@redue/cli 0.1.0-alpha.26 → 0.1.0-alpha.27

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 0.1.0-alpha.27 — 2026-11-01
+
+A build or test run no longer makes a sandboxed typecheck or lint STALE,
+and `redue stats` shows what REDUE saved you.
+
+- **Files git ignores are hidden from sandboxed runs.** A sandboxed
+  typecheck or lint now runs without the files git ignores (`dist/`,
+  `.next/`, coverage files, `.env`), except `node_modules`, `.venv` and
+  runner caches. Those files are not its inputs, so a build or test run that
+  writes them leaves the result CURRENT. The claim: the result holds for a
+  run that sees only the project's files that git doesn't ignore, its
+  installed packages and the toolchain. Only the project's `.gitignore`
+  files and `.git/info/exclude` count, not your global excludes file.
+- **Checks that need ignored files keep working.** `init` tries the
+  sandbox with ignored files hidden first (`sandbox-v2`), then with the
+  whole checkout (`sandbox-v1`), then the general recipe. A hidden run that
+  fails on a hidden file runs again in the sandbox without hiding, and that
+  result is kept. Checks set up by alpha.26 stay `sandbox-v1` until you run
+  `redue init` again.
+- **Measured.** In the product census, after each project's own build and
+  tests ran, checks that stayed CURRENT (alpha.26 in brackets, from the
+  measurement census): TypeScript on Linux 31 of 37 (5 of 43), on macOS 24
+  of 34 (5 of 38); Python on Linux 31 of 38 (24 of 37), on macOS 28 of 34
+  (20 of 33). Where a check qualifies with both, the sandbox stayed CURRENT
+  16 times and the general recipe 9 of 23 (Linux). The strace cross-check
+  found no read outside the recorded inputs.
+- **`redue stats`.** Per check: reruns the hook skipped, the time that
+  saved, recorded runs, and the top reasons a check was UNVERIFIED, from a
+  log in REDUE's local state.
+- `redue remove-state` no longer fails on Windows while the observer is
+  still closing its files.
+- Known limits: a sandboxed run can still see that a hidden file exists
+  (its name on macOS; listings, sizes and times on Linux), so a tool that
+  acts on existence alone is not covered; tests do not use hidden files for
+  that reason. On Linux, a file a run creates in a folder that holds hidden
+  files cannot be read back in the same run.
+- Contributors: eval entry points that run third-party code refuse to start
+  unless `GITHUB_ACTIONS=true`, and importing any eval entry point throws
+  before it does anything.
+
 ## 0.1.0-alpha.26 — 2026-10-31
 
 Typecheck and lint checks run inside an OS sandbox, so REDUE can reuse them

package/README.md

@@ -59,25 +59,32 @@ what the agent asks. Plain `redue status` is a fast cached answer and can say
 UNVERIFIED ("cannot confirm your execution context") where `--sync` would say
 CURRENT.
 
+`redue stats` shows, per check, the reruns the hook skipped, the time saved,
+the recorded runs and the top reasons a check was UNVERIFIED, from a log kept
+on your machine.
+
 To undo everything setup did: `redue remove`.
 
 ## What it covers today
 
-In a census of 120 active public TypeScript repositories (October 2026, REDUE
-at commit 046cd0e, before 0.1.0-alpha.26), each installed as its users would,
-with dependencies' install scripts on, 86 installed cleanly on a macOS runner.
+In a census of 120 active public TypeScript repositories (November 2026, REDUE
+at commit e264a67, before 0.1.0-alpha.27), each installed as its users would,
+with dependencies' install scripts on, 90 installed cleanly on a macOS runner.
 A check counts when two recorded runs on the same code both came out CURRENT
 on the same inputs. 35 repositories had at least one such check:
 
 | Check | Repositories | How |
 |---|---|---|
-| Typecheck | 22 | 15 by running the project's script in an OS sandbox ([sandboxed recipe](docs/user/sandbox.md)); 5 by running the local `tsc` directly ([direct recipe](docs/user/direct-typescript.md)); 2 by running the script with every Node process recorded ([general recipe](docs/user/node-script.md)) |
-| Lint | 25 | 21 sandboxed recipe, 4 general recipe |
+| Typecheck | 22 | 16 by running the project's script in an OS sandbox ([sandboxed recipe](docs/user/sandbox.md)), 15 of them with the files git ignores hidden; 5 by running the local `tsc` directly ([direct recipe](docs/user/direct-typescript.md)); 1 by running the script with every Node process recorded ([general recipe](docs/user/node-script.md)) |
+| Lint | 24 | 21 sandboxed recipe (19 with ignored files hidden), 3 general recipe |
 | Tests | 2 | Vitest run directly ([direct test recipe](docs/user/tests-direct.md)) |
 
-In a census of 120 Python repositories, 75 installed on a Linux runner
+In a census of 120 Python repositories, 74 installed on a Linux runner
 and 23 had a qualifying check: typecheck (mypy, pyright, ty) 15, lint (ruff)
-22, all through the sandboxed recipe. On Linux, every sandboxed run was traced
+22, all through the sandboxed recipe with ignored files hidden. A check whose
+git-ignored files are hidden stays CURRENT when a build or test run rewrites
+them: after each project's build and tests ran, 31 of 37 such TypeScript
+checks and 31 of 38 Python checks were still CURRENT on Linux. On Linux, every sandboxed run was traced
 with strace: each file it read in the checkout was a recorded input, a cache
 or its own output.
 

package/bin/redue.mjs

@@ -7,7 +7,7 @@ import {directCompiler,directQualification,directEnvironment,directInstalledInpu
 import {runArgv,tscRun} from '../src/typescript-invocation.mjs';
 import {testEnvironment,testRunnerAt,testsInterpretation,testsQualification} from '../src/test-direct.mjs';
 import {scriptEnvironment,scriptInterpretation,scriptKinds,scriptQualification} from '../src/node-script.mjs';
-import {pythonTool,sandboxEnvironment,sandboxInterpretation,sandboxKinds,sandboxQualification} from '../src/sandbox.mjs';
+import {hiddenListIssue,hiddenQualification,isSandboxed,pythonTool,sandboxEnvironment,sandboxInterpretationOf,sandboxKinds,sandboxQualification} from '../src/sandbox.mjs';
 import os from 'node:os';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
@@ -46,6 +46,7 @@ Commands:
   detail [CHECK] [--json]  Alias for explain
   run CHECK [--if-due] Execute one configured check and record its outcome; with --if-due,
                        only when its last pass does not apply to the files as they are now
+  stats [--json]       Per check: skips, time saved, recorded runs, why checks were UNVERIFIED
   remove-state         Stop and remove only this configuration's owned local state
 
 No checks run in the background. Direct commands outside redue create no receipts.`;
@@ -95,7 +96,7 @@ if(command==='agent'){
   catch(e){error(e.message);}
   await exit(0);
 }
-if(!['init','start','stop','status','detail','explain','run','remove-state'].includes(command))
+if(!['init','start','stop','status','detail','explain','run','stats','remove-state'].includes(command))
   error(`unknown command ${command||'<none>'}; use --help`);
 const json=args.includes('--json');
 // run --if-due: run the check only when its last pass does not apply now.
@@ -150,21 +151,30 @@ if(command==='init'){
     if(!chosen.length)error('no discovered check matches the selected workspace and kind');
     discovery.checks=chosen;discovery.config.checks=chosen.map(row=>row.config);
   }
-  // A sandboxed check is proposed only when it gives the same exit status
-  // inside the sandbox as outside it. Otherwise init writes what it would
+  // A sandboxed check is proposed only when it gives the same exit status and
+  // output inside the sandbox as outside it: first with the checkout's
+  // git-ignored files hidden (sandbox-v2), else with the whole checkout
+  // (sandbox-v1), reusing the plain run. Otherwise init writes what it would
   // have without the sandboxed recipe, with the reason.
+  const trialIssue=trial=>trial.issue?`the sandbox cannot run here (${trial.issue})`:
+    // A failure both ways that shows a refusal cannot be told from a real one.
+    trial.same?null:trial.plain!==trial.sandboxed?`exit ${trial.sandboxed} inside the sandbox, ${trial.plain} outside it${trial.line?` (${trial.line})`:''}`:
+    trial.line?`it fails both ways (exit ${trial.plain}), with a sign of a refusal inside the sandbox (${trial.line})`:
+    `the output differs inside the sandbox: ${JSON.stringify(trial.output.sandboxed)} instead of ${JSON.stringify(trial.output.plain)}`;
   let trials=0;
   for(const [at,row] of [...discovery.checks.entries()]){
     if(row.qualification!==sandboxQualification||row.level!=='ready')continue;
     if(!json)console.error(`Running ${row.config.name} inside and outside the sandbox to confirm it...`);
-    const trial=await sandboxTrial(discovery.root,row.config);
-    if(!trial.issue)trials++;
-    const issue=trial.issue?`the sandbox cannot run here (${trial.issue})`:
-      // A failure both ways that shows a refusal cannot be told from a real one.
-      trial.same?null:trial.plain!==trial.sandboxed?`exit ${trial.sandboxed} inside the sandbox, ${trial.plain} outside it${trial.line?` (${trial.line})`:''}`:
-      trial.line?`it fails both ways (exit ${trial.plain}), with a sign of a refusal inside the sandbox (${trial.line})`:
-      `the output differs inside the sandbox: ${JSON.stringify(trial.output.sandboxed)} instead of ${JSON.stringify(trial.output.plain)}`;
-    if(!issue){row.reason+=`; ran both ways at init, exit ${trial.plain}`;continue;}
+    const hidden=await sandboxTrial(discovery.root,row.config,{hide:true});
+    if(!hidden.issue)trials++;
+    if(!hidden.issue&&hidden.same){
+      row.config={...row.config,qualification:hiddenQualification};row.qualification=hiddenQualification;
+      row.reason=row.reason.replace('the whole checkout is its input',"the checkout's files git doesn't ignore are its input")+`; ran both ways at init, exit ${hidden.plain}`;continue;}
+    // Without git, nothing is hidden: the whole checkout is tried on its own.
+    const trial=hidden.plainRun?await sandboxTrial(discovery.root,row.config,{plain:hidden.plainRun}):
+      hidden.issue===hiddenListIssue?await sandboxTrial(discovery.root,row.config):hidden;
+    const issue=trialIssue(trial);
+    if(!issue){row.reason+=`; ran both ways at init, exit ${trial.plain}; it needs files git ignores (${hidden.issue??trialIssue(hidden)})`;continue;}
     if(row.fallback)discovery.checks[at]={...row.fallback,reason:`Sandboxed recipe unavailable: ${issue}; ${row.fallback.reason}`};
     else{discovery.checks[at]=null;discovery.skipped.push({kind:row.config.name,reason:`${row.config.name}: sandboxed recipe unavailable: ${issue}`});}
   }
@@ -310,7 +320,7 @@ const checks=publicConfig.checks.map(check=>{
   const pnpmTypecheck=check.qualification==='pnpm-tsc-v1';
   const testsDirect=check.qualification===testsQualification;
   const generalScript=check.qualification===scriptQualification;
-  const sandboxed=check.qualification===sandboxQualification;
+  const sandboxed=isSandboxed(check.qualification);
   if(check.script&&check.command&&!pnpmTypecheck&&!npmDirect&&!testsDirect)
     error(`${check.name}: choose script or command, not both`);
   const manager=publicConfig.packageManager;
@@ -398,12 +408,18 @@ const checks=publicConfig.checks.map(check=>{
     ...(npmDirect?{qualificationInterpretation:directInterpretation}:{}),
     ...(testsDirect?{qualificationInterpretation:testsInterpretation}:{}),
     ...(generalScript?{qualificationInterpretation:scriptInterpretation}:{}),
-    ...(sandboxed?{qualificationInterpretation:sandboxInterpretation}:{}),
+    ...(sandboxed?{qualificationInterpretation:sandboxInterpretationOf(check.qualification)}:{}),
     workspace:check.workspace||null,kind:check.kind||null};
 });
 const runtime={schema:1,provider:'declared-project@1',root,state,checks};
 try{assertOwnedStatePlacement(runtime);}catch(e){error(e.message);}
 const serialized=JSON.stringify(runtime,null,2)+'\n';
+if(command==='stats'){
+  const {readStats,renderStats}=await import('../src/stats.mjs');
+  const value=readStats(state,publicConfig.checks.map(item=>item.name));
+  console.log(json?JSON.stringify(value):renderStats(value));
+  await exit(0);
+}
 const maintenance=command==='stop'||command==='remove-state';
 if(maintenance&&!fs.existsSync(runtimeFile)){
   console.log(`No REDUE state exists for ${configFile}.`);
@@ -443,11 +459,14 @@ const internal=command==='remove-state'?'uninstall':
 // Asked when this part of a command runs, after earlier parts may have
 // changed files. REDUE_FORCE=1 runs it anyway.
 if(ifDue&&process.env.REDUE_FORCE!=='1'){
-  const {verdict}=await import('../src/claude-hook.mjs');
+  const [{verdict},{note,skipNote,dueNote}]=await Promise.all([import('../src/claude-hook.mjs'),import('../src/stats.mjs')]);
   const asked=spawnSync(process.execPath,[fileURLToPath(import.meta.url),'--config',configFile,...(stateOverride?['--state-dir',stateOverride]:[]),
     'status','--sync','--json'],{encoding:'utf8',stdio:['ignore','pipe','ignore'],env:process.env,timeout:600_000});
   let status=null;try{status=JSON.parse(asked.stdout);}catch{}
+  const due=dueNote(status,check);
+  if(due)note(state,due);
   if(verdict(status,check)){
+    note(state,skipNote(status,check,'if-due'));
     const row=status.checks.find(item=>item.name===check);
     if(json)console.log(JSON.stringify({check,skipped:true,result:'PASS',run_id:row.invocation.runId}));
     else console.error(`REDUE: ${check} passed on these exact inputs (run ${row.invocation.runId}); not run again. REDUE_FORCE=1 runs it anyway.`);

package/docs/user/sandbox.md

@@ -7,10 +7,15 @@ covers programs REDUE cannot record: TypeScript 7's native compiler, esbuild,
 oxlint and tsgolint, biome, turbo, and Python tools such as mypy, pyright, ty
 and ruff.
 
-**The claim.** A sandboxed result holds for a run that sees only the project,
-its installed packages and the toolchain, the way CI does. It does not say
-that a run with your own configuration files, a service on your machine or the
-network would give the same result.
+**The claim.** A sandboxed result holds for a run that sees only the project's
+files that git doesn't ignore, its installed packages and the toolchain, the
+way CI does. It does not say that a run with your own configuration files, a
+service on your machine or the network would give the same result.
+
+A check that needs files git ignores (generated code, another package's
+built declarations) gets the whole checkout instead: its result holds for a
+run that sees the project, git-ignored files included, its installed packages
+and the toolchain. See [files git ignores](#files-git-ignores).
 
 ## Where it applies
 
@@ -19,9 +24,9 @@ network would give the same result.
   [direct TypeScript recipe](direct-typescript.md) and the pnpm and Yarn
   TypeScript recipes first; they stay first where they apply. Then the
   sandboxed recipe, before the [general recipe](node-script.md), since it
-  also covers the native programs a script starts. Where init's trial shows a
-  difference, or the sandbox cannot run, `init` writes the general recipe as
-  before. Where the sandbox cannot start at run time (inside Claude Code's
+  also covers the native programs a script starts. Where init's trials show
+  a difference, or the sandbox cannot run, `init` writes the general recipe
+  as before. Where the sandbox cannot start at run time (inside Claude Code's
   macOS sandbox), a script the general recipe takes is recorded as it records
   it.
 - **Python projects:** mypy, pyright, ty and ruff installed in the project's
@@ -44,12 +49,14 @@ redue status --sync
 A Python check in the config:
 
 ```json
-{"name": "typecheck", "kind": "typecheck", "qualification": "sandbox-v1",
+{"name": "typecheck", "kind": "typecheck", "qualification": "sandbox-v2",
  "command": [".venv/bin/mypy", "src"], "inputs": ["**", "..."], "installedInputs": [".venv/**", "..."]}
 ```
 
 A Node check names its script, as the general recipe's do:
-`{"name": "lint", "script": "lint", "kind": "lint", "qualification": "sandbox-v1", ...}`.
+`{"name": "lint", "script": "lint", "kind": "lint", "qualification": "sandbox-v2", ...}`.
+`sandbox-v2` hides the files git ignores from the run; `sandbox-v1` runs it on
+the whole checkout.
 
 With the Claude Code hook, `uv run mypy src`, `poetry run mypy src`,
 `python -m mypy src`, `.venv/bin/mypy src` and `mypy src` are recognized as
@@ -57,11 +64,32 @@ that check. The last two count only when PATH finds the tool or Python in the
 project's `.venv/bin` first. When the hook runs the check through REDUE, it
 keeps `uv run` or `poetry run` in front, so the environment still syncs first.
 
+## Files git ignores
+
+`init` runs each check three ways at most: plainly, sandboxed with the files
+git ignores hidden, and, when those two differ, sandboxed with the whole
+checkout (reusing the plain run). The first sandboxed way that gives the same
+result is written: `sandbox-v2` or `sandbox-v1`.
+
+With `sandbox-v2`, each run hides what `git ls-files --others --ignored
+--exclude-standard --directory` lists, except `node_modules`, `.venv` and
+runner caches: build output (`dist/`, `.next/`), coverage files, `.env` files.
+Only the project's rules count: its `.gitignore` files and
+`.git/info/exclude`, not your global excludes file. Those files are not
+inputs, so a build or test run that writes them leaves the result CURRENT.
+
+When a `sandbox-v2` run fails with a refusal that names a hidden file (a
+missing file counts only when it names one, since Linux tools report an
+unreadable file as missing), REDUE runs the check again in the sandbox
+without hiding anything. That result is kept and compared on every file,
+git-ignored ones included. Run `redue init` again to write `sandbox-v1` for a
+check that keeps needing them.
+
 ## What the run sees
 
 It may read and execute only beneath:
 
-- the checkout;
+- the checkout, without the files git ignores for `sandbox-v2`;
 - the toolchain: Node's installation and the package managers' (with
   Corepack's downloads), or the Python installation the `.venv` was made from;
 - system directories (`/usr`, `/bin`, `/etc` and the like on Linux; `/usr`,
@@ -100,10 +128,11 @@ It gets a controlled environment, not yours:
 
 CURRENT means the last sandboxed run's inputs are unchanged:
 
-- every file in the checkout, git-ignored files and git-ignored links to
-  files in it included, except `.git`, `node_modules` and `.venv` (observed
-  as installed files, by identity) and runner caches: the general recipe's,
-  plus `__pycache__`, `.mypy_cache`, `.ruff_cache` and `.pytest_cache`;
+- every file in the checkout git doesn't ignore (`sandbox-v2`), or every file
+  in it, git-ignored files and git-ignored links to files in it included
+  (`sandbox-v1`), except `.git` and runner caches (the general recipe's, plus
+  `__pycache__`, `.mypy_cache`, `.ruff_cache` and `.pytest_cache`);
+- `node_modules` and `.venv`, observed as installed files, by identity;
 - the environment the run gets (without display variables such as `TERM`
   and `COLUMNS`), and the places it may read;
 - Node's and the package managers' executables, or the interpreter the
@@ -111,7 +140,8 @@ CURRENT means the last sandboxed run's inputs are unchanged:
 - every directory on PATH, by identity: installing, removing or upgrading a
   program in one makes the result STALE;
 - `.git/info/exclude` and `.git/config`, by content: ruff and biome read the
-  ignore rules there.
+  ignore rules there, and they decide what `sandbox-v2` hides. For a project
+  in a subdirectory of its repository, also the `.gitignore` files above it.
 
 ## Telling a refusal from a real failure
 
@@ -124,6 +154,9 @@ every failure twice to find out:
   timings, the temporary and home directories, and lines about caches.
   Otherwise `init` writes what it would have without this recipe and says why.
   These are the only runs `init` makes.
+- When a `sandbox-v2` run fails with a refusal that names a hidden file, it
+  runs again in the sandbox without hiding (see
+  [files git ignores](#files-git-ignores)).
 - When a sandboxed run fails and its output has a line that looks like a
   refusal ("Operation not permitted", "Permission denied", "Read-only file
   system", a name lookup or a connection that failed), REDUE runs the check
@@ -167,3 +200,22 @@ it with `redue remove-state`.
   nested example project's).
 - A script that changes files (`--fix`, `--write`) does not get this recipe:
   `init` would run it twice.
+- With `sandbox-v2`, a run cannot read a hidden file, but it can still see
+  that one exists. On macOS it sees the names of hidden files and folders at
+  the level where they start (`dist` in the checkout's root). On Linux it can
+  also list a hidden folder and see its files' sizes and times: Landlock
+  restricts neither beneath a folder the run may list. A tool that acts on
+  whether a git-ignored file exists, without reading it, is not covered: a
+  new or removed one does not make the result STALE. Typecheckers and
+  linters read what they act on; a test that skips itself when a built file
+  is missing does not, which is why hidden files are not used for tests yet.
+- On Linux, a file a `sandbox-v2` run creates in a folder that holds hidden
+  files (the checkout's root, when anything in it is hidden) cannot be read
+  back in the same run. `init`'s trial and the rerun without hiding catch a
+  check that needs to.
+- A file whose git status changes without a change to its content (`git add
+  -f` of an ignored file, `git rm --cached` of a tracked one) is noticed only
+  when its content next changes. A change to `.gitignore` or
+  `.git/info/exclude` makes the result STALE.
+- A run that moves a hidden folder into a visible place can read it there.
+  That changes the checkout during the run, so the run is not reused.

package/docs/user/supported-projects.md

@@ -20,8 +20,9 @@ build scripts. It prefers familiar script names (for typecheck: `typecheck`,
 matches are reported as ambiguous rather than guessed. It never creates a new
 project script. Without `--recipe`, `init` tries the strict recipes below first, then,
 for a root typecheck or lint script, the [sandboxed recipe](sandbox.md) on
-macOS and Linux (the script run inside an OS sandbox, the whole checkout as
-its input), then the [general recipe](node-script.md): the script run
+macOS and Linux (the script run inside an OS sandbox, with the files git
+ignores hidden when it gives the same result that way, else on the whole
+checkout), then the [general recipe](node-script.md): the script run
 through the package manager with every Node process recorded and the whole
 checkout as its input. Python projects get the sandboxed recipe for mypy,
 pyright, ty and ruff in their `.venv`. `--recipe typescript-direct`,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@redue/cli",
   "private": false,
-  "version": "0.1.0-alpha.26",
+  "version": "0.1.0-alpha.27",
   "publishConfig": {
     "access": "public",
     "tag": "alpha"

package/src/claude-hook.mjs

@@ -13,6 +13,7 @@ import {processAlive} from './process-liveness.mjs';
 import {scriptRunChecks} from './typescript-invocation.mjs';
 import {recipeLabel} from './presentation.mjs';
 import {findExecutable} from './executable-lookup.mjs';
+import {note,skipNote,dueNote} from './stats.mjs';
 
 export const hookCommand='redue agent hook claude';
 // No shell metacharacters; `@` starts scoped package names.
@@ -25,7 +26,8 @@ const tests=check=>check?.qualification==='npm-tests-direct-v1'&&Array.isArray(c
 const general=check=>(check?.qualification==='node-script-v1'&&['typecheck','test','lint'].includes(check.kind)||
   sandboxed(check))&&typeof check.script==='string';
 // A sandboxed check: a root package script, or a tool from the project's .venv.
-const sandboxed=check=>check?.qualification==='sandbox-v1'&&['typecheck','lint'].includes(check.kind);
+// sandbox.mjs's isSandboxed, written out: the hook does not load the sandbox module.
+const sandboxed=check=>['sandbox-v1','sandbox-v2'].includes(check?.qualification)&&['typecheck','lint'].includes(check.kind);
 const python=check=>sandboxed(check)&&Array.isArray(check.command)&&/^\.venv\/bin\/[A-Za-z0-9_.-]+$/.test(check.command[0]||'')&&
   check.command.every(word=>typeof word==='string'&&safe.test(word));
 const eligibleCheck=check=>typecheck(check)||tests(check)||general(check)||python(check);
@@ -505,6 +507,9 @@ export async function claudeHook(input,{entry,timeout,invoke=null}){
   const project=hookProject(root);
   if(!project)return null;
   const {record,config,parsed}=project;
+  // For `redue stats`: the checks a decision skipped, or the ones that were due.
+  const tally=(status,names,skipped)=>{let state;try{state=projectState(project.projectRoot,config);}catch{return;}
+    for(const name of names){const entry=skipped?skipNote(status,name,'hook'):dueNote(status,name);if(entry)note(state,entry);}};
   const entered=enteredDir(command,root,project.projectRoot);
   if(!entered)return null;
   let scripts={};
@@ -537,6 +542,7 @@ export async function claudeHook(input,{entry,timeout,invoke=null}){
     if(!names)return null;
     const status=await synchronizedStatus(entry,config,root,timeout??lastRunTimeout(config,parsed,...names)),
       reason=fanoutVerdict(status,names,match.rest);
+    tally(status,names,Boolean(reason));
     return reason?{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'deny',permissionDecisionReason:reason}}:null;
   }
   // A compiler script: its checks in the order of its runs, or nothing when
@@ -550,6 +556,7 @@ export async function claudeHook(input,{entry,timeout,invoke=null}){
     else{
       const status=await synchronizedStatus(entry,config,root,timeout??lastRunTimeout(config,parsed,...names)),
         reason=fanoutVerdict(status,names,match.rest);
+      tally(status,names,Boolean(reason));
       if(reason)return {hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'deny',permissionDecisionReason:reason}};
       const pending=names.filter(name=>!verdict(status,name));
       const rewritten=status?.schema===1&&status.observation?.healthy===true&&Array.isArray(status.checks)&&
@@ -561,6 +568,7 @@ export async function claudeHook(input,{entry,timeout,invoke=null}){
   }
   const name=match.check,status=await synchronizedStatus(entry,config,root,timeout??lastRunTimeout(config,parsed,name)),
     reason=verdict(status,name,match.rest);
+  tally(status,[name],Boolean(reason));
   if(reason)return {hookSpecificOutput:{hookEventName:'PreToolUse',
     permissionDecision:'deny',permissionDecisionReason:reason}};
   // Rewrite only on a healthy answer for this check: without an observer,

package/src/cli.mjs

@@ -8,8 +8,8 @@ import {patternMatcher} from './glob.mjs';
 import {observedBy} from './installed-observation.mjs';
 import {changedFiles,coverageReadable,gitIgnored,recordedEnvironment,testEnvironmentIssue,testGuardConfig,testRunGuard,testRunFacts,sharedInstalledFile,testsInterpretation,testsQualification} from './test-direct.mjs';
 import {childProgram,generalIssue,lookup,pnpmConfigFiles,scriptCaches,scriptInstalledPaths,scriptInterpretation,scriptQualification,scriptRunFacts,pnpmNameless,toolOutput,toolchainDirs} from './node-script.mjs';
-import {denialLine,endWithChild,runToEnd,sandboxArgv,sandboxContext,sandboxDirs,sandboxEnv,sandboxInterpretation,sandboxPlaces,
-  sandboxQualification,sandboxSupport,systemPlaces} from './sandbox.mjs';
+import {denialLine,endWithChild,hiddenEntries,hiddenQualification,hiddenRefusal,isSandboxed,runToEnd,sandboxArgv,sandboxContext,sandboxDirs,sandboxEnv,
+  sandboxInterpretation,sandboxInterpretationOf,sandboxPlaces,sandboxQualification,sandboxSupport,systemPlaces} from './sandbox.mjs';
 import path from 'node:path';
 import net from 'node:net';
 import os from 'node:os';
@@ -29,6 +29,7 @@ import {atomicJson,commitReceipt,readReceipts,receiptRevision} from './state-sto
 import {timing,profiling,mark,traceContext} from './decision-profile.mjs';
 import {readCachedStatus,unavailableCached} from './cached-state.mjs';
 import {renderRun} from './presentation.mjs';
+import {note} from './stats.mjs';
 
 mark('cli.loaded');
 const here=path.dirname(fileURLToPath(import.meta.url));
@@ -86,7 +87,7 @@ function environmentReads() {
 }
 const recordedRecipes=[testsQualification,scriptQualification];
 // A sandboxed check's run is recorded where its sandbox cannot start (execute).
-function contextHashes() {const reads=config.checks.some(check=>[...recordedRecipes,sandboxQualification].includes(check.qualification))?environmentReads():{};
+function contextHashes() {const reads=config.checks.some(check=>recordedRecipes.includes(check.qualification)||isSandboxed(check.qualification))?environmentReads():{};
   return Object.fromEntries(config.checks.map(check=>[
   check.name,Object.fromEntries([...(check.environment?.variables||[])
     .map(key=>[key,digest(process.env[key]??'<unset>')]),
@@ -99,7 +100,7 @@ function contextHashes() {const reads=config.checks.some(check=>[...recordedReci
       `__vstate_path_executable_${name}__`,pathExecutableIdentity(name)]),
     ...(check.environment?.executableIdentity?[['__vstate_node_identity__',nodeIdentity()]]:[]),
     // A sandboxed run's environment, toolchain and places (sandbox.mjs).
-    ...(check.qualification===sandboxQualification?Object.entries(sandboxContext(check,process.env,root)):[]),
+    ...(isSandboxed(check.qualification)?Object.entries(sandboxContext(check,process.env,root)):[]),
     // The variables the last test run read directly, compared here: which
     // list was compared, and the first variable whose value now differs.
     // Control requests are small, so the values stay out of them.
@@ -299,7 +300,7 @@ async function execute() {
     // A sandboxed check runs inside the OS sandbox. Where the sandbox cannot
     // start, a script the general recipe takes is recorded as that recipe
     // records it (`fallback`); any other runs as it is, and is not reused.
-    const sandboxed=selected.qualification===sandboxQualification,support=sandboxed?sandboxSupport():null;
+    const sandboxed=isSandboxed(selected.qualification),support=sandboxed?sandboxSupport():null;
     const fallback=Boolean(support?.issue&&typeof selected.script==='string'&&!generalIssue(root,selected.script));
     // A test run's processes record what the guard checks (test-recorder.cjs),
     // and so do a general recipe run's, through the package manager.
@@ -331,7 +332,11 @@ async function execute() {
       else{
         const dirs=sandboxDirs(state,name);
         const reads=[root,dirs.home,dirs.tmp,...sandboxPlaces(selected,process.env,root),...systemPlaces];
-        sandbox={mode:support.mode,dirs,argv:sandboxArgv(support.mode,command,{reads,tmp:dirs.tmp,python:support.python}),
+        // sandbox-v2 hides the checkout's git-ignored entries. Where git
+        // cannot list them, nothing is hidden, and the receipt compares every file.
+        const hidden=selected.qualification===hiddenQualification?hiddenEntries(root):null;
+        sandbox={mode:support.mode,dirs,reads,hidden,argv:sandboxArgv(support.mode,command,{reads,tmp:dirs.tmp,python:support.python,
+          hidden:(hidden||[]).map(rel=>path.join(root,rel.replace(/\/$/,'')))}),
           env:sandboxEnv(selected,process.env,{root,...dirs})};
       }
     }
@@ -516,6 +521,45 @@ async function execute() {
     // A recorded certificate changes only the probe part of the fingerprint.
     if(!outputs&&(!snap||!end||snap.planId!==end.planId||(recording?snap.inputKey!==end.inputKey:snap.fingerprint!==end.fingerprint)||
       snap.revision!==end.revision))captureIssues.push('declared inputs changed or were not observed');
+    // A run that hid git-ignored files and failed with a refusal that names
+    // one runs again in the sandbox without hiding them: the check needs
+    // them. That run's result is kept, compared on every file, when the
+    // inputs held through it too. Its own refusal is handled as below.
+    let hiddenRerun=null;
+    if(sandbox?.hidden?.length&&result==='FAIL'&&!requestedSignal){
+      const line=hiddenRefusal(output.head+'\n'+output.tail,sandbox.hidden);
+      if(line){
+        console.error(`redue: the sandboxed run failed with what looks like a refusal of a file git ignores (${line}); running it again in the sandbox without hiding them`);
+        const again=await runToEnd(sandboxArgv(sandbox.mode,command,{reads:sandbox.reads,tmp:sandbox.dirs.tmp,python:support.python}),
+          {cwd:plan.cwd,env:sandbox.env,echo:true,started:child=>{activeChild=child;}});
+        activeChild=null;
+        hiddenRerun={line,exitCode:again.status,signal:again.signal||null,...again.error?{errorCode:again.error.code||again.error.name}:{}};
+        if(requestedSignal){
+          captureIssues.push('interrupted during the run without hidden files');
+          Object.assign(invocation,{status:'interrupted',exitCode:null,signal:requestedSignal});
+        }
+        else if(again.error||again.status===null)
+          captureIssues.push(`the run without hidden files did not finish (${again.error?.code||again.signal}), so a refusal of a file git ignores is not ruled out (${line})`);
+        else{
+          const wait=decisionWait(process.env.VSTATE_CAPTURE_TIMEOUT_MS);
+          // Inputs, plan, observer and environment held through it as through the first run.
+          let confirmed=null;const environmentNow=contextHashes()[name];
+          try{confirmed=await call({action:'snapshot',name,contextHashes:contextHashes(),
+            ...Number.isSafeInteger(snap?.inputEventSerial)?{sinceSerial:snap.inputEventSerial}:{}},wait.timeout,wait.deadline);}catch{}
+          const last=confirmed?.snapshots?.[name];
+          if(!last?.observationHealthy||!snap||last.planId!==snap.planId||last.fingerprint!==snap.fingerprint||last.revision!==snap.revision||
+            last.inputEventSerial!==end?.inputEventSerial||last.planGeneration!==snap.planGeneration||
+            confirmed.observation?.generation!==before?.observation?.generation)
+            captureIssues.push('declared inputs changed or were not observed during the run without hidden files');
+          if(JSON.stringify(environmentNow)!==JSON.stringify(environmentBefore))
+            captureIssues.push('declared environment changed during the run without hidden files');
+          invocation.hiddenExitCode=invocation.exitCode;invocation.exitCode=again.status;
+          result=again.status===0?'PASS':'FAIL';
+          output.head=`${again.stdout}\n${again.stderr}`.slice(0,65536);output.tail='';
+          sandbox.hidden=null;
+        }
+      }
+    }
     // A sandboxed run that failed with what looks like a refusal by the
     // sandbox runs again outside it. When that run exits differently, the
     // sandbox changed the result: the plain run's result is kept, not reused.
@@ -562,7 +606,9 @@ async function execute() {
     // A recorded run's receipt carries its run facts, even none; observers that
     // predate run facts do not reuse version 2.
     // The recipe that made the receipt, which status and the hook name.
-    const receipt={result,invocation,target,stable,fingerprintVersion:recorded||testRun?2:1,recipe:(fallback?scriptQualification:selected.qualification)||null,
+    // A sandboxed receipt names what the run did: hid the git-ignored files or not.
+    const receipt={result,invocation,target,stable,fingerprintVersion:recorded||testRun?2:1,
+      recipe:(fallback?scriptQualification:own?(sandbox?.hidden?hiddenQualification:sandboxQualification):selected.qualification)||null,
       ...(recorded||testRun?{runFacts}:{}),
       ...(testRun?{verificationRecipe:general?scriptInterpretation:testsInterpretation,guardIssues:guard?.issues||['the run record is unavailable'],
         environmentReads:guard?.environmentReads||{},...(nondeterministic?{nondeterministic}:{})}:{}),
@@ -576,12 +622,15 @@ async function execute() {
       planId:snap?.planId??plan.id,fingerprint:(recording||outputs?end:snap)?.fingerprint??null,
       provider:plan.provider,environmentHashes:environmentBefore,
       ...(observedContext?{observedContext,verificationRecipe:directInterpretation}:{}),
-      ...(own?{verificationRecipe:sandboxInterpretation,sandbox:{mode:sandbox?.mode??null,...sandboxRerun?{rerun:sandboxRerun}:{}}}:{}),
+      // `hidden`: the git-ignored entries the run did not see, which the observer does not compare.
+      ...(own?{verificationRecipe:sandbox?.hidden?sandboxInterpretationOf(hiddenQualification):sandboxInterpretation,
+        sandbox:{mode:sandbox?.mode??null,hidden:sandbox?.hidden??null,...hiddenRerun?{hiddenRerun}:{},...sandboxRerun?{rerun:sandboxRerun}:{}}}:{}),
       ...(fallback?{sandbox:{mode:null,fallback:'node-script',issue:support.issue}}:{}),
       files:(outputs?end:snap)?.files??null,observerGeneration:before?.observation?.generation??null,
       startRevision:snap?.revision??null,endRevision:end?.revision??null};
     const persistenceStarted=performance.now();
     commitReceipt(state,name,receipt);
+    note(state,{kind:'run',check:name,ms:invocation.durationMs??null,result,stable});
     if(testRun){const reads=environmentReads();reads[name]=receipt.environmentReads;atomicJson(readsFile,{schema:1,checks:reads});}
     timing('cli.receipt_persistence',persistenceStarted);
     const reloadStarted=performance.now();
@@ -671,7 +720,8 @@ async function main(){
           await new Promise(r=>setTimeout(r,100));
         if(fs.existsSync(path.join(state,'observer.lock')))throw Error('observer did not stop');}
     }
-    fs.rmSync(state,{recursive:true,force:true});
+    // A stopping observer can still be closing its files (Windows: ENOTEMPTY, EBUSY).
+    fs.rmSync(state,{recursive:true,force:true,maxRetries:10,retryDelay:200});
     console.log(JSON.stringify({removed:state}));return;
   }
   if(action==='status'){console.log(JSON.stringify(cached()));return;}

package/src/daemon.mjs

@@ -25,7 +25,7 @@ import {npmCacheDir} from './npm-integrity.mjs';
 import {runFromArgv} from './typescript-invocation.mjs';
 import {buildInfoPath,recordedCertificate} from './direct-run-certificate.mjs';
 import {timing,mark,traceBase,traceContext,traceScope,traceEnvironment,traceId} from './decision-profile.mjs';
-import {sandboxChange} from './sandbox.mjs';
+import {ignoredNow,isSandboxed,sandboxChange,trackedBeneath} from './sandbox.mjs';
 
 const configFile=path.resolve(process.argv[2]);
 const config=JSON.parse(fs.readFileSync(configFile));
@@ -348,6 +348,39 @@ function describeChangedInput(plan,file) {
     .map(mapping=>mapping.logical).slice(0,2);
   return file+' changed'+(matches.length?` (installed via ${matches.join(', ')})`:'');
 }
+// A run that hid the checkout's git-ignored entries (sandbox@2) did not see
+// them. A changed file the run saw always counts. A file beneath a hidden
+// entry counts only once git tracks it, and a new file only when git does
+// not list it as ignored now, as the next run's hidden entries would not.
+// Installed trees count whatever git says. The first changed input that
+// counts, or null; once per receipt and pair of fingerprints. When git
+// cannot tell, every change counts.
+const hiddenRun=r=>Array.isArray(r?.sandbox?.hidden)&&Boolean(r.files);
+function visibleChange(row,r,name) {
+  const key=(r.invocation?.runId||'')+'\0'+r.fingerprint+'\0'+combinedSummary(name).fingerprint;
+  if(row.visibleKey===key)return row.visibleChange;
+  const hidden=r.sandbox.hidden.map(entry=>entry.replace(/\/$/,''));
+  const beneath=file=>hidden.some(entry=>file===entry||file.startsWith(entry+'/'));
+  const current=combinedFiles(name);
+  const changed=[...new Set([...Object.keys(r.files),...Object.keys(current)])].filter(file=>r.files[file]!==current[file]).sort();
+  const seen=changed.filter(file=>file in r.files&&!beneath(file));
+  const covered=changed.filter(file=>beneath(file)),fresh=changed.filter(file=>!(file in r.files)&&!beneath(file));
+  let found=seen[0]??null;
+  if(!found&&covered.length){
+    const tracked=trackedBeneath(root,hidden.filter(entry=>covered.some(file=>file===entry||file.startsWith(entry+'/'))));
+    found=covered.find(file=>!tracked||tracked.has(file))??null;
+  }
+  if(!found&&fresh.length){
+    // Ask once per directory the run had no file in, then the files outside one.
+    const before=new Set(Object.keys(r.files).flatMap(file=>file.split('/').slice(0,-1).map((_,i,parts)=>parts.slice(0,i+1).join('/'))));
+    const newDir=file=>{const parts=file.split('/');for(let i=1;i<parts.length;i++){const dir=parts.slice(0,i).join('/');if(!before.has(dir))return dir+'/';}return null;};
+    const asked=[...new Set(fresh.filter(file=>!file.startsWith('external:')).map(file=>newDir(file)??file))];
+    const ignored=ignoredNow(root,asked);
+    found=fresh.find(file=>file.startsWith('external:')||!ignored||!ignored.has(file))??null;
+  }
+  row.visibleKey=key;row.visibleChange=found;
+  return found;
+}
 function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=false) {
   if(!index)return [];
   return [...index.checks].map(([name,row])=>{
@@ -368,7 +401,7 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       return item;}
     if(pendingChecks.has(name)){item.reason='filesystem change pending content inspection';return item;}
     if(r&&r.planId) item.declared_inputs_match=r.planId===row.plan.id&&
-      r.fingerprint===combinedSummary(name).fingerprint;
+      (r.fingerprint===combinedSummary(name).fingerprint||hiddenRun(r)&&visibleChange(row,r,name)===null);
     if(r&&!(r.fingerprintVersion===1||r.fingerprintVersion===2&&Array.isArray(r.runFacts))){
       item.reason='receipt uses earlier input-resolution format';return item;}
     if(row.plan.unresolved.length){
@@ -410,7 +443,7 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       ...(row.plan.environment.executableIdentity?['__vstate_node_identity__']:[])];
     // A sandboxed run's variables, toolchain, PATH directories and places
     // (sandbox.mjs): every entry either side has, and the first change named.
-    const sandboxChanged=row.plan.qualification==='sandbox-v1'&&contextHashes?.[name]?
+    const sandboxChanged=isSandboxed(row.plan.qualification)&&contextHashes?.[name]?
       sandboxChange(r?.environmentHashes,contextHashes[name]):null;
     if(names.length&&!contextHashes?.[name])unconfirmed??='execution environment context not supplied';
     item.freshness='STALE';
@@ -431,8 +464,10 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
         item.freshness='UNVERIFIED';item.reason='environment variables the last run read were not compared';}
       else item.reason=`environment variable ${contextHashes[name].__redue_env_changed__} differs from the last run`;
     }
-    else if(r.fingerprint!==combinedSummary(name).fingerprint) {
+    else if(r.fingerprint!==combinedSummary(name).fingerprint&&!(hiddenRun(r)&&visibleChange(row,r,name)===null)) {
       const key=r.fingerprint+'\0'+combinedSummary(name).fingerprint;
+      if(row.staleReasonKey!==key&&hiddenRun(r)){
+        row.staleInputs=[visibleChange(row,r,name)];row.staleReason=describeChangedInput(row.plan,row.staleInputs[0]);row.staleReasonKey=key;}
       if(row.staleReasonKey!==key){
         let changed=row.lastReason;row.staleInputs=[];
         const candidate=changed?.endsWith(' changed')?changed.slice(0,-8):null;
@@ -807,7 +842,7 @@ function markInputEvent(name,rel,type,replay) {
     const serial=(inputEventSerial.get(name)||0)+1;
     inputEventSerial.set(name,serial);
     // Kept only for recorded test and script checks and sandboxed ones; trimmed in batches.
-    if(['npm-tests-direct-v1','node-script-v1','sandbox-v1'].includes(index?.checks.get(name)?.plan.qualification)){
+    if(['npm-tests-direct-v1','node-script-v1'].includes(index?.checks.get(name)?.plan.qualification)||isSandboxed(index?.checks.get(name)?.plan.qualification)){
       const list=inputEventPaths.get(name)||[];list.push([serial,rel]);
       if(list.length>2*eventPathLimit)list.splice(0,list.length-eventPathLimit);inputEventPaths.set(name,list);
     }

package/src/declared-plan.mjs

@@ -8,7 +8,7 @@ import {qualifyTypeScript} from './typescript-qualification.mjs';
 import {directBuildInfo} from './direct-typescript.mjs';
 import {qualifyTests,testWorkspacePatterns,testsQualification} from './test-direct.mjs';
 import {qualifyNodeScript,scriptQualification} from './node-script.mjs';
-import {qualifySandbox,sandboxInstalledExclusions,sandboxQualification} from './sandbox.mjs';
+import {isSandboxed,qualifySandbox,sandboxInstalledExclusions} from './sandbox.mjs';
 import {yarnWorkspaceTypecheckInputs} from './yarn-workspace-inputs.mjs';
 import {pnpmTypecheckInputs} from './pnpm-inputs.mjs';
 import {checkRun} from './typescript-invocation.mjs';
@@ -81,7 +81,7 @@ export function discoverDeclared(config) {
     const excluded=buildInfo?['!'+buildInfo]:[];
     // A sandboxed check leaves out the .venv's links that lead out of the
     // checkout; its qualification names them.
-    const sandboxed=selected.qualification===sandboxQualification;
+    const sandboxed=isSandboxed(selected.qualification);
     if(sandboxed)excluded.push(...sandboxInstalledExclusions(root));
     const installedStarted=performance.now();
     const installed=resolveDeclaredInstalled(root,

package/src/index.mjs

@@ -6,6 +6,7 @@ import micromatch from './glob.mjs';
 import {sha} from './plan.mjs';
 import {resolveLinks} from './installed-inputs.mjs';
 import {validInputRelative,identityFields,racyUntil} from './path-identity.mjs';
+import {isSandboxed} from './sandbox.mjs';
 
 const tracked = root => [...new Set(execFileSync('git',
   ['ls-files','--cached','--others','--exclude-standard','-z'],
@@ -204,7 +205,7 @@ export class InputIndex {
         // (its package.json stands for them).
         // The second form is for recorded checks only: their recorder
         // classifies a read through the link where it leads.
-        const recorded=name=>['node-script-v1','npm-tests-direct-v1','sandbox-v1'].includes(this.checks.get(name).plan.qualification);
+        const recorded=name=>['node-script-v1','npm-tests-direct-v1'].includes(this.checks.get(name).plan.qualification)||isSandboxed(this.checks.get(name).plan.qualification);
         const observedDir=installed?physical=>!this.includeInstalled&&
           ([...this.installedRootSet].some(root=>physical.startsWith(root+'/'))||
             !physical.split('/').includes('node_modules')&&!this.installedPath(physical+'/package.json')&&matched.every(recorded))&&

package/src/landlock.py

@@ -6,6 +6,14 @@
 # connection to an abstract Unix socket outside the run. Writes are not
 # handled, so they are not restricted.
 #
+# --hide PATH keeps the run from reading or executing beneath PATH, inside a
+# --read place. Landlock only grants, beneath a whole directory, so such a
+# place gets listing rights (beneath it all, hidden entries included) and
+# read and execute rights on each of its entries that is not hidden and
+# holds nothing hidden, descending into the ones that do. A hidden path can
+# still be listed and stat'ed. --stats FILE writes the rule count and the
+# time the rules took, as JSON.
+#
 # The launcher stays as the command's parent and a child subreaper: when the
 # command exits, it stops every process the command left running, daemons
 # that started their own session included (they are reparented to it), as a
@@ -13,7 +21,7 @@
 # launcher gets is passed to that group once. The launcher then ends as the
 # command did: with its exit status, or by its signal.
 #
-#   landlock.py --read /usr --read /tmp ... [--no-tcp] -- cmd args...
+#   landlock.py --read /usr --read /tmp ... [--hide P ...] [--stats F] [--no-tcp] -- cmd args...
 #   landlock.py --probe     # prints {"abi": N} or {"abi": null, "errno": E}
 import ctypes
 import json
@@ -53,10 +61,14 @@ def main(argv):
         v, err = abi()
         print(json.dumps({'abi': v, 'errno': err}))
         return 0
-    reads, no_tcp = [], False
+    reads, hidden, stats, no_tcp = [], set(), None, False
     while argv and argv[0] != '--':
         if argv[0] == '--read':
             reads.append(argv[1]); argv = argv[2:]
+        elif argv[0] == '--hide':
+            hidden.add(os.path.normpath(argv[1])); argv = argv[2:]
+        elif argv[0] == '--stats':
+            stats = argv[1]; argv = argv[2:]
         elif argv[0] == '--no-tcp':
             no_tcp = True; argv = argv[1:]
         else:
@@ -72,17 +84,50 @@ def main(argv):
     ruleset = libc.syscall(SYS_CREATE, ctypes.byref(attr), ctypes.c_size_t(size), ctypes.c_uint32(0))
     if ruleset < 0:
         sys.exit(f'landlock.py: create_ruleset errno {ctypes.get_errno()}')
-    for place in reads:
+    started, count = time.monotonic(), 0
+    def add(place, rights=None):
+        nonlocal count
         try:
             fd = os.open(place, os.O_PATH | os.O_CLOEXEC)
         except OSError:
-            continue
+            return
         # A file takes file rights only.
-        rights = handled if os.path.isdir(place) else EXECUTE | READ_FILE
+        if rights is None:
+            rights = handled if os.path.isdir(place) else EXECUTE | READ_FILE
         rule = PathBeneath(rights, fd)
         if libc.syscall(SYS_ADD, ctypes.c_int(ruleset), ctypes.c_int(1), ctypes.byref(rule), ctypes.c_uint32(0)) < 0:
             sys.exit(f'landlock.py: add_rule {place} errno {ctypes.get_errno()}')
         os.close(fd)
+        count += 1
+    # The directories that hold a hidden path, up to the root.
+    holders = set()
+    for path in hidden:
+        at = os.path.dirname(path)
+        while at not in holders and at != os.path.dirname(at):
+            holders.add(at); at = os.path.dirname(at)
+    def grant(directory):
+        # Links are not followed: what they lead to is granted on its own or not at all.
+        try:
+            entries = list(os.scandir(directory))
+        except OSError:
+            return
+        for entry in entries:
+            if entry.path in hidden or entry.is_symlink():
+                continue
+            if entry.path in holders:
+                grant(entry.path)
+            else:
+                add(entry.path)
+    for place in reads:
+        place = os.path.normpath(place)
+        if place in holders and os.path.isdir(place):
+            add(place, READ_DIR)
+            grant(place)
+        else:
+            add(place)
+    if stats:
+        with open(stats, 'w') as f:
+            json.dump({'rules': count, 'ms': round((time.monotonic() - started) * 1000, 1)}, f)
     if libc.prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0:
         sys.exit(f'landlock.py: no_new_privs errno {ctypes.get_errno()}')
     if libc.syscall(SYS_RESTRICT, ctypes.c_int(ruleset), ctypes.c_uint32(0)) < 0:

package/src/presentation.mjs

@@ -2,7 +2,8 @@
 // The recipe that made a receipt, by the qualification it names.
 const recipes={'npm-typescript-direct-v1':'direct TypeScript recipe','npm-tests-direct-v1':'direct test recipe',
   'node-script-v1':'general recipe','pnpm-tsc-v1':'pnpm TypeScript recipe','yarn-workspace-tsc-v1':'Yarn workspace TypeScript recipe',
-  'typescript-noemit-v1':'npm TypeScript recipe','sandbox-v1':'sandboxed recipe'};
+  'typescript-noemit-v1':'npm TypeScript recipe','sandbox-v1':'sandboxed recipe',
+  'sandbox-v2':'sandboxed recipe, git-ignored files hidden'};
 export const recipeLabel=recipe=>recipes[recipe]??null;
 export function checkLabel(row) {
   return row.result==='FAIL'?'FAILED':row.freshness;

package/src/sandbox.mjs

@@ -19,9 +19,18 @@ import {spawn,spawnSync} from 'node:child_process';
 import {fileURLToPath} from 'node:url';
 import {lookup,scriptCaches,scriptCheckInputs,scriptProject,toolchainDirs} from './node-script.mjs';
 import {displayVariables} from './test-direct.mjs';
+import picomatch from 'picomatch';
 
 export const sandboxQualification='sandbox-v1';
 export const sandboxInterpretation='sandbox@1';
+// The same recipe with the checkout's git-ignored files hidden from the run
+// (hiddenEntries): they are not its inputs, so build and test outputs do not
+// make it STALE. init gives it when the run gives the same result that way.
+export const hiddenQualification='sandbox-v2';
+export const hiddenInterpretation='sandbox@2';
+export const hiddenListIssue='git cannot list the ignored files';
+export const isSandboxed=qualification=>qualification===sandboxQualification||qualification===hiddenQualification;
+export const sandboxInterpretationOf=qualification=>qualification===hiddenQualification?hiddenInterpretation:sandboxInterpretation;
 export const sandboxKinds=['typecheck','lint'];
 const fail=code=>{throw Object.assign(Error(code),{code});};
 const digest=value=>createHash('sha256').update(value).digest('hex');
@@ -157,16 +166,26 @@ export function sandboxEnv(check,env,{root,home,tmp}){
   }
   return out;
 }
-// The files in the checkout's .git that tools read to choose files (ruff's
-// and biome's ignore rules): the repository's exclude file and config. The
-// observer does not watch .git, so they are compared as context.
+// The files in the repository's .git that tools read to choose files (ruff's
+// and biome's ignore rules), and that decide what sandbox-v2 hides: its
+// exclude file and config. For a project in a subdirectory of the
+// repository, also the .gitignore files above it. The observer watches
+// neither, so they are compared as context.
 function gitIgnoreSources(root){
-  let dir=path.join(root,'.git');
+  let top=root;
+  while(!fs.existsSync(path.join(top,'.git'))){const up=path.dirname(top);if(up===top)return [];top=up;}
+  let dir=path.join(top,'.git');
   try{if(fs.statSync(dir).isFile()){
-    const gitdir=path.resolve(root,/^gitdir:\s*(.+)$/m.exec(fs.readFileSync(dir,'utf8'))?.[1].trim()??'');
+    const gitdir=path.resolve(top,/^gitdir:\s*(.+)$/m.exec(fs.readFileSync(dir,'utf8'))?.[1].trim()??'');
     let common=gitdir;try{common=path.resolve(gitdir,fs.readFileSync(path.join(gitdir,'commondir'),'utf8').trim());}catch{}
     dir=common;}}catch{return [];}
-  return ['info/exclude','config'].map(rel=>{try{return [rel,digest(fs.readFileSync(path.join(dir,rel)))];}catch{return [rel,null];}});
+  const read=file=>{try{return digest(fs.readFileSync(file));}catch{return null;}};
+  const above=[];
+  for(let at=path.dirname(root);top!==root&&(at===top||at.startsWith(top+path.sep));at=path.dirname(at)){
+    above.push([path.relative(top,path.join(at,'.gitignore')),read(path.join(at,'.gitignore'))]);
+    if(at===top)break;
+  }
+  return [...['info/exclude','config'].map(rel=>[rel,read(path.join(dir,rel))]),...above];
 }
 // What a sandboxed result depends on outside the observed files, compared
 // before reuse, one entry each so a change can be named (sandboxChange): every
@@ -211,33 +230,102 @@ export function sandboxDirs(state,name){
   return {home,tmp:fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(),'redue-run-')))};
 }
 
+// The checkout's git-ignored entries a run may be kept from reading: what
+// `git ls-files --others --ignored --exclude-standard --directory` lists (a
+// wholly ignored directory as one entry, ending in /), but the installed
+// trees (node_modules, .venv) and runner caches. Relative to root. null when
+// git cannot list them. Only the project's rules count (.gitignore files and
+// .git/info/exclude), not a user's global excludes file, as on CI.
+const installedTree=/(?:^|\/)(?:node_modules|\.venv)(?:\/|$)/;
+const runnerCache=picomatch(sandboxCaches,{dot:true});
+const projectGit=['-c','core.excludesFile=/dev/null'],gitEnv=()=>({...process.env,GIT_OPTIONAL_LOCKS:'0'});
+export function hiddenEntries(root){
+  const r=spawnSync('git',[...projectGit,'ls-files','-z','--others','--ignored','--exclude-standard','--directory'],
+    {cwd:root,encoding:'utf8',maxBuffer:256*1024*1024,timeout:60000,stdio:['ignore','pipe','ignore'],env:gitEnv()});
+  if(r.status!==0)return null;
+  return r.stdout.split('\0').filter(Boolean).filter(rel=>!installedTree.test(rel)&&
+    !runnerCache(rel)&&!runnerCache(rel.replace(/\/$/,'')+'/x'));
+}
+
+// What git lists now as ignored at or beneath `paths` (relative files, or
+// directories ending in /), as hiddenEntries would: nested repositories are
+// not entered, and an entry that is an installed tree is not ignored (one
+// inside an ignored build directory is). {has(rel)} for a file, or null when
+// git cannot tell. A directory git ignores holds no file it does not, so
+// asking a new directory once covers its files.
+export function ignoredNow(root,paths){
+  const asked=paths;
+  if(!asked.length)return {has:()=>false};
+  const listed=new Set();
+  for(let at=0;at<asked.length;at+=500){
+    const r=spawnSync('git',[...projectGit,'ls-files','-z','--others','--ignored','--exclude-standard','--directory','--',...asked.slice(at,at+500)],
+      {cwd:root,encoding:'utf8',maxBuffer:256*1024*1024,timeout:10000,stdio:['ignore','pipe','ignore'],env:gitEnv()});
+    if(r.status!==0)return null;
+    for(const entry of r.stdout.split('\0'))if(entry)listed.add(entry);
+  }
+  const entries=[...listed].filter(entry=>!installedTree.test(entry));
+  return {has:rel=>entries.some(entry=>rel===entry||entry.endsWith('/')&&rel.startsWith(entry))};
+}
+// The files git tracks now beneath `entries` (relative). null when git cannot tell.
+export function trackedBeneath(root,entries){
+  if(!entries.length)return new Set();
+  const r=spawnSync('git',['ls-files','-z','--cached','--',...entries],
+    {cwd:root,encoding:'utf8',maxBuffer:256*1024*1024,timeout:10000,stdio:['ignore','pipe','ignore'],env:gitEnv()});
+  return r.status===0?new Set(r.stdout.split('\0').filter(Boolean)):null;
+}
+// A refusal line that names a hidden entry (relative): a refusal by the
+// sandbox, or a missing file, which Linux tools report for an unreadable one.
+export function hiddenRefusal(text,hidden){
+  const names=hidden.map(file=>file.replace(/\/$/,'')).filter(Boolean)
+    .map(name=>new RegExp(`(?:^|[\\s'"\`(=/])${escape(name)}(?:[/\\s'"\`):,]|$)`));
+  for(const line of String(text).split(/\r?\n/))
+    if((denial.test(line)||missing.test(line))&&names.some(name=>name.test(line)))return line.trim().slice(0,200);
+  return null;
+}
+
 const ancestors=list=>[...new Set(list.flatMap(dir=>{const out=[];for(let at=path.dirname(dir);at!=='/'&&at!=='.';at=path.dirname(at))out.push(at);return out;}))];
 // The Seatbelt profile: reads and executes only beneath the places, the
 // metadata of their parent directories, and no network but Unix sockets in
 // the run's own temporary directory (`own`), which is new for each run: a
-// daemon an earlier run left behind cannot answer a later one.
-export function seatbeltProfile(reads,own=null){
+// daemon an earlier run left behind cannot answer a later one. `hidden`:
+// absolute paths it may not read at all, not even their metadata.
+export function seatbeltProfile(reads,own=null,hidden=[]){
   const quote=value=>JSON.stringify(value);
   const all=[...new Set(reads.flatMap(dir=>[dir,real(dir)]).filter(Boolean))];
   return ['(version 1)','(allow default)','(deny file-read* process-exec*)',
     `(allow file-read* process-exec* ${all.map(dir=>`(subpath ${quote(dir)})`).join(' ')} (literal "/") (literal "/etc") (literal "/var") (literal "/tmp"))`,
     `(allow file-read-metadata ${ancestors(all).map(dir=>`(literal ${quote(dir)})`).join(' ')})`,
+    // The entry's own path, by its directory's real path: a hidden link's target is not hidden.
+    ...hidden.length?[`(deny file-read* process-exec* ${[...new Set(hidden.flatMap(file=>[file,path.join(real(path.dirname(file))??path.dirname(file),path.basename(file))]))]
+      .map(file=>`(subpath ${quote(file)})`).join(' ')})`]:[],
     '(deny network*)',...own?[`(allow network* ${[own,real(own)].filter(Boolean).map(dir=>`(subpath ${quote(dir)})`).join(' ')})`]:[]].join('\n');
 }
 // The argv that runs `argv` sandboxed: reads beneath `reads`, no network but
-// Unix sockets beneath `tmp` on macOS.
-export function sandboxArgv(mode,argv,{reads,tmp=null,python}){
-  if(mode==='seatbelt')return ['/usr/bin/sandbox-exec','-p',seatbeltProfile(reads,tmp),...argv];
+// Unix sockets beneath `tmp` on macOS, nothing beneath `hidden` (absolute).
+// On Linux a hidden directory can still be listed and its entries stat'ed:
+// Landlock restricts neither beneath a listable parent.
+export function sandboxArgv(mode,argv,{reads,tmp=null,python,hidden=[],stats=null}){
+  if(mode==='seatbelt')return ['/usr/bin/sandbox-exec','-p',seatbeltProfile(reads,tmp,hidden),...argv];
   // The launcher's own warnings would become the check's output.
-  if(mode==='landlock')return [python,'-I','-W','ignore',landlockScript,...reads.flatMap(dir=>['--read',dir]),'--no-tcp','--',...argv];
+  if(mode==='landlock')return [python,'-I','-W','ignore',landlockScript,...reads.flatMap(dir=>['--read',dir]),
+    ...hidden.flatMap(file=>['--hide',file]),...stats?['--stats',stats]:[],'--no-tcp','--',...argv];
   throw Error(`unknown sandbox ${mode}`);
 }
 // A line of a failed run's output that looks like the sandbox refused
 // something: a refused read or write, or the network unreachable. Such a
 // failure is run again outside the sandbox to tell a denial from a real one.
 const denial=/operation not permitted|permission denied|read-only file system|\bE(?:PERM|ACCES|ROFS|NOTFOUND|AI_AGAIN|CONNREFUSED|NETUNREACH|HOSTUNREACH)\b|sandbox-exec:|landlock\.py:|network is unreachable|could not resolve host|name or service not known|nodename nor servname|temporary failure in name resolution|getaddrinfo|connection refused/i;
-export function denialLine(text){
-  for(const line of String(text).split(/\r?\n/))if(denial.test(line))return line.trim().slice(0,200);
+// A missing file counts only when the line names a path the run was kept
+// from (`hidden`, relative to the checkout or absolute): Linux tools report
+// an unreadable file as not found.
+const missing=/not found|no such file|cannot find|can't find|could not find|cannot read|\bENOENT\b/i;
+const escape=text=>text.replace(/[.*+?^${}()|[\]\\]/g,'\\$&');
+export function denialLine(text,hidden=[]){
+  // A name as a whole path or path component, not inside a longer word.
+  const names=hidden.map(file=>file.replace(/\/$/,'')).filter(Boolean)
+    .map(name=>new RegExp(`(?:^|[\\s'"\`(=/])${escape(name)}(?:[/\\s'"\`):,]|$)`));
+  for(const line of String(text).split(/\r?\n/))
+    if(denial.test(line)||missing.test(line)&&names.some(name=>name.test(line)))return line.trim().slice(0,200);
   return null;
 }
 
@@ -366,7 +454,11 @@ export function runToEnd(argv,{cwd,env,timeout=0,echo=false,started=null}){
   });
 }
 // {same, plain, sandboxed, line} or {issue} when the sandbox cannot run here.
-export async function sandboxTrial(root,check,{timeout=300000}={}){
+// With `hide`, the git-ignored entries hiddenEntries lists are kept from the
+// sandboxed run, and it also returns them, their count, the run times and, on
+// Linux, the launcher's rule count and setup time.
+// `plain`: the plain run of an earlier trial of the same check, reused.
+export async function sandboxTrial(root,check,{timeout=300000,hide=false,plain:earlier=null}={}){
   const supported=sandboxSupport();
   if(supported.issue)return {issue:supported.issue};
   const python=Boolean(pythonTool(check));
@@ -375,13 +467,16 @@ export async function sandboxTrial(root,check,{timeout=300000}={}){
   const scratch=fs.mkdtempSync(path.join(os.tmpdir(),'redue-trial-')),home=path.join(scratch,'home'),tmp=path.join(scratch,'tmp');
   fs.mkdirSync(home);fs.mkdirSync(tmp);
   try{
-    const run=async(argv,env)=>{const r=await runToEnd(argv,{cwd:root,env,timeout});
-      return {status:r.timedOut?'timeout':r.status??r.signal??r.error?.code,output:`${r.stdout}\n${r.stderr}`};};
-    const plain=await run(command,{...process.env,...python?{}:{npm_config_update_notifier:'false'}});
+    const entries=hide?hiddenEntries(root):[];
+    if(!entries)return {issue:hiddenListIssue};
+    const hidden=entries.map(rel=>path.join(root,rel.replace(/\/$/,""))),stats=hide&&supported.mode==='landlock'?path.join(scratch,'stats.json'):null;
+    const run=async(argv,env)=>{const started=Date.now(),r=await runToEnd(argv,{cwd:root,env,timeout});
+      return {status:r.timedOut?'timeout':r.status??r.signal??r.error?.code,output:`${r.stdout}\n${r.stderr}`,ms:Date.now()-started};};
+    const plain=earlier??await run(command,{...process.env,...python?{}:{npm_config_update_notifier:'false'}});
     const reads=[root,home,tmp,...sandboxPlaces(selected,process.env,root),...systemPlaces];
-    const sandboxed=await run(sandboxArgv(supported.mode,command,{reads,tmp,python:supported.python}),sandboxEnv(selected,process.env,{root,home,tmp}));
+    const sandboxed=await run(sandboxArgv(supported.mode,command,{reads,tmp,python:supported.python,hidden,stats}),sandboxEnv(selected,process.env,{root,home,tmp}));
     // A failure both ways counts as the same only without a sign of a refusal.
-    const denied=sandboxed.status===0?null:denialLine(sandboxed.output);
+    const denied=sandboxed.status===0?null:denialLine(sandboxed.output,entries);
     const realOf=dir=>{try{return fs.realpathSync(dir);}catch{return null;}},plainTmp=process.env.TMPDIR||os.tmpdir();
     const paths=[[home,'<home>'],[realOf(home),'<home>'],[tmp,'<tmp>'],[realOf(tmp),'<tmp>'],[plainTmp,'<tmp>'],[realOf(plainTmp),'<tmp>'],
       [os.homedir(),'<home>'],[realOf(os.homedir()),'<home>']];
@@ -390,7 +485,9 @@ export async function sandboxTrial(root,check,{timeout=300000}={}){
     let at=a.findIndex((line,i)=>line!==b[i]);
     if(at<0&&b.length>a.length)at=a.length;
     const output=at<0?null:{plain:(a[at]??'(no more output)').slice(0,160),sandboxed:(b[at]??'(no more output)').slice(0,160)};
-    return {same:plain.status===sandboxed.status&&!denied&&!output,plain:plain.status,sandboxed:sandboxed.status,output,
-      line:denied||(plain.status===sandboxed.status?null:sandboxed.output.trim().split('\n').at(-1)?.slice(0,200)||null)};
+    let launcher=null;if(stats)try{launcher=JSON.parse(fs.readFileSync(stats,'utf8'));}catch{}
+    return {same:plain.status===sandboxed.status&&!denied&&!output,plain:plain.status,sandboxed:sandboxed.status,output,plainRun:plain,
+      line:denied||(plain.status===sandboxed.status?null:sandboxed.output.trim().split('\n').at(-1)?.slice(0,200)||null),
+      ...hide?{hidden:entries.length,entries,plainMs:plain.ms,sandboxedMs:sandboxed.ms,...launcher?{rules:launcher.rules,setupMs:launcher.ms}:{}}:{}};
   }finally{fs.rmSync(scratch,{recursive:true,force:true});}
 }

package/src/stats.mjs

@@ -0,0 +1,72 @@
+// `redue stats`: what REDUE did for each check, from a local log. The hook,
+// `run --if-due` and recorded runs append one line each to stats-v1.jsonl in
+// the project's state: a skip (with the skipped run's duration), a recorded
+// run, or a check that was due (STALE or UNVERIFIED, with the reason). The log
+// stays on this machine and goes away with `redue remove-state`.
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const statsFile=state=>path.join(state,'stats-v1.jsonl');
+
+// Never fails the command it is called from.
+export function note(state,entry){
+  try{fs.appendFileSync(statsFile(state),JSON.stringify({at:Date.now(),...entry})+'\n',{mode:0o600});}catch{}
+}
+
+// A skip of `name`, from a status row that allowed it.
+export const skipNote=(status,name,via)=>{
+  const ms=status?.checks?.find(row=>row?.name===name)?.invocation?.durationMs;
+  return {kind:'skip',check:name,via,savedMs:Number.isFinite(ms)&&ms>=0?ms:null};
+};
+// A check about to run because its last result does not apply, or null.
+export const dueNote=(status,name)=>{
+  const row=status?.observation?.healthy===true?status.checks?.find(item=>item?.name===name):null;
+  return row&&row.freshness!=='CURRENT'?{kind:'due',check:name,freshness:row.freshness,reason:row.reason??null}:null;
+};
+
+// Run ids, hashes and digits in a reason say nothing about its kind.
+const reasonKind=reason=>String(reason??'no reason').replace(/[0-9a-f]{8}(?:-?[0-9a-f]{4,})+|[0-9a-f]{12,}/g,'…').slice(0,160);
+
+export function readStats(state,names=[]){
+  let text='';try{text=fs.readFileSync(statsFile(state),'utf8');}catch{}
+  // Configured checks first, in config order, then any the log still names.
+  const checks=new Map();
+  const row=name=>{let value=checks.get(name);
+    if(!value)checks.set(name,value={name,skips:0,savedMs:0,runs:0,passed:0,failed:0,runMs:0,stale:0,unverified:0,reasons:{}});
+    return value;};
+  for(const name of names)row(name);
+  let since=null;
+  for(const line of text.split('\n')){
+    let entry;try{entry=JSON.parse(line);}catch{continue;}
+    if(typeof entry?.check!=='string')continue;
+    since??=entry.at;
+    const value=row(entry.check);
+    if(entry.kind==='skip'){value.skips++;value.savedMs+=entry.savedMs??0;}
+    else if(entry.kind==='run'){value.runs++;value.runMs+=entry.ms??0;
+      if(entry.result==='PASS')value.passed++;else if(entry.result==='FAIL')value.failed++;}
+    else if(entry.kind==='due'&&entry.freshness==='STALE')value.stale++;
+    else if(entry.kind==='due'&&entry.freshness==='UNVERIFIED'){value.unverified++;
+      const kind=reasonKind(entry.reason);value.reasons[kind]=(value.reasons[kind]??0)+1;}
+  }
+  const list=[...checks.values()].map(({reasons,...value})=>({...value,
+    topUnverified:Object.entries(reasons).sort((a,b)=>b[1]-a[1]).slice(0,3).map(([reason,count])=>({reason,count}))}));
+  return {schema:1,since:since===null?null:new Date(since).toISOString(),checks:list};
+}
+
+export const duration=ms=>!ms?'0s':ms<60_000?`${(ms/1000).toFixed(ms<10_000?1:0)}s`:
+  ms<3_600_000?`${Math.floor(ms/60_000)}m ${Math.round(ms%60_000/1000)}s`:`${Math.floor(ms/3_600_000)}h ${Math.round(ms%3_600_000/60_000)}m`;
+
+export function renderStats(value){
+  if(!value.since)return 'No skips or recorded runs yet.';
+  const head=['check','skips','saved','runs','pass','fail','stale','unverified'];
+  const rows=value.checks.map(c=>[c.name,c.skips,duration(c.savedMs),c.runs,c.passed,c.failed,c.stale,c.unverified].map(String));
+  const total=value.checks.reduce((sum,c)=>({skips:sum.skips+c.skips,savedMs:sum.savedMs+c.savedMs}),{skips:0,savedMs:0});
+  const widths=head.map((h,i)=>Math.max(h.length,...rows.map(r=>r[i].length)));
+  const line=r=>r.map((cell,i)=>i?cell.padStart(widths[i]):cell.padEnd(widths[i])).join('  ');
+  const lines=[`Since ${value.since.slice(0,10)}: ${total.skips} skips saved ${duration(total.savedMs)}.`,'',line(head),...rows.map(line)];
+  const reasons=value.checks.filter(c=>c.topUnverified.length);
+  if(reasons.length){lines.push('','Why checks were UNVERIFIED when they were due:');
+    for(const c of reasons)for(const r of c.topUnverified)lines.push(`  ${c.name}  ${r.count}×  ${r.reason}`);}
+  lines.push('','Saved is the duration of the run each skip reused.');
+  return lines.join('\n');
+}