@redue/cli 0.1.0-alpha.23 → 0.1.0-alpha.25

package/CHANGELOG.md

@@ -1,5 +1,63 @@
 # Changelog
 
+## 0.1.0-alpha.25 — 2026-10-29
+
+Running your tests no longer makes a typecheck STALE, and `status --sync`
+answers about twice as fast.
+
+- **Vitest and the direct TypeScript recipe.** A Vitest run writes its
+  results under `node_modules/.vite/vitest`, which the recipe counted as an
+  installed input, so the typecheck turned STALE after every test run. Those
+  files are no longer inputs. Everything else under `node_modules/.vite`
+  still is. A program that asks the compiler about anything under
+  `node_modules/.vite`, or lists `node_modules`, is UNVERIFIED instead. A
+  check set up by an earlier alpha reports STALE ("input plan changed") once
+  after the upgrade.
+- **Faster status.** `status --sync`, `detail` and `explain` no longer start
+  a second Node process on macOS and Linux, the YAML parser loads only for
+  pnpm projects, and each call to the observer no longer waits on a fresh
+  read of its status file. On the 800-file bench, warm `status --sync` adds
+  27 ms over cached status on a GitHub Linux runner (alpha.24: 120 ms) and
+  36 ms on a macOS runner (alpha.24: 137 ms).
+- **Releases are benched.** The release smoke now benches the candidate
+  against the last release on macOS and Linux runners; a slower candidate,
+  or one over the warm-sync or run-overhead budget, blocks the release.
+- Known limit: on the maintainer's Mac, which runs Microsoft Defender,
+  `redue run` still adds about 15-20% to a 2.7 s typecheck (3% on a GitHub
+  Linux runner).
+
+## 0.1.0-alpha.24 — 2026-10-28
+
+Checks keep working after a normal `npm install`, and agents that chain an
+edit and a check get the same skip-or-record as a check run on its own.
+
+- **Hard-linked installed files.** Without a pnpm store, any installed file
+  with a second hard link made a recorded run UNVERIFIED. esbuild's install
+  makes one (npm, not Yarn or Windows), so after an ordinary `npm install`
+  general-recipe and test checks in projects with esbuild stayed
+  UNVERIFIED. Such a file is now accepted when every one of its links is an
+  installed file the check observes; its link count is checked again before
+  every answer, so a link added later is noticed.
+- **Checks inside a chain.** In a simple chain (`printf ... >> README.md &&
+  npm run lint`), the Claude Code hook rewrites each check to the new
+  `redue run CHECK --if-due`, which skips the check when its last pass still
+  applies at that moment and otherwise runs it through REDUE with the same
+  exit code. The hook changes the command without approving it, so your
+  permission rules still apply. Chains with subshells, substitutions,
+  here-documents, background jobs, shell keywords or builtins before a check
+  run untouched.
+- The CLAUDE.md section asks agents to run each check as a command of its
+  own. Setups from earlier alphas are recognized and updated.
+- The README's coverage numbers now come from a census that installs with
+  dependencies' install scripts on, as users do: of 120 public TypeScript
+  repositories, 86 installed and 30 have a qualifying check (typecheck 21,
+  lint 18, tests 2).
+- Known limit, unchanged: a Vitest run writes under `node_modules/.vite`,
+  which makes a direct TypeScript typecheck STALE until it runs again.
+
+- Contributors: census `--install-scripts`; the stranger test can install
+  from npm (`--npm`) and run a follow-up session that uses the hooks.
+
 ## 0.1.0-alpha.23 — 2026-10-26
 
 One command to set up REDUE with Claude Code, and one to undo it.

package/README.md

@@ -62,25 +62,21 @@ To undo everything setup did: `redue remove`.
 ## What it covers today
 
 In a census of 120 active public TypeScript repositories (October 2026, REDUE
-at commit c9034e5, just after 0.1.0-alpha.22), 89 installed cleanly. A check
-counts when two recorded runs on the same code both came out CURRENT on the
-same inputs. 31 repositories had at least one such check:
+at commit 0fcd19b, after 0.1.0-alpha.23), each installed as its users would,
+with dependencies' install scripts on, 86 installed cleanly. A check counts
+when two recorded runs on the same code both came out CURRENT on the same
+inputs. 30 repositories had at least one such check:
 
 | Check | Repositories | How |
 |---|---|---|
-| Typecheck | 22 | 16 by running the project's script with every Node process recorded ([general recipe](docs/user/node-script.md)); 6 by running the local `tsc` directly ([direct recipe](docs/user/direct-typescript.md)) |
+| Typecheck | 21 | 15 by running the project's script with every Node process recorded ([general recipe](docs/user/node-script.md)); 6 by running the local `tsc` directly ([direct recipe](docs/user/direct-typescript.md)) |
 | Lint | 18 | general recipe |
 | Tests | 2 | Vitest run directly ([direct test recipe](docs/user/tests-direct.md)) |
 
 Everything else stays UNVERIFIED, with a reason you can read in
 `redue explain`. The usual ones: a script starts a program REDUE cannot see
 into (esbuild, turbo, nx, oxlint's tsgolint, TypeScript 7's native compiler),
-the project uses Bun, or a test suite writes into its own inputs. Two you may
-meet right after setup: a Vitest run writes its results under
-`node_modules/.vite`, which the direct TypeScript recipe counts as an
-installed input, so the typecheck turns STALE until it runs again; and an
-installed file with a second hard link (esbuild's install makes one) keeps
-the test check UNVERIFIED.
+the project uses Bun, or a test suite writes into its own inputs.
 [Supported projects](docs/user/supported-projects.md) has the details.
 
 ## Measured with Claude Code

package/bin/redue.mjs

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import {mark,traceBase,traceContext,traceEnvironment,traceId} from '../src/decision-profile.mjs';
 traceBase({...traceContext(),request:traceId(),work:'client'});
 mark('client.loaded');
-import {directCompiler,directQualification,directEnvironment,directInterpretation} from '../src/direct-typescript.mjs';
+import {directCompiler,directQualification,directEnvironment,directInstalledInputs,directInterpretation} from '../src/direct-typescript.mjs';
 import {runArgv,tscRun} from '../src/typescript-invocation.mjs';
 import {testEnvironment,testRunnerAt,testsInterpretation,testsQualification} from '../src/test-direct.mjs';
 import {scriptEnvironment,scriptInterpretation,scriptKinds,scriptQualification} from '../src/node-script.mjs';
@@ -43,7 +43,8 @@ Commands:
   status --sync        Reconcile inputs and caller context before answering
   explain [CHECK] [--json] Explain applicability (synchronized; may cost more than a rerun)
   detail [CHECK] [--json]  Alias for explain
-  run CHECK            Execute one configured check and record its outcome
+  run CHECK [--if-due] Execute one configured check and record its outcome; with --if-due,
+                       only when its last pass does not apply to the files as they are now
   remove-state         Stop and remove only this configuration's owned local state
 
 No checks run in the background. Direct commands outside redue create no receipts.`;
@@ -96,6 +97,9 @@ if(command==='agent'){
 if(!['init','start','stop','status','detail','explain','run','remove-state'].includes(command))
   error(`unknown command ${command||'<none>'}; use --help`);
 const json=args.includes('--json');
+// run --if-due: run the check only when its last pass does not apply now.
+const ifDue=command==='run'&&args.includes('--if-due');
+if(ifDue)args.splice(args.indexOf('--if-due'),1);
 const sync=args.includes('--sync');
 const dryRun=args.includes('--dry-run');
 const short=args.includes('--short');
@@ -333,7 +337,7 @@ const checks=publicConfig.checks.map(check=>{
     typeof check.cwd==='string'&&check.cwd&&!path.isAbsolute(check.cwd)&&!check.cwd.split('/').includes('..')?check.cwd:'.'),
     cwd:check.cwd,inputs:check.inputs||[],generatedInputs:check.generatedInputs||[],
     installedInputs:check.installedInputs||(
-      npmAutomatic||npmDirect||testsDirect?['node_modules/**']:[]),
+      npmDirect?[...directInstalledInputs]:npmAutomatic||testsDirect?['node_modules/**']:[]),
     allowedExternalRoots:check.allowedExternalRoots||[],
     probes:[...(check.probes||[]),...autoProbes]
       .map((p,i)=>argv(p,`${check.name}.probes[${i}]`)),
@@ -388,6 +392,20 @@ const internal=command==='remove-state'?'uninstall':
 // On macOS and Linux the engine runs in this process, which saves a Node startup
 // on every run; its own handlers receive SIGINT and SIGTERM. Windows keeps a
 // child engine because cancellation reaches it over IPC.
+// Asked when this part of a command runs, after earlier parts may have
+// changed files. REDUE_FORCE=1 runs it anyway.
+if(ifDue&&process.env.REDUE_FORCE!=='1'){
+  const {verdict}=await import('../src/claude-hook.mjs');
+  const asked=spawnSync(process.execPath,[fileURLToPath(import.meta.url),'--config',configFile,...(stateOverride?['--state-dir',stateOverride]:[]),
+    'status','--sync','--json'],{encoding:'utf8',stdio:['ignore','pipe','ignore'],env:process.env,timeout:600_000});
+  let status=null;try{status=JSON.parse(asked.stdout);}catch{}
+  if(verdict(status,check)){
+    const row=status.checks.find(item=>item.name===check);
+    if(json)console.log(JSON.stringify({check,skipped:true,result:'PASS',run_id:row.invocation.runId}));
+    else console.error(`REDUE: ${check} passed on these exact inputs (run ${row.invocation.runId}); not run again. REDUE_FORCE=1 runs it anyway.`);
+    await exit(0);
+  }
+}
 if(command==='run'&&process.platform!=='win32'){
   process.argv=[process.argv[0],engine,runtimeFile,internal,check,...(!json?['--human']:[])];
   await import(pathToFileURL(engine).href);
@@ -406,6 +424,15 @@ if(command==='run'&&process.platform!=='win32'){
   process.off('SIGINT',interrupt);process.off('SIGTERM',terminate);
   if(outcome.error)error(outcome.error.message);
   process.exit(outcome.status??(outcome.signal?128+os.constants.signals[outcome.signal]:1));
+}else if(internal==='sync'&&process.platform!=='win32'){
+  // As for run, the synchronized status engine runs in this process.
+  process.argv=[process.argv[0],engine,runtimeFile,internal,'','--value'];
+  mark('client.engine_submit',{inProcess:true});
+  const synchronized=await import(pathToFileURL(engine).href);
+  await synchronized.finished;
+  mark('client.engine_complete',{exit:process.exitCode??0});
+  if(synchronized.syncValue)showSynchronized(synchronized.syncValue);
+  await exit(process.exitCode??0);
 }else{
   mark('client.engine_submit');
   const result=spawnSync(process.execPath,[engine,runtimeFile,internal,...(check?[check]:[])],
@@ -416,10 +443,13 @@ if(command==='run'&&process.platform!=='win32'){
   if(result.stdout){
     if(['status','detail','explain'].includes(command)){
       let value;try{value=JSON.parse(result.stdout);}catch{error('status response could not be read; applicability is unknown');}
-      if(details&&check)value={...value,checks:value.checks.filter(row=>row.name===check)};
-      if(json)console.log(JSON.stringify(value));
-      else console.log(details?renderExplain(value,check):renderStatus(value,{short}));
+      showSynchronized(value);
     }else printLifecycle(result.stdout,command,json);
   }
   await exit(result.status??1);
 }
+function showSynchronized(value){
+  if(details&&check)value={...value,checks:value.checks.filter(row=>row.name===check)};
+  if(json)console.log(JSON.stringify(value));
+  else console.log(details?renderExplain(value,check):renderStatus(value,{short}));
+}

package/docs/user/agents.md

@@ -85,7 +85,26 @@ desktop app or another shell still runs the right REDUE; run setup again
 after moving or upgrading Node. `redue agent doctor` reports a hook whose
 paths no longer exist. When the hook runs a check through REDUE for the
 agent, it likewise writes plain `redue run` only if its own PATH finds this
-install, else the absolute form. Other settings in the file are kept,
+install, else the absolute form.
+
+Agents often chain an edit and a check (`printf … >> README.md && npm run
+lint`). In a simple chain (commands joined by `&&`, `||` or `;`, with no
+subshell, here-document, command substitution, background job or shell
+keyword) where every part before a check is a program on PATH (not a
+builtin such as `cd` or `export`, a shell function such as `nvm`, or a bare
+assignment), the hook rewrites each check to `redue run CHECK --if-due`. That
+command decides when its turn comes, after the earlier parts may have
+changed files: it skips the check (exit 0, and says so) when its last pass
+still applies, and otherwise runs it through REDUE with the exit code a plain
+run gives. A script that runs several checks becomes `{ redue run a --if-due
+&& redue run b --if-due; }`. The rest of the chain is unchanged. The hook
+rewrites only while the observer is healthy and knows each check. It changes
+such a command without approving it, so your permission rules apply to the
+rewritten command; a rule that allows only `npm run lint` will ask about
+`redue run lint --if-due`. Anything more complex runs untouched. Known
+limit: if REDUE cannot start the check when its turn comes (another
+`redue run` holds the project's run lock), that part exits with REDUE's
+error instead of running the check. Other settings in the file are kept,
 but the file is rewritten as 2-space JSON. `.claude/settings.json` is not touched.
 `redue agent remove claude --apply` removes only the entries REDUE added.
 

package/docs/user/direct-typescript.md

@@ -141,6 +141,14 @@ changes invalidate or withdraw applicability normally. Installed files are obser
 by identity, so reinstalling identical packages or restoring an installed file's
 bytes also needs one rerun (see [configuration](configuration.md)).
 
+Vitest writes its results under `node_modules/.vite/vitest` at every run.
+They are not inputs, so a test run leaves the typecheck CURRENT. Everything
+else under `node_modules/.vite` is still an input. A program that asks about
+anything under `node_modules/.vite` (by any spelling or through a link that
+resolves there), or lists `node_modules`, is UNVERIFIED: REDUE does not
+observe what Vitest writes there. A check configured before 0.1.0-alpha.25 gets the new inputs on
+its own and reports STALE once after the upgrade.
+
 A root tsconfig with `incremental: true` is supported. tsc reads and writes
 its build-info file (`tsBuildInfoFile`, or the default next to the config) on
 each run, so REDUE leaves that file out of the inputs and lets the run write

package/docs/user/tests-direct.md

@@ -90,8 +90,12 @@ kept but marked UNVERIFIED, with the reason, when the run:
   `--expose-internals`: the recorder cannot follow those;
 - had an installed file with another hard link, other than a link into the
   pnpm store the install recorded in `node_modules/.modules.yaml` (pnpm's
-  default on Linux). A change through a link elsewhere, such as Yarn's
-  hardlinks modes, is not seen.
+  default on Linux) or, without a pnpm store, links that are all installed
+  files the check observes (esbuild's install links its binary into its
+  platform package). The link count of each such file is checked again
+  before every answer, so a link added later is noticed. A change through a
+  link elsewhere, such as Yarn's hardlinks modes, is not seen. This applies
+  to the [general recipe](node-script.md) too.
 
 Lookups that can be asked again become run facts, checked before every CURRENT
 answer: whether a path outside the checkout exists, where a link resolves, the

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@redue/cli",
   "private": false,
-  "version": "0.1.0-alpha.23",
+  "version": "0.1.0-alpha.25",
   "publishConfig": {
     "access": "public",
     "tag": "alpha"

package/src/agent-integration.mjs

@@ -183,23 +183,28 @@ const commandsOf=rows=>[rows.filter(row=>row.kind!=='test'&&row.kind!=='lint').m
   rows.filter(row=>row.kind==='test').map(row=>row.form),rows.filter(row=>row.kind==='lint').map(row=>row.form)];
 const fence=(host,body)=>`\n\n<!-- REDUE:${host}:begin -->\n${body}<!-- REDUE:${host}:end -->\n`;
 const skillPointer=host=>`Before you run, skip or report a typecheck or other configured check, read\n${hosts[host].skill}.\n`;
-function blockFor(host,rows=[]){
+// `own`: the line asking for each check as a command of its own, added in
+// alpha.24; the alpha.15-alpha.23 wording without it is still recognized.
+function blockFor(host,rows=[],own=true){
   const [typechecks,tests,lints]=commandsOf(rows);
   if(!rows.length)return fence(host,skillPointer(host));
+  const ownLine=own?`Run each check as a command of its own, not chained after an edit or another\n`+
+    `command.\n`:'';
   if(lints.length)return fence(host,(typechecks.length?`Typecheck with ${quoted(typechecks)}.\n`:'')+
     (tests.length?`Run the unit tests with ${quoted(tests)}.\n`:'')+`Lint with ${quoted(lints)}.\n`+
     `Run a check before you say it passes, even after an edit you think cannot\n`+
     `matter; don't skip it yourself. If its last pass still applies to these exact\n`+
-    `files, a REDUE hook skips the run and says so. That skip counts as a pass.\n`);
+    `files, a REDUE hook skips the run and says so. That skip counts as a pass.\n`+ownLine);
   if(!tests.length)return fence(host,`Typecheck with ${quoted(typechecks)}. Run it before you say it passes, even after an\n`+
     `edit you think cannot matter; don't skip it yourself. If its last pass still\n`+
     `applies to these exact files, a REDUE hook skips the run and says so. That\n`+
-    `skip counts as a pass.\n`);
+    (own?`skip counts as a pass. Run it as a command of its own, not chained after an\n`+
+      `edit or another command.\n`:`skip counts as a pass.\n`));
   return fence(host,(typechecks.length?`Typecheck with ${quoted(typechecks)}.\n`:'')+
     `Run the unit tests with ${quoted(tests)}.\n`+
     `Run a check before you say it passes, even after an edit you think cannot\n`+
     `matter; don't skip it yourself. If its last pass still applies to these exact\n`+
-    `files, a REDUE hook skips the run and says so. That skip counts as a pass.\n`);
+    `files, a REDUE hook skips the run and says so. That skip counts as a pass.\n`+ownLine);
 }
 // The alpha.12-alpha.14 wording, recognized so setup can replace it.
 function earlierBlock(host,rows=[]){
@@ -240,7 +245,8 @@ function knownBlock(host,relative,block){
   const rows=[...forms(`^\\n\\n<!-- REDUE:[a-z]+:begin -->\\nTypecheck with ${list}\\.`).map(form=>({kind:'typecheck',form})),
     ...forms(`Run the unit tests with ${list}\\.\\n`).map(form=>({kind:'test',form})),
     ...forms(`Lint with ${list}\\.\\n`).map(form=>({kind:'lint',form}))];
-  return block===blockFor(host,rows)||block===earlierBlock(host,rows)||priorBlocks(host,relative).includes(block);
+  return block===blockFor(host,rows)||block===blockFor(host,rows,false)||block===earlierBlock(host,rows)||
+    priorBlocks(host,relative).includes(block);
 }
 // The policy with the exact commands for this config, so an agent never builds
 // a --config form the hook would not recognize. Claude Code gets the typecheck

package/src/claude-hook.mjs

@@ -276,6 +276,74 @@ function matched(command,config,configFile,dir='.',scripts={}){
   // A script form of compiler checks is checked against the script first.
   return row?.scriptForms?.includes(parts.base)?{row,rest:parts.rest}:row?{check:row.check,rest:parts.rest}:null;
 }
+// A simple chain: commands joined by &&, || or ;, outside quotes, with no
+// line break, subshell, command or process substitution, backtick,
+// here-document or background job. [{separator, text}] with the separator
+// before each part ('' for the first), or null.
+export function chainParts(command){
+  if(typeof command!=='string'||/[\r\n`]|\$\(|[<>]\(|<<|[()]/.test(command))return null;
+  const parts=[];let quote=null,start=0,separator='';
+  for(let i=0;i<command.length;i++){
+    const c=command[i];
+    if(quote){if(c===quote)quote=null;else if(c==='\\'&&quote==='"')i++;continue;}
+    if(c==='\\'){i++;continue;}
+    if(c==="'"||c==='"'){quote=c;continue;}
+    const two=command.slice(i,i+2);
+    if(two==='&&'||two==='||'||c===';'){
+      parts.push({separator,text:command.slice(start,i)});separator=c===';'?';':two;
+      start=i+(c===';'?1:2);if(c!==';')i++;continue;}
+    // A lone & runs a job in the background; >&, &> and |& redirect.
+    if(c==='&'&&command[i-1]!=='>'&&command[i+1]!=='>')return null;
+    if(two==='|&')return null;
+  }
+  if(quote)return null;
+  parts.push({separator,text:command.slice(start)});
+  return parts.every(part=>part.text.trim())?parts:null;
+}
+// A simple chain with each check in it run through REDUE when its turn comes:
+// `redue run CHECK --if-due` decides then, after earlier parts may have
+// changed files. Null when the command is not such a chain or runs no check.
+// The rest of the chain is unchanged, and so is its output and exit status
+// when a check runs.
+// Shell builtins that change the shell for the parts after them.
+const shellBuiltins=new Set(['cd','pushd','popd','export','unset','set','source','.','eval','exec','alias','unalias','shopt',
+  'ulimit','umask','trap','builtin','command','declare','typeset','local','readonly','hash','enable','let','read','wait']);
+// A part that cannot change the directory or environment of the parts after
+// it: a program found on PATH (or by path), not a builtin, function or bare
+// assignment.
+function plainProgram(body){
+  const words=body.split(/\s+/).filter(Boolean);
+  while(words.length&&/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0]))words.shift();
+  const word=words[0];
+  return Boolean(word)&&!shellBuiltins.has(word)&&/^[A-Za-z0-9_./+@-]+$/.test(word)&&(word.includes('/')||Boolean(findExecutable(word)));
+}
+// A simple chain with each check in it run through REDUE when its turn comes:
+// `redue run CHECK --if-due` decides then, after earlier parts may have
+// changed files. {command, names}, or null when the command is not such a
+// chain or runs no check. The rest of the chain is unchanged, and so are its
+// output and exit status when a check runs. Every part before a check must be
+// a plain program, so the check runs where and as it would have.
+export function chainCommand(command,config,configFile,dir='.',scripts={},invoke='redue',runConfig=configFile,projectRoot=null){
+  const parts=chainParts(command);
+  if(!parts||parts.length<2)return null;
+  const redue=redueFor(runConfig)?.replace(/^redue/,()=>invoke);
+  if(!redue)return null;
+  const names=[];let plain=true;
+  const text=parts.map(({separator,text})=>{
+    const lead=text.match(/^\s*/)[0],trail=text.match(/\s*$/)[0],body=text.trim();
+    const match=matched(body,config,configFile,dir,scripts),split_=split(body);
+    // A compiler script is its checks in the order of its runs.
+    const checks=match?.check?[match.check]:match?.row&&projectRoot?scriptChecks(match.row,config,projectRoot):null;
+    if(!checks?.length||match.rest!==null||!split_||!checks.every(name=>safe.test(name))){
+      plain&&=plainProgram(body);return separator+text;}
+    if(!plain)return null;
+    names.push(...checks);
+    // Grouped, so a separator before it applies to all its runs.
+    const runs=checks.map(name=>`${redue} run ${name} --if-due`).join(' && ');
+    return `${separator}${lead}${checks.length>1?`{ ${runs}; }`:runs}${split_.suffix}${trail}`;
+  });
+  return names.length&&!text.includes(null)?{command:text.join(''),names}:null;
+}
 export function matchCheck(command,config,configFile,dir,scripts){
   const match=matched(command,config,configFile,dir,scripts);
   return match?.row?match.row.checks.join(' && '):match?.check||null;
@@ -327,7 +395,8 @@ export function verdict(status,name,rest=null){
     (rest===null?'':` Nothing else in the command ran either; run the rest on its own: ${rest}`);
 }
 
-function synchronizedStatus(entry,config,root,timeout){
+// The status answer, synchronized unless `sync` is false (the cached one).
+function synchronizedStatus(entry,config,root,timeout,sync=true){
   return new Promise(resolve=>{
     let child,out='',done=false;
     const finish=value=>{if(done)return;done=true;clearTimeout(timer);process.off('SIGTERM',stop);
@@ -337,7 +406,7 @@ function synchronizedStatus(entry,config,root,timeout){
     // Claude Code ends a hook that outlives its own timeout; end the status call with it.
     const stop=()=>finish(null);process.once('SIGTERM',stop);
     // Its own process group on POSIX, so a timeout also ends the engine it starts.
-    try{child=spawn(process.execPath,[entry,'--config',config,'status','--sync','--json'],
+    try{child=spawn(process.execPath,[entry,'--config',config,'status',...(sync?['--sync']:[]),'--json'],
       {cwd:root,stdio:['ignore','pipe','ignore'],env:process.env,windowsHide:true,detached:process.platform!=='win32'});}
     catch{return finish(null);}
     child.on('error',()=>finish(null));
@@ -402,8 +471,27 @@ export async function claudeHook(input,{entry,timeout,invoke=null}){
   if(!entered)return null;
   let scripts={};
   if(entered.dir==='.')try{scripts=JSON.parse(fs.readFileSync(path.join(project.projectRoot,'package.json'),'utf8')).scripts||{};}catch{}
+  // The configured config path as the command's directory sees it.
+  // Both sides resolved alike: Windows can spell the same directory RUNNER~1 or by its long name.
+  const configPath=!entered.prefix?record.config:
+    path.relative(path.join(project.projectRoot,entered.dir),realObservedPath(config)).split(path.sep).join('/');
+  // A simple chain: each check in it runs through REDUE when its turn comes,
+  // after the parts before it (an edit) have run. The command is changed,
+  // not approved: Claude Code's permission rules apply to it as rewritten.
+  // A chain with no check of its own (a leading fan-out) goes on below.
+  // Rewritten only on a healthy answer: without an observer, redue run
+  // cannot run the check, and the chain would not run as written.
+  // The observer's cached health is enough here: each check asks again when it runs.
+  const chained=chainCommand(entered.command,parsed,record.config,entered.dir,scripts,invoke??redueInvocation(entry),configPath,project.projectRoot);
+  if(chained){
+    const cached=await synchronizedStatus(entry,config,root,timeout??5000,false);
+    return cached?.observation?.healthy===true&&chained.names.every(name=>cached.checks?.some(row=>row?.name===name))?
+      {hookSpecificOutput:{hookEventName:'PreToolUse',updatedInput:{...input.tool_input,command:entered.prefix+chained.command}}}:null;
+  }
   const match=matched(entered.command,parsed,record.config,entered.dir,scripts);
   if(!match)return null;
+  // A check followed by more than a simple chain runs untouched.
+  if(match.rest!==null&&!match.fanout)return null;
   // turbo, nx and `pnpm -r` cache their own results: skip only when every
   // check the command runs is CURRENT, and otherwise leave it alone.
   if(match.fanout){
@@ -413,10 +501,6 @@ export async function claudeHook(input,{entry,timeout,invoke=null}){
       reason=fanoutVerdict(status,names,match.rest);
     return reason?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'deny',permissionDecisionReason:reason}}:null;
   }
-  // The configured config path as the command's directory sees it.
-  // Both sides resolved alike: Windows can spell the same directory RUNNER~1 or by its long name.
-  const configPath=!entered.prefix?record.config:
-    path.relative(path.join(project.projectRoot,entered.dir),realObservedPath(config)).split(path.sep).join('/');
   // A compiler script: its checks in the order of its runs, or nothing when
   // they no longer correspond. One run is an ordinary check. A chain is
   // skipped when every run is CURRENT, else the runs that are not run through

package/src/cli.mjs

@@ -4,6 +4,8 @@ import fs from 'node:fs';
 import {directQualification,directInterpretation,observedNpmContext} from './direct-typescript.mjs';
 import {directRunCertificateAllowed,directRunCertificate,directRunRecordable,directRunRecording,probeQuestions,validateRunRecord} from './direct-run-certificate.mjs';
 import {queryAnswer,runFactChange} from './typescript-list.mjs';
+import {patternMatcher} from './glob.mjs';
+import {observedBy} from './installed-observation.mjs';
 import {changedFiles,coverageReadable,gitIgnored,recordedEnvironment,testEnvironmentIssue,testGuardConfig,testRunGuard,testRunFacts,sharedInstalledFile,testsInterpretation,testsQualification} from './test-direct.mjs';
 import {childProgram,lookup,pnpmConfigFiles,scriptCaches,scriptInstalledPaths,scriptInterpretation,scriptQualification,scriptRunFacts,pnpmNameless,toolOutput,toolchainDirs} from './node-script.mjs';
 import path from 'node:path';
@@ -53,7 +55,17 @@ function publishedProbeDeadline() {
   try{return publishedDeadline(JSON.parse(fs.readFileSync(path.join(state,'status.json'),'utf8')).probe_deadline_ms);}
   catch{return 0;}
 }
-const decisionDeadline=()=>Math.max(decisionBaseMs,publishedProbeDeadline()+10000);
+// The wait for a decision, read when it starts: the base at once, and the
+// published deadline when status.json has been read. That file is rewritten
+// at every decision, and a first read of a fresh file is slow where a scanner
+// checks files as they are opened, so it is read off the main thread while
+// the call runs. On Windows it is read before the call, as before: the
+// observer replaces it during the call, and a replacement fails there while a
+// reader holds the file open. An override is exact.
+const decisionWait=override=>override?{timeout:Number(override),deadline:null}:
+  process.platform==='win32'?{timeout:Math.max(decisionBaseMs,publishedProbeDeadline()+10000),deadline:null}:{timeout:decisionBaseMs,
+  deadline:fs.promises.readFile(path.join(state,'status.json'),'utf8')
+    .then(text=>Math.max(decisionBaseMs,publishedDeadline(JSON.parse(text).probe_deadline_ms)+10000),()=>decisionBaseMs)};
 const digest=value=>createHash('sha256').update(value).digest('hex');
 function nodeIdentity() {const real=fs.realpathSync(process.execPath),st=fs.statSync(real,{bigint:true});
   return digest(JSON.stringify([real,process.version,...['dev','ino','mode','size','mtimeNs','ctimeNs']
@@ -118,20 +130,26 @@ function owner(){
     atomicJson(ownerFile,expected);
   }
 }
-function call(message,timeout=5000) {
+// deadline, when given, resolves to the whole wait in ms, which replaces
+// timeout when it is longer.
+function call(message,timeout=5000,deadline=null) {
   return new Promise((resolve,reject)=>{
     let data='',done=false;mark('client.control_connect',{deadlineMs:timeout});const client=net.createConnection(socket);
-    const timer=setTimeout(()=>{mark('client.control_timeout');client.destroy();reject(Error('observer synchronization timeout'));},timeout);
+    const started=Date.now(),expire=()=>{mark('client.control_timeout');client.destroy();reject(Error('observer synchronization timeout'));};
+    let timer=setTimeout(expire,timeout);
+    deadline?.then(total=>{if(done||total<=timeout)return;mark('client.control_deadline',{deadlineMs:total});
+      clearTimeout(timer);timer=setTimeout(expire,Math.max(0,total-(Date.now()-started)));});
     client.on('connect',()=>{mark('client.control_submit');client.write(JSON.stringify({...message,...(profiling?{diagnostic:traceContext()}: {})})+'\n');});
     client.on('data',chunk=>data+=chunk);
     client.on('end',()=>{mark('client.control_complete',{bytes:data.length});clearTimeout(timer);if(done)return;done=true;
       try{resolve(JSON.parse(data));}catch(e){reject(e);}});
-    client.on('error',e=>{mark('client.control_error',{code:e.code});clearTimeout(timer);reject(e);});
+    client.on('error',e=>{mark('client.control_error',{code:e.code});clearTimeout(timer);done=true;reject(e);});
   });
 }
-async function decisionCall(message,timeout) {
-  const started=Date.now(),remaining=()=>Math.max(1,timeout-(Date.now()-started));
-  try{return await call(message,remaining());}
+async function decisionCall(message,{timeout,deadline}) {
+  let total=timeout;deadline?.then(value=>{total=Math.max(total,value);});
+  const started=Date.now(),remaining=()=>Math.max(1,total-(Date.now()-started));
+  try{return await call(message,timeout,deadline);}
   catch(error){
     if(process.platform!=='win32'||!['ENOENT','ECONNREFUSED','ECONNRESET'].includes(error.code))throw error;
     const pidFile=path.join(state,'observer.lock','pid');
@@ -231,8 +249,7 @@ async function execute() {
     const environmentBefore=contextHashes()[name];
     const observedContext=selected.qualification===directQualification?{interpretation:directInterpretation,npmProxyDigest:observedNpmContext()}:null;
     timing('cli.context_before',contextStarted);
-    const
-      captureTimeout=Number(process.env.VSTATE_CAPTURE_TIMEOUT_MS||decisionDeadline());
+    const captureWait=decisionWait(process.env.VSTATE_CAPTURE_TIMEOUT_MS);
     let before=null,after=null;
     // Expensive state probes can take seconds. Keep the filesystem checkpoint
     // adjacent to process launch so a late notification from earlier work
@@ -242,7 +259,7 @@ async function execute() {
     let probeBefore=callerCertificate?null:probeHash(probePlan);
     const startSnapshotStarted=performance.now();
     try{before=await call({action:'snapshot',name,contextHashes:contextHashes(),
-      ...(callerCertificate?{runCertificate:1}:{})},captureTimeout);}
+      ...(callerCertificate?{runCertificate:1}:{})},captureWait.timeout,captureWait.deadline);}
     catch(error){captureIssues.push('start observation unavailable'+
       (typeof error.code==='string'&&/^[A-Z0-9_]+$/.test(error.code)?` (${error.code})`:''));}
     timing('cli.start_checkpoint',startSnapshotStarted,{available:before?.snapshots?.[name]?1:0});
@@ -305,7 +322,7 @@ async function execute() {
       await new Promise(resolve=>setTimeout(resolve,100));
       const prelaunchStarted=performance.now();
       try{before=await call({action:'prelaunch',name,
-        contextHashes:contextHashes()},Math.min(captureTimeout,5000));}
+        contextHashes:contextHashes()},Math.min(captureWait.timeout,5000));}
       catch{before=null;captureIssues.push('prelaunch observation unavailable');}
       timing('cli.prelaunch_checkpoint',prelaunchStarted,
         {available:before?.snapshots?.[name]?1:0});
@@ -377,8 +394,13 @@ async function execute() {
       // The pnpm executable reads its configuration natively: kept by content.
       if(guard.opaque)for(const file of pnpmConfigFiles())try{runFacts.push(['readFile',file,queryAnswer('readFile',file)]);}
         catch{guard.issues.push(`pnpm configuration ${file} cannot be read`);}
-      const shared=sharedInstalledFile(root,testFacts,path.join(state,'pnpm-store-links-v1.json'));
+      // Hard links count only where the check observes them.
+      // As the index matches: source patterns, or additive (installed) ones.
+      const source=patternMatcher(plan.sourcePatterns||plan.patterns||[]),additive=patternMatcher(plan.additivePatterns||[]);
+      const linkFacts=[],observed=observedBy(root,rel=>source(rel)||additive(rel));
+      const shared=sharedInstalledFile(root,testFacts,path.join(state,'pnpm-store-links-v1.json'),{observed,facts:linkFacts});
       if(shared)guard.issues.push(`installed file ${shared.file} ${shared.reason}; a change through it is not observed`);
+      else runFacts.push(...linkFacts);
       fs.rmSync(testRecord,{recursive:true,force:true});
     }
     // The daemon reads the recording from owned state; control requests are small.
@@ -386,11 +408,12 @@ async function execute() {
     if(recordFile)try{fs.writeFileSync(recordFile,recordText,{mode:0o600});}catch{}
     const endSnapshotStarted=performance.now();
     if(!unobservedDirectRun){
+      // The start checkpoint's probe may have raised the deadline.
+      const endWait=decisionWait(process.env.VSTATE_CAPTURE_TIMEOUT_MS);
       try{after=await call({action:'snapshot',name,contextHashes:contextHashes(),
         ...(testRun&&Number.isSafeInteger(snap?.inputEventSerial)?{sinceSerial:snap.inputEventSerial}:{}),
         ...(recording?{runCertificate:1,adopt:recording}:recorded&&!certificate?{runCertificate:1,runFacts:1}:{})},
-        // The start checkpoint's probe may have raised the deadline.
-        Number(process.env.VSTATE_CAPTURE_TIMEOUT_MS||decisionDeadline()));}
+        endWait.timeout,endWait.deadline);}
       catch{captureIssues.push('end observation unavailable');}
       finally{if(recordFile)fs.rmSync(recordFile,{force:true});}
       timing('cli.end_checkpoint',endSnapshotStarted,{available:after?.snapshots?.[name]?1:0});
@@ -594,7 +617,7 @@ async function main(){
         observedNpmDigest:observedNpmContext(),proxyShapes});
     }
     let value;try{value=await decisionCall({action:'sync',contextHashes:contextHashes()},
-      Number(process.env.VSTATE_SYNC_TIMEOUT_MS||decisionDeadline()));
+      decisionWait(process.env.VSTATE_SYNC_TIMEOUT_MS));
       // A client upgrade can encounter an older running observer. Its successful
       // control response does not establish that it evaluated the latest receipt.
       if(value.receipt_revision===null){
@@ -608,7 +631,9 @@ async function main(){
       }}
     catch(e){value=unavailableCached(state,e.message,config.checks);process.exitCode=2;}
     timing('cli.synchronized_status',started,{available:value.observation?.healthy?1:0});
-    if(action==='sync')console.log(JSON.stringify(value));
+    // In the front's process (bin/redue.mjs), the value is handed back.
+    if(action==='sync'&&process.argv.includes('--value'))syncValue=value;
+    else if(action==='sync')console.log(JSON.stringify(value));
     else for(const row of value.checks)console.log(`${row.name}: ${row.freshness}/${row.result||'NO RESULT'} — ${row.reason}`);
     return;
   }
@@ -616,4 +641,5 @@ async function main(){
   if(action==='run'){await execute();return;}
   throw Error(`unknown action ${action}`);
 }
-main().catch(e=>{console.error(`redue: ${e.message}`);process.exitCode=2;});
+export let syncValue=null;
+export const finished=main().catch(e=>{console.error(`redue: ${e.message}`);process.exitCode=2;});

package/src/daemon.mjs

@@ -269,6 +269,7 @@ function probe(row,allowReuse=false,{launch=true}={}) {
         'typescript-plugin-unsupported':'TypeScript compiler plugin needs explicit review',
         'typescript-input-list-unavailable':'TypeScript input listing did not complete',
         'typescript-input-outside-repository':'TypeScript consumes files outside the observed repository',
+        'typescript-vite-cache-consumed':'TypeScript asks about node_modules/.vite or lists node_modules; Vitest rewrites files there and this recipe does not observe them',
         'npm-installation-layout-unsupported':'npm executable or installation layout is unsupported',
         'npm-installation-unobservable':'npm installation contains unobservable entries',
         'npm-configuration-unsupported':'npm script configuration needs review',

package/src/direct-run-certificate.mjs

@@ -7,7 +7,7 @@ import {createHash} from 'node:crypto';
 import {inflateSync} from 'node:zlib';
 import {fileURLToPath} from 'node:url';
 import {timing} from './decision-profile.mjs';
-import {directCompiler,directContextHash,directEnvironmentIssue,directProbeOutput,directProbeValue} from './direct-typescript.mjs';
+import {directCompiler,directContextHash,directEnvironmentIssue,directProbeOutput,directProbeValue,viteCacheQuestion} from './direct-typescript.mjs';
 import {withinPath} from './path-identity.mjs';
 const hash=value=>createHash('sha256').update(value).digest('hex');
 // Whether a direct run is recorded at all: on macOS and Linux, always, so its
@@ -158,6 +158,8 @@ export function runRecordIssue(record,certificate,runFacts=null) {
   if(kept.issue)return kept.issue;
   if(record.main!==compiler.entry||!Array.isArray(record.node)||
     directContextHash(compiler,record.node)!==certificate.context)return 'execution context changed';
+  const vite=viteCacheQuestion(compiler.root,kept.facts);
+  if(vite)return `the compiler asked about ${vite}, which Vitest rewrites and REDUE does not observe`;
   const inCompiler=withinCompiler(compiler);
   const facts=new Map();
   for(const query of queries){if(!facts.has(query[1]))facts.set(query[1],[]);facts.get(query[1]).push(query);}

package/src/direct-typescript-probe.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import {directProject,directInterpretation,directContextHash,directProbeOutput} from './direct-typescript.mjs';
+import {directProject,directInterpretation,directContextHash,directProbeOutput,viteCacheQuestion} from './direct-typescript.mjs';
 import {typeScriptInputFacts} from './typescript-input-facts.mjs';
 import {contextOnly,probeResult} from './probe-result.mjs';
 import {realObservedPath} from './path-identity.mjs';
@@ -18,6 +18,9 @@ try{
   const contextHash=directContextHash(compiler,context.node);
   if(!contextOnly(contextHash)){
     const {queries,configs,files,buildInfo}=typeScriptInputFacts(root,compiler.tsRoot,compiler.entry,compiler.config);
+    // Captured questions include every config and program file read.
+    if(viteCacheQuestion(root,queries||[...configs,...files].map(([file])=>['readFile',file])))
+      throw Object.assign(Error('typescript-vite-cache-consumed'),{code:'typescript-vite-cache-consumed'});
     const layout={root,script,configs,files,context,...(buildInfo?{buildInfo}:{})};
     probeResult(directProbeOutput(layout),contextHash,queries,layout);
   }

package/src/direct-typescript.mjs

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {createRequire} from 'node:module';
-import {racyUntil,realObservedPath,withinPath} from './path-identity.mjs';
+import {normalizedPath,racyUntil,realObservedPath,withinPath} from './path-identity.mjs';
 import {cachedTarball,lockedPackage,matchTarball,npmCacheDir,registryPackage,tarballFiles} from './npm-integrity.mjs';
 import {runConfig,tscRun} from './typescript-invocation.mjs';
 export const directInterpretation='npm-direct-typescript@1';
@@ -79,7 +79,7 @@ export function directCompiler(root,{verify=true}={}){
     for(const [name,file] of files.sort(([a],[b])=>a<b?-1:a>b?1:0))digest.update(name+'\0'+hash(fs.readFileSync(file))+'\0');
     if(digest.digest('hex')!==spec.digest)fail('direct-typescript-implementation-unreviewed');
   }
-  return {tsRoot,version,entry:path.join(tsRoot,spec.entry),digest:spec.digest};
+  return {root,tsRoot,version,entry:path.join(tsRoot,spec.entry),digest:spec.digest};
 }
 // A TypeScript 5.x or 6.0 the lockfile records: the installed package must be
 // the registry's `typescript` at that version, holding exactly the files of
@@ -115,7 +115,7 @@ function lockedCompiler(root,tsRoot,version,verify){
     }
   }
   const entry=fs.existsSync(path.join(tsRoot,'lib','_tsc.js'))?'lib/_tsc.js':'lib/tsc.js';
-  return {tsRoot,version,entry:path.join(tsRoot,entry),digest:hash('npm-integrity\0'+locked.integrity)};
+  return {root,tsRoot,version,entry:path.join(tsRoot,entry),digest:hash('npm-integrity\0'+locked.integrity)};
 }
 // The direct probe's output: root, script, configuration and program files with
 // their byte digests, and the execution context. A recorded run rebuilds it from
@@ -162,6 +162,26 @@ export function directContextHash(compiler,node){
   return hash(JSON.stringify({interpretation:directInterpretation,compiler:compiler.digest,
     entry:compiler.entry,node}));
 }
+// Vitest writes its results under node_modules/.vite/vitest at every run. The
+// recipe does not observe them. A compiler that asks about anything under
+// node_modules/.vite, is told a path there (realpath), or lists node_modules,
+// could see them, so its result is UNVERIFIED.
+export const directInstalledInputs=Object.freeze(['node_modules/**','!node_modules/.vite/vitest/**']);
+const listings=new Set(['readdir','listing','directories','entries','readDirectory']);
+// The first path of [kind, file, answer] questions that does, or null. Kinds
+// are a recorded run's (readdir) or a probe's. Compared without case: a
+// case-insensitive mount reaches .vite under any spelling.
+export function viteCacheQuestion(root,questions){
+  const fold=value=>normalizedPath(value).toLowerCase();
+  const modules=fold(path.join(root,'node_modules')),cache=path.join(modules,'.vite');
+  for(const [kind,file,answer] of questions){
+    if(typeof file!=='string')continue;
+    const at=fold(file);
+    if(withinPath(at,cache)||at===modules&&listings.has(kind))return file;
+    if(kind==='realpath'&&typeof answer==='string'&&withinPath(fold(answer),cache))return answer;
+  }
+  return null;
+}
 // The compiler for one check run {script, part, args}: script null for a
 // check init proposed without one. The run must pass --noEmit and name a
 // config inside the root.

package/src/installed-observation.mjs

@@ -0,0 +1,23 @@
+// Whether a check observes an installed file: the file is in the checkout
+// and matched by the check's patterns, and a link it goes through that leads
+// elsewhere in the checkout leads to a matched path too. A recorded run's
+// hard-linked installed files are accepted only when every link is one the
+// check observes, so a pattern that leaves a folder out (a runner cache in
+// node_modules) cannot hide one.
+import fs from 'node:fs';
+import path from 'node:path';
+import {observedRelative} from './path-identity.mjs';
+
+// `matches(rel)`: the check's pattern matcher over checkout-relative paths.
+// A link that leads outside the checkout is the plan's to resolve (a
+// permitted root or a refusal).
+export function observedBy(root,matches){
+  let realRoot=root;try{realRoot=fs.realpathSync(root);}catch{}
+  return file=>{
+    const logical=observedRelative(root,path.resolve(file));
+    if(logical===null||!matches(logical))return false;
+    let real;try{real=fs.realpathSync(file);}catch{return false;}
+    const physical=observedRelative(realRoot,real);
+    return physical===null||physical===logical||matches(physical);
+  };
+}

package/src/node-script.mjs

@@ -35,12 +35,15 @@ const modulesDirs=dirs=>['node_modules',...dirs.map(dir=>`${dir}/node_modules`)]
 // Inputs: the whole checkout but node_modules, .git and runner caches. Every
 // node_modules of the workspace is observed as installed files, without the
 // caches tools keep there.
+// Runner caches at the top of a node_modules, which Vite, Vitest and build
+// loaders rewrite as they run: not installed inputs.
+export const installedRunnerCaches=['.cache','.vite','.vite-temp','.vitest','.vitest-cache'];
 export function scriptCheckInputs(dirs=[]){
   const modules=modulesDirs(dirs);
   return {inputs:['**',...modules.map(at=>`!${at}/**`),'!.git/**',...installState.map(file=>`!${file}`),
     ...scriptCaches.map(pattern=>`!${pattern}`)],
-  installedInputs:[...modules.flatMap(at=>[`${at}/**`,`!${at}/.cache/**`,`!${at}/.vite/**`,`!${at}/.vite-temp/**`,
-    `!${at}/.vitest/**`,`!${at}/.vitest-cache/**`,`!${at}/**/*.tsbuildinfo`]),...installState]};
+  installedInputs:[...modules.flatMap(at=>[`${at}/**`,...installedRunnerCaches.map(dir=>`!${at}/${dir}/**`),
+    `!${at}/**/*.tsbuildinfo`]),...installState]};
 }
 // Installed files a tool rewrites during a run. pnpm writes its workspace
 // state in the root node_modules at the first run after an install, through

package/src/pnpm-inputs.mjs

@@ -8,7 +8,6 @@ import path from 'node:path';
 import {createRequire} from 'node:module';
 import {execFileSync,spawnSync} from 'node:child_process';
 import micromatch,{patternMatcher} from './glob.mjs';
-import YAML from 'yaml';
 import {resolveLinks} from './installed-inputs.mjs';
 import {withinPath as within,realObservedPath,samePath} from './path-identity.mjs';
 import {timing} from './decision-profile.mjs';
@@ -18,7 +17,11 @@ import {runConfig,tscRun,tscRuns} from './typescript-invocation.mjs';
 const rel=(root,file)=>path.relative(root,file).split(path.sep).join('/');
 const read=file=>JSON.parse(fs.readFileSync(file,'utf8'));
 const exists=file=>{try{fs.lstatSync(file);return true;}catch{return false;}};
+// Loaded on first use: the parser takes about 40 ms to load, and every
+// command imports this module.
+let YAML=null;
 export function yaml(file){
+  YAML??=createRequire(import.meta.url)('yaml');
   const doc=YAML.parseDocument(fs.readFileSync(file,'utf8'),{uniqueKeys:true});
   if(doc.errors.length)throw Error(`${path.basename(file)} cannot be interpreted safely`);
   return doc.toJS()||{};

package/src/test-direct.mjs

@@ -430,13 +430,18 @@ function storePath(files,file,st){
 // files, which is a change REDUE sees. `cache` (in owned state) keeps each
 // file found in the store with its identity and store path, so an unchanged
 // file is not hashed again; its store link is still checked.
-export function sharedInstalledFile(root,project={},cache=null){
+// Without a pnpm store, a hard-linked installed file is accepted only when
+// every one of its links is an installed file the check observes (`observed`,
+// installed-observation.mjs): esbuild links its binary into its platform
+// package. Each accepted file's link count becomes a run fact in `facts`, so
+// a link added later is noticed before the next answer.
+export function sharedInstalledFile(root,project={},cache=null,{observed=()=>false,facts=[]}={}){
   const stack=modulesDirs(project).map(dir=>path.join(root,dir));
   const files=pnpmStoreFiles(root),now=Date.now();
   let known={},changed=false;
   if(files&&cache)try{const value=JSON.parse(fs.readFileSync(cache,'utf8'));
     if(value?.files===files&&value.entries&&typeof value.entries==='object')known=value.entries;}catch{}
-  const found={};
+  const found={},links=new Map();
   const shared=(file,reason)=>({file:path.relative(root,file).split(path.sep).join('/'),reason});
   while(stack.length){
     const dir=stack.pop();let entries;
@@ -447,7 +452,14 @@ export function sharedInstalledFile(root,project={},cache=null){
       if(!entry.isFile())continue;
       let st;try{st=fs.lstatSync(file,{bigint:true});}catch{continue;}
       if(st.nlink<=1n)continue;
-      if(!files)return shared(file,'has another hard link, and the install records no pnpm store');
+      if(!files){
+        // Distinct observed links by real path: a directory walked twice
+        // through a link counts once.
+        const key=`${st.dev}:${st.ino}`,group=links.get(key)??{file,nlink:st.nlink,seen:new Set()};
+        if(group.nlink!==st.nlink)return shared(file,'had its hard links change while REDUE checked them');
+        if(observed(file))try{group.seen.add(fs.realpathSync(file));}catch{}
+        links.set(key,group);continue;
+      }
       const key=`${st.dev}:${st.ino}`,cached=known[key];
       let at=Array.isArray(cached)&&cached[0]===identity(st)&&typeof cached[1]==='string'&&
         sameFile(path.join(files,cached[1]),st)?cached[1]:null;
@@ -463,6 +475,10 @@ export function sharedInstalledFile(root,project={},cache=null){
       else changed=true;
     }
   }
+  for(const group of links.values()){
+    if(BigInt(group.seen.size)<group.nlink)return shared(group.file,'has another hard link that is not an installed file this check observes, and the install records no pnpm store');
+    facts.push(['linkCount',group.file,Number(group.nlink)]);
+  }
   if(files&&cache&&(changed||Object.keys(found).length!==Object.keys(known).length))
     try{atomicJson(cache,{files,entries:found});}catch{}
   return null;

package/src/typescript-list.mjs

@@ -15,6 +15,8 @@ export function queryAnswer(kind,file,options) {
     if(kind==='readFile')return hash(fs.readFileSync(file,'utf8'));
     if(kind==='fileExists')return fs.statSync(file).isFile();
     if(kind==='directoryExists')return fs.statSync(file).isDirectory();
+    // How many hard links a file has: a link added elsewhere changes it.
+    if(kind==='linkCount')return fs.lstatSync(file).nlink;
     // The compiler resolves through realpathSync.native outside Windows.
     if(kind==='realpath')return process.platform==='win32'?fs.realpathSync(file):fs.realpathSync.native(file);
     if(kind==='directories')return fs.readdirSync(file,{withFileTypes:true})
@@ -44,7 +46,7 @@ export function queryAnswer(kind,file,options) {
 export function runFactChange(facts) {
   if(!Array.isArray(facts))return 'an unreadable run fact';
   for(const fact of facts){
-    if(!Array.isArray(fact)||!['fileExists','directoryExists','realpath','readFile','entries'].includes(fact[0])||
+    if(!Array.isArray(fact)||!['fileExists','directoryExists','realpath','readFile','entries','linkCount'].includes(fact[0])||
       typeof fact[1]!=='string')return 'an unreadable run fact';
     const [kind,file,answer]=fact;
     let now;try{now=queryAnswer(kind,file);}catch{return file;}