@redue/cli 0.1.0-alpha.22 → 0.1.0-alpha.24

package/docs/user/tests-direct.md

@@ -90,8 +90,12 @@ kept but marked UNVERIFIED, with the reason, when the run:
   `--expose-internals`: the recorder cannot follow those;
 - had an installed file with another hard link, other than a link into the
   pnpm store the install recorded in `node_modules/.modules.yaml` (pnpm's
-  default on Linux). A change through a link elsewhere, such as Yarn's
-  hardlinks modes, is not seen.
+  default on Linux) or, without a pnpm store, links that are all installed
+  files the check observes (esbuild's install links its binary into its
+  platform package). The link count of each such file is checked again
+  before every answer, so a link added later is noticed. A change through a
+  link elsewhere, such as Yarn's hardlinks modes, is not seen. This applies
+  to the [general recipe](node-script.md) too.
 
 Lookups that can be asked again become run facts, checked before every CURRENT
 answer: whether a path outside the checkout exists, where a link resolves, the

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@redue/cli",
   "private": false,
-  "version": "0.1.0-alpha.22",
+  "version": "0.1.0-alpha.24",
   "publishConfig": {
     "access": "public",
     "tag": "alpha"

package/src/agent-integration.mjs

@@ -11,7 +11,7 @@ import {readProject,projectState,canonicalConfig} from './project-location.mjs';
 import {readCachedStatus} from './cached-state.mjs';
 import {samePath,withinPath} from './path-identity.mjs';
 import {processAlive} from './process-liveness.mjs';
-import {fanoutRules,hookCommand,hookForms,redueFor} from './claude-hook.mjs';
+import {fanoutRules,hookCommand,hookForms,redueFor,runsEntry,shellQuote as quote} from './claude-hook.mjs';
 
 const policy=fs.readFileSync(new URL('./agent-policy.md',import.meta.url),'utf8');
 const hosts={codex:{instruction:'AGENTS.md',skill:'.agents/skills/redue-verification/SKILL.md'},
@@ -25,17 +25,53 @@ const sameJson=(a,b)=>JSON.stringify(a)===JSON.stringify(b);
 // The hook waits for status up to 10 s; 15 s leaves room for starting Node.
 // Fan-out commands (turbo, nx, `pnpm -r`) and root scripts that run one get
 // prefix rules; the hook decides from the full command.
-function hookFor(config,relative,scripts){
+function hookFor(config,relative,scripts,command=hookCommand){
   const rules=[...new Set([...hookForms(config,relative,scripts).flatMap(row=>[...row.forms,...row.local]),
     ...fanoutRules(config,scripts)])].map(form=>`Bash(${form}*)`);
-  return rules.length?{matcher:'Bash',hooks:rules.map(rule=>({type:'command',if:rule,command:hookCommand,timeout:15}))}:null;
+  return rules.length?{matcher:'Bash',hooks:rules.map(rule=>({type:'command',if:rule,command,timeout:15}))}:null;
 }
 // The same command on SessionStart starts the observer; it needs no check to match.
-const sessionHook={hooks:[{type:'command',command:hookCommand,timeout:10}]};
+const sessionHookFor=(command=hookCommand)=>({hooks:[{type:'command',command,timeout:10}]});
 const events=['PreToolUse','SessionStart'];
+// The absolute form: Node and REDUE's entry (redue.mjs), each quoted as quote()
+// writes it. [node, entry] or null.
+function absoluteHook(command){
+  const word="'((?:[^']|'\\\\'')*)'";
+  const match=new RegExp(`^${word} ${word} agent hook claude$`).exec(command??'');
+  if(!match)return null;
+  const [node,entry]=[match[1],match[2]].map(value=>value.replaceAll("'\\''","'"));
+  // REDUE's entry file, or the bin link npm installs for it.
+  return /^redue(\.mjs)?$/.test(path.basename(entry))?[node,entry]:null;
+}
+export const isHookCommand=command=>command===hookCommand||Boolean(absoluteHook(command));
+// The command Claude Code runs for the hook. Plain `redue` when this install
+// is the one both this shell and a login shell find on PATH. Otherwise this
+// install's Node and entry by absolute path, so a Claude Code started from
+// another shell, an IDE or with a shorter PATH still runs it, and an older
+// install on PATH does not answer for this one. The settings file is
+// per-developer, so a machine path is fine there.
+export function hookInvocation(entry,{env=process.env,platform=process.platform}={}){
+  if(platform==='win32')return {command:hookCommand,reason:'Windows: plain redue on PATH'};
+  let target;try{target=fs.realpathSync(entry);}catch{target=entry;}
+  // Paths that survive upgrades where they can: the entry as invoked (a
+  // global bin link, not the versioned file behind it) and the node on PATH
+  // (Homebrew's link, not its versioned cellar).
+  const real=file=>{try{return fs.realpathSync(file);}catch{return null;}};
+  const invoked=typeof process.argv[1]==='string'&&path.isAbsolute(process.argv[1])&&real(process.argv[1])===target?process.argv[1]:target;
+  const execReal=real(process.execPath);
+  const node=(env.PATH||'').split(path.delimiter).map(dir=>path.join(dir||'.','node')).find(file=>real(file)===execReal)??process.execPath;
+  const same=file=>runsEntry(file,target,env);
+  const here=findExecutable('redue',{env});
+  const login=spawnSync(env.SHELL||'/bin/sh',['-lc','command -v redue'],{env,encoding:'utf8',timeout:5000,stdio:['ignore','pipe','ignore']});
+  const loginPath=login.status===0?login.stdout.trim().split('\n').pop():null;
+  if(same(here)&&same(loginPath))return {command:hookCommand,reason:`redue on PATH is this install (${here})`};
+  return {command:`${quote(node)} ${quote(invoked)} agent hook claude`,
+    reason:!here&&!loginPath?'redue is not on PATH; the hook names this install by its absolute path':
+      `redue on PATH is ${here||loginPath||'missing'} in ${same(here)?'a login shell':'this shell'}, not this install; the hook names this install by its absolute path`};
+}
 // REDUE's entry is recognized by its command, not by a committed record: the
 // local file differs between checkouts, and users may edit the entry.
-const ownedHook=entry=>Array.isArray(entry?.hooks)&&entry.hooks.length>0&&entry.hooks.every(h=>h?.command===hookCommand);
+const ownedHook=entry=>Array.isArray(entry?.hooks)&&entry.hooks.length>0&&entry.hooks.every(h=>isHookCommand(h?.command));
 function parseSettings(text){
   if(text===null)return {};
   let value;try{value=JSON.parse(text);}catch{throw Error(`${settingsPath} is not valid JSON; fix it before agent setup or removal`);}
@@ -65,6 +101,45 @@ function hookInstalled(root,event='PreToolUse'){
   try{return (parseSettings(read(root,settingsPath)).hooks?.[event]||[]).some(ownedHook);}
   catch{return false;}
 }
+// What removing a host's integration changes, from its setup record: the
+// managed block, the skill, the hooks and the record.
+function removalChanges(root,host,record){
+  const h=hosts[host],before=read(root,h.instruction),after=before===null?null:before.replace(record.block,'');
+  const changes=[{path:h.instruction,before,after:record.instructionCreated&&after===''?null:after},
+    {path:h.skill,before:read(root,h.skill),after:null}];
+  if(host==='claude'){const settings=read(root,settingsPath);
+    changes.push({path:settingsPath,before:settings,after:settingsWith(settings,null)});}
+  changes.push({path:marker(host),before:read(root,marker(host)),after:null});
+  return changes;
+}
+// Removes a host's integration without needing the project config (redue
+// remove after the config is gone): the changed paths, each with its operation.
+export function removeIntegration(root,host='claude'){
+  const record=saved(root,host);if(!record)return [];
+  const health=inspect(root,host,record);if(health.integrity==='conflict')throw Error(health.reason);
+  const changes=removalChanges(root,host,record).filter(c=>c.before!==c.after);
+  apply(root,changes);
+  return changes.map(c=>`${c.after===null?'remove':'update'} ${c.path}`);
+}
+// Whether REDUE's Claude Code hooks are in the local settings.
+export const claudeHooksInstalled=root=>hookInstalled(root,'SessionStart')||hookInstalled(root);
+// Removes REDUE's Claude Code hooks from the local settings and keeps the
+// rest; the file's path when it changed, else null.
+export function removeClaudeHooks(root){
+  const before=read(root,settingsPath);if(before===null)return null;
+  const after=settingsWith(before,null);if(after===before)return null;
+  apply(root,[{path:settingsPath,before,after}]);return settingsPath;
+}
+// Whether the installed hook's command can start: an absolute one by its
+// files, plain redue by PATH.
+function hookRunnable(root){
+  let command=null;
+  try{command=(parseSettings(read(root,settingsPath)).hooks?.SessionStart||[]).find(ownedHook)?.hooks[0]?.command??null;}catch{}
+  const absolute=absoluteHook(command);
+  if(absolute)return fs.existsSync(absolute[0])&&fs.existsSync(absolute[1])?'installed (absolute path)':
+    'installed, but its Node or REDUE path no longer exists; run redue agent setup claude again';
+  return findExecutable('redue')?'installed':'installed, but redue is not on PATH, so it never runs';
+}
 function safeFile(root,relative){
   if(path.isAbsolute(relative)||relative.split(/[\\/]/).some(p=>p==='..'||p===''))throw Error('unsafe integration path');
   const file=path.resolve(root,relative);
@@ -108,23 +183,28 @@ const commandsOf=rows=>[rows.filter(row=>row.kind!=='test'&&row.kind!=='lint').m
   rows.filter(row=>row.kind==='test').map(row=>row.form),rows.filter(row=>row.kind==='lint').map(row=>row.form)];
 const fence=(host,body)=>`\n\n<!-- REDUE:${host}:begin -->\n${body}<!-- REDUE:${host}:end -->\n`;
 const skillPointer=host=>`Before you run, skip or report a typecheck or other configured check, read\n${hosts[host].skill}.\n`;
-function blockFor(host,rows=[]){
+// `own`: the line asking for each check as a command of its own, added in
+// alpha.24; the alpha.15-alpha.23 wording without it is still recognized.
+function blockFor(host,rows=[],own=true){
   const [typechecks,tests,lints]=commandsOf(rows);
   if(!rows.length)return fence(host,skillPointer(host));
+  const ownLine=own?`Run each check as a command of its own, not chained after an edit or another\n`+
+    `command.\n`:'';
   if(lints.length)return fence(host,(typechecks.length?`Typecheck with ${quoted(typechecks)}.\n`:'')+
     (tests.length?`Run the unit tests with ${quoted(tests)}.\n`:'')+`Lint with ${quoted(lints)}.\n`+
     `Run a check before you say it passes, even after an edit you think cannot\n`+
     `matter; don't skip it yourself. If its last pass still applies to these exact\n`+
-    `files, a REDUE hook skips the run and says so. That skip counts as a pass.\n`);
+    `files, a REDUE hook skips the run and says so. That skip counts as a pass.\n`+ownLine);
   if(!tests.length)return fence(host,`Typecheck with ${quoted(typechecks)}. Run it before you say it passes, even after an\n`+
     `edit you think cannot matter; don't skip it yourself. If its last pass still\n`+
     `applies to these exact files, a REDUE hook skips the run and says so. That\n`+
-    `skip counts as a pass.\n`);
+    (own?`skip counts as a pass. Run it as a command of its own, not chained after an\n`+
+      `edit or another command.\n`:`skip counts as a pass.\n`));
   return fence(host,(typechecks.length?`Typecheck with ${quoted(typechecks)}.\n`:'')+
     `Run the unit tests with ${quoted(tests)}.\n`+
     `Run a check before you say it passes, even after an edit you think cannot\n`+
     `matter; don't skip it yourself. If its last pass still applies to these exact\n`+
-    `files, a REDUE hook skips the run and says so. That skip counts as a pass.\n`);
+    `files, a REDUE hook skips the run and says so. That skip counts as a pass.\n`+ownLine);
 }
 // The alpha.12-alpha.14 wording, recognized so setup can replace it.
 function earlierBlock(host,rows=[]){
@@ -165,7 +245,8 @@ function knownBlock(host,relative,block){
   const rows=[...forms(`^\\n\\n<!-- REDUE:[a-z]+:begin -->\\nTypecheck with ${list}\\.`).map(form=>({kind:'typecheck',form})),
     ...forms(`Run the unit tests with ${list}\\.\\n`).map(form=>({kind:'test',form})),
     ...forms(`Lint with ${list}\\.\\n`).map(form=>({kind:'lint',form}))];
-  return block===blockFor(host,rows)||block===earlierBlock(host,rows)||priorBlocks(host,relative).includes(block);
+  return block===blockFor(host,rows)||block===blockFor(host,rows,false)||block===earlierBlock(host,rows)||
+    priorBlocks(host,relative).includes(block);
 }
 // The policy with the exact commands for this config, so an agent never builds
 // a --config form the hook would not recognize. Claude Code gets the typecheck
@@ -273,7 +354,7 @@ export async function agentCommand(args,{configFile,stateOverride,entry,cwd=proc
   const {root,relative,config}=project(configFile),h=hosts[host],record=saved(root,host),health=inspect(root,host,record);
   if(health.integrity==='conflict')throw Error(health.reason);
   const changes=[],notes=action==='setup'?warnings(root,host,cwd):[];
-  let hook=null,block=null;
+  let hook=null,sessionHook=null,block=null;
   if(action==='setup'){
     const before=read(root,h.instruction),skill=skillFor(relative,host,config);
     block=blockFor(host,blockForms(host,config,relative));
@@ -281,7 +362,12 @@ export async function agentCommand(args,{configFile,stateOverride,entry,cwd=proc
       throw Error('unowned REDUE instruction or skill already exists; inspect it before setup');
     const after=record?before.replace(record.block,block):(before||'')+block;
     let scripts={};try{scripts=JSON.parse(read(root,'package.json')??'{}').scripts||{};}catch{}
-    hook=host==='claude'?hookFor(config,relative,scripts):null;
+    const invocation=host==='claude'?hookInvocation(entry):null;
+    if(invocation)notes.push(`Hook command: ${invocation.command} (${invocation.reason})`);
+    if(invocation&&invocation.command!==hookCommand)
+      notes.push('The agent instructions say `redue ...`: put this install on PATH (npm install --global @redue/cli@alpha) so the agent\'s shell can run them. The hook runs the checks it rewrites through this install either way.');
+    hook=host==='claude'?hookFor(config,relative,scripts,invocation.command):null;
+    sessionHook=host==='claude'?sessionHookFor(invocation.command):null;
     const next={schema:1,host,config:relative,instruction:h.instruction,skill:h.skill,
       block,skillHash:hash(skill),instructionCreated:record?.instructionCreated??before===null};
     changes.push({path:h.skill,before:read(root,h.skill),after:skill},
@@ -291,14 +377,7 @@ export async function agentCommand(args,{configFile,stateOverride,entry,cwd=proc
         content:JSON.stringify(hook?next:{SessionStart:sessionHook},null,2)+
           (hook?'':'\nno PreToolUse hook: no typecheck or test check to match')});}
     changes.push({path:marker(host),before:read(root,marker(host)),after:JSON.stringify(next,null,2)+'\n'});
-  }else if(record){
-    const before=read(root,h.instruction),after=before.replace(record.block,'');
-    changes.push({path:h.instruction,before,after:record.instructionCreated&&after===''?null:after},
-      {path:h.skill,before:read(root,h.skill),after:null});
-    if(host==='claude'){const settings=read(root,settingsPath);
-      changes.push({path:settingsPath,before:settings,after:settingsWith(settings,null)});}
-    changes.push({path:marker(host),before:read(root,marker(host)),after:null});
-  }
+  }else if(record)changes.push(...removalChanges(root,host,record));
   const actual=changes.filter(c=>c.before!==c.after);
   const summary={schema:1,action,host,config:configFile,applied:false,
     changes:actual.map(c=>({path:c.path,operation:c.after===null?'remove':c.before===null?'create':'update',
@@ -355,7 +434,7 @@ export async function doctor({configFile,stateOverride,entry,cwd,host}){
       const out=spawnSync(launch.file,launch.args,{...launch.options,encoding:'utf8',timeout:2000,maxBuffer:4096,stdio:['ignore','pipe','pipe']});
       if(out.status===0)version=out.stdout.trim();}
     let integration={installed:false,integrity:'unknown'},hook=name==='claude'?'absent':'none',sessionHook=hook;
-    const installed=()=>value.command.path?'installed':'installed, but redue is not on PATH, so it never runs';
+    const installed=()=>hookRunnable(p.root);
     if(p)try{const record=saved(p.root,name);integration=inspect(p.root,name,record);
       if(name==='claude'&&hookInstalled(p.root))hook=installed();
       if(name==='claude'&&hookInstalled(p.root,'SessionStart'))sessionHook=installed();

package/src/claude-hook.mjs

@@ -6,12 +6,13 @@
 // Never exit 2: Claude Code treats exit 2 as a block.
 import fs from 'node:fs';
 import path from 'node:path';
-import {spawn} from 'node:child_process';
+import {spawn,spawnSync} from 'node:child_process';
 import {projectState} from './project-location.mjs';
 import {realObservedPath} from './path-identity.mjs';
 import {processAlive} from './process-liveness.mjs';
 import {scriptRunChecks} from './typescript-invocation.mjs';
 import {recipeLabel} from './presentation.mjs';
+import {findExecutable} from './executable-lookup.mjs';
 
 export const hookCommand='redue agent hook claude';
 // No shell metacharacters; `@` starts scoped package names.
@@ -31,6 +32,22 @@ export const defaultConfig='redue.config.json';
 // would need shell quoting.
 export const redueFor=(configFile=defaultConfig)=>configFile===defaultConfig?'redue':
   safe.test(configFile)?`redue --config ${configFile}`:null;
+export const shellQuote=value=>`'${String(value).replaceAll("'","'\\''")}'`;
+// How a rewritten command starts REDUE: plain `redue` when the hook's PATH
+// finds this install, else this install by absolute path. An agent shell
+// without redue on PATH cannot run the plain form.
+export function redueInvocation(entry,{env=process.env,platform=process.platform}={}){
+  if(platform==='win32'||runsEntry(findExecutable('redue',{env}),entry,env))return 'redue';
+  return `${shellQuote(process.execPath)} ${shellQuote(entry)}`;
+}
+// Whether the command at `file` runs this install's entry: the same file, or
+// a shim or wrapper that reports it (redue --entry).
+export function runsEntry(file,entry,env=process.env){
+  if(!file)return false;
+  try{const target=fs.realpathSync(entry);if(fs.realpathSync(file)===target)return true;
+    const out=spawnSync(file,['--entry'],{env,encoding:'utf8',timeout:5000,stdio:['ignore','pipe','ignore']});
+    return out.status===0&&fs.realpathSync(out.stdout.trim())===target;}catch{return false;}
+}
 
 // Package-manager commands that a script of the same name would not reach.
 const builtins={pnpm:new Set(['add','audit','bin','config','create','dedupe','deploy','dlx','doctor','env','exec','fetch',
@@ -259,15 +276,83 @@ function matched(command,config,configFile,dir='.',scripts={}){
   // A script form of compiler checks is checked against the script first.
   return row?.scriptForms?.includes(parts.base)?{row,rest:parts.rest}:row?{check:row.check,rest:parts.rest}:null;
 }
+// A simple chain: commands joined by &&, || or ;, outside quotes, with no
+// line break, subshell, command or process substitution, backtick,
+// here-document or background job. [{separator, text}] with the separator
+// before each part ('' for the first), or null.
+export function chainParts(command){
+  if(typeof command!=='string'||/[\r\n`]|\$\(|[<>]\(|<<|[()]/.test(command))return null;
+  const parts=[];let quote=null,start=0,separator='';
+  for(let i=0;i<command.length;i++){
+    const c=command[i];
+    if(quote){if(c===quote)quote=null;else if(c==='\\'&&quote==='"')i++;continue;}
+    if(c==='\\'){i++;continue;}
+    if(c==="'"||c==='"'){quote=c;continue;}
+    const two=command.slice(i,i+2);
+    if(two==='&&'||two==='||'||c===';'){
+      parts.push({separator,text:command.slice(start,i)});separator=c===';'?';':two;
+      start=i+(c===';'?1:2);if(c!==';')i++;continue;}
+    // A lone & runs a job in the background; >&, &> and |& redirect.
+    if(c==='&'&&command[i-1]!=='>'&&command[i+1]!=='>')return null;
+    if(two==='|&')return null;
+  }
+  if(quote)return null;
+  parts.push({separator,text:command.slice(start)});
+  return parts.every(part=>part.text.trim())?parts:null;
+}
+// A simple chain with each check in it run through REDUE when its turn comes:
+// `redue run CHECK --if-due` decides then, after earlier parts may have
+// changed files. Null when the command is not such a chain or runs no check.
+// The rest of the chain is unchanged, and so is its output and exit status
+// when a check runs.
+// Shell builtins that change the shell for the parts after them.
+const shellBuiltins=new Set(['cd','pushd','popd','export','unset','set','source','.','eval','exec','alias','unalias','shopt',
+  'ulimit','umask','trap','builtin','command','declare','typeset','local','readonly','hash','enable','let','read','wait']);
+// A part that cannot change the directory or environment of the parts after
+// it: a program found on PATH (or by path), not a builtin, function or bare
+// assignment.
+function plainProgram(body){
+  const words=body.split(/\s+/).filter(Boolean);
+  while(words.length&&/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0]))words.shift();
+  const word=words[0];
+  return Boolean(word)&&!shellBuiltins.has(word)&&/^[A-Za-z0-9_./+@-]+$/.test(word)&&(word.includes('/')||Boolean(findExecutable(word)));
+}
+// A simple chain with each check in it run through REDUE when its turn comes:
+// `redue run CHECK --if-due` decides then, after earlier parts may have
+// changed files. {command, names}, or null when the command is not such a
+// chain or runs no check. The rest of the chain is unchanged, and so are its
+// output and exit status when a check runs. Every part before a check must be
+// a plain program, so the check runs where and as it would have.
+export function chainCommand(command,config,configFile,dir='.',scripts={},invoke='redue',runConfig=configFile,projectRoot=null){
+  const parts=chainParts(command);
+  if(!parts||parts.length<2)return null;
+  const redue=redueFor(runConfig)?.replace(/^redue/,()=>invoke);
+  if(!redue)return null;
+  const names=[];let plain=true;
+  const text=parts.map(({separator,text})=>{
+    const lead=text.match(/^\s*/)[0],trail=text.match(/\s*$/)[0],body=text.trim();
+    const match=matched(body,config,configFile,dir,scripts),split_=split(body);
+    // A compiler script is its checks in the order of its runs.
+    const checks=match?.check?[match.check]:match?.row&&projectRoot?scriptChecks(match.row,config,projectRoot):null;
+    if(!checks?.length||match.rest!==null||!split_||!checks.every(name=>safe.test(name))){
+      plain&&=plainProgram(body);return separator+text;}
+    if(!plain)return null;
+    names.push(...checks);
+    // Grouped, so a separator before it applies to all its runs.
+    const runs=checks.map(name=>`${redue} run ${name} --if-due`).join(' && ');
+    return `${separator}${lead}${checks.length>1?`{ ${runs}; }`:runs}${split_.suffix}${trail}`;
+  });
+  return names.length&&!text.includes(null)?{command:text.join(''),names}:null;
+}
 export function matchCheck(command,config,configFile,dir,scripts){
   const match=matched(command,config,configFile,dir,scripts);
   return match?.row?match.row.checks.join(' && '):match?.check||null;
 }
 // The same check (or checks, in order) through REDUE, keeping the output
 // suffix; null if it already is, or if more commands follow it.
-export function recordedCommand(command,name,configFile=defaultConfig){
+export function recordedCommand(command,name,configFile=defaultConfig,invoke='redue'){
   const names=Array.isArray(name)?name:[name];
-  const parts=split(command),redue=redueFor(configFile);
+  const parts=split(command),redue=redueFor(configFile)?.replace(/^redue/,()=>invoke);
   if(!parts||parts.rest!==null||!names.length||!names.every(value=>safe.test(value))||!redue)return null;
   const run=names.map(value=>`${redue} run ${value}`).join(' && ');
   return parts.base===run?null:names.length>1&&parts.suffix?`(${run})${parts.suffix}`:run+parts.suffix;
@@ -310,7 +395,8 @@ export function verdict(status,name,rest=null){
     (rest===null?'':` Nothing else in the command ran either; run the rest on its own: ${rest}`);
 }
 
-function synchronizedStatus(entry,config,root,timeout){
+// The status answer, synchronized unless `sync` is false (the cached one).
+function synchronizedStatus(entry,config,root,timeout,sync=true){
   return new Promise(resolve=>{
     let child,out='',done=false;
     const finish=value=>{if(done)return;done=true;clearTimeout(timer);process.off('SIGTERM',stop);
@@ -320,7 +406,7 @@ function synchronizedStatus(entry,config,root,timeout){
     // Claude Code ends a hook that outlives its own timeout; end the status call with it.
     const stop=()=>finish(null);process.once('SIGTERM',stop);
     // Its own process group on POSIX, so a timeout also ends the engine it starts.
-    try{child=spawn(process.execPath,[entry,'--config',config,'status','--sync','--json'],
+    try{child=spawn(process.execPath,[entry,'--config',config,'status',...(sync?['--sync']:[]),'--json'],
       {cwd:root,stdio:['ignore','pipe','ignore'],env:process.env,windowsHide:true,detached:process.platform!=='win32'});}
     catch{return finish(null);}
     child.on('error',()=>finish(null));
@@ -374,7 +460,7 @@ export function sessionStart(input,{entry}){
 }
 
 // Returns the hook's stdout object, or null to allow the command.
-export async function claudeHook(input,{entry,timeout}){
+export async function claudeHook(input,{entry,timeout,invoke=null}){
   if(input?.tool_name!=='Bash')return null;
   const command=input.tool_input?.command,root=input.cwd;
   if(typeof command!=='string'||/^\s*REDUE_FORCE=1(?:\s|$)/.test(command))return null;
@@ -385,8 +471,27 @@ export async function claudeHook(input,{entry,timeout}){
   if(!entered)return null;
   let scripts={};
   if(entered.dir==='.')try{scripts=JSON.parse(fs.readFileSync(path.join(project.projectRoot,'package.json'),'utf8')).scripts||{};}catch{}
+  // The configured config path as the command's directory sees it.
+  // Both sides resolved alike: Windows can spell the same directory RUNNER~1 or by its long name.
+  const configPath=!entered.prefix?record.config:
+    path.relative(path.join(project.projectRoot,entered.dir),realObservedPath(config)).split(path.sep).join('/');
+  // A simple chain: each check in it runs through REDUE when its turn comes,
+  // after the parts before it (an edit) have run. The command is changed,
+  // not approved: Claude Code's permission rules apply to it as rewritten.
+  // A chain with no check of its own (a leading fan-out) goes on below.
+  // Rewritten only on a healthy answer: without an observer, redue run
+  // cannot run the check, and the chain would not run as written.
+  // The observer's cached health is enough here: each check asks again when it runs.
+  const chained=chainCommand(entered.command,parsed,record.config,entered.dir,scripts,invoke??redueInvocation(entry),configPath,project.projectRoot);
+  if(chained){
+    const cached=await synchronizedStatus(entry,config,root,timeout??5000,false);
+    return cached?.observation?.healthy===true&&chained.names.every(name=>cached.checks?.some(row=>row?.name===name))?
+      {hookSpecificOutput:{hookEventName:'PreToolUse',updatedInput:{...input.tool_input,command:entered.prefix+chained.command}}}:null;
+  }
   const match=matched(entered.command,parsed,record.config,entered.dir,scripts);
   if(!match)return null;
+  // A check followed by more than a simple chain runs untouched.
+  if(match.rest!==null&&!match.fanout)return null;
   // turbo, nx and `pnpm -r` cache their own results: skip only when every
   // check the command runs is CURRENT, and otherwise leave it alone.
   if(match.fanout){
@@ -396,10 +501,6 @@ export async function claudeHook(input,{entry,timeout}){
       reason=fanoutVerdict(status,names,match.rest);
     return reason?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'deny',permissionDecisionReason:reason}}:null;
   }
-  // The configured config path as the command's directory sees it.
-  // Both sides resolved alike: Windows can spell the same directory RUNNER~1 or by its long name.
-  const configPath=!entered.prefix?record.config:
-    path.relative(path.join(project.projectRoot,entered.dir),realObservedPath(config)).split(path.sep).join('/');
   // A compiler script: its checks in the order of its runs, or nothing when
   // they no longer correspond. One run is an ordinary check. A chain is
   // skipped when every run is CURRENT, else the runs that are not run through
@@ -414,7 +515,7 @@ export async function claudeHook(input,{entry,timeout}){
       if(reason)return {hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'deny',permissionDecisionReason:reason}};
       const pending=names.filter(name=>!verdict(status,name));
       const rewritten=status?.schema===1&&status.observation?.healthy===true&&Array.isArray(status.checks)&&
-        names.every(name=>status.checks.some(item=>item?.name===name))?recordedCommand(entered.command,pending,configPath):null;
+        names.every(name=>status.checks.some(item=>item?.name===name))?recordedCommand(entered.command,pending,configPath,invoke??redueInvocation(entry)):null;
       return rewritten?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'allow',
         permissionDecisionReason:`REDUE: ${pending.map(name=>JSON.stringify(name)).join(', ')} of this script's checks ${pending.length===1?'is':'are'} not CURRENT; running ${pending.length===1?'it':'them'} through redue run so the result is recorded.`,
         updatedInput:{...input.tool_input,command:entered.prefix+rewritten}}}:null;
@@ -429,7 +530,7 @@ export async function claudeHook(input,{entry,timeout}){
   // stays too: the rewrite returns "allow", which would also skip the prompt
   // for the rest of the chain.
   const rewritten=status?.schema===1&&status.observation?.healthy===true&&Array.isArray(status.checks)&&
-    status.checks.some(item=>item?.name===name)?recordedCommand(entered.command,name,configPath):null;
+    status.checks.some(item=>item?.name===name)?recordedCommand(entered.command,name,configPath,invoke??redueInvocation(entry)):null;
   // updatedInput replaces the whole tool input. Deny and ask rules still apply
   // to the rewritten command; "allow" skips only the prompt.
   return rewritten?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'allow',

package/src/cli.mjs

@@ -4,6 +4,8 @@ import fs from 'node:fs';
 import {directQualification,directInterpretation,observedNpmContext} from './direct-typescript.mjs';
 import {directRunCertificateAllowed,directRunCertificate,directRunRecordable,directRunRecording,probeQuestions,validateRunRecord} from './direct-run-certificate.mjs';
 import {queryAnswer,runFactChange} from './typescript-list.mjs';
+import {patternMatcher} from './glob.mjs';
+import {observedBy} from './installed-observation.mjs';
 import {changedFiles,coverageReadable,gitIgnored,recordedEnvironment,testEnvironmentIssue,testGuardConfig,testRunGuard,testRunFacts,sharedInstalledFile,testsInterpretation,testsQualification} from './test-direct.mjs';
 import {childProgram,lookup,pnpmConfigFiles,scriptCaches,scriptInstalledPaths,scriptInterpretation,scriptQualification,scriptRunFacts,pnpmNameless,toolOutput,toolchainDirs} from './node-script.mjs';
 import path from 'node:path';
@@ -377,8 +379,13 @@ async function execute() {
       // The pnpm executable reads its configuration natively: kept by content.
       if(guard.opaque)for(const file of pnpmConfigFiles())try{runFacts.push(['readFile',file,queryAnswer('readFile',file)]);}
         catch{guard.issues.push(`pnpm configuration ${file} cannot be read`);}
-      const shared=sharedInstalledFile(root,testFacts,path.join(state,'pnpm-store-links-v1.json'));
+      // Hard links count only where the check observes them.
+      // As the index matches: source patterns, or additive (installed) ones.
+      const source=patternMatcher(plan.sourcePatterns||plan.patterns||[]),additive=patternMatcher(plan.additivePatterns||[]);
+      const linkFacts=[],observed=observedBy(root,rel=>source(rel)||additive(rel));
+      const shared=sharedInstalledFile(root,testFacts,path.join(state,'pnpm-store-links-v1.json'),{observed,facts:linkFacts});
       if(shared)guard.issues.push(`installed file ${shared.file} ${shared.reason}; a change through it is not observed`);
+      else runFacts.push(...linkFacts);
       fs.rmSync(testRecord,{recursive:true,force:true});
     }
     // The daemon reads the recording from owned state; control requests are small.

package/src/installed-observation.mjs

@@ -0,0 +1,23 @@
+// Whether a check observes an installed file: the file is in the checkout
+// and matched by the check's patterns, and a link it goes through that leads
+// elsewhere in the checkout leads to a matched path too. A recorded run's
+// hard-linked installed files are accepted only when every link is one the
+// check observes, so a pattern that leaves a folder out (a runner cache in
+// node_modules) cannot hide one.
+import fs from 'node:fs';
+import path from 'node:path';
+import {observedRelative} from './path-identity.mjs';
+
+// `matches(rel)`: the check's pattern matcher over checkout-relative paths.
+// A link that leads outside the checkout is the plan's to resolve (a
+// permitted root or a refusal).
+export function observedBy(root,matches){
+  let realRoot=root;try{realRoot=fs.realpathSync(root);}catch{}
+  return file=>{
+    const logical=observedRelative(root,path.resolve(file));
+    if(logical===null||!matches(logical))return false;
+    let real;try{real=fs.realpathSync(file);}catch{return false;}
+    const physical=observedRelative(realRoot,real);
+    return physical===null||physical===logical||matches(physical);
+  };
+}

package/src/node-script.mjs

@@ -35,12 +35,15 @@ const modulesDirs=dirs=>['node_modules',...dirs.map(dir=>`${dir}/node_modules`)]
 // Inputs: the whole checkout but node_modules, .git and runner caches. Every
 // node_modules of the workspace is observed as installed files, without the
 // caches tools keep there.
+// Runner caches at the top of a node_modules, which Vite, Vitest and build
+// loaders rewrite as they run: not installed inputs.
+export const installedRunnerCaches=['.cache','.vite','.vite-temp','.vitest','.vitest-cache'];
 export function scriptCheckInputs(dirs=[]){
   const modules=modulesDirs(dirs);
   return {inputs:['**',...modules.map(at=>`!${at}/**`),'!.git/**',...installState.map(file=>`!${file}`),
     ...scriptCaches.map(pattern=>`!${pattern}`)],
-  installedInputs:[...modules.flatMap(at=>[`${at}/**`,`!${at}/.cache/**`,`!${at}/.vite/**`,`!${at}/.vite-temp/**`,
-    `!${at}/.vitest/**`,`!${at}/.vitest-cache/**`,`!${at}/**/*.tsbuildinfo`]),...installState]};
+  installedInputs:[...modules.flatMap(at=>[`${at}/**`,...installedRunnerCaches.map(dir=>`!${at}/${dir}/**`),
+    `!${at}/**/*.tsbuildinfo`]),...installState]};
 }
 // Installed files a tool rewrites during a run. pnpm writes its workspace
 // state in the root node_modules at the first run after an install, through
@@ -236,6 +239,19 @@ export const scriptPath=(dir,callerPath)=>{
 // Why a shell command line could start a program REDUE does not record, or
 // null. Names are looked up along `searchPath` from `cwd`. A script the pnpm
 // executable runs is read the same way, since the recorder cannot see it.
+// TypeScript 7's Node launchers (tsc in typescript@7, tsgo in
+// @typescript/native-preview) replace themselves with a native compiler REDUE
+// does not record: the package and version, or null.
+export function nativeTypeScriptLauncher(file){
+  let dir;try{dir=path.dirname(fs.realpathSync(file));}catch{return null;}
+  for(let n=0;n<3;n++,dir=path.dirname(dir)){
+    let pkg;try{pkg=JSON.parse(fs.readFileSync(path.join(dir,'package.json'),'utf8'));}catch{continue;}
+    if(pkg.name==='typescript'&&Number(String(pkg.version).split('.')[0])>=7||pkg.name==='@typescript/native-preview')
+      return `${pkg.name} ${pkg.version}`;
+    return null;
+  }
+  return null;
+}
 export function commandLineIssue(text,{cwd,searchPath,depth=0}={}){
   if(depth>8)return 'the scripts run each other too deeply for REDUE to read';
   const parsed=parseCommandLine(text);
@@ -270,6 +286,8 @@ export function commandLineIssue(text,{cwd,searchPath,depth=0}={}){
       if(kind==='node'){
         const flag=['node','nodejs'].includes(path.basename(file))&&args.find(arg=>nativeReads.test(arg.text));
         if(flag)return `runs node ${flag.text.split('=')[0]}, which reads a file REDUE cannot see`;
+        const native=nativeTypeScriptLauncher(file);
+        if(native)return `runs ${path.basename(name)} from ${native}, a native compiler REDUE does not record`;
         break;
       }
       if(kind==='pnpm'){const issue=pnpmRunIssue(args.map(arg=>arg.text),{cwd:dir,searchPath,depth});if(issue)return issue;break;}

package/src/pnpm-inputs.mjs

@@ -2,7 +2,7 @@
 // repository-relative input sets and resolution relationships, never pnpm
 // virtual-store names as semantic identities.
 import {probeTimeLeft} from './probe-deadline.mjs';
-import {compilerFiles} from './typescript-list.mjs';
+import {compilerApiIssue,compilerFiles} from './typescript-list.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import {createRequire} from 'node:module';
@@ -298,7 +298,9 @@ export function pnpmTypecheckInputs(root,workspace,run,{captureQueries=false}={}
   let tsPackage;try{tsPackage=realObservedPath(lookup.resolve('typescript/package.json'));}
   catch{throw Error('installed TypeScript compiler cannot be resolved');}
   if(!within(tsPackage,root))throw Error('TypeScript compiler is outside the observed checkout');
-  const tsRoot=path.dirname(tsPackage),ts=lookup('typescript');
+  const tsRoot=path.dirname(tsPackage),apiIssue=compilerApiIssue(tsRoot);
+  if(apiIssue)throw Error(apiIssue);
+  const ts=lookup('typescript');
   const tsc=path.join(tsRoot,'bin','tsc');
   if(!exists(tsc))throw Error('installed TypeScript executable is missing');
   const configStarted=performance.now();