@redue/cli 0.1.0-alpha.24 → 0.1.0-alpha.25

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.1.0-alpha.25 — 2026-10-29
+
+Running your tests no longer makes a typecheck STALE, and `status --sync`
+answers about twice as fast.
+
+- **Vitest and the direct TypeScript recipe.** A Vitest run writes its
+  results under `node_modules/.vite/vitest`, which the recipe counted as an
+  installed input, so the typecheck turned STALE after every test run. Those
+  files are no longer inputs. Everything else under `node_modules/.vite`
+  still is. A program that asks the compiler about anything under
+  `node_modules/.vite`, or lists `node_modules`, is UNVERIFIED instead. A
+  check set up by an earlier alpha reports STALE ("input plan changed") once
+  after the upgrade.
+- **Faster status.** `status --sync`, `detail` and `explain` no longer start
+  a second Node process on macOS and Linux, the YAML parser loads only for
+  pnpm projects, and each call to the observer no longer waits on a fresh
+  read of its status file. On the 800-file bench, warm `status --sync` adds
+  27 ms over cached status on a GitHub Linux runner (alpha.24: 120 ms) and
+  36 ms on a macOS runner (alpha.24: 137 ms).
+- **Releases are benched.** The release smoke now benches the candidate
+  against the last release on macOS and Linux runners; a slower candidate,
+  or one over the warm-sync or run-overhead budget, blocks the release.
+- Known limit: on the maintainer's Mac, which runs Microsoft Defender,
+  `redue run` still adds about 15-20% to a 2.7 s typecheck (3% on a GitHub
+  Linux runner).
+
 ## 0.1.0-alpha.24 — 2026-10-28
 
 Checks keep working after a normal `npm install`, and agents that chain an

package/README.md

@@ -76,10 +76,7 @@ inputs. 30 repositories had at least one such check:
 Everything else stays UNVERIFIED, with a reason you can read in
 `redue explain`. The usual ones: a script starts a program REDUE cannot see
 into (esbuild, turbo, nx, oxlint's tsgolint, TypeScript 7's native compiler),
-the project uses Bun, or a test suite writes into its own inputs. One you may
-meet right after setup: a Vitest run writes its results under
-`node_modules/.vite`, which the direct TypeScript recipe counts as an
-installed input, so the typecheck turns STALE until it runs again.
+the project uses Bun, or a test suite writes into its own inputs.
 [Supported projects](docs/user/supported-projects.md) has the details.
 
 ## Measured with Claude Code

package/bin/redue.mjs

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import {mark,traceBase,traceContext,traceEnvironment,traceId} from '../src/decision-profile.mjs';
 traceBase({...traceContext(),request:traceId(),work:'client'});
 mark('client.loaded');
-import {directCompiler,directQualification,directEnvironment,directInterpretation} from '../src/direct-typescript.mjs';
+import {directCompiler,directQualification,directEnvironment,directInstalledInputs,directInterpretation} from '../src/direct-typescript.mjs';
 import {runArgv,tscRun} from '../src/typescript-invocation.mjs';
 import {testEnvironment,testRunnerAt,testsInterpretation,testsQualification} from '../src/test-direct.mjs';
 import {scriptEnvironment,scriptInterpretation,scriptKinds,scriptQualification} from '../src/node-script.mjs';
@@ -337,7 +337,7 @@ const checks=publicConfig.checks.map(check=>{
     typeof check.cwd==='string'&&check.cwd&&!path.isAbsolute(check.cwd)&&!check.cwd.split('/').includes('..')?check.cwd:'.'),
     cwd:check.cwd,inputs:check.inputs||[],generatedInputs:check.generatedInputs||[],
     installedInputs:check.installedInputs||(
-      npmAutomatic||npmDirect||testsDirect?['node_modules/**']:[]),
+      npmDirect?[...directInstalledInputs]:npmAutomatic||testsDirect?['node_modules/**']:[]),
     allowedExternalRoots:check.allowedExternalRoots||[],
     probes:[...(check.probes||[]),...autoProbes]
       .map((p,i)=>argv(p,`${check.name}.probes[${i}]`)),
@@ -424,6 +424,15 @@ if(command==='run'&&process.platform!=='win32'){
   process.off('SIGINT',interrupt);process.off('SIGTERM',terminate);
   if(outcome.error)error(outcome.error.message);
   process.exit(outcome.status??(outcome.signal?128+os.constants.signals[outcome.signal]:1));
+}else if(internal==='sync'&&process.platform!=='win32'){
+  // As for run, the synchronized status engine runs in this process.
+  process.argv=[process.argv[0],engine,runtimeFile,internal,'','--value'];
+  mark('client.engine_submit',{inProcess:true});
+  const synchronized=await import(pathToFileURL(engine).href);
+  await synchronized.finished;
+  mark('client.engine_complete',{exit:process.exitCode??0});
+  if(synchronized.syncValue)showSynchronized(synchronized.syncValue);
+  await exit(process.exitCode??0);
 }else{
   mark('client.engine_submit');
   const result=spawnSync(process.execPath,[engine,runtimeFile,internal,...(check?[check]:[])],
@@ -434,10 +443,13 @@ if(command==='run'&&process.platform!=='win32'){
   if(result.stdout){
     if(['status','detail','explain'].includes(command)){
       let value;try{value=JSON.parse(result.stdout);}catch{error('status response could not be read; applicability is unknown');}
-      if(details&&check)value={...value,checks:value.checks.filter(row=>row.name===check)};
-      if(json)console.log(JSON.stringify(value));
-      else console.log(details?renderExplain(value,check):renderStatus(value,{short}));
+      showSynchronized(value);
     }else printLifecycle(result.stdout,command,json);
   }
   await exit(result.status??1);
 }
+function showSynchronized(value){
+  if(details&&check)value={...value,checks:value.checks.filter(row=>row.name===check)};
+  if(json)console.log(JSON.stringify(value));
+  else console.log(details?renderExplain(value,check):renderStatus(value,{short}));
+}

package/docs/user/direct-typescript.md

@@ -141,6 +141,14 @@ changes invalidate or withdraw applicability normally. Installed files are obser
 by identity, so reinstalling identical packages or restoring an installed file's
 bytes also needs one rerun (see [configuration](configuration.md)).
 
+Vitest writes its results under `node_modules/.vite/vitest` at every run.
+They are not inputs, so a test run leaves the typecheck CURRENT. Everything
+else under `node_modules/.vite` is still an input. A program that asks about
+anything under `node_modules/.vite` (by any spelling or through a link that
+resolves there), or lists `node_modules`, is UNVERIFIED: REDUE does not
+observe what Vitest writes there. A check configured before 0.1.0-alpha.25 gets the new inputs on
+its own and reports STALE once after the upgrade.
+
 A root tsconfig with `incremental: true` is supported. tsc reads and writes
 its build-info file (`tsBuildInfoFile`, or the default next to the config) on
 each run, so REDUE leaves that file out of the inputs and lets the run write

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@redue/cli",
   "private": false,
-  "version": "0.1.0-alpha.24",
+  "version": "0.1.0-alpha.25",
   "publishConfig": {
     "access": "public",
     "tag": "alpha"

package/src/cli.mjs

@@ -55,7 +55,17 @@ function publishedProbeDeadline() {
   try{return publishedDeadline(JSON.parse(fs.readFileSync(path.join(state,'status.json'),'utf8')).probe_deadline_ms);}
   catch{return 0;}
 }
-const decisionDeadline=()=>Math.max(decisionBaseMs,publishedProbeDeadline()+10000);
+// The wait for a decision, read when it starts: the base at once, and the
+// published deadline when status.json has been read. That file is rewritten
+// at every decision, and a first read of a fresh file is slow where a scanner
+// checks files as they are opened, so it is read off the main thread while
+// the call runs. On Windows it is read before the call, as before: the
+// observer replaces it during the call, and a replacement fails there while a
+// reader holds the file open. An override is exact.
+const decisionWait=override=>override?{timeout:Number(override),deadline:null}:
+  process.platform==='win32'?{timeout:Math.max(decisionBaseMs,publishedProbeDeadline()+10000),deadline:null}:{timeout:decisionBaseMs,
+  deadline:fs.promises.readFile(path.join(state,'status.json'),'utf8')
+    .then(text=>Math.max(decisionBaseMs,publishedDeadline(JSON.parse(text).probe_deadline_ms)+10000),()=>decisionBaseMs)};
 const digest=value=>createHash('sha256').update(value).digest('hex');
 function nodeIdentity() {const real=fs.realpathSync(process.execPath),st=fs.statSync(real,{bigint:true});
   return digest(JSON.stringify([real,process.version,...['dev','ino','mode','size','mtimeNs','ctimeNs']
@@ -120,20 +130,26 @@ function owner(){
     atomicJson(ownerFile,expected);
   }
 }
-function call(message,timeout=5000) {
+// deadline, when given, resolves to the whole wait in ms, which replaces
+// timeout when it is longer.
+function call(message,timeout=5000,deadline=null) {
   return new Promise((resolve,reject)=>{
     let data='',done=false;mark('client.control_connect',{deadlineMs:timeout});const client=net.createConnection(socket);
-    const timer=setTimeout(()=>{mark('client.control_timeout');client.destroy();reject(Error('observer synchronization timeout'));},timeout);
+    const started=Date.now(),expire=()=>{mark('client.control_timeout');client.destroy();reject(Error('observer synchronization timeout'));};
+    let timer=setTimeout(expire,timeout);
+    deadline?.then(total=>{if(done||total<=timeout)return;mark('client.control_deadline',{deadlineMs:total});
+      clearTimeout(timer);timer=setTimeout(expire,Math.max(0,total-(Date.now()-started)));});
     client.on('connect',()=>{mark('client.control_submit');client.write(JSON.stringify({...message,...(profiling?{diagnostic:traceContext()}: {})})+'\n');});
     client.on('data',chunk=>data+=chunk);
     client.on('end',()=>{mark('client.control_complete',{bytes:data.length});clearTimeout(timer);if(done)return;done=true;
       try{resolve(JSON.parse(data));}catch(e){reject(e);}});
-    client.on('error',e=>{mark('client.control_error',{code:e.code});clearTimeout(timer);reject(e);});
+    client.on('error',e=>{mark('client.control_error',{code:e.code});clearTimeout(timer);done=true;reject(e);});
   });
 }
-async function decisionCall(message,timeout) {
-  const started=Date.now(),remaining=()=>Math.max(1,timeout-(Date.now()-started));
-  try{return await call(message,remaining());}
+async function decisionCall(message,{timeout,deadline}) {
+  let total=timeout;deadline?.then(value=>{total=Math.max(total,value);});
+  const started=Date.now(),remaining=()=>Math.max(1,total-(Date.now()-started));
+  try{return await call(message,timeout,deadline);}
   catch(error){
     if(process.platform!=='win32'||!['ENOENT','ECONNREFUSED','ECONNRESET'].includes(error.code))throw error;
     const pidFile=path.join(state,'observer.lock','pid');
@@ -233,8 +249,7 @@ async function execute() {
     const environmentBefore=contextHashes()[name];
     const observedContext=selected.qualification===directQualification?{interpretation:directInterpretation,npmProxyDigest:observedNpmContext()}:null;
     timing('cli.context_before',contextStarted);
-    const
-      captureTimeout=Number(process.env.VSTATE_CAPTURE_TIMEOUT_MS||decisionDeadline());
+    const captureWait=decisionWait(process.env.VSTATE_CAPTURE_TIMEOUT_MS);
     let before=null,after=null;
     // Expensive state probes can take seconds. Keep the filesystem checkpoint
     // adjacent to process launch so a late notification from earlier work
@@ -244,7 +259,7 @@ async function execute() {
     let probeBefore=callerCertificate?null:probeHash(probePlan);
     const startSnapshotStarted=performance.now();
     try{before=await call({action:'snapshot',name,contextHashes:contextHashes(),
-      ...(callerCertificate?{runCertificate:1}:{})},captureTimeout);}
+      ...(callerCertificate?{runCertificate:1}:{})},captureWait.timeout,captureWait.deadline);}
     catch(error){captureIssues.push('start observation unavailable'+
       (typeof error.code==='string'&&/^[A-Z0-9_]+$/.test(error.code)?` (${error.code})`:''));}
     timing('cli.start_checkpoint',startSnapshotStarted,{available:before?.snapshots?.[name]?1:0});
@@ -307,7 +322,7 @@ async function execute() {
       await new Promise(resolve=>setTimeout(resolve,100));
       const prelaunchStarted=performance.now();
       try{before=await call({action:'prelaunch',name,
-        contextHashes:contextHashes()},Math.min(captureTimeout,5000));}
+        contextHashes:contextHashes()},Math.min(captureWait.timeout,5000));}
       catch{before=null;captureIssues.push('prelaunch observation unavailable');}
       timing('cli.prelaunch_checkpoint',prelaunchStarted,
         {available:before?.snapshots?.[name]?1:0});
@@ -393,11 +408,12 @@ async function execute() {
     if(recordFile)try{fs.writeFileSync(recordFile,recordText,{mode:0o600});}catch{}
     const endSnapshotStarted=performance.now();
     if(!unobservedDirectRun){
+      // The start checkpoint's probe may have raised the deadline.
+      const endWait=decisionWait(process.env.VSTATE_CAPTURE_TIMEOUT_MS);
       try{after=await call({action:'snapshot',name,contextHashes:contextHashes(),
         ...(testRun&&Number.isSafeInteger(snap?.inputEventSerial)?{sinceSerial:snap.inputEventSerial}:{}),
         ...(recording?{runCertificate:1,adopt:recording}:recorded&&!certificate?{runCertificate:1,runFacts:1}:{})},
-        // The start checkpoint's probe may have raised the deadline.
-        Number(process.env.VSTATE_CAPTURE_TIMEOUT_MS||decisionDeadline()));}
+        endWait.timeout,endWait.deadline);}
       catch{captureIssues.push('end observation unavailable');}
       finally{if(recordFile)fs.rmSync(recordFile,{force:true});}
       timing('cli.end_checkpoint',endSnapshotStarted,{available:after?.snapshots?.[name]?1:0});
@@ -601,7 +617,7 @@ async function main(){
         observedNpmDigest:observedNpmContext(),proxyShapes});
     }
     let value;try{value=await decisionCall({action:'sync',contextHashes:contextHashes()},
-      Number(process.env.VSTATE_SYNC_TIMEOUT_MS||decisionDeadline()));
+      decisionWait(process.env.VSTATE_SYNC_TIMEOUT_MS));
       // A client upgrade can encounter an older running observer. Its successful
       // control response does not establish that it evaluated the latest receipt.
       if(value.receipt_revision===null){
@@ -615,7 +631,9 @@ async function main(){
       }}
     catch(e){value=unavailableCached(state,e.message,config.checks);process.exitCode=2;}
     timing('cli.synchronized_status',started,{available:value.observation?.healthy?1:0});
-    if(action==='sync')console.log(JSON.stringify(value));
+    // In the front's process (bin/redue.mjs), the value is handed back.
+    if(action==='sync'&&process.argv.includes('--value'))syncValue=value;
+    else if(action==='sync')console.log(JSON.stringify(value));
     else for(const row of value.checks)console.log(`${row.name}: ${row.freshness}/${row.result||'NO RESULT'} — ${row.reason}`);
     return;
   }
@@ -623,4 +641,5 @@ async function main(){
   if(action==='run'){await execute();return;}
   throw Error(`unknown action ${action}`);
 }
-main().catch(e=>{console.error(`redue: ${e.message}`);process.exitCode=2;});
+export let syncValue=null;
+export const finished=main().catch(e=>{console.error(`redue: ${e.message}`);process.exitCode=2;});

package/src/daemon.mjs

@@ -269,6 +269,7 @@ function probe(row,allowReuse=false,{launch=true}={}) {
         'typescript-plugin-unsupported':'TypeScript compiler plugin needs explicit review',
         'typescript-input-list-unavailable':'TypeScript input listing did not complete',
         'typescript-input-outside-repository':'TypeScript consumes files outside the observed repository',
+        'typescript-vite-cache-consumed':'TypeScript asks about node_modules/.vite or lists node_modules; Vitest rewrites files there and this recipe does not observe them',
         'npm-installation-layout-unsupported':'npm executable or installation layout is unsupported',
         'npm-installation-unobservable':'npm installation contains unobservable entries',
         'npm-configuration-unsupported':'npm script configuration needs review',

package/src/direct-run-certificate.mjs

@@ -7,7 +7,7 @@ import {createHash} from 'node:crypto';
 import {inflateSync} from 'node:zlib';
 import {fileURLToPath} from 'node:url';
 import {timing} from './decision-profile.mjs';
-import {directCompiler,directContextHash,directEnvironmentIssue,directProbeOutput,directProbeValue} from './direct-typescript.mjs';
+import {directCompiler,directContextHash,directEnvironmentIssue,directProbeOutput,directProbeValue,viteCacheQuestion} from './direct-typescript.mjs';
 import {withinPath} from './path-identity.mjs';
 const hash=value=>createHash('sha256').update(value).digest('hex');
 // Whether a direct run is recorded at all: on macOS and Linux, always, so its
@@ -158,6 +158,8 @@ export function runRecordIssue(record,certificate,runFacts=null) {
   if(kept.issue)return kept.issue;
   if(record.main!==compiler.entry||!Array.isArray(record.node)||
     directContextHash(compiler,record.node)!==certificate.context)return 'execution context changed';
+  const vite=viteCacheQuestion(compiler.root,kept.facts);
+  if(vite)return `the compiler asked about ${vite}, which Vitest rewrites and REDUE does not observe`;
   const inCompiler=withinCompiler(compiler);
   const facts=new Map();
   for(const query of queries){if(!facts.has(query[1]))facts.set(query[1],[]);facts.get(query[1]).push(query);}

package/src/direct-typescript-probe.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import {directProject,directInterpretation,directContextHash,directProbeOutput} from './direct-typescript.mjs';
+import {directProject,directInterpretation,directContextHash,directProbeOutput,viteCacheQuestion} from './direct-typescript.mjs';
 import {typeScriptInputFacts} from './typescript-input-facts.mjs';
 import {contextOnly,probeResult} from './probe-result.mjs';
 import {realObservedPath} from './path-identity.mjs';
@@ -18,6 +18,9 @@ try{
   const contextHash=directContextHash(compiler,context.node);
   if(!contextOnly(contextHash)){
     const {queries,configs,files,buildInfo}=typeScriptInputFacts(root,compiler.tsRoot,compiler.entry,compiler.config);
+    // Captured questions include every config and program file read.
+    if(viteCacheQuestion(root,queries||[...configs,...files].map(([file])=>['readFile',file])))
+      throw Object.assign(Error('typescript-vite-cache-consumed'),{code:'typescript-vite-cache-consumed'});
     const layout={root,script,configs,files,context,...(buildInfo?{buildInfo}:{})};
     probeResult(directProbeOutput(layout),contextHash,queries,layout);
   }

package/src/direct-typescript.mjs

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {createRequire} from 'node:module';
-import {racyUntil,realObservedPath,withinPath} from './path-identity.mjs';
+import {normalizedPath,racyUntil,realObservedPath,withinPath} from './path-identity.mjs';
 import {cachedTarball,lockedPackage,matchTarball,npmCacheDir,registryPackage,tarballFiles} from './npm-integrity.mjs';
 import {runConfig,tscRun} from './typescript-invocation.mjs';
 export const directInterpretation='npm-direct-typescript@1';
@@ -79,7 +79,7 @@ export function directCompiler(root,{verify=true}={}){
     for(const [name,file] of files.sort(([a],[b])=>a<b?-1:a>b?1:0))digest.update(name+'\0'+hash(fs.readFileSync(file))+'\0');
     if(digest.digest('hex')!==spec.digest)fail('direct-typescript-implementation-unreviewed');
   }
-  return {tsRoot,version,entry:path.join(tsRoot,spec.entry),digest:spec.digest};
+  return {root,tsRoot,version,entry:path.join(tsRoot,spec.entry),digest:spec.digest};
 }
 // A TypeScript 5.x or 6.0 the lockfile records: the installed package must be
 // the registry's `typescript` at that version, holding exactly the files of
@@ -115,7 +115,7 @@ function lockedCompiler(root,tsRoot,version,verify){
     }
   }
   const entry=fs.existsSync(path.join(tsRoot,'lib','_tsc.js'))?'lib/_tsc.js':'lib/tsc.js';
-  return {tsRoot,version,entry:path.join(tsRoot,entry),digest:hash('npm-integrity\0'+locked.integrity)};
+  return {root,tsRoot,version,entry:path.join(tsRoot,entry),digest:hash('npm-integrity\0'+locked.integrity)};
 }
 // The direct probe's output: root, script, configuration and program files with
 // their byte digests, and the execution context. A recorded run rebuilds it from
@@ -162,6 +162,26 @@ export function directContextHash(compiler,node){
   return hash(JSON.stringify({interpretation:directInterpretation,compiler:compiler.digest,
     entry:compiler.entry,node}));
 }
+// Vitest writes its results under node_modules/.vite/vitest at every run. The
+// recipe does not observe them. A compiler that asks about anything under
+// node_modules/.vite, is told a path there (realpath), or lists node_modules,
+// could see them, so its result is UNVERIFIED.
+export const directInstalledInputs=Object.freeze(['node_modules/**','!node_modules/.vite/vitest/**']);
+const listings=new Set(['readdir','listing','directories','entries','readDirectory']);
+// The first path of [kind, file, answer] questions that does, or null. Kinds
+// are a recorded run's (readdir) or a probe's. Compared without case: a
+// case-insensitive mount reaches .vite under any spelling.
+export function viteCacheQuestion(root,questions){
+  const fold=value=>normalizedPath(value).toLowerCase();
+  const modules=fold(path.join(root,'node_modules')),cache=path.join(modules,'.vite');
+  for(const [kind,file,answer] of questions){
+    if(typeof file!=='string')continue;
+    const at=fold(file);
+    if(withinPath(at,cache)||at===modules&&listings.has(kind))return file;
+    if(kind==='realpath'&&typeof answer==='string'&&withinPath(fold(answer),cache))return answer;
+  }
+  return null;
+}
 // The compiler for one check run {script, part, args}: script null for a
 // check init proposed without one. The run must pass --noEmit and name a
 // config inside the root.

package/src/pnpm-inputs.mjs

@@ -8,7 +8,6 @@ import path from 'node:path';
 import {createRequire} from 'node:module';
 import {execFileSync,spawnSync} from 'node:child_process';
 import micromatch,{patternMatcher} from './glob.mjs';
-import YAML from 'yaml';
 import {resolveLinks} from './installed-inputs.mjs';
 import {withinPath as within,realObservedPath,samePath} from './path-identity.mjs';
 import {timing} from './decision-profile.mjs';
@@ -18,7 +17,11 @@ import {runConfig,tscRun,tscRuns} from './typescript-invocation.mjs';
 const rel=(root,file)=>path.relative(root,file).split(path.sep).join('/');
 const read=file=>JSON.parse(fs.readFileSync(file,'utf8'));
 const exists=file=>{try{fs.lstatSync(file);return true;}catch{return false;}};
+// Loaded on first use: the parser takes about 40 ms to load, and every
+// command imports this module.
+let YAML=null;
 export function yaml(file){
+  YAML??=createRequire(import.meta.url)('yaml');
   const doc=YAML.parseDocument(fs.readFileSync(file,'utf8'),{uniqueKeys:true});
   if(doc.errors.length)throw Error(`${path.basename(file)} cannot be interpreted safely`);
   return doc.toJS()||{};