@redue/cli 0.1.0-alpha.15 → 0.1.0-alpha.17

package/src/pnpm-inputs.mjs

@@ -1,4 +1,4 @@
-// Pinned pnpm 12 node-modules installation provider. The engine sees only
+// pnpm 9-12 node-modules installation provider. The engine sees only
 // repository-relative input sets and resolution relationships, never pnpm
 // virtual-store names as semantic identities.
 import {probeTimeLeft} from './probe-deadline.mjs';
@@ -27,40 +27,81 @@ function safePatterns(values){
     throw Error('pnpm workspace patterns are unsupported');
   return values;
 }
+// The supported pnpm majors. pnpm 9 reads settings from .npmrc, pnpm 10 from
+// pnpm-workspace.yaml first and then .npmrc, pnpm 11 and 12 from
+// pnpm-workspace.yaml only.
+export const pnpmMajors=[9,10,11,12];
+// Settings that move or copy installed files, or run code during install,
+// where the contract does not look; by pnpm-workspace.yaml and .npmrc name.
+// Other settings change only what gets installed, and the installed files are
+// what the contract observes. These are refused when either file sets them,
+// whichever file the installed pnpm reads. Only the project's files are read:
+// user or global rc files and npm_config_* variables at install time are not.
+const refused=[['modulesDir','modules-dir'],['virtualStoreDir','virtual-store-dir'],['lockfileDir','lockfile-dir'],
+  ['enableGlobalVirtualStore','enable-global-virtual-store'],['injectWorkspacePackages','inject-workspace-packages'],
+  ['sharedWorkspaceLockfile','shared-workspace-lockfile'],['pnpmfile','pnpmfile'],['globalPnpmfile','global-pnpmfile'],
+  ['configDependencies','config-dependencies']];
+// .npmrc read as pnpm's ini parser reads it: a BOM is dropped, a bare key is
+// true, quotes are removed, and "true"/"false" become booleans.
+function npmrc(file){
+  const settings={};
+  if(!exists(file))return settings;
+  for(const line of fs.readFileSync(file,'utf8').replace(/^\uFEFF/,'').split(/\r?\n/)){
+    const trimmed=line.trim();if(!trimmed||/^[#;]/.test(trimmed))continue;
+    const at=trimmed.indexOf('='),key=(at<0?trimmed:trimmed.slice(0,at)).trim();
+    let value=at<0?true:trimmed.slice(at+1).trim();
+    if(typeof value==='string'&&/^(["']).*\1$/.test(value))value=value.slice(1,-1);
+    settings[key]=value==='true'?true:value==='false'?false:value;
+  }
+  return settings;
+}
+// Whether a refused setting is set: present at all, except that only
+// sharedWorkspaceLockfile=false and injectWorkspacePackages=true move files.
+const setting=(key,value)=>value!==undefined&&
+  (key==='sharedWorkspaceLockfile'?value===false:key==='injectWorkspacePackages'?value===true:true);
 export function pnpmProjectInfo(root){
   root=realObservedPath(root);
   const pkg=read(path.join(root,'package.json'));
-  const pin=/^pnpm@(12\.\d+\.\d+)(?:\+[^\s]+)?$/.exec(pkg.packageManager||'');
-  if(!pin)throw Error('an exact pnpm 12 packageManager pin is required');
+  // A pin is optional; when present it names pnpm 9-12, and the install must match it.
+  const pin=pkg.packageManager===undefined?null:/^pnpm@((\d+)\.\d+\.\d+)(?:\+[^\s]+)?$/.exec(pkg.packageManager);
+  if(pkg.packageManager!==undefined&&(!pin||!pnpmMajors.includes(Number(pin[2]))))
+    throw Error(`packageManager ${JSON.stringify(String(pkg.packageManager).split('+')[0])} is outside pnpm ${pnpmMajors[0]}-${pnpmMajors.at(-1)}`);
   const workspaceFile=path.join(root,'pnpm-workspace.yaml');
-  const settings=exists(workspaceFile)?yaml(workspaceFile):{};
-  const patterns=safePatterns(settings.packages||[]);
-  const linker=settings.nodeLinker||'isolated';
-  return {version:pin[1],linker,patterns,settings};
+  const workspace=exists(workspaceFile)?yaml(workspaceFile):{},rc=npmrc(path.join(root,'.npmrc'));
+  const patterns=safePatterns(workspace.packages||[]);
+  // The linker the given pnpm major reads; without a major, the one any reads.
+  const linkerFor=major=>(major===9?rc['node-linker']:major>=11?workspace.nodeLinker:
+    workspace.nodeLinker??rc['node-linker'])||'isolated';
+  const major=pin?Number(pin[2]):null;
+  return {version:pin?.[1]??null,linker:linkerFor(major),linkerFor,patterns,settings:workspace,
+    refused:refused.filter(([key,name])=>setting(key,workspace[key])||setting(key,rc[name])).map(([key])=>key)};
 }
 export function pnpmInstallInfo(root){
   const started=performance.now();
   root=realObservedPath(root);
-  const pkg=read(path.join(root,'package.json'));
-  const {version,linker,patterns,settings}=pnpmProjectInfo(root);
+  const {version,linkerFor,patterns,settings,refused}=pnpmProjectInfo(root);
   const workspaceFile=path.join(root,'pnpm-workspace.yaml');
-  if(!['isolated','hoisted'].includes(linker))throw Error(`pnpm ${linker} linker is recording-only`);
-  if(settings.modulesDir||settings.virtualStoreDir||settings.enableGlobalVirtualStore)
-    throw Error('custom pnpm modules or virtual-store location is recording-only');
-  if(settings.injectWorkspacePackages)
-    throw Error('injected workspace dependencies are recording-only');
-  if(settings.sharedWorkspaceLockfile===false)
-    throw Error('separate workspace lockfiles are recording-only');
-  if(exists(path.join(root,'.pnpmfile.cjs'))||exists(path.join(root,'.pnpmfile.mjs')))
+  if(refused.some(key=>['pnpmfile','globalPnpmfile','configDependencies'].includes(key))||
+    exists(path.join(root,'.pnpmfile.cjs'))||exists(path.join(root,'.pnpmfile.mjs')))
     throw Error('custom pnpm installation hooks need review');
+  if(refused.some(key=>['modulesDir','virtualStoreDir','lockfileDir','enableGlobalVirtualStore'].includes(key)))
+    throw Error('custom pnpm modules or virtual-store location is recording-only');
+  if(refused.includes('injectWorkspacePackages'))throw Error('injected workspace dependencies are recording-only');
+  if(refused.includes('sharedWorkspaceLockfile'))throw Error('separate workspace lockfiles are recording-only');
   const modulesFile=path.join(root,'node_modules','.modules.yaml');
   if(!exists(modulesFile))throw Error('installed pnpm module metadata is missing');
   const modules=yaml(modulesFile);
-  if(modules.nodeLinker!==linker||modules.packageManager!==pkg.packageManager)
+  const installed=/^pnpm@((\d+)\.\d+\.\d+)$/.exec(String(modules.packageManager));
+  if(!installed||!pnpmMajors.includes(Number(installed[2])))
+    throw Error(`installed by ${JSON.stringify(String(modules.packageManager))}, outside pnpm ${pnpmMajors[0]}-${pnpmMajors.at(-1)}`);
+  const linker=linkerFor(Number(installed[2]));
+  if(!['isolated','hoisted'].includes(linker))throw Error(`pnpm ${linker} linker is recording-only`);
+  if(modules.nodeLinker!==linker||version!==null&&installed[1]!==version)
     throw Error('installed pnpm linker or version differs from project configuration');
   const virtualStore=path.join(root,'node_modules','.pnpm');
-  // pnpm 12 on Windows can omit virtualStoreDir when using its project-local
-  // default. Accept only the observed, ordinary local directory in that case.
+  // pnpm can omit virtualStoreDir when using its project-local default
+  // (seen with pnpm 12 on Windows). Accept only the observed, ordinary local
+  // directory in that case.
   const declared=modules.virtualStoreDir;
   const selected=declared===undefined?virtualStore:
     path.resolve(path.dirname(modulesFile),declared);
@@ -72,18 +113,8 @@ export function pnpmInstallInfo(root){
     throw Error('nonstandard or incomplete project-local pnpm virtual store');
   if(!exists(path.join(root,'pnpm-lock.yaml')))
     throw Error('pnpm lockfile is missing');
-  if(exists(path.join(root,'.npmrc'))){
-    // pnpm 12 reads project settings from pnpm-workspace.yaml. Registry/auth
-    // entries affect acquisition, not a completed local TypeScript invocation.
-    for(const line of fs.readFileSync(path.join(root,'.npmrc'),'utf8').split(/\r?\n/)){
-      const trimmed=line.trim();if(!trimmed||/^[#;]/.test(trimmed))continue;
-      const key=trimmed.split('=')[0].trim();
-      if(key!=='registry'&&!/^\/\/[^\s]+\/:_authToken$/.test(key))
-        throw Error('project .npmrc has execution-relevant pnpm settings requiring review');
-    }
-  }
   timing('pnpm.install_metadata',started);
-  return {version,linker,patterns,settings,modulesFile,
+  return {version:installed[1],linker,patterns,settings,modulesFile,
     configurationInputs:['package.json','pnpm-lock.yaml',
       ...(exists(workspaceFile)?['pnpm-workspace.yaml']:[]),
       ...(exists(path.join(root,'.npmrc'))?['.npmrc']:[]),

package/src/test-direct.mjs

@@ -13,6 +13,8 @@ import {spawnSync} from 'node:child_process';
 import micromatch from './glob.mjs';
 import {runFact} from './direct-run-certificate.mjs';
 import {queryAnswer} from './typescript-list.mjs';
+import {pnpmInstallInfo,pnpmProjectInfo} from './pnpm-inputs.mjs';
+import {workspaceManifests} from './workspace-manifests.mjs';
 
 const digest=value=>createHash('sha256').update(value).digest('hex');
 export const testRecorder=fileURLToPath(new URL('test-recorder.cjs',import.meta.url));
@@ -39,10 +41,10 @@ const issueLimit=20,factLimit=10000;
 
 // The guard file the recorder reads: where to write, what counts as the
 // checkout and as temporary space, and digests of the caller's environment.
-export function testGuardConfig(dir,root,env=process.env) {
+export function testGuardConfig(dir,root,env=process.env,project={}) {
   const tmp=[...new Set([path.resolve(os.tmpdir()),fs.realpathSync(os.tmpdir())])];
   const real=dir=>{try{return fs.realpathSync(dir);}catch{return dir;}};
-  return {schema:1,dir,root,tmp,runnerData:[...new Set(runnerDataDirectories(env).flatMap(dir=>[path.resolve(dir),real(dir)]))],
+  return {schema:1,dir,root,tmp,installed:modulesDirs(project).map(at=>path.join(root,at)),runnerData:[...new Set(runnerDataDirectories(env).flatMap(dir=>[path.resolve(dir),real(dir)]))],
     env:Object.fromEntries(Object.entries(env).filter(([,value])=>typeof value==='string').map(([key,value])=>[key,digest(value)]))};
 }
 
@@ -262,48 +264,150 @@ export function testRecipeScript(scripts){
   return near?{issue:issue(near)}:{};
 }
 const majorOf=version=>Number(String(version).split('.')[0]);
-// The runner's executable inside the checkout's node_modules.
+// The runner's executable inside the checkout's node_modules. pnpm links
+// node_modules/RUNNER into node_modules/.pnpm; the files stay in node_modules.
 export function testRunnerEntry(root,runner){
   if(!runners[runner])fail('test-runner-unsupported');
   const dir=path.join(root,'node_modules',runner);
   let pkg,real;
   try{real=fs.realpathSync(dir);pkg=JSON.parse(fs.readFileSync(path.join(real,'package.json'),'utf8'));}
   catch{fail('test-runner-missing');}
-  if(real!==dir||pkg.name!==runner)fail('test-runner-layout-unsupported');
+  const modules=fs.realpathSync(path.join(root,'node_modules'));
+  if(!real.startsWith(modules+path.sep)||pkg.name!==runner)fail('test-runner-layout-unsupported');
   const bin=typeof pkg.bin==='string'?pkg.bin:pkg.bin?.[runner];
   const entry=typeof bin==='string'?path.resolve(real,bin):null;
   if(!entry||!entry.startsWith(real+path.sep)||!fs.existsSync(entry))fail('test-runner-layout-unsupported');
   return entry;
 }
-// The project facts the recipe needs, or an error code.
-export function testProject(root,script){
+// The package manager of a checkout whose install the recipe observes in
+// node_modules: npm, pnpm 9-12 (isolated or hoisted), or Yarn with the
+// node-modules linker. One lockfile kind, agreeing with any declaration.
+// Workspaces are refused unless `workspaces` is set.
+export function testPackageManager(root,pkg,{workspaces=false}={}){
+  const has=file=>fs.existsSync(path.join(root,file));
+  const kinds=new Set([has('package-lock.json')||has('npm-shrinkwrap.json')?'npm':null,has('pnpm-lock.yaml')?'pnpm':null,
+    has('yarn.lock')?'yarn':null,has('bun.lock')||has('bun.lockb')?'bun':null].filter(Boolean));
+  const declared=/^(npm|pnpm|yarn|bun)@/.exec(pkg.packageManager||'')?.[1];
+  if(pkg.packageManager!==undefined&&!declared)fail('test-package-manager-unsupported');
+  if(declared)kinds.add(declared);
+  const name=kinds.size===1?[...kinds][0]:null;
+  if(!name||!has({npm:'package-lock.json',pnpm:'pnpm-lock.yaml',yarn:'yarn.lock',bun:'bun.lock'}[name])&&
+    !(name==='npm'&&has('npm-shrinkwrap.json')))fail('test-package-manager-unsupported');
+  if(pkg.workspaces&&!workspaces)fail('test-workspace-unsupported');
+  if(name==='pnpm'){
+    // pnpm 10+ keeps settings in pnpm-workspace.yaml; only `packages` makes a workspace.
+    let install;try{install=pnpmInstallInfo(root);}catch{fail('test-pnpm-install-unsupported');}
+    if(install.patterns.length&&!workspaces)fail('test-workspace-unsupported');
+  }
+  if(name==='yarn'){
+    // Yarn 2+ needs top-level `nodeLinker: node-modules` and the classic nmMode
+    // (no hard links); Yarn 1 always installs node_modules.
+    const rc=has('.yarnrc.yml')?fs.readFileSync(path.join(root,'.yarnrc.yml'),'utf8'):null;
+    const top=key=>rc?new RegExp(`^${key}\\s*:\\s*['"]?([\\w-]+)`,'m').exec(rc)?.[1]:undefined;
+    const version=/^yarn@(\d+)\./.exec(pkg.packageManager||'')?.[1];
+    if(!version||(version==='1'?rc!==null:top('nodeLinker')!=='node-modules'||![undefined,'classic'].includes(top('nmMode'))))
+      fail('test-yarn-install-unsupported');
+  }
+  if(name==='bun')fail('test-package-manager-unsupported');
+  return name;
+}
+// What a recorded run needs, from the check itself rather than the checkout:
+// the package directory, the workspace node_modules its installed inputs
+// list, and the runner and arguments of the package's script. A package
+// added since init is then not treated as installed, so reads there are
+// unobserved and make the run UNVERIFIED.
+export function testRunFacts(root,check){
+  const dir=check.cwd&&check.cwd!=='.'?check.cwd:'.';
+  const dirs=(check.installedInputs||[]).map(p=>/^([^!*]+)\/node_modules\/\*\*$/.exec(p)?.[1]).filter(Boolean);
+  const own=JSON.parse(fs.readFileSync(path.join(root,dir,'package.json'),'utf8'));
+  if(typeof own.scripts?.[check.script]!=='string')fail('test-script-changed');
+  return {...testScript(own.scripts[check.script]),dir,dirs};
+}
+// The checkout's workspace patterns: pnpm's `packages`, else package.json's.
+export function testWorkspacePatterns(root,pkg){
+  return fs.existsSync(path.join(root,'pnpm-lock.yaml'))?pnpmProjectInfo(root).patterns:
+    Array.isArray(pkg.workspaces)?pkg.workspaces:pkg.workspaces?.packages??[];
+}
+// The checkout's workspace package directories, [] for a single package.
+export function testWorkspaceDirs(root,pkg){
+  const patterns=testWorkspacePatterns(root,pkg);
+  return patterns.length?workspaceManifests(root,patterns).map(({file})=>path.posix.dirname(file)):[];
+}
+// Each node_modules the recipe observes as installed: the root's and every
+// workspace package's, relative to the root.
+const modulesDirs=({dirs=[]})=>['node_modules',...dirs.map(dir=>`${dir}/node_modules`)];
+// The first installed file with more than one link, or null. A package store
+// outside the checkout (pnpm's default on Linux, Yarn's hardlinks modes) can
+// change such a file with no event here. Checked at every recorded run: a later
+// install that adds links replaces the files, which is a change REDUE sees.
+export function sharedInstalledFile(root,project={}){
+  const stack=modulesDirs(project).map(dir=>path.join(root,dir));
+  while(stack.length){
+    const dir=stack.pop();let entries;
+    try{entries=fs.readdirSync(dir,{withFileTypes:true});}catch{continue;}
+    for(const entry of entries){
+      const file=path.join(dir,entry.name);
+      if(entry.isDirectory())stack.push(file);
+      else if(entry.isFile())try{if(fs.lstatSync(file).nlink>1)return path.relative(root,file).split(path.sep).join('/');}catch{}
+    }
+  }
+  return null;
+}
+// The runner a package's script reaches: Node's lookup from the package
+// directory up to the root, skipping candidates that are not the runner. Its
+// files must be in an observed node_modules (`dirs`: workspace packages).
+// `logical` is where the lookup found it, before links, relative to the root.
+export function testRunnerAt(root,dir,runner,dirs=[]){
+  if(dir==='.')return {entry:testRunnerEntry(root,runner),logical:`node_modules/${runner}`};
+  if(!runners[runner])fail('test-runner-unsupported');
+  const rootReal=fs.realpathSync(root),observed=modulesDirs({dirs}).map(at=>path.join(rootReal,at)+path.sep);
+  for(let at=dir;;at=path.posix.dirname(at)){
+    const logical=at==='.'?`node_modules/${runner}`:`${at}/node_modules/${runner}`;
+    let real,pkg;
+    try{real=fs.realpathSync(path.join(root,logical));pkg=JSON.parse(fs.readFileSync(path.join(real,'package.json'),'utf8'));}catch{}
+    if(pkg?.name===runner){
+      if(!observed.some(prefix=>real.startsWith(prefix)))fail('test-runner-layout-unsupported');
+      const bin=typeof pkg.bin==='string'?pkg.bin:pkg.bin?.[runner];
+      const entry=typeof bin==='string'?path.resolve(real,bin):null;
+      if(!entry||!entry.startsWith(real+path.sep)||!fs.existsSync(entry))fail('test-runner-layout-unsupported');
+      return {entry,logical};
+    }
+    if(at==='.')fail('test-runner-missing');
+  }
+}
+// The project facts the recipe needs, or an error code. `dir` is a workspace
+// package's directory; there the recipe supports Vitest only.
+export function testProject(root,script,dir='.'){
   const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));
-  if(pkg.workspaces||pkg.packageManager&&!/^npm@/.test(pkg.packageManager)||
-    !['package-lock.json','npm-shrinkwrap.json'].some(file=>fs.existsSync(path.join(root,file)))||
-    ['yarn.lock','pnpm-lock.yaml','bun.lock','bun.lockb'].some(file=>fs.existsSync(path.join(root,file))))
-    fail('test-npm-project-unsupported');
-  if(typeof pkg.scripts?.[script]!=='string'||pkg.scripts['pre'+script]||pkg.scripts['post'+script])fail('test-script-changed');
-  const {runner,args}=testScript(pkg.scripts[script]);
-  const entry=testRunnerEntry(root,runner);
-  const version=JSON.parse(fs.readFileSync(path.join(root,'node_modules',runner,'package.json'),'utf8')).version;
+  testPackageManager(root,pkg,{workspaces:dir!=='.'});
+  const dirs=dir==='.'?[]:testWorkspaceDirs(root,pkg);
+  if(dir!=='.'&&!dirs.includes(dir))fail('test-workspace-unsupported');
+  const own=dir==='.'?pkg:JSON.parse(fs.readFileSync(path.join(root,dir,'package.json'),'utf8'));
+  if(typeof own.scripts?.[script]!=='string'||own.scripts['pre'+script]||own.scripts['post'+script])fail('test-script-changed');
+  const {runner,args}=testScript(own.scripts[script]);
+  if(dir!=='.'&&runner!=='vitest')fail('test-runner-unsupported');
+  const {entry,logical}=testRunnerAt(root,dir,runner,dirs);
+  const version=JSON.parse(fs.readFileSync(path.join(root,logical,'package.json'),'utf8')).version;
   if(!runners[runner].majors.includes(majorOf(version)))fail('test-runner-version-unsupported');
   if(runner==='jest'){
     let util=null;try{util=JSON.parse(fs.readFileSync(path.join(root,'node_modules/jest-util/package.json'),'utf8')).version;}catch{}
     if(majorOf(util)!==29||!fs.existsSync(path.join(root,'node_modules/jest-util/build/createProcessObject.js')))
       fail('test-runner-layout-unsupported');
   }
-  return {runner,version,args,entry};
+  return {runner,version,args,entry,dir,dirs,logical};
 }
 // Inputs: the whole checkout except documentation and the coverage report a
 // --coverage run writes. Git-ignored files the run creates are handled per
-// run (cli.mjs). Installed files are observed by identity; Vite's
-// caches inside node_modules are written by every Vitest run.
-export function testCheckInputs({runner,args}){
-  return {inputs:['**','!node_modules/**','!.git/**','!**/*.md','!**/*.mdx',
-    ...(args.includes('--coverage')?['!coverage/**']:[])],
+// run (cli.mjs). Installed files, in the root's node_modules and every
+// workspace package's, are observed by identity; Vite's caches inside them
+// are written by every Vitest run.
+export function testCheckInputs({runner,args,dir='.',dirs=[],logical=`node_modules/${runner}`}){
+  const modules=modulesDirs({dirs});
+  return {inputs:['**',...modules.map(at=>`!${at}/**`),'!.git/**','!**/*.md','!**/*.mdx',
+    ...(args.includes('--coverage')?[`!${dir==='.'?'':dir+'/'}coverage/**`]:[])],
   // Vitest's typecheck mode keeps tsc's build info in its own dist directory.
-  installedInputs:['node_modules/**',...(runner==='vitest'?['!node_modules/.vite/**','!node_modules/.vite-temp/**','!node_modules/.vitest/**',
-    '!node_modules/vitest/dist/tsconfig.tmp.tsbuildinfo']:[])]};
+  installedInputs:modules.flatMap(at=>[`${at}/**`,...(runner==='vitest'?[`!${at}/.vite/**`,`!${at}/.vite-temp/**`,`!${at}/.vitest/**`]:[])])
+    .concat(runner==='vitest'?[`!${logical}/dist/tsconfig.tmp.tsbuildinfo`]:[])};
 }
 // The coverage directory a --coverage run may read back: Jest reads every
 // .js file under its roots, an earlier report's included, to map dependencies,
@@ -311,21 +415,26 @@ export function testCheckInputs({runner,args}){
 // when no configuration names thresholds (which make the report decide the
 // result) or another report directory. Configuration can be code, so this
 // reads its text.
-export function coverageReadable(root,{runner,args}){
+export function coverageReadable(checkout,{runner,args,dir='.'}){
   if(!args.includes('--coverage'))return null;
+  // A workspace package's configuration and report live in its directory.
+  const root=path.join(checkout,dir);
   const names=runner==='jest'?['jest.config.js','jest.config.ts','jest.config.mjs','jest.config.cjs','jest.config.json']:
     ['vitest.config.ts','vitest.config.mts','vitest.config.cts','vitest.config.js','vitest.config.mjs','vitest.config.cjs',
       'vite.config.ts','vite.config.mts','vite.config.cts','vite.config.js','vite.config.mjs','vite.config.cjs',
       'vitest.workspace.ts','vitest.workspace.js','vitest.workspace.json'];
   const at=args.findIndex(arg=>arg==='--config'||arg==='-c'),inline=args.find(arg=>/^(?:--config|-c)=/.test(arg));
   const given=at>=0?args[at+1]:inline?.split(/=(.*)/s)[1];
-  const texts=[];
-  for(const name of [...names,...(given?[given]:[])]){
-    try{texts.push(fs.readFileSync(path.resolve(root,name),'utf8'));}catch{}
+  // Vitest finds its configuration in the package directory or a parent.
+  const texts=[],folders=[];
+  for(let at=dir;;at=path.posix.dirname(at)){folders.push(path.join(checkout,at));if(at==='.')break;}
+  for(const name of [...names,...(given?[given]:[])])for(const folder of folders){
+    try{texts.push(fs.readFileSync(path.resolve(folder,name),'utf8'));}catch{}
   }
   try{const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));
     if(runner==='jest'&&pkg.jest)texts.push(JSON.stringify(pkg.jest));}catch{return null;}
-  return texts.some(text=>/coverageThreshold|thresholds|coverageDirectory|reportsDirectory/.test(text))?null:'coverage';
+  return texts.some(text=>/coverageThreshold|thresholds|coverageDirectory|reportsDirectory/.test(text))?null:
+    dir==='.'?'coverage':`${dir}/coverage`;
 }
 // The caller's environment, when it would load code before the recorder or
 // the Node version is not one the recipe supports. Compared variables are
@@ -345,13 +454,17 @@ export function qualifyTests(root,selected){
   const issues=[];
   if(!['darwin','linux'].includes(process.platform))issues.push('the test recipe records runs on macOS and Linux only');
   try{
-    const project=testProject(root,selected.script);
-    if(JSON.stringify(selected.command)!==JSON.stringify([process.execPath,project.entry,...project.args])||
-      selected.cwd&&selected.cwd!=='.')issues.push('test runner invocation changed; run redue init again');
+    const dir=selected.cwd&&selected.cwd!=='.'?selected.cwd:'.';
+    if(dir!=='.'&&!selected.workspace)throw Object.assign(Error(),{code:'a test check in a directory needs its workspace'});
+    const project=testProject(root,selected.script,dir);
+    if(JSON.stringify(selected.command)!==JSON.stringify([process.execPath,project.entry,...project.args]))
+      issues.push('test runner invocation changed; run redue init again');
     // Every checkout file but installed ones is a content input; the recorder
     // skips node_modules because it is observed as installed files.
-    const positives=(selected.inputs||[]).filter(p=>!p.startsWith('!'));
-    if(positives.length!==1||positives[0]!=='**'||!selected.inputs.includes('!node_modules/**')||
+    if(dir!=='.'&&JSON.parse(fs.readFileSync(path.join(root,dir,'package.json'),'utf8')).name!==selected.workspace)
+      issues.push('the test check names another workspace package than its directory holds; run redue init again');
+    const expected=testCheckInputs(project),sorted=list=>JSON.stringify([...(list||[])].sort());
+    if(sorted(selected.inputs)!==sorted(expected.inputs)||
       JSON.stringify([...(selected.installedInputs||[])].sort())!==JSON.stringify([...testCheckInputs(project).installedInputs].sort()))
       issues.push('test inputs must be the whole checkout, with node_modules observed as installed files; run redue init again');
   }catch(e){issues.push(e.code||'test runner prerequisites unavailable');}

package/src/test-recorder.cjs

@@ -24,7 +24,8 @@ function install(){
     for(let at=0;at<line.length;)at+=original.writeSync(fd,line,at,line.length-at);}catch{}};
   const failed=reason=>emit(['U',reason]);
   emit(['H',{pid:process.pid,ppid:process.ppid,threadId}]);
-  const sep=path.sep,root=config.root,installed=path.join(root,'node_modules'),
+  // Every node_modules observed as installed: the root's and each workspace package's.
+  const sep=path.sep,root=config.root,installed=Array.isArray(config.installed)?config.installed:[path.join(root,'node_modules')],
     tmp=config.tmp;
   const within=(file,dir)=>file===dir||file.startsWith(dir+sep);
   const digest=value=>createHash('sha256').update(value).digest('hex');
@@ -85,7 +86,7 @@ function install(){
       if(full===undefined)return;
       if(full===null){if(!['produce','touch','mkdir'].includes(role))failed(`${role} of an unsupported path argument`);return;}
       // Installed files are observed by identity.
-      if(within(full,installed))return;
+      if(installed.some(dir=>within(full,dir)))return;
       if(role==='produce'){if(!error)produced.add(full);if(!error&&within(full,root))once(['P',rel(full)]);return;}
       // A directory the run created held nothing before it, so everything in
       // it is the run's output, whichever process reads it.

package/src/workspace-manifests.mjs

@@ -0,0 +1,23 @@
+// Workspace package manifests: package.json files Git tracks or would add,
+// in directories that match the workspace patterns, outside node_modules.
+import fs from 'node:fs';
+import path from 'node:path';
+import {spawnSync} from 'node:child_process';
+import micromatch from './glob.mjs';
+
+export function workspaceManifests(root,patterns) {
+  const listing=spawnSync('git',['ls-files','--cached','--others','--exclude-standard',
+    '-z','--',':(glob)**/package.json'],{cwd:root,encoding:'utf8',timeout:5000,
+    maxBuffer:32*1024*1024,stdio:['ignore','pipe','ignore'],
+    env:{...process.env,GIT_OPTIONAL_LOCKS:'0'}});
+  if(listing.status!==0||listing.error)throw Error('workspace package manifests cannot be inspected');
+  // `!pattern` entries exclude, as in pnpm-workspace.yaml.
+  const positive=patterns.filter(p=>!p.startsWith('!')),negative=patterns.filter(p=>p.startsWith('!')).map(p=>p.slice(1));
+  const matched=listing.stdout.split('\0').filter(Boolean).filter(file=>{
+    const dir=path.posix.dirname(file);
+    return dir!=='.'&&!dir.split('/').includes('node_modules')&&
+      micromatch.isMatch(dir,positive,{dot:true})&&!(negative.length&&micromatch.isMatch(dir,negative,{dot:true}));
+  }).sort();
+  if(matched.length>50)throw Error('more than 50 workspace packages found; select checks explicitly');
+  return matched.map(file=>({file,pkg:JSON.parse(fs.readFileSync(path.join(root,file),'utf8'))}));
+}