@redue/cli 0.1.0-alpha.16 → 0.1.0-alpha.17

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 0.1.0-alpha.17 — 2026-10-22
+
+Workspaces and package managers beyond npm. In the census of 108 public
+TypeScript repos, the ones `init` makes ready went from 5 to 8 for typecheck
+and from 6 to 22 for tests.
+
+- pnpm 9-12 for the pnpm TypeScript contract (it took only an exact pnpm 12
+  pin). The installed `.modules.yaml` names the version; a pin is optional,
+  with or without Corepack's `+sha512` hash (pins with a hash never matched
+  before). `.npmrc` settings that only change what gets installed are
+  accepted; settings that move or copy installed files, or run code during
+  install, are refused in either file: custom modules, virtual-store or
+  lockfile directories, the global virtual store, injected workspace
+  packages, separate lockfiles, pnpmfile hooks, `configDependencies`.
+- The tests recipe takes single-package pnpm 9-12 and Yarn `node-modules`
+  installs, and gives each workspace package (npm or Yarn `workspaces`, pnpm
+  `packages`) whose test script runs Vitest directly its own `PACKAGE:test`
+  check, run in the package directory. Inputs stay the whole checkout; every
+  package's node_modules is an installed input. Jest and root test scripts in
+  workspaces stay recording-only. A package added later makes the
+  workspace's checks UNVERIFIED until `init` runs again.
+- A recorded test run is UNVERIFIED when an installed file has another hard
+  link: a package store outside the checkout (pnpm's default on Linux, Yarn's
+  hardlinks modes) could change it unseen. pnpm on macOS clones files and is
+  not affected; on Linux, pnpm test checks qualify but are not reused unless
+  pnpm copies files.
+- Observer: an installed link to a directory (pnpm links every package) is
+  observed by its link chain when the target is itself observed installed;
+  any other directory link still makes observation unavailable.
+- Workspace patterns honour `!pattern` exclusions; before, a negated pattern
+  matched every directory.
+- Fixed: a new workspace package manifest did not re-plan a test check, for
+  npm workspaces too.
+
+Eval on alpha.17 code (CI 39828002753, 84 sessions, test tasks on twilio,
+cheerio and SwitchHosts plus the pnpm project devops-daily): 0 critical
+findings; 23 skipped test runs, each passing three plain reruns; nothing was
+skipped on devops-daily, whose recorded runs were UNVERIFIED on the Linux
+runner.
 ## 0.1.0-alpha.16 — 2026-10-22
 
 Changes to the Claude Code integration, and one fix for commands that meet

package/README.md

@@ -37,7 +37,7 @@ it; relevant source edits make it stale. [Run the reproducible demo](docs/contri
 
 ## Install the alpha
 
-The opt-in pilot uses **0.1.0-alpha.16**. Follow the
+The opt-in pilot uses **0.1.0-alpha.17**. Follow the
 [fixed-version pilot guide](docs/user/pilot.md) for supported projects, setup,
 updates and voluntary feedback. No external usage results are claimed yet.
 

package/bin/redue.mjs

@@ -4,7 +4,7 @@ import {mark,traceBase,traceContext,traceEnvironment,traceId} from '../src/decis
 traceBase({...traceContext(),request:traceId(),work:'client'});
 mark('client.loaded');
 import {directCompiler,directQualification,directEnvironment,directInterpretation} from '../src/direct-typescript.mjs';
-import {testEnvironment,testRunnerEntry,testsInterpretation,testsQualification} from '../src/test-direct.mjs';
+import {testEnvironment,testRunnerAt,testsInterpretation,testsQualification} from '../src/test-direct.mjs';
 import os from 'node:os';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
@@ -194,7 +194,7 @@ function which(name){
   if(found)return found;
   error(`cannot resolve executable ${name} on PATH`);
 }
-function token(value){
+function token(value,cwd='.'){
   if(value==='@node')return process.execPath;
   if(value==='@project')return root;
   if(value==='@typescript-compiler:.'){
@@ -202,8 +202,8 @@ function token(value){
   }
   if(value.startsWith('@test-runner:')){
     // Qualification reports a missing runner; status and stop still work.
-    try{return testRunnerEntry(root,value.slice('@test-runner:'.length));}
-    catch{return path.join(root,'node_modules',value.slice('@test-runner:'.length),'<unavailable>');}
+    try{return testRunnerAt(root,cwd,value.slice('@test-runner:'.length)).entry;}
+    catch{return path.join(root,cwd,'node_modules',value.slice('@test-runner:'.length),'<unavailable>');}
   }
   if(value==='@vstate/direct-typescript-probe')return path.join(productRoot,'src','direct-typescript-probe.mjs');
   if(value.startsWith('@typescript-bin:')){
@@ -226,10 +226,10 @@ function token(value){
   if(value.startsWith('@which:'))return which(value.slice(7));
   return value;
 }
-function argv(values,label){
+function argv(values,label,cwd){
   if(!Array.isArray(values)||!values.length||values.some(v=>typeof v!=='string'||!v))
     error(`${label} must be nonempty exact argv`);
-  return values.map(token);
+  return values.map(value=>token(value,cwd));
 }
 const categories=['source','generated','installedDependencies','environment','toolchain','runtime',
   'probeContinuity'];
@@ -260,7 +260,7 @@ const checks=publicConfig.checks.map(check=>{
     JSON.stringify(check.command)!==JSON.stringify(['@node','@typescript-compiler:.','--noEmit'])))
     error(`${check.name}: direct recipe requires its explicit local compiler command`);
   // The script's own arguments follow the runner; qualification compares them with the script.
-  if(testsDirect&&(manager!=='npm'||!check.script||check.cwd&&check.cwd!=='.'||!Array.isArray(check.command)||
+  if(testsDirect&&(!['npm','pnpm','yarn'].includes(manager)||!check.script||check.cwd&&check.cwd!=='.'&&!check.workspace||!Array.isArray(check.command)||
     check.command[0]!=='@node'||!/^@test-runner:(?:vitest|jest)$/.test(check.command[1]||'')))
     error(`${check.name}: test recipe requires its explicit local test runner command`);
   if(npmAutomatic&&(manager!=='npm'||check.cwd&&check.cwd!=='.'))
@@ -297,7 +297,8 @@ const checks=publicConfig.checks.map(check=>{
     {variables:['NODE_OPTIONS','NODE_PATH','CI','HOME','NODE_ENV','BASH_ENV','ENV',...windowsContext],
       prefixes:['PNPM_','COREPACK_','npm_config_','DYLD_','TSGO_'],
       pathExecutables:['node'],executableIdentity:true}:{};
-  return {name:check.name,command:argv(scriptCommand||check.command,`${check.name}.command`),
+  return {name:check.name,command:argv(scriptCommand||check.command,`${check.name}.command`,
+    typeof check.cwd==='string'&&check.cwd&&!path.isAbsolute(check.cwd)&&!check.cwd.split('/').includes('..')?check.cwd:'.'),
     cwd:check.cwd,inputs:check.inputs||[],generatedInputs:check.generatedInputs||[],
     installedInputs:check.installedInputs||(
       npmAutomatic||npmDirect||testsDirect?['node_modules/**']:[]),

package/docs/user/pilot.md

@@ -1,4 +1,4 @@
-# Opt-in development pilot: alpha.16
+# Opt-in development pilot: alpha.17
 
 Use one fixed build for several ordinary development sessions. The owner will
 invite two or three willing testers and approve their projects; nothing is
@@ -35,7 +35,7 @@ are **NOT RUN**. The recording shortcut is macOS/direct-recipe only.
 For a new default npm installation:
 
 ```sh
-npm install --global @redue/cli@0.1.0-alpha.16
+npm install --global @redue/cli@0.1.0-alpha.17
 redue --version
 cd my-project
 redue --config redue.config.json init --recipe typescript-direct --check typecheck --dry-run
@@ -89,7 +89,7 @@ using it; keep the same npm prefix, config and any explicit state selection.
 
 ```sh
 redue --config redue.config.json stop
-npm install --global @redue/cli@0.1.0-alpha.16
+npm install --global @redue/cli@0.1.0-alpha.17
 redue --config redue.config.json agent setup codex --dry-run
 redue --config redue.config.json agent setup codex --apply
 redue --config redue.config.json start

package/docs/user/supported-projects.md

@@ -45,13 +45,26 @@ project whose test script runs Vitest 4/5 or Jest 29 directly, the opt-in
 In particular, test caches and build-generated inputs are not excluded to
 make evidence green.
 
-Pinned pnpm 12 projects are read from `packageManager`, `pnpm-workspace.yaml`,
-the lockfile, and the installed `node_modules/.modules.yaml` metadata. The
+pnpm 9-12 projects are read from `packageManager`, `pnpm-workspace.yaml`,
+`.npmrc`, the lockfile, and the installed `node_modules/.modules.yaml`
+metadata. The installed metadata names the pnpm version; a `packageManager`
+pin is optional, and when present (with or without Corepack's `+sha512` hash)
+it must name the installed version. Settings that only change what gets
+installed are accepted, because the installed files are what REDUE observes.
+Settings that move or copy installed files, or run code during install, are
+not: custom `modulesDir`, `virtualStoreDir` or `lockfileDir`, the global
+virtual store, injected workspace packages, separate workspace lockfiles,
+pnpmfile hooks and `configDependencies`. They are refused when either
+`pnpm-workspace.yaml` or `.npmrc` sets them. The linker is read from the file
+the installed major reads (`.npmrc` for pnpm 9, `pnpm-workspace.yaml` then
+`.npmrc` for pnpm 10, `pnpm-workspace.yaml` for pnpm 11 and 12) and must match
+the installed one. Only the project's files are read: settings from a user or
+global rc file, or `npm_config_*` variables during install, are not. The
 supported local layouts are pnpm's standard isolated and hoisted
 `node_modules` with a project-local `.pnpm` virtual store. `init` can discover
 root and workspace scripts. For a standalone `tsc --noEmit` or `tsc -p ...`
 script in the narrow TypeScript contract, it records the exact installed
-compiler invocation directly. This avoids pnpm 12's task-run bookkeeping
+compiler invocation directly. This avoids pnpm's task-run bookkeeping
 writes during `pnpm run`; it does not alter the project's script. Test, lint,
 build, and ambiguous TypeScript scripts still execute through `pnpm run` and
 start recording-only. The generated `@typescript-bin:WORKSPACE` token resolves

package/docs/user/tests-direct.md

@@ -2,8 +2,24 @@
 
 `redue init --recipe tests-direct --check test` records a project's unit test
 run and reports later whether that result still applies to the files you have.
-It supports a single-package npm project whose test script runs Vitest 4 or 5,
-or Jest 29, directly. It runs on macOS and Linux with Node 22 or 24.
+It supports a single-package project installed by npm, pnpm 9-12 (isolated or
+hoisted `node_modules`) or Yarn with the `node-modules` linker, whose test
+script runs Vitest 4 or 5, or Jest 29, directly. It runs on macOS and Linux with
+Node 22 or 24. The project has one lockfile kind, matching any
+`packageManager` declaration; Yarn needs that declaration. With pnpm, the
+runner is the package `node_modules/RUNNER` links to, inside the checkout.
+Jest also needs jest-util 29 at `node_modules/jest-util`, which pnpm does not
+place there unless it hoists.
+
+In a workspace (npm or Yarn `workspaces`, or `packages` in
+`pnpm-workspace.yaml`), `init` gives each package whose test script runs
+Vitest directly its own check, `PACKAGE:test`, run in the package's directory
+with the Vitest that Node finds from there. Its inputs are still the whole
+checkout, so an edit in any package makes it STALE. The root's and every
+package's `node_modules` are observed as installed files, without Vite's
+caches in them. Jest is not supported in workspace packages, and neither is a
+test script at the workspace root. A package added later needs `init` again:
+its manifest appearing makes the workspace's checks UNVERIFIED until then.
 
 ## Setup
 
@@ -21,8 +37,8 @@ runner invocation: no `&&`, quotes, globs or variable assignments. Watch mode,
 Jest's `--onlyChanged` are refused. Vitest needs `run`, `--run` or
 `--watch=false`. Other scripts stay recording-only.
 
-REDUE runs the local runner with Node directly. npm, its lifecycle scripts and
-`package.json` are not changed or executed.
+REDUE runs the local runner with Node directly. The package manager, its
+lifecycle scripts and `package.json` are not changed or executed.
 
 ## What REDUE claims
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@redue/cli",
   "private": false,
-  "version": "0.1.0-alpha.16",
+  "version": "0.1.0-alpha.17",
   "publishConfig": {
     "access": "public",
     "tag": "alpha"

package/src/cli.mjs

@@ -4,7 +4,7 @@ import fs from 'node:fs';
 import {directQualification,directInterpretation,observedNpmContext} from './direct-typescript.mjs';
 import {directRunCertificateAllowed,directRunCertificate,directRunRecordable,directRunRecording,probeQuestions,validateRunRecord} from './direct-run-certificate.mjs';
 import {runFactChange} from './typescript-list.mjs';
-import {changedFiles,coverageReadable,gitIgnored,recordedEnvironment,testProject,testEnvironmentIssue,testGuardConfig,testRunGuard,testsInterpretation,testsQualification} from './test-direct.mjs';
+import {changedFiles,coverageReadable,gitIgnored,recordedEnvironment,testEnvironmentIssue,testGuardConfig,testRunGuard,testRunFacts,sharedInstalledFile,testsInterpretation,testsQualification} from './test-direct.mjs';
 import path from 'node:path';
 import net from 'node:net';
 import os from 'node:os';
@@ -273,14 +273,17 @@ async function execute() {
       ...command.slice(1)]:command;
     // A test run's processes record what the guard checks (test-recorder.cjs).
     const testRun=selected.qualification===testsQualification&&['darwin','linux'].includes(process.platform);
-    let testRecord=null,launchEnv=process.env;
+    let testRecord=null,launchEnv=process.env,testFacts={};
     if(testRun){
+      // The package directory and installed node_modules, as the plan has them.
+      try{testFacts=testRunFacts(root,selected);}
+      catch(e){captureIssues.push(`test run facts unavailable (${e.code||e.message})`);}
       const environmentIssue=testEnvironmentIssue();
       if(environmentIssue)captureIssues.push(environmentIssue);
       testRecord=path.join(state,`test-record-${runId}`);
       fs.mkdirSync(testRecord,{mode:0o700});
       const guardFile=path.join(testRecord,'guard.json');
-      fs.writeFileSync(guardFile,JSON.stringify(testGuardConfig(testRecord,root)),{mode:0o600});
+      fs.writeFileSync(guardFile,JSON.stringify(testGuardConfig(testRecord,root,process.env,testFacts)),{mode:0o600});
       launchEnv=recordedEnvironment(guardFile);
     }
     let runnerPid=null;
@@ -354,10 +357,12 @@ async function execute() {
     }else if(!unobservedDirectRun&&!recording)probeAfter=probeHash(probePlan);
     let guard=null;
     if(testRecord){
-      let coverage=null;try{coverage=coverageReadable(root,testProject(root,selected.script));}catch{}
+      let coverage=null;try{coverage=coverageReadable(root,testFacts);}catch{}
       guard=testRunGuard(testRecord,{root,sourcePatterns:plan.sourcePatterns||plan.patterns,files:snap?.files,
         runner:runnerPid,environment:selected.environment||{},coverage});
       runFacts=guard.runFacts;
+      const shared=sharedInstalledFile(root,testFacts);
+      if(shared)guard.issues.push(`installed file ${shared} has another hard link, likely into a package store; a change through it is not observed`);
       fs.rmSync(testRecord,{recursive:true,force:true});
     }
     // The daemon reads the recording from owned state; control requests are small.

package/src/daemon.mjs

@@ -271,7 +271,7 @@ function probe(row,allowReuse=false,{launch=true}={}) {
         'workspace-typecheck-contract-unavailable':'workspace TypeScript applicability probe could not establish inputs'
         ,'pnpm-execution-environment-unsupported':'pnpm or Node launcher environment override needs review'
         ,'pnpm-distribution-unobservable':'pnpm executable contents cannot be observed'
-        ,'pnpm-version-mismatch':'pnpm executable differs from the pinned version'
+        ,'pnpm-version-mismatch':'pnpm executable differs from the installed version'
         ,'typescript-input-outside-pnpm-contract':'TypeScript reads outside the selected workspace, linked outputs, or installed inputs'
         ,'pnpm-input-coverage-unavailable':'pnpm installed-input coverage became unavailable; inspect check details'
         ,'pnpm-typecheck-contract-unavailable':'pnpm TypeScript input contract could not be established'

package/src/declared-plan.mjs

@@ -6,7 +6,7 @@ import {createHash} from 'node:crypto';
 import {permittedRoots,resolveDeclaredInstalled} from './installed-inputs.mjs';
 import {qualifyTypeScript} from './typescript-qualification.mjs';
 import {directBuildInfo} from './direct-typescript.mjs';
-import {qualifyTests,testsQualification} from './test-direct.mjs';
+import {qualifyTests,testWorkspacePatterns,testsQualification} from './test-direct.mjs';
 import {yarnWorkspaceTypecheckInputs} from './yarn-workspace-inputs.mjs';
 import {pnpmTypecheckInputs} from './pnpm-inputs.mjs';
 import {observedRelative,withinPath,realObservedPath} from './path-identity.mjs';
@@ -92,6 +92,13 @@ export function discoverDeclared(config) {
       ...(workspaceIssue?[workspaceIssue]:[])];
     for(const item of workspace?.configurationInputs||[])configurationInputs.add(item);
     for(const item of workspace?.workspacePatterns||[])workspacePatterns.add(item);
+    // A workspace test check is qualified against the current package list: a
+    // package manifest appearing or pnpm's package list changing re-plans.
+    if(selected.qualification===testsQualification&&selected.workspace)try{
+      for(const item of testWorkspacePatterns(root,JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'))))
+        workspacePatterns.add(item);
+      if(fs.existsSync(path.join(root,'pnpm-workspace.yaml')))configurationInputs.add('pnpm-workspace.yaml');
+    }catch{}
     for(const item of workspace?.closure||[])workspaceManifests.add(item.manifest);
     if(!automatic)for(const category of ['source','generated','installedDependencies',
       'environment','toolchain','runtime'])if(!selected.coverage?.[category])

package/src/index.mjs

@@ -42,24 +42,33 @@ const pathPrefixes = rel => {
 // tick at the same size; such files are tracked in `racy`, and the daemon waits
 // the window out and records them again before it writes a run checkpoint.
 const identity=st=>identityFields.map(key=>String(st[key])).join(':');
+// An installed link to a directory (pnpm links every package this way) is
+// observed by its link chain alone, when `observedDir` says the directory it
+// resolves to is itself observed installed: its own entries carry its contents.
 function fileHash(root, rel,installed=false,before=fs.lstatSync(path.join(root,rel),
-  {bigint:true})) {
+  {bigint:true}),observedDir=null) {
   const file=path.join(root, rel);
   let value,references=[],bytes=installed?0:Number(before.size),racy=0;
   if(before.isSymbolicLink()){
     const resolution=resolveLinks(file,root,[],true);
     if(!resolution.physical)throw Error(`symlink input target observation unavailable: ${rel}: ${resolution.reason}`);
     const target=fs.statSync(resolution.physical,{bigint:true});
-    if(!target.isFile())throw Error(`directory input symlink unsupported: ${rel}`);
-    if(installed)racy=racyUntil(target);else bytes=Number(target.size);
-    value='link:'+JSON.stringify(resolution.links)+':'+(installed?'stat:'+identity(target):
-      target.mode+':'+hashRegular(resolution.physical).hash);
+    const physical=path.relative(root,resolution.physical).split(path.sep).join('/');
+    const directory=target.isDirectory()&&installed&&observedDir?.(physical);
+    if(!target.isFile()&&!directory)throw Error(`directory input symlink unsupported: ${rel}`);
+    if(directory)value='dirlink:'+JSON.stringify(resolution.links)+':'+physical;
+    else{
+      if(installed)racy=racyUntil(target);else bytes=Number(target.size);
+      value='link:'+JSON.stringify(resolution.links)+':'+(installed?'stat:'+identity(target):
+        target.mode+':'+hashRegular(resolution.physical).hash);
+    }
     references=[...new Set([...resolution.links.map(link=>path.relative(root,link.path)
       .split(path.sep).join('/')),path.relative(root,resolution.physical)
       .split(path.sep).join('/')])];
-    const targetAfter=fs.statSync(resolution.physical,{bigint:true});
-    for(const key of identityFields)
-      if(target[key]!==targetAfter[key])throw Error(`input changed during inspection: ${rel}`);
+    // A directory's own timestamps follow its entries, which are observed separately.
+    if(!directory){const targetAfter=fs.statSync(resolution.physical,{bigint:true});
+      for(const key of identityFields)
+        if(target[key]!==targetAfter[key])throw Error(`input changed during inspection: ${rel}`);}
     const resolutionAfter=resolveLinks(file,root,[],true);
     if(resolutionAfter.physical!==resolution.physical||
       JSON.stringify(resolutionAfter.links)!==JSON.stringify(resolution.links))
@@ -181,7 +190,14 @@ export class InputIndex {
     catch(e){if(e.code!=='ENOENT'){this.unavailable=String(e);return false;}}
     if(stat&&(stat.isFile()||stat.isSymbolicLink())) {
       const installed=this.installedPath(rel);
-      try{const started=performance.now();inspection=fileHash(this.root,rel,installed,stat);
+      try{const started=performance.now();
+        // A linked directory counts as observed only strictly inside an
+        // installed root, and only if every check matching the link also
+        // observes the directory's own files (its package.json stands for them).
+        const observedDir=installed?physical=>!this.includeInstalled&&
+          [...this.installedRootSet].some(root=>physical.startsWith(root+'/'))&&
+          matched.every(name=>this.matches(this.checks.get(name),physical+'/package.json')):null;
+        inspection=fileHash(this.root,rel,installed,stat,observedDir);
         fresh=inspection.hash;
         this.profile.hashingMs+=performance.now()-started;
         this.rehashedFiles++;this.rehashedBytes+=inspection.bytes;}
@@ -302,9 +318,10 @@ export class InputIndex {
     const full=path.join(this.root,rel);
     let subtree=false;
     try {
-      if(fs.lstatSync(full).isSymbolicLink()&&fs.statSync(full).isDirectory()){
-        this.unavailable=`directory symlink input unsupported: ${rel}`;return;}
-      if(fs.statSync(full).isDirectory()) {this.scanSubtree(rel);subtree=true;}
+      // A link is an entry of its own: record() accepts an observed installed
+      // directory link and refuses any other.
+      if(fs.lstatSync(full).isSymbolicLink())this.record(rel);
+      else if(fs.statSync(full).isDirectory()) {this.scanSubtree(rel);subtree=true;}
       else this.record(rel);
     } catch(e) {
       if(e.code==='ENOENT') {

package/src/installed-inputs.mjs

@@ -84,6 +84,10 @@ export function resolveDeclaredInstalled(root,patterns,allowed=[]) {
     if(!resolved.physical){
       if(resolved.reason==='resolved target missing'&&!resolved.links.length){
         internal.add(pattern);continue;}
+      // An exclusion of a path that does not exist yet, through links (a runner
+      // cache inside a linked package): exclude it where the links lead.
+      if(negative&&resolved.reason==='resolved target missing'&&resolved.prospective&&within(resolved.prospective,root)){
+        internal.add('!'+posix(path.relative(root,resolved.prospective))+(suffix?'/'+suffix:''));continue;}
       result.unresolved.push(`${prefix}: ${resolved.reason}`);continue;
     }
     const boundary=within(resolved.physical,root)?root:

package/src/node-onboarding.mjs

@@ -3,11 +3,11 @@ import {testProject,testRecipeScript,testCheckInputs,testsQualification} from '.
 import fs from 'node:fs';
 import path from 'node:path';
 import {spawnSync} from 'node:child_process';
-import micromatch from './glob.mjs';
 import {yarnWorkspaceTypecheckInputs} from './yarn-workspace-inputs.mjs';
 import {pnpmInstallInfo,pnpmProjectInfo,pnpmTypecheckInputs} from './pnpm-inputs.mjs';
 import {realObservedPath} from './path-identity.mjs';
 import {findExecutable} from './executable-lookup.mjs';
+import {workspaceManifests} from './workspace-manifests.mjs';
 
 const exists=file=>{try{fs.accessSync(file);return true;}catch{return false;}};
 const readJson=file=>JSON.parse(fs.readFileSync(file,'utf8'));
@@ -147,20 +147,6 @@ function selectScript(kind,names,scripts) {
   return candidates.length===1?{script:candidates[0]}:
     candidates.length>1?{ambiguous:candidates}:{};
 }
-function workspaceManifests(root,patterns) {
-  const listing=spawnSync('git',['ls-files','--cached','--others','--exclude-standard',
-    '-z','--',':(glob)**/package.json'],{cwd:root,encoding:'utf8',timeout:5000,
-    maxBuffer:32*1024*1024,stdio:['ignore','pipe','ignore'],
-    env:{...process.env,GIT_OPTIONAL_LOCKS:'0'}});
-  if(listing.status!==0||listing.error)throw Error('workspace package manifests cannot be inspected');
-  const matched=listing.stdout.split('\0').filter(Boolean).filter(file=>{
-    const dir=path.posix.dirname(file);
-    return dir!=='.'&&!dir.split('/').includes('node_modules')&&
-      micromatch.isMatch(dir,patterns,{dot:true});
-  }).sort();
-  if(matched.length>50)throw Error('more than 50 workspace packages found; select checks explicitly');
-  return matched.map(file=>({file,pkg:readJson(path.join(root,file))}));
-}
 // Workspace packages as init finds them, with their scripts; [] without workspaces.
 export function workspacePackages(root){
   root=realObservedPath(root);
@@ -209,7 +195,8 @@ export function discoverNodeProject(root,{recipe=null}={}) {
     }
     if(recipe==='tests-direct'&&kind==='test'){
       try{
-        if(pm.name!=='npm'||workspaces||observationIssue||pm.issue)throw Error('test recipe requires a supported single-package npm checkout');
+        if(!['npm','pnpm','yarn'].includes(pm.name)||workspaces||observationIssue||pm.issue)
+          throw Error('test recipe requires a supported single-package npm, pnpm or Yarn checkout');
         const chosen=testRecipeScript(scripts);
         if(chosen.ambiguous)throw Error(`several scripts run Vitest or Jest directly (${chosen.ambiguous.join(', ')})`);
         if(!chosen.script)throw Error(chosen.issue||'no script runs Vitest or Jest directly');
@@ -230,7 +217,7 @@ export function discoverNodeProject(root,{recipe=null}={}) {
         check.inputs=['package.json','pnpm-lock.yaml',
           ...(exists(path.join(root,'pnpm-workspace.yaml'))?['pnpm-workspace.yaml']:[]),
           'tsconfig.json','src/**'];
-        classification={level:'ready',reason:'pinned pnpm TypeScript inputs and installation; checked again before reuse',
+        classification={level:'ready',reason:'pnpm TypeScript inputs and installation; checked again before reuse',
           qualification:'pnpm-tsc-v1'};}
       catch(e){classification={level:'recording',reason:`pnpm TypeScript contract needs review: ${e.message}`};}
     }
@@ -284,9 +271,17 @@ export function discoverNodeProject(root,{recipe=null}={}) {
               ...member.scripts[selected.script].trim().split(/\s+/).slice(1)];
             check.inputs=['package.json','pnpm-lock.yaml','pnpm-workspace.yaml',file,
               `${dir}/src/**`];
-            level='ready';reason='pinned pnpm workspace TypeScript inputs; checked again before reuse';
+            level='ready';reason='pnpm workspace TypeScript inputs; checked again before reuse';
           }catch(e){reason=`pnpm TypeScript contract needs review: ${e.message}`;}
         }
+        if(recipe==='tests-direct'&&kind==='test'&&!pm.issue){
+          try{const project=testProject(root,selected.script,dir);
+            Object.assign(check,{workspace:name,script:selected.script,cwd:dir,
+              command:['@node',`@test-runner:${project.runner}`,...project.args],...testCheckInputs(project),
+              qualification:testsQualification});
+            level='ready';reason=`explicit local ${project.runner} ${project.version} run of ${name}'s script ${JSON.stringify(selected.script)}; the whole checkout is its input; the package manager and lifecycle scripts are not executed`;
+          }catch(e){reason=`Test recipe unavailable (${e.code||e.message}); original script retained`;}
+        }
         checks.push({config:check,level,reason});
       }
     }

package/src/pnpm-inputs.mjs

@@ -1,4 +1,4 @@
-// Pinned pnpm 12 node-modules installation provider. The engine sees only
+// pnpm 9-12 node-modules installation provider. The engine sees only
 // repository-relative input sets and resolution relationships, never pnpm
 // virtual-store names as semantic identities.
 import {probeTimeLeft} from './probe-deadline.mjs';
@@ -27,40 +27,81 @@ function safePatterns(values){
     throw Error('pnpm workspace patterns are unsupported');
   return values;
 }
+// The supported pnpm majors. pnpm 9 reads settings from .npmrc, pnpm 10 from
+// pnpm-workspace.yaml first and then .npmrc, pnpm 11 and 12 from
+// pnpm-workspace.yaml only.
+export const pnpmMajors=[9,10,11,12];
+// Settings that move or copy installed files, or run code during install,
+// where the contract does not look; by pnpm-workspace.yaml and .npmrc name.
+// Other settings change only what gets installed, and the installed files are
+// what the contract observes. These are refused when either file sets them,
+// whichever file the installed pnpm reads. Only the project's files are read:
+// user or global rc files and npm_config_* variables at install time are not.
+const refused=[['modulesDir','modules-dir'],['virtualStoreDir','virtual-store-dir'],['lockfileDir','lockfile-dir'],
+  ['enableGlobalVirtualStore','enable-global-virtual-store'],['injectWorkspacePackages','inject-workspace-packages'],
+  ['sharedWorkspaceLockfile','shared-workspace-lockfile'],['pnpmfile','pnpmfile'],['globalPnpmfile','global-pnpmfile'],
+  ['configDependencies','config-dependencies']];
+// .npmrc read as pnpm's ini parser reads it: a BOM is dropped, a bare key is
+// true, quotes are removed, and "true"/"false" become booleans.
+function npmrc(file){
+  const settings={};
+  if(!exists(file))return settings;
+  for(const line of fs.readFileSync(file,'utf8').replace(/^\uFEFF/,'').split(/\r?\n/)){
+    const trimmed=line.trim();if(!trimmed||/^[#;]/.test(trimmed))continue;
+    const at=trimmed.indexOf('='),key=(at<0?trimmed:trimmed.slice(0,at)).trim();
+    let value=at<0?true:trimmed.slice(at+1).trim();
+    if(typeof value==='string'&&/^(["']).*\1$/.test(value))value=value.slice(1,-1);
+    settings[key]=value==='true'?true:value==='false'?false:value;
+  }
+  return settings;
+}
+// Whether a refused setting is set: present at all, except that only
+// sharedWorkspaceLockfile=false and injectWorkspacePackages=true move files.
+const setting=(key,value)=>value!==undefined&&
+  (key==='sharedWorkspaceLockfile'?value===false:key==='injectWorkspacePackages'?value===true:true);
 export function pnpmProjectInfo(root){
   root=realObservedPath(root);
   const pkg=read(path.join(root,'package.json'));
-  const pin=/^pnpm@(12\.\d+\.\d+)(?:\+[^\s]+)?$/.exec(pkg.packageManager||'');
-  if(!pin)throw Error('an exact pnpm 12 packageManager pin is required');
+  // A pin is optional; when present it names pnpm 9-12, and the install must match it.
+  const pin=pkg.packageManager===undefined?null:/^pnpm@((\d+)\.\d+\.\d+)(?:\+[^\s]+)?$/.exec(pkg.packageManager);
+  if(pkg.packageManager!==undefined&&(!pin||!pnpmMajors.includes(Number(pin[2]))))
+    throw Error(`packageManager ${JSON.stringify(String(pkg.packageManager).split('+')[0])} is outside pnpm ${pnpmMajors[0]}-${pnpmMajors.at(-1)}`);
   const workspaceFile=path.join(root,'pnpm-workspace.yaml');
-  const settings=exists(workspaceFile)?yaml(workspaceFile):{};
-  const patterns=safePatterns(settings.packages||[]);
-  const linker=settings.nodeLinker||'isolated';
-  return {version:pin[1],linker,patterns,settings};
+  const workspace=exists(workspaceFile)?yaml(workspaceFile):{},rc=npmrc(path.join(root,'.npmrc'));
+  const patterns=safePatterns(workspace.packages||[]);
+  // The linker the given pnpm major reads; without a major, the one any reads.
+  const linkerFor=major=>(major===9?rc['node-linker']:major>=11?workspace.nodeLinker:
+    workspace.nodeLinker??rc['node-linker'])||'isolated';
+  const major=pin?Number(pin[2]):null;
+  return {version:pin?.[1]??null,linker:linkerFor(major),linkerFor,patterns,settings:workspace,
+    refused:refused.filter(([key,name])=>setting(key,workspace[key])||setting(key,rc[name])).map(([key])=>key)};
 }
 export function pnpmInstallInfo(root){
   const started=performance.now();
   root=realObservedPath(root);
-  const pkg=read(path.join(root,'package.json'));
-  const {version,linker,patterns,settings}=pnpmProjectInfo(root);
+  const {version,linkerFor,patterns,settings,refused}=pnpmProjectInfo(root);
   const workspaceFile=path.join(root,'pnpm-workspace.yaml');
-  if(!['isolated','hoisted'].includes(linker))throw Error(`pnpm ${linker} linker is recording-only`);
-  if(settings.modulesDir||settings.virtualStoreDir||settings.enableGlobalVirtualStore)
-    throw Error('custom pnpm modules or virtual-store location is recording-only');
-  if(settings.injectWorkspacePackages)
-    throw Error('injected workspace dependencies are recording-only');
-  if(settings.sharedWorkspaceLockfile===false)
-    throw Error('separate workspace lockfiles are recording-only');
-  if(exists(path.join(root,'.pnpmfile.cjs'))||exists(path.join(root,'.pnpmfile.mjs')))
+  if(refused.some(key=>['pnpmfile','globalPnpmfile','configDependencies'].includes(key))||
+    exists(path.join(root,'.pnpmfile.cjs'))||exists(path.join(root,'.pnpmfile.mjs')))
     throw Error('custom pnpm installation hooks need review');
+  if(refused.some(key=>['modulesDir','virtualStoreDir','lockfileDir','enableGlobalVirtualStore'].includes(key)))
+    throw Error('custom pnpm modules or virtual-store location is recording-only');
+  if(refused.includes('injectWorkspacePackages'))throw Error('injected workspace dependencies are recording-only');
+  if(refused.includes('sharedWorkspaceLockfile'))throw Error('separate workspace lockfiles are recording-only');
   const modulesFile=path.join(root,'node_modules','.modules.yaml');
   if(!exists(modulesFile))throw Error('installed pnpm module metadata is missing');
   const modules=yaml(modulesFile);
-  if(modules.nodeLinker!==linker||modules.packageManager!==pkg.packageManager)
+  const installed=/^pnpm@((\d+)\.\d+\.\d+)$/.exec(String(modules.packageManager));
+  if(!installed||!pnpmMajors.includes(Number(installed[2])))
+    throw Error(`installed by ${JSON.stringify(String(modules.packageManager))}, outside pnpm ${pnpmMajors[0]}-${pnpmMajors.at(-1)}`);
+  const linker=linkerFor(Number(installed[2]));
+  if(!['isolated','hoisted'].includes(linker))throw Error(`pnpm ${linker} linker is recording-only`);
+  if(modules.nodeLinker!==linker||version!==null&&installed[1]!==version)
     throw Error('installed pnpm linker or version differs from project configuration');
   const virtualStore=path.join(root,'node_modules','.pnpm');
-  // pnpm 12 on Windows can omit virtualStoreDir when using its project-local
-  // default. Accept only the observed, ordinary local directory in that case.
+  // pnpm can omit virtualStoreDir when using its project-local default
+  // (seen with pnpm 12 on Windows). Accept only the observed, ordinary local
+  // directory in that case.
   const declared=modules.virtualStoreDir;
   const selected=declared===undefined?virtualStore:
     path.resolve(path.dirname(modulesFile),declared);
@@ -72,18 +113,8 @@ export function pnpmInstallInfo(root){
     throw Error('nonstandard or incomplete project-local pnpm virtual store');
   if(!exists(path.join(root,'pnpm-lock.yaml')))
     throw Error('pnpm lockfile is missing');
-  if(exists(path.join(root,'.npmrc'))){
-    // pnpm 12 reads project settings from pnpm-workspace.yaml. Registry/auth
-    // entries affect acquisition, not a completed local TypeScript invocation.
-    for(const line of fs.readFileSync(path.join(root,'.npmrc'),'utf8').split(/\r?\n/)){
-      const trimmed=line.trim();if(!trimmed||/^[#;]/.test(trimmed))continue;
-      const key=trimmed.split('=')[0].trim();
-      if(key!=='registry'&&!/^\/\/[^\s]+\/:_authToken$/.test(key))
-        throw Error('project .npmrc has execution-relevant pnpm settings requiring review');
-    }
-  }
   timing('pnpm.install_metadata',started);
-  return {version,linker,patterns,settings,modulesFile,
+  return {version:installed[1],linker,patterns,settings,modulesFile,
     configurationInputs:['package.json','pnpm-lock.yaml',
       ...(exists(workspaceFile)?['pnpm-workspace.yaml']:[]),
       ...(exists(path.join(root,'.npmrc'))?['.npmrc']:[]),

package/src/test-direct.mjs

@@ -13,6 +13,8 @@ import {spawnSync} from 'node:child_process';
 import micromatch from './glob.mjs';
 import {runFact} from './direct-run-certificate.mjs';
 import {queryAnswer} from './typescript-list.mjs';
+import {pnpmInstallInfo,pnpmProjectInfo} from './pnpm-inputs.mjs';
+import {workspaceManifests} from './workspace-manifests.mjs';
 
 const digest=value=>createHash('sha256').update(value).digest('hex');
 export const testRecorder=fileURLToPath(new URL('test-recorder.cjs',import.meta.url));
@@ -39,10 +41,10 @@ const issueLimit=20,factLimit=10000;
 
 // The guard file the recorder reads: where to write, what counts as the
 // checkout and as temporary space, and digests of the caller's environment.
-export function testGuardConfig(dir,root,env=process.env) {
+export function testGuardConfig(dir,root,env=process.env,project={}) {
   const tmp=[...new Set([path.resolve(os.tmpdir()),fs.realpathSync(os.tmpdir())])];
   const real=dir=>{try{return fs.realpathSync(dir);}catch{return dir;}};
-  return {schema:1,dir,root,tmp,runnerData:[...new Set(runnerDataDirectories(env).flatMap(dir=>[path.resolve(dir),real(dir)]))],
+  return {schema:1,dir,root,tmp,installed:modulesDirs(project).map(at=>path.join(root,at)),runnerData:[...new Set(runnerDataDirectories(env).flatMap(dir=>[path.resolve(dir),real(dir)]))],
     env:Object.fromEntries(Object.entries(env).filter(([,value])=>typeof value==='string').map(([key,value])=>[key,digest(value)]))};
 }
 
@@ -262,48 +264,150 @@ export function testRecipeScript(scripts){
   return near?{issue:issue(near)}:{};
 }
 const majorOf=version=>Number(String(version).split('.')[0]);
-// The runner's executable inside the checkout's node_modules.
+// The runner's executable inside the checkout's node_modules. pnpm links
+// node_modules/RUNNER into node_modules/.pnpm; the files stay in node_modules.
 export function testRunnerEntry(root,runner){
   if(!runners[runner])fail('test-runner-unsupported');
   const dir=path.join(root,'node_modules',runner);
   let pkg,real;
   try{real=fs.realpathSync(dir);pkg=JSON.parse(fs.readFileSync(path.join(real,'package.json'),'utf8'));}
   catch{fail('test-runner-missing');}
-  if(real!==dir||pkg.name!==runner)fail('test-runner-layout-unsupported');
+  const modules=fs.realpathSync(path.join(root,'node_modules'));
+  if(!real.startsWith(modules+path.sep)||pkg.name!==runner)fail('test-runner-layout-unsupported');
   const bin=typeof pkg.bin==='string'?pkg.bin:pkg.bin?.[runner];
   const entry=typeof bin==='string'?path.resolve(real,bin):null;
   if(!entry||!entry.startsWith(real+path.sep)||!fs.existsSync(entry))fail('test-runner-layout-unsupported');
   return entry;
 }
-// The project facts the recipe needs, or an error code.
-export function testProject(root,script){
+// The package manager of a checkout whose install the recipe observes in
+// node_modules: npm, pnpm 9-12 (isolated or hoisted), or Yarn with the
+// node-modules linker. One lockfile kind, agreeing with any declaration.
+// Workspaces are refused unless `workspaces` is set.
+export function testPackageManager(root,pkg,{workspaces=false}={}){
+  const has=file=>fs.existsSync(path.join(root,file));
+  const kinds=new Set([has('package-lock.json')||has('npm-shrinkwrap.json')?'npm':null,has('pnpm-lock.yaml')?'pnpm':null,
+    has('yarn.lock')?'yarn':null,has('bun.lock')||has('bun.lockb')?'bun':null].filter(Boolean));
+  const declared=/^(npm|pnpm|yarn|bun)@/.exec(pkg.packageManager||'')?.[1];
+  if(pkg.packageManager!==undefined&&!declared)fail('test-package-manager-unsupported');
+  if(declared)kinds.add(declared);
+  const name=kinds.size===1?[...kinds][0]:null;
+  if(!name||!has({npm:'package-lock.json',pnpm:'pnpm-lock.yaml',yarn:'yarn.lock',bun:'bun.lock'}[name])&&
+    !(name==='npm'&&has('npm-shrinkwrap.json')))fail('test-package-manager-unsupported');
+  if(pkg.workspaces&&!workspaces)fail('test-workspace-unsupported');
+  if(name==='pnpm'){
+    // pnpm 10+ keeps settings in pnpm-workspace.yaml; only `packages` makes a workspace.
+    let install;try{install=pnpmInstallInfo(root);}catch{fail('test-pnpm-install-unsupported');}
+    if(install.patterns.length&&!workspaces)fail('test-workspace-unsupported');
+  }
+  if(name==='yarn'){
+    // Yarn 2+ needs top-level `nodeLinker: node-modules` and the classic nmMode
+    // (no hard links); Yarn 1 always installs node_modules.
+    const rc=has('.yarnrc.yml')?fs.readFileSync(path.join(root,'.yarnrc.yml'),'utf8'):null;
+    const top=key=>rc?new RegExp(`^${key}\\s*:\\s*['"]?([\\w-]+)`,'m').exec(rc)?.[1]:undefined;
+    const version=/^yarn@(\d+)\./.exec(pkg.packageManager||'')?.[1];
+    if(!version||(version==='1'?rc!==null:top('nodeLinker')!=='node-modules'||![undefined,'classic'].includes(top('nmMode'))))
+      fail('test-yarn-install-unsupported');
+  }
+  if(name==='bun')fail('test-package-manager-unsupported');
+  return name;
+}
+// What a recorded run needs, from the check itself rather than the checkout:
+// the package directory, the workspace node_modules its installed inputs
+// list, and the runner and arguments of the package's script. A package
+// added since init is then not treated as installed, so reads there are
+// unobserved and make the run UNVERIFIED.
+export function testRunFacts(root,check){
+  const dir=check.cwd&&check.cwd!=='.'?check.cwd:'.';
+  const dirs=(check.installedInputs||[]).map(p=>/^([^!*]+)\/node_modules\/\*\*$/.exec(p)?.[1]).filter(Boolean);
+  const own=JSON.parse(fs.readFileSync(path.join(root,dir,'package.json'),'utf8'));
+  if(typeof own.scripts?.[check.script]!=='string')fail('test-script-changed');
+  return {...testScript(own.scripts[check.script]),dir,dirs};
+}
+// The checkout's workspace patterns: pnpm's `packages`, else package.json's.
+export function testWorkspacePatterns(root,pkg){
+  return fs.existsSync(path.join(root,'pnpm-lock.yaml'))?pnpmProjectInfo(root).patterns:
+    Array.isArray(pkg.workspaces)?pkg.workspaces:pkg.workspaces?.packages??[];
+}
+// The checkout's workspace package directories, [] for a single package.
+export function testWorkspaceDirs(root,pkg){
+  const patterns=testWorkspacePatterns(root,pkg);
+  return patterns.length?workspaceManifests(root,patterns).map(({file})=>path.posix.dirname(file)):[];
+}
+// Each node_modules the recipe observes as installed: the root's and every
+// workspace package's, relative to the root.
+const modulesDirs=({dirs=[]})=>['node_modules',...dirs.map(dir=>`${dir}/node_modules`)];
+// The first installed file with more than one link, or null. A package store
+// outside the checkout (pnpm's default on Linux, Yarn's hardlinks modes) can
+// change such a file with no event here. Checked at every recorded run: a later
+// install that adds links replaces the files, which is a change REDUE sees.
+export function sharedInstalledFile(root,project={}){
+  const stack=modulesDirs(project).map(dir=>path.join(root,dir));
+  while(stack.length){
+    const dir=stack.pop();let entries;
+    try{entries=fs.readdirSync(dir,{withFileTypes:true});}catch{continue;}
+    for(const entry of entries){
+      const file=path.join(dir,entry.name);
+      if(entry.isDirectory())stack.push(file);
+      else if(entry.isFile())try{if(fs.lstatSync(file).nlink>1)return path.relative(root,file).split(path.sep).join('/');}catch{}
+    }
+  }
+  return null;
+}
+// The runner a package's script reaches: Node's lookup from the package
+// directory up to the root, skipping candidates that are not the runner. Its
+// files must be in an observed node_modules (`dirs`: workspace packages).
+// `logical` is where the lookup found it, before links, relative to the root.
+export function testRunnerAt(root,dir,runner,dirs=[]){
+  if(dir==='.')return {entry:testRunnerEntry(root,runner),logical:`node_modules/${runner}`};
+  if(!runners[runner])fail('test-runner-unsupported');
+  const rootReal=fs.realpathSync(root),observed=modulesDirs({dirs}).map(at=>path.join(rootReal,at)+path.sep);
+  for(let at=dir;;at=path.posix.dirname(at)){
+    const logical=at==='.'?`node_modules/${runner}`:`${at}/node_modules/${runner}`;
+    let real,pkg;
+    try{real=fs.realpathSync(path.join(root,logical));pkg=JSON.parse(fs.readFileSync(path.join(real,'package.json'),'utf8'));}catch{}
+    if(pkg?.name===runner){
+      if(!observed.some(prefix=>real.startsWith(prefix)))fail('test-runner-layout-unsupported');
+      const bin=typeof pkg.bin==='string'?pkg.bin:pkg.bin?.[runner];
+      const entry=typeof bin==='string'?path.resolve(real,bin):null;
+      if(!entry||!entry.startsWith(real+path.sep)||!fs.existsSync(entry))fail('test-runner-layout-unsupported');
+      return {entry,logical};
+    }
+    if(at==='.')fail('test-runner-missing');
+  }
+}
+// The project facts the recipe needs, or an error code. `dir` is a workspace
+// package's directory; there the recipe supports Vitest only.
+export function testProject(root,script,dir='.'){
   const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));
-  if(pkg.workspaces||pkg.packageManager&&!/^npm@/.test(pkg.packageManager)||
-    !['package-lock.json','npm-shrinkwrap.json'].some(file=>fs.existsSync(path.join(root,file)))||
-    ['yarn.lock','pnpm-lock.yaml','bun.lock','bun.lockb'].some(file=>fs.existsSync(path.join(root,file))))
-    fail('test-npm-project-unsupported');
-  if(typeof pkg.scripts?.[script]!=='string'||pkg.scripts['pre'+script]||pkg.scripts['post'+script])fail('test-script-changed');
-  const {runner,args}=testScript(pkg.scripts[script]);
-  const entry=testRunnerEntry(root,runner);
-  const version=JSON.parse(fs.readFileSync(path.join(root,'node_modules',runner,'package.json'),'utf8')).version;
+  testPackageManager(root,pkg,{workspaces:dir!=='.'});
+  const dirs=dir==='.'?[]:testWorkspaceDirs(root,pkg);
+  if(dir!=='.'&&!dirs.includes(dir))fail('test-workspace-unsupported');
+  const own=dir==='.'?pkg:JSON.parse(fs.readFileSync(path.join(root,dir,'package.json'),'utf8'));
+  if(typeof own.scripts?.[script]!=='string'||own.scripts['pre'+script]||own.scripts['post'+script])fail('test-script-changed');
+  const {runner,args}=testScript(own.scripts[script]);
+  if(dir!=='.'&&runner!=='vitest')fail('test-runner-unsupported');
+  const {entry,logical}=testRunnerAt(root,dir,runner,dirs);
+  const version=JSON.parse(fs.readFileSync(path.join(root,logical,'package.json'),'utf8')).version;
   if(!runners[runner].majors.includes(majorOf(version)))fail('test-runner-version-unsupported');
   if(runner==='jest'){
     let util=null;try{util=JSON.parse(fs.readFileSync(path.join(root,'node_modules/jest-util/package.json'),'utf8')).version;}catch{}
     if(majorOf(util)!==29||!fs.existsSync(path.join(root,'node_modules/jest-util/build/createProcessObject.js')))
       fail('test-runner-layout-unsupported');
   }
-  return {runner,version,args,entry};
+  return {runner,version,args,entry,dir,dirs,logical};
 }
 // Inputs: the whole checkout except documentation and the coverage report a
 // --coverage run writes. Git-ignored files the run creates are handled per
-// run (cli.mjs). Installed files are observed by identity; Vite's
-// caches inside node_modules are written by every Vitest run.
-export function testCheckInputs({runner,args}){
-  return {inputs:['**','!node_modules/**','!.git/**','!**/*.md','!**/*.mdx',
-    ...(args.includes('--coverage')?['!coverage/**']:[])],
+// run (cli.mjs). Installed files, in the root's node_modules and every
+// workspace package's, are observed by identity; Vite's caches inside them
+// are written by every Vitest run.
+export function testCheckInputs({runner,args,dir='.',dirs=[],logical=`node_modules/${runner}`}){
+  const modules=modulesDirs({dirs});
+  return {inputs:['**',...modules.map(at=>`!${at}/**`),'!.git/**','!**/*.md','!**/*.mdx',
+    ...(args.includes('--coverage')?[`!${dir==='.'?'':dir+'/'}coverage/**`]:[])],
   // Vitest's typecheck mode keeps tsc's build info in its own dist directory.
-  installedInputs:['node_modules/**',...(runner==='vitest'?['!node_modules/.vite/**','!node_modules/.vite-temp/**','!node_modules/.vitest/**',
-    '!node_modules/vitest/dist/tsconfig.tmp.tsbuildinfo']:[])]};
+  installedInputs:modules.flatMap(at=>[`${at}/**`,...(runner==='vitest'?[`!${at}/.vite/**`,`!${at}/.vite-temp/**`,`!${at}/.vitest/**`]:[])])
+    .concat(runner==='vitest'?[`!${logical}/dist/tsconfig.tmp.tsbuildinfo`]:[])};
 }
 // The coverage directory a --coverage run may read back: Jest reads every
 // .js file under its roots, an earlier report's included, to map dependencies,
@@ -311,21 +415,26 @@ export function testCheckInputs({runner,args}){
 // when no configuration names thresholds (which make the report decide the
 // result) or another report directory. Configuration can be code, so this
 // reads its text.
-export function coverageReadable(root,{runner,args}){
+export function coverageReadable(checkout,{runner,args,dir='.'}){
   if(!args.includes('--coverage'))return null;
+  // A workspace package's configuration and report live in its directory.
+  const root=path.join(checkout,dir);
   const names=runner==='jest'?['jest.config.js','jest.config.ts','jest.config.mjs','jest.config.cjs','jest.config.json']:
     ['vitest.config.ts','vitest.config.mts','vitest.config.cts','vitest.config.js','vitest.config.mjs','vitest.config.cjs',
       'vite.config.ts','vite.config.mts','vite.config.cts','vite.config.js','vite.config.mjs','vite.config.cjs',
       'vitest.workspace.ts','vitest.workspace.js','vitest.workspace.json'];
   const at=args.findIndex(arg=>arg==='--config'||arg==='-c'),inline=args.find(arg=>/^(?:--config|-c)=/.test(arg));
   const given=at>=0?args[at+1]:inline?.split(/=(.*)/s)[1];
-  const texts=[];
-  for(const name of [...names,...(given?[given]:[])]){
-    try{texts.push(fs.readFileSync(path.resolve(root,name),'utf8'));}catch{}
+  // Vitest finds its configuration in the package directory or a parent.
+  const texts=[],folders=[];
+  for(let at=dir;;at=path.posix.dirname(at)){folders.push(path.join(checkout,at));if(at==='.')break;}
+  for(const name of [...names,...(given?[given]:[])])for(const folder of folders){
+    try{texts.push(fs.readFileSync(path.resolve(folder,name),'utf8'));}catch{}
   }
   try{const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));
     if(runner==='jest'&&pkg.jest)texts.push(JSON.stringify(pkg.jest));}catch{return null;}
-  return texts.some(text=>/coverageThreshold|thresholds|coverageDirectory|reportsDirectory/.test(text))?null:'coverage';
+  return texts.some(text=>/coverageThreshold|thresholds|coverageDirectory|reportsDirectory/.test(text))?null:
+    dir==='.'?'coverage':`${dir}/coverage`;
 }
 // The caller's environment, when it would load code before the recorder or
 // the Node version is not one the recipe supports. Compared variables are
@@ -345,13 +454,17 @@ export function qualifyTests(root,selected){
   const issues=[];
   if(!['darwin','linux'].includes(process.platform))issues.push('the test recipe records runs on macOS and Linux only');
   try{
-    const project=testProject(root,selected.script);
-    if(JSON.stringify(selected.command)!==JSON.stringify([process.execPath,project.entry,...project.args])||
-      selected.cwd&&selected.cwd!=='.')issues.push('test runner invocation changed; run redue init again');
+    const dir=selected.cwd&&selected.cwd!=='.'?selected.cwd:'.';
+    if(dir!=='.'&&!selected.workspace)throw Object.assign(Error(),{code:'a test check in a directory needs its workspace'});
+    const project=testProject(root,selected.script,dir);
+    if(JSON.stringify(selected.command)!==JSON.stringify([process.execPath,project.entry,...project.args]))
+      issues.push('test runner invocation changed; run redue init again');
     // Every checkout file but installed ones is a content input; the recorder
     // skips node_modules because it is observed as installed files.
-    const positives=(selected.inputs||[]).filter(p=>!p.startsWith('!'));
-    if(positives.length!==1||positives[0]!=='**'||!selected.inputs.includes('!node_modules/**')||
+    if(dir!=='.'&&JSON.parse(fs.readFileSync(path.join(root,dir,'package.json'),'utf8')).name!==selected.workspace)
+      issues.push('the test check names another workspace package than its directory holds; run redue init again');
+    const expected=testCheckInputs(project),sorted=list=>JSON.stringify([...(list||[])].sort());
+    if(sorted(selected.inputs)!==sorted(expected.inputs)||
       JSON.stringify([...(selected.installedInputs||[])].sort())!==JSON.stringify([...testCheckInputs(project).installedInputs].sort()))
       issues.push('test inputs must be the whole checkout, with node_modules observed as installed files; run redue init again');
   }catch(e){issues.push(e.code||'test runner prerequisites unavailable');}

package/src/test-recorder.cjs

@@ -24,7 +24,8 @@ function install(){
     for(let at=0;at<line.length;)at+=original.writeSync(fd,line,at,line.length-at);}catch{}};
   const failed=reason=>emit(['U',reason]);
   emit(['H',{pid:process.pid,ppid:process.ppid,threadId}]);
-  const sep=path.sep,root=config.root,installed=path.join(root,'node_modules'),
+  // Every node_modules observed as installed: the root's and each workspace package's.
+  const sep=path.sep,root=config.root,installed=Array.isArray(config.installed)?config.installed:[path.join(root,'node_modules')],
     tmp=config.tmp;
   const within=(file,dir)=>file===dir||file.startsWith(dir+sep);
   const digest=value=>createHash('sha256').update(value).digest('hex');
@@ -85,7 +86,7 @@ function install(){
       if(full===undefined)return;
       if(full===null){if(!['produce','touch','mkdir'].includes(role))failed(`${role} of an unsupported path argument`);return;}
       // Installed files are observed by identity.
-      if(within(full,installed))return;
+      if(installed.some(dir=>within(full,dir)))return;
       if(role==='produce'){if(!error)produced.add(full);if(!error&&within(full,root))once(['P',rel(full)]);return;}
       // A directory the run created held nothing before it, so everything in
       // it is the run's output, whichever process reads it.

package/src/workspace-manifests.mjs

@@ -0,0 +1,23 @@
+// Workspace package manifests: package.json files Git tracks or would add,
+// in directories that match the workspace patterns, outside node_modules.
+import fs from 'node:fs';
+import path from 'node:path';
+import {spawnSync} from 'node:child_process';
+import micromatch from './glob.mjs';
+
+export function workspaceManifests(root,patterns) {
+  const listing=spawnSync('git',['ls-files','--cached','--others','--exclude-standard',
+    '-z','--',':(glob)**/package.json'],{cwd:root,encoding:'utf8',timeout:5000,
+    maxBuffer:32*1024*1024,stdio:['ignore','pipe','ignore'],
+    env:{...process.env,GIT_OPTIONAL_LOCKS:'0'}});
+  if(listing.status!==0||listing.error)throw Error('workspace package manifests cannot be inspected');
+  // `!pattern` entries exclude, as in pnpm-workspace.yaml.
+  const positive=patterns.filter(p=>!p.startsWith('!')),negative=patterns.filter(p=>p.startsWith('!')).map(p=>p.slice(1));
+  const matched=listing.stdout.split('\0').filter(Boolean).filter(file=>{
+    const dir=path.posix.dirname(file);
+    return dir!=='.'&&!dir.split('/').includes('node_modules')&&
+      micromatch.isMatch(dir,positive,{dot:true})&&!(negative.length&&micromatch.isMatch(dir,negative,{dot:true}));
+  }).sort();
+  if(matched.length>50)throw Error('more than 50 workspace packages found; select checks explicitly');
+  return matched.map(file=>({file,pkg:JSON.parse(fs.readFileSync(path.join(root,file),'utf8'))}));
+}