@redue/cli 0.1.0-alpha.16 → 0.1.0-alpha.18

package/src/claude-hook.mjs

@@ -10,6 +10,7 @@ import {spawn} from 'node:child_process';
 import {projectState} from './project-location.mjs';
 import {realObservedPath} from './path-identity.mjs';
 import {processAlive} from './process-liveness.mjs';
+import {scriptRunChecks} from './typescript-invocation.mjs';
 
 export const hookCommand='redue agent hook claude';
 // No shell metacharacters; `@` starts scoped package names.
@@ -91,29 +92,65 @@ const checkScript=check=>typeof check.script==='string'?check.script:
   Array.isArray(check.command)&&/^@which:(?:npm|pnpm|yarn)$/.test(check.command[0])&&check.command.includes('run')?
     check.command[check.command.indexOf('run')+1]:null;
 
+// A typecheck check whose command is the compiler: its arguments are one tsc
+// run of its script (typescript-invocation.mjs).
+function tscCheck(check){return typecheck(check)&&/^tsc(?: |$)/.test(toolText(check)||'');}
 // Exact commands that rerun each configured typecheck or direct test check.
 // `forms` work from the project root; `local` ones work in the check's own
 // directory `dir`, after a `cd` into it. Names that would need shell quoting
-// get no form, so the hook never fires for them.
+// get no form, so the hook never fires for them. The script forms of compiler
+// checks name the script's checks as {checks, script}: the hook acts on them
+// only when the script's tsc runs are those checks' runs, one each. With one
+// check they stay on its row (`scriptForms`); a chain's checks get a row for
+// the script, and their own rows (`part`) keep only their own forms.
 export function hookForms(config,configFile=defaultConfig){
-  const rows=[],redue=redueFor(configFile),pm=config?.packageManager;
-  for(const check of config?.checks||[]){
-    if(!(typecheck(check)||tests(check))||typeof check.name!=='string'||!safe.test(check.name))continue;
-    const forms=redue?[`${redue} run ${check.name}`]:[],local=[],dir=checkDir(check),script=checkScript(check);
+  const rows=[],redue=redueFor(configFile),pm=config?.packageManager,scripts=new Map();
+  const eligible=(config?.checks||[]).filter(check=>(typecheck(check)||tests(check))&&typeof check.name==='string'&&safe.test(check.name));
+  const groupOf=check=>tscCheck(check)&&typeof checkScript(check)==='string'&&checkDir(check)!==null?
+    JSON.stringify([checkDir(check),checkScript(check),workspaceName(check)]):null;
+  for(const check of eligible){const key=groupOf(check);if(key)scripts.set(key,[...scripts.get(key)||[],check.name]);}
+  const scriptRow=(dir,script,workspace)=>({forms:dir==='.'?scriptForms(pm,script):dir!==null&&safe.test(dir)?workspaceForms(pm,workspace,script):[],
+    local:dir!=='.'&&dir!==null&&safe.test(dir)?scriptForms(pm,script):[]});
+  for(const check of eligible){
+    const forms=redue?[`${redue} run ${check.name}`]:[],local=[],dir=checkDir(check),key=groupOf(check),
+      group=key?scripts.get(key):null,part=group?.length>1;
+    const own=group?null:checkScript(check);
     if(dir==='.'){
-      forms.push(...scriptForms(pm,script),...toolForms(pm,toolText(check)));
+      forms.push(...scriptForms(pm,own),...toolForms(pm,toolText(check)));
       if(!tests(check)&&Array.isArray(check.command)&&check.command.length&&
         check.command.every(v=>typeof v==='string'&&safe.test(v)&&!v.startsWith('@')))
         forms.push(check.command.join(' '));
     }else if(dir!==null&&safe.test(dir)){
-      forms.push(...workspaceForms(pm,workspaceName(check),script));
-      local.push(...scriptForms(pm,script),...(check.cwd===dir?toolForms(pm,toolText(check)):[]));
+      forms.push(...workspaceForms(pm,workspaceName(check),own));
+      local.push(...scriptForms(pm,own),...(check.cwd===dir?toolForms(pm,toolText(check)):[]));
     }
+    let extra={};
+    if(group&&!part){
+      const {forms:scriptOnly,local:scriptLocal}=scriptRow(dir,checkScript(check),workspaceName(check));
+      forms.splice(redue?1:0,0,...scriptOnly);local.unshift(...scriptLocal);
+      extra={checks:group,script:checkScript(check),scriptForms:[...scriptOnly,...scriptLocal]};
+    }
+    if(part)extra={part:true};
     if(forms.length||local.length)rows.push({check:check.name,kind:checkKind(check),dir,
-      forms:[...new Set(forms)],local:[...new Set(local)]});
+      forms:[...new Set(forms)],local:[...new Set(local)],...extra});
+  }
+  for(const [key,checks] of scripts){
+    if(checks.length<2)continue;
+    const [dir,script,workspace]=JSON.parse(key),{forms,local}=scriptRow(dir,script,workspace);
+    if(forms.length||local.length)rows.push({check:checks[0].replace(/\.\d+$/,''),checks,script,
+      scriptForms:[...forms,...local],kind:'typecheck',dir,forms,local});
   }
   return rows;
 }
+// The checks a compiler script row runs, in the order of the script's runs in
+// the package's package.json now; null when they no longer correspond (the
+// script changed since init), so the hook leaves the command alone.
+export function scriptChecks(row,config,projectRoot){
+  let scripts;try{scripts=JSON.parse(fs.readFileSync(path.join(projectRoot,row.dir,'package.json'),'utf8')).scripts;}catch{return null;}
+  if(scripts?.['pre'+row.script]||scripts?.['post'+row.script])return null;
+  const args=name=>config.checks.find(check=>check.name===name)?.command?.slice(2);
+  return scriptRunChecks(scripts?.[row.script],row.checks.map(name=>({name,args:args(name)})));
+}
 
 // A turbo or `pnpm -r` command that runs one task in every workspace package:
 // {tool, task}. No filters and no nx: both can add packages or tasks that only
@@ -166,10 +203,17 @@ export async function fanoutChecks(fan,config,projectRoot){
     return null;
   const names=[];
   for(const item of packages){
-    const check=config.checks.find(c=>(typecheck(c)||tests(c))&&typeof c.name==='string'&&
+    const own=config.checks.filter(c=>(typecheck(c)||tests(c))&&typeof c.name==='string'&&
       workspaceName(c)===item.name&&checkScript(c)===fan.task&&checkDir(c)===item.dir);
-    if(!check)return null;
-    names.push(check.name);
+    if(!own.length)return null;
+    // A compiler script's checks: one per tsc run it has now.
+    if(own.every(tscCheck)){
+      const ordered=scriptRunChecks(item.scripts[fan.task],own.map(c=>({name:c.name,args:c.command.slice(2)})));
+      if(!ordered)return null;
+      names.push(...ordered);continue;
+    }
+    if(own.length!==1)return null;
+    names.push(own[0].name);
   }
   return names;
 }
@@ -199,18 +243,23 @@ function matched(command,config,configFile,dir='.',scripts={}){
         return scripts['pre'+name]||scripts['post'+name]?null:{fanout:fanout(text.trim()),rest:parts.rest};
     if(fanout(parts.base))return {fanout:fanout(parts.base),rest:parts.rest};
   }
-  const check=hookForms(config,configFile).find(row=>dir==='.'?row.forms.includes(parts.base):
-    row.dir===dir&&row.local.includes(parts.base))?.check;
-  return check?{check,rest:parts.rest}:null;
+  const row=hookForms(config,configFile).find(row=>dir==='.'?row.forms.includes(parts.base):
+    row.dir===dir&&row.local.includes(parts.base));
+  // A script form of compiler checks is checked against the script first.
+  return row?.scriptForms?.includes(parts.base)?{row,rest:parts.rest}:row?{check:row.check,rest:parts.rest}:null;
 }
-export function matchCheck(command,config,configFile,dir,scripts){return matched(command,config,configFile,dir,scripts)?.check||null;}
-// The same check through REDUE, keeping the output suffix; null if it already
-// is, or if more commands follow it.
+export function matchCheck(command,config,configFile,dir,scripts){
+  const match=matched(command,config,configFile,dir,scripts);
+  return match?.row?match.row.checks.join(' && '):match?.check||null;
+}
+// The same check (or checks, in order) through REDUE, keeping the output
+// suffix; null if it already is, or if more commands follow it.
 export function recordedCommand(command,name,configFile=defaultConfig){
+  const names=Array.isArray(name)?name:[name];
   const parts=split(command),redue=redueFor(configFile);
-  if(!parts||parts.rest!==null||!safe.test(name)||!redue)return null;
-  const run=`${redue} run ${name}`;
-  return parts.base===run?null:run+parts.suffix;
+  if(!parts||parts.rest!==null||!names.length||!names.every(value=>safe.test(value))||!redue)return null;
+  const run=names.map(value=>`${redue} run ${value}`).join(' && ');
+  return parts.base===run?null:names.length>1&&parts.suffix?`(${run})${parts.suffix}`:run+parts.suffix;
 }
 
 // A leading `cd DIR;` or `cd DIR &&`, which agents often add before a check:
@@ -277,9 +326,11 @@ export function statusTimeout(status,name){
     Math.min(run.durationMs/2,10000):2000;
 }
 // From the observer's last published status, which is small, not the receipts.
-export function lastRunTimeout(config,parsed,name){
+// The longest wait among `names`, read once.
+export function lastRunTimeout(config,parsed,...names){
   try{const root=realObservedPath(path.resolve(path.dirname(config),parsed.root||'.'));
-    return statusTimeout(JSON.parse(fs.readFileSync(path.join(projectState(root,config),'status.json'),'utf8')),name);}
+    const status=JSON.parse(fs.readFileSync(path.join(projectState(root,config),'status.json'),'utf8'));
+    return Math.max(...names.map(name=>statusTimeout(status,name)));}
   catch{return 2000;}
 }
 
@@ -329,10 +380,34 @@ export async function claudeHook(input,{entry,timeout}){
   if(match.fanout){
     const names=await fanoutChecks(match.fanout,parsed,project.projectRoot);
     if(!names)return null;
-    const status=await synchronizedStatus(entry,config,root,timeout??Math.max(...names.map(name=>lastRunTimeout(config,parsed,name)))),
+    const status=await synchronizedStatus(entry,config,root,timeout??lastRunTimeout(config,parsed,...names)),
       reason=fanoutVerdict(status,names,match.rest);
     return reason?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'deny',permissionDecisionReason:reason}}:null;
   }
+  // The configured config path as the command's directory sees it.
+  // Both sides resolved alike: Windows can spell the same directory RUNNER~1 or by its long name.
+  const configPath=!entered.prefix?record.config:
+    path.relative(path.join(project.projectRoot,entered.dir),realObservedPath(config)).split(path.sep).join('/');
+  // A compiler script: its checks in the order of its runs, or nothing when
+  // they no longer correspond. One run is an ordinary check. A chain is
+  // skipped when every run is CURRENT, else the runs that are not run through
+  // redue run, in order.
+  if(match.row){
+    const names=scriptChecks(match.row,parsed,project.projectRoot);
+    if(!names)return null;
+    if(names.length===1)match.check=names[0];
+    else{
+      const status=await synchronizedStatus(entry,config,root,timeout??lastRunTimeout(config,parsed,...names)),
+        reason=fanoutVerdict(status,names,match.rest);
+      if(reason)return {hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'deny',permissionDecisionReason:reason}};
+      const pending=names.filter(name=>!verdict(status,name));
+      const rewritten=status?.schema===1&&status.observation?.healthy===true&&Array.isArray(status.checks)&&
+        names.every(name=>status.checks.some(item=>item?.name===name))?recordedCommand(entered.command,pending,configPath):null;
+      return rewritten?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'allow',
+        permissionDecisionReason:`REDUE: ${pending.map(name=>JSON.stringify(name)).join(', ')} of this script's checks ${pending.length===1?'is':'are'} not CURRENT; running ${pending.length===1?'it':'them'} through redue run so the result is recorded.`,
+        updatedInput:{...input.tool_input,command:entered.prefix+rewritten}}}:null;
+    }
+  }
   const name=match.check,status=await synchronizedStatus(entry,config,root,timeout??lastRunTimeout(config,parsed,name)),
     reason=verdict(status,name,match.rest);
   if(reason)return {hookSpecificOutput:{hookEventName:'PreToolUse',
@@ -342,9 +417,7 @@ export async function claudeHook(input,{entry,timeout}){
   // stays too: the rewrite returns "allow", which would also skip the prompt
   // for the rest of the chain.
   const rewritten=status?.schema===1&&status.observation?.healthy===true&&Array.isArray(status.checks)&&
-    status.checks.some(item=>item?.name===name)?recordedCommand(entered.command,name,
-      // Both sides resolved alike: Windows can spell the same directory RUNNER~1 or by its long name.
-      !entered.prefix?record.config:path.relative(path.join(project.projectRoot,entered.dir),realObservedPath(config)).split(path.sep).join('/')):null;
+    status.checks.some(item=>item?.name===name)?recordedCommand(entered.command,name,configPath):null;
   // updatedInput replaces the whole tool input. Deny and ask rules still apply
   // to the rewritten command; "allow" skips only the prompt.
   return rewritten?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'allow',

package/src/cli.mjs

@@ -4,7 +4,7 @@ import fs from 'node:fs';
 import {directQualification,directInterpretation,observedNpmContext} from './direct-typescript.mjs';
 import {directRunCertificateAllowed,directRunCertificate,directRunRecordable,directRunRecording,probeQuestions,validateRunRecord} from './direct-run-certificate.mjs';
 import {runFactChange} from './typescript-list.mjs';
-import {changedFiles,coverageReadable,gitIgnored,recordedEnvironment,testProject,testEnvironmentIssue,testGuardConfig,testRunGuard,testsInterpretation,testsQualification} from './test-direct.mjs';
+import {changedFiles,coverageReadable,gitIgnored,recordedEnvironment,testEnvironmentIssue,testGuardConfig,testRunGuard,testRunFacts,sharedInstalledFile,testsInterpretation,testsQualification} from './test-direct.mjs';
 import path from 'node:path';
 import net from 'node:net';
 import os from 'node:os';
@@ -273,14 +273,17 @@ async function execute() {
       ...command.slice(1)]:command;
     // A test run's processes record what the guard checks (test-recorder.cjs).
     const testRun=selected.qualification===testsQualification&&['darwin','linux'].includes(process.platform);
-    let testRecord=null,launchEnv=process.env;
+    let testRecord=null,launchEnv=process.env,testFacts={};
     if(testRun){
+      // The package directory and installed node_modules, as the plan has them.
+      try{testFacts=testRunFacts(root,selected);}
+      catch(e){captureIssues.push(`test run facts unavailable (${e.code||e.message})`);}
       const environmentIssue=testEnvironmentIssue();
       if(environmentIssue)captureIssues.push(environmentIssue);
       testRecord=path.join(state,`test-record-${runId}`);
       fs.mkdirSync(testRecord,{mode:0o700});
       const guardFile=path.join(testRecord,'guard.json');
-      fs.writeFileSync(guardFile,JSON.stringify(testGuardConfig(testRecord,root)),{mode:0o600});
+      fs.writeFileSync(guardFile,JSON.stringify(testGuardConfig(testRecord,root,process.env,testFacts)),{mode:0o600});
       launchEnv=recordedEnvironment(guardFile);
     }
     let runnerPid=null;
@@ -354,10 +357,12 @@ async function execute() {
     }else if(!unobservedDirectRun&&!recording)probeAfter=probeHash(probePlan);
     let guard=null;
     if(testRecord){
-      let coverage=null;try{coverage=coverageReadable(root,testProject(root,selected.script));}catch{}
+      let coverage=null;try{coverage=coverageReadable(root,testFacts);}catch{}
       guard=testRunGuard(testRecord,{root,sourcePatterns:plan.sourcePatterns||plan.patterns,files:snap?.files,
         runner:runnerPid,environment:selected.environment||{},coverage});
       runFacts=guard.runFacts;
+      const shared=sharedInstalledFile(root,testFacts,path.join(state,'pnpm-store-links-v1.json'));
+      if(shared)guard.issues.push(`installed file ${shared.file} ${shared.reason}; a change through it is not observed`);
       fs.rmSync(testRecord,{recursive:true,force:true});
     }
     // The daemon reads the recording from owned state; control requests are small.

package/src/daemon.mjs

@@ -20,7 +20,9 @@ import {inputKey,planGuard,toolchainKey} from './decision-validation.mjs';
 import {queriesHold,runFactReason as runFactChanged} from './typescript-list.mjs';
 import {nextProbeHint,probeDeadline,probeFloorMs} from './probe-deadline.mjs';
 import {statusSummary} from './cached-state.mjs';
-import {directProject,directProbeValue,reviewedTypeScriptVersions} from './direct-typescript.mjs';
+import {directProject,directProbeValue} from './direct-typescript.mjs';
+import {npmCacheDir} from './npm-integrity.mjs';
+import {runFromArgv} from './typescript-invocation.mjs';
 import {buildInfoPath,recordedCertificate} from './direct-run-certificate.mjs';
 import {timing,mark,traceBase,traceContext,traceScope,traceEnvironment,traceId} from './decision-profile.mjs';
 
@@ -130,7 +132,7 @@ function continuityBarrier() {
 // The basis a full direct probe is checked against: plan guard, observation
 // continuity, and the compiler tree and Node identity taken before the probe.
 function certificateBasis(row) {
-  const argv=row.plan.probes[0],compiler=directProject(argv[2],argv[3],{verify:false});
+  const argv=row.plan.probes[0],compiler=directProject(argv[2],runFromArgv(argv.slice(3)),{verify:false});
   return {guard:planGuard(index.bundle),gaps:metrics.gaps,
     compiler:JSON.stringify([compiler.tsRoot,compiler.entry,compiler.digest]),
     toolchain:toolchainKey(compiler.tsRoot,argv[0])};
@@ -238,8 +240,18 @@ function probe(row,allowReuse=false,{launch=true}={}) {
         .includes(row.plan.qualification)?
         /VSTATE_REASON:([a-z-]+)/.exec(out.stderr?.toString()||'')?.[1]:null;
       const explanations={
-        'direct-typescript-implementation-unreviewed':'installed TypeScript bytes or membership differ from the reviewed compiler',
-        'direct-typescript-version-unsupported':`direct compiler recipe supports reviewed TypeScript ${reviewedTypeScriptVersions.join(', ')} only`,
+        'direct-typescript-implementation-unreviewed':'installed TypeScript files differ from the reviewed compiler or from the tarball package-lock.json names',
+        'direct-typescript-version-unsupported':'direct compiler recipe supports TypeScript 5.x and 6.0',
+        'direct-typescript-lockfile-source-unsupported':'package-lock.json installs TypeScript from somewhere other than the registry\'s typescript package (an alias, a file or a git source)',
+        'npm-shrinkwrap-unsupported':'npm-shrinkwrap.json is not read; the reviewed TypeScript releases still qualify',
+        'direct-typescript-lockfile-integrity-missing':'package-lock.json records no integrity for the installed TypeScript',
+        'direct-typescript-lockfile-version-differs':'installed TypeScript version differs from package-lock.json; run npm ci',
+        'npm-lockfile-unreadable':'package-lock.json cannot be read',
+        'npm-lockfile-integrity-unsupported':'package-lock.json records TypeScript integrity with neither sha512 nor sha1',
+        'npm-tarball-uncached':`the TypeScript tarball package-lock.json names is not in npm's cache (${npmCacheDir(root)}); run npm ci or npm cache add`,
+        'npm-tarball-corrupt':"npm's cached TypeScript tarball does not match its integrity",
+        'npm-tarball-invalid':"npm's cached TypeScript tarball cannot be read",
+        'npm-tarball-link-unsupported':"npm's cached TypeScript tarball holds links",
         'direct-execution-environment-unsupported':'direct compiler rejects development helpers, Node cache/preloads, and unreviewed runtime overrides',
         'direct-node-version-unsupported':'direct compiler recipe supports Node 22 and 24',
         'npm-launcher-unobserved-inputs':'npm launcher uses unobserved notifier inputs; execution is recording-only',
@@ -271,7 +283,7 @@ function probe(row,allowReuse=false,{launch=true}={}) {
         'workspace-typecheck-contract-unavailable':'workspace TypeScript applicability probe could not establish inputs'
         ,'pnpm-execution-environment-unsupported':'pnpm or Node launcher environment override needs review'
         ,'pnpm-distribution-unobservable':'pnpm executable contents cannot be observed'
-        ,'pnpm-version-mismatch':'pnpm executable differs from the pinned version'
+        ,'pnpm-version-mismatch':'pnpm executable differs from the installed version'
         ,'typescript-input-outside-pnpm-contract':'TypeScript reads outside the selected workspace, linked outputs, or installed inputs'
         ,'pnpm-input-coverage-unavailable':'pnpm installed-input coverage became unavailable; inspect check details'
         ,'pnpm-typecheck-contract-unavailable':'pnpm TypeScript input contract could not be established'
@@ -492,7 +504,7 @@ function adopt(name,row,token) {
     return done('inputs or certificate changed during the run');
   const cache=pending.cache,argv=row.plan.probes[0];
   let result;
-  try{result=recordedCertificate(text,cache,directProject(argv[2],argv[3],{verify:false}),buildInfoPath(row.plan));}
+  try{result=recordedCertificate(text,cache,directProject(argv[2],runFromArgv(argv.slice(3)),{verify:false}),buildInfoPath(row.plan));}
   catch{return done('recording unreadable');}
   if(result.issue)return done(result.issue);
   const identities=new Map(cache.identities);
@@ -1217,7 +1229,9 @@ const server=net.createServer(client=>{
     event('control_reply_unavailable',{classification:handled?'closed_without_reply':
       'closed_before_request',request_bytes:text.length});});
   client.on('data',d=>{
-    if(handled)return;text+=d;if(text.length>4096){event('control_request_rejected',
+    // A sync request carries each check's context digests, about 1.5 KB per
+    // check; 1 MiB leaves room for hundreds of checks.
+    if(handled)return;text+=d;if(text.length>1024*1024){event('control_request_rejected',
       {classification:'request_too_large',request_bytes:text.length});client.destroy();return;}
     if(!text.includes('\n'))return;handled=true;
     try{const message=JSON.parse(text);

package/src/declared-plan.mjs

@@ -6,9 +6,10 @@ import {createHash} from 'node:crypto';
 import {permittedRoots,resolveDeclaredInstalled} from './installed-inputs.mjs';
 import {qualifyTypeScript} from './typescript-qualification.mjs';
 import {directBuildInfo} from './direct-typescript.mjs';
-import {qualifyTests,testsQualification} from './test-direct.mjs';
+import {qualifyTests,testWorkspacePatterns,testsQualification} from './test-direct.mjs';
 import {yarnWorkspaceTypecheckInputs} from './yarn-workspace-inputs.mjs';
 import {pnpmTypecheckInputs} from './pnpm-inputs.mjs';
+import {checkRun} from './typescript-invocation.mjs';
 import {observedRelative,withinPath,realObservedPath} from './path-identity.mjs';
 import {timing} from './decision-profile.mjs';
 
@@ -64,8 +65,7 @@ export function discoverDeclared(config) {
       catch(e){workspaceIssue=e.message;}
     }
     if(selected.qualification==='pnpm-tsc-v1'){
-      try{workspace=pnpmTypecheckInputs(root,selected.workspace||'.',
-        selected.script||selected.command.at(-1));}
+      try{workspace=pnpmTypecheckInputs(root,selected.workspace||'.',checkRun(selected));}
       catch(e){workspaceIssue=e.message;}
     }
     timing('plan.workspace_inputs',workspaceStarted,{available:workspace?1:0});
@@ -75,7 +75,7 @@ export function discoverDeclared(config) {
     // until then the run reports the unexpected write and is not reusable.
     let buildInfo=null;
     if(selected.qualification==='npm-typescript-direct-v1')
-      try{buildInfo=directBuildInfo(root,selected.script);}catch{}
+      try{buildInfo=directBuildInfo(root,checkRun(selected));}catch{}
     const excluded=buildInfo?['!'+buildInfo]:[];
     const installedStarted=performance.now();
     const installed=resolveDeclaredInstalled(root,
@@ -92,6 +92,13 @@ export function discoverDeclared(config) {
       ...(workspaceIssue?[workspaceIssue]:[])];
     for(const item of workspace?.configurationInputs||[])configurationInputs.add(item);
     for(const item of workspace?.workspacePatterns||[])workspacePatterns.add(item);
+    // A workspace test check is qualified against the current package list: a
+    // package manifest appearing or pnpm's package list changing re-plans.
+    if(selected.qualification===testsQualification&&selected.workspace)try{
+      for(const item of testWorkspacePatterns(root,JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'))))
+        workspacePatterns.add(item);
+      if(fs.existsSync(path.join(root,'pnpm-workspace.yaml')))configurationInputs.add('pnpm-workspace.yaml');
+    }catch{}
     for(const item of workspace?.closure||[])workspaceManifests.add(item.manifest);
     if(!automatic)for(const category of ['source','generated','installedDependencies',
       'environment','toolchain','runtime'])if(!selected.coverage?.[category])

package/src/direct-typescript-probe.mjs

@@ -4,18 +4,20 @@ import {typeScriptInputFacts} from './typescript-input-facts.mjs';
 import {contextOnly,probeResult} from './probe-result.mjs';
 import {realObservedPath} from './path-identity.mjs';
 import {timing} from './decision-profile.mjs';
+import {runArgv,runFromArgv} from './typescript-invocation.mjs';
 try{
-  const [rootArg,script]=process.argv.slice(2),root=realObservedPath(rootArg);
+  const [rootArg,...rest]=process.argv.slice(2).filter(value=>!value.startsWith('--redue-')),root=realObservedPath(rootArg);
+  const run=runFromArgv(rest),script=runArgv(run).join(' ');
   // Verify all installed implementation bytes before loading compiler API/code,
   // including the optimized context-only path. A version label is insufficient.
   const implementationStarted=performance.now();
-  const compiler=directProject(root,script);
+  const compiler=directProject(root,run);
   timing('direct_probe.implementation',implementationStarted,{version:compiler.version});
   const context={interpretation:directInterpretation,compiler:compiler.digest,
     entry:compiler.entry,node:[realObservedPath(process.execPath),process.version]};
   const contextHash=directContextHash(compiler,context.node);
   if(!contextOnly(contextHash)){
-    const {queries,configs,files,buildInfo}=typeScriptInputFacts(root,compiler.tsRoot,compiler.entry);
+    const {queries,configs,files,buildInfo}=typeScriptInputFacts(root,compiler.tsRoot,compiler.entry,compiler.config);
     const layout={root,script,configs,files,context,...(buildInfo?{buildInfo}:{})};
     probeResult(directProbeOutput(layout),contextHash,queries,layout);
   }

package/src/direct-typescript.mjs

@@ -3,7 +3,9 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {createRequire} from 'node:module';
-import {realObservedPath,withinPath} from './path-identity.mjs';
+import {racyUntil,realObservedPath,withinPath} from './path-identity.mjs';
+import {cachedTarball,lockedPackage,matchTarball,npmCacheDir,registryPackage,tarballFiles} from './npm-integrity.mjs';
+import {runConfig,tscRun} from './typescript-invocation.mjs';
 export const directInterpretation='npm-direct-typescript@1';
 export const directQualification='npm-typescript-direct-v1';
 const reviewed={
@@ -60,8 +62,9 @@ export function directCompiler(root,{verify=true}={}){
   const tsRoot=path.dirname(realObservedPath(manifest));
   if(!withinPath(tsRoot,root)||tsRoot!==realObservedPath(path.join(root,'node_modules/typescript')))
     fail('direct-typescript-layout-unsupported');
-  const version=JSON.parse(fs.readFileSync(manifest)).version,spec=reviewed[version];
-  if(!spec)fail('direct-typescript-version-unsupported');
+  const version=JSON.parse(fs.readFileSync(manifest)).version;
+  if(!reviewed[version])return lockedCompiler(root,tsRoot,version,verify);
+  const spec=reviewed[version];
   if(verify){
     const files=[];
     const walk=(dir,relative='')=>{
@@ -78,6 +81,42 @@ export function directCompiler(root,{verify=true}={}){
   }
   return {tsRoot,version,entry:path.join(tsRoot,spec.entry),digest:spec.digest};
 }
+// A TypeScript 5.x or 6.0 the lockfile records: the installed package must be
+// the registry's `typescript` at that version, holding exactly the files of
+// the tarball npm cached under the lockfile's integrity. Its identity is that
+// integrity. The entry is lib/_tsc.js where the package has one (5.7 and
+// later), as for the reviewed versions, else lib/tsc.js. A verified tree is
+// remembered per process while its files keep their identity.
+const verifiedTrees=new Map();
+function treeIdentity(tsRoot){
+  const parts=[],now=Date.now();
+  const walk=folder=>{for(const entry of fs.readdirSync(folder,{withFileTypes:true})){
+    const full=path.join(folder,entry.name),st=fs.lstatSync(full,{bigint:true});
+    if(racyUntil(st)>now)return null;
+    parts.push([full,st.dev,st.ino,st.size,st.mtimeNs,st.ctimeNs].join(':'));
+    if(entry.isDirectory()&&walk(full)===null)return null;
+  }};
+  try{if(walk(tsRoot)===null)return null;}catch{return null;}
+  return hash(parts.sort().join('\n'));
+}
+function lockedCompiler(root,tsRoot,version,verify){
+  if(!/^(?:5\.\d+|6\.0)\.\d+$/.test(version))fail('direct-typescript-version-unsupported');
+  let locked;try{locked=lockedPackage(root,'typescript');}
+  catch(e){fail(['npm-lockfile-unreadable','npm-shrinkwrap-unsupported'].includes(e.code)?e.code:'direct-typescript-lockfile-integrity-missing');}
+  if(locked.version!==version)fail('direct-typescript-lockfile-version-differs');
+  if(!registryPackage(locked,'typescript',version)||
+    JSON.parse(fs.readFileSync(path.join(tsRoot,'package.json'),'utf8')).name!=='typescript')
+    fail('direct-typescript-lockfile-source-unsupported');
+  if(verify){
+    const tree=treeIdentity(tsRoot);
+    if(!tree||verifiedTrees.get(locked.integrity)!==tree){
+      matchTarball(tsRoot,tarballFiles(cachedTarball(npmCacheDir(root),locked.integrity)));
+      if(tree)verifiedTrees.set(locked.integrity,tree);
+    }
+  }
+  const entry=fs.existsSync(path.join(tsRoot,'lib','_tsc.js'))?'lib/_tsc.js':'lib/tsc.js';
+  return {tsRoot,version,entry:path.join(tsRoot,entry),digest:hash('npm-integrity\0'+locked.integrity)};
+}
 // The direct probe's output: root, script, configuration and program files with
 // their byte digests, and the execution context. A recorded run rebuilds it from
 // the same layout (direct-run-certificate.mjs).
@@ -101,13 +140,16 @@ export function buildInfoFor(ts,options,root) {
   if(!relative.endsWith('.tsbuildinfo')||/[*?[\]{}()!+@,]/.test(relative))return {issue:'typescript-buildinfo-name-unsupported'};
   return {file:relative};
 }
+// The config a run's arguments name, relative to the root, or null.
+export const directConfig=(root,args)=>runConfig(root,args);
 // The plan's build-info file, or null. The compiler is loaded only when the
-// root config sets incremental or extends another config.
-export function directBuildInfo(root,script) {
-  const config=path.join(root,'tsconfig.json');
+// run's config sets incremental or extends another config.
+export function directBuildInfo(root,run) {
+  const name=directConfig(root,run.args);if(!name)return null;
+  const config=path.join(root,name);
   let raw;try{raw=fs.readFileSync(config,'utf8');}catch{return null;}
   if(!/"(?:incremental|extends)"\s*:/.test(raw))return null;
-  const compiler=directProject(root,script,{verify:false}),ts=createRequire(import.meta.url)(compiler.tsRoot);
+  const compiler=directProject(root,run,{verify:false}),ts=createRequire(import.meta.url)(compiler.tsRoot);
   const parsed=ts.getParsedCommandLineOfConfigFile(config,{},{...ts.sys,onUnRecoverableConfigFileDiagnostic(){}});
   return parsed?.options?.composite?null:buildInfoFor(ts,parsed?.options,root).file??null;
 }
@@ -120,16 +162,21 @@ export function directContextHash(compiler,node){
   return hash(JSON.stringify({interpretation:directInterpretation,compiler:compiler.digest,
     entry:compiler.entry,node}));
 }
-export function directProject(root,script,{verify=true}={}){
+// The compiler for one check run {script, part, args}: script null for a
+// check init proposed without one. The run must pass --noEmit and name a
+// config inside the root.
+export function directProject(root,run,{verify=true}={}){
   const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json')));
   if(pkg.workspaces||pkg.packageManager&&!/^npm@/.test(pkg.packageManager)||
     !['package-lock.json','npm-shrinkwrap.json'].some(file=>fs.existsSync(path.join(root,file)))||
     ['yarn.lock','pnpm-lock.yaml','bun.lock','bun.lockb'].some(file=>fs.existsSync(path.join(root,file))))
     fail('direct-npm-project-unsupported');
-  if(pkg.scripts?.[script]?.trim()!=='tsc --noEmit'||pkg.scripts?.['pre'+script]||pkg.scripts?.['post'+script])
-    fail('typecheck-script-changed');
+  const own=tscRun(pkg.scripts,run).run;
+  if(!own?.noEmit)fail('typecheck-script-changed');
+  const config=directConfig(root,run.args);
+  if(!config||!fs.existsSync(path.join(root,config)))fail('typescript-config-unavailable');
   const issue=directEnvironmentIssue();if(issue)fail(issue);
-  return directCompiler(root,{verify});
+  return {...directCompiler(root,{verify}),config};
 }
 // Provenance only: retain a digest, never proxy URLs/credentials or a raw dump.
 // No npm process runs in this recipe; these keys are not compiler applicability.

package/src/glob.mjs

@@ -7,3 +7,11 @@ export default {
   matcher(pattern,options){return picomatch(pattern,options);},
   isMatch(file,patterns,options){return picomatch(patterns,options)(file);}
 };
+// A matcher for a pattern list with `!` exclusions: a path matches when a
+// positive pattern does and no excluded one does. A plain list match would
+// take any `!` pattern as matching everything else.
+export function patternMatcher(patterns){
+  const positive=patterns.filter(p=>!p.startsWith('!')).map(p=>picomatch(p,{dot:true}));
+  const negative=patterns.filter(p=>p.startsWith('!')).map(p=>picomatch(p.slice(1),{dot:true}));
+  return file=>positive.some(fn=>fn(file))&&!negative.some(fn=>fn(file));
+}

package/src/index.mjs

@@ -42,24 +42,33 @@ const pathPrefixes = rel => {
 // tick at the same size; such files are tracked in `racy`, and the daemon waits
 // the window out and records them again before it writes a run checkpoint.
 const identity=st=>identityFields.map(key=>String(st[key])).join(':');
+// An installed link to a directory (pnpm links every package this way) is
+// observed by its link chain alone, when `observedDir` says the directory it
+// resolves to is itself observed installed: its own entries carry its contents.
 function fileHash(root, rel,installed=false,before=fs.lstatSync(path.join(root,rel),
-  {bigint:true})) {
+  {bigint:true}),observedDir=null) {
   const file=path.join(root, rel);
   let value,references=[],bytes=installed?0:Number(before.size),racy=0;
   if(before.isSymbolicLink()){
     const resolution=resolveLinks(file,root,[],true);
     if(!resolution.physical)throw Error(`symlink input target observation unavailable: ${rel}: ${resolution.reason}`);
     const target=fs.statSync(resolution.physical,{bigint:true});
-    if(!target.isFile())throw Error(`directory input symlink unsupported: ${rel}`);
-    if(installed)racy=racyUntil(target);else bytes=Number(target.size);
-    value='link:'+JSON.stringify(resolution.links)+':'+(installed?'stat:'+identity(target):
-      target.mode+':'+hashRegular(resolution.physical).hash);
+    const physical=path.relative(root,resolution.physical).split(path.sep).join('/');
+    const directory=target.isDirectory()&&installed&&observedDir?.(physical);
+    if(!target.isFile()&&!directory)throw Error(`directory input symlink unsupported: ${rel}`);
+    if(directory)value='dirlink:'+JSON.stringify(resolution.links)+':'+physical;
+    else{
+      if(installed)racy=racyUntil(target);else bytes=Number(target.size);
+      value='link:'+JSON.stringify(resolution.links)+':'+(installed?'stat:'+identity(target):
+        target.mode+':'+hashRegular(resolution.physical).hash);
+    }
     references=[...new Set([...resolution.links.map(link=>path.relative(root,link.path)
       .split(path.sep).join('/')),path.relative(root,resolution.physical)
       .split(path.sep).join('/')])];
-    const targetAfter=fs.statSync(resolution.physical,{bigint:true});
-    for(const key of identityFields)
-      if(target[key]!==targetAfter[key])throw Error(`input changed during inspection: ${rel}`);
+    // A directory's own timestamps follow its entries, which are observed separately.
+    if(!directory){const targetAfter=fs.statSync(resolution.physical,{bigint:true});
+      for(const key of identityFields)
+        if(target[key]!==targetAfter[key])throw Error(`input changed during inspection: ${rel}`);}
     const resolutionAfter=resolveLinks(file,root,[],true);
     if(resolutionAfter.physical!==resolution.physical||
       JSON.stringify(resolutionAfter.links)!==JSON.stringify(resolution.links))
@@ -181,7 +190,14 @@ export class InputIndex {
     catch(e){if(e.code!=='ENOENT'){this.unavailable=String(e);return false;}}
     if(stat&&(stat.isFile()||stat.isSymbolicLink())) {
       const installed=this.installedPath(rel);
-      try{const started=performance.now();inspection=fileHash(this.root,rel,installed,stat);
+      try{const started=performance.now();
+        // A linked directory counts as observed only strictly inside an
+        // installed root, and only if every check matching the link also
+        // observes the directory's own files (its package.json stands for them).
+        const observedDir=installed?physical=>!this.includeInstalled&&
+          [...this.installedRootSet].some(root=>physical.startsWith(root+'/'))&&
+          matched.every(name=>this.matches(this.checks.get(name),physical+'/package.json')):null;
+        inspection=fileHash(this.root,rel,installed,stat,observedDir);
         fresh=inspection.hash;
         this.profile.hashingMs+=performance.now()-started;
         this.rehashedFiles++;this.rehashedBytes+=inspection.bytes;}
@@ -302,9 +318,10 @@ export class InputIndex {
     const full=path.join(this.root,rel);
     let subtree=false;
     try {
-      if(fs.lstatSync(full).isSymbolicLink()&&fs.statSync(full).isDirectory()){
-        this.unavailable=`directory symlink input unsupported: ${rel}`;return;}
-      if(fs.statSync(full).isDirectory()) {this.scanSubtree(rel);subtree=true;}
+      // A link is an entry of its own: record() accepts an observed installed
+      // directory link and refuses any other.
+      if(fs.lstatSync(full).isSymbolicLink())this.record(rel);
+      else if(fs.statSync(full).isDirectory()) {this.scanSubtree(rel);subtree=true;}
       else this.record(rel);
     } catch(e) {
       if(e.code==='ENOENT') {

package/src/installed-inputs.mjs

@@ -84,6 +84,10 @@ export function resolveDeclaredInstalled(root,patterns,allowed=[]) {
     if(!resolved.physical){
       if(resolved.reason==='resolved target missing'&&!resolved.links.length){
         internal.add(pattern);continue;}
+      // An exclusion of a path that does not exist yet, through links (a runner
+      // cache inside a linked package): exclude it where the links lead.
+      if(negative&&resolved.reason==='resolved target missing'&&resolved.prospective&&within(resolved.prospective,root)){
+        internal.add('!'+posix(path.relative(root,resolved.prospective))+(suffix?'/'+suffix:''));continue;}
       result.unresolved.push(`${prefix}: ${resolved.reason}`);continue;
     }
     const boundary=within(resolved.physical,root)?root: