@redue/cli 0.1.0-alpha.17 → 0.1.0-alpha.18

package/CHANGELOG.md

@@ -1,5 +1,63 @@
 # Changelog
 
+## 0.1.0-alpha.18 — 2026-10-23
+
+Typecheck in more project shapes, and pnpm test reuse on Linux. In the census
+of 108 public TypeScript repos, the ones `init` makes ready went from 8 to 11
+for typecheck (the census clones each repo's current head, so one or two
+repos move between runs) and stayed at 22 for tests.
+
+- pnpm test checks are reused on Linux. A recorded run accepts an installed
+  file hard-linked into the pnpm store the install recorded, when the store
+  holds it at its content address (pnpm names store files by their sha512).
+  Links anywhere else stay UNVERIFIED. Each file is hashed once; REDUE keeps
+  its identity and store path in its state and hashes it again only when the
+  identity changes. A 46 MB install takes about 160 ms to check the first
+  time. Limit: an in-place edit of an installed file in another project that
+  shares the store file is not seen until the next recorded run.
+
+- Typecheck scripts in more shapes. A script of `tsc --noEmit` runs with
+  `-p`/`--project`, `--skipLibCheck` or `--pretty`, in any argument order,
+  qualifies for the direct npm recipe and the pnpm contract. A chain of such
+  runs joined by `&&` becomes one check per run (`typecheck.1`,
+  `typecheck.2`); the hook skips the script only when every run is CURRENT
+  and otherwise runs the stale ones through `redue run`. `check-types` joins
+  the recognized script names.
+- The hook acts on a typecheck script's form only while the script in
+  package.json still has exactly the configured `tsc` runs. Before, a script
+  changed to `tsc --noEmit && eslint .` was rewritten to `redue run
+  typecheck`, which ran tsc alone.
+- Without a typecheck script, `init` proposes a `tsc --noEmit` check for a
+  root `tsconfig.json` (direct npm recipe, pnpm) and for each pnpm workspace
+  package with one, unless a script runs a TypeScript checker in another form
+  (`tsc -b`, `vue-tsc`, ...). package.json is not changed; the check is
+  written only when the contract holds.
+- The pnpm contract no longer needs `include: ["src"]`. Its source inputs are
+  the directories the config's `include` covers, as TypeScript computes them
+  for new files, minus `node_modules`. `exclude` entries stay inputs, since an
+  import can still reach an excluded file. A config extended from an installed
+  package is an installed input.
+- Fixed: a config with three or more pnpm or test checks never got a
+  synchronized answer. The observer dropped control requests over 4 KB, and a
+  sync request carries about 1.5 KB of context digests per check; status
+  showed "Unexpected end of JSON input" for every check. The limit is 1 MiB.
+
+- The direct npm TypeScript recipe takes any TypeScript 5.x or 6.0, not only
+  the five reviewed releases. Another release qualifies when package-lock.json
+  records the registry's `typescript` at that version with an integrity
+  (sha512, or sha1 from registries that record only sha1), npm's cache holds
+  the tarball under it, and the installed package is exactly the tarball's
+  files. Nothing is downloaded; a missing tarball
+  keeps the check recording-only with `npm-tarball-uncached`. The check takes
+  about 100 ms per full probe (TypeScript 5.x and 6.0 tarballs, 120-140 files).
+  CI runs the direct contract suite against 5.0.4, 5.1.6, 5.2.2, 5.3.3, 5.4.5,
+  5.5.4, 5.7.3 and 5.8.3.
+
+- Contributors: `npm test` runs up to four test files at a time, keeping two
+  cores free (a 3-core CI macOS runner runs one at a time), and takes about
+  6 minutes on the owner's Mac (was 19.6). The two TypeScript 6 fixture
+  suites are separate files so they run side by side.
+
 ## 0.1.0-alpha.17 — 2026-10-22
 
 Workspaces and package managers beyond npm. In the census of 108 public

package/README.md

@@ -37,7 +37,7 @@ it; relevant source edits make it stale. [Run the reproducible demo](docs/contri
 
 ## Install the alpha
 
-The opt-in pilot uses **0.1.0-alpha.17**. Follow the
+The opt-in pilot uses **0.1.0-alpha.18**. Follow the
 [fixed-version pilot guide](docs/user/pilot.md) for supported projects, setup,
 updates and voluntary feedback. No external usage results are claimed yet.
 

package/bin/redue.mjs

@@ -4,6 +4,7 @@ import {mark,traceBase,traceContext,traceEnvironment,traceId} from '../src/decis
 traceBase({...traceContext(),request:traceId(),work:'client'});
 mark('client.loaded');
 import {directCompiler,directQualification,directEnvironment,directInterpretation} from '../src/direct-typescript.mjs';
+import {runArgv,tscRun} from '../src/typescript-invocation.mjs';
 import {testEnvironment,testRunnerAt,testsInterpretation,testsQualification} from '../src/test-direct.mjs';
 import os from 'node:os';
 import path from 'node:path';
@@ -256,8 +257,9 @@ const checks=publicConfig.checks.map(check=>{
   const yarnWorkspace=check.qualification==='yarn-workspace-tsc-v1';
   if(check.qualification&&!npmAutomatic&&!npmDirect&&!yarnWorkspace&&!pnpmTypecheck&&!testsDirect)
     error(`${check.name}: unknown qualification contract`);
-  if(npmDirect&&(manager!=='npm'||!check.script||check.cwd&&check.cwd!=='.'||
-    JSON.stringify(check.command)!==JSON.stringify(['@node','@typescript-compiler:.','--noEmit'])))
+  if(npmDirect&&(manager!=='npm'||check.cwd&&check.cwd!=='.'||!Array.isArray(check.command)||
+    check.command[0]!=='@node'||check.command[1]!=='@typescript-compiler:.'||
+    !tscRun({},{script:null,args:check.command.slice(2)}).run?.noEmit))
     error(`${check.name}: direct recipe requires its explicit local compiler command`);
   // The script's own arguments follow the runner; qualification compares them with the script.
   if(testsDirect&&(!['npm','pnpm','yarn'].includes(manager)||!check.script||check.cwd&&check.cwd!=='.'&&!check.workspace||!Array.isArray(check.command)||
@@ -270,22 +272,29 @@ const checks=publicConfig.checks.map(check=>{
     check.command[1]!=='workspace'||check.command[2]!==check.workspace||
     check.command[3]!=='run'))
     error(`${check.name}: Yarn workspace qualification needs its discovered workspace command`);
-  if(pnpmTypecheck&&(manager!=='pnpm'||!check.script||!check.command||
+  if(pnpmTypecheck&&(manager!=='pnpm'||!Array.isArray(check.command)||
     check.command[0]!=='@node'||
     check.command[1]!==`@typescript-bin:${check.cwd||'.'}`||
     check.workspace&&check.cwd==='.'||
-    !check.command.slice(2).every(value=>typeof value==='string'&&value)))
+    !tscRun({},{script:null,args:check.command.slice(2)}).run))
     error(`${check.name}: pnpm qualification needs its discovered standalone TypeScript command`);
   const reason=check.kind==='test'?'test runtime, transforms and cache inputs need review':
     check.kind==='lint'?'lint plugins, config and resolver inputs need review':
     check.kind==='build'?'build environment and generated inputs need review':
     'check inputs need review';
-  const autoProbes=npmDirect?[['@node','@vstate/direct-typescript-probe','@project',check.script]]:npmAutomatic?[['@node','@vstate/typescript-contract-probe',
+  // A chained script has one check per tsc run: each check's run counts them,
+  // so a run added to or removed from the script invalidates them all.
+  const runCount=(npmDirect||pnpmTypecheck)&&check.script?publicConfig.checks.filter(other=>
+    other.qualification===check.qualification&&other.script===check.script&&
+    (other.cwd||'.')===(check.cwd||'.')&&(other.workspace||null)===(check.workspace||null)).length:1;
+  if(runCount>16)error(`${check.name}: more than 16 checks for script ${check.script}`);
+  const run=npmDirect||pnpmTypecheck?runArgv({script:check.script??null,args:check.command.slice(2),count:runCount}):null;
+  const autoProbes=npmDirect?[['@node','@vstate/direct-typescript-probe','@project',...run]]:npmAutomatic?[['@node','@vstate/typescript-contract-probe',
     '@project',check.script,'@which:npm']]:yarnWorkspace?
     [['@node','@vstate/yarn-workspace-typecheck-probe','@project',
       check.workspace,check.command[4],'@which:yarn']]:pnpmTypecheck?
     [['@node','@vstate/pnpm-typecheck-probe','@project',
-      check.workspace||'.',check.script]]:[];
+      check.workspace||'.',...run]]:[];
   const windowsContext=process.platform==='win32'?
     ['ComSpec','COMSPEC','PATHEXT','USERPROFILE']:[];
   const autoEnvironment=npmDirect?directEnvironment:testsDirect?testEnvironment:npmAutomatic?{variables:['NODE_OPTIONS','NODE_PATH','CI','HOME',
@@ -310,6 +319,7 @@ const checks=publicConfig.checks.map(check=>{
     coverageReasons:check.coverageReasons||Object.fromEntries(
       categories.map(category=>[category,reason])),
     qualification:check.qualification||null,script:check.script||null,
+    ...(runCount>1?{runCount}:{}),
     ...(npmAutomatic?{qualificationInterpretation:'npm-launcher-withheld@1'}:{}),
     ...(npmDirect?{qualificationInterpretation:directInterpretation}:{}),
     ...(testsDirect?{qualificationInterpretation:testsInterpretation}:{}),

package/docs/user/agents.md

@@ -122,6 +122,17 @@ post-scripts. In every other case the command runs as typed: turbo caches its
 own results, so the hook never rewrites it. Filters (`--filter`) and nx are not
 matched.
 
+For a typecheck check that runs the compiler, the script's forms act only when
+the script in package.json still has exactly the configured runs: one `tsc`
+run per check with the same arguments, and no pre- or post-script. Otherwise
+the command runs as typed. A script that chains `tsc` runs with `&&` has one
+check per run, `typecheck.1`, `typecheck.2` and so on (see
+[direct TypeScript](direct-typescript.md#script-forms)); each run's own
+`npx tsc ...` form matches its check. The hook skips the script when all its
+runs are CURRENT, PASS and `reuse_eligible`, and otherwise rewrites it to
+`redue run` of the runs that are not, in the script's order, joined by `&&`.
+In a turbo or `pnpm -r` fan-out, a package's script counts only the same way.
+
 Each form may end with `2>&1` and then one `| tail -n N`, `| head -n N`,
 `| tail -N` or `| head -N`. It may also be the first command of a `;` or `&&`
 chain. Nothing else matches. Each form has its own `if` rule, so other Bash

package/docs/user/configuration.md

@@ -56,6 +56,10 @@ Advanced explicit contracts may declare `generatedInputs`, `installedInputs`, na
 reviewed escape hatches, not onboarding requirements. A coverage rationale cannot
 override unsupported storage, unresolved links, missing inputs, or observation failure.
 
+A chained typecheck script gets one generated check per `tsc` run, all with
+the script's name (see [script forms](direct-typescript.md#script-forms)). A
+proposed check for a project without a typecheck script has no `script`.
+
 Input patterns are relative to the project root. They cannot name a `.git`
 directory, because REDUE does not observe one; `!.git/**` is fine.
 

package/docs/user/direct-typescript.md

@@ -4,8 +4,10 @@ This check means: the reviewed local TypeScript compiler completed the configure
 check against declared, observed inputs and relevant execution context. It does
 not mean npm or npm lifecycle scripts completed.
 
-For a supported single-package npm project with an existing standalone
-`tsc --noEmit` script, installed dependencies, Node 22/24 and TypeScript 5.5.2/5.6.3/5.9.3/6.0.2/6.0.3:
+For a supported single-package npm project with a typecheck script of `tsc`
+runs (see [script forms](#script-forms)) or no typecheck script and a root
+`tsconfig.json`, installed dependencies, Node 22/24 and TypeScript 5.x or 6.0
+(see [compiler identity](#compiler-identity)):
 
 ```sh
 redue init --recipe typescript-direct --check typecheck --dry-run
@@ -33,9 +35,64 @@ A generated check contains:
 
 `script` identifies the reviewed source recipe; `command` is what actually runs:
 the resolved Node executable and local TypeScript implementation, with exact argv
-and no shell. TypeScript 5.5.2 and 5.6.3 use `lib/tsc.js`; 5.9.3, 6.0.2 and 6.0.3 use `lib/_tsc.js` directly,
-without its outer compile-cache-enabling shim. No compiler is fetched or bundled.
-The entire installed package must match reviewed official distribution bytes.
+and no shell. The entry is `lib/_tsc.js` where the package has one (5.7 and
+later), without its outer compile-cache-enabling shim, and `lib/tsc.js`
+otherwise. No compiler is fetched or bundled.
+
+## Compiler identity
+
+The entire installed `node_modules/typescript` must be an official package,
+byte for byte, in one of two ways:
+
+- TypeScript 5.5.2, 5.6.3, 5.9.3, 6.0.2 or 6.0.3: its files match the digest
+  REDUE ships for that release.
+- Any other TypeScript 5.x or 6.0 release: package-lock.json records the
+  registry's `typescript` package at the installed version (no alias, an
+  `https` tarball URL, not a file or git source) with an integrity (sha512,
+  or sha1 where a registry records only sha1), npm's cache holds the tarball
+  under that integrity, and the installed files are exactly the tarball's
+  files. REDUE reads the cache only; it never downloads. The cache is the one
+  npm uses: `npm_config_cache`, else `cache` in the project's `.npmrc`, then
+  the user's, else `~/.npm` (`%LocalAppData%\npm-cache` on Windows); the
+  global npmrc is not read. `npm-shrinkwrap.json` is not read on this path.
+  `npm ci` fills the cache. When the tarball is missing the check stays
+  recording-only with the reason `npm-tarball-uncached`; `npm cache add
+  typescript@VERSION` adds it. The check's compiler identity is then the
+  lockfile integrity, so a lockfile change re-probes.
+
+CI runs the same contract suite against the last release of each minor from
+5.0 to 5.8 that the reviewed releases do not cover. Later minors (6.1 and up)
+wait until CI covers them. TypeScript 7 (the native compiler) is not
+supported.
+
+## Script forms
+
+A typecheck script qualifies when it is one or more `tsc` runs joined by `&&`,
+each with `--noEmit` and only these arguments, in any order: `-p`/`--project`
+with a config file or directory inside the project, `--skipLibCheck`, and
+`--pretty` (optionally `true` or `false`). For example
+`tsc -p tsconfig.app.json --noEmit` or
+`tsc --noEmit && tsc --noEmit -p tsconfig.node.json`. `tsc -b`, `--watch`,
+other options, quotes, variables and other commands keep the script
+recording-only.
+
+A chain gets one check per run, named `typecheck.1`, `typecheck.2` and so on,
+each with the script's name and that run's arguments in its command. Each run
+is checked as its own program against its own config, and is reused only while
+the script still has as many runs as the config has checks for it, one of them
+with exactly those arguments. Adding or removing a run, or a pre- or
+post-script, makes every check of the script not reusable until `init` runs
+again. The script as a whole
+(`npm run typecheck`) is skipped only when its current runs and the configured
+checks correspond one to one and all are CURRENT (see [agents](agents.md)).
+
+With no typecheck script and a root `tsconfig.json`, init proposes a
+`tsc --noEmit` check with no `script` field, unless a script already runs a
+TypeScript checker in another form (`tsc -b`, `vue-tsc`, `svelte-check`,
+`tsgo`, `astro check`, `nuxi typecheck`). package.json is not changed. The
+check is written only when the contract holds; otherwise no typecheck check is
+added. The pnpm contract does the same for each workspace package with a
+`tsconfig.json` and no typecheck script.
 
 Existing configs are never overwritten. To compare choices, use a new project-local
 `--config redue.direct.config.json` with init; this explicitly selects separate

package/docs/user/pilot.md

@@ -1,4 +1,4 @@
-# Opt-in development pilot: alpha.17
+# Opt-in development pilot: alpha.18
 
 Use one fixed build for several ordinary development sessions. The owner will
 invite two or three willing testers and approve their projects; nothing is
@@ -9,8 +9,9 @@ controlled compiler/agent trials are acceptance evidence, not independent adopti
 
 Start with a trusted, single-package npm Git checkout, normally installed locked
 dependencies, and an existing standalone `tsc --noEmit` script without pre/post
-scripts. The direct recipe accepts only the official, unchanged TypeScript
-**5.5.2, 5.6.3, 5.9.3, 6.0.2 or 6.0.3** packages and Node **22 or 24**. No workspaces, named
+scripts. The direct recipe accepts only an official, unchanged TypeScript **5.x or
+6.0** package (a reviewed release, or one matching the tarball package-lock.json
+names in npm's cache) and Node **22 or 24**. No workspaces, named
 tsconfig selection, emitted/incremental/composite builds, custom loaders or
 outside-root inputs are added by this pilot. Do not downgrade or change your
 project to fit; record an unsupported setup as feedback.
@@ -35,7 +36,7 @@ are **NOT RUN**. The recording shortcut is macOS/direct-recipe only.
 For a new default npm installation:
 
 ```sh
-npm install --global @redue/cli@0.1.0-alpha.17
+npm install --global @redue/cli@0.1.0-alpha.18
 redue --version
 cd my-project
 redue --config redue.config.json init --recipe typescript-direct --check typecheck --dry-run
@@ -89,7 +90,7 @@ using it; keep the same npm prefix, config and any explicit state selection.
 
 ```sh
 redue --config redue.config.json stop
-npm install --global @redue/cli@0.1.0-alpha.17
+npm install --global @redue/cli@0.1.0-alpha.18
 redue --config redue.config.json agent setup codex --dry-run
 redue --config redue.config.json agent setup codex --apply
 redue --config redue.config.json start

package/docs/user/supported-projects.md

@@ -18,8 +18,12 @@ matches are reported as ambiguous rather than guessed. It never creates a new
 project script. Automatic npm-launcher applicability was withdrawn in alpha.4;
 ordinary npm scripts remain recording-only. See the [maintainer notice](npm-launcher-notice.md).
 The direct recipe is opt-in, available since alpha.5. The opt-in `init --recipe typescript-direct` supports
-a standalone `tsc --noEmit` script in a single-package npm installation using
-reviewed TypeScript 5.5.2/5.6.3/5.9.3/6.0.2/6.0.3 and Node 22/24. It executes the local compiler,
+a typecheck script of `tsc --noEmit` runs in any argument order, chained runs,
+or no typecheck script at all (a proposed `tsc --noEmit`; see
+[script forms](direct-typescript.md#script-forms)), in a single-package npm installation using
+TypeScript 5.x or 6.0 (a reviewed release, or one whose installed files match the
+tarball package-lock.json names in npm's cache; see
+[compiler identity](direct-typescript.md#compiler-identity)) and Node 22/24. It executes the local compiler,
 not npm. Full installed compiler identity, config/membership, installed inputs
 and relevant Node environment are checked before reuse. See the
 [exact direct boundary](direct-typescript.md). Unsupported plugins, preloads,
@@ -62,9 +66,14 @@ the installed one. Only the project's files are read: settings from a user or
 global rc file, or `npm_config_*` variables during install, are not. The
 supported local layouts are pnpm's standard isolated and hoisted
 `node_modules` with a project-local `.pnpm` virtual store. `init` can discover
-root and workspace scripts. For a standalone `tsc --noEmit` or `tsc -p ...`
-script in the narrow TypeScript contract, it records the exact installed
-compiler invocation directly. This avoids pnpm's task-run bookkeeping
+root and workspace scripts. For a typecheck script of `tsc` runs
+([script forms](direct-typescript.md#script-forms); `tsc -p .` without
+`--noEmit` is also accepted), or a package with a `tsconfig.json` and no
+typecheck script, it records the exact installed compiler invocation directly.
+The source inputs are the directories the config's `include` covers, as
+TypeScript itself computes them for new files, minus `node_modules` (`exclude`
+entries stay inputs: an import can still reach an excluded file); a file the
+program reads outside them keeps the check recording-only. This avoids pnpm's task-run bookkeeping
 writes during `pnpm run`; it does not alter the project's script. Test, lint,
 build, and ambiguous TypeScript scripts still execute through `pnpm run` and
 start recording-only. The generated `@typescript-bin:WORKSPACE` token resolves

package/docs/user/tests-direct.md

@@ -79,6 +79,10 @@ kept but marked UNVERIFIED, with the reason, when the run:
   about a name other than localhost;
 - started a process that did not load the recorder: a shell, a binary, or a
   Node process with its own environment;
+- had an installed file with another hard link, other than a link into the
+  pnpm store the install recorded in `node_modules/.modules.yaml` (pnpm's
+  default on Linux). A change through a link elsewhere, such as Yarn's
+  hardlinks modes, is not seen.
 
 Lookups that can be asked again become run facts, checked before every CURRENT
 answer: whether a path outside the checkout exists, where a link resolves, the
@@ -119,4 +123,8 @@ Tests that write files git does not ignore change the run's inputs.
   are not indexed at start), makes the result STALE.
 - A config written by an earlier build of this recipe is UNVERIFIED with "run
   redue init again"; move `redue.config.json` aside and run init.
+- pnpm's store is trusted not to change a file in place, as pnpm never does.
+  Editing an installed file in another project that shares the same store
+  file changes it here too, unseen. Use `pnpm patch`, or a copying install
+  (`package-import-method=copy`), if you edit installed files.
 - Windows is not supported; the check stays recording-only there.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@redue/cli",
   "private": false,
-  "version": "0.1.0-alpha.17",
+  "version": "0.1.0-alpha.18",
   "publishConfig": {
     "access": "public",
     "tag": "alpha"
@@ -11,7 +11,7 @@
     "redue": "./bin/redue.mjs"
   },
   "scripts": {
-    "test": "node --test --test-concurrency=1 test/*.test.mjs",
+    "test": "node test/run-suite.mjs",
     "test:package": "node test/acceptance/package-smoke.mjs",
     "demo": "node test/acceptance/package-smoke.mjs --demo",
     "pretest": "npm --prefix test/fixtures/typescript-5-5-2 ci --no-audit --no-fund && npm --prefix test/fixtures/typescript-6-0-2 ci --no-audit --no-fund && npm --prefix test/fixtures/typescript-6-0-3 ci --no-audit --no-fund"

package/src/agent-integration.mjs

@@ -134,7 +134,7 @@ function earlierBlock(host,rows=[]){
 }
 // One form per check: the package manager's script form when there is one,
 // since that is what the project's own instructions usually name.
-const blockForms=(host,config,relative)=>host!=='claude'?[]:hookForms(config,relative).map(row=>({kind:row.kind,
+const blockForms=(host,config,relative)=>host!=='claude'?[]:hookForms(config,relative).filter(row=>!row.part).map(row=>({kind:row.kind,
   form:row.forms.find(form=>/^(?:npm run|pnpm|yarn) /.test(form))??row.forms.find(form=>!form.startsWith('redue '))??row.forms[0]}));
 const priorBlocks=(host,relative)=>[false,true].map(legacy=>`\n\n<!-- REDUE:${host}:begin -->\n`+
   `Before deciding whether configured verification needs repeating, use REDUE.\n`+
@@ -166,7 +166,7 @@ function knownBlock(host,relative,block){
 function skillFor(relative,host,config){
   // Double quotes work in POSIX shells, cmd and PowerShell for ordinary names.
   const redue=redueFor(relative)??`redue --config ${JSON.stringify(relative)}`,status=`${redue} status --sync --json`;
-  const rows=host==='claude'?hookForms(config,relative):[];
+  const rows=host==='claude'?hookForms(config,relative).filter(row=>!row.part):[];
   const label=row=>row.kind==='test'?(row.check==='test'?'Unit tests':`Unit tests \`${row.check}\``):
     row.check==='typecheck'?'Typecheck':`Typecheck \`${row.check}\``;
   const commands=rows.map(row=>`- ${label(row)}: `+

package/src/claude-hook.mjs

@@ -10,6 +10,7 @@ import {spawn} from 'node:child_process';
 import {projectState} from './project-location.mjs';
 import {realObservedPath} from './path-identity.mjs';
 import {processAlive} from './process-liveness.mjs';
+import {scriptRunChecks} from './typescript-invocation.mjs';
 
 export const hookCommand='redue agent hook claude';
 // No shell metacharacters; `@` starts scoped package names.
@@ -91,29 +92,65 @@ const checkScript=check=>typeof check.script==='string'?check.script:
   Array.isArray(check.command)&&/^@which:(?:npm|pnpm|yarn)$/.test(check.command[0])&&check.command.includes('run')?
     check.command[check.command.indexOf('run')+1]:null;
 
+// A typecheck check whose command is the compiler: its arguments are one tsc
+// run of its script (typescript-invocation.mjs).
+function tscCheck(check){return typecheck(check)&&/^tsc(?: |$)/.test(toolText(check)||'');}
 // Exact commands that rerun each configured typecheck or direct test check.
 // `forms` work from the project root; `local` ones work in the check's own
 // directory `dir`, after a `cd` into it. Names that would need shell quoting
-// get no form, so the hook never fires for them.
+// get no form, so the hook never fires for them. The script forms of compiler
+// checks name the script's checks as {checks, script}: the hook acts on them
+// only when the script's tsc runs are those checks' runs, one each. With one
+// check they stay on its row (`scriptForms`); a chain's checks get a row for
+// the script, and their own rows (`part`) keep only their own forms.
 export function hookForms(config,configFile=defaultConfig){
-  const rows=[],redue=redueFor(configFile),pm=config?.packageManager;
-  for(const check of config?.checks||[]){
-    if(!(typecheck(check)||tests(check))||typeof check.name!=='string'||!safe.test(check.name))continue;
-    const forms=redue?[`${redue} run ${check.name}`]:[],local=[],dir=checkDir(check),script=checkScript(check);
+  const rows=[],redue=redueFor(configFile),pm=config?.packageManager,scripts=new Map();
+  const eligible=(config?.checks||[]).filter(check=>(typecheck(check)||tests(check))&&typeof check.name==='string'&&safe.test(check.name));
+  const groupOf=check=>tscCheck(check)&&typeof checkScript(check)==='string'&&checkDir(check)!==null?
+    JSON.stringify([checkDir(check),checkScript(check),workspaceName(check)]):null;
+  for(const check of eligible){const key=groupOf(check);if(key)scripts.set(key,[...scripts.get(key)||[],check.name]);}
+  const scriptRow=(dir,script,workspace)=>({forms:dir==='.'?scriptForms(pm,script):dir!==null&&safe.test(dir)?workspaceForms(pm,workspace,script):[],
+    local:dir!=='.'&&dir!==null&&safe.test(dir)?scriptForms(pm,script):[]});
+  for(const check of eligible){
+    const forms=redue?[`${redue} run ${check.name}`]:[],local=[],dir=checkDir(check),key=groupOf(check),
+      group=key?scripts.get(key):null,part=group?.length>1;
+    const own=group?null:checkScript(check);
     if(dir==='.'){
-      forms.push(...scriptForms(pm,script),...toolForms(pm,toolText(check)));
+      forms.push(...scriptForms(pm,own),...toolForms(pm,toolText(check)));
       if(!tests(check)&&Array.isArray(check.command)&&check.command.length&&
         check.command.every(v=>typeof v==='string'&&safe.test(v)&&!v.startsWith('@')))
         forms.push(check.command.join(' '));
     }else if(dir!==null&&safe.test(dir)){
-      forms.push(...workspaceForms(pm,workspaceName(check),script));
-      local.push(...scriptForms(pm,script),...(check.cwd===dir?toolForms(pm,toolText(check)):[]));
+      forms.push(...workspaceForms(pm,workspaceName(check),own));
+      local.push(...scriptForms(pm,own),...(check.cwd===dir?toolForms(pm,toolText(check)):[]));
     }
+    let extra={};
+    if(group&&!part){
+      const {forms:scriptOnly,local:scriptLocal}=scriptRow(dir,checkScript(check),workspaceName(check));
+      forms.splice(redue?1:0,0,...scriptOnly);local.unshift(...scriptLocal);
+      extra={checks:group,script:checkScript(check),scriptForms:[...scriptOnly,...scriptLocal]};
+    }
+    if(part)extra={part:true};
     if(forms.length||local.length)rows.push({check:check.name,kind:checkKind(check),dir,
-      forms:[...new Set(forms)],local:[...new Set(local)]});
+      forms:[...new Set(forms)],local:[...new Set(local)],...extra});
+  }
+  for(const [key,checks] of scripts){
+    if(checks.length<2)continue;
+    const [dir,script,workspace]=JSON.parse(key),{forms,local}=scriptRow(dir,script,workspace);
+    if(forms.length||local.length)rows.push({check:checks[0].replace(/\.\d+$/,''),checks,script,
+      scriptForms:[...forms,...local],kind:'typecheck',dir,forms,local});
   }
   return rows;
 }
+// The checks a compiler script row runs, in the order of the script's runs in
+// the package's package.json now; null when they no longer correspond (the
+// script changed since init), so the hook leaves the command alone.
+export function scriptChecks(row,config,projectRoot){
+  let scripts;try{scripts=JSON.parse(fs.readFileSync(path.join(projectRoot,row.dir,'package.json'),'utf8')).scripts;}catch{return null;}
+  if(scripts?.['pre'+row.script]||scripts?.['post'+row.script])return null;
+  const args=name=>config.checks.find(check=>check.name===name)?.command?.slice(2);
+  return scriptRunChecks(scripts?.[row.script],row.checks.map(name=>({name,args:args(name)})));
+}
 
 // A turbo or `pnpm -r` command that runs one task in every workspace package:
 // {tool, task}. No filters and no nx: both can add packages or tasks that only
@@ -166,10 +203,17 @@ export async function fanoutChecks(fan,config,projectRoot){
     return null;
   const names=[];
   for(const item of packages){
-    const check=config.checks.find(c=>(typecheck(c)||tests(c))&&typeof c.name==='string'&&
+    const own=config.checks.filter(c=>(typecheck(c)||tests(c))&&typeof c.name==='string'&&
       workspaceName(c)===item.name&&checkScript(c)===fan.task&&checkDir(c)===item.dir);
-    if(!check)return null;
-    names.push(check.name);
+    if(!own.length)return null;
+    // A compiler script's checks: one per tsc run it has now.
+    if(own.every(tscCheck)){
+      const ordered=scriptRunChecks(item.scripts[fan.task],own.map(c=>({name:c.name,args:c.command.slice(2)})));
+      if(!ordered)return null;
+      names.push(...ordered);continue;
+    }
+    if(own.length!==1)return null;
+    names.push(own[0].name);
   }
   return names;
 }
@@ -199,18 +243,23 @@ function matched(command,config,configFile,dir='.',scripts={}){
         return scripts['pre'+name]||scripts['post'+name]?null:{fanout:fanout(text.trim()),rest:parts.rest};
     if(fanout(parts.base))return {fanout:fanout(parts.base),rest:parts.rest};
   }
-  const check=hookForms(config,configFile).find(row=>dir==='.'?row.forms.includes(parts.base):
-    row.dir===dir&&row.local.includes(parts.base))?.check;
-  return check?{check,rest:parts.rest}:null;
+  const row=hookForms(config,configFile).find(row=>dir==='.'?row.forms.includes(parts.base):
+    row.dir===dir&&row.local.includes(parts.base));
+  // A script form of compiler checks is checked against the script first.
+  return row?.scriptForms?.includes(parts.base)?{row,rest:parts.rest}:row?{check:row.check,rest:parts.rest}:null;
 }
-export function matchCheck(command,config,configFile,dir,scripts){return matched(command,config,configFile,dir,scripts)?.check||null;}
-// The same check through REDUE, keeping the output suffix; null if it already
-// is, or if more commands follow it.
+export function matchCheck(command,config,configFile,dir,scripts){
+  const match=matched(command,config,configFile,dir,scripts);
+  return match?.row?match.row.checks.join(' && '):match?.check||null;
+}
+// The same check (or checks, in order) through REDUE, keeping the output
+// suffix; null if it already is, or if more commands follow it.
 export function recordedCommand(command,name,configFile=defaultConfig){
+  const names=Array.isArray(name)?name:[name];
   const parts=split(command),redue=redueFor(configFile);
-  if(!parts||parts.rest!==null||!safe.test(name)||!redue)return null;
-  const run=`${redue} run ${name}`;
-  return parts.base===run?null:run+parts.suffix;
+  if(!parts||parts.rest!==null||!names.length||!names.every(value=>safe.test(value))||!redue)return null;
+  const run=names.map(value=>`${redue} run ${value}`).join(' && ');
+  return parts.base===run?null:names.length>1&&parts.suffix?`(${run})${parts.suffix}`:run+parts.suffix;
 }
 
 // A leading `cd DIR;` or `cd DIR &&`, which agents often add before a check:
@@ -277,9 +326,11 @@ export function statusTimeout(status,name){
     Math.min(run.durationMs/2,10000):2000;
 }
 // From the observer's last published status, which is small, not the receipts.
-export function lastRunTimeout(config,parsed,name){
+// The longest wait among `names`, read once.
+export function lastRunTimeout(config,parsed,...names){
   try{const root=realObservedPath(path.resolve(path.dirname(config),parsed.root||'.'));
-    return statusTimeout(JSON.parse(fs.readFileSync(path.join(projectState(root,config),'status.json'),'utf8')),name);}
+    const status=JSON.parse(fs.readFileSync(path.join(projectState(root,config),'status.json'),'utf8'));
+    return Math.max(...names.map(name=>statusTimeout(status,name)));}
   catch{return 2000;}
 }
 
@@ -329,10 +380,34 @@ export async function claudeHook(input,{entry,timeout}){
   if(match.fanout){
     const names=await fanoutChecks(match.fanout,parsed,project.projectRoot);
     if(!names)return null;
-    const status=await synchronizedStatus(entry,config,root,timeout??Math.max(...names.map(name=>lastRunTimeout(config,parsed,name)))),
+    const status=await synchronizedStatus(entry,config,root,timeout??lastRunTimeout(config,parsed,...names)),
       reason=fanoutVerdict(status,names,match.rest);
     return reason?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'deny',permissionDecisionReason:reason}}:null;
   }
+  // The configured config path as the command's directory sees it.
+  // Both sides resolved alike: Windows can spell the same directory RUNNER~1 or by its long name.
+  const configPath=!entered.prefix?record.config:
+    path.relative(path.join(project.projectRoot,entered.dir),realObservedPath(config)).split(path.sep).join('/');
+  // A compiler script: its checks in the order of its runs, or nothing when
+  // they no longer correspond. One run is an ordinary check. A chain is
+  // skipped when every run is CURRENT, else the runs that are not run through
+  // redue run, in order.
+  if(match.row){
+    const names=scriptChecks(match.row,parsed,project.projectRoot);
+    if(!names)return null;
+    if(names.length===1)match.check=names[0];
+    else{
+      const status=await synchronizedStatus(entry,config,root,timeout??lastRunTimeout(config,parsed,...names)),
+        reason=fanoutVerdict(status,names,match.rest);
+      if(reason)return {hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'deny',permissionDecisionReason:reason}};
+      const pending=names.filter(name=>!verdict(status,name));
+      const rewritten=status?.schema===1&&status.observation?.healthy===true&&Array.isArray(status.checks)&&
+        names.every(name=>status.checks.some(item=>item?.name===name))?recordedCommand(entered.command,pending,configPath):null;
+      return rewritten?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'allow',
+        permissionDecisionReason:`REDUE: ${pending.map(name=>JSON.stringify(name)).join(', ')} of this script's checks ${pending.length===1?'is':'are'} not CURRENT; running ${pending.length===1?'it':'them'} through redue run so the result is recorded.`,
+        updatedInput:{...input.tool_input,command:entered.prefix+rewritten}}}:null;
+    }
+  }
   const name=match.check,status=await synchronizedStatus(entry,config,root,timeout??lastRunTimeout(config,parsed,name)),
     reason=verdict(status,name,match.rest);
   if(reason)return {hookSpecificOutput:{hookEventName:'PreToolUse',
@@ -342,9 +417,7 @@ export async function claudeHook(input,{entry,timeout}){
   // stays too: the rewrite returns "allow", which would also skip the prompt
   // for the rest of the chain.
   const rewritten=status?.schema===1&&status.observation?.healthy===true&&Array.isArray(status.checks)&&
-    status.checks.some(item=>item?.name===name)?recordedCommand(entered.command,name,
-      // Both sides resolved alike: Windows can spell the same directory RUNNER~1 or by its long name.
-      !entered.prefix?record.config:path.relative(path.join(project.projectRoot,entered.dir),realObservedPath(config)).split(path.sep).join('/')):null;
+    status.checks.some(item=>item?.name===name)?recordedCommand(entered.command,name,configPath):null;
   // updatedInput replaces the whole tool input. Deny and ask rules still apply
   // to the rewritten command; "allow" skips only the prompt.
   return rewritten?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'allow',

package/src/cli.mjs

@@ -361,8 +361,8 @@ async function execute() {
       guard=testRunGuard(testRecord,{root,sourcePatterns:plan.sourcePatterns||plan.patterns,files:snap?.files,
         runner:runnerPid,environment:selected.environment||{},coverage});
       runFacts=guard.runFacts;
-      const shared=sharedInstalledFile(root,testFacts);
-      if(shared)guard.issues.push(`installed file ${shared} has another hard link, likely into a package store; a change through it is not observed`);
+      const shared=sharedInstalledFile(root,testFacts,path.join(state,'pnpm-store-links-v1.json'));
+      if(shared)guard.issues.push(`installed file ${shared.file} ${shared.reason}; a change through it is not observed`);
       fs.rmSync(testRecord,{recursive:true,force:true});
     }
     // The daemon reads the recording from owned state; control requests are small.