@redue/cli 0.1.0-alpha.15 → 0.1.0-alpha.17

package/CHANGELOG.md

@@ -1,5 +1,73 @@
 # Changelog
 
+## 0.1.0-alpha.17 — 2026-10-22
+
+Workspaces and package managers beyond npm. In the census of 108 public
+TypeScript repos, the ones `init` makes ready went from 5 to 8 for typecheck
+and from 6 to 22 for tests.
+
+- pnpm 9-12 for the pnpm TypeScript contract (it took only an exact pnpm 12
+  pin). The installed `.modules.yaml` names the version; a pin is optional,
+  with or without Corepack's `+sha512` hash (pins with a hash never matched
+  before). `.npmrc` settings that only change what gets installed are
+  accepted; settings that move or copy installed files, or run code during
+  install, are refused in either file: custom modules, virtual-store or
+  lockfile directories, the global virtual store, injected workspace
+  packages, separate lockfiles, pnpmfile hooks, `configDependencies`.
+- The tests recipe takes single-package pnpm 9-12 and Yarn `node-modules`
+  installs, and gives each workspace package (npm or Yarn `workspaces`, pnpm
+  `packages`) whose test script runs Vitest directly its own `PACKAGE:test`
+  check, run in the package directory. Inputs stay the whole checkout; every
+  package's node_modules is an installed input. Jest and root test scripts in
+  workspaces stay recording-only. A package added later makes the
+  workspace's checks UNVERIFIED until `init` runs again.
+- A recorded test run is UNVERIFIED when an installed file has another hard
+  link: a package store outside the checkout (pnpm's default on Linux, Yarn's
+  hardlinks modes) could change it unseen. pnpm on macOS clones files and is
+  not affected; on Linux, pnpm test checks qualify but are not reused unless
+  pnpm copies files.
+- Observer: an installed link to a directory (pnpm links every package) is
+  observed by its link chain when the target is itself observed installed;
+  any other directory link still makes observation unavailable.
+- Workspace patterns honour `!pattern` exclusions; before, a negated pattern
+  matched every directory.
+- Fixed: a new workspace package manifest did not re-plan a test check, for
+  npm workspaces too.
+
+Eval on alpha.17 code (CI 39828002753, 84 sessions, test tasks on twilio,
+cheerio and SwitchHosts plus the pnpm project devops-daily): 0 critical
+findings; 23 skipped test runs, each passing three plain reruns; nothing was
+skipped on devops-daily, whose recorded runs were UNVERIFIED on the Linux
+runner.
+## 0.1.0-alpha.16 — 2026-10-22
+
+Changes to the Claude Code integration, and one fix for commands that meet
+on fresh state. Run `redue agent setup claude --apply` again to get the new
+hook entries.
+
+- A SessionStart hook starts the project's observer when a session starts,
+  resumes, clears or compacts, if none is running. It returns at once and
+  prints nothing. Without a running observer every check was UNVERIFIED, so
+  the hook could neither skip nor record. `agent doctor` reports it.
+- The hook matches more command forms, each mapping to one configured check:
+  `pnpm SCRIPT`, `pnpm run SCRIPT`, `yarn SCRIPT`, `yarn run SCRIPT`,
+  `pnpm exec tsc ...`; for a workspace package's check, `pnpm --filter NAME
+  SCRIPT`, `yarn workspace NAME SCRIPT`, `npm run SCRIPT -w NAME`, and its
+  script after a `cd` into the package. In the census of 108 public
+  TypeScript repos, 61 use pnpm or Yarn.
+- `turbo run TASK` and, in pnpm projects, `pnpm -r TASK` (or a root script
+  that is one of them) are skipped only when every workspace package with the
+  task's script has a check and all are CURRENT; otherwise they run as typed,
+  never rewritten. No skip when turbo may run more (other `dependsOn` tasks,
+  `with`, package-scoped keys, a package turbo.json), when pnpm includes the
+  workspace root, or for a root script with pre/post scripts. Filters and nx
+  are not matched.
+- Fixed: when two commands met on fresh state (SessionStart's `start` and the
+  first `status`), the second failed and no observer started.
+
+Pilot eval on alpha.16 code (CI 39799994225, 96 sessions over twilio,
+semiotic, Ultra-Card and SwitchHosts): 0 critical findings; 29 skipped
+typechecks, each confirmed by a plain rerun.
 ## 0.1.0-alpha.15 — 2026-10-22
 
 No change to observation, status or `redue run` since alpha.14; the changes

package/README.md

@@ -37,7 +37,7 @@ it; relevant source edits make it stale. [Run the reproducible demo](docs/contri
 
 ## Install the alpha
 
-The opt-in pilot uses **0.1.0-alpha.15**. Follow the
+The opt-in pilot uses **0.1.0-alpha.17**. Follow the
 [fixed-version pilot guide](docs/user/pilot.md) for supported projects, setup,
 updates and voluntary feedback. No external usage results are claimed yet.
 

package/bin/redue.mjs

@@ -4,7 +4,7 @@ import {mark,traceBase,traceContext,traceEnvironment,traceId} from '../src/decis
 traceBase({...traceContext(),request:traceId(),work:'client'});
 mark('client.loaded');
 import {directCompiler,directQualification,directEnvironment,directInterpretation} from '../src/direct-typescript.mjs';
-import {testEnvironment,testRunnerEntry,testsInterpretation,testsQualification} from '../src/test-direct.mjs';
+import {testEnvironment,testRunnerAt,testsInterpretation,testsQualification} from '../src/test-direct.mjs';
 import os from 'node:os';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
@@ -194,7 +194,7 @@ function which(name){
   if(found)return found;
   error(`cannot resolve executable ${name} on PATH`);
 }
-function token(value){
+function token(value,cwd='.'){
   if(value==='@node')return process.execPath;
   if(value==='@project')return root;
   if(value==='@typescript-compiler:.'){
@@ -202,8 +202,8 @@ function token(value){
   }
   if(value.startsWith('@test-runner:')){
     // Qualification reports a missing runner; status and stop still work.
-    try{return testRunnerEntry(root,value.slice('@test-runner:'.length));}
-    catch{return path.join(root,'node_modules',value.slice('@test-runner:'.length),'<unavailable>');}
+    try{return testRunnerAt(root,cwd,value.slice('@test-runner:'.length)).entry;}
+    catch{return path.join(root,cwd,'node_modules',value.slice('@test-runner:'.length),'<unavailable>');}
   }
   if(value==='@vstate/direct-typescript-probe')return path.join(productRoot,'src','direct-typescript-probe.mjs');
   if(value.startsWith('@typescript-bin:')){
@@ -226,10 +226,10 @@ function token(value){
   if(value.startsWith('@which:'))return which(value.slice(7));
   return value;
 }
-function argv(values,label){
+function argv(values,label,cwd){
   if(!Array.isArray(values)||!values.length||values.some(v=>typeof v!=='string'||!v))
     error(`${label} must be nonempty exact argv`);
-  return values.map(token);
+  return values.map(value=>token(value,cwd));
 }
 const categories=['source','generated','installedDependencies','environment','toolchain','runtime',
   'probeContinuity'];
@@ -260,7 +260,7 @@ const checks=publicConfig.checks.map(check=>{
     JSON.stringify(check.command)!==JSON.stringify(['@node','@typescript-compiler:.','--noEmit'])))
     error(`${check.name}: direct recipe requires its explicit local compiler command`);
   // The script's own arguments follow the runner; qualification compares them with the script.
-  if(testsDirect&&(manager!=='npm'||!check.script||check.cwd&&check.cwd!=='.'||!Array.isArray(check.command)||
+  if(testsDirect&&(!['npm','pnpm','yarn'].includes(manager)||!check.script||check.cwd&&check.cwd!=='.'&&!check.workspace||!Array.isArray(check.command)||
     check.command[0]!=='@node'||!/^@test-runner:(?:vitest|jest)$/.test(check.command[1]||'')))
     error(`${check.name}: test recipe requires its explicit local test runner command`);
   if(npmAutomatic&&(manager!=='npm'||check.cwd&&check.cwd!=='.'))
@@ -297,7 +297,8 @@ const checks=publicConfig.checks.map(check=>{
     {variables:['NODE_OPTIONS','NODE_PATH','CI','HOME','NODE_ENV','BASH_ENV','ENV',...windowsContext],
       prefixes:['PNPM_','COREPACK_','npm_config_','DYLD_','TSGO_'],
       pathExecutables:['node'],executableIdentity:true}:{};
-  return {name:check.name,command:argv(scriptCommand||check.command,`${check.name}.command`),
+  return {name:check.name,command:argv(scriptCommand||check.command,`${check.name}.command`,
+    typeof check.cwd==='string'&&check.cwd&&!path.isAbsolute(check.cwd)&&!check.cwd.split('/').includes('..')?check.cwd:'.'),
     cwd:check.cwd,inputs:check.inputs||[],generatedInputs:check.generatedInputs||[],
     installedInputs:check.installedInputs||(
       npmAutomatic||npmDirect||testsDirect?['node_modules/**']:[]),
@@ -323,7 +324,13 @@ if(maintenance&&!fs.existsSync(runtimeFile)){
   process.exit(0);
 }
 if(!maintenance)fs.mkdirSync(state,{recursive:true,mode:0o700});
-if(!maintenance&&fs.existsSync(runtimeFile)){
+// Two commands can meet on fresh state (SessionStart's start and the first
+// status): whichever creates the runtime file first wins, and the other
+// treats it as existing.
+let created=false;
+if(!maintenance&&!fs.existsSync(runtimeFile))
+  try{fs.writeFileSync(runtimeFile,serialized,{flag:'wx',mode:0o600});created=true;}catch(e){if(e.code!=='EEXIST')throw e;}
+if(!maintenance&&!created){
   const previous=fs.readFileSync(runtimeFile,'utf8');
   if(previous!==serialized){
     const pidFile=path.join(state,'observer.lock','pid');
@@ -333,7 +340,7 @@ if(!maintenance&&fs.existsSync(runtimeFile)){
     }
     fs.writeFileSync(runtimeFile,serialized,{mode:0o600});
   }
-}else if(!maintenance)fs.writeFileSync(runtimeFile,serialized,{flag:'wx',mode:0o600});
+}
 
 if(command==='status'&&!sync){
   const value=readCachedStatus(state,publicConfig.checks);

package/docs/user/agents.md

@@ -69,25 +69,58 @@ Start a fresh agent session in this checkout, then give it your ordinary task.
 Interactive setup shows the changes and asks before applying; noninteractive
 setup requires `--apply`. `--dry-run` never writes. Installing REDUE or running
 `init` does not connect an agent automatically. Setup does not start an observer
-or execute verification. Use `redue start` when you want observation.
+or execute verification. With Claude Code, a SessionStart hook starts the
+observer when a session starts (below); otherwise use `redue start`.
 
 ## Claude Code typecheck hook
 
-`redue agent setup claude --apply` also adds a PreToolUse hook to
-`.claude/settings.local.json`. The hook needs a local REDUE install, so it is
+`redue agent setup claude --apply` also adds a PreToolUse hook and a
+SessionStart hook to `.claude/settings.local.json`. Both run
+`redue agent hook claude`, which needs a local REDUE install, so they are
 per-developer; keep that file out of commits. Other settings in the file are kept,
 but the file is rewritten as 2-space JSON. `.claude/settings.json` is not touched.
-`redue agent remove claude --apply` removes only the entry REDUE added.
+`redue agent remove claude --apply` removes only the entries REDUE added.
 
-The hook skips an exact rerun of a configured typecheck: a check with
-`kind: "typecheck"` or named `typecheck`. It matches these commands, run from the
-project root:
+When a session starts, resumes, clears or compacts, the SessionStart hook starts
+this project's observer if none is running. It launches `redue start` in the
+background and returns at once, and prints nothing, so it adds nothing to the
+agent's context. Until the observer's first index is done, checks are
+UNVERIFIED and run as typed. An observer you stopped with `redue stop` starts
+again with the next session; remove the hook to prevent that. Setups from
+alpha.15 or earlier get the hook by running `redue agent setup claude --apply`
+again.
+
+The hook skips an exact rerun of a configured typecheck (a check with
+`kind: "typecheck"` or named `typecheck`) or direct test check. It matches
+these commands, run from the project root:
 
 - `redue run CHECK`, or `redue --config FILE run CHECK` when the config is not
   `redue.config.json`
-- `npm run SCRIPT`, when the check has an npm script
-- `npx tsc --noEmit`, for the direct-TypeScript recipe
+- the check's script through the project's package manager: `npm run SCRIPT`
+  (and `npm test`), `pnpm SCRIPT`, `pnpm run SCRIPT`, `yarn SCRIPT` or
+  `yarn run SCRIPT`. The short form is left out when the script is named like
+  one of the package manager's own commands.
+- the tool the check runs: `npx tsc ARGS` (and `pnpm exec tsc ARGS` with pnpm)
+  for a direct TypeScript check, or the runner's command, alone or after `npx`,
+  for a direct test check
 - the check's `command`, when it has no `@` tokens
+- for a workspace package's check: `pnpm --filter NAME SCRIPT` (also
+  `--filter=NAME`, `-F NAME`, and with `run`), `yarn workspace NAME SCRIPT`, or
+  `npm run SCRIPT -w NAME` (also `--workspace NAME`, `--workspace=NAME` and
+  `npm -w NAME run SCRIPT`). After `cd` into the package's directory, the
+  package-manager script forms and tool forms match that check.
+
+A `turbo run TASK` (or `turbo TASK`, alone or after `npx` or `pnpm exec`) or,
+in a pnpm project, `pnpm -r TASK` (`--recursive`, with or without `run`) that
+runs a checked task in every workspace package is skipped only when every check
+it would run is CURRENT, PASS and `reuse_eligible`. Every package with the
+task's script must have a check. turbo must define the task, with `dependsOn`
+listing at most `^TASK`, no `with`, no `PACKAGE#TASK` entries and no package
+`turbo.json`; `pnpm -r` must not include the workspace root. A root script
+whose text is such a command counts as that command, unless it has pre- or
+post-scripts. In every other case the command runs as typed: turbo caches its
+own results, so the hook never rewrites it. Filters (`--filter`) and nx are not
+matched.
 
 Each form may end with `2>&1` and then one `| tail -n N`, `| head -n N`,
 `| tail -N` or `| head -N`. It may also be the first command of a `;` or `&&`
@@ -121,8 +154,10 @@ Limits:
 
 - The hook judges its own environment, which Claude Code passes to it. The Bash
   tool can add variables from your shell profile. The hook cannot see those.
-- Commands run from a subdirectory, after another command (`cd x && tsc`), or
-  combined with `||`, `&` or other pipes, are not matched.
+- Commands run from a session that started in a subdirectory, after a `cd`
+  outside the project, or combined with `||`, `&` or other pipes, are not
+  matched. After a `cd` into any other directory than the root or a checked
+  package's, nothing matches.
 - A skip writes nothing. If a typecheck command also emits files, later
   commands see the files from its last run.
 - Only the Bash tool is covered, not PowerShell.

package/docs/user/pilot.md

@@ -1,4 +1,4 @@
-# Opt-in development pilot: alpha.15
+# Opt-in development pilot: alpha.17
 
 Use one fixed build for several ordinary development sessions. The owner will
 invite two or three willing testers and approve their projects; nothing is
@@ -35,7 +35,7 @@ are **NOT RUN**. The recording shortcut is macOS/direct-recipe only.
 For a new default npm installation:
 
 ```sh
-npm install --global @redue/cli@0.1.0-alpha.15
+npm install --global @redue/cli@0.1.0-alpha.17
 redue --version
 cd my-project
 redue --config redue.config.json init --recipe typescript-direct --check typecheck --dry-run
@@ -89,7 +89,7 @@ using it; keep the same npm prefix, config and any explicit state selection.
 
 ```sh
 redue --config redue.config.json stop
-npm install --global @redue/cli@0.1.0-alpha.15
+npm install --global @redue/cli@0.1.0-alpha.17
 redue --config redue.config.json agent setup codex --dry-run
 redue --config redue.config.json agent setup codex --apply
 redue --config redue.config.json start

package/docs/user/supported-projects.md

@@ -45,13 +45,26 @@ project whose test script runs Vitest 4/5 or Jest 29 directly, the opt-in
 In particular, test caches and build-generated inputs are not excluded to
 make evidence green.
 
-Pinned pnpm 12 projects are read from `packageManager`, `pnpm-workspace.yaml`,
-the lockfile, and the installed `node_modules/.modules.yaml` metadata. The
+pnpm 9-12 projects are read from `packageManager`, `pnpm-workspace.yaml`,
+`.npmrc`, the lockfile, and the installed `node_modules/.modules.yaml`
+metadata. The installed metadata names the pnpm version; a `packageManager`
+pin is optional, and when present (with or without Corepack's `+sha512` hash)
+it must name the installed version. Settings that only change what gets
+installed are accepted, because the installed files are what REDUE observes.
+Settings that move or copy installed files, or run code during install, are
+not: custom `modulesDir`, `virtualStoreDir` or `lockfileDir`, the global
+virtual store, injected workspace packages, separate workspace lockfiles,
+pnpmfile hooks and `configDependencies`. They are refused when either
+`pnpm-workspace.yaml` or `.npmrc` sets them. The linker is read from the file
+the installed major reads (`.npmrc` for pnpm 9, `pnpm-workspace.yaml` then
+`.npmrc` for pnpm 10, `pnpm-workspace.yaml` for pnpm 11 and 12) and must match
+the installed one. Only the project's files are read: settings from a user or
+global rc file, or `npm_config_*` variables during install, are not. The
 supported local layouts are pnpm's standard isolated and hoisted
 `node_modules` with a project-local `.pnpm` virtual store. `init` can discover
 root and workspace scripts. For a standalone `tsc --noEmit` or `tsc -p ...`
 script in the narrow TypeScript contract, it records the exact installed
-compiler invocation directly. This avoids pnpm 12's task-run bookkeeping
+compiler invocation directly. This avoids pnpm's task-run bookkeeping
 writes during `pnpm run`; it does not alter the project's script. Test, lint,
 build, and ambiguous TypeScript scripts still execute through `pnpm run` and
 start recording-only. The generated `@typescript-bin:WORKSPACE` token resolves

package/docs/user/tests-direct.md

@@ -2,8 +2,24 @@
 
 `redue init --recipe tests-direct --check test` records a project's unit test
 run and reports later whether that result still applies to the files you have.
-It supports a single-package npm project whose test script runs Vitest 4 or 5,
-or Jest 29, directly. It runs on macOS and Linux with Node 22 or 24.
+It supports a single-package project installed by npm, pnpm 9-12 (isolated or
+hoisted `node_modules`) or Yarn with the `node-modules` linker, whose test
+script runs Vitest 4 or 5, or Jest 29, directly. It runs on macOS and Linux with
+Node 22 or 24. The project has one lockfile kind, matching any
+`packageManager` declaration; Yarn needs that declaration. With pnpm, the
+runner is the package `node_modules/RUNNER` links to, inside the checkout.
+Jest also needs jest-util 29 at `node_modules/jest-util`, which pnpm does not
+place there unless it hoists.
+
+In a workspace (npm or Yarn `workspaces`, or `packages` in
+`pnpm-workspace.yaml`), `init` gives each package whose test script runs
+Vitest directly its own check, `PACKAGE:test`, run in the package's directory
+with the Vitest that Node finds from there. Its inputs are still the whole
+checkout, so an edit in any package makes it STALE. The root's and every
+package's `node_modules` are observed as installed files, without Vite's
+caches in them. Jest is not supported in workspace packages, and neither is a
+test script at the workspace root. A package added later needs `init` again:
+its manifest appearing makes the workspace's checks UNVERIFIED until then.
 
 ## Setup
 
@@ -21,8 +37,8 @@ runner invocation: no `&&`, quotes, globs or variable assignments. Watch mode,
 Jest's `--onlyChanged` are refused. Vitest needs `run`, `--run` or
 `--watch=false`. Other scripts stay recording-only.
 
-REDUE runs the local runner with Node directly. npm, its lifecycle scripts and
-`package.json` are not changed or executed.
+REDUE runs the local runner with Node directly. The package manager, its
+lifecycle scripts and `package.json` are not changed or executed.
 
 ## What REDUE claims
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@redue/cli",
   "private": false,
-  "version": "0.1.0-alpha.15",
+  "version": "0.1.0-alpha.17",
   "publishConfig": {
     "access": "public",
     "tag": "alpha"

package/src/agent-integration.mjs

@@ -11,7 +11,7 @@ import {readProject,projectState,canonicalConfig} from './project-location.mjs';
 import {readCachedStatus} from './cached-state.mjs';
 import {samePath,withinPath} from './path-identity.mjs';
 import {processAlive} from './process-liveness.mjs';
-import {hookCommand,hookForms,redueFor} from './claude-hook.mjs';
+import {fanoutRules,hookCommand,hookForms,redueFor} from './claude-hook.mjs';
 
 const policy=fs.readFileSync(new URL('./agent-policy.md',import.meta.url),'utf8');
 const hosts={codex:{instruction:'AGENTS.md',skill:'.agents/skills/redue-verification/SKILL.md'},
@@ -23,10 +23,16 @@ const settingsPath='.claude/settings.local.json';
 const sameJson=(a,b)=>JSON.stringify(a)===JSON.stringify(b);
 // One handler per exact command form; `if` keeps other Bash calls from starting Node.
 // The hook waits for status up to 10 s; 15 s leaves room for starting Node.
-function hookFor(config,relative){
-  const rules=[...new Set(hookForms(config,relative).flatMap(row=>row.forms))].map(form=>`Bash(${form}*)`);
+// Fan-out commands (turbo, nx, `pnpm -r`) and root scripts that run one get
+// prefix rules; the hook decides from the full command.
+function hookFor(config,relative,scripts){
+  const rules=[...new Set([...hookForms(config,relative).flatMap(row=>[...row.forms,...row.local]),
+    ...fanoutRules(config,scripts)])].map(form=>`Bash(${form}*)`);
   return rules.length?{matcher:'Bash',hooks:rules.map(rule=>({type:'command',if:rule,command:hookCommand,timeout:15}))}:null;
 }
+// The same command on SessionStart starts the observer; it needs no check to match.
+const sessionHook={hooks:[{type:'command',command:hookCommand,timeout:10}]};
+const events=['PreToolUse','SessionStart'];
 // REDUE's entry is recognized by its command, not by a committed record: the
 // local file differs between checkouts, and users may edit the entry.
 const ownedHook=entry=>Array.isArray(entry?.hooks)&&entry.hooks.length>0&&entry.hooks.every(h=>h?.command===hookCommand);
@@ -35,23 +41,28 @@ function parseSettings(text){
   let value;try{value=JSON.parse(text);}catch{throw Error(`${settingsPath} is not valid JSON; fix it before agent setup or removal`);}
   if(!value||typeof value!=='object'||Array.isArray(value)||value.hooks!==undefined&&
     (!value.hooks||typeof value.hooks!=='object'||Array.isArray(value.hooks)||
-      value.hooks.PreToolUse!==undefined&&!Array.isArray(value.hooks.PreToolUse)))
+      events.some(event=>value.hooks[event]!==undefined&&!Array.isArray(value.hooks[event]))))
     throw Error(`${settingsPath} has an unexpected shape; fix it before agent setup or removal`);
   return value;
 }
-// Replace REDUE's entries with `next` (or remove them). Unchanged input returns
-// the same text, so idempotent setup does not rewrite the file.
+// Replace REDUE's entry for each event with next[event] (or remove it; a null
+// `next` removes them all). Unchanged input returns the same text, so
+// idempotent setup does not rewrite the file.
 function settingsWith(text,next){
-  const value=parseSettings(text),old=value.hooks?.PreToolUse||[];
-  const at=old.findIndex(ownedHook),list=old.filter(entry=>!ownedHook(entry));
-  if(next)list.splice(at<0?list.length:at,0,next);
-  if(sameJson(list,old))return text;
-  if(list.length)value.hooks={...value.hooks,PreToolUse:list};
-  else if(value.hooks){delete value.hooks.PreToolUse;if(!Object.keys(value.hooks).length)delete value.hooks;}
+  const value=parseSettings(text);let changed=false;
+  for(const event of events){
+    const old=value.hooks?.[event]||[],at=old.findIndex(ownedHook),list=old.filter(entry=>!ownedHook(entry));
+    if(next?.[event])list.splice(at<0?list.length:at,0,next[event]);
+    if(sameJson(list,old))continue;
+    changed=true;
+    if(list.length)value.hooks={...value.hooks,[event]:list};
+    else if(value.hooks){delete value.hooks[event];if(!Object.keys(value.hooks).length)delete value.hooks;}
+  }
+  if(!changed)return text;
   return Object.keys(value).length?JSON.stringify(value,null,2)+'\n':null;
 }
-function hookInstalled(root){
-  try{return (parseSettings(read(root,settingsPath)).hooks?.PreToolUse||[]).some(ownedHook);}
+function hookInstalled(root,event='PreToolUse'){
+  try{return (parseSettings(read(root,settingsPath)).hooks?.[event]||[]).some(ownedHook);}
   catch{return false;}
 }
 function safeFile(root,relative){
@@ -121,10 +132,10 @@ function earlierBlock(host,rows=[]){
     `If a check's last pass still applies to these exact files, a REDUE hook skips\n`+
     `the run and says so. The skip counts as a pass; don't check it again.\n`);
 }
-// One form per check: the npm script when there is one, since that is what
-// the project's own instructions usually name.
+// One form per check: the package manager's script form when there is one,
+// since that is what the project's own instructions usually name.
 const blockForms=(host,config,relative)=>host!=='claude'?[]:hookForms(config,relative).map(row=>({kind:row.kind,
-  form:row.forms.find(form=>form.startsWith('npm run '))??row.forms.find(form=>!form.startsWith('redue '))??row.forms[0]}));
+  form:row.forms.find(form=>/^(?:npm run|pnpm|yarn) /.test(form))??row.forms.find(form=>!form.startsWith('redue '))??row.forms[0]}));
 const priorBlocks=(host,relative)=>[false,true].map(legacy=>`\n\n<!-- REDUE:${host}:begin -->\n`+
   `Before deciding whether configured verification needs repeating, use REDUE.\n`+
   (legacy?`Read ${hosts[host].skill} for the decision policy, then query ordinary status\n`+
@@ -143,7 +154,7 @@ const priorBlocks=(host,relative)=>[false,true].map(legacy=>`\n\n<!-- REDUE:${ho
 // varies, and only in the safe character set. Earlier owned versions are
 // recognized so setup can replace them; other stored text never is.
 function knownBlock(host,relative,block){
-  const list='((?:`[A-Za-z0-9_./:=,+ -]+`(?: and )?)+)';
+  const list='((?:`[A-Za-z0-9_./:=,+@ -]+`(?: and )?)+)';
   const forms=pattern=>{const named=new RegExp(pattern).exec(block);return named?[...named[1].matchAll(/`([^`]+)`/g)].map(m=>m[1]):[];};
   const rows=[...forms(`^\\n\\n<!-- REDUE:[a-z]+:begin -->\\nTypecheck with ${list}\\.`).map(form=>({kind:'typecheck',form})),
     ...forms(`Run the unit tests with ${list}\\.\\n`).map(form=>({kind:'test',form}))];
@@ -245,7 +256,7 @@ export async function agentCommand(args,{configFile,stateOverride,entry,cwd=proc
       if(value.state_access)console.log(`State access: ${value.state_access.status}${value.state_access.reason?' — '+value.state_access.reason:''}`);
       if(value.compatibility?.reason)console.log(`Observer compatibility: ${value.compatibility.reason}`);
       if(value.applicability?.requires_reassessment)console.log('Applicability: cached evidence needs reassessment; choose synchronization or execution deliberately.');
-      for(const row of value.hosts)console.log(`${row.host}: ${row.version||'host unavailable'}; integration ${row.integrity}; hook ${row.hook}; behavioral validation NOT VERIFIED by doctor${row.reason?' — '+row.reason:''}`);
+      for(const row of value.hosts)console.log(`${row.host}: ${row.version||'host unavailable'}; integration ${row.integrity}; hook ${row.hook}${row.host==='claude'?`; session start ${row.session_start}`:''}; behavioral validation NOT VERIFIED by doctor${row.reason?' — '+row.reason:''}`);
       console.log('Doctor does not start observers, execute checks, or prove agent behavior.');
       for(const warning of value.warnings)console.log(`Review: ${warning}`);
     }return value;
@@ -261,14 +272,16 @@ export async function agentCommand(args,{configFile,stateOverride,entry,cwd=proc
     if(!record&&(before?.includes('<!-- REDUE:')||read(root,h.skill)!==null))
       throw Error('unowned REDUE instruction or skill already exists; inspect it before setup');
     const after=record?before.replace(record.block,block):(before||'')+block;
-    hook=host==='claude'?hookFor(config,relative):null;
+    let scripts={};try{scripts=JSON.parse(read(root,'package.json')??'{}').scripts||{};}catch{}
+    hook=host==='claude'?hookFor(config,relative,scripts):null;
     const next={schema:1,host,config:relative,instruction:h.instruction,skill:h.skill,
       block,skillHash:hash(skill),instructionCreated:record?.instructionCreated??before===null};
     changes.push({path:h.skill,before:read(root,h.skill),after:skill},
       {path:h.instruction,before,after});
-    if(host==='claude'){const settings=read(root,settingsPath);
-      changes.push({path:settingsPath,before:settings,after:settingsWith(settings,hook),
-        content:hook?JSON.stringify(hook,null,2):'remove the REDUE PreToolUse hook (no typecheck or test check to match)'});}
+    if(host==='claude'){const settings=read(root,settingsPath),next={PreToolUse:hook,SessionStart:sessionHook};
+      changes.push({path:settingsPath,before:settings,after:settingsWith(settings,next),
+        content:JSON.stringify(hook?next:{SessionStart:sessionHook},null,2)+
+          (hook?'':'\nno PreToolUse hook: no typecheck or test check to match')});}
     changes.push({path:marker(host),before:read(root,marker(host)),after:JSON.stringify(next,null,2)+'\n'});
   }else if(record){
     const before=read(root,h.instruction),after=before.replace(record.block,'');
@@ -282,7 +295,7 @@ export async function agentCommand(args,{configFile,stateOverride,entry,cwd=proc
   const summary={schema:1,action,host,config:configFile,applied:false,
     changes:actual.map(c=>({path:c.path,operation:c.after===null?'remove':c.before===null?'create':'update',
       ...(action==='setup'?{content:c.path===h.instruction?block:c.content??c.after}: {})})),
-    warnings:notes,hooks:hook?`${settingsPath} PreToolUse`:'none',behavior_verified:false};
+    warnings:notes,hooks:host!=='claude'||action!=='setup'?'none':`${settingsPath} ${hook?'PreToolUse, ':''}SessionStart`,behavior_verified:false};
   if(!json){console.log(`${action} ${host}: ${configFile}`);
     for(const c of summary.changes)console.log(`  ${c.operation} ${c.path}${c.content?'\n'+c.content:''}`);
     if(!actual.length)console.log('Already in the requested state.');
@@ -302,7 +315,7 @@ export async function agentCommand(args,{configFile,stateOverride,entry,cwd=proc
 export async function doctor({configFile,stateOverride,entry,cwd,host}){
   const value={schema:1,command:{path:findExecutable('redue'),invoked:entry},project:{config:configFile},
     observation:null,control:null,state_access:null,observer_process:null,compatibility:null,
-    applicability:null,hosts:[],warnings:[],hooks:`claude only: PreToolUse typecheck hook in ${settingsPath}`,behavior_verified:false};
+    applicability:null,hosts:[],warnings:[],hooks:`claude only: PreToolUse check hook and SessionStart observer start in ${settingsPath}`,behavior_verified:false};
   let p;try{p=project(configFile);value.project.root=p.root;
     const state=stateOverride||projectState(p.root,configFile);value.project.state=state;
     const cached=readCachedStatus(state,p.config.checks);value.observation=cached.observation;
@@ -333,12 +346,14 @@ export async function doctor({configFile,stateOverride,entry,cwd,host}){
     if(executable){const launch=windowsLaunch([executable,'--version']);
       const out=spawnSync(launch.file,launch.args,{...launch.options,encoding:'utf8',timeout:2000,maxBuffer:4096,stdio:['ignore','pipe','pipe']});
       if(out.status===0)version=out.stdout.trim();}
-    let integration={installed:false,integrity:'unknown'},hook=name==='claude'?'absent':'none';
+    let integration={installed:false,integrity:'unknown'},hook=name==='claude'?'absent':'none',sessionHook=hook;
+    const installed=()=>value.command.path?'installed':'installed, but redue is not on PATH, so it never runs';
     if(p)try{const record=saved(p.root,name);integration=inspect(p.root,name,record);
-      if(name==='claude'&&hookInstalled(p.root))hook=value.command.path?'installed':'installed, but redue is not on PATH, so it never runs';
+      if(name==='claude'&&hookInstalled(p.root))hook=installed();
+      if(name==='claude'&&hookInstalled(p.root,'SessionStart'))sessionHook=installed();
       value.warnings.push(...warnings(p.root,name,cwd));
     }catch(e){integration={installed:false,integrity:'conflict',reason:e.message};}
-    value.hosts.push({host:name,executable,version,...integration,hook,behavior_verified:false,
+    value.hosts.push({host:name,executable,version,...integration,hook,session_start:sessionHook,behavior_verified:false,
       loading:name==='codex'?'AGENTS.md at session start; .agents/skills; overrides and size limits apply':
         'CLAUDE.md at session start; .claude/skills; managed/user policies and exclusions apply'});
   }