit qualification'};
+    const check={name:kind,script,kind,inputs:sourceInputs(root,kind,pm.lockfiles||[])};
+    if(pm.name==='pnpm'&&kind==='typecheck'&&!workspaces&&!pm.issue&&
+      /^(?:tsc --noEmit|tsc -p (?:\.|tsconfig\.json)(?: --noEmit)?)$/.test(scripts[script].trim())){
+      try{const contract=pnpmTypecheckInputs(root,'.',script);
+        if(contract.limitations.length)throw Error(contract.limitations.join('; '));
+        check.command=['@node','@typescript-bin:.',
+          ...scripts[script].trim().split(/\s+/).slice(1)];
+        check.cwd='.';
+        check.inputs=['package.json','pnpm-lock.yaml',
+          ...(exists(path.join(root,'pnpm-workspace.yaml'))?['pnpm-workspace.yaml']:[]),
+          'tsconfig.json','src/**'];
+        classification={level:'ready',reason:'pinned pnpm TypeScript inputs and installation; checked again before reuse',
+          qualification:'pnpm-tsc-v1'};}
+      catch(e){classification={level:'recording',reason:`pnpm TypeScript contract needs review: ${e.message}`};}
+    }
+    if(classification.qualification)check.qualification=classification.qualification;
+    checks.push({config:check,...classification});
+  }
+  if(workspaces&&!observationIssue){
+    const seen=new Set();
+    for(const {file,pkg:member} of workspaceManifests(root,workspacePatterns)){
+      const dir=path.posix.dirname(file),name=member.name;
+      if(typeof name!=='string'||!name||seen.has(name)){
+        ambiguous.push({kind:'workspace',scripts:[dir],reason:'missing or duplicate package name'});
+        continue;
+      }
+      seen.add(name);
+      if(!['npm','yarn','pnpm'].includes(pm.name))continue;
+      for(const [kind,names] of Object.entries(scriptNames)){
+        const selected=selectScript(kind,names,member.scripts||{});
+        if(selected.ambiguous){ambiguous.push({kind:`${name}:${kind}`,
+          scripts:selected.ambiguous});continue;}
+        if(!selected.script)continue;
+        const command=pm.name==='npm'?['@which:npm','run',selected.script,
+          '--workspace',name]:pm.name==='yarn'?
+          ['@which:yarn','workspace',name,'run',selected.script]:
+          ['@which:pnpm','--filter',name,'run',selected.script];
+        const check={name:`${name}:${kind}`,kind,command,
+          inputs:['package.json',...(pm.lockfiles||[]),`${dir}/**`,
+            `!${dir}/node_modules/**`]};
+        let level=pm.issue&&pm.name!=='pnpm'?'unsupported':'recording';
+        let reason=pm.issue||'workspace script found; shared configuration and installed inputs need review';
+        if(!pm.issue&&pm.name==='yarn'&&pm.layout==='node-modules/classic'&&
+          kind==='typecheck'&&(member.scripts||{})[selected.script]?.trim()==='tsc -p .'&&
+          !member.scripts?.['pre'+selected.script]&&!member.scripts?.['post'+selected.script]){
+          try{
+            yarnWorkspaceTypecheckInputs(root,name,selected.script);
+            check.workspace=name;check.qualification='yarn-workspace-tsc-v1';
+            check.inputs=['package.json','yarn.lock','.yarnrc.yml',file,`${dir}/src/**`];
+            level='ready';reason='pinned Yarn workspace tsc and installed inputs; checked again before reuse';
+          }catch(e){reason=`workspace TypeScript contract needs review: ${e.message}`;}
+        }
+        if(!pm.issue&&pm.name==='pnpm'&&kind==='typecheck'&&
+          /^(?:tsc --noEmit|tsc -p (?:\.|tsconfig\.json)(?: --noEmit)?)$/.test(
+            (member.scripts||{})[selected.script]?.trim()||'')&&
+          !member.scripts?.['pre'+selected.script]&&!member.scripts?.['post'+selected.script]){
+          try{const contract=pnpmTypecheckInputs(root,name,selected.script);
+            if(contract.limitations.length)throw Error(contract.limitations.join('; '));
+            check.workspace=name;check.qualification='pnpm-tsc-v1';
+            check.script=selected.script;
+            check.cwd=dir;
+            check.command=['@node',`@typescript-bin:${dir}`,
+              ...member.scripts[selected.script].trim().split(/\s+/).slice(1)];
+            check.inputs=['package.json','pnpm-lock.yaml','pnpm-workspace.yaml',file,
+              `${dir}/src/**`];
+            level='ready';reason='pinned pnpm workspace TypeScript inputs; checked again before reuse';
+          }catch(e){reason=`pnpm TypeScript contract needs review: ${e.message}`;}
+        }
+        checks.push({config:check,level,reason});
+      }
+    }
+  }
+  return {schema:1,root,manager:pm,observationIssue,workspaces,node:process.version,
+    checks,ambiguous,
+    config:{schema:1,packageManager:pm.name||'unknown',checks:checks.map(row=>row.config)}};
+}