@redue/cli 0.1.0-alpha.15 → 0.1.0-alpha.17

package/src/claude-hook.mjs

@@ -2,15 +2,18 @@
 // reports CURRENT/PASS with reuse_eligible on the current inputs. When the check is not
 // CURRENT, the command becomes `redue run <check>` so the run is recorded. Every
 // other outcome, including errors and timeouts, allows the command unchanged.
+// The same command handles SessionStart: it starts the project's observer.
 // Never exit 2: Claude Code treats exit 2 as a block.
 import fs from 'node:fs';
 import path from 'node:path';
 import {spawn} from 'node:child_process';
 import {projectState} from './project-location.mjs';
-import {realObservedPath,samePath} from './path-identity.mjs';
+import {realObservedPath} from './path-identity.mjs';
+import {processAlive} from './process-liveness.mjs';
 
 export const hookCommand='redue agent hook claude';
-const safe=/^[A-Za-z0-9_./:=,+-]+$/;
+// No shell metacharacters; `@` starts scoped package names.
+const safe=/^[A-Za-z0-9_./:=,+@-]+$/;
 const typecheck=check=>check?.kind==='typecheck'||check?.name==='typecheck';
 // A direct test check: its command is the runner and the script's arguments.
 const tests=check=>check?.qualification==='npm-tests-direct-v1'&&Array.isArray(check.command)&&
@@ -22,32 +25,155 @@ export const defaultConfig='redue.config.json';
 // would need shell quoting.
 export const redueFor=(configFile=defaultConfig)=>configFile===defaultConfig?'redue':
   safe.test(configFile)?`redue --config ${configFile}`:null;
+
+// Package-manager commands that a script of the same name would not reach.
+const builtins={pnpm:new Set(['add','audit','bin','config','create','dedupe','deploy','dlx','doctor','env','exec','fetch',
+  'i','import','init','install','link','list','ln','ls','outdated','pack','patch','prune','publish','rebuild','recursive',
+  'remove','rm','root','run','self-update','server','setup','store','uninstall','unlink','up','update','why','x']),
+  // Yarn 4 and Yarn 1 together.
+  yarn:new Set(['access','add','audit','autoclean','bin','cache','check','config','constraints','create','dedupe','dir','dlx',
+  'exec','explain','generate-lock-entry','global','help','import','info','init','install','licenses','link','list','login',
+  'logout','node','npm','outdated','owner','pack','patch','plugin','policies','publish','rebuild','remove','run','set',
+  'stage','tag','team','unlink','unplug','up','upgrade','upgrade-interactive','version','versions','why','workspace','workspaces'])};
+// A package script run by the project's package manager, in the package's directory.
+function scriptForms(pm,script){
+  if(typeof script!=='string'||!safe.test(script))return [];
+  if(pm==='npm')return [`npm run ${script}`,...(script==='test'?['npm test']:[])];
+  if(pm==='pnpm'||pm==='yarn')return [...(builtins[pm].has(script)?[]:[`${pm} ${script}`]),`${pm} run ${script}`];
+  return [];
+}
+// A workspace package's script, run from the project root.
+function workspaceForms(pm,name,script){
+  if(typeof name!=='string'||!safe.test(name)||typeof script!=='string'||!safe.test(script))return [];
+  if(pm==='pnpm')return ['--filter ','--filter=','-F '].flatMap(flag=>
+    [...(builtins.pnpm.has(script)?[]:[`pnpm ${flag}${name} ${script}`]),`pnpm ${flag}${name} run ${script}`]);
+  if(pm==='yarn')return [...(builtins.yarn.has(script)?[]:[`yarn workspace ${name} ${script}`]),`yarn workspace ${name} run ${script}`];
+  if(pm==='npm')return [`npm run ${script} -w ${name}`,`npm run ${script} --workspace ${name}`,
+    `npm run ${script} --workspace=${name}`,`npm -w ${name} run ${script}`];
+  return [];
+}
+// The tool a check runs, as typed: `tsc ARGS` or the test runner's command.
+function toolText(check){
+  const command=check.command;
+  if(!Array.isArray(command)||command[0]!=='@node')return null;
+  const words=/^@typescript-(?:compiler|bin):/.test(command[1]||'')?['tsc',...command.slice(2)]:
+    tests(check)?[command[1].slice('@test-runner:'.length),...command.slice(2)]:null;
+  return words?.every(word=>typeof word==='string'&&safe.test(word))?words.join(' '):null;
+}
+// A bare `tsc` is rarely on PATH; a test runner's own text is what the script says.
+const toolForms=(pm,text)=>!text?[]:[...(/^tsc(?: |$)/.test(text)?[]:[text]),`npx ${text}`,...(pm==='pnpm'?[`pnpm exec ${text}`]:[])];
+// A workspace check's package: its `workspace`, or the package its generated
+// `npm run S --workspace W`, `yarn workspace W run S` or `pnpm --filter W run S`
+// command names; null for any other check.
+function workspaceName(check){
+  if(typeof check.workspace==='string')return check.workspace;
+  const command=check.command,flag={'@which:npm':'--workspace','@which:yarn':'workspace','@which:pnpm':'--filter'}[command?.[0]];
+  const at=flag&&Array.isArray(command)?command.indexOf(flag):-1;
+  return at>0&&typeof command[at+1]==='string'?command[at+1]:null;
+}
+// Where a check runs: '.' for a root check, the package directory for a
+// workspace check, or null. A workspace check's directory is its `cwd`, or the
+// one directory its inputs name as `DIR/package.json` or `DIR/**` with
+// `!DIR/node_modules/**`, as init writes them.
+export function checkDir(check){
+  if(!workspaceName(check))return check.cwd===undefined||check.cwd==='.'?'.':null;
+  if(typeof check.cwd==='string'&&check.cwd!=='.')return check.cwd;
+  const inputs=(check.inputs||[]).filter(value=>typeof value==='string');
+  const dirs=new Set(inputs.flatMap(value=>{
+    const manifest=/^([^!*]+)\/package\.json$/.exec(value)?.[1],tree=/^([^!*]+)\/\*\*$/.exec(value)?.[1];
+    return manifest?[manifest]:tree&&inputs.includes(`!${tree}/node_modules/**`)?[tree]:[];
+  }));
+  return dirs.size===1?[...dirs][0]:null;
+}
+// The package script a check runs: its `script`, or the last word of a
+// generated `pnpm --filter NAME run SCRIPT`-style command.
+const checkScript=check=>typeof check.script==='string'?check.script:
+  Array.isArray(check.command)&&/^@which:(?:npm|pnpm|yarn)$/.test(check.command[0])&&check.command.includes('run')?
+    check.command[check.command.indexOf('run')+1]:null;
+
 // Exact commands that rerun each configured typecheck or direct test check.
-// Names that would need shell quoting get no form, so the hook never fires for them.
+// `forms` work from the project root; `local` ones work in the check's own
+// directory `dir`, after a `cd` into it. Names that would need shell quoting
+// get no form, so the hook never fires for them.
 export function hookForms(config,configFile=defaultConfig){
-  const rows=[],redue=redueFor(configFile);
+  const rows=[],redue=redueFor(configFile),pm=config?.packageManager;
   for(const check of config?.checks||[]){
     if(!(typecheck(check)||tests(check))||typeof check.name!=='string'||!safe.test(check.name))continue;
-    const forms=redue?[`${redue} run ${check.name}`]:[];
-    // Other forms run from the project root, so they match only a root check.
-    if(check.cwd!==undefined&&check.cwd!=='.'){if(forms.length)rows.push({check:check.name,forms});continue;}
-    if(config.packageManager==='npm'&&typeof check.script==='string'&&safe.test(check.script))
-      forms.push(`npm run ${check.script}`);
-    if(check.qualification==='npm-typescript-direct-v1')forms.push('npx tsc --noEmit');
-    if(!tests(check)&&Array.isArray(check.command)&&check.command.length&&
-      check.command.every(v=>typeof v==='string'&&safe.test(v)&&!v.startsWith('@')))
-      forms.push(check.command.join(' '));
-    // The script's own text, which runs the same runner with the same arguments.
-    if(tests(check)){
-      if(check.script==='test'&&config.packageManager==='npm')forms.push('npm test');
-      const text=[check.command[1].slice('@test-runner:'.length),...check.command.slice(2)];
-      if(text.every(v=>typeof v==='string'&&safe.test(v)))forms.push(text.join(' '),`npx ${text.join(' ')}`);
+    const forms=redue?[`${redue} run ${check.name}`]:[],local=[],dir=checkDir(check),script=checkScript(check);
+    if(dir==='.'){
+      forms.push(...scriptForms(pm,script),...toolForms(pm,toolText(check)));
+      if(!tests(check)&&Array.isArray(check.command)&&check.command.length&&
+        check.command.every(v=>typeof v==='string'&&safe.test(v)&&!v.startsWith('@')))
+        forms.push(check.command.join(' '));
+    }else if(dir!==null&&safe.test(dir)){
+      forms.push(...workspaceForms(pm,workspaceName(check),script));
+      local.push(...scriptForms(pm,script),...(check.cwd===dir?toolForms(pm,toolText(check)):[]));
     }
-    if(forms.length)rows.push({check:check.name,kind:checkKind(check),forms:[...new Set(forms)]});
+    if(forms.length||local.length)rows.push({check:check.name,kind:checkKind(check),dir,
+      forms:[...new Set(forms)],local:[...new Set(local)]});
   }
   return rows;
 }
 
+// A turbo or `pnpm -r` command that runs one task in every workspace package:
+// {tool, task}. No filters and no nx: both can add packages or tasks that only
+// a fuller model of the tool would see. `pnpm turbo` is left out because a root
+// script named turbo would run instead.
+const turboPrefix='(?:npx |pnpm exec )?',task='([A-Za-z0-9_:.-]+)';
+const fanouts=[['turbo',new RegExp(`^${turboPrefix}turbo(?: run)? ${task}$`)],
+  ['pnpm',new RegExp(`^pnpm (?:-r|--recursive)(?: run)? ${task}$`)]];
+export function fanout(text){
+  for(const [tool,pattern] of fanouts){const match=pattern.exec(text);
+    if(match)return {tool,task:match[1]};}
+  return null;
+}
+// Bash `if` rules for fan-out commands of a task some workspace check runs,
+// and for root scripts that run one; other turbo or nx commands never start the hook.
+export function fanoutRules(config,scripts={}){
+  const tasks=new Set((config?.checks||[]).filter(check=>(typecheck(check)||tests(check))&&typeof check.name==='string'&&
+    ![null,'.'].includes(checkDir(check))).map(checkScript).filter(task=>typeof task==='string'&&/^[A-Za-z0-9_:.-]+$/.test(task)));
+  const rules=[];
+  for(const task of tasks){
+    for(const prefix of ['','npx ','pnpm exec '])rules.push(`${prefix}turbo run ${task}`,`${prefix}turbo ${task}`);
+    if(config.packageManager==='pnpm')rules.push(`pnpm -r ${task}`,`pnpm -r run ${task}`,`pnpm --recursive ${task}`,`pnpm --recursive run ${task}`);
+  }
+  for(const [name,text] of Object.entries(scripts||{})){
+    const fan=typeof text==='string'&&!scripts['pre'+name]&&!scripts['post'+name]?fanout(text.trim()):null;
+    if(fan&&tasks.has(fan.task))rules.push(...scriptForms(config.packageManager,name));
+  }
+  return rules;
+}
+// The checks a fan-out runs: one configured check for every workspace package
+// with the task's script, or null when any package has none, or when the
+// tool may run more: another task first (turbo `dependsOn` other than ^TASK,
+// `with`, package-scoped keys, package turbo.json), a task turbo does not
+// define, or pnpm's workspace root.
+export async function fanoutChecks(fan,config,projectRoot){
+  const {workspacePackages}=await import('./node-onboarding.mjs');
+  const packages=workspacePackages(projectRoot).filter(item=>typeof item.scripts[fan.task]==='string');
+  if(!packages.length)return null;
+  const text=file=>{try{return fs.readFileSync(path.join(projectRoot,file),'utf8');}catch(e){return e.code==='ENOENT'?undefined:null;}};
+  if(fan.tool==='turbo'){
+    let tasks;try{const turbo=JSON.parse(text('turbo.json'));tasks=turbo?.tasks??turbo?.pipeline;}catch{return null;}
+    const own=tasks?.[fan.task];
+    if(!own||typeof own!=='object'||own.with!==undefined||
+      own.dependsOn!==undefined&&!(Array.isArray(own.dependsOn)&&own.dependsOn.every(item=>item===`^${fan.task}`))||
+      Object.keys(tasks).some(key=>key.endsWith(`#${fan.task}`))||
+      packages.some(item=>text(`${item.dir}/turbo.json`)!==undefined||text(`${item.dir}/turbo.jsonc`)!==undefined))return null;
+  }
+  if(fan.tool==='pnpm'&&(config.packageManager!=='pnpm'||
+    ['.npmrc','pnpm-workspace.yaml'].some(file=>{const value=text(file);return value===null||/include-?workspace-?root/i.test(value??'');})))
+    return null;
+  const names=[];
+  for(const item of packages){
+    const check=config.checks.find(c=>(typecheck(c)||tests(c))&&typeof c.name==='string'&&
+      workspaceName(c)===item.name&&checkScript(c)===fan.task&&checkDir(c)===item.dir);
+    if(!check)return null;
+    names.push(check.name);
+  }
+  return names;
+}
+
 // Accept only an optional trailing `2>&1`, then an optional `| tail|head -n N`
 // or `-N`, then optionally `;` or `&&` and the rest of the command. A form has
 // no shell metacharacters, so the first separator after it ends it. Newlines
@@ -59,11 +185,25 @@ function split(command){
   const one=text=>text.replace(/[ \t]+/g,' ');
   return {base:one(base),suffix:one(suffix),rest};
 }
-function matched(command,config,configFile){
-  const parts=split(command),check=parts&&hookForms(config,configFile).find(row=>row.forms.includes(parts.base))?.check;
+// {check, rest}, or {fanout, rest} for a turbo/nx/`pnpm -r` command or a root
+// script that runs one; null when nothing matches. `dir` is where the command
+// runs, relative to the project root.
+function matched(command,config,configFile,dir='.',scripts={}){
+  const parts=split(command);
+  if(!parts)return null;
+  if(dir==='.'){
+    // A root script that runs a fan-out is that fan-out, unless pre/post scripts
+    // run around it: then it matches nothing.
+    for(const [name,text] of Object.entries(scripts||{}))
+      if(typeof text==='string'&&scriptForms(config.packageManager,name).includes(parts.base)&&fanout(text.trim()))
+        return scripts['pre'+name]||scripts['post'+name]?null:{fanout:fanout(text.trim()),rest:parts.rest};
+    if(fanout(parts.base))return {fanout:fanout(parts.base),rest:parts.rest};
+  }
+  const check=hookForms(config,configFile).find(row=>dir==='.'?row.forms.includes(parts.base):
+    row.dir===dir&&row.local.includes(parts.base))?.check;
   return check?{check,rest:parts.rest}:null;
 }
-export function matchCheck(command,config,configFile){return matched(command,config,configFile)?.check||null;}
+export function matchCheck(command,config,configFile,dir,scripts){return matched(command,config,configFile,dir,scripts)?.check||null;}
 // The same check through REDUE, keeping the output suffix; null if it already
 // is, or if more commands follow it.
 export function recordedCommand(command,name,configFile=defaultConfig){
@@ -73,21 +213,30 @@ export function recordedCommand(command,name,configFile=defaultConfig){
   return parts.base===run?null:run+parts.suffix;
 }
 
-// A leading `cd DIR;` or `cd DIR &&` into the project root, which agents
-// often add before a check: {prefix, command} with the rest of the command,
-// the whole command when there is no such prefix, or null when it enters
-// another directory. DIR may be quoted; it may not use variables, a leading
+// A leading `cd DIR;` or `cd DIR &&`, which agents often add before a check:
+// {prefix, command, dir} with the rest of the command and DIR relative to the
+// project root ('.' for the root or no prefix), or null when DIR is outside
+// the project or missing. DIR may be quoted; it may not use variables, a leading
 // `~` or escapes. Inside double quotes a backslash before anything but
 // $ ` " \ is literal, so a quoted Windows path matches; unquoted it is an escape.
 const cdPrefix=/^[ \t]*cd[ \t]+(?:"((?:[^"$`\\]|\\(?![$`"\\\n]))*)"|'([^']*)'|((?!~)[^\s;&|'"$`\\]+))[ \t]*(?:;|&&)[ \t]*/;
-export function rootCd(command,cwd,projectRoot){
+export function enteredDir(command,cwd,projectRoot){
   const prefix=typeof command==='string'?cdPrefix.exec(command):null;
-  if(!prefix)return {prefix:'',command};
-  const dir=prefix[1]??prefix[2]??prefix[3];
-  try{if(!samePath(realObservedPath(path.resolve(cwd,dir)),projectRoot))return null;}catch{return null;}
-  return {prefix:prefix[0],command:command.slice(prefix[0].length)};
+  if(!prefix)return {prefix:'',command,dir:'.'};
+  let relative;
+  try{relative=path.relative(projectRoot,realObservedPath(path.resolve(cwd,prefix[1]??prefix[2]??prefix[3])));}catch{return null;}
+  if(relative.split(path.sep)[0]==='..'||path.isAbsolute(relative))return null;
+  return {prefix:prefix[0],command:command.slice(prefix[0].length),dir:relative?relative.split(path.sep).join('/'):'.'};
 }
 
+// The fan-out's skip message when every check it runs is CURRENT/PASS, else null.
+export function fanoutVerdict(status,names,rest=null){
+  if(!names.length||!names.every(name=>verdict(status,name)))return null;
+  return `REDUE: all ${names.length} checks this command runs (${names.join(', ')}) passed on these exact inputs; `+
+    'rerun skipped. This counts as a pass for the current files; no status check is needed. '+
+    'To run it anyway, prefix the command with REDUE_FORCE=1.'+
+    (rest===null?'':` Nothing else in the command ran either; run the rest on its own: ${rest}`);
+}
 export function verdict(status,name,rest=null){
   const row=status?.schema===1&&status.observation?.healthy===true&&Array.isArray(status.checks)?
     status.checks.find(item=>item?.name===name):null;
@@ -134,20 +283,56 @@ export function lastRunTimeout(config,parsed,name){
   catch{return 2000;}
 }
 
-// Returns the hook's stdout object, or null to allow the command.
-export async function claudeHook(input,{entry,timeout}){
-  if(input?.tool_name!=='Bash')return null;
-  const command=input.tool_input?.command,root=input.cwd;
-  if(typeof command!=='string'||/^\s*REDUE_FORCE=1(?:\s|$)/.test(command))return null;
+// The project set up in the session's directory: its setup record, the config
+// beside it and the project root. null when there is none; throws on bad files.
+function hookProject(root){
   if(typeof root!=='string'||!path.isAbsolute(root))return null;
   const record=JSON.parse(fs.readFileSync(path.join(root,'.redue','agents','claude.json'),'utf8'));
   if(record?.schema!==1||record.host!=='claude'||typeof record.config!=='string'||
     !/^[^/\\]+\.json$/.test(record.config))return null;
   const config=path.join(root,record.config);
   const parsed=JSON.parse(fs.readFileSync(config,'utf8'));
-  const entered=rootCd(command,root,realObservedPath(path.resolve(path.dirname(config),parsed.root||'.')));
-  const match=entered&&matched(entered.command,parsed,record.config);
+  return {record,config,parsed,projectRoot:realObservedPath(path.resolve(path.dirname(config),parsed.root||'.'))};
+}
+
+// SessionStart: start the observer when none is running, so the session's
+// checks can be skipped or recorded without a manual `redue start`. It
+// launches `redue start` detached and returns at once, and prints nothing:
+// SessionStart output becomes agent context. Returns what it did.
+export function sessionStart(input,{entry}){
+  const project=hookProject(input?.cwd);
+  if(!project)return null;
+  try{const pid=Number(fs.readFileSync(path.join(projectState(project.projectRoot,project.config),'observer.lock','pid'),'utf8'));
+    if(Number.isSafeInteger(pid)&&pid>0&&processAlive(pid))return 'running';}catch{}
+  const child=spawn(process.execPath,[entry,'--config',project.config,'start'],
+    {cwd:input.cwd,detached:true,stdio:'ignore',windowsHide:true,env:process.env});
+  child.on('error',()=>{});child.unref();
+  return 'started';
+}
+
+// Returns the hook's stdout object, or null to allow the command.
+export async function claudeHook(input,{entry,timeout}){
+  if(input?.tool_name!=='Bash')return null;
+  const command=input.tool_input?.command,root=input.cwd;
+  if(typeof command!=='string'||/^\s*REDUE_FORCE=1(?:\s|$)/.test(command))return null;
+  const project=hookProject(root);
+  if(!project)return null;
+  const {record,config,parsed}=project;
+  const entered=enteredDir(command,root,project.projectRoot);
+  if(!entered)return null;
+  let scripts={};
+  if(entered.dir==='.')try{scripts=JSON.parse(fs.readFileSync(path.join(project.projectRoot,'package.json'),'utf8')).scripts||{};}catch{}
+  const match=matched(entered.command,parsed,record.config,entered.dir,scripts);
   if(!match)return null;
+  // turbo, nx and `pnpm -r` cache their own results: skip only when every
+  // check the command runs is CURRENT, and otherwise leave it alone.
+  if(match.fanout){
+    const names=await fanoutChecks(match.fanout,parsed,project.projectRoot);
+    if(!names)return null;
+    const status=await synchronizedStatus(entry,config,root,timeout??Math.max(...names.map(name=>lastRunTimeout(config,parsed,name)))),
+      reason=fanoutVerdict(status,names,match.rest);
+    return reason?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'deny',permissionDecisionReason:reason}}:null;
+  }
   const name=match.check,status=await synchronizedStatus(entry,config,root,timeout??lastRunTimeout(config,parsed,name)),
     reason=verdict(status,name,match.rest);
   if(reason)return {hookSpecificOutput:{hookEventName:'PreToolUse',
@@ -157,7 +342,9 @@ export async function claudeHook(input,{entry,timeout}){
   // stays too: the rewrite returns "allow", which would also skip the prompt
   // for the rest of the chain.
   const rewritten=status?.schema===1&&status.observation?.healthy===true&&Array.isArray(status.checks)&&
-    status.checks.some(item=>item?.name===name)?recordedCommand(entered.command,name,record.config):null;
+    status.checks.some(item=>item?.name===name)?recordedCommand(entered.command,name,
+      // Both sides resolved alike: Windows can spell the same directory RUNNER~1 or by its long name.
+      !entered.prefix?record.config:path.relative(path.join(project.projectRoot,entered.dir),realObservedPath(config)).split(path.sep).join('/')):null;
   // updatedInput replaces the whole tool input. Deny and ask rules still apply
   // to the rewritten command; "allow" skips only the prompt.
   return rewritten?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'allow',
@@ -169,7 +356,9 @@ export async function runClaudeHook(entry){
   try{
     let text='';process.stdin.setEncoding('utf8');
     for await(const chunk of process.stdin){text+=chunk;if(text.length>1024*1024)return;}
-    const output=await claudeHook(JSON.parse(text),{entry});
+    const input=JSON.parse(text);
+    if(input?.hook_event_name==='SessionStart'){sessionStart(input,{entry});return;}
+    const output=await claudeHook(input,{entry});
     if(output)await new Promise(resolve=>process.stdout.write(JSON.stringify(output)+'\n',resolve));
   }catch{}
 }

package/src/cli.mjs

@@ -4,7 +4,7 @@ import fs from 'node:fs';
 import {directQualification,directInterpretation,observedNpmContext} from './direct-typescript.mjs';
 import {directRunCertificateAllowed,directRunCertificate,directRunRecordable,directRunRecording,probeQuestions,validateRunRecord} from './direct-run-certificate.mjs';
 import {runFactChange} from './typescript-list.mjs';
-import {changedFiles,coverageReadable,gitIgnored,recordedEnvironment,testProject,testEnvironmentIssue,testGuardConfig,testRunGuard,testsInterpretation,testsQualification} from './test-direct.mjs';
+import {changedFiles,coverageReadable,gitIgnored,recordedEnvironment,testEnvironmentIssue,testGuardConfig,testRunGuard,testRunFacts,sharedInstalledFile,testsInterpretation,testsQualification} from './test-direct.mjs';
 import path from 'node:path';
 import net from 'node:net';
 import os from 'node:os';
@@ -273,14 +273,17 @@ async function execute() {
       ...command.slice(1)]:command;
     // A test run's processes record what the guard checks (test-recorder.cjs).
     const testRun=selected.qualification===testsQualification&&['darwin','linux'].includes(process.platform);
-    let testRecord=null,launchEnv=process.env;
+    let testRecord=null,launchEnv=process.env,testFacts={};
     if(testRun){
+      // The package directory and installed node_modules, as the plan has them.
+      try{testFacts=testRunFacts(root,selected);}
+      catch(e){captureIssues.push(`test run facts unavailable (${e.code||e.message})`);}
       const environmentIssue=testEnvironmentIssue();
       if(environmentIssue)captureIssues.push(environmentIssue);
       testRecord=path.join(state,`test-record-${runId}`);
       fs.mkdirSync(testRecord,{mode:0o700});
       const guardFile=path.join(testRecord,'guard.json');
-      fs.writeFileSync(guardFile,JSON.stringify(testGuardConfig(testRecord,root)),{mode:0o600});
+      fs.writeFileSync(guardFile,JSON.stringify(testGuardConfig(testRecord,root,process.env,testFacts)),{mode:0o600});
       launchEnv=recordedEnvironment(guardFile);
     }
     let runnerPid=null;
@@ -354,10 +357,12 @@ async function execute() {
     }else if(!unobservedDirectRun&&!recording)probeAfter=probeHash(probePlan);
     let guard=null;
     if(testRecord){
-      let coverage=null;try{coverage=coverageReadable(root,testProject(root,selected.script));}catch{}
+      let coverage=null;try{coverage=coverageReadable(root,testFacts);}catch{}
       guard=testRunGuard(testRecord,{root,sourcePatterns:plan.sourcePatterns||plan.patterns,files:snap?.files,
         runner:runnerPid,environment:selected.environment||{},coverage});
       runFacts=guard.runFacts;
+      const shared=sharedInstalledFile(root,testFacts);
+      if(shared)guard.issues.push(`installed file ${shared} has another hard link, likely into a package store; a change through it is not observed`);
       fs.rmSync(testRecord,{recursive:true,force:true});
     }
     // The daemon reads the recording from owned state; control requests are small.

package/src/daemon.mjs

@@ -271,7 +271,7 @@ function probe(row,allowReuse=false,{launch=true}={}) {
         'workspace-typecheck-contract-unavailable':'workspace TypeScript applicability probe could not establish inputs'
         ,'pnpm-execution-environment-unsupported':'pnpm or Node launcher environment override needs review'
         ,'pnpm-distribution-unobservable':'pnpm executable contents cannot be observed'
-        ,'pnpm-version-mismatch':'pnpm executable differs from the pinned version'
+        ,'pnpm-version-mismatch':'pnpm executable differs from the installed version'
         ,'typescript-input-outside-pnpm-contract':'TypeScript reads outside the selected workspace, linked outputs, or installed inputs'
         ,'pnpm-input-coverage-unavailable':'pnpm installed-input coverage became unavailable; inspect check details'
         ,'pnpm-typecheck-contract-unavailable':'pnpm TypeScript input contract could not be established'

package/src/declared-plan.mjs

@@ -6,7 +6,7 @@ import {createHash} from 'node:crypto';
 import {permittedRoots,resolveDeclaredInstalled} from './installed-inputs.mjs';
 import {qualifyTypeScript} from './typescript-qualification.mjs';
 import {directBuildInfo} from './direct-typescript.mjs';
-import {qualifyTests,testsQualification} from './test-direct.mjs';
+import {qualifyTests,testWorkspacePatterns,testsQualification} from './test-direct.mjs';
 import {yarnWorkspaceTypecheckInputs} from './yarn-workspace-inputs.mjs';
 import {pnpmTypecheckInputs} from './pnpm-inputs.mjs';
 import {observedRelative,withinPath,realObservedPath} from './path-identity.mjs';
@@ -92,6 +92,13 @@ export function discoverDeclared(config) {
       ...(workspaceIssue?[workspaceIssue]:[])];
     for(const item of workspace?.configurationInputs||[])configurationInputs.add(item);
     for(const item of workspace?.workspacePatterns||[])workspacePatterns.add(item);
+    // A workspace test check is qualified against the current package list: a
+    // package manifest appearing or pnpm's package list changing re-plans.
+    if(selected.qualification===testsQualification&&selected.workspace)try{
+      for(const item of testWorkspacePatterns(root,JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'))))
+        workspacePatterns.add(item);
+      if(fs.existsSync(path.join(root,'pnpm-workspace.yaml')))configurationInputs.add('pnpm-workspace.yaml');
+    }catch{}
     for(const item of workspace?.closure||[])workspaceManifests.add(item.manifest);
     if(!automatic)for(const category of ['source','generated','installedDependencies',
       'environment','toolchain','runtime'])if(!selected.coverage?.[category])

package/src/index.mjs

@@ -42,24 +42,33 @@ const pathPrefixes = rel => {
 // tick at the same size; such files are tracked in `racy`, and the daemon waits
 // the window out and records them again before it writes a run checkpoint.
 const identity=st=>identityFields.map(key=>String(st[key])).join(':');
+// An installed link to a directory (pnpm links every package this way) is
+// observed by its link chain alone, when `observedDir` says the directory it
+// resolves to is itself observed installed: its own entries carry its contents.
 function fileHash(root, rel,installed=false,before=fs.lstatSync(path.join(root,rel),
-  {bigint:true})) {
+  {bigint:true}),observedDir=null) {
   const file=path.join(root, rel);
   let value,references=[],bytes=installed?0:Number(before.size),racy=0;
   if(before.isSymbolicLink()){
     const resolution=resolveLinks(file,root,[],true);
     if(!resolution.physical)throw Error(`symlink input target observation unavailable: ${rel}: ${resolution.reason}`);
     const target=fs.statSync(resolution.physical,{bigint:true});
-    if(!target.isFile())throw Error(`directory input symlink unsupported: ${rel}`);
-    if(installed)racy=racyUntil(target);else bytes=Number(target.size);
-    value='link:'+JSON.stringify(resolution.links)+':'+(installed?'stat:'+identity(target):
-      target.mode+':'+hashRegular(resolution.physical).hash);
+    const physical=path.relative(root,resolution.physical).split(path.sep).join('/');
+    const directory=target.isDirectory()&&installed&&observedDir?.(physical);
+    if(!target.isFile()&&!directory)throw Error(`directory input symlink unsupported: ${rel}`);
+    if(directory)value='dirlink:'+JSON.stringify(resolution.links)+':'+physical;
+    else{
+      if(installed)racy=racyUntil(target);else bytes=Number(target.size);
+      value='link:'+JSON.stringify(resolution.links)+':'+(installed?'stat:'+identity(target):
+        target.mode+':'+hashRegular(resolution.physical).hash);
+    }
     references=[...new Set([...resolution.links.map(link=>path.relative(root,link.path)
       .split(path.sep).join('/')),path.relative(root,resolution.physical)
       .split(path.sep).join('/')])];
-    const targetAfter=fs.statSync(resolution.physical,{bigint:true});
-    for(const key of identityFields)
-      if(target[key]!==targetAfter[key])throw Error(`input changed during inspection: ${rel}`);
+    // A directory's own timestamps follow its entries, which are observed separately.
+    if(!directory){const targetAfter=fs.statSync(resolution.physical,{bigint:true});
+      for(const key of identityFields)
+        if(target[key]!==targetAfter[key])throw Error(`input changed during inspection: ${rel}`);}
     const resolutionAfter=resolveLinks(file,root,[],true);
     if(resolutionAfter.physical!==resolution.physical||
       JSON.stringify(resolutionAfter.links)!==JSON.stringify(resolution.links))
@@ -181,7 +190,14 @@ export class InputIndex {
     catch(e){if(e.code!=='ENOENT'){this.unavailable=String(e);return false;}}
     if(stat&&(stat.isFile()||stat.isSymbolicLink())) {
       const installed=this.installedPath(rel);
-      try{const started=performance.now();inspection=fileHash(this.root,rel,installed,stat);
+      try{const started=performance.now();
+        // A linked directory counts as observed only strictly inside an
+        // installed root, and only if every check matching the link also
+        // observes the directory's own files (its package.json stands for them).
+        const observedDir=installed?physical=>!this.includeInstalled&&
+          [...this.installedRootSet].some(root=>physical.startsWith(root+'/'))&&
+          matched.every(name=>this.matches(this.checks.get(name),physical+'/package.json')):null;
+        inspection=fileHash(this.root,rel,installed,stat,observedDir);
         fresh=inspection.hash;
         this.profile.hashingMs+=performance.now()-started;
         this.rehashedFiles++;this.rehashedBytes+=inspection.bytes;}
@@ -302,9 +318,10 @@ export class InputIndex {
     const full=path.join(this.root,rel);
     let subtree=false;
     try {
-      if(fs.lstatSync(full).isSymbolicLink()&&fs.statSync(full).isDirectory()){
-        this.unavailable=`directory symlink input unsupported: ${rel}`;return;}
-      if(fs.statSync(full).isDirectory()) {this.scanSubtree(rel);subtree=true;}
+      // A link is an entry of its own: record() accepts an observed installed
+      // directory link and refuses any other.
+      if(fs.lstatSync(full).isSymbolicLink())this.record(rel);
+      else if(fs.statSync(full).isDirectory()) {this.scanSubtree(rel);subtree=true;}
       else this.record(rel);
     } catch(e) {
       if(e.code==='ENOENT') {

package/src/installed-inputs.mjs

@@ -84,6 +84,10 @@ export function resolveDeclaredInstalled(root,patterns,allowed=[]) {
     if(!resolved.physical){
       if(resolved.reason==='resolved target missing'&&!resolved.links.length){
         internal.add(pattern);continue;}
+      // An exclusion of a path that does not exist yet, through links (a runner
+      // cache inside a linked package): exclude it where the links lead.
+      if(negative&&resolved.reason==='resolved target missing'&&resolved.prospective&&within(resolved.prospective,root)){
+        internal.add('!'+posix(path.relative(root,resolved.prospective))+(suffix?'/'+suffix:''));continue;}
       result.unresolved.push(`${prefix}: ${resolved.reason}`);continue;
     }
     const boundary=within(resolved.physical,root)?root:

package/src/node-onboarding.mjs

@@ -3,11 +3,11 @@ import {testProject,testRecipeScript,testCheckInputs,testsQualification} from '.
 import fs from 'node:fs';
 import path from 'node:path';
 import {spawnSync} from 'node:child_process';
-import micromatch from './glob.mjs';
 import {yarnWorkspaceTypecheckInputs} from './yarn-workspace-inputs.mjs';
 import {pnpmInstallInfo,pnpmProjectInfo,pnpmTypecheckInputs} from './pnpm-inputs.mjs';
 import {realObservedPath} from './path-identity.mjs';
 import {findExecutable} from './executable-lookup.mjs';
+import {workspaceManifests} from './workspace-manifests.mjs';
 
 const exists=file=>{try{fs.accessSync(file);return true;}catch{return false;}};
 const readJson=file=>JSON.parse(fs.readFileSync(file,'utf8'));
@@ -147,19 +147,14 @@ function selectScript(kind,names,scripts) {
   return candidates.length===1?{script:candidates[0]}:
     candidates.length>1?{ambiguous:candidates}:{};
 }
-function workspaceManifests(root,patterns) {
-  const listing=spawnSync('git',['ls-files','--cached','--others','--exclude-standard',
-    '-z','--',':(glob)**/package.json'],{cwd:root,encoding:'utf8',timeout:5000,
-    maxBuffer:32*1024*1024,stdio:['ignore','pipe','ignore'],
-    env:{...process.env,GIT_OPTIONAL_LOCKS:'0'}});
-  if(listing.status!==0||listing.error)throw Error('workspace package manifests cannot be inspected');
-  const matched=listing.stdout.split('\0').filter(Boolean).filter(file=>{
-    const dir=path.posix.dirname(file);
-    return dir!=='.'&&!dir.split('/').includes('node_modules')&&
-      micromatch.isMatch(dir,patterns,{dot:true});
-  }).sort();
-  if(matched.length>50)throw Error('more than 50 workspace packages found; select checks explicitly');
-  return matched.map(file=>({file,pkg:readJson(path.join(root,file))}));
+// Workspace packages as init finds them, with their scripts; [] without workspaces.
+export function workspacePackages(root){
+  root=realObservedPath(root);
+  const pkg=readJson(path.join(root,'package.json')),pm=manager(root,pkg);
+  const patterns=pm.name==='pnpm'?pm.workspacePatterns:Array.isArray(pkg.workspaces)?pkg.workspaces:pkg.workspaces?.packages;
+  if(!Array.isArray(patterns)||!patterns.length)return [];
+  return workspaceManifests(root,patterns).map(({file,pkg:member})=>
+    ({name:member.name,dir:path.posix.dirname(file),scripts:member.scripts&&typeof member.scripts==='object'?member.scripts:{}}));
 }
 export function discoverNodeProject(root,{recipe=null}={}) {
   if(recipe&&!['typescript-direct','tests-direct'].includes(recipe))throw Error('unknown recipe; use typescript-direct or tests-direct');
@@ -200,7 +195,8 @@ export function discoverNodeProject(root,{recipe=null}={}) {
     }
     if(recipe==='tests-direct'&&kind==='test'){
       try{
-        if(pm.name!=='npm'||workspaces||observationIssue||pm.issue)throw Error('test recipe requires a supported single-package npm checkout');
+        if(!['npm','pnpm','yarn'].includes(pm.name)||workspaces||observationIssue||pm.issue)
+          throw Error('test recipe requires a supported single-package npm, pnpm or Yarn checkout');
         const chosen=testRecipeScript(scripts);
         if(chosen.ambiguous)throw Error(`several scripts run Vitest or Jest directly (${chosen.ambiguous.join(', ')})`);
         if(!chosen.script)throw Error(chosen.issue||'no script runs Vitest or Jest directly');
@@ -221,7 +217,7 @@ export function discoverNodeProject(root,{recipe=null}={}) {
         check.inputs=['package.json','pnpm-lock.yaml',
           ...(exists(path.join(root,'pnpm-workspace.yaml'))?['pnpm-workspace.yaml']:[]),
           'tsconfig.json','src/**'];
-        classification={level:'ready',reason:'pinned pnpm TypeScript inputs and installation; checked again before reuse',
+        classification={level:'ready',reason:'pnpm TypeScript inputs and installation; checked again before reuse',
           qualification:'pnpm-tsc-v1'};}
       catch(e){classification={level:'recording',reason:`pnpm TypeScript contract needs review: ${e.message}`};}
     }
@@ -275,9 +271,17 @@ export function discoverNodeProject(root,{recipe=null}={}) {
               ...member.scripts[selected.script].trim().split(/\s+/).slice(1)];
             check.inputs=['package.json','pnpm-lock.yaml','pnpm-workspace.yaml',file,
               `${dir}/src/**`];
-            level='ready';reason='pinned pnpm workspace TypeScript inputs; checked again before reuse';
+            level='ready';reason='pnpm workspace TypeScript inputs; checked again before reuse';
           }catch(e){reason=`pnpm TypeScript contract needs review: ${e.message}`;}
         }
+        if(recipe==='tests-direct'&&kind==='test'&&!pm.issue){
+          try{const project=testProject(root,selected.script,dir);
+            Object.assign(check,{workspace:name,script:selected.script,cwd:dir,
+              command:['@node',`@test-runner:${project.runner}`,...project.args],...testCheckInputs(project),
+              qualification:testsQualification});
+            level='ready';reason=`explicit local ${project.runner} ${project.version} run of ${name}'s script ${JSON.stringify(selected.script)}; the whole checkout is its input; the package manager and lifecycle scripts are not executed`;
+          }catch(e){reason=`Test recipe unavailable (${e.code||e.message}); original script retained`;}
+        }
         checks.push({config:check,level,reason});
       }
     }