@redue/cli 0.1.0-alpha.25 → 0.1.0-alpha.26

package/src/cli.mjs

@@ -7,7 +7,9 @@ import {queryAnswer,runFactChange} from './typescript-list.mjs';
 import {patternMatcher} from './glob.mjs';
 import {observedBy} from './installed-observation.mjs';
 import {changedFiles,coverageReadable,gitIgnored,recordedEnvironment,testEnvironmentIssue,testGuardConfig,testRunGuard,testRunFacts,sharedInstalledFile,testsInterpretation,testsQualification} from './test-direct.mjs';
-import {childProgram,lookup,pnpmConfigFiles,scriptCaches,scriptInstalledPaths,scriptInterpretation,scriptQualification,scriptRunFacts,pnpmNameless,toolOutput,toolchainDirs} from './node-script.mjs';
+import {childProgram,generalIssue,lookup,pnpmConfigFiles,scriptCaches,scriptInstalledPaths,scriptInterpretation,scriptQualification,scriptRunFacts,pnpmNameless,toolOutput,toolchainDirs} from './node-script.mjs';
+import {denialLine,endWithChild,runToEnd,sandboxArgv,sandboxContext,sandboxDirs,sandboxEnv,sandboxInterpretation,sandboxPlaces,
+  sandboxQualification,sandboxSupport,systemPlaces} from './sandbox.mjs';
 import path from 'node:path';
 import net from 'node:net';
 import os from 'node:os';
@@ -83,7 +85,8 @@ function environmentReads() {
   try{const value=JSON.parse(fs.readFileSync(readsFile,'utf8'));return value?.schema===1&&value.checks||{};}catch{return {};}
 }
 const recordedRecipes=[testsQualification,scriptQualification];
-function contextHashes() {const reads=config.checks.some(check=>recordedRecipes.includes(check.qualification))?environmentReads():{};
+// A sandboxed check's run is recorded where its sandbox cannot start (execute).
+function contextHashes() {const reads=config.checks.some(check=>[...recordedRecipes,sandboxQualification].includes(check.qualification))?environmentReads():{};
   return Object.fromEntries(config.checks.map(check=>[
   check.name,Object.fromEntries([...(check.environment?.variables||[])
     .map(key=>[key,digest(process.env[key]??'<unset>')]),
@@ -95,6 +98,8 @@ function contextHashes() {const reads=config.checks.some(check=>recordedRecipes.
     ...(check.environment?.pathExecutables||[]).map(name=>[
       `__vstate_path_executable_${name}__`,pathExecutableIdentity(name)]),
     ...(check.environment?.executableIdentity?[['__vstate_node_identity__',nodeIdentity()]]:[]),
+    // A sandboxed run's environment, toolchain and places (sandbox.mjs).
+    ...(check.qualification===sandboxQualification?Object.entries(sandboxContext(check,process.env,root)):[]),
     // The variables the last test run read directly, compared here: which
     // list was compared, and the first variable whose value now differs.
     // Control requests are small, so the values stay out of them.
@@ -211,10 +216,11 @@ async function execute() {
   const lockStarted=performance.now(),runLock=acquireRunLock(state);
   timing('cli.run_lock',lockStarted);
   const captureIssues=[];
-  let activeChild=null,requestedSignal=null,treeStop=null,preserveRunLock=false;
+  let activeChild=null,requestedSignal=null,treeStop=null,preserveRunLock=false,ownGroup=false;
   const forward=signal=>{requestedSignal=signal;
     if(activeChild&&activeChild.exitCode===null){
-      if(process.platform==='linux'&&activeChild.pid){
+      // A Linux run, and a sandboxed one on macOS, has its own process group.
+      if((process.platform==='linux'||ownGroup)&&activeChild.pid){
         try{process.kill(-activeChild.pid,signal);}
         catch(e){if(e.code!=='ESRCH')throw e;}
       }else if(process.platform==='win32'&&activeChild.pid){
@@ -290,10 +296,15 @@ async function execute() {
     const recorded=directRunRecordable(selected)&&!unobservedDirectRun;
     const launched=recorded?[command[0],'--require',path.join(here,'run-recorder.cjs'),
       ...command.slice(1)]:command;
+    // A sandboxed check runs inside the OS sandbox. Where the sandbox cannot
+    // start, a script the general recipe takes is recorded as that recipe
+    // records it (`fallback`); any other runs as it is, and is not reused.
+    const sandboxed=selected.qualification===sandboxQualification,support=sandboxed?sandboxSupport():null;
+    const fallback=Boolean(support?.issue&&typeof selected.script==='string'&&!generalIssue(root,selected.script));
     // A test run's processes record what the guard checks (test-recorder.cjs),
     // and so do a general recipe run's, through the package manager.
-    const general=selected.qualification===scriptQualification;
-    const testRun=recordedRecipes.includes(selected.qualification)&&['darwin','linux'].includes(process.platform);
+    const general=selected.qualification===scriptQualification||fallback;
+    const testRun=(recordedRecipes.includes(selected.qualification)||fallback)&&['darwin','linux'].includes(process.platform);
     let testRecord=null,launchEnv=process.env,testFacts={},toolchain=[];
     if(testRun){
       // The package directory and installed node_modules, as the plan has them.
@@ -313,6 +324,27 @@ async function execute() {
       // npm's and pnpm's update checks read state outside the checkout and the network.
       if(general)launchEnv.npm_config_update_notifier='false';
     }
+    // The sandboxed run, with the environment REDUE gives it.
+    let sandbox=null;
+    if(sandboxed&&!fallback){
+      if(support.issue)captureIssues.push(`the run was not sandboxed: ${support.issue}`);
+      else{
+        const dirs=sandboxDirs(state,name);
+        const reads=[root,dirs.home,dirs.tmp,...sandboxPlaces(selected,process.env,root),...systemPlaces];
+        sandbox={mode:support.mode,dirs,argv:sandboxArgv(support.mode,command,{reads,tmp:dirs.tmp,python:support.python}),
+          env:sandboxEnv(selected,process.env,{root,...dirs})};
+      }
+    }
+    const plainEnv={...process.env,...selected.script?{npm_config_update_notifier:'false'}:{}};
+    // Output kept, and its own process group, for a run as this recipe makes it.
+    const own=sandboxed&&!fallback;
+    ownGroup=own&&process.platform!=='win32';
+    // A sandboxed run's output is passed through and its start and end kept,
+    // to tell a refusal by the sandbox from a real failure.
+    const output={head:'',tail:''};
+    const keep=chunk=>{const text=chunk.toString('utf8');
+      if(output.head.length<65536)output.head+=text.slice(0,65536-output.head.length);
+      output.tail=(output.tail+text).slice(-65536);};
     let runnerPid=null;
     const record=[];
     // A Windows full reconciliation may finish while queued watcher callbacks
@@ -335,11 +367,19 @@ async function execute() {
       if(requestedSignal){resolve({status:'interrupted',exitCode:null,signal:requestedSignal});return;}
       let child,spawnError=null;
       try{runLock.phase('launching');
-        const launch=windowsLaunch(launched);
+        const launch=windowsLaunch(sandbox?.argv??launched);
         child=spawn(launch.file,launch.args,{cwd:plan.cwd,
-        stdio:recorded?['inherit','inherit','inherit','pipe']:'inherit',env:launchEnv,
-        detached:process.platform==='linux',...launch.options});
-        child.stdio[3]?.on('data',chunk=>record.push(chunk));}
+        // A sandboxed run's own group gets no terminal input, which would stop it.
+        stdio:recorded?['inherit','inherit','inherit','pipe']:own?['ignore','pipe','pipe']:'inherit',
+        env:sandbox?.env??(own?plainEnv:launchEnv),
+        detached:process.platform==='linux'||ownGroup,...launch.options});
+        child.stdio[3]?.on('data',chunk=>record.push(chunk));
+        if(own){child.stdout.on('data',chunk=>{process.stdout.write(chunk);keep(chunk);});
+          child.stderr.on('data',chunk=>{process.stderr.write(chunk);keep(chunk);});
+          // What the check left running is stopped when it exits, as a CI
+          // job's end does (on Linux the launcher also stops daemons that
+          // left the group), and the run ends a second after its exit.
+          endWithChild(child);}}
       catch(e){resolve({status:'start_failed',exitCode:null,signal:null,errorCode:e.code||e.name});return;}
       activeChild=child;runnerPid=child.pid??null;runLock.phase('running',child.pid??null);
       mark('cli.child_started',{childPid:child.pid});
@@ -347,7 +387,7 @@ async function execute() {
       child.on('error',e=>{spawnError=e.code||e.name;});
       child.on('close',async(exit,signal)=>{
         if(treeStop)await treeStop;
-        if(process.platform==='linux'&&requestedSignal&&child.pid){
+        if((process.platform==='linux'||ownGroup)&&requestedSignal&&child.pid){
           // A verification command may have forked children in its process
           // group. Normal cancellation must reach them even if the leader has
           // already exited. Commands that daemonize into a new session remain
@@ -369,7 +409,7 @@ async function execute() {
     invocation.argc=command.length;
     invocation.runId=runId;
     invocation.reporting='normal';
-    const result=invocation.status==='exited'?(invocation.exitCode===0?'PASS':'FAIL'):null;
+    let result=invocation.status==='exited'?(invocation.exitCode===0?'PASS':'FAIL'):null;
     const target={source:'direct-command',status:invocation.status==='exited'?'direct_executed':'unknown'};
     const afterContextStarted=performance.now(),environmentAfter=contextHashes()[name];
     timing('cli.context_after',afterContextStarted);
@@ -411,7 +451,7 @@ async function execute() {
       // The start checkpoint's probe may have raised the deadline.
       const endWait=decisionWait(process.env.VSTATE_CAPTURE_TIMEOUT_MS);
       try{after=await call({action:'snapshot',name,contextHashes:contextHashes(),
-        ...(testRun&&Number.isSafeInteger(snap?.inputEventSerial)?{sinceSerial:snap.inputEventSerial}:{}),
+        ...((testRun||sandboxed)&&Number.isSafeInteger(snap?.inputEventSerial)?{sinceSerial:snap.inputEventSerial}:{}),
         ...(recording?{runCertificate:1,adopt:recording}:recorded&&!certificate?{runCertificate:1,runFacts:1}:{})},
         endWait.timeout,endWait.deadline);}
       catch{captureIssues.push('end observation unavailable');}
@@ -476,12 +516,40 @@ async function execute() {
     // A recorded certificate changes only the probe part of the fingerprint.
     if(!outputs&&(!snap||!end||snap.planId!==end.planId||(recording?snap.inputKey!==end.inputKey:snap.fingerprint!==end.fingerprint)||
       snap.revision!==end.revision))captureIssues.push('declared inputs changed or were not observed');
+    // A sandboxed run that failed with what looks like a refusal by the
+    // sandbox runs again outside it. When that run exits differently, the
+    // sandbox changed the result: the plain run's result is kept, not reused.
+    // An interrupt before or during it stops there: the run is interrupted.
+    let sandboxRerun=null;
+    if(sandbox&&result==='FAIL'&&!requestedSignal){
+      const line=denialLine(output.head+'\n'+output.tail);
+      if(line){
+        console.error(`redue: the sandboxed run failed with what looks like a refusal by the sandbox (${line}); running it again outside the sandbox`);
+        // Interrupting REDUE interrupts the rerun's group too (forward).
+        const plain=await runToEnd(command,{cwd:plan.cwd,env:plainEnv,echo:true,started:child=>{activeChild=child;}});
+        activeChild=null;
+        sandboxRerun={line,exitCode:plain.status,signal:plain.signal||null,...plain.error?{errorCode:plain.error.code||plain.error.name}:{}};
+        if(requestedSignal){
+          captureIssues.push('interrupted during the run outside the sandbox');
+          Object.assign(invocation,{status:'interrupted',exitCode:null,signal:requestedSignal});
+        }
+        // A rerun that did not start or finish tells nothing: the sandboxed result stands, not reused.
+        else if(plain.error||plain.status===null)
+          captureIssues.push(`the run outside the sandbox did not finish (${plain.error?.code||plain.signal}), so a refusal by the sandbox is not ruled out (${line})`);
+        else if(plain.status!==invocation.exitCode){
+          captureIssues.push(`the sandbox changed the result: exit ${invocation.exitCode} inside it, ${plain.status??plain.signal} outside it (${line})`);
+          invocation.sandboxedExitCode=invocation.exitCode;invocation.exitCode=plain.status;
+        }
+      }
+    }
+    if(sandbox)fs.rmSync(sandbox.dirs.tmp,{recursive:true,force:true});
     const stable=captureIssues.length===0;
     // Two runs on the same inputs, environment and plan that disagree make the
     // check nondeterministic until its inputs change.
     let nondeterministic=false;
     const declared=hashes=>Object.entries(hashes||{}).filter(([key])=>!key.startsWith('__redue_env_'));
-    if(testRun&&stable&&result){
+    if(sandboxRerun)result=invocation.status==='exited'?(invocation.exitCode===0?'PASS':'FAIL'):null;
+    if((testRun||sandboxed)&&stable&&result){
       const prior=readReceipts(state).checks[name];
       // A difference explained by inputs REDUE did not observe proves nothing.
       nondeterministic=Boolean(!guard?.issues.length&&prior?.stable&&!prior.guardIssues?.length&&prior.result&&prior.planId===(snap?.planId??plan.id)&&
@@ -494,7 +562,7 @@ async function execute() {
     // A recorded run's receipt carries its run facts, even none; observers that
     // predate run facts do not reuse version 2.
     // The recipe that made the receipt, which status and the hook name.
-    const receipt={result,invocation,target,stable,fingerprintVersion:recorded||testRun?2:1,recipe:selected.qualification||null,
+    const receipt={result,invocation,target,stable,fingerprintVersion:recorded||testRun?2:1,recipe:(fallback?scriptQualification:selected.qualification)||null,
       ...(recorded||testRun?{runFacts}:{}),
       ...(testRun?{verificationRecipe:general?scriptInterpretation:testsInterpretation,guardIssues:guard?.issues||['the run record is unavailable'],
         environmentReads:guard?.environmentReads||{},...(nondeterministic?{nondeterministic}:{})}:{}),
@@ -508,6 +576,8 @@ async function execute() {
       planId:snap?.planId??plan.id,fingerprint:(recording||outputs?end:snap)?.fingerprint??null,
       provider:plan.provider,environmentHashes:environmentBefore,
       ...(observedContext?{observedContext,verificationRecipe:directInterpretation}:{}),
+      ...(own?{verificationRecipe:sandboxInterpretation,sandbox:{mode:sandbox?.mode??null,...sandboxRerun?{rerun:sandboxRerun}:{}}}:{}),
+      ...(fallback?{sandbox:{mode:null,fallback:'node-script',issue:support.issue}}:{}),
       files:(outputs?end:snap)?.files??null,observerGeneration:before?.observation?.generation??null,
       startRevision:snap?.revision??null,endRevision:end?.revision??null};
     const persistenceStarted=performance.now();

package/src/daemon.mjs

@@ -25,6 +25,7 @@ import {npmCacheDir} from './npm-integrity.mjs';
 import {runFromArgv} from './typescript-invocation.mjs';
 import {buildInfoPath,recordedCertificate} from './direct-run-certificate.mjs';
 import {timing,mark,traceBase,traceContext,traceScope,traceEnvironment,traceId} from './decision-profile.mjs';
+import {sandboxChange} from './sandbox.mjs';
 
 const configFile=path.resolve(process.argv[2]);
 const config=JSON.parse(fs.readFileSync(configFile));
@@ -63,7 +64,9 @@ let identityChanged=false;
 let identityGapKey=null;
 let triggerHashes=new Map();
 let candidateDescendants=new Map();
-let workspacePatterns=(()=>{const w=JSON.parse(fs.readFileSync(path.join(root,'package.json'))).workspaces;
+// A Python project may have no package.json.
+let workspacePatterns=(()=>{let w;try{w=JSON.parse(fs.readFileSync(path.join(root,'package.json'))).workspaces;}
+  catch(e){if(e.code==='ENOENT')return [];throw e;}
   return Array.isArray(w)?w:w?.packages||[];})();
 let planningWorker=null;
 let validatedPlan=null;
@@ -396,13 +399,19 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
     if(r.target.status==='failed'&&result!=='FAIL'){
       item.reason='target failure conflicts with outer invocation outcome';return item;}
     if(!r.stable){const issues=r.checkpoint?.issues?.length?` (${r.checkpoint.issues.join('; ')})`:'';
-      item.reason=`inputs changed during execution or observation gap${issues}`;return item;}
+      // A sandboxed run that could not start, whose result the sandbox changed, or whose rerun outside it did not finish, says so alone.
+      const sandbox=r.checkpoint?.issues?.length&&r.checkpoint.issues.every(issue=>/^the (?:sandbox changed|run was not sandboxed|run outside the sandbox)/.test(issue));
+      item.reason=sandbox?r.checkpoint.issues.join('; '):`inputs changed during execution or observation gap${issues}`;return item;}
     const names=[...(row.plan.environment.variables||[]),
       ...(row.plan.environment.prefixes||[]).map(prefix=>
         `__vstate_env_prefix_${prefix.toLowerCase()}__`),
       ...(row.plan.environment.pathExecutables||[]).map(name=>
         `__vstate_path_executable_${name}__`),
       ...(row.plan.environment.executableIdentity?['__vstate_node_identity__']:[])];
+    // A sandboxed run's variables, toolchain, PATH directories and places
+    // (sandbox.mjs): every entry either side has, and the first change named.
+    const sandboxChanged=row.plan.qualification==='sandbox-v1'&&contextHashes?.[name]?
+      sandboxChange(r?.environmentHashes,contextHashes[name]):null;
     if(names.length&&!contextHashes?.[name])unconfirmed??='execution environment context not supplied';
     item.freshness='STALE';
     if(r.planId!==row.plan.id){
@@ -411,6 +420,7 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       item.reason=changed?`installed input link changed: ${changed.path}`:'input plan changed';
       if(changed)item.changed_inputs=[changed.path];
     }
+    else if(sandboxChanged)item.reason=sandboxChanged;
     else if(contextHashes?.[name]&&names.some(key=>contextHashes[name][key]!==r.environmentHashes?.[key]))
       item.reason='declared execution environment changed';
     // Every variable a test run read directly must have the same value. The
@@ -796,8 +806,8 @@ function markInputEvent(name,rel,type,replay) {
   if(!hasHistory||historyDisabled||replay){
     const serial=(inputEventSerial.get(name)||0)+1;
     inputEventSerial.set(name,serial);
-    // Kept only for recorded test and script checks; trimmed in batches.
-    if(['npm-tests-direct-v1','node-script-v1'].includes(index?.checks.get(name)?.plan.qualification)){
+    // Kept only for recorded test and script checks and sandboxed ones; trimmed in batches.
+    if(['npm-tests-direct-v1','node-script-v1','sandbox-v1'].includes(index?.checks.get(name)?.plan.qualification)){
       const list=inputEventPaths.get(name)||[];list.push([serial,rel]);
       if(list.length>2*eventPathLimit)list.splice(0,list.length-eventPathLimit);inputEventPaths.set(name,list);
     }

package/src/decision-validation.mjs

@@ -17,7 +17,8 @@ export function planGuard(bundle) {
     ...bundle.workspaceManifests||[],...bundle.configurationInputs||[],
     ...Object.values(bundle.plans).flatMap(plan=>plan.resolutionTriggers||[])]);
   const patterns=bundle.workspacePatterns?.length?bundle.workspacePatterns:
-    (()=>{const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json')));
+    (()=>{let pkg;try{pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json')));}
+      catch(e){if(e.code==='ENOENT')return [];throw e;}
       return Array.isArray(pkg.workspaces)?pkg.workspaces:pkg.workspaces?.packages||[];})();
   if(patterns.length){
     const files=execFileSync('git',['ls-files','--cached','--others','--exclude-standard',

package/src/declared-plan.mjs

@@ -8,6 +8,7 @@ import {qualifyTypeScript} from './typescript-qualification.mjs';
 import {directBuildInfo} from './direct-typescript.mjs';
 import {qualifyTests,testWorkspacePatterns,testsQualification} from './test-direct.mjs';
 import {qualifyNodeScript,scriptQualification} from './node-script.mjs';
+import {qualifySandbox,sandboxInstalledExclusions,sandboxQualification} from './sandbox.mjs';
 import {yarnWorkspaceTypecheckInputs} from './yarn-workspace-inputs.mjs';
 import {pnpmTypecheckInputs} from './pnpm-inputs.mjs';
 import {checkRun} from './typescript-invocation.mjs';
@@ -78,12 +79,17 @@ export function discoverDeclared(config) {
     if(selected.qualification==='npm-typescript-direct-v1')
       try{buildInfo=directBuildInfo(root,checkRun(selected));}catch{}
     const excluded=buildInfo?['!'+buildInfo]:[];
+    // A sandboxed check leaves out the .venv's links that lead out of the
+    // checkout; its qualification names them.
+    const sandboxed=selected.qualification===sandboxQualification;
+    if(sandboxed)excluded.push(...sandboxInstalledExclusions(root));
     const installedStarted=performance.now();
     const installed=resolveDeclaredInstalled(root,
       [...(selected.installedInputs||[]),...(workspace?.installed||[]),...excluded],allowedRoots);
     timing('plan.installed_resolution',installedStarted,{mappings:installed.mappings.length});
     const automatic=selected.qualification===testsQualification?qualifyTests(root,selected):
       selected.qualification===scriptQualification?qualifyNodeScript(root,selected):
+      sandboxed?qualifySandbox(root,selected):
       qualifyTypeScript(root,selected,{workspace,issue:workspaceIssue});
     const sourcePatterns=[...new Set([...selected.inputs,...(workspace?.source||[]),
       ...(workspace?.generated||[]),...excluded])].sort();
@@ -97,7 +103,8 @@ export function discoverDeclared(config) {
     // A workspace test check, and a general check in a workspace, is qualified
     // against the current package list: a package manifest appearing or pnpm's
     // package list changing re-plans.
-    if(selected.qualification===testsQualification&&selected.workspace||selected.qualification===scriptQualification)try{
+    if(selected.qualification===testsQualification&&selected.workspace||selected.qualification===scriptQualification||
+      sandboxed&&typeof selected.script==='string')try{
       for(const item of testWorkspacePatterns(root,JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'))))
         workspacePatterns.add(item);
       if(fs.existsSync(path.join(root,'pnpm-workspace.yaml')))configurationInputs.add('pnpm-workspace.yaml');
@@ -136,6 +143,8 @@ export function discoverDeclared(config) {
       probes:selected.probes||[],environment:selected.environment||{},
       qualification:selected.qualification||null,
       ...(buildInfo?{buildInfo}:{}),
+      // A sandboxed run's reads are not recorded: git-ignored files are inputs too.
+      ...(sandboxed?{ignoredInputs:true}:{}),
       executionProvenance:'declared-command',
       unresolved:[...new Set(unresolved)].sort()};
     plan.resolutionCandidates=workspace?.resolutionCandidates||[];

package/src/index.mjs

@@ -11,6 +11,11 @@ const tracked = root => [...new Set(execFileSync('git',
   ['ls-files','--cached','--others','--exclude-standard','-z'],
   {cwd:root,env:{...process.env,GIT_OPTIONAL_LOCKS:'0'},maxBuffer:64*1024*1024})
   .toString().split('\0').filter(Boolean))];
+// Git-ignored paths at the top of each ignored tree: a directory ends in '/'.
+const ignored = root => [...new Set(execFileSync('git',
+  ['ls-files','--others','--ignored','--exclude-standard','--directory','-z'],
+  {cwd:root,env:{...process.env,GIT_OPTIONAL_LOCKS:'0'},maxBuffer:64*1024*1024})
+  .toString().split('\0').filter(Boolean))];
 const xor = (left,right) => { for(let i=0;i<32;i++) left[i]^=right[i]; };
 const token = (file,hash) => createHash('sha256').update(file+'\0'+hash).digest();
 const stablePrefix = glob => {
@@ -178,12 +183,13 @@ export class InputIndex {
   }
   summary(name) { const row=this.checks.get(name); return {fingerprint:this.fingerprint(name),
     revision:row.revision,planId:row.plan.id,files:row.files.size,probeAt:row.probeAt}; }
-  record(rel, changeReason=rel+' changed', observedStat=null) {
+  // `only`, when given, limits which checks may take the file.
+  record(rel, changeReason=rel+' changed', observedStat=null, only=null) {
     if(!validInputRelative(rel)) {
       this.unavailable='invalid event path'; return false;
     }
     const names=this.candidates(rel), old=this.files.get(rel), matched=[];
-    for(const name of names) if(this.matches(this.checks.get(name),rel)) matched.push(name);
+    for(const name of names) if((!only||only(name))&&this.matches(this.checks.get(name),rel)) matched.push(name);
     if(!matched.length && old===undefined) return false;
     let fresh,stat,inspection;
     try{stat=observedStat||fs.lstatSync(path.join(this.root,rel),{bigint:true});}
@@ -198,7 +204,7 @@ export class InputIndex {
         // (its package.json stands for them).
         // The second form is for recorded checks only: their recorder
         // classifies a read through the link where it leads.
-        const recorded=name=>['node-script-v1','npm-tests-direct-v1'].includes(this.checks.get(name).plan.qualification);
+        const recorded=name=>['node-script-v1','npm-tests-direct-v1','sandbox-v1'].includes(this.checks.get(name).plan.qualification);
         const observedDir=installed?physical=>!this.includeInstalled&&
           ([...this.installedRootSet].some(root=>physical.startsWith(root+'/'))||
             !physical.split('/').includes('node_modules')&&!this.installedPath(physical+'/package.json')&&matched.every(recorded))&&
@@ -267,6 +273,10 @@ export class InputIndex {
     this.unavailable=null;
     const trackedStarted=performance.now();
     const names=new Set(this.trackGit?tracked(this.root):[]);
+    // A sandboxed check's reads are not recorded, so git-ignored files are its
+    // inputs too: every ignored file its patterns take, outside the scan roots
+    // (installed trees) and the directories no pattern can take a file from.
+    const ignoredTrees=this.trackGit&&[...this.checks.values()].some(row=>row.plan.ignoredInputs)?ignored(this.root):[];
     this.profile.trackedMs+=performance.now()-trackedStarted;
     const enumerationStarted=performance.now();
     // Traverse declared input roots to include ignored/generated inputs. Avoid unrelated
@@ -310,6 +320,29 @@ export class InputIndex {
       }
       visit(base,prefix);
     }
+    // Only the checks that take ignored files get them here, as before for the others.
+    const ignoring=name=>this.checks.get(name).plan.ignoredInputs===true;
+    const takes=rel=>[...this.checks.values()].some(row=>row.plan.ignoredInputs&&this.matches(row,rel));
+    // A node_modules that is not installed input is skipped, as above. An
+    // ignored link is taken when it leads to a file in the checkout; a link
+    // to a directory or out of the checkout is not a file input.
+    const linkToFile=rel=>{try{const target=fs.realpathSync(path.join(this.root,rel));
+      return fs.statSync(target).isFile()&&target.startsWith(fs.realpathSync(this.root)+path.sep);}catch{return false;}};
+    const visitIgnored=rel=>{
+      const base=path.posix.basename(rel);
+      if(this.prefixes.has(rel)||this.installedPath(rel)&&!this.installedAncestors.has(rel)||base==='.git'||
+        base==='node_modules'&&!this.installedPath(rel))return;
+      let st;try{st=fs.lstatSync(path.join(this.root,rel),{bigint:true});}
+      catch(e){if(e.code==='ENOENT')return;throw e;}
+      this.profile.enumeratedEntries++;
+      if(st.isSymbolicLink()&&!linkToFile(rel))return;
+      if(st.isDirectory()){
+        if(!takes(rel+'/.redue-probe'))return;
+        for(const ent of fs.readdirSync(path.join(this.root,rel),{withFileTypes:true}))visitIgnored(rel+'/'+ent.name);
+      }else if(this.candidates(rel).size){
+        const started=performance.now();this.record(rel,'cold reconciliation',st,ignoring);processingMs+=performance.now()-started;scanned++;}
+    };
+    for(const entry of ignoredTrees)visitIgnored(entry.replace(/\/$/,''));
     this.profile.enumerationMs+=performance.now()-enumerationStarted-processingMs;
     const recordStarted=performance.now();
     for(const rel of names) {

package/src/landlock.py

@@ -0,0 +1,183 @@
+#!/usr/bin/env python3
+# The sandboxed recipe's Linux launcher (src/sandbox.mjs): runs a command
+# under a Landlock ruleset (Linux >= 5.13), with the standard library only.
+# Reads and executes are allowed beneath the --read paths; with --no-tcp
+# (ABI >= 4), every TCP bind and connect is refused, and (ABI >= 6) so is a
+# connection to an abstract Unix socket outside the run. Writes are not
+# handled, so they are not restricted.
+#
+# The launcher stays as the command's parent and a child subreaper: when the
+# command exits, it stops every process the command left running, daemons
+# that started their own session included (they are reparented to it), as a
+# CI job's end does. The command runs in its own process group; a signal the
+# launcher gets is passed to that group once. The launcher then ends as the
+# command did: with its exit status, or by its signal.
+#
+#   landlock.py --read /usr --read /tmp ... [--no-tcp] -- cmd args...
+#   landlock.py --probe     # prints {"abi": N} or {"abi": null, "errno": E}
+import ctypes
+import json
+import os
+import signal
+import sys
+import time
+
+SYS_CREATE, SYS_ADD, SYS_RESTRICT = 444, 445, 446  # the same on x86_64 and aarch64
+EXECUTE, READ_FILE, READ_DIR = 1 << 0, 1 << 2, 1 << 3
+BIND_TCP, CONNECT_TCP = 1 << 0, 1 << 1
+SCOPE_ABSTRACT_UNIX_SOCKET = 1 << 0
+PR_SET_NO_NEW_PRIVS, PR_SET_CHILD_SUBREAPER = 38, 36
+
+libc = ctypes.CDLL(None, use_errno=True)
+libc.syscall.restype = ctypes.c_long
+
+
+class RulesetAttr(ctypes.Structure):
+    _fields_ = [('fs', ctypes.c_uint64), ('net', ctypes.c_uint64), ('scoped', ctypes.c_uint64)]
+
+
+class PathBeneath(ctypes.Structure):
+    # Packed, as the kernel's struct is: 12 bytes. Python 3.14 asks for the layout.
+    _layout_ = 'ms'
+    _pack_ = 1
+    _fields_ = [('allowed', ctypes.c_uint64), ('fd', ctypes.c_int32)]
+
+
+def abi():
+    v = libc.syscall(SYS_CREATE, None, ctypes.c_size_t(0), ctypes.c_uint32(1))
+    return (v, 0) if v >= 0 else (None, ctypes.get_errno())
+
+
+def main(argv):
+    if argv == ['--probe']:
+        v, err = abi()
+        print(json.dumps({'abi': v, 'errno': err}))
+        return 0
+    reads, no_tcp = [], False
+    while argv and argv[0] != '--':
+        if argv[0] == '--read':
+            reads.append(argv[1]); argv = argv[2:]
+        elif argv[0] == '--no-tcp':
+            no_tcp = True; argv = argv[1:]
+        else:
+            sys.exit(f'landlock.py: unknown option {argv[0]}')
+    cmd = argv[1:]
+    version, err = abi()
+    if version is None:
+        sys.exit(f'landlock.py: Landlock unavailable (errno {err})')
+    handled = EXECUTE | READ_FILE | READ_DIR
+    attr = RulesetAttr(handled, (BIND_TCP | CONNECT_TCP) if no_tcp and version >= 4 else 0,
+                       SCOPE_ABSTRACT_UNIX_SOCKET if no_tcp and version >= 6 else 0)
+    size = 24 if attr.scoped else 16 if attr.net else 8
+    ruleset = libc.syscall(SYS_CREATE, ctypes.byref(attr), ctypes.c_size_t(size), ctypes.c_uint32(0))
+    if ruleset < 0:
+        sys.exit(f'landlock.py: create_ruleset errno {ctypes.get_errno()}')
+    for place in reads:
+        try:
+            fd = os.open(place, os.O_PATH | os.O_CLOEXEC)
+        except OSError:
+            continue
+        # A file takes file rights only.
+        rights = handled if os.path.isdir(place) else EXECUTE | READ_FILE
+        rule = PathBeneath(rights, fd)
+        if libc.syscall(SYS_ADD, ctypes.c_int(ruleset), ctypes.c_int(1), ctypes.byref(rule), ctypes.c_uint32(0)) < 0:
+            sys.exit(f'landlock.py: add_rule {place} errno {ctypes.get_errno()}')
+        os.close(fd)
+    if libc.prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0:
+        sys.exit(f'landlock.py: no_new_privs errno {ctypes.get_errno()}')
+    if libc.syscall(SYS_RESTRICT, ctypes.c_int(ruleset), ctypes.c_uint32(0)) < 0:
+        sys.exit(f'landlock.py: restrict_self errno {ctypes.get_errno()}')
+    os.close(ruleset)
+    libc.prctl(PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0)
+    pid = os.fork()
+    if pid == 0:
+        os.setpgid(0, 0)
+        try:
+            os.execvp(cmd[0], cmd)
+        except OSError as e:
+            sys.stderr.write(f'landlock.py: exec {cmd[0]}: {e}\n')
+        os._exit(127)
+    # Also here, so a signal that comes before the child runs finds its group.
+    try:
+        os.setpgid(pid, pid)
+    except OSError:
+        pass
+    def forward(number, frame):
+        try:
+            os.killpg(pid, number)
+        except (ProcessLookupError, PermissionError):
+            pass
+    for number in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP):
+        signal.signal(number, forward)
+    _, status = os.waitpid(pid, 0)
+    stop_left()
+    code = os.waitstatus_to_exitcode(status)
+    if code >= 0:
+        return code
+    # Killed by a signal: end the same way, so the caller sees the signal.
+    try:
+        signal.signal(-code, signal.SIG_DFL)
+    except (OSError, ValueError):
+        pass
+    os.kill(os.getpid(), -code)
+    return 128 - code
+
+
+def children(me):
+    # The kernel's list of this process's children, where it keeps one.
+    try:
+        found = set()
+        for task in os.listdir('/proc/self/task'):
+            with open(f'/proc/self/task/{task}/children') as f:
+                found.update(int(pid) for pid in f.read().split())
+        return list(found)
+    except OSError:
+        pass
+    # Else every process's parent. The fields after the command name, which
+    # may hold spaces or parentheses.
+    found = []
+    for entry in os.listdir('/proc'):
+        if not entry.isdigit():
+            continue
+        try:
+            with open(f'/proc/{entry}/stat') as f:
+                stat = f.read()
+        except OSError:
+            continue
+        if int(stat[stat.rindex(')') + 2:].split()[1]) == me:
+            found.append(int(entry))
+    return found
+
+
+# Every process left under the launcher: SIGTERM, then SIGKILL after a second.
+# A process's own children are reparented here when it ends, so this repeats
+# until none is left, for at most three seconds: a process in uninterruptible
+# sleep is named and left.
+def stop_left():
+    me, start, number = os.getpid(), time.monotonic(), signal.SIGTERM
+    while True:
+        while True:
+            try:
+                done, _ = os.waitpid(-1, os.WNOHANG)
+            except ChildProcessError:
+                done = 0
+            if done == 0:
+                break
+        left = children(me)
+        if not left:
+            return
+        if time.monotonic() > start + 3:
+            sys.stderr.write(f'landlock.py: processes {left} did not stop\n')
+            return
+        if time.monotonic() > start + 1:
+            number = signal.SIGKILL
+        for pid in left:
+            try:
+                os.kill(pid, number)
+            except ProcessLookupError:
+                pass
+        time.sleep(0.05)
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))