@redue/cli 0.1.0-alpha.18 → 0.1.0-alpha.19

package/src/pnpm-shims.mjs

@@ -0,0 +1,54 @@
+// pnpm's launchers. On macOS and Linux, pnpm writes each node_modules/.bin
+// entry as a `#!/bin/sh` script that finds its own directory (with sed,
+// dirname, readlink, uname or printf, depending on the pnpm release), sets
+// NODE_PATH and execs Node on the package's bin file. A launcher is trusted only
+// when its text is one of the templates pnpm releases write
+// (pnpm-shim-templates.json, built by eval/pnpm-shim-templates.mjs), with only
+// the NODE_PATH value, the bin file and the trailing target comment filled in.
+import fs from 'node:fs';
+import path from 'node:path';
+
+const templates=JSON.parse(fs.readFileSync(new URL('pnpm-shim-templates.json',import.meta.url),'utf8')).templates;
+const known=new Set(templates.map(row=>row.template));
+// A value with no quote, expansion, escape or line break: it stays literal in
+// the shell.
+const literal=/^[^"$`\\\n]*$/;
+
+// The launcher's text as a template, with the values it fills in, or null
+// when it does not have pnpm's form.
+export function shimTemplate(text){
+  if(typeof text!=='string'||!text.startsWith('#!/bin/sh\n'))return null;
+  let template=text,nodePath=null;
+  // NODE_PATH, set alone or in front of the caller's.
+  const alone=/\n  export NODE_PATH="([^"\n]*)"\n/.exec(text);
+  if(alone){
+    nodePath=alone[1];
+    // Each entry is literal, or relative to the launcher's own directory
+    // ($basedir_abs, which pnpm 12.6 and later write).
+    if(!nodePath.split(':').every(entry=>literal.test(entry.replace(/^\$basedir(?:_abs)?\//,'')))||
+      !text.includes(`\n  export NODE_PATH="${nodePath}:$NODE_PATH"\n`))return null;
+    template=template.split(`\n  export NODE_PATH="${nodePath}:$NODE_PATH"\n`).join('\n  export NODE_PATH="@@NODE_PATH@@:$NODE_PATH"\n')
+      .split(`\n  export NODE_PATH="${nodePath}"\n`).join('\n  export NODE_PATH="@@NODE_PATH@@"\n');
+  }
+  // The bin file, relative to the launcher's directory, after $basedir,
+  // $basedir_abs or $basedir_win; `node` and `node.exe` there are Node itself.
+  const targets=new Set([...template.matchAll(/"\$basedir(?:_abs|_win)?\/([^"\n]+)"/g)].map(match=>match[1])
+    .filter(value=>value!=='node'&&value!=='node.exe'));
+  if(targets.size!==1)return null;
+  const [target]=targets;
+  if(!literal.test(target))return null;
+  for(const prefix of ['$basedir','$basedir_abs','$basedir_win'])
+    template=template.split(`"${prefix}/${target}"`).join(`"${prefix}/@@TARGET@@"`);
+  // pnpm 11 and later end with a comment naming the target.
+  template=template.replace(/\n# cmd-shim-target=[^\n]*\n?$/,'\n# cmd-shim-target=@@COMMENT@@\n');
+  return {template,nodePath,target};
+}
+// The bin file a pnpm launcher runs with Node, as an absolute path, or null
+// when `file` is not a launcher pnpm writes.
+export function pnpmShimTarget(file,text=null){
+  try{
+    text??=fs.readFileSync(file,'utf8');
+    const shim=shimTemplate(text);
+    return shim&&known.has(shim.template)?path.resolve(path.dirname(file),shim.target):null;
+  }catch{return null;}
+}

package/src/presentation.mjs

@@ -1,4 +1,9 @@
 // Presentation consumes evidence; it never grants applicability.
+// The recipe that made a receipt, by the qualification it names.
+const recipes={'npm-typescript-direct-v1':'direct TypeScript recipe','npm-tests-direct-v1':'direct test recipe',
+  'node-script-v1':'general recipe','pnpm-tsc-v1':'pnpm TypeScript recipe','yarn-workspace-tsc-v1':'Yarn workspace TypeScript recipe',
+  'typescript-noemit-v1':'npm TypeScript recipe'};
+export const recipeLabel=recipe=>recipes[recipe]??null;
 export function checkLabel(row) {
   return row.result==='FAIL'?'FAILED':row.freshness;
 }
@@ -21,7 +26,8 @@ export function renderStatus(value,{short=false}={}) {
     const label=checkLabel(row),symbol=label==='CURRENT'&&row.result==='PASS'?'✓':label==='FAILED'?'✗':'?';
     const mark=label==='STALE'?'⚠':symbol;
     const historical=row.result?` / ${row.result}`:'';
-    lines.push(`${mark} ${row.name}  ${label}${historical}`);
+    const recipe=label==='CURRENT'?recipeLabel(row.recipe):null;
+    lines.push(`${mark} ${row.name}  ${label}${historical}${recipe?`  (${recipe})`:''}`);
     if(label!=='CURRENT')lines.push(`  ${row.result==='FAIL'?`Historical failure; applicability ${row.freshness}. `:''}${explanation(row)}`);
   }
   if(!lines.length)lines.push('UNVERIFIED — observation is initializing; no check state is available yet.');
@@ -34,6 +40,7 @@ export function renderExplain(value,name) {
     const lines=[`${row.name}: ${checkLabel(row)}${row.result?` / ${row.result}`:''}`];
     if(row.result==='FAIL')lines.push(`Historical failure; applicability: ${row.freshness}.`);
     if(row.verification_recipe==='npm-direct-typescript@1')lines.push('Recorded recipe: direct local TypeScript compiler; npm and lifecycle scripts were not executed.');
+    else if(recipeLabel(row.recipe))lines.push(`Recorded recipe: ${recipeLabel(row.recipe)}.`);
     lines.push(explanation(row));
     if(row.changed_inputs?.length)lines.push('Relevant inputs changed:',...row.changed_inputs.map(file=>`  ${file}`));
     if(row.freshness==='STALE')lines.push(`Due again when verification is needed: redue run ${JSON.stringify(row.name)}`);

package/src/test-direct.mjs

@@ -61,8 +61,12 @@ export function recordedEnvironment(guardFile,env=process.env) {
 // input (relative path) at the start checkpoint to its digest; `runner` is the
 // PID of the process REDUE started. Returns {issues, runFacts, environmentReads,
 // isOutput}: environmentReads maps each variable the run read directly to the
-// caller's value digest, or '<unset>'.
-export function testRunGuard(dir,{root,sourcePatterns,files,runner,environment=testEnvironment,coverage=null}) {
+// caller's value digest, or '<unset>'. `programs` is the general recipe's
+// account of processes (node-script.mjs): `judge(child, parentMain)` says
+// whether a started program is accounted for and must load the recorder,
+// `runner` describes the program REDUE started, and `trusted` names checkout
+// paths (runner caches) whose use is not an input.
+export function testRunGuard(dir,{root,sourcePatterns,files,runner,environment=testEnvironment,coverage=null,programs=null}) {
   // The recipe's variables and any the project declares are compared, not guarded.
   const compared=name=>(environment.variables||[]).includes(name)||
     (environment.prefixes||[]).some(prefix=>name.toLowerCase().startsWith(prefix.toLowerCase()));
@@ -82,16 +86,28 @@ export function testRunGuard(dir,{root,sourcePatterns,files,runner,environment=t
     headers.set(`${header.pid}-${header.threadId}`,header);
     records.push({header,rows:rows.slice(1)});
   }
-  if(!headers.has(`${runner}-0`))add('the test runner did not load the REDUE recorder');
+  let opaque=false;
+  if(!programs){if(!headers.has(`${runner}-0`))add('the test runner did not load the REDUE recorder');}
+  else{const judged=programs.judge(programs.runner,null);
+    if(judged.issue)add(judged.issue);
+    else if(judged.needsHeader&&!headers.has(`${runner}-0`))add('the package manager did not load the REDUE recorder');
+    opaque||=Boolean(judged.opaque);}
+  const trusted=programs?.trusted?patternMatcher(['**',...programs.trusted.map(pattern=>'!'+pattern)]):null;
+  // A cache directory itself, and everything in it.
+  const isTrusted=rel=>trusted!==null&&(!trusted(rel)||!trusted(rel+'/_'));
   // Answers per question; a question answered two ways changed during the run.
   const answers=new Map(),ask=(key,answer)=>{const set=answers.get(key)||new Set();set.add(JSON.stringify(answer));answers.set(key,set);};
-  const reads=new Map(),produced=new Set(),created=new Set(),environmentReads={},spawned=new Map();
+  // Every child with a PID, accepted shells too: a header with one of these
+  // PIDs is that child, not an execSync child (which reports no PID).
+  const installedWrites=new Set();
+  const reads=new Map(),produced=new Set(),created=new Set(),environmentReads={},spawned=new Map(),childPids=new Map();
   for(const {header,rows} of records){
     for(const row of rows){
       const [kind,...value]=Array.isArray(row)?row:[];
       if(kind==='U')add(`recorder: ${value[0]}`);
       else if(kind==='R')reads.set(value[0],reads.get(value[0])||value[1]===true);
       else if(kind==='P')produced.add(path.join(root,value[0]));
+      else if(kind==='I')installedWrites.add(value[0]);
       else if(kind==='M')created.add(value[0]);
       else if(kind==='L')ask(`stat\0${value[0]}`,value[1]);
       else if(kind==='D')ask(`entries\0${value[0]}`,value[1]);
@@ -101,7 +117,15 @@ export function testRunGuard(dir,{root,sourcePatterns,files,runner,environment=t
         environmentReads[name]=typeof state==='string'?state:'<unset>';}
       else if(kind==='N')add(`network: ${value[0]}`);
       else if(kind==='C'||kind==='S'){
-        const list=spawned.get(header.pid)||[];list.push({pid:kind==='C'?value[0]:null,file:value[kind==='C'?1:0]});
+        const [file,args,cwd,searchPath,env,script]=kind==='C'?value.slice(1):value;
+        if(kind==='C')childPids.set(header.pid,[...childPids.get(header.pid)||[],value[0]]);
+        // The general recipe accounts for each program; one that needs no
+        // recorder (a shell, the pnpm executable) is not matched to a header.
+        if(programs){const judged=programs.judge({file,args,cwd,searchPath,env,script},header.main??null);
+          if(judged.issue){add(judged.issue);continue;}
+          opaque||=Boolean(judged.opaque);
+          if(!judged.needsHeader)continue;}
+        const list=spawned.get(header.pid)||[];list.push({pid:kind==='C'?value[0]:null,file});
         spawned.set(header.pid,list);}
       else if(kind==='T'){if(!headers.has(`${header.pid}-${value[0]}`))add('a worker thread did not load the REDUE recorder');}
       else if(kind!=='H')add('a run record is unreadable');
@@ -114,9 +138,14 @@ export function testRunGuard(dir,{root,sourcePatterns,files,runner,environment=t
     const unknown=children.filter(child=>child.pid===null);
     for(const child of children)if(child.pid!==null&&!recorded.some(h=>h.pid===child.pid))
       add(`started ${path.basename(child.file)}, which REDUE does not record`);
-    const matched=recorded.filter(h=>!children.some(child=>child.pid===h.pid)).length;
+    const matched=recorded.filter(h=>!(childPids.get(parent)||[]).includes(h.pid)).length;
     if(unknown.length>matched)add(`started ${path.basename(unknown[0].file)}, which REDUE does not record`);
   }
+  // What the pnpm executable starts is not seen. Its node-options setting
+  // replaces NODE_OPTIONS for everything it starts, so a run through it must
+  // show at least one recorded Node process the recorded ones did not start.
+  if(opaque&&![...headers.values()].some(h=>h.threadId===0&&h.pid!==runner&&!headers.has(`${h.ppid}-0`)))
+    add('no Node process the pnpm executable started loaded the REDUE recorder');
   // Inside a directory the run created. A file the run wrote excuses nothing:
   // another process may have read it before the write. Listings may differ
   // by such files (listingAfter).
@@ -128,8 +157,11 @@ export function testRunGuard(dir,{root,sourcePatterns,files,runner,environment=t
   // (coverageReadable); its contents do not decide pass or fail.
   const inCoverage=rel=>coverage!==null&&(rel===coverage||rel.startsWith(coverage+'/'));
   // File content in the checkout must be an observed input.
+  // A runner cache is git-ignored; a file in a cache path git keeps is source.
+  const trustedReads=[...reads].filter(([rel,found])=>found&&isTrusted(rel)&&!inCreated(checkout(rel))).map(([rel])=>rel);
+  const ignoredCaches=gitIgnored(root,trustedReads);
   for(const [rel,found] of [...reads].sort(([a],[b])=>a<b?-1:a>b?1:0)){
-    if(inCreated(checkout(rel))||inCoverage(rel))continue;
+    if(inCreated(checkout(rel))||inCoverage(rel)||isTrusted(rel)&&(!found||ignoredCaches.has(rel)||produced.has(checkout(rel))))continue;
     if(!included(rel))add(`read ${rel}, which the check's inputs exclude`);
     else if(found&&!observed(rel))add(`read ${rel}, which REDUE does not observe (ignored by git)`);
     // A missing file may be ignored by git, so the index would not see it appear.
@@ -141,7 +173,7 @@ export function testRunGuard(dir,{root,sourcePatterns,files,runner,environment=t
     if(question==='stat'||question==='entries'){
       const full=checkout(where);
       // A path the run made answers differently afterwards; it is output, not input.
-      if(madeByRun(full)||produced.has(full)||inCoverage(where))continue;
+      if(madeByRun(full)||produced.has(full)||inCoverage(where)||isTrusted(where))continue;
       if(set.size>1){add(`${where} changed during the run`);continue;}
       if(question==='stat'){
         // Observed files and directories: the index covers them. A missing
@@ -173,7 +205,8 @@ export function testRunGuard(dir,{root,sourcePatterns,files,runner,environment=t
     produced.has(checkout(rel))&&reads.get(rel)!==true);
   return {issues:issues.length>issueLimit?[...issues.slice(0,issueLimit),`${issues.length-issueLimit} more`]:issues,
     runFacts:runFacts.length>factLimit?[]:[...new Map(runFacts.map(f=>[JSON.stringify(f),f])).values()],
-    environmentReads:Object.fromEntries(Object.entries(environmentReads).sort(([a],[b])=>a<b?-1:a>b?1:0)),isOutput};
+    environmentReads:Object.fromEntries(Object.entries(environmentReads).sort(([a],[b])=>a<b?-1:a>b?1:0)),isOutput,opaque,
+    wroteInstalled:rel=>installedWrites.has(rel)};
 }
 // The observed files that differ between two checkpoints' file maps.
 export function changedFiles(before,after){

package/src/test-recorder.cjs

@@ -23,11 +23,15 @@ function install(){
   const emit=row=>{try{const line=Buffer.from(JSON.stringify(row)+'\n');
     for(let at=0;at<line.length;)at+=original.writeSync(fd,line,at,line.length-at);}catch{}};
   const failed=reason=>emit(['U',reason]);
-  emit(['H',{pid:process.pid,ppid:process.ppid,threadId}]);
+  // The main script tells the guard which program a process runs (a package
+  // manager may start helpers of its own).
+  emit(['H',{pid:process.pid,ppid:process.ppid,threadId,main:typeof process.argv[1]==='string'?process.argv[1]:null}]);
   // Every node_modules observed as installed: the root's and each workspace package's.
   const sep=path.sep,root=config.root,installed=Array.isArray(config.installed)?config.installed:[path.join(root,'node_modules')],
     tmp=config.tmp;
   const within=(file,dir)=>file===dir||file.startsWith(dir+sep);
+  let installedReal=null;
+  const realInstalled=()=>installedReal??=installed.map(dir=>realDir(dir));
   const digest=value=>createHash('sha256').update(value).digest('hex');
   // Directory realpaths, so a checkout path spelled through a link is still
   // classified as the checkout.
@@ -44,7 +48,8 @@ function install(){
   // The absolute path an argument names; undefined for a descriptor, whose
   // open was recorded; null for anything else.
   function located(file){
-    if(typeof file==='number')return undefined;
+    // A descriptor or a FileHandle: its open was recorded.
+    if(typeof file==='number'||file&&typeof file==='object'&&typeof file.fd==='number'&&typeof file.close==='function')return undefined;
     if(Buffer.isBuffer(file))file=file.toString();
     else if(file instanceof URL){if(file.protocol!=='file:')return null;file=require('node:url').fileURLToPath(file);}
     if(typeof file!=='string')return null;
@@ -75,18 +80,45 @@ function install(){
     if(!produced.size)return false;
     for(let at=full;;at=path.dirname(at)){if(produced.has(at))return true;if(path.dirname(at)===at)return false;}
   }
-  const runnerData=config.runnerData||[];
-  const runnerCache=full=>tmp.some(dir=>within(full,dir)&&full.slice(dir.length+1).split(sep)[0].startsWith('jest_'))||
+  // Runner data and the toolchain's own files (a package manager's install
+  // and logs) are not inputs.
+  const runnerData=[...(config.runnerData||[]),...(Array.isArray(config.toolchain)?config.toolchain:[])];
+  // Runner caches in the temporary directory, keyed by content: Jest's,
+  // Yarn 1's compile cache, tsx's, jiti's, ts-node's and Babel's.
+  const tmpCache=/^(?:jest_|v8-compile-cache|tsx-\d+$|jiti$|node-jiti$|ts-node|babel)/;
+  const runnerCache=full=>tmp.some(dir=>within(full,dir)&&tmpCache.test(full.slice(dir.length+1).split(sep)[0]))||
     runnerData.some(dir=>within(full,dir));
+  // A read of the process's own executable through /proc (detect-libc reads
+  // its ELF header there), when the process runs the Node on PATH, which the
+  // environment identifies by its file.
+  const ownExePath=process.platform==='linux'?`/proc/${process.pid}/exe`:null;
+  let ownExe;
+  const ownExecutable=(role,full)=>{
+    if(role!=='read'||full!==ownExePath)return false;
+    if(ownExe===undefined)try{ownExe=typeof config.node==='string'&&original.real(full)===config.node;}catch{ownExe=false;}
+    return ownExe;
+  };
   // One filesystem access by its role: read (content), produce, touch (a write
   // that keeps earlier content), mkdir, mkdtemp, list, stat or realpath.
   function access(role,file,error=null,result=undefined,recursive=false){
     try{
-      const full=located(file);
+      let full=located(file);
       if(full===undefined)return;
       if(full===null){if(!['produce','touch','mkdir'].includes(role))failed(`${role} of an unsupported path argument`);return;}
-      // Installed files are observed by identity.
-      if(installed.some(dir=>within(full,dir)))return;
+      // Installed files are observed by identity. A path under node_modules
+      // that a link leads out of the installed tree (a workspace package's
+      // link) is classified where it leads.
+      if(installed.some(dir=>within(full,dir))){
+        // A listing, lookup or realpath of the link itself follows it.
+        const real=['list','stat','realpath'].includes(role)?realDir(full):path.join(realDir(path.dirname(full)),path.basename(full));
+        // A write there is noted apart from checkout outputs: the guard does
+        // not see reads of installed files, so only named tool files use it.
+        if(real===full||realInstalled().some(dir=>within(real,dir))){
+          if(role==='produce'&&!error&&within(full,root))once(['I',rel(full)]);
+          return;
+        }
+        full=real;
+      }
       if(role==='produce'){if(!error)produced.add(full);if(!error&&within(full,root))once(['P',rel(full)]);return;}
       // A directory the run created held nothing before it, so everything in
       // it is the run's output, whichever process reads it.
@@ -105,7 +137,7 @@ function install(){
         else if(role==='list')emit(['D',rel(full),error?missing(error):entries(full)]);
         return;
       }
-      if(runnerCache(full))return;
+      if(runnerCache(full)||ownExecutable(role,full))return;
       // A small file read outside the checkout is kept by its content, as
       // queryAnswer's readFile hashes it, so status can ask again.
       if(role==='read'&&!error){
@@ -212,7 +244,8 @@ function install(){
       envSeen.add(key);emit(['E',key,caller[key]]);
     }catch{failed('recorder failure');}
   }
-  const recordingEnv=source=>new Proxy(source,{
+  const targets=new WeakMap();
+  const recordingEnv=source=>{const proxy=new Proxy(source,{
     ownKeys(t){const keys=Reflect.ownKeys(t),current={keys:new Set(keys),last:null,copy:nodeInternal()};enumeration=current;
       queueMicrotask(()=>{if(enumeration===current)enumeration=null;});return keys;},
     getOwnPropertyDescriptor(t,key){
@@ -225,7 +258,10 @@ function install(){
       return Reflect.get(t,key);},
     has(t,key){if(enumeration)enumeration.last=null;envRead(t,key);return Reflect.has(t,key);},
     set(t,key,value){t[key]=value;return true;},
-  });
+  });targets.set(proxy,source);return proxy;};
+  // PATH as a child receives it, read without recording a read.
+  const pathOf=env=>{try{const value=Reflect.get(targets.get(env)??env??{},'PATH');return typeof value==='string'?value:null;}
+    catch{return null;}};
   function wrapEnv(holder){
     let current=recordingEnv(holder.env);
     // Code that replaces the environment object keeps being recorded.
@@ -289,17 +325,63 @@ function install(){
     }
   // Child processes and threads must load this recorder too; the guard checks
   // for their headers. Children of execSync/execFileSync report no PID, so
-  // they are counted instead.
+  // they are counted instead. Each row names the program and its arguments
+  // as Node's spawn normalizes them (a `shell` option runs /bin/sh -c and the
+  // joined command), the working directory and PATH, so the guard can tell
+  // which program a name ran and read what a shell was asked to run.
+  // Arguments over 64 KB in all are left out (null).
+  const argsOf=args=>{try{const list=Array.isArray(args)?args.map(String):[];
+    return list.reduce((n,arg)=>n+arg.length,0)>65536?null:list;}catch{return null;}};
+  const normalized=(file,args,options,shell)=>{
+    if(!Array.isArray(args)){options=args;args=[];}
+    shell=options?.shell??shell;
+    if(!shell)return [String(file),argsOf(args)];
+    return [typeof shell==='string'?shell:'/bin/sh',['-c',[file,...args].join(' ')]];
+  };
+  // What the child's environment says: whether NODE_OPTIONS still loads this
+  // recorder for the same run (npm's and pnpm's `node-options` setting
+  // replaces it), and whether BASH_ENV is set (bash -c sources it).
+  const envFacts=lookupVar=>{
+    try{const options=lookupVar('NODE_OPTIONS');
+      return {preload:typeof options==='string'&&options.includes(__filename)&&lookupVar('REDUE_RUN_RECORD')===configFile,
+        bashEnv:Boolean(lookupVar('BASH_ENV'))};}
+    catch{return {preload:false,bashEnv:true};}
+  };
+  const envOf=env=>envFacts(name=>{const value=Reflect.get(targets.get(env)??env??{},name);return typeof value==='string'?value:undefined;});
+  const pairsOf=pairs=>envFacts(name=>{const pair=(pairs||[]).find(item=>typeof item==='string'&&item.startsWith(name+'='));
+    return pair?pair.slice(name.length+1):undefined;});
+  const where=options=>[path.resolve(typeof options?.cwd==='string'?options.cwd:options?.cwd instanceof URL?
+    require('node:url').fileURLToPath(options.cwd):'.'),pathOf(options?.env??process.env),envOf(options?.env??process.env)];
+  const optionsOf=(args,options)=>Array.isArray(args)?options:args;
+  // A #! script the child runs, as it is now: Yarn writes its bin wrappers
+  // into a temporary directory and removes them after the run.
+  function scriptOf(file,cwd,searchPath){
+    try{
+      const candidates=file.includes(sep)?[path.resolve(cwd,file)]:String(searchPath??'').split(path.delimiter).map(dir=>path.join(path.resolve(cwd,dir||'.'),file));
+      for(const candidate of candidates){
+        let st;try{st=original.statSync(candidate);}catch{continue;}
+        if(!st.isFile()||!(st.mode&0o111))continue;
+        if(st.size>16384)return null;
+        const text=original.readFileSync(candidate,'utf8');
+        return text.startsWith('#!')?{file:original.real(candidate),text}:null;
+      }
+    }catch{}
+    return null;
+  }
   const childProcess=require('node:child_process'),spawn=childProcess.ChildProcess.prototype.spawn;
   childProcess.ChildProcess.prototype.spawn=function(options){
     const result=spawn.call(this,options);
-    try{if(this.pid)emit(['C',this.pid,String(options?.file)]);}catch{failed('recorder failure');}
+    try{if(this.pid){const pair=(options?.envPairs||[]).find(item=>typeof item==='string'&&item.startsWith('PATH='));
+      emit(['C',this.pid,String(options?.file),argsOf(options?.args?.slice(1)),where(options)[0],pair?pair.slice(5):null,
+        pairsOf(options?.envPairs),scriptOf(String(options?.file),where(options)[0],pair?pair.slice(5):null)]);}}
+    catch{failed('recorder failure');}
     return result;
   };
   const spawnSync=childProcess.spawnSync;
   childProcess.spawnSync=function(file,...rest){
     const result=spawnSync.call(this,file,...rest);
-    try{if(result?.pid)emit(['C',result.pid,String(file)]);}catch{failed('recorder failure');}
+    try{if(result?.pid)emit(['C',result.pid,...normalized(file,rest[0],rest[1]),...where(optionsOf(rest[0],rest[1]))]);}
+    catch{failed('recorder failure');}
     return result;
   };
   for(const name of ['execSync','execFileSync']){
@@ -308,12 +390,17 @@ function install(){
       let started=true;
       try{return call.call(this,file,...rest);}
       catch(error){if(error?.code==='ENOENT'&&!error.pid)started=false;throw error;}
-      finally{if(started)emit(['S',String(file)]);}
+      finally{if(started)try{emit(['S',...name==='execSync'?normalized(file,[],rest[0],true):normalized(file,rest[0],rest[1]),
+        ...where(name==='execSync'?rest[0]:optionsOf(rest[0],rest[1]))]);}
+        catch{failed('recorder failure');}}
     };
   }
   const workers=require('node:worker_threads'),Worker=workers.Worker;
   workers.Worker=class extends Worker{
     constructor(...args){super(...args);try{emit(['T',this.threadId]);}catch{failed('recorder failure');}}
   };
+  // Node reads an environment file natively; this is the one JavaScript entry to it.
+  if(typeof process.loadEnvFile==='function'){const load=process.loadEnvFile;
+    process.loadEnvFile=function(file='.env',...rest){access('read',file);return load.call(this,file,...rest);};}
   try{Module.syncBuiltinESMExports();}catch{failed('recorder failure');}
 }