@redue/cli 0.1.0-alpha.23 → 0.1.0-alpha.24

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 0.1.0-alpha.24 — 2026-10-28
+
+Checks keep working after a normal `npm install`, and agents that chain an
+edit and a check get the same skip-or-record as a check run on its own.
+
+- **Hard-linked installed files.** Without a pnpm store, any installed file
+  with a second hard link made a recorded run UNVERIFIED. esbuild's install
+  makes one (npm, not Yarn or Windows), so after an ordinary `npm install`
+  general-recipe and test checks in projects with esbuild stayed
+  UNVERIFIED. Such a file is now accepted when every one of its links is an
+  installed file the check observes; its link count is checked again before
+  every answer, so a link added later is noticed.
+- **Checks inside a chain.** In a simple chain (`printf ... >> README.md &&
+  npm run lint`), the Claude Code hook rewrites each check to the new
+  `redue run CHECK --if-due`, which skips the check when its last pass still
+  applies at that moment and otherwise runs it through REDUE with the same
+  exit code. The hook changes the command without approving it, so your
+  permission rules still apply. Chains with subshells, substitutions,
+  here-documents, background jobs, shell keywords or builtins before a check
+  run untouched.
+- The CLAUDE.md section asks agents to run each check as a command of its
+  own. Setups from earlier alphas are recognized and updated.
+- The README's coverage numbers now come from a census that installs with
+  dependencies' install scripts on, as users do: of 120 public TypeScript
+  repositories, 86 installed and 30 have a qualifying check (typecheck 21,
+  lint 18, tests 2).
+- Known limit, unchanged: a Vitest run writes under `node_modules/.vite`,
+  which makes a direct TypeScript typecheck STALE until it runs again.
+
+- Contributors: census `--install-scripts`; the stranger test can install
+  from npm (`--npm`) and run a follow-up session that uses the hooks.
+
 ## 0.1.0-alpha.23 — 2026-10-26
 
 One command to set up REDUE with Claude Code, and one to undo it.

package/README.md

@@ -62,25 +62,24 @@ To undo everything setup did: `redue remove`.
 ## What it covers today
 
 In a census of 120 active public TypeScript repositories (October 2026, REDUE
-at commit c9034e5, just after 0.1.0-alpha.22), 89 installed cleanly. A check
-counts when two recorded runs on the same code both came out CURRENT on the
-same inputs. 31 repositories had at least one such check:
+at commit 0fcd19b, after 0.1.0-alpha.23), each installed as its users would,
+with dependencies' install scripts on, 86 installed cleanly. A check counts
+when two recorded runs on the same code both came out CURRENT on the same
+inputs. 30 repositories had at least one such check:
 
 | Check | Repositories | How |
 |---|---|---|
-| Typecheck | 22 | 16 by running the project's script with every Node process recorded ([general recipe](docs/user/node-script.md)); 6 by running the local `tsc` directly ([direct recipe](docs/user/direct-typescript.md)) |
+| Typecheck | 21 | 15 by running the project's script with every Node process recorded ([general recipe](docs/user/node-script.md)); 6 by running the local `tsc` directly ([direct recipe](docs/user/direct-typescript.md)) |
 | Lint | 18 | general recipe |
 | Tests | 2 | Vitest run directly ([direct test recipe](docs/user/tests-direct.md)) |
 
 Everything else stays UNVERIFIED, with a reason you can read in
 `redue explain`. The usual ones: a script starts a program REDUE cannot see
 into (esbuild, turbo, nx, oxlint's tsgolint, TypeScript 7's native compiler),
-the project uses Bun, or a test suite writes into its own inputs. Two you may
+the project uses Bun, or a test suite writes into its own inputs. One you may
 meet right after setup: a Vitest run writes its results under
 `node_modules/.vite`, which the direct TypeScript recipe counts as an
-installed input, so the typecheck turns STALE until it runs again; and an
-installed file with a second hard link (esbuild's install makes one) keeps
-the test check UNVERIFIED.
+installed input, so the typecheck turns STALE until it runs again.
 [Supported projects](docs/user/supported-projects.md) has the details.
 
 ## Measured with Claude Code

package/bin/redue.mjs

@@ -43,7 +43,8 @@ Commands:
   status --sync        Reconcile inputs and caller context before answering
   explain [CHECK] [--json] Explain applicability (synchronized; may cost more than a rerun)
   detail [CHECK] [--json]  Alias for explain
-  run CHECK            Execute one configured check and record its outcome
+  run CHECK [--if-due] Execute one configured check and record its outcome; with --if-due,
+                       only when its last pass does not apply to the files as they are now
   remove-state         Stop and remove only this configuration's owned local state
 
 No checks run in the background. Direct commands outside redue create no receipts.`;
@@ -96,6 +97,9 @@ if(command==='agent'){
 if(!['init','start','stop','status','detail','explain','run','remove-state'].includes(command))
   error(`unknown command ${command||'<none>'}; use --help`);
 const json=args.includes('--json');
+// run --if-due: run the check only when its last pass does not apply now.
+const ifDue=command==='run'&&args.includes('--if-due');
+if(ifDue)args.splice(args.indexOf('--if-due'),1);
 const sync=args.includes('--sync');
 const dryRun=args.includes('--dry-run');
 const short=args.includes('--short');
@@ -388,6 +392,20 @@ const internal=command==='remove-state'?'uninstall':
 // On macOS and Linux the engine runs in this process, which saves a Node startup
 // on every run; its own handlers receive SIGINT and SIGTERM. Windows keeps a
 // child engine because cancellation reaches it over IPC.
+// Asked when this part of a command runs, after earlier parts may have
+// changed files. REDUE_FORCE=1 runs it anyway.
+if(ifDue&&process.env.REDUE_FORCE!=='1'){
+  const {verdict}=await import('../src/claude-hook.mjs');
+  const asked=spawnSync(process.execPath,[fileURLToPath(import.meta.url),'--config',configFile,...(stateOverride?['--state-dir',stateOverride]:[]),
+    'status','--sync','--json'],{encoding:'utf8',stdio:['ignore','pipe','ignore'],env:process.env,timeout:600_000});
+  let status=null;try{status=JSON.parse(asked.stdout);}catch{}
+  if(verdict(status,check)){
+    const row=status.checks.find(item=>item.name===check);
+    if(json)console.log(JSON.stringify({check,skipped:true,result:'PASS',run_id:row.invocation.runId}));
+    else console.error(`REDUE: ${check} passed on these exact inputs (run ${row.invocation.runId}); not run again. REDUE_FORCE=1 runs it anyway.`);
+    await exit(0);
+  }
+}
 if(command==='run'&&process.platform!=='win32'){
   process.argv=[process.argv[0],engine,runtimeFile,internal,check,...(!json?['--human']:[])];
   await import(pathToFileURL(engine).href);

package/docs/user/agents.md

@@ -85,7 +85,26 @@ desktop app or another shell still runs the right REDUE; run setup again
 after moving or upgrading Node. `redue agent doctor` reports a hook whose
 paths no longer exist. When the hook runs a check through REDUE for the
 agent, it likewise writes plain `redue run` only if its own PATH finds this
-install, else the absolute form. Other settings in the file are kept,
+install, else the absolute form.
+
+Agents often chain an edit and a check (`printf … >> README.md && npm run
+lint`). In a simple chain (commands joined by `&&`, `||` or `;`, with no
+subshell, here-document, command substitution, background job or shell
+keyword) where every part before a check is a program on PATH (not a
+builtin such as `cd` or `export`, a shell function such as `nvm`, or a bare
+assignment), the hook rewrites each check to `redue run CHECK --if-due`. That
+command decides when its turn comes, after the earlier parts may have
+changed files: it skips the check (exit 0, and says so) when its last pass
+still applies, and otherwise runs it through REDUE with the exit code a plain
+run gives. A script that runs several checks becomes `{ redue run a --if-due
+&& redue run b --if-due; }`. The rest of the chain is unchanged. The hook
+rewrites only while the observer is healthy and knows each check. It changes
+such a command without approving it, so your permission rules apply to the
+rewritten command; a rule that allows only `npm run lint` will ask about
+`redue run lint --if-due`. Anything more complex runs untouched. Known
+limit: if REDUE cannot start the check when its turn comes (another
+`redue run` holds the project's run lock), that part exits with REDUE's
+error instead of running the check. Other settings in the file are kept,
 but the file is rewritten as 2-space JSON. `.claude/settings.json` is not touched.
 `redue agent remove claude --apply` removes only the entries REDUE added.
 

package/docs/user/tests-direct.md

@@ -90,8 +90,12 @@ kept but marked UNVERIFIED, with the reason, when the run:
   `--expose-internals`: the recorder cannot follow those;
 - had an installed file with another hard link, other than a link into the
   pnpm store the install recorded in `node_modules/.modules.yaml` (pnpm's
-  default on Linux). A change through a link elsewhere, such as Yarn's
-  hardlinks modes, is not seen.
+  default on Linux) or, without a pnpm store, links that are all installed
+  files the check observes (esbuild's install links its binary into its
+  platform package). The link count of each such file is checked again
+  before every answer, so a link added later is noticed. A change through a
+  link elsewhere, such as Yarn's hardlinks modes, is not seen. This applies
+  to the [general recipe](node-script.md) too.
 
 Lookups that can be asked again become run facts, checked before every CURRENT
 answer: whether a path outside the checkout exists, where a link resolves, the

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@redue/cli",
   "private": false,
-  "version": "0.1.0-alpha.23",
+  "version": "0.1.0-alpha.24",
   "publishConfig": {
     "access": "public",
     "tag": "alpha"

package/src/agent-integration.mjs

@@ -183,23 +183,28 @@ const commandsOf=rows=>[rows.filter(row=>row.kind!=='test'&&row.kind!=='lint').m
   rows.filter(row=>row.kind==='test').map(row=>row.form),rows.filter(row=>row.kind==='lint').map(row=>row.form)];
 const fence=(host,body)=>`\n\n<!-- REDUE:${host}:begin -->\n${body}<!-- REDUE:${host}:end -->\n`;
 const skillPointer=host=>`Before you run, skip or report a typecheck or other configured check, read\n${hosts[host].skill}.\n`;
-function blockFor(host,rows=[]){
+// `own`: the line asking for each check as a command of its own, added in
+// alpha.24; the alpha.15-alpha.23 wording without it is still recognized.
+function blockFor(host,rows=[],own=true){
   const [typechecks,tests,lints]=commandsOf(rows);
   if(!rows.length)return fence(host,skillPointer(host));
+  const ownLine=own?`Run each check as a command of its own, not chained after an edit or another\n`+
+    `command.\n`:'';
   if(lints.length)return fence(host,(typechecks.length?`Typecheck with ${quoted(typechecks)}.\n`:'')+
     (tests.length?`Run the unit tests with ${quoted(tests)}.\n`:'')+`Lint with ${quoted(lints)}.\n`+
     `Run a check before you say it passes, even after an edit you think cannot\n`+
     `matter; don't skip it yourself. If its last pass still applies to these exact\n`+
-    `files, a REDUE hook skips the run and says so. That skip counts as a pass.\n`);
+    `files, a REDUE hook skips the run and says so. That skip counts as a pass.\n`+ownLine);
   if(!tests.length)return fence(host,`Typecheck with ${quoted(typechecks)}. Run it before you say it passes, even after an\n`+
     `edit you think cannot matter; don't skip it yourself. If its last pass still\n`+
     `applies to these exact files, a REDUE hook skips the run and says so. That\n`+
-    `skip counts as a pass.\n`);
+    (own?`skip counts as a pass. Run it as a command of its own, not chained after an\n`+
+      `edit or another command.\n`:`skip counts as a pass.\n`));
   return fence(host,(typechecks.length?`Typecheck with ${quoted(typechecks)}.\n`:'')+
     `Run the unit tests with ${quoted(tests)}.\n`+
     `Run a check before you say it passes, even after an edit you think cannot\n`+
     `matter; don't skip it yourself. If its last pass still applies to these exact\n`+
-    `files, a REDUE hook skips the run and says so. That skip counts as a pass.\n`);
+    `files, a REDUE hook skips the run and says so. That skip counts as a pass.\n`+ownLine);
 }
 // The alpha.12-alpha.14 wording, recognized so setup can replace it.
 function earlierBlock(host,rows=[]){
@@ -240,7 +245,8 @@ function knownBlock(host,relative,block){
   const rows=[...forms(`^\\n\\n<!-- REDUE:[a-z]+:begin -->\\nTypecheck with ${list}\\.`).map(form=>({kind:'typecheck',form})),
     ...forms(`Run the unit tests with ${list}\\.\\n`).map(form=>({kind:'test',form})),
     ...forms(`Lint with ${list}\\.\\n`).map(form=>({kind:'lint',form}))];
-  return block===blockFor(host,rows)||block===earlierBlock(host,rows)||priorBlocks(host,relative).includes(block);
+  return block===blockFor(host,rows)||block===blockFor(host,rows,false)||block===earlierBlock(host,rows)||
+    priorBlocks(host,relative).includes(block);
 }
 // The policy with the exact commands for this config, so an agent never builds
 // a --config form the hook would not recognize. Claude Code gets the typecheck

package/src/claude-hook.mjs

@@ -276,6 +276,74 @@ function matched(command,config,configFile,dir='.',scripts={}){
   // A script form of compiler checks is checked against the script first.
   return row?.scriptForms?.includes(parts.base)?{row,rest:parts.rest}:row?{check:row.check,rest:parts.rest}:null;
 }
+// A simple chain: commands joined by &&, || or ;, outside quotes, with no
+// line break, subshell, command or process substitution, backtick,
+// here-document or background job. [{separator, text}] with the separator
+// before each part ('' for the first), or null.
+export function chainParts(command){
+  if(typeof command!=='string'||/[\r\n`]|\$\(|[<>]\(|<<|[()]/.test(command))return null;
+  const parts=[];let quote=null,start=0,separator='';
+  for(let i=0;i<command.length;i++){
+    const c=command[i];
+    if(quote){if(c===quote)quote=null;else if(c==='\\'&&quote==='"')i++;continue;}
+    if(c==='\\'){i++;continue;}
+    if(c==="'"||c==='"'){quote=c;continue;}
+    const two=command.slice(i,i+2);
+    if(two==='&&'||two==='||'||c===';'){
+      parts.push({separator,text:command.slice(start,i)});separator=c===';'?';':two;
+      start=i+(c===';'?1:2);if(c!==';')i++;continue;}
+    // A lone & runs a job in the background; >&, &> and |& redirect.
+    if(c==='&'&&command[i-1]!=='>'&&command[i+1]!=='>')return null;
+    if(two==='|&')return null;
+  }
+  if(quote)return null;
+  parts.push({separator,text:command.slice(start)});
+  return parts.every(part=>part.text.trim())?parts:null;
+}
+// A simple chain with each check in it run through REDUE when its turn comes:
+// `redue run CHECK --if-due` decides then, after earlier parts may have
+// changed files. Null when the command is not such a chain or runs no check.
+// The rest of the chain is unchanged, and so is its output and exit status
+// when a check runs.
+// Shell builtins that change the shell for the parts after them.
+const shellBuiltins=new Set(['cd','pushd','popd','export','unset','set','source','.','eval','exec','alias','unalias','shopt',
+  'ulimit','umask','trap','builtin','command','declare','typeset','local','readonly','hash','enable','let','read','wait']);
+// A part that cannot change the directory or environment of the parts after
+// it: a program found on PATH (or by path), not a builtin, function or bare
+// assignment.
+function plainProgram(body){
+  const words=body.split(/\s+/).filter(Boolean);
+  while(words.length&&/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0]))words.shift();
+  const word=words[0];
+  return Boolean(word)&&!shellBuiltins.has(word)&&/^[A-Za-z0-9_./+@-]+$/.test(word)&&(word.includes('/')||Boolean(findExecutable(word)));
+}
+// A simple chain with each check in it run through REDUE when its turn comes:
+// `redue run CHECK --if-due` decides then, after earlier parts may have
+// changed files. {command, names}, or null when the command is not such a
+// chain or runs no check. The rest of the chain is unchanged, and so are its
+// output and exit status when a check runs. Every part before a check must be
+// a plain program, so the check runs where and as it would have.
+export function chainCommand(command,config,configFile,dir='.',scripts={},invoke='redue',runConfig=configFile,projectRoot=null){
+  const parts=chainParts(command);
+  if(!parts||parts.length<2)return null;
+  const redue=redueFor(runConfig)?.replace(/^redue/,()=>invoke);
+  if(!redue)return null;
+  const names=[];let plain=true;
+  const text=parts.map(({separator,text})=>{
+    const lead=text.match(/^\s*/)[0],trail=text.match(/\s*$/)[0],body=text.trim();
+    const match=matched(body,config,configFile,dir,scripts),split_=split(body);
+    // A compiler script is its checks in the order of its runs.
+    const checks=match?.check?[match.check]:match?.row&&projectRoot?scriptChecks(match.row,config,projectRoot):null;
+    if(!checks?.length||match.rest!==null||!split_||!checks.every(name=>safe.test(name))){
+      plain&&=plainProgram(body);return separator+text;}
+    if(!plain)return null;
+    names.push(...checks);
+    // Grouped, so a separator before it applies to all its runs.
+    const runs=checks.map(name=>`${redue} run ${name} --if-due`).join(' && ');
+    return `${separator}${lead}${checks.length>1?`{ ${runs}; }`:runs}${split_.suffix}${trail}`;
+  });
+  return names.length&&!text.includes(null)?{command:text.join(''),names}:null;
+}
 export function matchCheck(command,config,configFile,dir,scripts){
   const match=matched(command,config,configFile,dir,scripts);
   return match?.row?match.row.checks.join(' && '):match?.check||null;
@@ -327,7 +395,8 @@ export function verdict(status,name,rest=null){
     (rest===null?'':` Nothing else in the command ran either; run the rest on its own: ${rest}`);
 }
 
-function synchronizedStatus(entry,config,root,timeout){
+// The status answer, synchronized unless `sync` is false (the cached one).
+function synchronizedStatus(entry,config,root,timeout,sync=true){
   return new Promise(resolve=>{
     let child,out='',done=false;
     const finish=value=>{if(done)return;done=true;clearTimeout(timer);process.off('SIGTERM',stop);
@@ -337,7 +406,7 @@ function synchronizedStatus(entry,config,root,timeout){
     // Claude Code ends a hook that outlives its own timeout; end the status call with it.
     const stop=()=>finish(null);process.once('SIGTERM',stop);
     // Its own process group on POSIX, so a timeout also ends the engine it starts.
-    try{child=spawn(process.execPath,[entry,'--config',config,'status','--sync','--json'],
+    try{child=spawn(process.execPath,[entry,'--config',config,'status',...(sync?['--sync']:[]),'--json'],
       {cwd:root,stdio:['ignore','pipe','ignore'],env:process.env,windowsHide:true,detached:process.platform!=='win32'});}
     catch{return finish(null);}
     child.on('error',()=>finish(null));
@@ -402,8 +471,27 @@ export async function claudeHook(input,{entry,timeout,invoke=null}){
   if(!entered)return null;
   let scripts={};
   if(entered.dir==='.')try{scripts=JSON.parse(fs.readFileSync(path.join(project.projectRoot,'package.json'),'utf8')).scripts||{};}catch{}
+  // The configured config path as the command's directory sees it.
+  // Both sides resolved alike: Windows can spell the same directory RUNNER~1 or by its long name.
+  const configPath=!entered.prefix?record.config:
+    path.relative(path.join(project.projectRoot,entered.dir),realObservedPath(config)).split(path.sep).join('/');
+  // A simple chain: each check in it runs through REDUE when its turn comes,
+  // after the parts before it (an edit) have run. The command is changed,
+  // not approved: Claude Code's permission rules apply to it as rewritten.
+  // A chain with no check of its own (a leading fan-out) goes on below.
+  // Rewritten only on a healthy answer: without an observer, redue run
+  // cannot run the check, and the chain would not run as written.
+  // The observer's cached health is enough here: each check asks again when it runs.
+  const chained=chainCommand(entered.command,parsed,record.config,entered.dir,scripts,invoke??redueInvocation(entry),configPath,project.projectRoot);
+  if(chained){
+    const cached=await synchronizedStatus(entry,config,root,timeout??5000,false);
+    return cached?.observation?.healthy===true&&chained.names.every(name=>cached.checks?.some(row=>row?.name===name))?
+      {hookSpecificOutput:{hookEventName:'PreToolUse',updatedInput:{...input.tool_input,command:entered.prefix+chained.command}}}:null;
+  }
   const match=matched(entered.command,parsed,record.config,entered.dir,scripts);
   if(!match)return null;
+  // A check followed by more than a simple chain runs untouched.
+  if(match.rest!==null&&!match.fanout)return null;
   // turbo, nx and `pnpm -r` cache their own results: skip only when every
   // check the command runs is CURRENT, and otherwise leave it alone.
   if(match.fanout){
@@ -413,10 +501,6 @@ export async function claudeHook(input,{entry,timeout,invoke=null}){
       reason=fanoutVerdict(status,names,match.rest);
     return reason?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'deny',permissionDecisionReason:reason}}:null;
   }
-  // The configured config path as the command's directory sees it.
-  // Both sides resolved alike: Windows can spell the same directory RUNNER~1 or by its long name.
-  const configPath=!entered.prefix?record.config:
-    path.relative(path.join(project.projectRoot,entered.dir),realObservedPath(config)).split(path.sep).join('/');
   // A compiler script: its checks in the order of its runs, or nothing when
   // they no longer correspond. One run is an ordinary check. A chain is
   // skipped when every run is CURRENT, else the runs that are not run through

package/src/cli.mjs

@@ -4,6 +4,8 @@ import fs from 'node:fs';
 import {directQualification,directInterpretation,observedNpmContext} from './direct-typescript.mjs';
 import {directRunCertificateAllowed,directRunCertificate,directRunRecordable,directRunRecording,probeQuestions,validateRunRecord} from './direct-run-certificate.mjs';
 import {queryAnswer,runFactChange} from './typescript-list.mjs';
+import {patternMatcher} from './glob.mjs';
+import {observedBy} from './installed-observation.mjs';
 import {changedFiles,coverageReadable,gitIgnored,recordedEnvironment,testEnvironmentIssue,testGuardConfig,testRunGuard,testRunFacts,sharedInstalledFile,testsInterpretation,testsQualification} from './test-direct.mjs';
 import {childProgram,lookup,pnpmConfigFiles,scriptCaches,scriptInstalledPaths,scriptInterpretation,scriptQualification,scriptRunFacts,pnpmNameless,toolOutput,toolchainDirs} from './node-script.mjs';
 import path from 'node:path';
@@ -377,8 +379,13 @@ async function execute() {
       // The pnpm executable reads its configuration natively: kept by content.
       if(guard.opaque)for(const file of pnpmConfigFiles())try{runFacts.push(['readFile',file,queryAnswer('readFile',file)]);}
         catch{guard.issues.push(`pnpm configuration ${file} cannot be read`);}
-      const shared=sharedInstalledFile(root,testFacts,path.join(state,'pnpm-store-links-v1.json'));
+      // Hard links count only where the check observes them.
+      // As the index matches: source patterns, or additive (installed) ones.
+      const source=patternMatcher(plan.sourcePatterns||plan.patterns||[]),additive=patternMatcher(plan.additivePatterns||[]);
+      const linkFacts=[],observed=observedBy(root,rel=>source(rel)||additive(rel));
+      const shared=sharedInstalledFile(root,testFacts,path.join(state,'pnpm-store-links-v1.json'),{observed,facts:linkFacts});
       if(shared)guard.issues.push(`installed file ${shared.file} ${shared.reason}; a change through it is not observed`);
+      else runFacts.push(...linkFacts);
       fs.rmSync(testRecord,{recursive:true,force:true});
     }
     // The daemon reads the recording from owned state; control requests are small.

package/src/installed-observation.mjs

@@ -0,0 +1,23 @@
+// Whether a check observes an installed file: the file is in the checkout
+// and matched by the check's patterns, and a link it goes through that leads
+// elsewhere in the checkout leads to a matched path too. A recorded run's
+// hard-linked installed files are accepted only when every link is one the
+// check observes, so a pattern that leaves a folder out (a runner cache in
+// node_modules) cannot hide one.
+import fs from 'node:fs';
+import path from 'node:path';
+import {observedRelative} from './path-identity.mjs';
+
+// `matches(rel)`: the check's pattern matcher over checkout-relative paths.
+// A link that leads outside the checkout is the plan's to resolve (a
+// permitted root or a refusal).
+export function observedBy(root,matches){
+  let realRoot=root;try{realRoot=fs.realpathSync(root);}catch{}
+  return file=>{
+    const logical=observedRelative(root,path.resolve(file));
+    if(logical===null||!matches(logical))return false;
+    let real;try{real=fs.realpathSync(file);}catch{return false;}
+    const physical=observedRelative(realRoot,real);
+    return physical===null||physical===logical||matches(physical);
+  };
+}

package/src/node-script.mjs

@@ -35,12 +35,15 @@ const modulesDirs=dirs=>['node_modules',...dirs.map(dir=>`${dir}/node_modules`)]
 // Inputs: the whole checkout but node_modules, .git and runner caches. Every
 // node_modules of the workspace is observed as installed files, without the
 // caches tools keep there.
+// Runner caches at the top of a node_modules, which Vite, Vitest and build
+// loaders rewrite as they run: not installed inputs.
+export const installedRunnerCaches=['.cache','.vite','.vite-temp','.vitest','.vitest-cache'];
 export function scriptCheckInputs(dirs=[]){
   const modules=modulesDirs(dirs);
   return {inputs:['**',...modules.map(at=>`!${at}/**`),'!.git/**',...installState.map(file=>`!${file}`),
     ...scriptCaches.map(pattern=>`!${pattern}`)],
-  installedInputs:[...modules.flatMap(at=>[`${at}/**`,`!${at}/.cache/**`,`!${at}/.vite/**`,`!${at}/.vite-temp/**`,
-    `!${at}/.vitest/**`,`!${at}/.vitest-cache/**`,`!${at}/**/*.tsbuildinfo`]),...installState]};
+  installedInputs:[...modules.flatMap(at=>[`${at}/**`,...installedRunnerCaches.map(dir=>`!${at}/${dir}/**`),
+    `!${at}/**/*.tsbuildinfo`]),...installState]};
 }
 // Installed files a tool rewrites during a run. pnpm writes its workspace
 // state in the root node_modules at the first run after an install, through

package/src/test-direct.mjs

@@ -430,13 +430,18 @@ function storePath(files,file,st){
 // files, which is a change REDUE sees. `cache` (in owned state) keeps each
 // file found in the store with its identity and store path, so an unchanged
 // file is not hashed again; its store link is still checked.
-export function sharedInstalledFile(root,project={},cache=null){
+// Without a pnpm store, a hard-linked installed file is accepted only when
+// every one of its links is an installed file the check observes (`observed`,
+// installed-observation.mjs): esbuild links its binary into its platform
+// package. Each accepted file's link count becomes a run fact in `facts`, so
+// a link added later is noticed before the next answer.
+export function sharedInstalledFile(root,project={},cache=null,{observed=()=>false,facts=[]}={}){
   const stack=modulesDirs(project).map(dir=>path.join(root,dir));
   const files=pnpmStoreFiles(root),now=Date.now();
   let known={},changed=false;
   if(files&&cache)try{const value=JSON.parse(fs.readFileSync(cache,'utf8'));
     if(value?.files===files&&value.entries&&typeof value.entries==='object')known=value.entries;}catch{}
-  const found={};
+  const found={},links=new Map();
   const shared=(file,reason)=>({file:path.relative(root,file).split(path.sep).join('/'),reason});
   while(stack.length){
     const dir=stack.pop();let entries;
@@ -447,7 +452,14 @@ export function sharedInstalledFile(root,project={},cache=null){
       if(!entry.isFile())continue;
       let st;try{st=fs.lstatSync(file,{bigint:true});}catch{continue;}
       if(st.nlink<=1n)continue;
-      if(!files)return shared(file,'has another hard link, and the install records no pnpm store');
+      if(!files){
+        // Distinct observed links by real path: a directory walked twice
+        // through a link counts once.
+        const key=`${st.dev}:${st.ino}`,group=links.get(key)??{file,nlink:st.nlink,seen:new Set()};
+        if(group.nlink!==st.nlink)return shared(file,'had its hard links change while REDUE checked them');
+        if(observed(file))try{group.seen.add(fs.realpathSync(file));}catch{}
+        links.set(key,group);continue;
+      }
       const key=`${st.dev}:${st.ino}`,cached=known[key];
       let at=Array.isArray(cached)&&cached[0]===identity(st)&&typeof cached[1]==='string'&&
         sameFile(path.join(files,cached[1]),st)?cached[1]:null;
@@ -463,6 +475,10 @@ export function sharedInstalledFile(root,project={},cache=null){
       else changed=true;
     }
   }
+  for(const group of links.values()){
+    if(BigInt(group.seen.size)<group.nlink)return shared(group.file,'has another hard link that is not an installed file this check observes, and the install records no pnpm store');
+    facts.push(['linkCount',group.file,Number(group.nlink)]);
+  }
   if(files&&cache&&(changed||Object.keys(found).length!==Object.keys(known).length))
     try{atomicJson(cache,{files,entries:found});}catch{}
   return null;

package/src/typescript-list.mjs

@@ -15,6 +15,8 @@ export function queryAnswer(kind,file,options) {
     if(kind==='readFile')return hash(fs.readFileSync(file,'utf8'));
     if(kind==='fileExists')return fs.statSync(file).isFile();
     if(kind==='directoryExists')return fs.statSync(file).isDirectory();
+    // How many hard links a file has: a link added elsewhere changes it.
+    if(kind==='linkCount')return fs.lstatSync(file).nlink;
     // The compiler resolves through realpathSync.native outside Windows.
     if(kind==='realpath')return process.platform==='win32'?fs.realpathSync(file):fs.realpathSync.native(file);
     if(kind==='directories')return fs.readdirSync(file,{withFileTypes:true})
@@ -44,7 +46,7 @@ export function queryAnswer(kind,file,options) {
 export function runFactChange(facts) {
   if(!Array.isArray(facts))return 'an unreadable run fact';
   for(const fact of facts){
-    if(!Array.isArray(fact)||!['fileExists','directoryExists','realpath','readFile','entries'].includes(fact[0])||
+    if(!Array.isArray(fact)||!['fileExists','directoryExists','realpath','readFile','entries','linkCount'].includes(fact[0])||
       typeof fact[1]!=='string')return 'an unreadable run fact';
     const [kind,file,answer]=fact;
     let now;try{now=queryAnswer(kind,file);}catch{return file;}