@redue/cli 0.1.0-alpha.17 → 0.1.0-alpha.19

package/docs/user/tests-direct.md

@@ -1,7 +1,8 @@
 # Direct test recipe (Vitest and Jest)
 
-`redue init --recipe tests-direct --check test` records a project's unit test
-run and reports later whether that result still applies to the files you have.
+`redue init` (or `redue init --recipe tests-direct --check test` for this recipe
+alone) records a project's unit test run and reports later whether that result
+still applies to the files you have.
 It supports a single-package project installed by npm, pnpm 9-12 (isolated or
 hoisted `node_modules`) or Yarn with the `node-modules` linker, whose test
 script runs Vitest 4 or 5, or Jest 29, directly. It runs on macOS and Linux with
@@ -35,7 +36,8 @@ runner directly, otherwise the only script that does. The script must be one
 runner invocation: no `&&`, quotes, globs or variable assignments. Watch mode,
 `--changed`, `related`, snapshot updates (`-u`), shuffling, sharding and
 Jest's `--onlyChanged` are refused. Vitest needs `run`, `--run` or
-`--watch=false`. Other scripts stay recording-only.
+`--watch=false`. Other test scripts stay recording-only: the
+[general recipe](node-script.md) covers typecheck and lint scripts, not tests.
 
 REDUE runs the local runner with Node directly. The package manager, its
 lifecycle scripts and `package.json` are not changed or executed.
@@ -79,6 +81,10 @@ kept but marked UNVERIFIED, with the reason, when the run:
   about a name other than localhost;
 - started a process that did not load the recorder: a shell, a binary, or a
   Node process with its own environment;
+- had an installed file with another hard link, other than a link into the
+  pnpm store the install recorded in `node_modules/.modules.yaml` (pnpm's
+  default on Linux). A change through a link elsewhere, such as Yarn's
+  hardlinks modes, is not seen.
 
 Lookups that can be asked again become run facts, checked before every CURRENT
 answer: whether a path outside the checkout exists, where a link resolves, the
@@ -119,4 +125,8 @@ Tests that write files git does not ignore change the run's inputs.
   are not indexed at start), makes the result STALE.
 - A config written by an earlier build of this recipe is UNVERIFIED with "run
   redue init again"; move `redue.config.json` aside and run init.
+- pnpm's store is trusted not to change a file in place, as pnpm never does.
+  Editing an installed file in another project that shares the same store
+  file changes it here too, unseen. Use `pnpm patch`, or a copying install
+  (`package-import-method=copy`), if you edit installed files.
 - Windows is not supported; the check stays recording-only there.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@redue/cli",
   "private": false,
-  "version": "0.1.0-alpha.17",
+  "version": "0.1.0-alpha.19",
   "publishConfig": {
     "access": "public",
     "tag": "alpha"
@@ -11,7 +11,7 @@
     "redue": "./bin/redue.mjs"
   },
   "scripts": {
-    "test": "node --test --test-concurrency=1 test/*.test.mjs",
+    "test": "node test/run-suite.mjs",
     "test:package": "node test/acceptance/package-smoke.mjs",
     "demo": "node test/acceptance/package-smoke.mjs --demo",
     "pretest": "npm --prefix test/fixtures/typescript-5-5-2 ci --no-audit --no-fund && npm --prefix test/fixtures/typescript-6-0-2 ci --no-audit --no-fund && npm --prefix test/fixtures/typescript-6-0-3 ci --no-audit --no-fund"

package/src/agent-integration.mjs

@@ -26,7 +26,7 @@ const sameJson=(a,b)=>JSON.stringify(a)===JSON.stringify(b);
 // Fan-out commands (turbo, nx, `pnpm -r`) and root scripts that run one get
 // prefix rules; the hook decides from the full command.
 function hookFor(config,relative,scripts){
-  const rules=[...new Set([...hookForms(config,relative).flatMap(row=>[...row.forms,...row.local]),
+  const rules=[...new Set([...hookForms(config,relative,scripts).flatMap(row=>[...row.forms,...row.local]),
     ...fanoutRules(config,scripts)])].map(form=>`Bash(${form}*)`);
   return rules.length?{matcher:'Bash',hooks:rules.map(rule=>({type:'command',if:rule,command:hookCommand,timeout:15}))}:null;
 }
@@ -99,17 +99,23 @@ function saved(root,host){const text=read(root,marker(host));if(text===null)retu
   return value;
 }
 // The managed block is always in the agent's context, so it stays short. For
-// Claude Code it names the typecheck and test commands the hook matches, asks
+// Claude Code it names the typecheck, test and lint commands the hook matches, asks
 // the agent to run them rather than judge for itself that a rerun is not
 // needed, and says what a skip means. The hook does the rest, so the block
 // does not point to the skill; the skill stays for agents that look for it.
 const quoted=forms=>forms.map(form=>`\`${form}\``).join(' and ');
-const commandsOf=rows=>[rows.filter(row=>row.kind!=='test').map(row=>row.form),rows.filter(row=>row.kind==='test').map(row=>row.form)];
+const commandsOf=rows=>[rows.filter(row=>row.kind!=='test'&&row.kind!=='lint').map(row=>row.form),
+  rows.filter(row=>row.kind==='test').map(row=>row.form),rows.filter(row=>row.kind==='lint').map(row=>row.form)];
 const fence=(host,body)=>`\n\n<!-- REDUE:${host}:begin -->\n${body}<!-- REDUE:${host}:end -->\n`;
 const skillPointer=host=>`Before you run, skip or report a typecheck or other configured check, read\n${hosts[host].skill}.\n`;
 function blockFor(host,rows=[]){
-  const [typechecks,tests]=commandsOf(rows);
+  const [typechecks,tests,lints]=commandsOf(rows);
   if(!rows.length)return fence(host,skillPointer(host));
+  if(lints.length)return fence(host,(typechecks.length?`Typecheck with ${quoted(typechecks)}.\n`:'')+
+    (tests.length?`Run the unit tests with ${quoted(tests)}.\n`:'')+`Lint with ${quoted(lints)}.\n`+
+    `Run a check before you say it passes, even after an edit you think cannot\n`+
+    `matter; don't skip it yourself. If its last pass still applies to these exact\n`+
+    `files, a REDUE hook skips the run and says so. That skip counts as a pass.\n`);
   if(!tests.length)return fence(host,`Typecheck with ${quoted(typechecks)}. Run it before you say it passes, even after an\n`+
     `edit you think cannot matter; don't skip it yourself. If its last pass still\n`+
     `applies to these exact files, a REDUE hook skips the run and says so. That\n`+
@@ -134,7 +140,7 @@ function earlierBlock(host,rows=[]){
 }
 // One form per check: the package manager's script form when there is one,
 // since that is what the project's own instructions usually name.
-const blockForms=(host,config,relative)=>host!=='claude'?[]:hookForms(config,relative).map(row=>({kind:row.kind,
+const blockForms=(host,config,relative)=>host!=='claude'?[]:hookForms(config,relative).filter(row=>!row.part).map(row=>({kind:row.kind,
   form:row.forms.find(form=>/^(?:npm run|pnpm|yarn) /.test(form))??row.forms.find(form=>!form.startsWith('redue '))??row.forms[0]}));
 const priorBlocks=(host,relative)=>[false,true].map(legacy=>`\n\n<!-- REDUE:${host}:begin -->\n`+
   `Before deciding whether configured verification needs repeating, use REDUE.\n`+
@@ -157,7 +163,8 @@ function knownBlock(host,relative,block){
   const list='((?:`[A-Za-z0-9_./:=,+@ -]+`(?: and )?)+)';
   const forms=pattern=>{const named=new RegExp(pattern).exec(block);return named?[...named[1].matchAll(/`([^`]+)`/g)].map(m=>m[1]):[];};
   const rows=[...forms(`^\\n\\n<!-- REDUE:[a-z]+:begin -->\\nTypecheck with ${list}\\.`).map(form=>({kind:'typecheck',form})),
-    ...forms(`Run the unit tests with ${list}\\.\\n`).map(form=>({kind:'test',form}))];
+    ...forms(`Run the unit tests with ${list}\\.\\n`).map(form=>({kind:'test',form})),
+    ...forms(`Lint with ${list}\\.\\n`).map(form=>({kind:'lint',form}))];
   return block===blockFor(host,rows)||block===earlierBlock(host,rows)||priorBlocks(host,relative).includes(block);
 }
 // The policy with the exact commands for this config, so an agent never builds
@@ -166,8 +173,9 @@ function knownBlock(host,relative,block){
 function skillFor(relative,host,config){
   // Double quotes work in POSIX shells, cmd and PowerShell for ordinary names.
   const redue=redueFor(relative)??`redue --config ${JSON.stringify(relative)}`,status=`${redue} status --sync --json`;
-  const rows=host==='claude'?hookForms(config,relative):[];
+  const rows=host==='claude'?hookForms(config,relative).filter(row=>!row.part):[];
   const label=row=>row.kind==='test'?(row.check==='test'?'Unit tests':`Unit tests \`${row.check}\``):
+    row.kind==='lint'?(row.check==='lint'?'Lint':`Lint \`${row.check}\``):
     row.check==='typecheck'?'Typecheck':`Typecheck \`${row.check}\``;
   const commands=rows.map(row=>`- ${label(row)}: `+
     `${row.forms.map(form=>`\`${form}\``).join(' or ')}.\n`).join('')+
@@ -183,7 +191,7 @@ function skillFor(relative,host,config){
   // typecheck needs only the CLAUDE.md block, so the description must not
   // send the agent here for one.
   const description=rows.length?'Rules and exact commands for redue status, redue run and other redue commands. '+
-    `A plain ${rows.some(row=>row.kind==='test')?'typecheck or test run':'typecheck'} needs only the REDUE section of CLAUDE.md.`:
+    `A plain ${rows.some(row=>row.kind==='lint')?'typecheck, test or lint run':rows.some(row=>row.kind==='test')?'typecheck or test run':'typecheck'} needs only the REDUE section of CLAUDE.md.`:
     'Use before running, skipping or reporting a typecheck or other configured check.';
   // Replacer functions, so `$` in a config name is never a replacement pattern.
   return policy.replace('{{DESCRIPTION}}',()=>description).replace('{{CONFIG}}',()=>JSON.stringify(relative)).replace('{{COMMANDS}}',()=>commands.trimEnd())

package/src/claude-hook.mjs

@@ -1,4 +1,4 @@
-// Claude Code PreToolUse hook: skip an exact typecheck or test rerun when REDUE
+// Claude Code PreToolUse hook: skip an exact typecheck, test or lint rerun when REDUE
 // reports CURRENT/PASS with reuse_eligible on the current inputs. When the check is not
 // CURRENT, the command becomes `redue run <check>` so the run is recorded. Every
 // other outcome, including errors and timeouts, allows the command unchanged.
@@ -10,6 +10,8 @@ import {spawn} from 'node:child_process';
 import {projectState} from './project-location.mjs';
 import {realObservedPath} from './path-identity.mjs';
 import {processAlive} from './process-liveness.mjs';
+import {scriptRunChecks} from './typescript-invocation.mjs';
+import {recipeLabel} from './presentation.mjs';
 
 export const hookCommand='redue agent hook claude';
 // No shell metacharacters; `@` starts scoped package names.
@@ -18,7 +20,11 @@ const typecheck=check=>check?.kind==='typecheck'||check?.name==='typecheck';
 // A direct test check: its command is the runner and the script's arguments.
 const tests=check=>check?.qualification==='npm-tests-direct-v1'&&Array.isArray(check.command)&&
   /^@test-runner:(?:vitest|jest)$/.test(check.command[1]||'');
-export const checkKind=check=>tests(check)?'test':'typecheck';
+// A general recipe check: a root typecheck, test or lint script run through the package manager.
+const general=check=>check?.qualification==='node-script-v1'&&['typecheck','test','lint'].includes(check.kind)&&
+  typeof check.script==='string';
+const eligibleCheck=check=>typecheck(check)||tests(check)||general(check);
+export const checkKind=check=>tests(check)?'test':general(check)?check.kind:'typecheck';
 
 export const defaultConfig='redue.config.json';
 // The `redue` prefix for a config beside the project root; null when the name
@@ -52,8 +58,12 @@ function workspaceForms(pm,name,script){
     `npm run ${script} --workspace=${name}`,`npm -w ${name} run ${script}`];
   return [];
 }
-// The tool a check runs, as typed: `tsc ARGS` or the test runner's command.
-function toolText(check){
+// The tool a check runs, as typed: `tsc ARGS` or the test runner's command;
+// for a general check, its script when the script is one plain command.
+function toolText(check,scripts){
+  if(general(check)){const text=typeof scripts?.[check.script]==='string'?scripts[check.script].trim().replace(/\s+/g,' '):'';
+    return safe.test(text.replace(/ /g,''))&&!/^(?:npm|npx|pnpm|pnpx|yarn|node)(?: |$)/.test(text)&&
+      !scripts['pre'+check.script]&&!scripts['post'+check.script]?text:null;}
   const command=check.command;
   if(!Array.isArray(command)||command[0]!=='@node')return null;
   const words=/^@typescript-(?:compiler|bin):/.test(command[1]||'')?['tsc',...command.slice(2)]:
@@ -91,29 +101,65 @@ const checkScript=check=>typeof check.script==='string'?check.script:
   Array.isArray(check.command)&&/^@which:(?:npm|pnpm|yarn)$/.test(check.command[0])&&check.command.includes('run')?
     check.command[check.command.indexOf('run')+1]:null;
 
+// A typecheck check whose command is the compiler: its arguments are one tsc
+// run of its script (typescript-invocation.mjs).
+function tscCheck(check){return typecheck(check)&&/^tsc(?: |$)/.test(toolText(check)||'');}
 // Exact commands that rerun each configured typecheck or direct test check.
 // `forms` work from the project root; `local` ones work in the check's own
 // directory `dir`, after a `cd` into it. Names that would need shell quoting
-// get no form, so the hook never fires for them.
-export function hookForms(config,configFile=defaultConfig){
-  const rows=[],redue=redueFor(configFile),pm=config?.packageManager;
-  for(const check of config?.checks||[]){
-    if(!(typecheck(check)||tests(check))||typeof check.name!=='string'||!safe.test(check.name))continue;
-    const forms=redue?[`${redue} run ${check.name}`]:[],local=[],dir=checkDir(check),script=checkScript(check);
+// get no form, so the hook never fires for them. The script forms of compiler
+// checks name the script's checks as {checks, script}: the hook acts on them
+// only when the script's tsc runs are those checks' runs, one each. With one
+// check they stay on its row (`scriptForms`); a chain's checks get a row for
+// the script, and their own rows (`part`) keep only their own forms.
+export function hookForms(config,configFile=defaultConfig,packageScripts=null){
+  const rows=[],redue=redueFor(configFile),pm=config?.packageManager,scripts=new Map();
+  const eligible=(config?.checks||[]).filter(check=>eligibleCheck(check)&&typeof check.name==='string'&&safe.test(check.name));
+  const groupOf=check=>tscCheck(check)&&typeof checkScript(check)==='string'&&checkDir(check)!==null?
+    JSON.stringify([checkDir(check),checkScript(check),workspaceName(check)]):null;
+  for(const check of eligible){const key=groupOf(check);if(key)scripts.set(key,[...scripts.get(key)||[],check.name]);}
+  const scriptRow=(dir,script,workspace)=>({forms:dir==='.'?scriptForms(pm,script):dir!==null&&safe.test(dir)?workspaceForms(pm,workspace,script):[],
+    local:dir!=='.'&&dir!==null&&safe.test(dir)?scriptForms(pm,script):[]});
+  for(const check of eligible){
+    const forms=redue?[`${redue} run ${check.name}`]:[],local=[],dir=checkDir(check),key=groupOf(check),
+      group=key?scripts.get(key):null,part=group?.length>1;
+    const own=group?null:checkScript(check);
     if(dir==='.'){
-      forms.push(...scriptForms(pm,script),...toolForms(pm,toolText(check)));
+      forms.push(...scriptForms(pm,own),...toolForms(pm,toolText(check,packageScripts)));
       if(!tests(check)&&Array.isArray(check.command)&&check.command.length&&
         check.command.every(v=>typeof v==='string'&&safe.test(v)&&!v.startsWith('@')))
         forms.push(check.command.join(' '));
     }else if(dir!==null&&safe.test(dir)){
-      forms.push(...workspaceForms(pm,workspaceName(check),script));
-      local.push(...scriptForms(pm,script),...(check.cwd===dir?toolForms(pm,toolText(check)):[]));
+      forms.push(...workspaceForms(pm,workspaceName(check),own));
+      local.push(...scriptForms(pm,own),...(check.cwd===dir?toolForms(pm,toolText(check)):[]));
     }
+    let extra={};
+    if(group&&!part){
+      const {forms:scriptOnly,local:scriptLocal}=scriptRow(dir,checkScript(check),workspaceName(check));
+      forms.splice(redue?1:0,0,...scriptOnly);local.unshift(...scriptLocal);
+      extra={checks:group,script:checkScript(check),scriptForms:[...scriptOnly,...scriptLocal]};
+    }
+    if(part)extra={part:true};
     if(forms.length||local.length)rows.push({check:check.name,kind:checkKind(check),dir,
-      forms:[...new Set(forms)],local:[...new Set(local)]});
+      forms:[...new Set(forms)],local:[...new Set(local)],...extra});
+  }
+  for(const [key,checks] of scripts){
+    if(checks.length<2)continue;
+    const [dir,script,workspace]=JSON.parse(key),{forms,local}=scriptRow(dir,script,workspace);
+    if(forms.length||local.length)rows.push({check:checks[0].replace(/\.\d+$/,''),checks,script,
+      scriptForms:[...forms,...local],kind:'typecheck',dir,forms,local});
   }
   return rows;
 }
+// The checks a compiler script row runs, in the order of the script's runs in
+// the package's package.json now; null when they no longer correspond (the
+// script changed since init), so the hook leaves the command alone.
+export function scriptChecks(row,config,projectRoot){
+  let scripts;try{scripts=JSON.parse(fs.readFileSync(path.join(projectRoot,row.dir,'package.json'),'utf8')).scripts;}catch{return null;}
+  if(scripts?.['pre'+row.script]||scripts?.['post'+row.script])return null;
+  const args=name=>config.checks.find(check=>check.name===name)?.command?.slice(2);
+  return scriptRunChecks(scripts?.[row.script],row.checks.map(name=>({name,args:args(name)})));
+}
 
 // A turbo or `pnpm -r` command that runs one task in every workspace package:
 // {tool, task}. No filters and no nx: both can add packages or tasks that only
@@ -130,7 +176,7 @@ export function fanout(text){
 // Bash `if` rules for fan-out commands of a task some workspace check runs,
 // and for root scripts that run one; other turbo or nx commands never start the hook.
 export function fanoutRules(config,scripts={}){
-  const tasks=new Set((config?.checks||[]).filter(check=>(typecheck(check)||tests(check))&&typeof check.name==='string'&&
+  const tasks=new Set((config?.checks||[]).filter(check=>eligibleCheck(check)&&typeof check.name==='string'&&
     ![null,'.'].includes(checkDir(check))).map(checkScript).filter(task=>typeof task==='string'&&/^[A-Za-z0-9_:.-]+$/.test(task)));
   const rules=[];
   for(const task of tasks){
@@ -166,10 +212,17 @@ export async function fanoutChecks(fan,config,projectRoot){
     return null;
   const names=[];
   for(const item of packages){
-    const check=config.checks.find(c=>(typecheck(c)||tests(c))&&typeof c.name==='string'&&
+    const own=config.checks.filter(c=>eligibleCheck(c)&&typeof c.name==='string'&&
       workspaceName(c)===item.name&&checkScript(c)===fan.task&&checkDir(c)===item.dir);
-    if(!check)return null;
-    names.push(check.name);
+    if(!own.length)return null;
+    // A compiler script's checks: one per tsc run it has now.
+    if(own.every(tscCheck)){
+      const ordered=scriptRunChecks(item.scripts[fan.task],own.map(c=>({name:c.name,args:c.command.slice(2)})));
+      if(!ordered)return null;
+      names.push(...ordered);continue;
+    }
+    if(own.length!==1)return null;
+    names.push(own[0].name);
   }
   return names;
 }
@@ -191,6 +244,10 @@ function split(command){
 function matched(command,config,configFile,dir='.',scripts={}){
   const parts=split(command);
   if(!parts)return null;
+  const row=hookForms(config,configFile,dir==='.'?scripts:null).find(row=>dir==='.'?row.forms.includes(parts.base):
+    row.dir===dir&&row.local.includes(parts.base));
+  // A root script that a general check runs is that check, even when the script fans out.
+  if(dir==='.'&&row&&general(config.checks.find(check=>check.name===row.check)))return {check:row.check,rest:parts.rest};
   if(dir==='.'){
     // A root script that runs a fan-out is that fan-out, unless pre/post scripts
     // run around it: then it matches nothing.
@@ -199,18 +256,21 @@ function matched(command,config,configFile,dir='.',scripts={}){
         return scripts['pre'+name]||scripts['post'+name]?null:{fanout:fanout(text.trim()),rest:parts.rest};
     if(fanout(parts.base))return {fanout:fanout(parts.base),rest:parts.rest};
   }
-  const check=hookForms(config,configFile).find(row=>dir==='.'?row.forms.includes(parts.base):
-    row.dir===dir&&row.local.includes(parts.base))?.check;
-  return check?{check,rest:parts.rest}:null;
+  // A script form of compiler checks is checked against the script first.
+  return row?.scriptForms?.includes(parts.base)?{row,rest:parts.rest}:row?{check:row.check,rest:parts.rest}:null;
 }
-export function matchCheck(command,config,configFile,dir,scripts){return matched(command,config,configFile,dir,scripts)?.check||null;}
-// The same check through REDUE, keeping the output suffix; null if it already
-// is, or if more commands follow it.
+export function matchCheck(command,config,configFile,dir,scripts){
+  const match=matched(command,config,configFile,dir,scripts);
+  return match?.row?match.row.checks.join(' && '):match?.check||null;
+}
+// The same check (or checks, in order) through REDUE, keeping the output
+// suffix; null if it already is, or if more commands follow it.
 export function recordedCommand(command,name,configFile=defaultConfig){
+  const names=Array.isArray(name)?name:[name];
   const parts=split(command),redue=redueFor(configFile);
-  if(!parts||parts.rest!==null||!safe.test(name)||!redue)return null;
-  const run=`${redue} run ${name}`;
-  return parts.base===run?null:run+parts.suffix;
+  if(!parts||parts.rest!==null||!names.length||!names.every(value=>safe.test(value))||!redue)return null;
+  const run=names.map(value=>`${redue} run ${value}`).join(' && ');
+  return parts.base===run?null:names.length>1&&parts.suffix?`(${run})${parts.suffix}`:run+parts.suffix;
 }
 
 // A leading `cd DIR;` or `cd DIR &&`, which agents often add before a check:
@@ -243,7 +303,8 @@ export function verdict(status,name,rest=null){
   const runId=row?.invocation?.runId;
   if(!row||row.freshness!=='CURRENT'||row.result!=='PASS'||row.reuse_eligible!==true||
     typeof runId!=='string'||!/^[0-9a-f-]{36}$/.test(runId))return null;
-  return `REDUE: check ${JSON.stringify(name)} passed on these exact inputs (run ${runId}); `+
+  const recipe=recipeLabel(row.recipe);
+  return `REDUE: check ${JSON.stringify(name)} passed on these exact inputs (run ${runId}${recipe?`, ${recipe}`:''}); `+
     'rerun skipped. This counts as a pass for the current files; no status check is needed. '+
     'To run it anyway, prefix the command with REDUE_FORCE=1.'+
     (rest===null?'':` Nothing else in the command ran either; run the rest on its own: ${rest}`);
@@ -277,9 +338,11 @@ export function statusTimeout(status,name){
     Math.min(run.durationMs/2,10000):2000;
 }
 // From the observer's last published status, which is small, not the receipts.
-export function lastRunTimeout(config,parsed,name){
+// The longest wait among `names`, read once.
+export function lastRunTimeout(config,parsed,...names){
   try{const root=realObservedPath(path.resolve(path.dirname(config),parsed.root||'.'));
-    return statusTimeout(JSON.parse(fs.readFileSync(path.join(projectState(root,config),'status.json'),'utf8')),name);}
+    const status=JSON.parse(fs.readFileSync(path.join(projectState(root,config),'status.json'),'utf8'));
+    return Math.max(...names.map(name=>statusTimeout(status,name)));}
   catch{return 2000;}
 }
 
@@ -329,10 +392,34 @@ export async function claudeHook(input,{entry,timeout}){
   if(match.fanout){
     const names=await fanoutChecks(match.fanout,parsed,project.projectRoot);
     if(!names)return null;
-    const status=await synchronizedStatus(entry,config,root,timeout??Math.max(...names.map(name=>lastRunTimeout(config,parsed,name)))),
+    const status=await synchronizedStatus(entry,config,root,timeout??lastRunTimeout(config,parsed,...names)),
       reason=fanoutVerdict(status,names,match.rest);
     return reason?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'deny',permissionDecisionReason:reason}}:null;
   }
+  // The configured config path as the command's directory sees it.
+  // Both sides resolved alike: Windows can spell the same directory RUNNER~1 or by its long name.
+  const configPath=!entered.prefix?record.config:
+    path.relative(path.join(project.projectRoot,entered.dir),realObservedPath(config)).split(path.sep).join('/');
+  // A compiler script: its checks in the order of its runs, or nothing when
+  // they no longer correspond. One run is an ordinary check. A chain is
+  // skipped when every run is CURRENT, else the runs that are not run through
+  // redue run, in order.
+  if(match.row){
+    const names=scriptChecks(match.row,parsed,project.projectRoot);
+    if(!names)return null;
+    if(names.length===1)match.check=names[0];
+    else{
+      const status=await synchronizedStatus(entry,config,root,timeout??lastRunTimeout(config,parsed,...names)),
+        reason=fanoutVerdict(status,names,match.rest);
+      if(reason)return {hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'deny',permissionDecisionReason:reason}};
+      const pending=names.filter(name=>!verdict(status,name));
+      const rewritten=status?.schema===1&&status.observation?.healthy===true&&Array.isArray(status.checks)&&
+        names.every(name=>status.checks.some(item=>item?.name===name))?recordedCommand(entered.command,pending,configPath):null;
+      return rewritten?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'allow',
+        permissionDecisionReason:`REDUE: ${pending.map(name=>JSON.stringify(name)).join(', ')} of this script's checks ${pending.length===1?'is':'are'} not CURRENT; running ${pending.length===1?'it':'them'} through redue run so the result is recorded.`,
+        updatedInput:{...input.tool_input,command:entered.prefix+rewritten}}}:null;
+    }
+  }
   const name=match.check,status=await synchronizedStatus(entry,config,root,timeout??lastRunTimeout(config,parsed,name)),
     reason=verdict(status,name,match.rest);
   if(reason)return {hookSpecificOutput:{hookEventName:'PreToolUse',
@@ -342,9 +429,7 @@ export async function claudeHook(input,{entry,timeout}){
   // stays too: the rewrite returns "allow", which would also skip the prompt
   // for the rest of the chain.
   const rewritten=status?.schema===1&&status.observation?.healthy===true&&Array.isArray(status.checks)&&
-    status.checks.some(item=>item?.name===name)?recordedCommand(entered.command,name,
-      // Both sides resolved alike: Windows can spell the same directory RUNNER~1 or by its long name.
-      !entered.prefix?record.config:path.relative(path.join(project.projectRoot,entered.dir),realObservedPath(config)).split(path.sep).join('/')):null;
+    status.checks.some(item=>item?.name===name)?recordedCommand(entered.command,name,configPath):null;
   // updatedInput replaces the whole tool input. Deny and ask rules still apply
   // to the rewritten command; "allow" skips only the prompt.
   return rewritten?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'allow',

package/src/cli.mjs

@@ -3,8 +3,9 @@ import {builtInProbe,probeFloorMs,publishedDeadline} from './probe-deadline.mjs'
 import fs from 'node:fs';
 import {directQualification,directInterpretation,observedNpmContext} from './direct-typescript.mjs';
 import {directRunCertificateAllowed,directRunCertificate,directRunRecordable,directRunRecording,probeQuestions,validateRunRecord} from './direct-run-certificate.mjs';
-import {runFactChange} from './typescript-list.mjs';
+import {queryAnswer,runFactChange} from './typescript-list.mjs';
 import {changedFiles,coverageReadable,gitIgnored,recordedEnvironment,testEnvironmentIssue,testGuardConfig,testRunGuard,testRunFacts,sharedInstalledFile,testsInterpretation,testsQualification} from './test-direct.mjs';
+import {childProgram,lookup,pnpmConfigFiles,scriptCaches,scriptInstalledPaths,scriptInterpretation,scriptQualification,scriptRunFacts,toolOutput,toolchainDirs} from './node-script.mjs';
 import path from 'node:path';
 import net from 'node:net';
 import os from 'node:os';
@@ -69,7 +70,8 @@ const readsFile=path.join(state,'environment-reads-v1.json');
 function environmentReads() {
   try{const value=JSON.parse(fs.readFileSync(readsFile,'utf8'));return value?.schema===1&&value.checks||{};}catch{return {};}
 }
-function contextHashes() {const reads=config.checks.some(check=>check.qualification===testsQualification)?environmentReads():{};
+const recordedRecipes=[testsQualification,scriptQualification];
+function contextHashes() {const reads=config.checks.some(check=>recordedRecipes.includes(check.qualification))?environmentReads():{};
   return Object.fromEntries(config.checks.map(check=>[
   check.name,Object.fromEntries([...(check.environment?.variables||[])
     .map(key=>[key,digest(process.env[key]??'<unset>')]),
@@ -271,20 +273,28 @@ async function execute() {
     const recorded=directRunRecordable(selected)&&!unobservedDirectRun;
     const launched=recorded?[command[0],'--require',path.join(here,'run-recorder.cjs'),
       ...command.slice(1)]:command;
-    // A test run's processes record what the guard checks (test-recorder.cjs).
-    const testRun=selected.qualification===testsQualification&&['darwin','linux'].includes(process.platform);
-    let testRecord=null,launchEnv=process.env,testFacts={};
+    // A test run's processes record what the guard checks (test-recorder.cjs),
+    // and so do a general recipe run's, through the package manager.
+    const general=selected.qualification===scriptQualification;
+    const testRun=recordedRecipes.includes(selected.qualification)&&['darwin','linux'].includes(process.platform);
+    let testRecord=null,launchEnv=process.env,testFacts={},toolchain=[];
     if(testRun){
       // The package directory and installed node_modules, as the plan has them.
-      try{testFacts=testRunFacts(root,selected);}
-      catch(e){captureIssues.push(`test run facts unavailable (${e.code||e.message})`);}
+      try{testFacts=general?scriptRunFacts(root,selected):testRunFacts(root,selected);}
+      catch(e){captureIssues.push(`${general?'script':'test'} run facts unavailable (${e.code||e.message})`);}
       const environmentIssue=testEnvironmentIssue();
       if(environmentIssue)captureIssues.push(environmentIssue);
       testRecord=path.join(state,`test-record-${runId}`);
       fs.mkdirSync(testRecord,{mode:0o700});
-      const guardFile=path.join(testRecord,'guard.json');
-      fs.writeFileSync(guardFile,JSON.stringify(testGuardConfig(testRecord,root,process.env,testFacts)),{mode:0o600});
+      const guardFile=path.join(testRecord,'guard.json'),guardConfig=testGuardConfig(testRecord,root,process.env,testFacts);
+      if(general){toolchain=toolchainDirs();
+        // The Node on PATH, which the environment identifies by its file.
+        Object.assign(guardConfig,{installed:scriptInstalledPaths(root,testFacts.dirs||[]),toolchain,
+          node:lookup('node',process.env.PATH,process.cwd())});}
+      fs.writeFileSync(guardFile,JSON.stringify(guardConfig),{mode:0o600});
       launchEnv=recordedEnvironment(guardFile);
+      // npm's and pnpm's update checks read state outside the checkout and the network.
+      if(general)launchEnv.npm_config_update_notifier='false';
     }
     let runnerPid=null;
     const record=[];
@@ -357,12 +367,18 @@ async function execute() {
     }else if(!unobservedDirectRun&&!recording)probeAfter=probeHash(probePlan);
     let guard=null;
     if(testRecord){
-      let coverage=null;try{coverage=coverageReadable(root,testFacts);}catch{}
+      let coverage=null;if(!general)try{coverage=coverageReadable(root,testFacts);}catch{}
+      const programs=general?{runner:{file:command[0],args:command.slice(1),cwd:plan.cwd,searchPath:process.env.PATH,
+        env:{preload:true,bashEnv:Boolean(process.env.BASH_ENV)}},
+        judge:(child,main)=>childProgram(child,{toolchain,parentMain:main}),trusted:scriptCaches}:null;
       guard=testRunGuard(testRecord,{root,sourcePatterns:plan.sourcePatterns||plan.patterns,files:snap?.files,
-        runner:runnerPid,environment:selected.environment||{},coverage});
+        runner:runnerPid,environment:selected.environment||{},coverage,programs});
       runFacts=guard.runFacts;
-      const shared=sharedInstalledFile(root,testFacts);
-      if(shared)guard.issues.push(`installed file ${shared} has another hard link, likely into a package store; a change through it is not observed`);
+      // The pnpm executable reads its configuration natively: kept by content.
+      if(guard.opaque)for(const file of pnpmConfigFiles())try{runFacts.push(['readFile',file,queryAnswer('readFile',file)]);}
+        catch{guard.issues.push(`pnpm configuration ${file} cannot be read`);}
+      const shared=sharedInstalledFile(root,testFacts,path.join(state,'pnpm-store-links-v1.json'));
+      if(shared)guard.issues.push(`installed file ${shared.file} ${shared.reason}; a change through it is not observed`);
       fs.rmSync(testRecord,{recursive:true,force:true});
     }
     // The daemon reads the recording from owned state; control requests are small.
@@ -392,7 +408,8 @@ async function execute() {
       const directory=rel=>{try{return fs.lstatSync(path.join(root,rel)).isDirectory();}catch{return false;}};
       const changed=changedFiles(snap.files,end.files),events=(end.inputEventPaths||[]).filter(rel=>!directory(rel));
       const touched=[...new Set([...changed,...events])].sort();
-      const ignored=touched.length&&touched.every(guard.isOutput)?gitIgnored(root,touched):new Set();
+      const output=rel=>guard.isOutput(rel)||general&&toolOutput(rel,guard);
+      const ignored=touched.length&&touched.every(output)?gitIgnored(root,touched):new Set();
       if(touched.every(file=>ignored.has(file))){eventsExplained=true;if(changed.length)outputs=changed;}
     }
     // The end certificate, recorded or probed, must cover what this compile received.
@@ -447,9 +464,10 @@ async function execute() {
     }
     // A recorded run's receipt carries its run facts, even none; observers that
     // predate run facts do not reuse version 2.
-    const receipt={result,invocation,target,stable,fingerprintVersion:recorded||testRun?2:1,
+    // The recipe that made the receipt, which status and the hook name.
+    const receipt={result,invocation,target,stable,fingerprintVersion:recorded||testRun?2:1,recipe:selected.qualification||null,
       ...(recorded||testRun?{runFacts}:{}),
-      ...(testRun?{verificationRecipe:testsInterpretation,guardIssues:guard?.issues||['the run record is unavailable'],
+      ...(testRun?{verificationRecipe:general?scriptInterpretation:testsInterpretation,guardIssues:guard?.issues||['the run record is unavailable'],
         environmentReads:guard?.environmentReads||{},...(nondeterministic?{nondeterministic}:{})}:{}),
       resolutionLinks:plan.resolutionLinks||[],
       coverage:{qualified:plan.unresolved.length===0,unresolved:plan.unresolved},

package/src/daemon.mjs

@@ -20,7 +20,9 @@ import {inputKey,planGuard,toolchainKey} from './decision-validation.mjs';
 import {queriesHold,runFactReason as runFactChanged} from './typescript-list.mjs';
 import {nextProbeHint,probeDeadline,probeFloorMs} from './probe-deadline.mjs';
 import {statusSummary} from './cached-state.mjs';
-import {directProject,directProbeValue,reviewedTypeScriptVersions} from './direct-typescript.mjs';
+import {directProject,directProbeValue} from './direct-typescript.mjs';
+import {npmCacheDir} from './npm-integrity.mjs';
+import {runFromArgv} from './typescript-invocation.mjs';
 import {buildInfoPath,recordedCertificate} from './direct-run-certificate.mjs';
 import {timing,mark,traceBase,traceContext,traceScope,traceEnvironment,traceId} from './decision-profile.mjs';
 
@@ -130,7 +132,7 @@ function continuityBarrier() {
 // The basis a full direct probe is checked against: plan guard, observation
 // continuity, and the compiler tree and Node identity taken before the probe.
 function certificateBasis(row) {
-  const argv=row.plan.probes[0],compiler=directProject(argv[2],argv[3],{verify:false});
+  const argv=row.plan.probes[0],compiler=directProject(argv[2],runFromArgv(argv.slice(3)),{verify:false});
   return {guard:planGuard(index.bundle),gaps:metrics.gaps,
     compiler:JSON.stringify([compiler.tsRoot,compiler.entry,compiler.digest]),
     toolchain:toolchainKey(compiler.tsRoot,argv[0])};
@@ -238,8 +240,18 @@ function probe(row,allowReuse=false,{launch=true}={}) {
         .includes(row.plan.qualification)?
         /VSTATE_REASON:([a-z-]+)/.exec(out.stderr?.toString()||'')?.[1]:null;
       const explanations={
-        'direct-typescript-implementation-unreviewed':'installed TypeScript bytes or membership differ from the reviewed compiler',
-        'direct-typescript-version-unsupported':`direct compiler recipe supports reviewed TypeScript ${reviewedTypeScriptVersions.join(', ')} only`,
+        'direct-typescript-implementation-unreviewed':'installed TypeScript files differ from the reviewed compiler or from the tarball package-lock.json names',
+        'direct-typescript-version-unsupported':'direct compiler recipe supports TypeScript 5.x and 6.0',
+        'direct-typescript-lockfile-source-unsupported':'package-lock.json installs TypeScript from somewhere other than the registry\'s typescript package (an alias, a file or a git source)',
+        'npm-shrinkwrap-unsupported':'npm-shrinkwrap.json is not read; the reviewed TypeScript releases still qualify',
+        'direct-typescript-lockfile-integrity-missing':'package-lock.json records no integrity for the installed TypeScript',
+        'direct-typescript-lockfile-version-differs':'installed TypeScript version differs from package-lock.json; run npm ci',
+        'npm-lockfile-unreadable':'package-lock.json cannot be read',
+        'npm-lockfile-integrity-unsupported':'package-lock.json records TypeScript integrity with neither sha512 nor sha1',
+        'npm-tarball-uncached':`the TypeScript tarball package-lock.json names is not in npm's cache (${npmCacheDir(root)}); run npm ci or npm cache add`,
+        'npm-tarball-corrupt':"npm's cached TypeScript tarball does not match its integrity",
+        'npm-tarball-invalid':"npm's cached TypeScript tarball cannot be read",
+        'npm-tarball-link-unsupported':"npm's cached TypeScript tarball holds links",
         'direct-execution-environment-unsupported':'direct compiler rejects development helpers, Node cache/preloads, and unreviewed runtime overrides',
         'direct-node-version-unsupported':'direct compiler recipe supports Node 22 and 24',
         'npm-launcher-unobserved-inputs':'npm launcher uses unobserved notifier inputs; execution is recording-only',
@@ -340,6 +352,7 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       plan_id:row.plan.id,observed_at:lastObservation,
       invocation:r?.invocation||null,target_provenance:r?.target||null,
       ...(r?.verificationRecipe?{verification_recipe:r.verificationRecipe}:{}),
+      ...(r?.recipe?{recipe:r.recipe}:{}),
       coverage_at_run:r?.coverage||null,declared_inputs_match:null,reuse_eligible:false,
       ...(r?.runFacts?.length?{run_facts:r.runFacts.length}:{})};
     if(receiptStateError){item.reason=receiptStateError;return item;}
@@ -492,7 +505,7 @@ function adopt(name,row,token) {
     return done('inputs or certificate changed during the run');
   const cache=pending.cache,argv=row.plan.probes[0];
   let result;
-  try{result=recordedCertificate(text,cache,directProject(argv[2],argv[3],{verify:false}),buildInfoPath(row.plan));}
+  try{result=recordedCertificate(text,cache,directProject(argv[2],runFromArgv(argv.slice(3)),{verify:false}),buildInfoPath(row.plan));}
   catch{return done('recording unreadable');}
   if(result.issue)return done(result.issue);
   const identities=new Map(cache.identities);
@@ -782,8 +795,8 @@ function markInputEvent(name,rel,type,replay) {
   if(!hasHistory||historyDisabled||replay){
     const serial=(inputEventSerial.get(name)||0)+1;
     inputEventSerial.set(name,serial);
-    // Kept only for test checks; trimmed in batches.
-    if(index?.checks.get(name)?.plan.qualification==='npm-tests-direct-v1'){
+    // Kept only for recorded test and script checks; trimmed in batches.
+    if(['npm-tests-direct-v1','node-script-v1'].includes(index?.checks.get(name)?.plan.qualification)){
       const list=inputEventPaths.get(name)||[];list.push([serial,rel]);
       if(list.length>2*eventPathLimit)list.splice(0,list.length-eventPathLimit);inputEventPaths.set(name,list);
     }
@@ -1217,7 +1230,9 @@ const server=net.createServer(client=>{
     event('control_reply_unavailable',{classification:handled?'closed_without_reply':
       'closed_before_request',request_bytes:text.length});});
   client.on('data',d=>{
-    if(handled)return;text+=d;if(text.length>4096){event('control_request_rejected',
+    // A sync request carries each check's context digests, about 1.5 KB per
+    // check; 1 MiB leaves room for hundreds of checks.
+    if(handled)return;text+=d;if(text.length>1024*1024){event('control_request_rejected',
       {classification:'request_too_large',request_bytes:text.length});client.destroy();return;}
     if(!text.includes('\n'))return;handled=true;
     try{const message=JSON.parse(text);