@redue/cli 0.1.0-alpha.18 → 0.1.0-alpha.19

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## 0.1.0-alpha.19 — 2026-10-24
+
+A general recipe for typecheck and lint scripts that the strict recipes do not
+take. Test scripts stay on the direct test recipe (Vitest, Jest).
+
+- `redue init` tries the strict recipes first, then writes a general check
+  (`"qualification": "node-script-v1"`) for a root typecheck or lint script.
+  `redue run` runs the script through the project's package manager (npm,
+  pnpm 9-12 or Yarn with the `node-modules` linker) with REDUE's recorder in
+  every Node process, on macOS and Linux. The input is the whole checkout but
+  `.git`, `node_modules` and runner caches, plus every workspace
+  `node_modules` observed as installed files, the package manager and its
+  version, and the environment. See docs/user/node-script.md.
+- pnpm's launchers are trusted only when their text matches a template a pnpm
+  release writes (pnpm 8.0 to 12.14). The pnpm executable, Corepack's
+  pnpm-native included, is toolchain; its configuration files are kept by
+  content.
+- A run that starts a program REDUE does not record is UNVERIFIED and the
+  reason names it: native programs from installed packages (esbuild, turbo,
+  tsgolint, biome), git, find, and shells that read startup files.
+- `status` and the hook's skip message name the recipe that made the receipt
+  ("general recipe"). The Claude Code hook recognizes lint commands as it does
+  typecheck and test commands: `npm run lint`, `pnpm lint`, and for a script
+  that is one plain command, that command and its `npx` form.
+- In the census of 108 public TypeScript repos, the general recipe qualifies
+  23 typecheck and 21 lint scripts (both recorded runs clean, CURRENT after
+  the second). Of the scripts whose runs start only Node and the package
+  manager's own launchers (35 typecheck, 37 lint, measured with strace), init
+  proposes and observes about 21 and 22, and 18 of each qualify. The rest:
+  init does not pick script names such as `tsc:build`, fails in monorepos
+  over 50 packages, or refuses source directory links and custom install
+  setups; plans with submodules or dangling links are unavailable.
+- Known limits: on macOS, pnpm 12's temporary files in the project root can
+  arrive as an event on the root and make a run UNVERIFIED. Writes into
+  `node_modules` during a run make it UNVERIFIED, except pnpm's workspace
+  state and vue-tsc's global types, which stay inputs and are kept as the run
+  left them. A workspace's recording checks now leave out nested
+  `node_modules`, so `redue init` rewrites them once.
+
+- Contributors: `census.mjs --product` applies the product's own rule and
+  lists the files an unstable run touched; the eval kills a timed-out
+  command's whole process group; the agent eval has lint tasks.
+
 ## 0.1.0-alpha.18 — 2026-10-23
 
 Typecheck in more project shapes, and pnpm test reuse on Linux. In the census

package/README.md

@@ -76,10 +76,14 @@ Start with ordinary `status`. When it cannot establish caller context, use
 **Synchronization can cost more than rerunning a cheap check, particularly on
 Windows.** REDUE does not choose or execute that tradeoff for you.
 
-Since alpha.4, ordinary npm scripts are recording-only after
-[an npm launcher applicability gap](docs/acceptance/npm-launcher-boundary.md).
-A separate explicit [direct compiler recipe](docs/user/direct-typescript.md) can
-qualify supported npm typechecks. It does not claim that npm/lifecycle scripts ran.
+`init` tries the strict recipes first: the [direct compiler recipe](docs/user/direct-typescript.md)
+for npm typechecks, the pnpm and Yarn TypeScript recipes, and the
+[direct test recipe](docs/user/tests-direct.md). A root typecheck or lint
+script none of them takes can use the [general recipe](docs/user/node-script.md),
+which runs the script through the package manager and records every Node
+process; a script that starts another program (git, esbuild, turbo) stays
+UNVERIFIED and the reason names it. Test scripts use the direct test recipe
+(Vitest, Jest); other test scripts stay recording-only.
 
 ## Connect your agent (experimental)
 

package/bin/redue.mjs

@@ -6,6 +6,7 @@ mark('client.loaded');
 import {directCompiler,directQualification,directEnvironment,directInterpretation} from '../src/direct-typescript.mjs';
 import {runArgv,tscRun} from '../src/typescript-invocation.mjs';
 import {testEnvironment,testRunnerAt,testsInterpretation,testsQualification} from '../src/test-direct.mjs';
+import {scriptEnvironment,scriptInterpretation,scriptKinds,scriptQualification} from '../src/node-script.mjs';
 import os from 'node:os';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
@@ -27,7 +28,7 @@ const help=`REDUE ${version}
 Usage: redue [--config FILE] [--state-dir DIR] COMMAND [OPTIONS]
 
 Commands:
-  init [--dry-run] [--workspace NAME] [--check KIND] [--recipe typescript-direct|tests-direct]
+  init [--dry-run] [--workspace NAME] [--check KIND] [--recipe typescript-direct|tests-direct|node-script]
                        Discover existing scripts; optionally select one workspace/check
   agent setup codex|claude [--dry-run|--apply] [--json]
   agent doctor [codex|claude] [--json]
@@ -246,6 +247,7 @@ const checks=publicConfig.checks.map(check=>{
   const npmDirect=check.qualification===directQualification;
   const pnpmTypecheck=check.qualification==='pnpm-tsc-v1';
   const testsDirect=check.qualification===testsQualification;
+  const generalScript=check.qualification===scriptQualification;
   if(check.script&&check.command&&!pnpmTypecheck&&!npmDirect&&!testsDirect)
     error(`${check.name}: choose script or command, not both`);
   const manager=publicConfig.packageManager;
@@ -255,8 +257,12 @@ const checks=publicConfig.checks.map(check=>{
     [`@which:${manager}`,'run',check.script]:null;
   const npmAutomatic=check.qualification==='typescript-noemit-v1';
   const yarnWorkspace=check.qualification==='yarn-workspace-tsc-v1';
-  if(check.qualification&&!npmAutomatic&&!npmDirect&&!yarnWorkspace&&!pnpmTypecheck&&!testsDirect)
+  if(check.qualification&&!npmAutomatic&&!npmDirect&&!yarnWorkspace&&!pnpmTypecheck&&!testsDirect&&!generalScript)
     error(`${check.name}: unknown qualification contract`);
+  // The general recipe runs the root package script through the package manager.
+  if(generalScript&&(!['npm','pnpm','yarn'].includes(manager)||!check.script||check.command||check.cwd&&check.cwd!=='.'||
+    check.workspace||!scriptKinds.includes(check.kind)))
+    error(`${check.name}: the general recipe needs a root typecheck, test or lint script, without command or cwd`);
   if(npmDirect&&(manager!=='npm'||check.cwd&&check.cwd!=='.'||!Array.isArray(check.command)||
     check.command[0]!=='@node'||check.command[1]!=='@typescript-compiler:.'||
     !tscRun({},{script:null,args:check.command.slice(2)}).run?.noEmit))
@@ -297,7 +303,7 @@ const checks=publicConfig.checks.map(check=>{
       check.workspace||'.',...run]]:[];
   const windowsContext=process.platform==='win32'?
     ['ComSpec','COMSPEC','PATHEXT','USERPROFILE']:[];
-  const autoEnvironment=npmDirect?directEnvironment:testsDirect?testEnvironment:npmAutomatic?{variables:['NODE_OPTIONS','NODE_PATH','CI','HOME',
+  const autoEnvironment=npmDirect?directEnvironment:testsDirect?testEnvironment:generalScript?scriptEnvironment(manager):npmAutomatic?{variables:['NODE_OPTIONS','NODE_PATH','CI','HOME',
     'NODE_ENV','BASH_ENV','ENV',...windowsContext],prefixes:['npm_config_','DYLD_','TSGO_'],
     pathExecutables:['node','npm'],executableIdentity:true}:yarnWorkspace?
     {variables:['NODE_OPTIONS','NODE_PATH','CI','HOME','NODE_ENV','BASH_ENV','ENV',...windowsContext],
@@ -323,6 +329,7 @@ const checks=publicConfig.checks.map(check=>{
     ...(npmAutomatic?{qualificationInterpretation:'npm-launcher-withheld@1'}:{}),
     ...(npmDirect?{qualificationInterpretation:directInterpretation}:{}),
     ...(testsDirect?{qualificationInterpretation:testsInterpretation}:{}),
+    ...(generalScript?{qualificationInterpretation:scriptInterpretation}:{}),
     workspace:check.workspace||null,kind:check.kind||null};
 });
 const runtime={schema:1,provider:'declared-project@1',root,state,checks};

package/docs/user/configuration.md

@@ -30,6 +30,8 @@ out of version-controlled configuration.
 
 For the explicit direct compiler choice and generated exact argv, see
 [direct TypeScript](direct-typescript.md). Existing script receipts cannot satisfy it.
+A general check (`"qualification": "node-script-v1"`) has a `script` and no
+`command`; see the [general recipe](node-script.md).
 
 ## Arbitrary commands
 

package/docs/user/getting-started.md

@@ -82,9 +82,10 @@ Use a check actually printed by `init`. For a workspace:
 `redue init --workspace @example/package --check typecheck`.
 Initialization previews detected commands and qualification confidence before writing
 `redue.config.json`. An existing config is never overwritten. No checks are run and
-no dependencies installed. A missing/unsupported boundary is explained. Npm-launcher typechecks are
-recording-only in alpha.4; a passed execution is historical PASS with UNVERIFIED
-applicability, not reusable CURRENT.
+no dependencies installed. A missing/unsupported boundary is explained. `init` tries
+the strict recipes first and uses the [general recipe](node-script.md) for a root
+typecheck or lint script none of them takes. Test scripts use the
+[direct test recipe](tests-direct.md).
 
 “Ready to qualify” means REDUE has a supported recipe whose prerequisites will be
 validated. It is not a receipt. “Recording-only” can record PASS/FAIL without claiming
@@ -92,10 +93,9 @@ reusability. Qualification can change when configuration or installation changes
 
 `run` streams normal output and preserves execution environment and cancellation.
 For the narrow pnpm TypeScript contract, `init` explicitly shows the direct installed
-compiler invocation it selects. Npm scripts remain recording-only;
-use `redue init --recipe typescript-direct --dry-run` to preview a distinct,
-explicit [local compiler recipe](direct-typescript.md). Other scripts run through
-the package manager. No existing configuration is silently migrated.
+compiler invocation it selects, and for npm the
+[local compiler recipe](direct-typescript.md). General checks and other scripts
+run through the package manager. No existing configuration is silently migrated.
 Only use configs and probes from trusted repositories: these execute local code.
 
 `status` is cached and conservative. `status --sync` and `explain` revalidate caller

package/docs/user/node-script.md

@@ -0,0 +1,153 @@
+# General recipe (typecheck and lint scripts)
+
+The general recipe records a project's own typecheck or lint script, run
+through its package manager, and reports later whether that result still
+applies to the files you have. It is a lower tier than the strict recipes:
+`redue init` tries the [direct TypeScript recipe](direct-typescript.md), the
+pnpm and Yarn TypeScript recipes and the [direct test recipe](tests-direct.md)
+first, and uses the general recipe for a root typecheck or lint script none of
+them takes. Test scripts use the direct test recipe; `init` does not propose
+the general recipe for them.
+
+It supports a project installed by npm, pnpm 9-12 (isolated or hoisted
+`node_modules`) or Yarn with the `node-modules` linker, with one lockfile kind
+matching any `packageManager` declaration, on macOS and Linux with Node 22 or
+24. Workspaces are supported for root scripts. `init --recipe node-script`
+writes general checks only.
+
+## Setup
+
+```sh
+redue init
+redue start
+redue run lint
+redue status --sync
+```
+
+The config gets one field for the recipe, written by `init`:
+
+```json
+{"name": "lint", "script": "lint", "kind": "lint", "qualification": "node-script-v1", "inputs": ["**", "..."]}
+```
+
+`redue run lint` runs `npm run lint` (or `pnpm run lint`, `yarn run lint`) with
+REDUE's recorder loaded in every Node process, and npm's and pnpm's update
+checks turned off. With the Claude Code hook, `npm run lint`, `pnpm lint` and,
+for a script that is one plain command such as `eslint .`, that command itself
+and `npx eslint .` are recognized like typecheck and test commands.
+`status` and the hook's skip message name the recipe that made the receipt.
+
+## What REDUE claims
+
+CURRENT means the last run's inputs are unchanged:
+
+- every file in the checkout, except `.git`, every `node_modules`, the runner
+  caches listed below and the files the run itself wrote;
+- the installed files in the root's and every workspace package's
+  `node_modules`, and Yarn's install state, by file identity;
+- the lockfile and `package.json`, as files of the checkout;
+- the package manager's executable and Node, by file identity, and the exact
+  script;
+- every environment variable the run's JavaScript read directly, and always
+  `TZ`, `LANG`, `PATH`, `HOME`, `CI`, `XDG_CONFIG_HOME` and every `NODE_*`,
+  `LC_*`, `VITE_*`, `DYLD_*`, `LD_*`, `npm_config_*`, `pnpm_config_*`,
+  `PNPM_*`, `COREPACK_*` and `YARN_*` variable;
+- the executables of npm, pnpm, Yarn and Corepack on PATH, by file identity,
+  since a script may run another package manager;
+- small files read outside the checkout (up to 1 MB), by content, and lookups
+  outside it, asked again before each answer.
+
+Runner caches are not inputs, and a run may read and write them: `.cache`,
+`.vite`, `.vitest`, `.turbo`, `.nx`, `.swc`, `.jest-cache`, `.parcel-cache`,
+`.angular/cache`, `.next/cache` and `.tmp` directories, `*.tsbuildinfo`,
+`.eslintcache`, `.stylelintcache`, `.prettiercache`, and the
+`_tmp_<pid>_<hex>` files pnpm writes and removes at every run. A file with
+such a path that git does not ignore is source: reading it makes the run
+UNVERIFIED. At the top of each `node_modules`, only `.cache`, `.vite`,
+`.vite-temp`, `.vitest` and `.vitest-cache` are left out, and `*.tsbuildinfo`
+anywhere in it.
+
+Two installed files are rewritten by tools during a run: pnpm's
+`node_modules/.pnpm-workspace-state-v1.json` at the first run after an
+install, and the `node_modules/.vue-global-types/*.d.ts` files vue-tsc writes
+before it reads them. They stay inputs. When they are the only files a run
+changed, and the run wrote them (a recorded process wrote the file, or the
+pnpm executable ran, for its state), the result is kept with the files as the
+run left them, and a later change to them makes it STALE.
+
+It does not mean a rerun would give the same result: a test that depends on
+the time or on randomness can pass now and fail later on the same inputs.
+
+## Programs
+
+The recorder sees only Node processes. Every other program a run starts must be
+one REDUE can account for:
+
+- `sh` or `dash`, or `bash` without `BASH_ENV`, running a command that, read
+  as text, starts only Node programs, package managers and shell builtins
+  (`cd`, `echo`, `true`, `export`, `exec` and a few more). Words are looked up
+  on the PATH the shell got. A Node program is the Node executable, a file
+  whose `#!` line runs Node, or a pnpm launcher. A version manager's `node`
+  shim (asdf, nodenv) is a script and does not count. Other shells read
+  startup files and are refused. The shell must still have REDUE's recorder in
+  `NODE_OPTIONS`: npm's and pnpm's `node-options` setting replaces it, and a
+  run under such a setting is UNVERIFIED;
+- a pnpm launcher in `node_modules/.bin`: the `#!/bin/sh` script pnpm writes,
+  which runs `sed`, `dirname`, `uname` or `readlink` before it starts Node. It
+  is trusted only when its text is exactly one of the templates pnpm 8.0 to
+  12.14 write (`src/pnpm-shim-templates.json`), with only the bin file and
+  `NODE_PATH` filled in;
+- the pnpm executable (pnpm 12, also the copy Corepack downloads): REDUE cannot
+  see what it does, so the scripts it runs are read as text the same way,
+  their `pre` and `post` scripts included. Filters and recursive runs
+  (`--filter`, `-r`) are refused. At least one Node process it starts must
+  have loaded the recorder, and its configuration files outside the checkout
+  (`pnpm/rc`, `pnpm/config.yaml`, `~/.npmrc`, the global `npmrc`) are kept by
+  content;
+- `ps -A -o ppid,pid`, which pnpm loaded into Corepack runs.
+
+Anything else makes the result UNVERIFIED and names the program: `git`,
+`sleep`, `find`, and native programs from installed packages such as esbuild,
+turbo, tsgo, tsgolint and biome, whose reads, writes and network use REDUE
+cannot see. `init` reads the script the same way and keeps a script that
+starts such a program recording-only, with the program in the reason.
+
+A command line may use `&&`, `||`, `;`, `|`, quotes without expansions,
+globs in arguments and redirection to `/dev/null`. Variables, command
+substitution, input redirection, subshells, here-documents and `command -p`
+are refused. Setting or clearing `NODE_OPTIONS`, `PATH`, `REDUE_RUN_RECORD`,
+`BASH_ENV`, `ENV`, or npm's or pnpm's `node-options` or `script-shell` is
+refused, since it could stop a Node process from loading the recorder.
+`node --env-file` and Node's config-file options are refused: Node reads those
+files natively. `process.loadEnvFile` is recorded as a read.
+
+## The guard
+
+As in the [direct test recipe](tests-direct.md#the-guard), the result is kept
+but marked UNVERIFIED, with the reason, when the run read a git-ignored file
+REDUE does not observe and did not create first, changed an input during the
+run (a formatter's `--write`, a generated `version.ts`), listed a directory or
+read a large file outside the checkout, used the network, or started a program
+REDUE does not account for. Reads through a workspace package's link in
+`node_modules` count where the link leads.
+
+The package managers' own installations, Corepack's downloads and npm's log
+directory are toolchain, identified by the package manager's executable, not
+inputs.
+
+## Limits
+
+- On macOS, a file created and removed directly in the project root during a
+  run (pnpm 12 does this) can be reported by the file watcher as an event on
+  the root itself, an observation gap that makes the run UNVERIFIED. Linux
+  reports the file, which is not an input.
+- The pnpm executable and the pnpm launchers' helpers are trusted as
+  toolchain: what they read is not checked.
+- Code that copies the environment and reads the copy, and native code that
+  reads files or variables (native addons such as Rust-based resolvers), is
+  not seen.
+- A project whose `.npmrc` sets `node-options` stays UNVERIFIED: npm replaces
+  `NODE_OPTIONS` with it, which drops REDUE's recorder.
+- A script that runs a build first (`npm run build && tsc --noEmit`) usually
+  starts esbuild or another native bundler and stays UNVERIFIED.
+- Windows is not supported; the check stays recording-only there.

package/docs/user/supported-projects.md

@@ -15,9 +15,11 @@ At the repository root, `init` looks for existing typecheck, test, lint, and
 build scripts. It prefers familiar script names, then unique recognizable
 `tsc`, Vitest/Jest, ESLint, or Vite commands under other names. Multiple
 matches are reported as ambiguous rather than guessed. It never creates a new
-project script. Automatic npm-launcher applicability was withdrawn in alpha.4;
-ordinary npm scripts remain recording-only. See the [maintainer notice](npm-launcher-notice.md).
-The direct recipe is opt-in, available since alpha.5. The opt-in `init --recipe typescript-direct` supports
+project script. Without `--recipe`, `init` tries the strict recipes below first,
+then the [general recipe](node-script.md) for a root typecheck or lint
+script: the script run through the package manager with every Node process
+recorded and the whole checkout as its input. `--recipe typescript-direct`,
+`tests-direct` or `node-script` selects one recipe alone. The direct TypeScript recipe supports
 a typecheck script of `tsc --noEmit` runs in any argument order, chained runs,
 or no typecheck script at all (a proposed `tsc --noEmit`; see
 [script forms](direct-typescript.md#script-forms)), in a single-package npm installation using
@@ -41,11 +43,11 @@ When an internal dependency is consumed through built declarations, changing
 only its source does not stale the selected check until the consumed output
 changes. Unsupported custom resolution, project references, outside-root
 source links, and installation modes remain recording-only. Other Yarn
-typechecks, Vitest/Jest, ESLint, and builds start recording-only unless a
-separately justified explicit contract is provided. For a single-package npm
-project whose test script runs Vitest 4/5 or Jest 29 directly, the opt-in
-`init --recipe tests-direct` records the run and guards its inputs; see
-[direct tests](tests-direct.md).
+typechecks, Vitest/Jest, ESLint, and builds in workspace packages start
+recording-only unless a separately justified explicit contract is provided.
+For a single-package project whose test script runs Vitest 4/5 or Jest 29
+directly, `init` uses the direct test recipe, which records the run and guards
+its inputs; see [direct tests](tests-direct.md).
 In particular, test caches and build-generated inputs are not excluded to
 make evidence green.
 
@@ -75,8 +77,8 @@ TypeScript itself computes them for new files, minus `node_modules` (`exclude`
 entries stay inputs: an import can still reach an excluded file); a file the
 program reads outside them keeps the check recording-only. This avoids pnpm's task-run bookkeeping
 writes during `pnpm run`; it does not alter the project's script. Test, lint,
-build, and ambiguous TypeScript scripts still execute through `pnpm run` and
-start recording-only. The generated `@typescript-bin:WORKSPACE` token resolves
+build, and ambiguous TypeScript scripts still execute through `pnpm run`; root
+typecheck and lint ones can use the [general recipe](node-script.md). The generated `@typescript-bin:WORKSPACE` token resolves
 the local compiler when the check runs; it is not an absolute machine path.
 
 The pnpm contract indexes consumed installed package contents inside the

package/docs/user/tests-direct.md

@@ -1,7 +1,8 @@
 # Direct test recipe (Vitest and Jest)
 
-`redue init --recipe tests-direct --check test` records a project's unit test
-run and reports later whether that result still applies to the files you have.
+`redue init` (or `redue init --recipe tests-direct --check test` for this recipe
+alone) records a project's unit test run and reports later whether that result
+still applies to the files you have.
 It supports a single-package project installed by npm, pnpm 9-12 (isolated or
 hoisted `node_modules`) or Yarn with the `node-modules` linker, whose test
 script runs Vitest 4 or 5, or Jest 29, directly. It runs on macOS and Linux with
@@ -35,7 +36,8 @@ runner directly, otherwise the only script that does. The script must be one
 runner invocation: no `&&`, quotes, globs or variable assignments. Watch mode,
 `--changed`, `related`, snapshot updates (`-u`), shuffling, sharding and
 Jest's `--onlyChanged` are refused. Vitest needs `run`, `--run` or
-`--watch=false`. Other scripts stay recording-only.
+`--watch=false`. Other test scripts stay recording-only: the
+[general recipe](node-script.md) covers typecheck and lint scripts, not tests.
 
 REDUE runs the local runner with Node directly. The package manager, its
 lifecycle scripts and `package.json` are not changed or executed.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@redue/cli",
   "private": false,
-  "version": "0.1.0-alpha.18",
+  "version": "0.1.0-alpha.19",
   "publishConfig": {
     "access": "public",
     "tag": "alpha"

package/src/agent-integration.mjs

@@ -26,7 +26,7 @@ const sameJson=(a,b)=>JSON.stringify(a)===JSON.stringify(b);
 // Fan-out commands (turbo, nx, `pnpm -r`) and root scripts that run one get
 // prefix rules; the hook decides from the full command.
 function hookFor(config,relative,scripts){
-  const rules=[...new Set([...hookForms(config,relative).flatMap(row=>[...row.forms,...row.local]),
+  const rules=[...new Set([...hookForms(config,relative,scripts).flatMap(row=>[...row.forms,...row.local]),
     ...fanoutRules(config,scripts)])].map(form=>`Bash(${form}*)`);
   return rules.length?{matcher:'Bash',hooks:rules.map(rule=>({type:'command',if:rule,command:hookCommand,timeout:15}))}:null;
 }
@@ -99,17 +99,23 @@ function saved(root,host){const text=read(root,marker(host));if(text===null)retu
   return value;
 }
 // The managed block is always in the agent's context, so it stays short. For
-// Claude Code it names the typecheck and test commands the hook matches, asks
+// Claude Code it names the typecheck, test and lint commands the hook matches, asks
 // the agent to run them rather than judge for itself that a rerun is not
 // needed, and says what a skip means. The hook does the rest, so the block
 // does not point to the skill; the skill stays for agents that look for it.
 const quoted=forms=>forms.map(form=>`\`${form}\``).join(' and ');
-const commandsOf=rows=>[rows.filter(row=>row.kind!=='test').map(row=>row.form),rows.filter(row=>row.kind==='test').map(row=>row.form)];
+const commandsOf=rows=>[rows.filter(row=>row.kind!=='test'&&row.kind!=='lint').map(row=>row.form),
+  rows.filter(row=>row.kind==='test').map(row=>row.form),rows.filter(row=>row.kind==='lint').map(row=>row.form)];
 const fence=(host,body)=>`\n\n<!-- REDUE:${host}:begin -->\n${body}<!-- REDUE:${host}:end -->\n`;
 const skillPointer=host=>`Before you run, skip or report a typecheck or other configured check, read\n${hosts[host].skill}.\n`;
 function blockFor(host,rows=[]){
-  const [typechecks,tests]=commandsOf(rows);
+  const [typechecks,tests,lints]=commandsOf(rows);
   if(!rows.length)return fence(host,skillPointer(host));
+  if(lints.length)return fence(host,(typechecks.length?`Typecheck with ${quoted(typechecks)}.\n`:'')+
+    (tests.length?`Run the unit tests with ${quoted(tests)}.\n`:'')+`Lint with ${quoted(lints)}.\n`+
+    `Run a check before you say it passes, even after an edit you think cannot\n`+
+    `matter; don't skip it yourself. If its last pass still applies to these exact\n`+
+    `files, a REDUE hook skips the run and says so. That skip counts as a pass.\n`);
   if(!tests.length)return fence(host,`Typecheck with ${quoted(typechecks)}. Run it before you say it passes, even after an\n`+
     `edit you think cannot matter; don't skip it yourself. If its last pass still\n`+
     `applies to these exact files, a REDUE hook skips the run and says so. That\n`+
@@ -157,7 +163,8 @@ function knownBlock(host,relative,block){
   const list='((?:`[A-Za-z0-9_./:=,+@ -]+`(?: and )?)+)';
   const forms=pattern=>{const named=new RegExp(pattern).exec(block);return named?[...named[1].matchAll(/`([^`]+)`/g)].map(m=>m[1]):[];};
   const rows=[...forms(`^\\n\\n<!-- REDUE:[a-z]+:begin -->\\nTypecheck with ${list}\\.`).map(form=>({kind:'typecheck',form})),
-    ...forms(`Run the unit tests with ${list}\\.\\n`).map(form=>({kind:'test',form}))];
+    ...forms(`Run the unit tests with ${list}\\.\\n`).map(form=>({kind:'test',form})),
+    ...forms(`Lint with ${list}\\.\\n`).map(form=>({kind:'lint',form}))];
   return block===blockFor(host,rows)||block===earlierBlock(host,rows)||priorBlocks(host,relative).includes(block);
 }
 // The policy with the exact commands for this config, so an agent never builds
@@ -168,6 +175,7 @@ function skillFor(relative,host,config){
   const redue=redueFor(relative)??`redue --config ${JSON.stringify(relative)}`,status=`${redue} status --sync --json`;
   const rows=host==='claude'?hookForms(config,relative).filter(row=>!row.part):[];
   const label=row=>row.kind==='test'?(row.check==='test'?'Unit tests':`Unit tests \`${row.check}\``):
+    row.kind==='lint'?(row.check==='lint'?'Lint':`Lint \`${row.check}\``):
     row.check==='typecheck'?'Typecheck':`Typecheck \`${row.check}\``;
   const commands=rows.map(row=>`- ${label(row)}: `+
     `${row.forms.map(form=>`\`${form}\``).join(' or ')}.\n`).join('')+
@@ -183,7 +191,7 @@ function skillFor(relative,host,config){
   // typecheck needs only the CLAUDE.md block, so the description must not
   // send the agent here for one.
   const description=rows.length?'Rules and exact commands for redue status, redue run and other redue commands. '+
-    `A plain ${rows.some(row=>row.kind==='test')?'typecheck or test run':'typecheck'} needs only the REDUE section of CLAUDE.md.`:
+    `A plain ${rows.some(row=>row.kind==='lint')?'typecheck, test or lint run':rows.some(row=>row.kind==='test')?'typecheck or test run':'typecheck'} needs only the REDUE section of CLAUDE.md.`:
     'Use before running, skipping or reporting a typecheck or other configured check.';
   // Replacer functions, so `$` in a config name is never a replacement pattern.
   return policy.replace('{{DESCRIPTION}}',()=>description).replace('{{CONFIG}}',()=>JSON.stringify(relative)).replace('{{COMMANDS}}',()=>commands.trimEnd())

package/src/claude-hook.mjs

@@ -1,4 +1,4 @@
-// Claude Code PreToolUse hook: skip an exact typecheck or test rerun when REDUE
+// Claude Code PreToolUse hook: skip an exact typecheck, test or lint rerun when REDUE
 // reports CURRENT/PASS with reuse_eligible on the current inputs. When the check is not
 // CURRENT, the command becomes `redue run <check>` so the run is recorded. Every
 // other outcome, including errors and timeouts, allows the command unchanged.
@@ -11,6 +11,7 @@ import {projectState} from './project-location.mjs';
 import {realObservedPath} from './path-identity.mjs';
 import {processAlive} from './process-liveness.mjs';
 import {scriptRunChecks} from './typescript-invocation.mjs';
+import {recipeLabel} from './presentation.mjs';
 
 export const hookCommand='redue agent hook claude';
 // No shell metacharacters; `@` starts scoped package names.
@@ -19,7 +20,11 @@ const typecheck=check=>check?.kind==='typecheck'||check?.name==='typecheck';
 // A direct test check: its command is the runner and the script's arguments.
 const tests=check=>check?.qualification==='npm-tests-direct-v1'&&Array.isArray(check.command)&&
   /^@test-runner:(?:vitest|jest)$/.test(check.command[1]||'');
-export const checkKind=check=>tests(check)?'test':'typecheck';
+// A general recipe check: a root typecheck, test or lint script run through the package manager.
+const general=check=>check?.qualification==='node-script-v1'&&['typecheck','test','lint'].includes(check.kind)&&
+  typeof check.script==='string';
+const eligibleCheck=check=>typecheck(check)||tests(check)||general(check);
+export const checkKind=check=>tests(check)?'test':general(check)?check.kind:'typecheck';
 
 export const defaultConfig='redue.config.json';
 // The `redue` prefix for a config beside the project root; null when the name
@@ -53,8 +58,12 @@ function workspaceForms(pm,name,script){
     `npm run ${script} --workspace=${name}`,`npm -w ${name} run ${script}`];
   return [];
 }
-// The tool a check runs, as typed: `tsc ARGS` or the test runner's command.
-function toolText(check){
+// The tool a check runs, as typed: `tsc ARGS` or the test runner's command;
+// for a general check, its script when the script is one plain command.
+function toolText(check,scripts){
+  if(general(check)){const text=typeof scripts?.[check.script]==='string'?scripts[check.script].trim().replace(/\s+/g,' '):'';
+    return safe.test(text.replace(/ /g,''))&&!/^(?:npm|npx|pnpm|pnpx|yarn|node)(?: |$)/.test(text)&&
+      !scripts['pre'+check.script]&&!scripts['post'+check.script]?text:null;}
   const command=check.command;
   if(!Array.isArray(command)||command[0]!=='@node')return null;
   const words=/^@typescript-(?:compiler|bin):/.test(command[1]||'')?['tsc',...command.slice(2)]:
@@ -103,9 +112,9 @@ function tscCheck(check){return typecheck(check)&&/^tsc(?: |$)/.test(toolText(ch
 // only when the script's tsc runs are those checks' runs, one each. With one
 // check they stay on its row (`scriptForms`); a chain's checks get a row for
 // the script, and their own rows (`part`) keep only their own forms.
-export function hookForms(config,configFile=defaultConfig){
+export function hookForms(config,configFile=defaultConfig,packageScripts=null){
   const rows=[],redue=redueFor(configFile),pm=config?.packageManager,scripts=new Map();
-  const eligible=(config?.checks||[]).filter(check=>(typecheck(check)||tests(check))&&typeof check.name==='string'&&safe.test(check.name));
+  const eligible=(config?.checks||[]).filter(check=>eligibleCheck(check)&&typeof check.name==='string'&&safe.test(check.name));
   const groupOf=check=>tscCheck(check)&&typeof checkScript(check)==='string'&&checkDir(check)!==null?
     JSON.stringify([checkDir(check),checkScript(check),workspaceName(check)]):null;
   for(const check of eligible){const key=groupOf(check);if(key)scripts.set(key,[...scripts.get(key)||[],check.name]);}
@@ -116,7 +125,7 @@ export function hookForms(config,configFile=defaultConfig){
       group=key?scripts.get(key):null,part=group?.length>1;
     const own=group?null:checkScript(check);
     if(dir==='.'){
-      forms.push(...scriptForms(pm,own),...toolForms(pm,toolText(check)));
+      forms.push(...scriptForms(pm,own),...toolForms(pm,toolText(check,packageScripts)));
       if(!tests(check)&&Array.isArray(check.command)&&check.command.length&&
         check.command.every(v=>typeof v==='string'&&safe.test(v)&&!v.startsWith('@')))
         forms.push(check.command.join(' '));
@@ -167,7 +176,7 @@ export function fanout(text){
 // Bash `if` rules for fan-out commands of a task some workspace check runs,
 // and for root scripts that run one; other turbo or nx commands never start the hook.
 export function fanoutRules(config,scripts={}){
-  const tasks=new Set((config?.checks||[]).filter(check=>(typecheck(check)||tests(check))&&typeof check.name==='string'&&
+  const tasks=new Set((config?.checks||[]).filter(check=>eligibleCheck(check)&&typeof check.name==='string'&&
     ![null,'.'].includes(checkDir(check))).map(checkScript).filter(task=>typeof task==='string'&&/^[A-Za-z0-9_:.-]+$/.test(task)));
   const rules=[];
   for(const task of tasks){
@@ -203,7 +212,7 @@ export async function fanoutChecks(fan,config,projectRoot){
     return null;
   const names=[];
   for(const item of packages){
-    const own=config.checks.filter(c=>(typecheck(c)||tests(c))&&typeof c.name==='string'&&
+    const own=config.checks.filter(c=>eligibleCheck(c)&&typeof c.name==='string'&&
       workspaceName(c)===item.name&&checkScript(c)===fan.task&&checkDir(c)===item.dir);
     if(!own.length)return null;
     // A compiler script's checks: one per tsc run it has now.
@@ -235,6 +244,10 @@ function split(command){
 function matched(command,config,configFile,dir='.',scripts={}){
   const parts=split(command);
   if(!parts)return null;
+  const row=hookForms(config,configFile,dir==='.'?scripts:null).find(row=>dir==='.'?row.forms.includes(parts.base):
+    row.dir===dir&&row.local.includes(parts.base));
+  // A root script that a general check runs is that check, even when the script fans out.
+  if(dir==='.'&&row&&general(config.checks.find(check=>check.name===row.check)))return {check:row.check,rest:parts.rest};
   if(dir==='.'){
     // A root script that runs a fan-out is that fan-out, unless pre/post scripts
     // run around it: then it matches nothing.
@@ -243,8 +256,6 @@ function matched(command,config,configFile,dir='.',scripts={}){
         return scripts['pre'+name]||scripts['post'+name]?null:{fanout:fanout(text.trim()),rest:parts.rest};
     if(fanout(parts.base))return {fanout:fanout(parts.base),rest:parts.rest};
   }
-  const row=hookForms(config,configFile).find(row=>dir==='.'?row.forms.includes(parts.base):
-    row.dir===dir&&row.local.includes(parts.base));
   // A script form of compiler checks is checked against the script first.
   return row?.scriptForms?.includes(parts.base)?{row,rest:parts.rest}:row?{check:row.check,rest:parts.rest}:null;
 }
@@ -292,7 +303,8 @@ export function verdict(status,name,rest=null){
   const runId=row?.invocation?.runId;
   if(!row||row.freshness!=='CURRENT'||row.result!=='PASS'||row.reuse_eligible!==true||
     typeof runId!=='string'||!/^[0-9a-f-]{36}$/.test(runId))return null;
-  return `REDUE: check ${JSON.stringify(name)} passed on these exact inputs (run ${runId}); `+
+  const recipe=recipeLabel(row.recipe);
+  return `REDUE: check ${JSON.stringify(name)} passed on these exact inputs (run ${runId}${recipe?`, ${recipe}`:''}); `+
     'rerun skipped. This counts as a pass for the current files; no status check is needed. '+
     'To run it anyway, prefix the command with REDUE_FORCE=1.'+
     (rest===null?'':` Nothing else in the command ran either; run the rest on its own: ${rest}`);